library/psa_crypto.c

/*
 *  PSA crypto layer on top of Mbed TLS crypto
 */
/*
 *  Copyright The Mbed TLS Contributors
 *  SPDX-License-Identifier: Apache-2.0
 *
 *  Licensed under the Apache License, Version 2.0 (the "License"); you may
 *  not use this file except in compliance with the License.
 *  You may obtain a copy of the License at
 *
 *  http://www.apache.org/licenses/LICENSE-2.0
 *
 *  Unless required by applicable law or agreed to in writing, software
 *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
 *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *  See the License for the specific language governing permissions and
 *  limitations under the License.
 */

#include "common.h"

#if defined(MBEDTLS_PSA_CRYPTO_C)

#    if defined(MBEDTLS_PSA_CRYPTO_CONFIG)
#        include "check_crypto_config.h"
#    endif

#    include "psa/crypto.h"

#    include "psa_crypto_cipher.h"
#    include "psa_crypto_core.h"
#    include "psa_crypto_invasive.h"
#    include "psa_crypto_driver_wrappers.h"
#    include "psa_crypto_ecp.h"
#    include "psa_crypto_hash.h"
#    include "psa_crypto_mac.h"
#    include "psa_crypto_rsa.h"
#    include "psa_crypto_ecp.h"
#    if defined(MBEDTLS_PSA_CRYPTO_SE_C)
#        include "psa_crypto_se.h"
#    endif
#    include "psa_crypto_slot_management.h"
/* Include internal declarations that are useful for implementing persistently
 * stored keys. */
#    include "psa_crypto_storage.h"

#    include "psa_crypto_random_impl.h"

#    include <assert.h>
#    include <stdlib.h>
#    include <string.h>
#    include "mbedtls/platform.h"
#    if !defined(MBEDTLS_PLATFORM_C)
#        define mbedtls_calloc calloc
#        define mbedtls_free   free
#    endif

#    include "mbedtls/aes.h"
#    include "mbedtls/asn1.h"
#    include "mbedtls/asn1write.h"
#    include "mbedtls/bignum.h"
#    include "mbedtls/camellia.h"
#    include "mbedtls/chacha20.h"
#    include "mbedtls/chachapoly.h"
#    include "mbedtls/cipher.h"
#    include "mbedtls/ccm.h"
#    include "mbedtls/cmac.h"
#    include "mbedtls/des.h"
#    include "mbedtls/ecdh.h"
#    include "mbedtls/ecp.h"
#    include "mbedtls/entropy.h"
#    include "mbedtls/error.h"
#    include "mbedtls/gcm.h"
#    include "mbedtls/md5.h"
#    include "mbedtls/md.h"
#    include "md_wrap.h"
#    include "mbedtls/pk.h"
#    include "pk_wrap.h"
#    include "mbedtls/platform_util.h"
#    include "mbedtls/error.h"
#    include "mbedtls/ripemd160.h"
#    include "mbedtls/rsa.h"
#    include "mbedtls/sha1.h"
#    include "mbedtls/sha256.h"
#    include "mbedtls/sha512.h"

#    define ARRAY_LENGTH(array) (sizeof(array) / sizeof(*(array)))

/****************************************************************/
/* Global data, support functions and library management */
/****************************************************************/

static int key_type_is_raw_bytes(psa_key_type_t type)
{
    return PSA_KEY_TYPE_IS_UNSTRUCTURED(type);
}

/* Values for psa_global_data_t::rng_state */
#    define RNG_NOT_INITIALIZED 0
#    define RNG_INITIALIZED     1
#    define RNG_SEEDED          2

typedef struct {
    mbedtls_psa_random_context_t rng;
    unsigned initialized : 1;
    unsigned rng_state   : 2;
} psa_global_data_t;

static psa_global_data_t global_data;

#    if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
mbedtls_psa_drbg_context_t *const mbedtls_psa_random_state =
    &global_data.rng.drbg;
#    endif

#    define GUARD_MODULE_INITIALIZED      \
        if (global_data.initialized == 0) \
            return PSA_ERROR_BAD_STATE;

psa_status_t mbedtls_to_psa_error(int ret)
{
    /* Mbed TLS error codes can combine a high-level error code and a
     * low-level error code. The low-level error usually reflects the
     * root cause better, so dispatch on that preferably. */
    int low_level_ret = -(-ret & 0x007f);
    switch (low_level_ret != 0 ? low_level_ret : ret) {
        case 0:
            return PSA_SUCCESS;

        case MBEDTLS_ERR_AES_INVALID_KEY_LENGTH:
        case MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH:
            return PSA_ERROR_NOT_SUPPORTED;
        case MBEDTLS_ERR_ASN1_OUT_OF_DATA:
        case MBEDTLS_ERR_ASN1_UNEXPECTED_TAG:
        case MBEDTLS_ERR_ASN1_INVALID_LENGTH:
        case MBEDTLS_ERR_ASN1_LENGTH_MISMATCH:
        case MBEDTLS_ERR_ASN1_INVALID_DATA:
            return PSA_ERROR_INVALID_ARGUMENT;
        case MBEDTLS_ERR_ASN1_ALLOC_FAILED:
            return PSA_ERROR_INSUFFICIENT_MEMORY;
        case MBEDTLS_ERR_ASN1_BUF_TOO_SMALL:
            return PSA_ERROR_BUFFER_TOO_SMALL;

#    if defined(MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA)
        case MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA:
#    endif
        case MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH:
            return PSA_ERROR_NOT_SUPPORTED;

        case MBEDTLS_ERR_CCM_BAD_INPUT:
            return PSA_ERROR_INVALID_ARGUMENT;
        case MBEDTLS_ERR_CCM_AUTH_FAILED:
            return PSA_ERROR_INVALID_SIGNATURE;

        case MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA:
            return PSA_ERROR_INVALID_ARGUMENT;

        case MBEDTLS_ERR_CHACHAPOLY_BAD_STATE:
            return PSA_ERROR_BAD_STATE;
        case MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED:
            return PSA_ERROR_INVALID_SIGNATURE;

        case MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE:
            return PSA_ERROR_NOT_SUPPORTED;
        case MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA:
            return PSA_ERROR_INVALID_ARGUMENT;
        case MBEDTLS_ERR_CIPHER_ALLOC_FAILED:
            return PSA_ERROR_INSUFFICIENT_MEMORY;
        case MBEDTLS_ERR_CIPHER_INVALID_PADDING:
            return PSA_ERROR_INVALID_PADDING;
        case MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED:
            return PSA_ERROR_INVALID_ARGUMENT;
        case MBEDTLS_ERR_CIPHER_AUTH_FAILED:
            return PSA_ERROR_INVALID_SIGNATURE;
        case MBEDTLS_ERR_CIPHER_INVALID_CONTEXT:
            return PSA_ERROR_CORRUPTION_DETECTED;

#    if !(defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) || \
          defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE))
        /* Only check CTR_DRBG error codes if underlying mbedtls_xxx
         * functions are passed a CTR_DRBG instance. */
        case MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED:
            return PSA_ERROR_INSUFFICIENT_ENTROPY;
        case MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG:
        case MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG:
            return PSA_ERROR_NOT_SUPPORTED;
        case MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR:
            return PSA_ERROR_INSUFFICIENT_ENTROPY;
#    endif

        case MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH:
            return PSA_ERROR_NOT_SUPPORTED;

        case MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED:
        case MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE:
        case MBEDTLS_ERR_ENTROPY_SOURCE_FAILED:
            return PSA_ERROR_INSUFFICIENT_ENTROPY;

        case MBEDTLS_ERR_GCM_AUTH_FAILED:
            return PSA_ERROR_INVALID_SIGNATURE;
        case MBEDTLS_ERR_GCM_BAD_INPUT:
            return PSA_ERROR_INVALID_ARGUMENT;

#    if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) && \
        defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE)
        /* Only check HMAC_DRBG error codes if underlying mbedtls_xxx
         * functions are passed a HMAC_DRBG instance. */
        case MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED:
            return PSA_ERROR_INSUFFICIENT_ENTROPY;
        case MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG:
        case MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG:
            return PSA_ERROR_NOT_SUPPORTED;
        case MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR:
            return PSA_ERROR_INSUFFICIENT_ENTROPY;
#    endif

        case MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE:
            return PSA_ERROR_NOT_SUPPORTED;
        case MBEDTLS_ERR_MD_BAD_INPUT_DATA:
            return PSA_ERROR_INVALID_ARGUMENT;
        case MBEDTLS_ERR_MD_ALLOC_FAILED:
            return PSA_ERROR_INSUFFICIENT_MEMORY;
        case MBEDTLS_ERR_MD_FILE_IO_ERROR:
            return PSA_ERROR_STORAGE_FAILURE;

        case MBEDTLS_ERR_MPI_FILE_IO_ERROR:
            return PSA_ERROR_STORAGE_FAILURE;
        case MBEDTLS_ERR_MPI_BAD_INPUT_DATA:
            return PSA_ERROR_INVALID_ARGUMENT;
        case MBEDTLS_ERR_MPI_INVALID_CHARACTER:
            return PSA_ERROR_INVALID_ARGUMENT;
        case MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL:
            return PSA_ERROR_BUFFER_TOO_SMALL;
        case MBEDTLS_ERR_MPI_NEGATIVE_VALUE:
            return PSA_ERROR_INVALID_ARGUMENT;
        case MBEDTLS_ERR_MPI_DIVISION_BY_ZERO:
            return PSA_ERROR_INVALID_ARGUMENT;
        case MBEDTLS_ERR_MPI_NOT_ACCEPTABLE:
            return PSA_ERROR_INVALID_ARGUMENT;
        case MBEDTLS_ERR_MPI_ALLOC_FAILED:
            return PSA_ERROR_INSUFFICIENT_MEMORY;

        case MBEDTLS_ERR_PK_ALLOC_FAILED:
            return PSA_ERROR_INSUFFICIENT_MEMORY;
        case MBEDTLS_ERR_PK_TYPE_MISMATCH:
        case MBEDTLS_ERR_PK_BAD_INPUT_DATA:
            return PSA_ERROR_INVALID_ARGUMENT;
        case MBEDTLS_ERR_PK_FILE_IO_ERROR:
            return PSA_ERROR_STORAGE_FAILURE;
        case MBEDTLS_ERR_PK_KEY_INVALID_VERSION:
        case MBEDTLS_ERR_PK_KEY_INVALID_FORMAT:
            return PSA_ERROR_INVALID_ARGUMENT;
        case MBEDTLS_ERR_PK_UNKNOWN_PK_ALG:
            return PSA_ERROR_NOT_SUPPORTED;
        case MBEDTLS_ERR_PK_PASSWORD_REQUIRED:
        case MBEDTLS_ERR_PK_PASSWORD_MISMATCH:
            return PSA_ERROR_NOT_PERMITTED;
        case MBEDTLS_ERR_PK_INVALID_PUBKEY:
            return PSA_ERROR_INVALID_ARGUMENT;
        case MBEDTLS_ERR_PK_INVALID_ALG:
        case MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE:
        case MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE:
            return PSA_ERROR_NOT_SUPPORTED;
        case MBEDTLS_ERR_PK_SIG_LEN_MISMATCH:
            return PSA_ERROR_INVALID_SIGNATURE;
        case MBEDTLS_ERR_PK_BUFFER_TOO_SMALL:
            return PSA_ERROR_BUFFER_TOO_SMALL;

        case MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED:
            return PSA_ERROR_HARDWARE_FAILURE;
        case MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
            return PSA_ERROR_NOT_SUPPORTED;

        case MBEDTLS_ERR_RSA_BAD_INPUT_DATA:
            return PSA_ERROR_INVALID_ARGUMENT;
        case MBEDTLS_ERR_RSA_INVALID_PADDING:
            return PSA_ERROR_INVALID_PADDING;
        case MBEDTLS_ERR_RSA_KEY_GEN_FAILED:
            return PSA_ERROR_HARDWARE_FAILURE;
        case MBEDTLS_ERR_RSA_KEY_CHECK_FAILED:
            return PSA_ERROR_INVALID_ARGUMENT;
        case MBEDTLS_ERR_RSA_PUBLIC_FAILED:
        case MBEDTLS_ERR_RSA_PRIVATE_FAILED:
            return PSA_ERROR_CORRUPTION_DETECTED;
        case MBEDTLS_ERR_RSA_VERIFY_FAILED:
            return PSA_ERROR_INVALID_SIGNATURE;
        case MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE:
            return PSA_ERROR_BUFFER_TOO_SMALL;
        case MBEDTLS_ERR_RSA_RNG_FAILED:
            return PSA_ERROR_INSUFFICIENT_ENTROPY;

        case MBEDTLS_ERR_ECP_BAD_INPUT_DATA:
        case MBEDTLS_ERR_ECP_INVALID_KEY:
            return PSA_ERROR_INVALID_ARGUMENT;
        case MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL:
            return PSA_ERROR_BUFFER_TOO_SMALL;
        case MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE:
            return PSA_ERROR_NOT_SUPPORTED;
        case MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH:
        case MBEDTLS_ERR_ECP_VERIFY_FAILED:
            return PSA_ERROR_INVALID_SIGNATURE;
        case MBEDTLS_ERR_ECP_ALLOC_FAILED:
            return PSA_ERROR_INSUFFICIENT_MEMORY;
        case MBEDTLS_ERR_ECP_RANDOM_FAILED:
            return PSA_ERROR_INSUFFICIENT_ENTROPY;

        case MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED:
            return PSA_ERROR_CORRUPTION_DETECTED;

        default:
            return PSA_ERROR_GENERIC_ERROR;
    }
}

/****************************************************************/
/* Key management */
/****************************************************************/

#    if defined(MBEDTLS_PSA_CRYPTO_SE_C)
static inline int psa_key_slot_is_external(const psa_key_slot_t *slot)
{
    return psa_key_lifetime_is_external(slot->attr.lifetime);
}
#    endif /* MBEDTLS_PSA_CRYPTO_SE_C */

/* For now the MBEDTLS_PSA_ACCEL_ guards are also used here since the
 * current test driver in key_management.c is using this function
 * when accelerators are used for ECC key pair and public key.
 * Once that dependency is resolved these guards can be removed.
 */
#    if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||   \
        defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) || \
        defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR) ||     \
        defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY)
mbedtls_ecp_group_id mbedtls_ecc_group_of_psa(psa_ecc_family_t curve,
                                              size_t bits,
                                              int bits_is_sloppy)
{
    switch (curve) {
        case PSA_ECC_FAMILY_SECP_R1:
            switch (bits) {
#        if defined(PSA_WANT_ECC_SECP_R1_192)
                case 192:
                    return MBEDTLS_ECP_DP_SECP192R1;
#        endif
#        if defined(PSA_WANT_ECC_SECP_R1_224)
                case 224:
                    return MBEDTLS_ECP_DP_SECP224R1;
#        endif
#        if defined(PSA_WANT_ECC_SECP_R1_256)
                case 256:
                    return MBEDTLS_ECP_DP_SECP256R1;
#        endif
#        if defined(PSA_WANT_ECC_SECP_R1_384)
                case 384:
                    return MBEDTLS_ECP_DP_SECP384R1;
#        endif
#        if defined(PSA_WANT_ECC_SECP_R1_521)
                case 521:
                    return MBEDTLS_ECP_DP_SECP521R1;
                case 528:
                    if (bits_is_sloppy)
                        return MBEDTLS_ECP_DP_SECP521R1;
                    break;
#        endif
            }
            break;

        case PSA_ECC_FAMILY_BRAINPOOL_P_R1:
            switch (bits) {
#        if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_256)
                case 256:
                    return MBEDTLS_ECP_DP_BP256R1;
#        endif
#        if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_384)
                case 384:
                    return MBEDTLS_ECP_DP_BP384R1;
#        endif
#        if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_512)
                case 512:
                    return MBEDTLS_ECP_DP_BP512R1;
#        endif
            }
            break;

        case PSA_ECC_FAMILY_MONTGOMERY:
            switch (bits) {
#        if defined(PSA_WANT_ECC_MONTGOMERY_255)
                case 255:
                    return MBEDTLS_ECP_DP_CURVE25519;
                case 256:
                    if (bits_is_sloppy)
                        return MBEDTLS_ECP_DP_CURVE25519;
                    break;
#        endif
#        if defined(PSA_WANT_ECC_MONTGOMERY_448)
                case 448:
                    return MBEDTLS_ECP_DP_CURVE448;
#        endif
            }
            break;

        case PSA_ECC_FAMILY_SECP_K1:
            switch (bits) {
#        if defined(PSA_WANT_ECC_SECP_K1_192)
                case 192:
                    return MBEDTLS_ECP_DP_SECP192K1;
#        endif
#        if defined(PSA_WANT_ECC_SECP_K1_224)
                case 224:
                    return MBEDTLS_ECP_DP_SECP224K1;
#        endif
#        if defined(PSA_WANT_ECC_SECP_K1_256)
                case 256:
                    return MBEDTLS_ECP_DP_SECP256K1;
#        endif
            }
            break;
    }

    (void)bits_is_sloppy;
    return MBEDTLS_ECP_DP_NONE;
}
#    endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||   \
            * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) || \
            * defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR) ||     \
            * defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY) */

static psa_status_t validate_unstructured_key_bit_size(psa_key_type_t type,
                                                       size_t bits)
{
    /* Check that the bit size is acceptable for the key type */
    switch (type) {
        case PSA_KEY_TYPE_RAW_DATA:
        case PSA_KEY_TYPE_HMAC:
        case PSA_KEY_TYPE_DERIVE:
            break;
#    if defined(PSA_WANT_KEY_TYPE_AES)
        case PSA_KEY_TYPE_AES:
            if (bits != 128 && bits != 192 && bits != 256)
                return PSA_ERROR_INVALID_ARGUMENT;
            break;
#    endif
#    if defined(PSA_WANT_KEY_TYPE_CAMELLIA)
        case PSA_KEY_TYPE_CAMELLIA:
            if (bits != 128 && bits != 192 && bits != 256)
                return PSA_ERROR_INVALID_ARGUMENT;
            break;
#    endif
#    if defined(PSA_WANT_KEY_TYPE_DES)
        case PSA_KEY_TYPE_DES:
            if (bits != 64 && bits != 128 && bits != 192)
                return PSA_ERROR_INVALID_ARGUMENT;
            break;
#    endif
#    if defined(PSA_WANT_KEY_TYPE_CHACHA20)
        case PSA_KEY_TYPE_CHACHA20:
            if (bits != 256)
                return PSA_ERROR_INVALID_ARGUMENT;
            break;
#    endif
        default:
            return PSA_ERROR_NOT_SUPPORTED;
    }
    if (bits % 8 != 0)
        return PSA_ERROR_INVALID_ARGUMENT;

    return PSA_SUCCESS;
}

/** Check whether a given key type is valid for use with a given MAC algorithm
 *
 * Upon successful return of this function, the behavior of #PSA_MAC_LENGTH
 * when called with the validated \p algorithm and \p key_type is well-defined.
 *
 * \param[in] algorithm     The specific MAC algorithm (can be wildcard).
 * \param[in] key_type      The key type of the key to be used with the
 *                          \p algorithm.
 *
 * \retval #PSA_SUCCESS
 *         The \p key_type is valid for use with the \p algorithm
 * \retval #PSA_ERROR_INVALID_ARGUMENT
 *         The \p key_type is not valid for use with the \p algorithm
 */
MBEDTLS_STATIC_TESTABLE psa_status_t
psa_mac_key_can_do(psa_algorithm_t algorithm, psa_key_type_t key_type)
{
    if (PSA_ALG_IS_HMAC(algorithm)) {
        if (key_type == PSA_KEY_TYPE_HMAC)
            return PSA_SUCCESS;
    }

    if (PSA_ALG_IS_BLOCK_CIPHER_MAC(algorithm)) {
        /* Check that we're calling PSA_BLOCK_CIPHER_BLOCK_LENGTH with a cipher
         * key. */
        if ((key_type & PSA_KEY_TYPE_CATEGORY_MASK) ==
            PSA_KEY_TYPE_CATEGORY_SYMMETRIC) {
            /* PSA_BLOCK_CIPHER_BLOCK_LENGTH returns 1 for stream ciphers and
             * the block length (larger than 1) for block ciphers. */
            if (PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type) > 1)
                return PSA_SUCCESS;
        }
    }

    return PSA_ERROR_INVALID_ARGUMENT;
}

psa_status_t psa_allocate_buffer_to_slot(psa_key_slot_t *slot,
                                         size_t buffer_length)
{
    if (slot->key.data != NULL)
        return PSA_ERROR_ALREADY_EXISTS;

    slot->key.data = mbedtls_calloc(1, buffer_length);
    if (slot->key.data == NULL)
        return PSA_ERROR_INSUFFICIENT_MEMORY;

    slot->key.bytes = buffer_length;
    return PSA_SUCCESS;
}

psa_status_t psa_copy_key_material_into_slot(psa_key_slot_t *slot,
                                             const uint8_t *data,
                                             size_t data_length)
{
    psa_status_t status = psa_allocate_buffer_to_slot(slot, data_length);
    if (status != PSA_SUCCESS)
        return status;

    memcpy(slot->key.data, data, data_length);
    return PSA_SUCCESS;
}

psa_status_t psa_import_key_into_slot(const psa_key_attributes_t *attributes,
                                      const uint8_t *data,
                                      size_t data_length,
                                      uint8_t *key_buffer,
                                      size_t key_buffer_size,
                                      size_t *key_buffer_length,
                                      size_t *bits)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_key_type_t type = attributes->core.type;

    /* zero-length keys are never supported. */
    if (data_length == 0)
        return PSA_ERROR_NOT_SUPPORTED;

    if (key_type_is_raw_bytes(type)) {
        *bits = PSA_BYTES_TO_BITS(data_length);

        /* Ensure that the bytes-to-bits conversion hasn't overflown. */
        if (data_length > SIZE_MAX / 8)
            return PSA_ERROR_NOT_SUPPORTED;

        /* Enforce a size limit, and in particular ensure that the bit
         * size fits in its representation type. */
        if ((*bits) > PSA_MAX_KEY_BITS)
            return PSA_ERROR_NOT_SUPPORTED;

        status = validate_unstructured_key_bit_size(type, *bits);
        if (status != PSA_SUCCESS)
            return status;

        /* Copy the key material. */
        memcpy(key_buffer, data, data_length);
        *key_buffer_length = data_length;
        (void)key_buffer_size;

        return PSA_SUCCESS;
    } else if (PSA_KEY_TYPE_IS_ASYMMETRIC(type)) {
#    if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
        defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)
        if (PSA_KEY_TYPE_IS_ECC(type)) {
            return (mbedtls_psa_ecp_import_key(attributes, data, data_length,
                                               key_buffer, key_buffer_size,
                                               key_buffer_length, bits));
        }
#    endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
            * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
#    if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
        defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
        if (PSA_KEY_TYPE_IS_RSA(type)) {
            return (mbedtls_psa_rsa_import_key(attributes, data, data_length,
                                               key_buffer, key_buffer_size,
                                               key_buffer_length, bits));
        }
#    endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
            * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
    }

    return PSA_ERROR_NOT_SUPPORTED;
}

/** Calculate the intersection of two algorithm usage policies.
 *
 * Return 0 (which allows no operation) on incompatibility.
 */
static psa_algorithm_t
psa_key_policy_algorithm_intersection(psa_key_type_t key_type,
                                      psa_algorithm_t alg1,
                                      psa_algorithm_t alg2)
{
    /* Common case: both sides actually specify the same policy. */
    if (alg1 == alg2)
        return alg1;
    /* If the policies are from the same hash-and-sign family, check
     * if one is a wildcard. If so the other has the specific algorithm. */
    if (PSA_ALG_IS_HASH_AND_SIGN(alg1) && PSA_ALG_IS_HASH_AND_SIGN(alg2) &&
        (alg1 & ~PSA_ALG_HASH_MASK) == (alg2 & ~PSA_ALG_HASH_MASK)) {
        if (PSA_ALG_SIGN_GET_HASH(alg1) == PSA_ALG_ANY_HASH)
            return alg2;
        if (PSA_ALG_SIGN_GET_HASH(alg2) == PSA_ALG_ANY_HASH)
            return alg1;
    }
    /* If the policies are from the same AEAD family, check whether
     * one of them is a minimum-tag-length wildcard. Calculate the most
     * restrictive tag length. */
    if (PSA_ALG_IS_AEAD(alg1) && PSA_ALG_IS_AEAD(alg2) &&
        (PSA_ALG_AEAD_WITH_SHORTENED_TAG(alg1, 0) ==
         PSA_ALG_AEAD_WITH_SHORTENED_TAG(alg2, 0))) {
        size_t alg1_len = PSA_ALG_AEAD_GET_TAG_LENGTH(alg1);
        size_t alg2_len = PSA_ALG_AEAD_GET_TAG_LENGTH(alg2);
        size_t restricted_len = alg1_len > alg2_len ? alg1_len : alg2_len;

        /* If both are wildcards, return most restrictive wildcard */
        if (((alg1 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
            ((alg2 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0)) {
            return (PSA_ALG_AEAD_WITH_AT_LEAST_THIS_LENGTH_TAG(alg1,
                                                               restricted_len));
        }
        /* If only one is a wildcard, return specific algorithm if compatible.
         */
        if (((alg1 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
            (alg1_len <= alg2_len)) {
            return alg2;
        }
        if (((alg2 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
            (alg2_len <= alg1_len)) {
            return alg1;
        }
    }
    /* If the policies are from the same MAC family, check whether one
     * of them is a minimum-MAC-length policy. Calculate the most
     * restrictive tag length. */
    if (PSA_ALG_IS_MAC(alg1) && PSA_ALG_IS_MAC(alg2) &&
        (PSA_ALG_FULL_LENGTH_MAC(alg1) == PSA_ALG_FULL_LENGTH_MAC(alg2))) {
        /* Validate the combination of key type and algorithm. Since the base
         * algorithm of alg1 and alg2 are the same, we only need this once. */
        if (PSA_SUCCESS != psa_mac_key_can_do(alg1, key_type))
            return 0;

        /* Get the (exact or at-least) output lengths for both sides of the
         * requested intersection. None of the currently supported algorithms
         * have an output length dependent on the actual key size, so setting it
         * to a bogus value of 0 is currently OK.
         *
         * Note that for at-least-this-length wildcard algorithms, the output
         * length is set to the shortest allowed length, which allows us to
         * calculate the most restrictive tag length for the intersection. */
        size_t alg1_len = PSA_MAC_LENGTH(key_type, 0, alg1);
        size_t alg2_len = PSA_MAC_LENGTH(key_type, 0, alg2);
        size_t restricted_len = alg1_len > alg2_len ? alg1_len : alg2_len;

        /* If both are wildcards, return most restrictive wildcard */
        if (((alg1 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
            ((alg2 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0)) {
            return PSA_ALG_AT_LEAST_THIS_LENGTH_MAC(alg1, restricted_len);
        }

        /* If only one is an at-least-this-length policy, the intersection would
         * be the other (fixed-length) policy as long as said fixed length is
         * equal to or larger than the shortest allowed length. */
        if ((alg1 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) {
            return (alg1_len <= alg2_len) ? alg2 : 0;
        }
        if ((alg2 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) {
            return (alg2_len <= alg1_len) ? alg1 : 0;
        }

        /* If none of them are wildcards, check whether they define the same tag
         * length. This is still possible here when one is default-length and
         * the other specific-length. Ensure to always return the
         * specific-length version for the intersection. */
        if (alg1_len == alg2_len)
            return PSA_ALG_TRUNCATED_MAC(alg1, alg1_len);
    }
    /* If the policies are incompatible, allow nothing. */
    return 0;
}

static int psa_key_algorithm_permits(psa_key_type_t key_type,
                                     psa_algorithm_t policy_alg,
                                     psa_algorithm_t requested_alg)
{
    /* Common case: the policy only allows requested_alg. */
    if (requested_alg == policy_alg)
        return 1;
    /* If policy_alg is a hash-and-sign with a wildcard for the hash,
     * and requested_alg is the same hash-and-sign family with any hash,
     * then requested_alg is compliant with policy_alg. */
    if (PSA_ALG_IS_HASH_AND_SIGN(requested_alg) &&
        PSA_ALG_SIGN_GET_HASH(policy_alg) == PSA_ALG_ANY_HASH) {
        return ((policy_alg & ~PSA_ALG_HASH_MASK) ==
                (requested_alg & ~PSA_ALG_HASH_MASK));
    }
    /* If policy_alg is a wildcard AEAD algorithm of the same base as
     * the requested algorithm, check the requested tag length to be
     * equal-length or longer than the wildcard-specified length. */
    if (PSA_ALG_IS_AEAD(policy_alg) && PSA_ALG_IS_AEAD(requested_alg) &&
        (PSA_ALG_AEAD_WITH_SHORTENED_TAG(policy_alg, 0) ==
         PSA_ALG_AEAD_WITH_SHORTENED_TAG(requested_alg, 0)) &&
        ((policy_alg & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0)) {
        return (PSA_ALG_AEAD_GET_TAG_LENGTH(policy_alg) <=
                PSA_ALG_AEAD_GET_TAG_LENGTH(requested_alg));
    }
    /* If policy_alg is a MAC algorithm of the same base as the requested
     * algorithm, check whether their MAC lengths are compatible. */
    if (PSA_ALG_IS_MAC(policy_alg) && PSA_ALG_IS_MAC(requested_alg) &&
        (PSA_ALG_FULL_LENGTH_MAC(policy_alg) ==
         PSA_ALG_FULL_LENGTH_MAC(requested_alg))) {
        /* Validate the combination of key type and algorithm. Since the policy
         * and requested algorithms are the same, we only need this once. */
        if (PSA_SUCCESS != psa_mac_key_can_do(policy_alg, key_type))
            return 0;

        /* Get both the requested output length for the algorithm which is to be
         * verified, and the default output length for the base algorithm.
         * Note that none of the currently supported algorithms have an output
         * length dependent on actual key size, so setting it to a bogus value
         * of 0 is currently OK. */
        size_t requested_output_length =
            PSA_MAC_LENGTH(key_type, 0, requested_alg);
        size_t default_output_length =
            PSA_MAC_LENGTH(key_type, 0, PSA_ALG_FULL_LENGTH_MAC(requested_alg));

        /* If the policy is default-length, only allow an algorithm with
         * a declared exact-length matching the default. */
        if (PSA_MAC_TRUNCATED_LENGTH(policy_alg) == 0)
            return requested_output_length == default_output_length;

        /* If the requested algorithm is default-length, allow it if the policy
         * length exactly matches the default length. */
        if (PSA_MAC_TRUNCATED_LENGTH(requested_alg) == 0 &&
            PSA_MAC_TRUNCATED_LENGTH(policy_alg) == default_output_length) {
            return 1;
        }

        /* If policy_alg is an at-least-this-length wildcard MAC algorithm,
         * check for the requested MAC length to be equal to or longer than the
         * minimum allowed length. */
        if ((policy_alg & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) {
            return (PSA_MAC_TRUNCATED_LENGTH(policy_alg) <=
                    requested_output_length);
        }
    }
    /* If policy_alg is a generic key agreement operation, then using it for
     * a key derivation with that key agreement should also be allowed. This
     * behaviour is expected to be defined in a future specification version. */
    if (PSA_ALG_IS_RAW_KEY_AGREEMENT(policy_alg) &&
        PSA_ALG_IS_KEY_AGREEMENT(requested_alg)) {
        return (PSA_ALG_KEY_AGREEMENT_GET_BASE(requested_alg) == policy_alg);
    }
    /* If it isn't explicitly permitted, it's forbidden. */
    return 0;
}

/** Test whether a policy permits an algorithm.
 *
 * The caller must test usage flags separately.
 *
 * \note This function requires providing the key type for which the policy is
 *       being validated, since some algorithm policy definitions (e.g. MAC)
 *       have different properties depending on what kind of cipher it is
 *       combined with.
 *
 * \retval PSA_SUCCESS                  When \p alg is a specific algorithm
 *                                      allowed by the \p policy.
 * \retval PSA_ERROR_INVALID_ARGUMENT   When \p alg is not a specific algorithm
 * \retval PSA_ERROR_NOT_PERMITTED      When \p alg is a specific algorithm, but
 *                                      the \p policy does not allow it.
 */
static psa_status_t psa_key_policy_permits(const psa_key_policy_t *policy,
                                           psa_key_type_t key_type,
                                           psa_algorithm_t alg)
{
    /* '0' is not a valid algorithm */
    if (alg == 0)
        return PSA_ERROR_INVALID_ARGUMENT;

    /* A requested algorithm cannot be a wildcard. */
    if (PSA_ALG_IS_WILDCARD(alg))
        return PSA_ERROR_INVALID_ARGUMENT;

    if (psa_key_algorithm_permits(key_type, policy->alg, alg) ||
        psa_key_algorithm_permits(key_type, policy->alg2, alg))
        return PSA_SUCCESS;
    else
        return PSA_ERROR_NOT_PERMITTED;
}

/** Restrict a key policy based on a constraint.
 *
 * \note This function requires providing the key type for which the policy is
 *       being restricted, since some algorithm policy definitions (e.g. MAC)
 *       have different properties depending on what kind of cipher it is
 *       combined with.
 *
 * \param[in] key_type      The key type for which to restrict the policy
 * \param[in,out] policy    The policy to restrict.
 * \param[in] constraint    The policy constraint to apply.
 *
 * \retval #PSA_SUCCESS
 *         \c *policy contains the intersection of the original value of
 *         \c *policy and \c *constraint.
 * \retval #PSA_ERROR_INVALID_ARGUMENT
 *         \c key_type, \c *policy and \c *constraint are incompatible.
 *         \c *policy is unchanged.
 */
static psa_status_t psa_restrict_key_policy(psa_key_type_t key_type,
                                            psa_key_policy_t *policy,
                                            const psa_key_policy_t *constraint)
{
    psa_algorithm_t intersection_alg = psa_key_policy_algorithm_intersection(
        key_type, policy->alg, constraint->alg);
    psa_algorithm_t intersection_alg2 = psa_key_policy_algorithm_intersection(
        key_type, policy->alg2, constraint->alg2);
    if (intersection_alg == 0 && policy->alg != 0 && constraint->alg != 0)
        return PSA_ERROR_INVALID_ARGUMENT;
    if (intersection_alg2 == 0 && policy->alg2 != 0 && constraint->alg2 != 0)
        return PSA_ERROR_INVALID_ARGUMENT;
    policy->usage &= constraint->usage;
    policy->alg = intersection_alg;
    policy->alg2 = intersection_alg2;
    return PSA_SUCCESS;
}

/** Get the description of a key given its identifier and policy constraints
 *  and lock it.
 *
 * The key must have allow all the usage flags set in \p usage. If \p alg is
 * nonzero, the key must allow operations with this algorithm. If \p alg is
 * zero, the algorithm is not checked.
 *
 * In case of a persistent key, the function loads the description of the key
 * into a key slot if not already done.
 *
 * On success, the returned key slot is locked. It is the responsibility of
 * the caller to unlock the key slot when it does not access it anymore.
 */
static psa_status_t
psa_get_and_lock_key_slot_with_policy(mbedtls_svc_key_id_t key,
                                      psa_key_slot_t **p_slot,
                                      psa_key_usage_t usage,
                                      psa_algorithm_t alg)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_key_slot_t *slot;

    status = psa_get_and_lock_key_slot(key, p_slot);
    if (status != PSA_SUCCESS)
        return status;
    slot = *p_slot;

    /* Enforce that usage policy for the key slot contains all the flags
     * required by the usage parameter. There is one exception: public
     * keys can always be exported, so we treat public key objects as
     * if they had the export flag. */
    if (PSA_KEY_TYPE_IS_PUBLIC_KEY(slot->attr.type))
        usage &= ~PSA_KEY_USAGE_EXPORT;

    if ((slot->attr.policy.usage & usage) != usage) {
        status = PSA_ERROR_NOT_PERMITTED;
        goto error;
    }

    /* Enforce that the usage policy permits the requested algortihm. */
    if (alg != 0) {
        status =
            psa_key_policy_permits(&slot->attr.policy, slot->attr.type, alg);
        if (status != PSA_SUCCESS)
            goto error;
    }

    return PSA_SUCCESS;

error:
    *p_slot = NULL;
    psa_unlock_key_slot(slot);

    return status;
}

/** Get a key slot containing a transparent key and lock it.
 *
 * A transparent key is a key for which the key material is directly
 * available, as opposed to a key in a secure element.
 *
 * This is a temporary function to use instead of
 * psa_get_and_lock_key_slot_with_policy() until secure element support is
 * fully implemented.
 *
 * On success, the returned key slot is locked. It is the responsibility of the
 * caller to unlock the key slot when it does not access it anymore.
 */
#    if defined(MBEDTLS_PSA_CRYPTO_SE_C)
static psa_status_t
psa_get_and_lock_transparent_key_slot_with_policy(mbedtls_svc_key_id_t key,
                                                  psa_key_slot_t **p_slot,
                                                  psa_key_usage_t usage,
                                                  psa_algorithm_t alg)
{
    psa_status_t status =
        psa_get_and_lock_key_slot_with_policy(key, p_slot, usage, alg);
    if (status != PSA_SUCCESS)
        return status;

    if (psa_key_slot_is_external(*p_slot)) {
        psa_unlock_key_slot(*p_slot);
        *p_slot = NULL;
        return PSA_ERROR_NOT_SUPPORTED;
    }

    return PSA_SUCCESS;
}
#    else /* MBEDTLS_PSA_CRYPTO_SE_C */
/* With no secure element support, all keys are transparent. */
#        define psa_get_and_lock_transparent_key_slot_with_policy(key, p_slot, \
                                                                  usage, alg)  \
            psa_get_and_lock_key_slot_with_policy(key, p_slot, usage, alg)
#    endif /* MBEDTLS_PSA_CRYPTO_SE_C */

psa_status_t psa_remove_key_data_from_memory(psa_key_slot_t *slot)
{
    /* Data pointer will always be either a valid pointer or NULL in an
     * initialized slot, so we can just free it. */
    if (slot->key.data != NULL)
        mbedtls_platform_zeroize(slot->key.data, slot->key.bytes);

    mbedtls_free(slot->key.data);
    slot->key.data = NULL;
    slot->key.bytes = 0;

    return PSA_SUCCESS;
}

/** Completely wipe a slot in memory, including its policy.
 * Persistent storage is not affected. */
psa_status_t psa_wipe_key_slot(psa_key_slot_t *slot)
{
    psa_status_t status = psa_remove_key_data_from_memory(slot);

    /*
     * As the return error code may not be handled in case of multiple errors,
     * do our best to report an unexpected lock counter. Assert with
     * MBEDTLS_TEST_HOOK_TEST_ASSERT that the lock counter is equal to one:
     * if the MBEDTLS_TEST_HOOKS configuration option is enabled and the
     * function is called as part of the execution of a test suite, the
     * execution of the test suite is stopped in error if the assertion fails.
     */
    if (slot->lock_count != 1) {
        MBEDTLS_TEST_HOOK_TEST_ASSERT(slot->lock_count == 1);
        status = PSA_ERROR_CORRUPTION_DETECTED;
    }

    /* Multipart operations may still be using the key. This is safe
     * because all multipart operation objects are independent from
     * the key slot: if they need to access the key after the setup
     * phase, they have a copy of the key. Note that this means that
     * key material can linger until all operations are completed. */
    /* At this point, key material and other type-specific content has
     * been wiped. Clear remaining metadata. We can call memset and not
     * zeroize because the metadata is not particularly sensitive. */
    memset(slot, 0, sizeof(*slot));
    return status;
}

psa_status_t psa_destroy_key(mbedtls_svc_key_id_t key)
{
    psa_key_slot_t *slot;
    psa_status_t status; /* status of the last operation */
    psa_status_t overall_status = PSA_SUCCESS;
#    if defined(MBEDTLS_PSA_CRYPTO_SE_C)
    psa_se_drv_table_entry_t *driver;
#    endif /* MBEDTLS_PSA_CRYPTO_SE_C */

    if (mbedtls_svc_key_id_is_null(key))
        return PSA_SUCCESS;

    /*
     * Get the description of the key in a key slot. In case of a persistent
     * key, this will load the key description from persistent memory if not
     * done yet. We cannot avoid this loading as without it we don't know if
     * the key is operated by an SE or not and this information is needed by
     * the current implementation.
     */
    status = psa_get_and_lock_key_slot(key, &slot);
    if (status != PSA_SUCCESS)
        return status;

    /*
     * If the key slot containing the key description is under access by the
     * library (apart from the present access), the key cannot be destroyed
     * yet. For the time being, just return in error. Eventually (to be
     * implemented), the key should be destroyed when all accesses have
     * stopped.
     */
    if (slot->lock_count > 1) {
        psa_unlock_key_slot(slot);
        return PSA_ERROR_GENERIC_ERROR;
    }

    if (PSA_KEY_LIFETIME_IS_READ_ONLY(slot->attr.lifetime)) {
        /* Refuse the destruction of a read-only key (which may or may not work
         * if we attempt it, depending on whether the key is merely read-only
         * by policy or actually physically read-only).
         * Just do the best we can, which is to wipe the copy in memory
         * (done in this function's cleanup code). */
        overall_status = PSA_ERROR_NOT_PERMITTED;
        goto exit;
    }

#    if defined(MBEDTLS_PSA_CRYPTO_SE_C)
    driver = psa_get_se_driver_entry(slot->attr.lifetime);
    if (driver != NULL) {
        /* For a key in a secure element, we need to do three things:
         * remove the key file in internal storage, destroy the
         * key inside the secure element, and update the driver's
         * persistent data. Start a transaction that will encompass these
         * three actions. */
        psa_crypto_prepare_transaction(PSA_CRYPTO_TRANSACTION_DESTROY_KEY);
        psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
        psa_crypto_transaction.key.slot = psa_key_slot_get_slot_number(slot);
        psa_crypto_transaction.key.id = slot->attr.id;
        status = psa_crypto_save_transaction();
        if (status != PSA_SUCCESS) {
            (void)psa_crypto_stop_transaction();
            /* We should still try to destroy the key in the secure
             * element and the key metadata in storage. This is especially
             * important if the error is that the storage is full.
             * But how to do it exactly without risking an inconsistent
             * state after a reset?
             * https://github.com/ARMmbed/mbed-crypto/issues/215
             */
            overall_status = status;
            goto exit;
        }

        status = psa_destroy_se_key(driver, psa_key_slot_get_slot_number(slot));
        if (overall_status == PSA_SUCCESS)
            overall_status = status;
    }
#    endif /* MBEDTLS_PSA_CRYPTO_SE_C */

#    if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
    if (!PSA_KEY_LIFETIME_IS_VOLATILE(slot->attr.lifetime)) {
        status = psa_destroy_persistent_key(slot->attr.id);
        if (overall_status == PSA_SUCCESS)
            overall_status = status;

        /* TODO: other slots may have a copy of the same key. We should
         * invalidate them.
         * https://github.com/ARMmbed/mbed-crypto/issues/214
         */
    }
#    endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */

#    if defined(MBEDTLS_PSA_CRYPTO_SE_C)
    if (driver != NULL) {
        status = psa_save_se_persistent_data(driver);
        if (overall_status == PSA_SUCCESS)
            overall_status = status;
        status = psa_crypto_stop_transaction();
        if (overall_status == PSA_SUCCESS)
            overall_status = status;
    }
#    endif /* MBEDTLS_PSA_CRYPTO_SE_C */

exit:
    status = psa_wipe_key_slot(slot);
    /* Prioritize CORRUPTION_DETECTED from wiping over a storage error */
    if (status != PSA_SUCCESS)
        overall_status = status;
    return overall_status;
}

#    if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
        defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
static psa_status_t
psa_get_rsa_public_exponent(const mbedtls_rsa_context *rsa,
                            psa_key_attributes_t *attributes)
{
    mbedtls_mpi mpi;
    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
    uint8_t *buffer = NULL;
    size_t buflen;
    mbedtls_mpi_init(&mpi);

    ret = mbedtls_rsa_export(rsa, NULL, NULL, NULL, NULL, &mpi);
    if (ret != 0)
        goto exit;
    if (mbedtls_mpi_cmp_int(&mpi, 65537) == 0) {
        /* It's the default value, which is reported as an empty string,
         * so there's nothing to do. */
        goto exit;
    }

    buflen = mbedtls_mpi_size(&mpi);
    buffer = mbedtls_calloc(1, buflen);
    if (buffer == NULL) {
        ret = MBEDTLS_ERR_MPI_ALLOC_FAILED;
        goto exit;
    }
    ret = mbedtls_mpi_write_binary(&mpi, buffer, buflen);
    if (ret != 0)
        goto exit;
    attributes->domain_parameters = buffer;
    attributes->domain_parameters_size = buflen;

exit:
    mbedtls_mpi_free(&mpi);
    if (ret != 0)
        mbedtls_free(buffer);
    return mbedtls_to_psa_error(ret);
}
#    endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
            * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */

/** Retrieve all the publicly-accessible attributes of a key.
 */
psa_status_t psa_get_key_attributes(mbedtls_svc_key_id_t key,
                                    psa_key_attributes_t *attributes)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_key_slot_t *slot;

    psa_reset_key_attributes(attributes);

    status = psa_get_and_lock_key_slot_with_policy(key, &slot, 0, 0);
    if (status != PSA_SUCCESS)
        return status;

    attributes->core = slot->attr;
    attributes->core.flags &=
        (MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY | MBEDTLS_PSA_KA_MASK_DUAL_USE);

#    if defined(MBEDTLS_PSA_CRYPTO_SE_C)
    if (psa_key_slot_is_external(slot))
        psa_set_key_slot_number(attributes, psa_key_slot_get_slot_number(slot));
#    endif /* MBEDTLS_PSA_CRYPTO_SE_C */

    switch (slot->attr.type) {
#    if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
        defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
        case PSA_KEY_TYPE_RSA_KEY_PAIR:
        case PSA_KEY_TYPE_RSA_PUBLIC_KEY:
#        if defined(MBEDTLS_PSA_CRYPTO_SE_C)
            /* TODO: reporting the public exponent for opaque keys
             * is not yet implemented.
             * https://github.com/ARMmbed/mbed-crypto/issues/216
             */
            if (psa_key_slot_is_external(slot))
                break;
#        endif /* MBEDTLS_PSA_CRYPTO_SE_C */
            {
                mbedtls_rsa_context *rsa = NULL;

                status = mbedtls_psa_rsa_load_representation(
                    slot->attr.type, slot->key.data, slot->key.bytes, &rsa);
                if (status != PSA_SUCCESS)
                    break;

                status = psa_get_rsa_public_exponent(rsa, attributes);
                mbedtls_rsa_free(rsa);
                mbedtls_free(rsa);
            }
            break;
#    endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
            * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
        default:
            /* Nothing else to do. */
            break;
    }

    if (status != PSA_SUCCESS)
        psa_reset_key_attributes(attributes);

    unlock_status = psa_unlock_key_slot(slot);

    return (status == PSA_SUCCESS) ? unlock_status : status;
}

#    if defined(MBEDTLS_PSA_CRYPTO_SE_C)
psa_status_t psa_get_key_slot_number(const psa_key_attributes_t *attributes,
                                     psa_key_slot_number_t *slot_number)
{
    if (attributes->core.flags & MBEDTLS_PSA_KA_FLAG_HAS_SLOT_NUMBER) {
        *slot_number = attributes->slot_number;
        return PSA_SUCCESS;
    } else
        return PSA_ERROR_INVALID_ARGUMENT;
}
#    endif /* MBEDTLS_PSA_CRYPTO_SE_C */

static psa_status_t psa_export_key_buffer_internal(const uint8_t *key_buffer,
                                                   size_t key_buffer_size,
                                                   uint8_t *data,
                                                   size_t data_size,
                                                   size_t *data_length)
{
    if (key_buffer_size > data_size)
        return PSA_ERROR_BUFFER_TOO_SMALL;
    memcpy(data, key_buffer, key_buffer_size);
    memset(data + key_buffer_size, 0, data_size - key_buffer_size);
    *data_length = key_buffer_size;
    return PSA_SUCCESS;
}

psa_status_t psa_export_key_internal(const psa_key_attributes_t *attributes,
                                     const uint8_t *key_buffer,
                                     size_t key_buffer_size,
                                     uint8_t *data,
                                     size_t data_size,
                                     size_t *data_length)
{
    psa_key_type_t type = attributes->core.type;

    if (key_type_is_raw_bytes(type) || PSA_KEY_TYPE_IS_RSA(type) ||
        PSA_KEY_TYPE_IS_ECC(type)) {
        return (psa_export_key_buffer_internal(key_buffer, key_buffer_size,
                                               data, data_size, data_length));
    } else {
        /* This shouldn't happen in the reference implementation, but
           it is valid for a special-purpose implementation to omit
           support for exporting certain key types. */
        return PSA_ERROR_NOT_SUPPORTED;
    }
}

psa_status_t psa_export_key(mbedtls_svc_key_id_t key,
                            uint8_t *data,
                            size_t data_size,
                            size_t *data_length)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_key_slot_t *slot;

    /* Reject a zero-length output buffer now, since this can never be a
     * valid key representation. This way we know that data must be a valid
     * pointer and we can do things like memset(data, ..., data_size). */
    if (data_size == 0)
        return PSA_ERROR_BUFFER_TOO_SMALL;

    /* Set the key to empty now, so that even when there are errors, we always
     * set data_length to a value between 0 and data_size. On error, setting
     * the key to empty is a good choice because an empty key representation is
     * unlikely to be accepted anywhere. */
    *data_length = 0;

    /* Export requires the EXPORT flag. There is an exception for public keys,
     * which don't require any flag, but
     * psa_get_and_lock_key_slot_with_policy() takes care of this.
     */
    status = psa_get_and_lock_key_slot_with_policy(key, &slot,
                                                   PSA_KEY_USAGE_EXPORT, 0);
    if (status != PSA_SUCCESS)
        return status;

    psa_key_attributes_t attributes = { .core = slot->attr };
    status = psa_driver_wrapper_export_key(&attributes, slot->key.data,
                                           slot->key.bytes, data, data_size,
                                           data_length);

    unlock_status = psa_unlock_key_slot(slot);

    return (status == PSA_SUCCESS) ? unlock_status : status;
}

psa_status_t
psa_export_public_key_internal(const psa_key_attributes_t *attributes,
                               const uint8_t *key_buffer,
                               size_t key_buffer_size,
                               uint8_t *data,
                               size_t data_size,
                               size_t *data_length)
{
    psa_key_type_t type = attributes->core.type;

    if (PSA_KEY_TYPE_IS_RSA(type) || PSA_KEY_TYPE_IS_ECC(type)) {
        if (PSA_KEY_TYPE_IS_PUBLIC_KEY(type)) {
            /* Exporting public -> public */
            return (psa_export_key_buffer_internal(
                key_buffer, key_buffer_size, data, data_size, data_length));
        }

        if (PSA_KEY_TYPE_IS_RSA(type)) {
#    if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
        defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
            return (mbedtls_psa_rsa_export_public_key(attributes, key_buffer,
                                                      key_buffer_size, data,
                                                      data_size, data_length));
#    else
            /* We don't know how to convert a private RSA key to public. */
            return PSA_ERROR_NOT_SUPPORTED;
#    endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
            * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
        } else {
#    if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
        defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)
            return (mbedtls_psa_ecp_export_public_key(attributes, key_buffer,
                                                      key_buffer_size, data,
                                                      data_size, data_length));
#    else
            /* We don't know how to convert a private ECC key to public */
            return PSA_ERROR_NOT_SUPPORTED;
#    endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
            * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
        }
    } else {
        /* This shouldn't happen in the reference implementation, but
           it is valid for a special-purpose implementation to omit
           support for exporting certain key types. */
        return PSA_ERROR_NOT_SUPPORTED;
    }
}

psa_status_t psa_export_public_key(mbedtls_svc_key_id_t key,
                                   uint8_t *data,
                                   size_t data_size,
                                   size_t *data_length)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_key_slot_t *slot;

    /* Reject a zero-length output buffer now, since this can never be a
     * valid key representation. This way we know that data must be a valid
     * pointer and we can do things like memset(data, ..., data_size). */
    if (data_size == 0)
        return PSA_ERROR_BUFFER_TOO_SMALL;

    /* Set the key to empty now, so that even when there are errors, we always
     * set data_length to a value between 0 and data_size. On error, setting
     * the key to empty is a good choice because an empty key representation is
     * unlikely to be accepted anywhere. */
    *data_length = 0;

    /* Exporting a public key doesn't require a usage flag. */
    status = psa_get_and_lock_key_slot_with_policy(key, &slot, 0, 0);
    if (status != PSA_SUCCESS)
        return status;

    if (!PSA_KEY_TYPE_IS_ASYMMETRIC(slot->attr.type)) {
        status = PSA_ERROR_INVALID_ARGUMENT;
        goto exit;
    }

    psa_key_attributes_t attributes = { .core = slot->attr };
    status = psa_driver_wrapper_export_public_key(&attributes, slot->key.data,
                                                  slot->key.bytes, data,
                                                  data_size, data_length);

exit:
    unlock_status = psa_unlock_key_slot(slot);

    return (status == PSA_SUCCESS) ? unlock_status : status;
}

#    if defined(static_assert)
static_assert(
    (MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE) == 0,
    "One or more key attribute flag is listed as both external-only and dual-use");
static_assert(
    (PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE) == 0,
    "One or more key attribute flag is listed as both internal-only and dual-use");
static_assert(
    (PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY) == 0,
    "One or more key attribute flag is listed as both internal-only and external-only");
#    endif

/** Validate that a key policy is internally well-formed.
 *
 * This function only rejects invalid policies. It does not validate the
 * consistency of the policy with respect to other attributes of the key
 * such as the key type.
 */
static psa_status_t psa_validate_key_policy(const psa_key_policy_t *policy)
{
    if ((policy->usage &
         ~(PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_ENCRYPT |
           PSA_KEY_USAGE_DECRYPT | PSA_KEY_USAGE_SIGN_MESSAGE |
           PSA_KEY_USAGE_VERIFY_MESSAGE | PSA_KEY_USAGE_SIGN_HASH |
           PSA_KEY_USAGE_VERIFY_HASH | PSA_KEY_USAGE_VERIFY_DERIVATION |
           PSA_KEY_USAGE_DERIVE)) != 0)
        return PSA_ERROR_INVALID_ARGUMENT;

    return PSA_SUCCESS;
}

/** Validate the internal consistency of key attributes.
 *
 * This function only rejects invalid attribute values. If does not
 * validate the consistency of the attributes with any key data that may
 * be involved in the creation of the key.
 *
 * Call this function early in the key creation process.
 *
 * \param[in] attributes    Key attributes for the new key.
 * \param[out] p_drv        On any return, the driver for the key, if any.
 *                          NULL for a transparent key.
 *
 */
static psa_status_t
psa_validate_key_attributes(const psa_key_attributes_t *attributes,
                            psa_se_drv_table_entry_t **p_drv)
{
    psa_status_t status = PSA_ERROR_INVALID_ARGUMENT;
    psa_key_lifetime_t lifetime = psa_get_key_lifetime(attributes);
    mbedtls_svc_key_id_t key = psa_get_key_id(attributes);

    status = psa_validate_key_location(lifetime, p_drv);
    if (status != PSA_SUCCESS)
        return status;

    status = psa_validate_key_persistence(lifetime);
    if (status != PSA_SUCCESS)
        return status;

    if (PSA_KEY_LIFETIME_IS_VOLATILE(lifetime)) {
        if (MBEDTLS_SVC_KEY_ID_GET_KEY_ID(key) != 0)
            return PSA_ERROR_INVALID_ARGUMENT;
    } else {
        if (!psa_is_valid_key_id(psa_get_key_id(attributes), 0))
            return PSA_ERROR_INVALID_ARGUMENT;
    }

    status = psa_validate_key_policy(&attributes->core.policy);
    if (status != PSA_SUCCESS)
        return status;

    /* Refuse to create overly large keys.
     * Note that this doesn't trigger on import if the attributes don't
     * explicitly specify a size (so psa_get_key_bits returns 0), so
     * psa_import_key() needs its own checks. */
    if (psa_get_key_bits(attributes) > PSA_MAX_KEY_BITS)
        return PSA_ERROR_NOT_SUPPORTED;

    /* Reject invalid flags. These should not be reachable through the API. */
    if (attributes->core.flags &
        ~(MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY | MBEDTLS_PSA_KA_MASK_DUAL_USE))
        return PSA_ERROR_INVALID_ARGUMENT;

    return PSA_SUCCESS;
}

/** Prepare a key slot to receive key material.
 *
 * This function allocates a key slot and sets its metadata.
 *
 * If this function fails, call psa_fail_key_creation().
 *
 * This function is intended to be used as follows:
 * -# Call psa_start_key_creation() to allocate a key slot, prepare
 *    it with the specified attributes, and in case of a volatile key assign it
 *    a volatile key identifier.
 * -# Populate the slot with the key material.
 * -# Call psa_finish_key_creation() to finalize the creation of the slot.
 * In case of failure at any step, stop the sequence and call
 * psa_fail_key_creation().
 *
 * On success, the key slot is locked. It is the responsibility of the caller
 * to unlock the key slot when it does not access it anymore.
 *
 * \param method            An identification of the calling function.
 * \param[in] attributes    Key attributes for the new key.
 * \param[out] p_slot       On success, a pointer to the prepared slot.
 * \param[out] p_drv        On any return, the driver for the key, if any.
 *                          NULL for a transparent key.
 *
 * \retval #PSA_SUCCESS
 *         The key slot is ready to receive key material.
 * \return If this function fails, the key slot is an invalid state.
 *         You must call psa_fail_key_creation() to wipe and free the slot.
 */
static psa_status_t
psa_start_key_creation(psa_key_creation_method_t method,
                       const psa_key_attributes_t *attributes,
                       psa_key_slot_t **p_slot,
                       psa_se_drv_table_entry_t **p_drv)
{
    psa_status_t status;
    psa_key_id_t volatile_key_id;
    psa_key_slot_t *slot;

    (void)method;
    *p_drv = NULL;

    status = psa_validate_key_attributes(attributes, p_drv);
    if (status != PSA_SUCCESS)
        return status;

    status = psa_get_empty_key_slot(&volatile_key_id, p_slot);
    if (status != PSA_SUCCESS)
        return status;
    slot = *p_slot;

    /* We're storing the declared bit-size of the key. It's up to each
     * creation mechanism to verify that this information is correct.
     * It's automatically correct for mechanisms that use the bit-size as
     * an input (generate, device) but not for those where the bit-size
     * is optional (import, copy). In case of a volatile key, assign it the
     * volatile key identifier associated to the slot returned to contain its
     * definition. */

    slot->attr = attributes->core;
    if (PSA_KEY_LIFETIME_IS_VOLATILE(slot->attr.lifetime)) {
#    if !defined(MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER)
        slot->attr.id = volatile_key_id;
#    else
        slot->attr.id.key_id = volatile_key_id;
#    endif
    }

    /* Erase external-only flags from the internal copy. To access
     * external-only flags, query `attributes`. Thanks to the check
     * in psa_validate_key_attributes(), this leaves the dual-use
     * flags and any internal flag that psa_get_empty_key_slot()
     * may have set. */
    slot->attr.flags &= ~MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY;

#    if defined(MBEDTLS_PSA_CRYPTO_SE_C)
    /* For a key in a secure element, we need to do three things
     * when creating or registering a persistent key:
     * create the key file in internal storage, create the
     * key inside the secure element, and update the driver's
     * persistent data. This is done by starting a transaction that will
     * encompass these three actions.
     * For registering a volatile key, we just need to find an appropriate
     * slot number inside the SE. Since the key is designated volatile, creating
     * a transaction is not required. */
    /* The first thing to do is to find a slot number for the new key.
     * We save the slot number in persistent storage as part of the
     * transaction data. It will be needed to recover if the power
     * fails during the key creation process, to clean up on the secure
     * element side after restarting. Obtaining a slot number from the
     * secure element driver updates its persistent state, but we do not yet
     * save the driver's persistent state, so that if the power fails,
     * we can roll back to a state where the key doesn't exist. */
    if (*p_drv != NULL) {
        psa_key_slot_number_t slot_number;
        status =
            psa_find_se_slot_for_key(attributes, method, *p_drv, &slot_number);
        if (status != PSA_SUCCESS)
            return status;

        if (!PSA_KEY_LIFETIME_IS_VOLATILE(attributes->core.lifetime)) {
            psa_crypto_prepare_transaction(PSA_CRYPTO_TRANSACTION_CREATE_KEY);
            psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
            psa_crypto_transaction.key.slot = slot_number;
            psa_crypto_transaction.key.id = slot->attr.id;
            status = psa_crypto_save_transaction();
            if (status != PSA_SUCCESS) {
                (void)psa_crypto_stop_transaction();
                return status;
            }
        }

        status = psa_copy_key_material_into_slot(
            slot, (uint8_t *)(&slot_number), sizeof(slot_number));
    }

    if (*p_drv == NULL && method == PSA_KEY_CREATION_REGISTER) {
        /* Key registration only makes sense with a secure element. */
        return PSA_ERROR_INVALID_ARGUMENT;
    }
#    endif /* MBEDTLS_PSA_CRYPTO_SE_C */

    return PSA_SUCCESS;
}

/** Finalize the creation of a key once its key material has been set.
 *
 * This entails writing the key to persistent storage.
 *
 * If this function fails, call psa_fail_key_creation().
 * See the documentation of psa_start_key_creation() for the intended use
 * of this function.
 *
 * If the finalization succeeds, the function unlocks the key slot (it was
 * locked by psa_start_key_creation()) and the key slot cannot be accessed
 * anymore as part of the key creation process.
 *
 * \param[in,out] slot  Pointer to the slot with key material.
 * \param[in] driver    The secure element driver for the key,
 *                      or NULL for a transparent key.
 * \param[out] key      On success, identifier of the key. Note that the
 *                      key identifier is also stored in the key slot.
 *
 * \retval #PSA_SUCCESS
 *         The key was successfully created.
 * \retval #PSA_ERROR_INSUFFICIENT_MEMORY
 * \retval #PSA_ERROR_INSUFFICIENT_STORAGE
 * \retval #PSA_ERROR_ALREADY_EXISTS
 * \retval #PSA_ERROR_DATA_INVALID
 * \retval #PSA_ERROR_DATA_CORRUPT
 * \retval #PSA_ERROR_STORAGE_FAILURE
 *
 * \return If this function fails, the key slot is an invalid state.
 *         You must call psa_fail_key_creation() to wipe and free the slot.
 */
static psa_status_t psa_finish_key_creation(psa_key_slot_t *slot,
                                            psa_se_drv_table_entry_t *driver,
                                            mbedtls_svc_key_id_t *key)
{
    psa_status_t status = PSA_SUCCESS;
    (void)slot;
    (void)driver;

#    if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
    if (!PSA_KEY_LIFETIME_IS_VOLATILE(slot->attr.lifetime)) {
#        if defined(MBEDTLS_PSA_CRYPTO_SE_C)
        if (driver != NULL) {
            psa_se_key_data_storage_t data;
            psa_key_slot_number_t slot_number =
                psa_key_slot_get_slot_number(slot);

#            if defined(static_assert)
            static_assert(
                sizeof(slot_number) == sizeof(data.slot_number),
                "Slot number size does not match psa_se_key_data_storage_t");
#            endif
            memcpy(&data.slot_number, &slot_number, sizeof(slot_number));
            status = psa_save_persistent_key(&slot->attr, (uint8_t *)&data,
                                             sizeof(data));
        } else
#        endif /* MBEDTLS_PSA_CRYPTO_SE_C */
        {
            /* Key material is saved in export representation in the slot, so
             * just pass the slot buffer for storage. */
            status = psa_save_persistent_key(&slot->attr, slot->key.data,
                                             slot->key.bytes);
        }
    }
#    endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */

#    if defined(MBEDTLS_PSA_CRYPTO_SE_C)
    /* Finish the transaction for a key creation. This does not
     * happen when registering an existing key. Detect this case
     * by checking whether a transaction is in progress (actual
     * creation of a persistent key in a secure element requires a transaction,
     * but registration or volatile key creation doesn't use one). */
    if (driver != NULL && psa_crypto_transaction.unknown.type ==
                              PSA_CRYPTO_TRANSACTION_CREATE_KEY) {
        status = psa_save_se_persistent_data(driver);
        if (status != PSA_SUCCESS) {
            psa_destroy_persistent_key(slot->attr.id);
            return status;
        }
        status = psa_crypto_stop_transaction();
    }
#    endif /* MBEDTLS_PSA_CRYPTO_SE_C */

    if (status == PSA_SUCCESS) {
        *key = slot->attr.id;
        status = psa_unlock_key_slot(slot);
        if (status != PSA_SUCCESS)
            *key = MBEDTLS_SVC_KEY_ID_INIT;
    }

    return status;
}

/** Abort the creation of a key.
 *
 * You may call this function after calling psa_start_key_creation(),
 * or after psa_finish_key_creation() fails. In other circumstances, this
 * function may not clean up persistent storage.
 * See the documentation of psa_start_key_creation() for the intended use
 * of this function.
 *
 * \param[in,out] slot  Pointer to the slot with key material.
 * \param[in] driver    The secure element driver for the key,
 *                      or NULL for a transparent key.
 */
static void psa_fail_key_creation(psa_key_slot_t *slot,
                                  psa_se_drv_table_entry_t *driver)
{
    (void)driver;

    if (slot == NULL)
        return;

#    if defined(MBEDTLS_PSA_CRYPTO_SE_C)
    /* TODO: If the key has already been created in the secure
     * element, and the failure happened later (when saving metadata
     * to internal storage), we need to destroy the key in the secure
     * element.
     * https://github.com/ARMmbed/mbed-crypto/issues/217
     */

    /* Abort the ongoing transaction if any (there may not be one if
     * the creation process failed before starting one, or if the
     * key creation is a registration of a key in a secure element).
     * Earlier functions must already have done what it takes to undo any
     * partial creation. All that's left is to update the transaction data
     * itself. */
    (void)psa_crypto_stop_transaction();
#    endif /* MBEDTLS_PSA_CRYPTO_SE_C */

    psa_wipe_key_slot(slot);
}

/** Validate optional attributes during key creation.
 *
 * Some key attributes are optional during key creation. If they are
 * specified in the attributes structure, check that they are consistent
 * with the data in the slot.
 *
 * This function should be called near the end of key creation, after
 * the slot in memory is fully populated but before saving persistent data.
 */
static psa_status_t
psa_validate_optional_attributes(const psa_key_slot_t *slot,
                                 const psa_key_attributes_t *attributes)
{
    if (attributes->core.type != 0) {
        if (attributes->core.type != slot->attr.type)
            return PSA_ERROR_INVALID_ARGUMENT;
    }

    if (attributes->domain_parameters_size != 0) {
#    if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
        defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
        if (PSA_KEY_TYPE_IS_RSA(slot->attr.type)) {
            mbedtls_rsa_context *rsa = NULL;
            mbedtls_mpi actual, required;
            int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;

            psa_status_t status = mbedtls_psa_rsa_load_representation(
                slot->attr.type, slot->key.data, slot->key.bytes, &rsa);
            if (status != PSA_SUCCESS)
                return status;

            mbedtls_mpi_init(&actual);
            mbedtls_mpi_init(&required);
            ret = mbedtls_rsa_export(rsa, NULL, NULL, NULL, NULL, &actual);
            mbedtls_rsa_free(rsa);
            mbedtls_free(rsa);
            if (ret != 0)
                goto rsa_exit;
            ret = mbedtls_mpi_read_binary(&required,
                                          attributes->domain_parameters,
                                          attributes->domain_parameters_size);
            if (ret != 0)
                goto rsa_exit;
            if (mbedtls_mpi_cmp_mpi(&actual, &required) != 0)
                ret = MBEDTLS_ERR_RSA_BAD_INPUT_DATA;
rsa_exit:
            mbedtls_mpi_free(&actual);
            mbedtls_mpi_free(&required);
            if (ret != 0)
                return mbedtls_to_psa_error(ret);
        } else
#    endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
            * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
        {
            return PSA_ERROR_INVALID_ARGUMENT;
        }
    }

    if (attributes->core.bits != 0) {
        if (attributes->core.bits != slot->attr.bits)
            return PSA_ERROR_INVALID_ARGUMENT;
    }

    return PSA_SUCCESS;
}

psa_status_t psa_import_key(const psa_key_attributes_t *attributes,
                            const uint8_t *data,
                            size_t data_length,
                            mbedtls_svc_key_id_t *key)
{
    psa_status_t status;
    psa_key_slot_t *slot = NULL;
    psa_se_drv_table_entry_t *driver = NULL;
    size_t bits;

    *key = MBEDTLS_SVC_KEY_ID_INIT;

    /* Reject zero-length symmetric keys (including raw data key objects).
     * This also rejects any key which might be encoded as an empty string,
     * which is never valid. */
    if (data_length == 0)
        return PSA_ERROR_INVALID_ARGUMENT;

    status = psa_start_key_creation(PSA_KEY_CREATION_IMPORT, attributes, &slot,
                                    &driver);
    if (status != PSA_SUCCESS)
        goto exit;

    /* In the case of a transparent key or an opaque key stored in local
     * storage (thus not in the case of generating a key in a secure element
     * or cryptoprocessor with storage), we have to allocate a buffer to
     * hold the generated key material. */
    if (slot->key.data == NULL) {
        status = psa_allocate_buffer_to_slot(slot, data_length);
        if (status != PSA_SUCCESS)
            goto exit;
    }

    bits = slot->attr.bits;
    status = psa_driver_wrapper_import_key(attributes, data, data_length,
                                           slot->key.data, slot->key.bytes,
                                           &slot->key.bytes, &bits);
    if (status != PSA_SUCCESS)
        goto exit;

    if (slot->attr.bits == 0)
        slot->attr.bits = (psa_key_bits_t)bits;
    else if (bits != slot->attr.bits) {
        status = PSA_ERROR_INVALID_ARGUMENT;
        goto exit;
    }

    status = psa_validate_optional_attributes(slot, attributes);
    if (status != PSA_SUCCESS)
        goto exit;

    status = psa_finish_key_creation(slot, driver, key);
exit:
    if (status != PSA_SUCCESS)
        psa_fail_key_creation(slot, driver);

    return status;
}

#    if defined(MBEDTLS_PSA_CRYPTO_SE_C)
psa_status_t mbedtls_psa_register_se_key(const psa_key_attributes_t *attributes)
{
    psa_status_t status;
    psa_key_slot_t *slot = NULL;
    psa_se_drv_table_entry_t *driver = NULL;
    mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT;

    /* Leaving attributes unspecified is not currently supported.
     * It could make sense to query the key type and size from the
     * secure element, but not all secure elements support this
     * and the driver HAL doesn't currently support it. */
    if (psa_get_key_type(attributes) == PSA_KEY_TYPE_NONE)
        return PSA_ERROR_NOT_SUPPORTED;
    if (psa_get_key_bits(attributes) == 0)
        return PSA_ERROR_NOT_SUPPORTED;

    status = psa_start_key_creation(PSA_KEY_CREATION_REGISTER, attributes,
                                    &slot, &driver);
    if (status != PSA_SUCCESS)
        goto exit;

    status = psa_finish_key_creation(slot, driver, &key);

exit:
    if (status != PSA_SUCCESS)
        psa_fail_key_creation(slot, driver);

    /* Registration doesn't keep the key in RAM. */
    psa_close_key(key);
    return status;
}
#    endif /* MBEDTLS_PSA_CRYPTO_SE_C */

static psa_status_t psa_copy_key_material(const psa_key_slot_t *source,
                                          psa_key_slot_t *target)
{
    psa_status_t status = psa_copy_key_material_into_slot(
        target, source->key.data, source->key.bytes);
    if (status != PSA_SUCCESS)
        return status;

    target->attr.type = source->attr.type;
    target->attr.bits = source->attr.bits;

    return PSA_SUCCESS;
}

psa_status_t psa_copy_key(mbedtls_svc_key_id_t source_key,
                          const psa_key_attributes_t *specified_attributes,
                          mbedtls_svc_key_id_t *target_key)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_key_slot_t *source_slot = NULL;
    psa_key_slot_t *target_slot = NULL;
    psa_key_attributes_t actual_attributes = *specified_attributes;
    psa_se_drv_table_entry_t *driver = NULL;

    *target_key = MBEDTLS_SVC_KEY_ID_INIT;

    status = psa_get_and_lock_transparent_key_slot_with_policy(
        source_key, &source_slot, PSA_KEY_USAGE_COPY, 0);
    if (status != PSA_SUCCESS)
        goto exit;

    status =
        psa_validate_optional_attributes(source_slot, specified_attributes);
    if (status != PSA_SUCCESS)
        goto exit;

    status = psa_restrict_key_policy(source_slot->attr.type,
                                     &actual_attributes.core.policy,
                                     &source_slot->attr.policy);
    if (status != PSA_SUCCESS)
        goto exit;

    status = psa_start_key_creation(PSA_KEY_CREATION_COPY, &actual_attributes,
                                    &target_slot, &driver);
    if (status != PSA_SUCCESS)
        goto exit;

#    if defined(MBEDTLS_PSA_CRYPTO_SE_C)
    if (driver != NULL) {
        /* Copying to a secure element is not implemented yet. */
        status = PSA_ERROR_NOT_SUPPORTED;
        goto exit;
    }
#    endif /* MBEDTLS_PSA_CRYPTO_SE_C */

    if (psa_key_lifetime_is_external(actual_attributes.core.lifetime)) {
        /*
         * Copying through an opaque driver is not implemented yet, consider
         * a lifetime with an external location as an invalid parameter for
         * now.
         */
        status = PSA_ERROR_INVALID_ARGUMENT;
        goto exit;
    }

    status = psa_copy_key_material(source_slot, target_slot);
    if (status != PSA_SUCCESS)
        goto exit;

    status = psa_finish_key_creation(target_slot, driver, target_key);
exit:
    if (status != PSA_SUCCESS)
        psa_fail_key_creation(target_slot, driver);

    unlock_status = psa_unlock_key_slot(source_slot);

    return (status == PSA_SUCCESS) ? unlock_status : status;
}

/****************************************************************/
/* Message digests */
/****************************************************************/

psa_status_t psa_hash_abort(psa_hash_operation_t *operation)
{
    /* Aborting a non-active operation is allowed */
    if (operation->id == 0)
        return PSA_SUCCESS;

    psa_status_t status = psa_driver_wrapper_hash_abort(operation);
    operation->id = 0;

    return status;
}

psa_status_t psa_hash_setup(psa_hash_operation_t *operation,
                            psa_algorithm_t alg)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;

    /* A context must be freshly initialized before it can be set up. */
    if (operation->id != 0) {
        status = PSA_ERROR_BAD_STATE;
        goto exit;
    }

    if (!PSA_ALG_IS_HASH(alg)) {
        status = PSA_ERROR_INVALID_ARGUMENT;
        goto exit;
    }

    /* Ensure all of the context is zeroized, since PSA_HASH_OPERATION_INIT only
     * directly zeroes the int-sized dummy member of the context union. */
    memset(&operation->ctx, 0, sizeof(operation->ctx));

    status = psa_driver_wrapper_hash_setup(operation, alg);

exit:
    if (status != PSA_SUCCESS)
        psa_hash_abort(operation);

    return status;
}

psa_status_t psa_hash_update(psa_hash_operation_t *operation,
                             const uint8_t *input,
                             size_t input_length)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;

    if (operation->id == 0) {
        status = PSA_ERROR_BAD_STATE;
        goto exit;
    }

    /* Don't require hash implementations to behave correctly on a
     * zero-length input, which may have an invalid pointer. */
    if (input_length == 0)
        return PSA_SUCCESS;

    status = psa_driver_wrapper_hash_update(operation, input, input_length);

exit:
    if (status != PSA_SUCCESS)
        psa_hash_abort(operation);

    return status;
}

psa_status_t psa_hash_finish(psa_hash_operation_t *operation,
                             uint8_t *hash,
                             size_t hash_size,
                             size_t *hash_length)
{
    *hash_length = 0;
    if (operation->id == 0)
        return PSA_ERROR_BAD_STATE;

    psa_status_t status =
        psa_driver_wrapper_hash_finish(operation, hash, hash_size, hash_length);
    psa_hash_abort(operation);
    return status;
}

psa_status_t psa_hash_verify(psa_hash_operation_t *operation,
                             const uint8_t *hash,
                             size_t hash_length)
{
    uint8_t actual_hash[MBEDTLS_MD_MAX_SIZE];
    size_t actual_hash_length;
    psa_status_t status = psa_hash_finish(
        operation, actual_hash, sizeof(actual_hash), &actual_hash_length);

    if (status != PSA_SUCCESS)
        goto exit;

    if (actual_hash_length != hash_length) {
        status = PSA_ERROR_INVALID_SIGNATURE;
        goto exit;
    }

    if (mbedtls_psa_safer_memcmp(hash, actual_hash, actual_hash_length) != 0)
        status = PSA_ERROR_INVALID_SIGNATURE;

exit:
    if (status != PSA_SUCCESS)
        psa_hash_abort(operation);

    return status;
}

psa_status_t psa_hash_compute(psa_algorithm_t alg,
                              const uint8_t *input,
                              size_t input_length,
                              uint8_t *hash,
                              size_t hash_size,
                              size_t *hash_length)
{
    *hash_length = 0;
    if (!PSA_ALG_IS_HASH(alg))
        return PSA_ERROR_INVALID_ARGUMENT;

    return (psa_driver_wrapper_hash_compute(alg, input, input_length, hash,
                                            hash_size, hash_length));
}

psa_status_t psa_hash_compare(psa_algorithm_t alg,
                              const uint8_t *input,
                              size_t input_length,
                              const uint8_t *hash,
                              size_t hash_length)
{
    uint8_t actual_hash[MBEDTLS_MD_MAX_SIZE];
    size_t actual_hash_length;

    if (!PSA_ALG_IS_HASH(alg))
        return PSA_ERROR_INVALID_ARGUMENT;

    psa_status_t status = psa_driver_wrapper_hash_compute(
        alg, input, input_length, actual_hash, sizeof(actual_hash),
        &actual_hash_length);
    if (status != PSA_SUCCESS)
        return status;
    if (actual_hash_length != hash_length)
        return PSA_ERROR_INVALID_SIGNATURE;
    if (mbedtls_psa_safer_memcmp(hash, actual_hash, actual_hash_length) != 0)
        return PSA_ERROR_INVALID_SIGNATURE;
    return PSA_SUCCESS;
}

psa_status_t psa_hash_clone(const psa_hash_operation_t *source_operation,
                            psa_hash_operation_t *target_operation)
{
    if (source_operation->id == 0 || target_operation->id != 0) {
        return PSA_ERROR_BAD_STATE;
    }

    psa_status_t status =
        psa_driver_wrapper_hash_clone(source_operation, target_operation);
    if (status != PSA_SUCCESS)
        psa_hash_abort(target_operation);

    return status;
}

/****************************************************************/
/* MAC */
/****************************************************************/

psa_status_t psa_mac_abort(psa_mac_operation_t *operation)
{
    /* Aborting a non-active operation is allowed */
    if (operation->id == 0)
        return PSA_SUCCESS;

    psa_status_t status = psa_driver_wrapper_mac_abort(operation);
    operation->mac_size = 0;
    operation->is_sign = 0;
    operation->id = 0;

    return status;
}

static psa_status_t
psa_mac_finalize_alg_and_key_validation(psa_algorithm_t alg,
                                        const psa_key_attributes_t *attributes,
                                        uint8_t *mac_size)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_key_type_t key_type = psa_get_key_type(attributes);
    size_t key_bits = psa_get_key_bits(attributes);

    if (!PSA_ALG_IS_MAC(alg))
        return PSA_ERROR_INVALID_ARGUMENT;

    /* Validate the combination of key type and algorithm */
    status = psa_mac_key_can_do(alg, key_type);
    if (status != PSA_SUCCESS)
        return status;

    /* Get the output length for the algorithm and key combination */
    *mac_size = PSA_MAC_LENGTH(key_type, key_bits, alg);

    if (*mac_size < 4) {
        /* A very short MAC is too short for security since it can be
         * brute-forced. Ancient protocols with 32-bit MACs do exist,
         * so we make this our minimum, even though 32 bits is still
         * too small for security. */
        return PSA_ERROR_NOT_SUPPORTED;
    }

    if (*mac_size >
        PSA_MAC_LENGTH(key_type, key_bits, PSA_ALG_FULL_LENGTH_MAC(alg))) {
        /* It's impossible to "truncate" to a larger length than the full length
         * of the algorithm. */
        return PSA_ERROR_INVALID_ARGUMENT;
    }

    return PSA_SUCCESS;
}

static psa_status_t psa_mac_setup(psa_mac_operation_t *operation,
                                  mbedtls_svc_key_id_t key,
                                  psa_algorithm_t alg,
                                  int is_sign)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_key_slot_t *slot = NULL;

    /* A context must be freshly initialized before it can be set up. */
    if (operation->id != 0) {
        status = PSA_ERROR_BAD_STATE;
        goto exit;
    }

    status = psa_get_and_lock_key_slot_with_policy(
        key, &slot,
        is_sign ? PSA_KEY_USAGE_SIGN_HASH : PSA_KEY_USAGE_VERIFY_HASH, alg);
    if (status != PSA_SUCCESS)
        goto exit;

    psa_key_attributes_t attributes = { .core = slot->attr };

    status = psa_mac_finalize_alg_and_key_validation(alg, &attributes,
                                                     &operation->mac_size);
    if (status != PSA_SUCCESS)
        goto exit;

    operation->is_sign = is_sign;
    /* Dispatch the MAC setup call with validated input */
    if (is_sign) {
        status = psa_driver_wrapper_mac_sign_setup(
            operation, &attributes, slot->key.data, slot->key.bytes, alg);
    } else {
        status = psa_driver_wrapper_mac_verify_setup(
            operation, &attributes, slot->key.data, slot->key.bytes, alg);
    }

exit:
    if (status != PSA_SUCCESS)
        psa_mac_abort(operation);

    unlock_status = psa_unlock_key_slot(slot);

    return (status == PSA_SUCCESS) ? unlock_status : status;
}

psa_status_t psa_mac_sign_setup(psa_mac_operation_t *operation,
                                mbedtls_svc_key_id_t key,
                                psa_algorithm_t alg)
{
    return psa_mac_setup(operation, key, alg, 1);
}

psa_status_t psa_mac_verify_setup(psa_mac_operation_t *operation,
                                  mbedtls_svc_key_id_t key,
                                  psa_algorithm_t alg)
{
    return psa_mac_setup(operation, key, alg, 0);
}

psa_status_t psa_mac_update(psa_mac_operation_t *operation,
                            const uint8_t *input,
                            size_t input_length)
{
    if (operation->id == 0)
        return PSA_ERROR_BAD_STATE;

    /* Don't require hash implementations to behave correctly on a
     * zero-length input, which may have an invalid pointer. */
    if (input_length == 0)
        return PSA_SUCCESS;

    psa_status_t status =
        psa_driver_wrapper_mac_update(operation, input, input_length);
    if (status != PSA_SUCCESS)
        psa_mac_abort(operation);

    return status;
}

psa_status_t psa_mac_sign_finish(psa_mac_operation_t *operation,
                                 uint8_t *mac,
                                 size_t mac_size,
                                 size_t *mac_length)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED;

    if (operation->id == 0) {
        status = PSA_ERROR_BAD_STATE;
        goto exit;
    }

    if (!operation->is_sign) {
        status = PSA_ERROR_BAD_STATE;
        goto exit;
    }

    /* Sanity check. This will guarantee that mac_size != 0 (and so mac != NULL)
     * once all the error checks are done. */
    if (operation->mac_size == 0) {
        status = PSA_ERROR_BAD_STATE;
        goto exit;
    }

    if (mac_size < operation->mac_size) {
        status = PSA_ERROR_BUFFER_TOO_SMALL;
        goto exit;
    }

    status = psa_driver_wrapper_mac_sign_finish(
        operation, mac, operation->mac_size, mac_length);

exit:
    /* In case of success, set the potential excess room in the output buffer
     * to an invalid value, to avoid potentially leaking a longer MAC.
     * In case of error, set the output length and content to a safe default,
     * such that in case the caller misses an error check, the output would be
     * an unachievable MAC.
     */
    if (status != PSA_SUCCESS) {
        *mac_length = mac_size;
        operation->mac_size = 0;
    }

    if (mac_size > operation->mac_size)
        memset(&mac[operation->mac_size], '!', mac_size - operation->mac_size);

    abort_status = psa_mac_abort(operation);

    return status == PSA_SUCCESS ? abort_status : status;
}

psa_status_t psa_mac_verify_finish(psa_mac_operation_t *operation,
                                   const uint8_t *mac,
                                   size_t mac_length)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED;

    if (operation->id == 0) {
        status = PSA_ERROR_BAD_STATE;
        goto exit;
    }

    if (operation->is_sign) {
        status = PSA_ERROR_BAD_STATE;
        goto exit;
    }

    if (operation->mac_size != mac_length) {
        status = PSA_ERROR_INVALID_SIGNATURE;
        goto exit;
    }

    status = psa_driver_wrapper_mac_verify_finish(operation, mac, mac_length);

exit:
    abort_status = psa_mac_abort(operation);

    return status == PSA_SUCCESS ? abort_status : status;
}

static psa_status_t psa_mac_compute_internal(mbedtls_svc_key_id_t key,
                                             psa_algorithm_t alg,
                                             const uint8_t *input,
                                             size_t input_length,
                                             uint8_t *mac,
                                             size_t mac_size,
                                             size_t *mac_length,
                                             int is_sign)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_key_slot_t *slot;
    uint8_t operation_mac_size = 0;

    status = psa_get_and_lock_key_slot_with_policy(
        key, &slot,
        is_sign ? PSA_KEY_USAGE_SIGN_HASH : PSA_KEY_USAGE_VERIFY_HASH, alg);
    if (status != PSA_SUCCESS)
        goto exit;

    psa_key_attributes_t attributes = { .core = slot->attr };

    status = psa_mac_finalize_alg_and_key_validation(alg, &attributes,
                                                     &operation_mac_size);
    if (status != PSA_SUCCESS)
        goto exit;

    if (mac_size < operation_mac_size) {
        status = PSA_ERROR_BUFFER_TOO_SMALL;
        goto exit;
    }

    status = psa_driver_wrapper_mac_compute(&attributes, slot->key.data,
                                            slot->key.bytes, alg, input,
                                            input_length, mac,
                                            operation_mac_size, mac_length);

exit:
    /* In case of success, set the potential excess room in the output buffer
     * to an invalid value, to avoid potentially leaking a longer MAC.
     * In case of error, set the output length and content to a safe default,
     * such that in case the caller misses an error check, the output would be
     * an unachievable MAC.
     */
    if (status != PSA_SUCCESS) {
        *mac_length = mac_size;
        operation_mac_size = 0;
    }
    if (mac_size > operation_mac_size)
        memset(&mac[operation_mac_size], '!', mac_size - operation_mac_size);

    unlock_status = psa_unlock_key_slot(slot);

    return (status == PSA_SUCCESS) ? unlock_status : status;
}

psa_status_t psa_mac_compute(mbedtls_svc_key_id_t key,
                             psa_algorithm_t alg,
                             const uint8_t *input,
                             size_t input_length,
                             uint8_t *mac,
                             size_t mac_size,
                             size_t *mac_length)
{
    return (psa_mac_compute_internal(key, alg, input, input_length, mac,
                                     mac_size, mac_length, 1));
}

psa_status_t psa_mac_verify(mbedtls_svc_key_id_t key,
                            psa_algorithm_t alg,
                            const uint8_t *input,
                            size_t input_length,
                            const uint8_t *mac,
                            size_t mac_length)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
    uint8_t actual_mac[PSA_MAC_MAX_SIZE];
    size_t actual_mac_length;

    status = psa_mac_compute_internal(key, alg, input, input_length, actual_mac,
                                      sizeof(actual_mac), &actual_mac_length,
                                      0);
    if (status != PSA_SUCCESS)
        goto exit;

    if (mac_length != actual_mac_length) {
        status = PSA_ERROR_INVALID_SIGNATURE;
        goto exit;
    }
    if (mbedtls_psa_safer_memcmp(mac, actual_mac, actual_mac_length) != 0) {
        status = PSA_ERROR_INVALID_SIGNATURE;
        goto exit;
    }

exit:
    mbedtls_platform_zeroize(actual_mac, sizeof(actual_mac));

    return status;
}

/****************************************************************/
/* Asymmetric cryptography */
/****************************************************************/

static psa_status_t psa_sign_verify_check_alg(int input_is_message,
                                              psa_algorithm_t alg)
{
    if (input_is_message) {
        if (!PSA_ALG_IS_SIGN_MESSAGE(alg))
            return PSA_ERROR_INVALID_ARGUMENT;

        if (PSA_ALG_IS_HASH_AND_SIGN(alg)) {
            if (!PSA_ALG_IS_HASH(PSA_ALG_SIGN_GET_HASH(alg)))
                return PSA_ERROR_INVALID_ARGUMENT;
        }
    } else {
        if (!PSA_ALG_IS_HASH_AND_SIGN(alg))
            return PSA_ERROR_INVALID_ARGUMENT;
    }

    return PSA_SUCCESS;
}

static psa_status_t psa_sign_internal(mbedtls_svc_key_id_t key,
                                      int input_is_message,
                                      psa_algorithm_t alg,
                                      const uint8_t *input,
                                      size_t input_length,
                                      uint8_t *signature,
                                      size_t signature_size,
                                      size_t *signature_length)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_key_slot_t *slot;

    *signature_length = 0;

    status = psa_sign_verify_check_alg(input_is_message, alg);
    if (status != PSA_SUCCESS)
        return status;

    /* Immediately reject a zero-length signature buffer. This guarantees
     * that signature must be a valid pointer. (On the other hand, the input
     * buffer can in principle be empty since it doesn't actually have
     * to be a hash.) */
    if (signature_size == 0)
        return PSA_ERROR_BUFFER_TOO_SMALL;

    status = psa_get_and_lock_key_slot_with_policy(
        key, &slot,
        input_is_message ? PSA_KEY_USAGE_SIGN_MESSAGE : PSA_KEY_USAGE_SIGN_HASH,
        alg);

    if (status != PSA_SUCCESS)
        goto exit;

    if (!PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type)) {
        status = PSA_ERROR_INVALID_ARGUMENT;
        goto exit;
    }

    psa_key_attributes_t attributes = { .core = slot->attr };

    if (input_is_message) {
        status = psa_driver_wrapper_sign_message(
            &attributes, slot->key.data, slot->key.bytes, alg, input,
            input_length, signature, signature_size, signature_length);
    } else {
        status = psa_driver_wrapper_sign_hash(&attributes, slot->key.data,
                                              slot->key.bytes, alg, input,
                                              input_length, signature,
                                              signature_size, signature_length);
    }

exit:
    /* Fill the unused part of the output buffer (the whole buffer on error,
     * the trailing part on success) with something that isn't a valid signature
     * (barring an attack on the signature and deliberately-crafted input),
     * in case the caller doesn't check the return status properly. */
    if (status == PSA_SUCCESS)
        memset(signature + *signature_length, '!',
               signature_size - *signature_length);
    else
        memset(signature, '!', signature_size);
    /* If signature_size is 0 then we have nothing to do. We must not call
     * memset because signature may be NULL in this case. */

    unlock_status = psa_unlock_key_slot(slot);

    return (status == PSA_SUCCESS) ? unlock_status : status;
}

static psa_status_t psa_verify_internal(mbedtls_svc_key_id_t key,
                                        int input_is_message,
                                        psa_algorithm_t alg,
                                        const uint8_t *input,
                                        size_t input_length,
                                        const uint8_t *signature,
                                        size_t signature_length)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_key_slot_t *slot;

    status = psa_sign_verify_check_alg(input_is_message, alg);
    if (status != PSA_SUCCESS)
        return status;

    status = psa_get_and_lock_key_slot_with_policy(
        key, &slot,
        input_is_message ? PSA_KEY_USAGE_VERIFY_MESSAGE :
                           PSA_KEY_USAGE_VERIFY_HASH,
        alg);

    if (status != PSA_SUCCESS)
        return status;

    psa_key_attributes_t attributes = { .core = slot->attr };

    if (input_is_message) {
        status = psa_driver_wrapper_verify_message(&attributes, slot->key.data,
                                                   slot->key.bytes, alg, input,
                                                   input_length, signature,
                                                   signature_length);
    } else {
        status = psa_driver_wrapper_verify_hash(&attributes, slot->key.data,
                                                slot->key.bytes, alg, input,
                                                input_length, signature,
                                                signature_length);
    }

    unlock_status = psa_unlock_key_slot(slot);

    return (status == PSA_SUCCESS) ? unlock_status : status;
}

psa_status_t psa_sign_message_builtin(const psa_key_attributes_t *attributes,
                                      const uint8_t *key_buffer,
                                      size_t key_buffer_size,
                                      psa_algorithm_t alg,
                                      const uint8_t *input,
                                      size_t input_length,
                                      uint8_t *signature,
                                      size_t signature_size,
                                      size_t *signature_length)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;

    if (PSA_ALG_IS_HASH_AND_SIGN(alg)) {
        size_t hash_length;
        uint8_t hash[PSA_HASH_MAX_SIZE];

        status = psa_driver_wrapper_hash_compute(PSA_ALG_SIGN_GET_HASH(alg),
                                                 input, input_length, hash,
                                                 sizeof(hash), &hash_length);

        if (status != PSA_SUCCESS)
            return status;

        return psa_driver_wrapper_sign_hash(attributes, key_buffer,
                                            key_buffer_size, alg, hash,
                                            hash_length, signature,
                                            signature_size, signature_length);
    }

    return PSA_ERROR_NOT_SUPPORTED;
}

psa_status_t psa_sign_message(mbedtls_svc_key_id_t key,
                              psa_algorithm_t alg,
                              const uint8_t *input,
                              size_t input_length,
                              uint8_t *signature,
                              size_t signature_size,
                              size_t *signature_length)
{
    return psa_sign_internal(key, 1, alg, input, input_length, signature,
                             signature_size, signature_length);
}

psa_status_t psa_verify_message_builtin(const psa_key_attributes_t *attributes,
                                        const uint8_t *key_buffer,
                                        size_t key_buffer_size,
                                        psa_algorithm_t alg,
                                        const uint8_t *input,
                                        size_t input_length,
                                        const uint8_t *signature,
                                        size_t signature_length)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;

    if (PSA_ALG_IS_HASH_AND_SIGN(alg)) {
        size_t hash_length;
        uint8_t hash[PSA_HASH_MAX_SIZE];

        status = psa_driver_wrapper_hash_compute(PSA_ALG_SIGN_GET_HASH(alg),
                                                 input, input_length, hash,
                                                 sizeof(hash), &hash_length);

        if (status != PSA_SUCCESS)
            return status;

        return psa_driver_wrapper_verify_hash(attributes, key_buffer,
                                              key_buffer_size, alg, hash,
                                              hash_length, signature,
                                              signature_length);
    }

    return PSA_ERROR_NOT_SUPPORTED;
}

psa_status_t psa_verify_message(mbedtls_svc_key_id_t key,
                                psa_algorithm_t alg,
                                const uint8_t *input,
                                size_t input_length,
                                const uint8_t *signature,
                                size_t signature_length)
{
    return psa_verify_internal(key, 1, alg, input, input_length, signature,
                               signature_length);
}

psa_status_t psa_sign_hash_builtin(const psa_key_attributes_t *attributes,
                                   const uint8_t *key_buffer,
                                   size_t key_buffer_size,
                                   psa_algorithm_t alg,
                                   const uint8_t *hash,
                                   size_t hash_length,
                                   uint8_t *signature,
                                   size_t signature_size,
                                   size_t *signature_length)
{
    if (attributes->core.type == PSA_KEY_TYPE_RSA_KEY_PAIR) {
        if (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) || PSA_ALG_IS_RSA_PSS(alg)) {
#    if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
        defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
            return (mbedtls_psa_rsa_sign_hash(
                attributes, key_buffer, key_buffer_size, alg, hash, hash_length,
                signature, signature_size, signature_length));
#    endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
            * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
        } else {
            return PSA_ERROR_INVALID_ARGUMENT;
        }
    } else if (PSA_KEY_TYPE_IS_ECC(attributes->core.type)) {
        if (PSA_ALG_IS_ECDSA(alg)) {
#    if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
        defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
            return (mbedtls_psa_ecdsa_sign_hash(
                attributes, key_buffer, key_buffer_size, alg, hash, hash_length,
                signature, signature_size, signature_length));
#    endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
            * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
        } else {
            return PSA_ERROR_INVALID_ARGUMENT;
        }
    }

    (void)key_buffer;
    (void)key_buffer_size;
    (void)hash;
    (void)hash_length;
    (void)signature;
    (void)signature_size;
    (void)signature_length;

    return PSA_ERROR_NOT_SUPPORTED;
}

psa_status_t psa_sign_hash(mbedtls_svc_key_id_t key,
                           psa_algorithm_t alg,
                           const uint8_t *hash,
                           size_t hash_length,
                           uint8_t *signature,
                           size_t signature_size,
                           size_t *signature_length)
{
    return psa_sign_internal(key, 0, alg, hash, hash_length, signature,
                             signature_size, signature_length);
}

psa_status_t psa_verify_hash_builtin(const psa_key_attributes_t *attributes,
                                     const uint8_t *key_buffer,
                                     size_t key_buffer_size,
                                     psa_algorithm_t alg,
                                     const uint8_t *hash,
                                     size_t hash_length,
                                     const uint8_t *signature,
                                     size_t signature_length)
{
    if (PSA_KEY_TYPE_IS_RSA(attributes->core.type)) {
        if (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) || PSA_ALG_IS_RSA_PSS(alg)) {
#    if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
        defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
            return (mbedtls_psa_rsa_verify_hash(
                attributes, key_buffer, key_buffer_size, alg, hash, hash_length,
                signature, signature_length));
#    endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
            * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
        } else {
            return PSA_ERROR_INVALID_ARGUMENT;
        }
    } else if (PSA_KEY_TYPE_IS_ECC(attributes->core.type)) {
        if (PSA_ALG_IS_ECDSA(alg)) {
#    if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
        defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
            return (mbedtls_psa_ecdsa_verify_hash(
                attributes, key_buffer, key_buffer_size, alg, hash, hash_length,
                signature, signature_length));
#    endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
            * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
        } else {
            return PSA_ERROR_INVALID_ARGUMENT;
        }
    }

    (void)key_buffer;
    (void)key_buffer_size;
    (void)hash;
    (void)hash_length;
    (void)signature;
    (void)signature_length;

    return PSA_ERROR_NOT_SUPPORTED;
}

psa_status_t psa_verify_hash(mbedtls_svc_key_id_t key,
                             psa_algorithm_t alg,
                             const uint8_t *hash,
                             size_t hash_length,
                             const uint8_t *signature,
                             size_t signature_length)
{
    return psa_verify_internal(key, 0, alg, hash, hash_length, signature,
                               signature_length);
}

#    if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
static int psa_rsa_oaep_set_padding_mode(psa_algorithm_t alg,
                                         mbedtls_rsa_context *rsa)
{
    psa_algorithm_t hash_alg = PSA_ALG_RSA_OAEP_GET_HASH(alg);
    const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa(hash_alg);
    mbedtls_md_type_t md_alg = mbedtls_md_get_type(md_info);

    return mbedtls_rsa_set_padding(rsa, MBEDTLS_RSA_PKCS_V21, md_alg);
}
#    endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */

psa_status_t psa_asymmetric_encrypt(mbedtls_svc_key_id_t key,
                                    psa_algorithm_t alg,
                                    const uint8_t *input,
                                    size_t input_length,
                                    const uint8_t *salt,
                                    size_t salt_length,
                                    uint8_t *output,
                                    size_t output_size,
                                    size_t *output_length)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_key_slot_t *slot;

    (void)input;
    (void)input_length;
    (void)salt;
    (void)output;
    (void)output_size;

    *output_length = 0;

    if (!PSA_ALG_IS_RSA_OAEP(alg) && salt_length != 0)
        return PSA_ERROR_INVALID_ARGUMENT;

    status = psa_get_and_lock_transparent_key_slot_with_policy(
        key, &slot, PSA_KEY_USAGE_ENCRYPT, alg);
    if (status != PSA_SUCCESS)
        return status;
    if (!(PSA_KEY_TYPE_IS_PUBLIC_KEY(slot->attr.type) ||
          PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type))) {
        status = PSA_ERROR_INVALID_ARGUMENT;
        goto exit;
    }

#    if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \
        defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
    if (PSA_KEY_TYPE_IS_RSA(slot->attr.type)) {
        mbedtls_rsa_context *rsa = NULL;
        status = mbedtls_psa_rsa_load_representation(
            slot->attr.type, slot->key.data, slot->key.bytes, &rsa);
        if (status != PSA_SUCCESS)
            goto rsa_exit;

        if (output_size < mbedtls_rsa_get_len(rsa)) {
            status = PSA_ERROR_BUFFER_TOO_SMALL;
            goto rsa_exit;
        }
#        if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT)
        if (alg == PSA_ALG_RSA_PKCS1V15_CRYPT) {
            status = mbedtls_to_psa_error(mbedtls_rsa_pkcs1_encrypt(
                rsa, mbedtls_psa_get_random, MBEDTLS_PSA_RANDOM_STATE,
                input_length, input, output));
        } else
#        endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT */
#        if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
            if (PSA_ALG_IS_RSA_OAEP(alg)) {
            status =
                mbedtls_to_psa_error(psa_rsa_oaep_set_padding_mode(alg, rsa));
            if (status != PSA_SUCCESS)
                goto rsa_exit;

            status = mbedtls_to_psa_error(mbedtls_rsa_rsaes_oaep_encrypt(
                rsa, mbedtls_psa_get_random, MBEDTLS_PSA_RANDOM_STATE, salt,
                salt_length, input_length, input, output));
        } else
#        endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP */
        {
            status = PSA_ERROR_INVALID_ARGUMENT;
            goto rsa_exit;
        }
rsa_exit:
        if (status == PSA_SUCCESS)
            *output_length = mbedtls_rsa_get_len(rsa);

        mbedtls_rsa_free(rsa);
        mbedtls_free(rsa);
    } else
#    endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \
            * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */
    {
        status = PSA_ERROR_NOT_SUPPORTED;
    }

exit:
    unlock_status = psa_unlock_key_slot(slot);

    return (status == PSA_SUCCESS) ? unlock_status : status;
}

psa_status_t psa_asymmetric_decrypt(mbedtls_svc_key_id_t key,
                                    psa_algorithm_t alg,
                                    const uint8_t *input,
                                    size_t input_length,
                                    const uint8_t *salt,
                                    size_t salt_length,
                                    uint8_t *output,
                                    size_t output_size,
                                    size_t *output_length)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_key_slot_t *slot;

    (void)input;
    (void)input_length;
    (void)salt;
    (void)output;
    (void)output_size;

    *output_length = 0;

    if (!PSA_ALG_IS_RSA_OAEP(alg) && salt_length != 0)
        return PSA_ERROR_INVALID_ARGUMENT;

    status = psa_get_and_lock_transparent_key_slot_with_policy(
        key, &slot, PSA_KEY_USAGE_DECRYPT, alg);
    if (status != PSA_SUCCESS)
        return status;
    if (!PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type)) {
        status = PSA_ERROR_INVALID_ARGUMENT;
        goto exit;
    }

#    if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \
        defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
    if (slot->attr.type == PSA_KEY_TYPE_RSA_KEY_PAIR) {
        mbedtls_rsa_context *rsa = NULL;
        status = mbedtls_psa_rsa_load_representation(
            slot->attr.type, slot->key.data, slot->key.bytes, &rsa);
        if (status != PSA_SUCCESS)
            goto exit;

        if (input_length != mbedtls_rsa_get_len(rsa)) {
            status = PSA_ERROR_INVALID_ARGUMENT;
            goto rsa_exit;
        }

#        if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT)
        if (alg == PSA_ALG_RSA_PKCS1V15_CRYPT) {
            status = mbedtls_to_psa_error(mbedtls_rsa_pkcs1_decrypt(
                rsa, mbedtls_psa_get_random, MBEDTLS_PSA_RANDOM_STATE,
                output_length, input, output, output_size));
        } else
#        endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT */
#        if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
            if (PSA_ALG_IS_RSA_OAEP(alg)) {
            status =
                mbedtls_to_psa_error(psa_rsa_oaep_set_padding_mode(alg, rsa));
            if (status != PSA_SUCCESS)
                goto rsa_exit;

            status = mbedtls_to_psa_error(mbedtls_rsa_rsaes_oaep_decrypt(
                rsa, mbedtls_psa_get_random, MBEDTLS_PSA_RANDOM_STATE, salt,
                salt_length, output_length, input, output, output_size));
        } else
#        endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP */
        {
            status = PSA_ERROR_INVALID_ARGUMENT;
        }

rsa_exit:
        mbedtls_rsa_free(rsa);
        mbedtls_free(rsa);
    } else
#    endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \
            * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */
    {
        status = PSA_ERROR_NOT_SUPPORTED;
    }

exit:
    unlock_status = psa_unlock_key_slot(slot);

    return (status == PSA_SUCCESS) ? unlock_status : status;
}

/****************************************************************/
/* Symmetric cryptography */
/****************************************************************/

static psa_status_t psa_cipher_setup(psa_cipher_operation_t *operation,
                                     mbedtls_svc_key_id_t key,
                                     psa_algorithm_t alg,
                                     mbedtls_operation_t cipher_operation)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_key_slot_t *slot = NULL;
    psa_key_usage_t usage = (cipher_operation == MBEDTLS_ENCRYPT ?
                                 PSA_KEY_USAGE_ENCRYPT :
                                 PSA_KEY_USAGE_DECRYPT);

    /* A context must be freshly initialized before it can be set up. */
    if (operation->id != 0) {
        status = PSA_ERROR_BAD_STATE;
        goto exit;
    }

    if (!PSA_ALG_IS_CIPHER(alg)) {
        status = PSA_ERROR_INVALID_ARGUMENT;
        goto exit;
    }

    status = psa_get_and_lock_key_slot_with_policy(key, &slot, usage, alg);
    if (status != PSA_SUCCESS)
        goto exit;

    /* Initialize the operation struct members, except for id. The id member
     * is used to indicate to psa_cipher_abort that there are resources to free,
     * so we only set it (in the driver wrapper) after resources have been
     * allocated/initialized. */
    operation->iv_set = 0;
    if (alg == PSA_ALG_ECB_NO_PADDING)
        operation->iv_required = 0;
    else
        operation->iv_required = 1;
    operation->default_iv_length = PSA_CIPHER_IV_LENGTH(slot->attr.type, alg);

    psa_key_attributes_t attributes = { .core = slot->attr };

    /* Try doing the operation through a driver before using software fallback.
     */
    if (cipher_operation == MBEDTLS_ENCRYPT)
        status = psa_driver_wrapper_cipher_encrypt_setup(
            operation, &attributes, slot->key.data, slot->key.bytes, alg);
    else
        status = psa_driver_wrapper_cipher_decrypt_setup(
            operation, &attributes, slot->key.data, slot->key.bytes, alg);

exit:
    if (status != PSA_SUCCESS)
        psa_cipher_abort(operation);

    unlock_status = psa_unlock_key_slot(slot);

    return (status == PSA_SUCCESS) ? unlock_status : status;
}

psa_status_t psa_cipher_encrypt_setup(psa_cipher_operation_t *operation,
                                      mbedtls_svc_key_id_t key,
                                      psa_algorithm_t alg)
{
    return psa_cipher_setup(operation, key, alg, MBEDTLS_ENCRYPT);
}

psa_status_t psa_cipher_decrypt_setup(psa_cipher_operation_t *operation,
                                      mbedtls_svc_key_id_t key,
                                      psa_algorithm_t alg)
{
    return psa_cipher_setup(operation, key, alg, MBEDTLS_DECRYPT);
}

psa_status_t psa_cipher_generate_iv(psa_cipher_operation_t *operation,
                                    uint8_t *iv,
                                    size_t iv_size,
                                    size_t *iv_length)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;

    *iv_length = 0;

    if (operation->id == 0) {
        status = PSA_ERROR_BAD_STATE;
        goto exit;
    }

    if (operation->iv_set || !operation->iv_required) {
        status = PSA_ERROR_BAD_STATE;
        goto exit;
    }

    if (iv_size < operation->default_iv_length) {
        status = PSA_ERROR_BUFFER_TOO_SMALL;
        goto exit;
    }

    status = psa_generate_random(iv, operation->default_iv_length);
    if (status != PSA_SUCCESS)
        goto exit;

    status = psa_driver_wrapper_cipher_set_iv(operation, iv,
                                              operation->default_iv_length);

exit:
    if (status == PSA_SUCCESS) {
        operation->iv_set = 1;
        *iv_length = operation->default_iv_length;
    } else
        psa_cipher_abort(operation);

    return status;
}

psa_status_t psa_cipher_set_iv(psa_cipher_operation_t *operation,
                               const uint8_t *iv,
                               size_t iv_length)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;

    if (operation->id == 0) {
        status = PSA_ERROR_BAD_STATE;
        goto exit;
    }

    if (operation->iv_set || !operation->iv_required) {
        status = PSA_ERROR_BAD_STATE;
        goto exit;
    }

    if (iv_length > PSA_CIPHER_IV_MAX_SIZE) {
        status = PSA_ERROR_INVALID_ARGUMENT;
        goto exit;
    }

    status = psa_driver_wrapper_cipher_set_iv(operation, iv, iv_length);

exit:
    if (status == PSA_SUCCESS)
        operation->iv_set = 1;
    else
        psa_cipher_abort(operation);
    return status;
}

psa_status_t psa_cipher_update(psa_cipher_operation_t *operation,
                               const uint8_t *input,
                               size_t input_length,
                               uint8_t *output,
                               size_t output_size,
                               size_t *output_length)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;

    if (operation->id == 0) {
        status = PSA_ERROR_BAD_STATE;
        goto exit;
    }

    if (operation->iv_required && !operation->iv_set) {
        status = PSA_ERROR_BAD_STATE;
        goto exit;
    }

    status = psa_driver_wrapper_cipher_update(
        operation, input, input_length, output, output_size, output_length);

exit:
    if (status != PSA_SUCCESS)
        psa_cipher_abort(operation);

    return status;
}

psa_status_t psa_cipher_finish(psa_cipher_operation_t *operation,
                               uint8_t *output,
                               size_t output_size,
                               size_t *output_length)
{
    psa_status_t status = PSA_ERROR_GENERIC_ERROR;

    if (operation->id == 0) {
        status = PSA_ERROR_BAD_STATE;
        goto exit;
    }

    if (operation->iv_required && !operation->iv_set) {
        status = PSA_ERROR_BAD_STATE;
        goto exit;
    }

    status = psa_driver_wrapper_cipher_finish(operation, output, output_size,
                                              output_length);

exit:
    if (status == PSA_SUCCESS)
        return psa_cipher_abort(operation);
    else {
        *output_length = 0;
        (void)psa_cipher_abort(operation);

        return status;
    }
}

psa_status_t psa_cipher_abort(psa_cipher_operation_t *operation)
{
    if (operation->id == 0) {
        /* The object has (apparently) been initialized but it is not (yet)
         * in use. It's ok to call abort on such an object, and there's
         * nothing to do. */
        return PSA_SUCCESS;
    }

    psa_driver_wrapper_cipher_abort(operation);

    operation->id = 0;
    operation->iv_set = 0;
    operation->iv_required = 0;

    return PSA_SUCCESS;
}

psa_status_t psa_cipher_encrypt(mbedtls_svc_key_id_t key,
                                psa_algorithm_t alg,
                                const uint8_t *input,
                                size_t input_length,
                                uint8_t *output,
                                size_t output_size,
                                size_t *output_length)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_key_slot_t *slot;
    psa_key_type_t key_type;
    size_t iv_length;

    *output_length = 0;

    if (!PSA_ALG_IS_CIPHER(alg))
        return PSA_ERROR_INVALID_ARGUMENT;

    status = psa_get_and_lock_key_slot_with_policy(key, &slot,
                                                   PSA_KEY_USAGE_ENCRYPT, alg);
    if (status != PSA_SUCCESS)
        return status;

    psa_key_attributes_t attributes = { .core = slot->attr };

    key_type = slot->attr.type;
    iv_length = PSA_CIPHER_IV_LENGTH(key_type, alg);

    if (iv_length > 0) {
        if (output_size < iv_length) {
            status = PSA_ERROR_BUFFER_TOO_SMALL;
            goto exit;
        }

        status = psa_generate_random(output, iv_length);
        if (status != PSA_SUCCESS)
            goto exit;
    }

    status = psa_driver_wrapper_cipher_encrypt(&attributes, slot->key.data,
                                               slot->key.bytes, alg, input,
                                               input_length, output,
                                               output_size, output_length);

exit:
    unlock_status = psa_unlock_key_slot(slot);

    return (status == PSA_SUCCESS) ? unlock_status : status;
}

psa_status_t psa_cipher_decrypt(mbedtls_svc_key_id_t key,
                                psa_algorithm_t alg,
                                const uint8_t *input,
                                size_t input_length,
                                uint8_t *output,
                                size_t output_size,
                                size_t *output_length)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_key_slot_t *slot;

    *output_length = 0;

    if (!PSA_ALG_IS_CIPHER(alg))
        return PSA_ERROR_INVALID_ARGUMENT;

    status = psa_get_and_lock_key_slot_with_policy(key, &slot,
                                                   PSA_KEY_USAGE_DECRYPT, alg);
    if (status != PSA_SUCCESS)
        return status;

    psa_key_attributes_t attributes = { .core = slot->attr };

    if (input_length < PSA_CIPHER_IV_LENGTH(slot->attr.type, alg)) {
        status = PSA_ERROR_INVALID_ARGUMENT;
        goto exit;
    }

    status = psa_driver_wrapper_cipher_decrypt(&attributes, slot->key.data,
                                               slot->key.bytes, alg, input,
                                               input_length, output,
                                               output_size, output_length);

exit:
    unlock_status = psa_unlock_key_slot(slot);

    return (status == PSA_SUCCESS) ? unlock_status : status;
}

/****************************************************************/
/* AEAD */
/****************************************************************/

psa_status_t psa_aead_encrypt(mbedtls_svc_key_id_t key,
                              psa_algorithm_t alg,
                              const uint8_t *nonce,
                              size_t nonce_length,
                              const uint8_t *additional_data,
                              size_t additional_data_length,
                              const uint8_t *plaintext,
                              size_t plaintext_length,
                              uint8_t *ciphertext,
                              size_t ciphertext_size,
                              size_t *ciphertext_length)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_key_slot_t *slot;

    *ciphertext_length = 0;

    if (!PSA_ALG_IS_AEAD(alg) || PSA_ALG_IS_WILDCARD(alg))
        return PSA_ERROR_NOT_SUPPORTED;

    status = psa_get_and_lock_key_slot_with_policy(key, &slot,
                                                   PSA_KEY_USAGE_ENCRYPT, alg);
    if (status != PSA_SUCCESS)
        return status;

    psa_key_attributes_t attributes = { .core = slot->attr };

    status = psa_driver_wrapper_aead_encrypt(
        &attributes, slot->key.data, slot->key.bytes, alg, nonce, nonce_length,
        additional_data, additional_data_length, plaintext, plaintext_length,
        ciphertext, ciphertext_size, ciphertext_length);

    if (status != PSA_SUCCESS && ciphertext_size != 0)
        memset(ciphertext, 0, ciphertext_size);

    psa_unlock_key_slot(slot);

    return status;
}

psa_status_t psa_aead_decrypt(mbedtls_svc_key_id_t key,
                              psa_algorithm_t alg,
                              const uint8_t *nonce,
                              size_t nonce_length,
                              const uint8_t *additional_data,
                              size_t additional_data_length,
                              const uint8_t *ciphertext,
                              size_t ciphertext_length,
                              uint8_t *plaintext,
                              size_t plaintext_size,
                              size_t *plaintext_length)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_key_slot_t *slot;

    *plaintext_length = 0;

    if (!PSA_ALG_IS_AEAD(alg) || PSA_ALG_IS_WILDCARD(alg))
        return PSA_ERROR_NOT_SUPPORTED;

    status = psa_get_and_lock_key_slot_with_policy(key, &slot,
                                                   PSA_KEY_USAGE_DECRYPT, alg);
    if (status != PSA_SUCCESS)
        return status;

    psa_key_attributes_t attributes = { .core = slot->attr };

    status = psa_driver_wrapper_aead_decrypt(
        &attributes, slot->key.data, slot->key.bytes, alg, nonce, nonce_length,
        additional_data, additional_data_length, ciphertext, ciphertext_length,
        plaintext, plaintext_size, plaintext_length);

    if (status != PSA_SUCCESS && plaintext_size != 0)
        memset(plaintext, 0, plaintext_size);

    psa_unlock_key_slot(slot);

    return status;
}

/****************************************************************/
/* Generators */
/****************************************************************/

#    if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF) ||      \
        defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
        defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
#        define AT_LEAST_ONE_BUILTIN_KDF
#    endif /* At least one builtin KDF */

#    if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF) ||      \
        defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
        defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
static psa_status_t
psa_key_derivation_start_hmac(psa_mac_operation_t *operation,
                              psa_algorithm_t hash_alg,
                              const uint8_t *hmac_key,
                              size_t hmac_key_length)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
    psa_set_key_type(&attributes, PSA_KEY_TYPE_HMAC);
    psa_set_key_bits(&attributes, PSA_BYTES_TO_BITS(hmac_key_length));
    psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_HASH);

    operation->is_sign = 1;
    operation->mac_size = PSA_HASH_LENGTH(hash_alg);

    status = psa_driver_wrapper_mac_sign_setup(operation, &attributes, hmac_key,
                                               hmac_key_length,
                                               PSA_ALG_HMAC(hash_alg));

    psa_reset_key_attributes(&attributes);
    return status;
}
#    endif /* KDF algorithms reliant on HMAC */

#    define HKDF_STATE_INIT    0 /* no input yet */
#    define HKDF_STATE_STARTED 1 /* got salt */
#    define HKDF_STATE_KEYED   2 /* got key */
#    define HKDF_STATE_OUTPUT  3 /* output started */

static psa_algorithm_t
psa_key_derivation_get_kdf_alg(const psa_key_derivation_operation_t *operation)
{
    if (PSA_ALG_IS_KEY_AGREEMENT(operation->alg))
        return PSA_ALG_KEY_AGREEMENT_GET_KDF(operation->alg);
    else
        return operation->alg;
}

psa_status_t psa_key_derivation_abort(psa_key_derivation_operation_t *operation)
{
    psa_status_t status = PSA_SUCCESS;
    psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation);
    if (kdf_alg == 0) {
        /* The object has (apparently) been initialized but it is not
         * in use. It's ok to call abort on such an object, and there's
         * nothing to do. */
    } else
#    if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
        if (PSA_ALG_IS_HKDF(kdf_alg)) {
        mbedtls_free(operation->ctx.hkdf.info);
        status = psa_mac_abort(&operation->ctx.hkdf.hmac);
    } else
#    endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF */
#    if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
        defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
        if (PSA_ALG_IS_TLS12_PRF(kdf_alg) ||
            /* TLS-1.2 PSK-to-MS KDF uses the same core as TLS-1.2 PRF */
            PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
        if (operation->ctx.tls12_prf.secret != NULL) {
            mbedtls_platform_zeroize(operation->ctx.tls12_prf.secret,
                                     operation->ctx.tls12_prf.secret_length);
            mbedtls_free(operation->ctx.tls12_prf.secret);
        }

        if (operation->ctx.tls12_prf.seed != NULL) {
            mbedtls_platform_zeroize(operation->ctx.tls12_prf.seed,
                                     operation->ctx.tls12_prf.seed_length);
            mbedtls_free(operation->ctx.tls12_prf.seed);
        }

        if (operation->ctx.tls12_prf.label != NULL) {
            mbedtls_platform_zeroize(operation->ctx.tls12_prf.label,
                                     operation->ctx.tls12_prf.label_length);
            mbedtls_free(operation->ctx.tls12_prf.label);
        }

        status = PSA_SUCCESS;

        /* We leave the fields Ai and output_block to be erased safely by the
         * mbedtls_platform_zeroize() in the end of this function. */
    } else
#    endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
            * defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) */
    {
        status = PSA_ERROR_BAD_STATE;
    }
    mbedtls_platform_zeroize(operation, sizeof(*operation));
    return status;
}

psa_status_t
psa_key_derivation_get_capacity(const psa_key_derivation_operation_t *operation,
                                size_t *capacity)
{
    if (operation->alg == 0) {
        /* This is a blank key derivation operation. */
        return PSA_ERROR_BAD_STATE;
    }

    *capacity = operation->capacity;
    return PSA_SUCCESS;
}

psa_status_t
psa_key_derivation_set_capacity(psa_key_derivation_operation_t *operation,
                                size_t capacity)
{
    if (operation->alg == 0)
        return PSA_ERROR_BAD_STATE;
    if (capacity > operation->capacity)
        return PSA_ERROR_INVALID_ARGUMENT;
    operation->capacity = capacity;
    return PSA_SUCCESS;
}

#    if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
/* Read some bytes from an HKDF-based operation. This performs a chunk
 * of the expand phase of the HKDF algorithm. */
static psa_status_t
psa_key_derivation_hkdf_read(psa_hkdf_key_derivation_t *hkdf,
                             psa_algorithm_t hash_alg,
                             uint8_t *output,
                             size_t output_length)
{
    uint8_t hash_length = PSA_HASH_LENGTH(hash_alg);
    size_t hmac_output_length;
    psa_status_t status;

    if (hkdf->state < HKDF_STATE_KEYED || !hkdf->info_set)
        return PSA_ERROR_BAD_STATE;
    hkdf->state = HKDF_STATE_OUTPUT;

    while (output_length != 0) {
        /* Copy what remains of the current block */
        uint8_t n = hash_length - hkdf->offset_in_block;
        if (n > output_length)
            n = (uint8_t)output_length;
        memcpy(output, hkdf->output_block + hkdf->offset_in_block, n);
        output += n;
        output_length -= n;
        hkdf->offset_in_block += n;
        if (output_length == 0)
            break;
        /* We can't be wanting more output after block 0xff, otherwise
         * the capacity check in psa_key_derivation_output_bytes() would have
         * prevented this call. It could happen only if the operation
         * object was corrupted or if this function is called directly
         * inside the library. */
        if (hkdf->block_number == 0xff)
            return PSA_ERROR_BAD_STATE;

        /* We need a new block */
        ++hkdf->block_number;
        hkdf->offset_in_block = 0;

        status = psa_key_derivation_start_hmac(&hkdf->hmac, hash_alg, hkdf->prk,
                                               hash_length);
        if (status != PSA_SUCCESS)
            return status;

        if (hkdf->block_number != 1) {
            status =
                psa_mac_update(&hkdf->hmac, hkdf->output_block, hash_length);
            if (status != PSA_SUCCESS)
                return status;
        }
        status = psa_mac_update(&hkdf->hmac, hkdf->info, hkdf->info_length);
        if (status != PSA_SUCCESS)
            return status;
        status = psa_mac_update(&hkdf->hmac, &hkdf->block_number, 1);
        if (status != PSA_SUCCESS)
            return status;
        status = psa_mac_sign_finish(&hkdf->hmac, hkdf->output_block,
                                     sizeof(hkdf->output_block),
                                     &hmac_output_length);
        if (status != PSA_SUCCESS)
            return status;
    }

    return PSA_SUCCESS;
}
#    endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF */

#    if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
        defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
static psa_status_t psa_key_derivation_tls12_prf_generate_next_block(
    psa_tls12_prf_key_derivation_t *tls12_prf,
    psa_algorithm_t alg)
{
    psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(alg);
    uint8_t hash_length = PSA_HASH_LENGTH(hash_alg);
    psa_mac_operation_t hmac = PSA_MAC_OPERATION_INIT;
    size_t hmac_output_length;
    psa_status_t status, cleanup_status;

    /* We can't be wanting more output after block 0xff, otherwise
     * the capacity check in psa_key_derivation_output_bytes() would have
     * prevented this call. It could happen only if the operation
     * object was corrupted or if this function is called directly
     * inside the library. */
    if (tls12_prf->block_number == 0xff)
        return PSA_ERROR_CORRUPTION_DETECTED;

    /* We need a new block */
    ++tls12_prf->block_number;
    tls12_prf->left_in_block = hash_length;

    /* Recall the definition of the TLS-1.2-PRF from RFC 5246:
     *
     * PRF(secret, label, seed) = P_<hash>(secret, label + seed)
     *
     * P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
     *                        HMAC_hash(secret, A(2) + seed) +
     *                        HMAC_hash(secret, A(3) + seed) + ...
     *
     * A(0) = seed
     * A(i) = HMAC_hash(secret, A(i-1))
     *
     * The `psa_tls12_prf_key_derivation` structure saves the block
     * `HMAC_hash(secret, A(i) + seed)` from which the output
     * is currently extracted as `output_block` and where i is
     * `block_number`.
     */

    status = psa_key_derivation_start_hmac(&hmac, hash_alg, tls12_prf->secret,
                                           tls12_prf->secret_length);
    if (status != PSA_SUCCESS)
        goto cleanup;

    /* Calculate A(i) where i = tls12_prf->block_number. */
    if (tls12_prf->block_number == 1) {
        /* A(1) = HMAC_hash(secret, A(0)), where A(0) = seed. (The RFC overloads
         * the variable seed and in this instance means it in the context of the
         * P_hash function, where seed = label + seed.) */
        status =
            psa_mac_update(&hmac, tls12_prf->label, tls12_prf->label_length);
        if (status != PSA_SUCCESS)
            goto cleanup;
        status = psa_mac_update(&hmac, tls12_prf->seed, tls12_prf->seed_length);
        if (status != PSA_SUCCESS)
            goto cleanup;
    } else {
        /* A(i) = HMAC_hash(secret, A(i-1)) */
        status = psa_mac_update(&hmac, tls12_prf->Ai, hash_length);
        if (status != PSA_SUCCESS)
            goto cleanup;
    }

    status = psa_mac_sign_finish(&hmac, tls12_prf->Ai, hash_length,
                                 &hmac_output_length);
    if (hmac_output_length != hash_length)
        status = PSA_ERROR_CORRUPTION_DETECTED;
    if (status != PSA_SUCCESS)
        goto cleanup;

    /* Calculate HMAC_hash(secret, A(i) + label + seed). */
    status = psa_key_derivation_start_hmac(&hmac, hash_alg, tls12_prf->secret,
                                           tls12_prf->secret_length);
    if (status != PSA_SUCCESS)
        goto cleanup;
    status = psa_mac_update(&hmac, tls12_prf->Ai, hash_length);
    if (status != PSA_SUCCESS)
        goto cleanup;
    status = psa_mac_update(&hmac, tls12_prf->label, tls12_prf->label_length);
    if (status != PSA_SUCCESS)
        goto cleanup;
    status = psa_mac_update(&hmac, tls12_prf->seed, tls12_prf->seed_length);
    if (status != PSA_SUCCESS)
        goto cleanup;
    status = psa_mac_sign_finish(&hmac, tls12_prf->output_block, hash_length,
                                 &hmac_output_length);
    if (status != PSA_SUCCESS)
        goto cleanup;

cleanup:
    cleanup_status = psa_mac_abort(&hmac);
    if (status == PSA_SUCCESS && cleanup_status != PSA_SUCCESS)
        status = cleanup_status;

    return status;
}

static psa_status_t
psa_key_derivation_tls12_prf_read(psa_tls12_prf_key_derivation_t *tls12_prf,
                                  psa_algorithm_t alg,
                                  uint8_t *output,
                                  size_t output_length)
{
    psa_algorithm_t hash_alg = PSA_ALG_TLS12_PRF_GET_HASH(alg);
    uint8_t hash_length = PSA_HASH_LENGTH(hash_alg);
    psa_status_t status;
    uint8_t offset, length;

    switch (tls12_prf->state) {
        case PSA_TLS12_PRF_STATE_LABEL_SET:
            tls12_prf->state = PSA_TLS12_PRF_STATE_OUTPUT;
            break;
        case PSA_TLS12_PRF_STATE_OUTPUT:
            break;
        default:
            return PSA_ERROR_BAD_STATE;
    }

    while (output_length != 0) {
        /* Check if we have fully processed the current block. */
        if (tls12_prf->left_in_block == 0) {
            status = psa_key_derivation_tls12_prf_generate_next_block(tls12_prf,
                                                                      alg);
            if (status != PSA_SUCCESS)
                return status;

            continue;
        }

        if (tls12_prf->left_in_block > output_length)
            length = (uint8_t)output_length;
        else
            length = tls12_prf->left_in_block;

        offset = hash_length - tls12_prf->left_in_block;
        memcpy(output, tls12_prf->output_block + offset, length);
        output += length;
        output_length -= length;
        tls12_prf->left_in_block -= length;
    }

    return PSA_SUCCESS;
}
#    endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF || \
            * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */

psa_status_t
psa_key_derivation_output_bytes(psa_key_derivation_operation_t *operation,
                                uint8_t *output,
                                size_t output_length)
{
    psa_status_t status;
    psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation);

    if (operation->alg == 0) {
        /* This is a blank operation. */
        return PSA_ERROR_BAD_STATE;
    }

    if (output_length > operation->capacity) {
        operation->capacity = 0;
        /* Go through the error path to wipe all confidential data now
         * that the operation object is useless. */
        status = PSA_ERROR_INSUFFICIENT_DATA;
        goto exit;
    }
    if (output_length == 0 && operation->capacity == 0) {
        /* Edge case: this is a finished operation, and 0 bytes
         * were requested. The right error in this case could
         * be either INSUFFICIENT_CAPACITY or BAD_STATE. Return
         * INSUFFICIENT_CAPACITY, which is right for a finished
         * operation, for consistency with the case when
         * output_length > 0. */
        return PSA_ERROR_INSUFFICIENT_DATA;
    }
    operation->capacity -= output_length;

#    if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
    if (PSA_ALG_IS_HKDF(kdf_alg)) {
        psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(kdf_alg);
        status = psa_key_derivation_hkdf_read(&operation->ctx.hkdf, hash_alg,
                                              output, output_length);
    } else
#    endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF */
#    if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
        defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
        if (PSA_ALG_IS_TLS12_PRF(kdf_alg) ||
            PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
        status = psa_key_derivation_tls12_prf_read(
            &operation->ctx.tls12_prf, kdf_alg, output, output_length);
    } else
#    endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF || \
            * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
    {
        (void)kdf_alg;
        return PSA_ERROR_BAD_STATE;
    }

exit:
    if (status != PSA_SUCCESS) {
        /* Preserve the algorithm upon errors, but clear all sensitive state.
         * This allows us to differentiate between exhausted operations and
         * blank operations, so we can return PSA_ERROR_BAD_STATE on blank
         * operations. */
        psa_algorithm_t alg = operation->alg;
        psa_key_derivation_abort(operation);
        operation->alg = alg;
        memset(output, '!', output_length);
    }
    return status;
}

#    if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
static void psa_des_set_key_parity(uint8_t *data, size_t data_size)
{
    if (data_size >= 8)
        mbedtls_des_key_set_parity(data);
    if (data_size >= 16)
        mbedtls_des_key_set_parity(data + 8);
    if (data_size >= 24)
        mbedtls_des_key_set_parity(data + 16);
}
#    endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */

static psa_status_t
psa_generate_derived_key_internal(psa_key_slot_t *slot,
                                  size_t bits,
                                  psa_key_derivation_operation_t *operation)
{
    uint8_t *data = NULL;
    size_t bytes = PSA_BITS_TO_BYTES(bits);
    psa_status_t status;

    if (!key_type_is_raw_bytes(slot->attr.type))
        return PSA_ERROR_INVALID_ARGUMENT;
    if (bits % 8 != 0)
        return PSA_ERROR_INVALID_ARGUMENT;
    data = mbedtls_calloc(1, bytes);
    if (data == NULL)
        return PSA_ERROR_INSUFFICIENT_MEMORY;

    status = psa_key_derivation_output_bytes(operation, data, bytes);
    if (status != PSA_SUCCESS)
        goto exit;
#    if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
    if (slot->attr.type == PSA_KEY_TYPE_DES)
        psa_des_set_key_parity(data, bytes);
#    endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */

    status = psa_allocate_buffer_to_slot(slot, bytes);
    if (status != PSA_SUCCESS)
        goto exit;

    slot->attr.bits = (psa_key_bits_t)bits;
    psa_key_attributes_t attributes = { .core = slot->attr };

    status = psa_driver_wrapper_import_key(&attributes, data, bytes,
                                           slot->key.data, slot->key.bytes,
                                           &slot->key.bytes, &bits);
    if (bits != slot->attr.bits)
        status = PSA_ERROR_INVALID_ARGUMENT;

exit:
    mbedtls_free(data);
    return status;
}

psa_status_t
psa_key_derivation_output_key(const psa_key_attributes_t *attributes,
                              psa_key_derivation_operation_t *operation,
                              mbedtls_svc_key_id_t *key)
{
    psa_status_t status;
    psa_key_slot_t *slot = NULL;
    psa_se_drv_table_entry_t *driver = NULL;

    *key = MBEDTLS_SVC_KEY_ID_INIT;

    /* Reject any attempt to create a zero-length key so that we don't
     * risk tripping up later, e.g. on a malloc(0) that returns NULL. */
    if (psa_get_key_bits(attributes) == 0)
        return PSA_ERROR_INVALID_ARGUMENT;

    if (!operation->can_output_key)
        return PSA_ERROR_NOT_PERMITTED;

    status = psa_start_key_creation(PSA_KEY_CREATION_DERIVE, attributes, &slot,
                                    &driver);
#    if defined(MBEDTLS_PSA_CRYPTO_SE_C)
    if (driver != NULL) {
        /* Deriving a key in a secure element is not implemented yet. */
        status = PSA_ERROR_NOT_SUPPORTED;
    }
#    endif /* MBEDTLS_PSA_CRYPTO_SE_C */
    if (status == PSA_SUCCESS) {
        status = psa_generate_derived_key_internal(slot, attributes->core.bits,
                                                   operation);
    }
    if (status == PSA_SUCCESS)
        status = psa_finish_key_creation(slot, driver, key);
    if (status != PSA_SUCCESS)
        psa_fail_key_creation(slot, driver);

    return status;
}

/****************************************************************/
/* Key derivation */
/****************************************************************/

#    if defined(AT_LEAST_ONE_BUILTIN_KDF)
static psa_status_t
psa_key_derivation_setup_kdf(psa_key_derivation_operation_t *operation,
                             psa_algorithm_t kdf_alg)
{
    int is_kdf_alg_supported;

    /* Make sure that operation->ctx is properly zero-initialised. (Macro
     * initialisers for this union leave some bytes unspecified.) */
    memset(&operation->ctx, 0, sizeof(operation->ctx));

    /* Make sure that kdf_alg is a supported key derivation algorithm. */
#        if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
    if (PSA_ALG_IS_HKDF(kdf_alg))
        is_kdf_alg_supported = 1;
    else
#        endif
#        if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF)
        if (PSA_ALG_IS_TLS12_PRF(kdf_alg))
        is_kdf_alg_supported = 1;
    else
#        endif
#        if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
        if (PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg))
        is_kdf_alg_supported = 1;
    else
#        endif
        is_kdf_alg_supported = 0;

    if (is_kdf_alg_supported) {
        psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(kdf_alg);
        size_t hash_size = PSA_HASH_LENGTH(hash_alg);
        if (hash_size == 0)
            return PSA_ERROR_NOT_SUPPORTED;
        if ((PSA_ALG_IS_TLS12_PRF(kdf_alg) ||
             PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) &&
            !(hash_alg == PSA_ALG_SHA_256 || hash_alg == PSA_ALG_SHA_384)) {
            return PSA_ERROR_NOT_SUPPORTED;
        }
        operation->capacity = 255 * hash_size;
        return PSA_SUCCESS;
    }

    return PSA_ERROR_NOT_SUPPORTED;
}
#    endif /* AT_LEAST_ONE_BUILTIN_KDF */

psa_status_t psa_key_derivation_setup(psa_key_derivation_operation_t *operation,
                                      psa_algorithm_t alg)
{
    psa_status_t status;

    if (operation->alg != 0)
        return PSA_ERROR_BAD_STATE;

    if (PSA_ALG_IS_RAW_KEY_AGREEMENT(alg))
        return PSA_ERROR_INVALID_ARGUMENT;
    else if (PSA_ALG_IS_KEY_AGREEMENT(alg)) {
#    if defined(AT_LEAST_ONE_BUILTIN_KDF)
        psa_algorithm_t kdf_alg = PSA_ALG_KEY_AGREEMENT_GET_KDF(alg);
        status = psa_key_derivation_setup_kdf(operation, kdf_alg);
#    else
        return PSA_ERROR_NOT_SUPPORTED;
#    endif /* AT_LEAST_ONE_BUILTIN_KDF */
    } else if (PSA_ALG_IS_KEY_DERIVATION(alg)) {
#    if defined(AT_LEAST_ONE_BUILTIN_KDF)
        status = psa_key_derivation_setup_kdf(operation, alg);
#    else
        return PSA_ERROR_NOT_SUPPORTED;
#    endif /* AT_LEAST_ONE_BUILTIN_KDF */
    } else
        return PSA_ERROR_INVALID_ARGUMENT;

    if (status == PSA_SUCCESS)
        operation->alg = alg;
    return status;
}

#    if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
static psa_status_t psa_hkdf_input(psa_hkdf_key_derivation_t *hkdf,
                                   psa_algorithm_t hash_alg,
                                   psa_key_derivation_step_t step,
                                   const uint8_t *data,
                                   size_t data_length)
{
    psa_status_t status;
    switch (step) {
        case PSA_KEY_DERIVATION_INPUT_SALT:
            if (hkdf->state != HKDF_STATE_INIT)
                return PSA_ERROR_BAD_STATE;
            else {
                status = psa_key_derivation_start_hmac(&hkdf->hmac, hash_alg,
                                                       data, data_length);
                if (status != PSA_SUCCESS)
                    return status;
                hkdf->state = HKDF_STATE_STARTED;
                return PSA_SUCCESS;
            }
        case PSA_KEY_DERIVATION_INPUT_SECRET:
            /* If no salt was provided, use an empty salt. */
            if (hkdf->state == HKDF_STATE_INIT) {
                status = psa_key_derivation_start_hmac(&hkdf->hmac, hash_alg,
                                                       NULL, 0);
                if (status != PSA_SUCCESS)
                    return status;
                hkdf->state = HKDF_STATE_STARTED;
            }
            if (hkdf->state != HKDF_STATE_STARTED)
                return PSA_ERROR_BAD_STATE;
            status = psa_mac_update(&hkdf->hmac, data, data_length);
            if (status != PSA_SUCCESS)
                return status;
            status = psa_mac_sign_finish(&hkdf->hmac, hkdf->prk,
                                         sizeof(hkdf->prk), &data_length);
            if (status != PSA_SUCCESS)
                return status;
            hkdf->offset_in_block = PSA_HASH_LENGTH(hash_alg);
            hkdf->block_number = 0;
            hkdf->state = HKDF_STATE_KEYED;
            return PSA_SUCCESS;
        case PSA_KEY_DERIVATION_INPUT_INFO:
            if (hkdf->state == HKDF_STATE_OUTPUT)
                return PSA_ERROR_BAD_STATE;
            if (hkdf->info_set)
                return PSA_ERROR_BAD_STATE;
            hkdf->info_length = data_length;
            if (data_length != 0) {
                hkdf->info = mbedtls_calloc(1, data_length);
                if (hkdf->info == NULL)
                    return PSA_ERROR_INSUFFICIENT_MEMORY;
                memcpy(hkdf->info, data, data_length);
            }
            hkdf->info_set = 1;
            return PSA_SUCCESS;
        default:
            return PSA_ERROR_INVALID_ARGUMENT;
    }
}
#    endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF */

#    if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
        defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
static psa_status_t psa_tls12_prf_set_seed(psa_tls12_prf_key_derivation_t *prf,
                                           const uint8_t *data,
                                           size_t data_length)
{
    if (prf->state != PSA_TLS12_PRF_STATE_INIT)
        return PSA_ERROR_BAD_STATE;

    if (data_length != 0) {
        prf->seed = mbedtls_calloc(1, data_length);
        if (prf->seed == NULL)
            return PSA_ERROR_INSUFFICIENT_MEMORY;

        memcpy(prf->seed, data, data_length);
        prf->seed_length = data_length;
    }

    prf->state = PSA_TLS12_PRF_STATE_SEED_SET;

    return PSA_SUCCESS;
}

static psa_status_t psa_tls12_prf_set_key(psa_tls12_prf_key_derivation_t *prf,
                                          const uint8_t *data,
                                          size_t data_length)
{
    if (prf->state != PSA_TLS12_PRF_STATE_SEED_SET)
        return PSA_ERROR_BAD_STATE;

    if (data_length != 0) {
        prf->secret = mbedtls_calloc(1, data_length);
        if (prf->secret == NULL)
            return PSA_ERROR_INSUFFICIENT_MEMORY;

        memcpy(prf->secret, data, data_length);
        prf->secret_length = data_length;
    }

    prf->state = PSA_TLS12_PRF_STATE_KEY_SET;

    return PSA_SUCCESS;
}

static psa_status_t psa_tls12_prf_set_label(psa_tls12_prf_key_derivation_t *prf,
                                            const uint8_t *data,
                                            size_t data_length)
{
    if (prf->state != PSA_TLS12_PRF_STATE_KEY_SET)
        return PSA_ERROR_BAD_STATE;

    if (data_length != 0) {
        prf->label = mbedtls_calloc(1, data_length);
        if (prf->label == NULL)
            return PSA_ERROR_INSUFFICIENT_MEMORY;

        memcpy(prf->label, data, data_length);
        prf->label_length = data_length;
    }

    prf->state = PSA_TLS12_PRF_STATE_LABEL_SET;

    return PSA_SUCCESS;
}

static psa_status_t psa_tls12_prf_input(psa_tls12_prf_key_derivation_t *prf,
                                        psa_key_derivation_step_t step,
                                        const uint8_t *data,
                                        size_t data_length)
{
    switch (step) {
        case PSA_KEY_DERIVATION_INPUT_SEED:
            return psa_tls12_prf_set_seed(prf, data, data_length);
        case PSA_KEY_DERIVATION_INPUT_SECRET:
            return psa_tls12_prf_set_key(prf, data, data_length);
        case PSA_KEY_DERIVATION_INPUT_LABEL:
            return psa_tls12_prf_set_label(prf, data, data_length);
        default:
            return PSA_ERROR_INVALID_ARGUMENT;
    }
}
#    endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
            * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */

#    if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
static psa_status_t
psa_tls12_prf_psk_to_ms_set_key(psa_tls12_prf_key_derivation_t *prf,
                                const uint8_t *data,
                                size_t data_length)
{
    psa_status_t status;
    uint8_t pms[4 + 2 * PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE];
    uint8_t *cur = pms;

    if (data_length > PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE)
        return PSA_ERROR_INVALID_ARGUMENT;

    /* Quoting RFC 4279, Section 2:
     *
     * The premaster secret is formed as follows: if the PSK is N octets
     * long, concatenate a uint16 with the value N, N zero octets, a second
     * uint16 with the value N, and the PSK itself.
     */

    *cur++ = (data_length >> 8) & 0xff;
    *cur++ = (data_length >> 0) & 0xff;
    memset(cur, 0, data_length);
    cur += data_length;
    *cur++ = pms[0];
    *cur++ = pms[1];
    memcpy(cur, data, data_length);
    cur += data_length;

    status = psa_tls12_prf_set_key(prf, pms, cur - pms);

    mbedtls_platform_zeroize(pms, sizeof(pms));
    return status;
}

static psa_status_t
psa_tls12_prf_psk_to_ms_input(psa_tls12_prf_key_derivation_t *prf,
                              psa_key_derivation_step_t step,
                              const uint8_t *data,
                              size_t data_length)
{
    if (step == PSA_KEY_DERIVATION_INPUT_SECRET) {
        return (psa_tls12_prf_psk_to_ms_set_key(prf, data, data_length));
    }

    return psa_tls12_prf_input(prf, step, data, data_length);
}
#    endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */

/** Check whether the given key type is acceptable for the given
 * input step of a key derivation.
 *
 * Secret inputs must have the type #PSA_KEY_TYPE_DERIVE.
 * Non-secret inputs must have the type #PSA_KEY_TYPE_RAW_DATA.
 * Both secret and non-secret inputs can alternatively have the type
 * #PSA_KEY_TYPE_NONE, which is never the type of a key object, meaning
 * that the input was passed as a buffer rather than via a key object.
 */
static int psa_key_derivation_check_input_type(psa_key_derivation_step_t step,
                                               psa_key_type_t key_type)
{
    switch (step) {
        case PSA_KEY_DERIVATION_INPUT_SECRET:
            if (key_type == PSA_KEY_TYPE_DERIVE)
                return PSA_SUCCESS;
            if (key_type == PSA_KEY_TYPE_NONE)
                return PSA_SUCCESS;
            break;
        case PSA_KEY_DERIVATION_INPUT_LABEL:
        case PSA_KEY_DERIVATION_INPUT_SALT:
        case PSA_KEY_DERIVATION_INPUT_INFO:
        case PSA_KEY_DERIVATION_INPUT_SEED:
            if (key_type == PSA_KEY_TYPE_RAW_DATA)
                return PSA_SUCCESS;
            if (key_type == PSA_KEY_TYPE_NONE)
                return PSA_SUCCESS;
            break;
    }
    return PSA_ERROR_INVALID_ARGUMENT;
}

static psa_status_t
psa_key_derivation_input_internal(psa_key_derivation_operation_t *operation,
                                  psa_key_derivation_step_t step,
                                  psa_key_type_t key_type,
                                  const uint8_t *data,
                                  size_t data_length)
{
    psa_status_t status;
    psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation);

    status = psa_key_derivation_check_input_type(step, key_type);
    if (status != PSA_SUCCESS)
        goto exit;

#    if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
    if (PSA_ALG_IS_HKDF(kdf_alg)) {
        status = psa_hkdf_input(&operation->ctx.hkdf,
                                PSA_ALG_HKDF_GET_HASH(kdf_alg), step, data,
                                data_length);
    } else
#    endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF */
#    if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF)
        if (PSA_ALG_IS_TLS12_PRF(kdf_alg)) {
        status = psa_tls12_prf_input(&operation->ctx.tls12_prf, step, data,
                                     data_length);
    } else
#    endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF */
#    if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
        if (PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
        status = psa_tls12_prf_psk_to_ms_input(&operation->ctx.tls12_prf, step,
                                               data, data_length);
    } else
#    endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
    {
        /* This can't happen unless the operation object was not initialized */
        (void)data;
        (void)data_length;
        (void)kdf_alg;
        return PSA_ERROR_BAD_STATE;
    }

exit:
    if (status != PSA_SUCCESS)
        psa_key_derivation_abort(operation);
    return status;
}

psa_status_t
psa_key_derivation_input_bytes(psa_key_derivation_operation_t *operation,
                               psa_key_derivation_step_t step,
                               const uint8_t *data,
                               size_t data_length)
{
    return (psa_key_derivation_input_internal(
        operation, step, PSA_KEY_TYPE_NONE, data, data_length));
}

psa_status_t
psa_key_derivation_input_key(psa_key_derivation_operation_t *operation,
                             psa_key_derivation_step_t step,
                             mbedtls_svc_key_id_t key)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_key_slot_t *slot;

    status = psa_get_and_lock_transparent_key_slot_with_policy(
        key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg);
    if (status != PSA_SUCCESS) {
        psa_key_derivation_abort(operation);
        return status;
    }

    /* Passing a key object as a SECRET input unlocks the permission
     * to output to a key object. */
    if (step == PSA_KEY_DERIVATION_INPUT_SECRET)
        operation->can_output_key = 1;

    status = psa_key_derivation_input_internal(operation, step, slot->attr.type,
                                               slot->key.data, slot->key.bytes);

    unlock_status = psa_unlock_key_slot(slot);

    return (status == PSA_SUCCESS) ? unlock_status : status;
}

/****************************************************************/
/* Key agreement */
/****************************************************************/

#    if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
static psa_status_t psa_key_agreement_ecdh(const uint8_t *peer_key,
                                           size_t peer_key_length,
                                           const mbedtls_ecp_keypair *our_key,
                                           uint8_t *shared_secret,
                                           size_t shared_secret_size,
                                           size_t *shared_secret_length)
{
    mbedtls_ecp_keypair *their_key = NULL;
    mbedtls_ecdh_context ecdh;
    psa_status_t status;
    size_t bits = 0;
    psa_ecc_family_t curve = mbedtls_ecc_group_to_psa(our_key->grp.id, &bits);
    mbedtls_ecdh_init(&ecdh);

    status = mbedtls_psa_ecp_load_representation(
        PSA_KEY_TYPE_ECC_PUBLIC_KEY(curve), bits, peer_key, peer_key_length,
        &their_key);
    if (status != PSA_SUCCESS)
        goto exit;

    status = mbedtls_to_psa_error(
        mbedtls_ecdh_get_params(&ecdh, their_key, MBEDTLS_ECDH_THEIRS));
    if (status != PSA_SUCCESS)
        goto exit;
    status = mbedtls_to_psa_error(
        mbedtls_ecdh_get_params(&ecdh, our_key, MBEDTLS_ECDH_OURS));
    if (status != PSA_SUCCESS)
        goto exit;

    status = mbedtls_to_psa_error(mbedtls_ecdh_calc_secret(
        &ecdh, shared_secret_length, shared_secret, shared_secret_size,
        mbedtls_psa_get_random, MBEDTLS_PSA_RANDOM_STATE));
    if (status != PSA_SUCCESS)
        goto exit;
    if (PSA_BITS_TO_BYTES(bits) != *shared_secret_length)
        status = PSA_ERROR_CORRUPTION_DETECTED;

exit:
    if (status != PSA_SUCCESS)
        mbedtls_platform_zeroize(shared_secret, shared_secret_size);
    mbedtls_ecdh_free(&ecdh);
    mbedtls_ecp_keypair_free(their_key);
    mbedtls_free(their_key);

    return status;
}
#    endif /* MBEDTLS_PSA_BUILTIN_ALG_ECDH */

#    define PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE MBEDTLS_ECP_MAX_BYTES

static psa_status_t psa_key_agreement_raw_internal(psa_algorithm_t alg,
                                                   psa_key_slot_t *private_key,
                                                   const uint8_t *peer_key,
                                                   size_t peer_key_length,
                                                   uint8_t *shared_secret,
                                                   size_t shared_secret_size,
                                                   size_t *shared_secret_length)
{
    switch (alg) {
#    if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
        case PSA_ALG_ECDH:
            if (!PSA_KEY_TYPE_IS_ECC_KEY_PAIR(private_key->attr.type))
                return PSA_ERROR_INVALID_ARGUMENT;
            mbedtls_ecp_keypair *ecp = NULL;
            psa_status_t status = mbedtls_psa_ecp_load_representation(
                private_key->attr.type, private_key->attr.bits,
                private_key->key.data, private_key->key.bytes, &ecp);
            if (status != PSA_SUCCESS)
                return status;
            status = psa_key_agreement_ecdh(peer_key, peer_key_length, ecp,
                                            shared_secret, shared_secret_size,
                                            shared_secret_length);
            mbedtls_ecp_keypair_free(ecp);
            mbedtls_free(ecp);
            return status;
#    endif /* MBEDTLS_PSA_BUILTIN_ALG_ECDH */
        default:
            (void)private_key;
            (void)peer_key;
            (void)peer_key_length;
            (void)shared_secret;
            (void)shared_secret_size;
            (void)shared_secret_length;
            return PSA_ERROR_NOT_SUPPORTED;
    }
}

/* Note that if this function fails, you must call psa_key_derivation_abort()
 * to potentially free embedded data structures and wipe confidential data.
 */
static psa_status_t
psa_key_agreement_internal(psa_key_derivation_operation_t *operation,
                           psa_key_derivation_step_t step,
                           psa_key_slot_t *private_key,
                           const uint8_t *peer_key,
                           size_t peer_key_length)
{
    psa_status_t status;
    uint8_t shared_secret[PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE];
    size_t shared_secret_length = 0;
    psa_algorithm_t ka_alg = PSA_ALG_KEY_AGREEMENT_GET_BASE(operation->alg);

    /* Step 1: run the secret agreement algorithm to generate the shared
     * secret. */
    status = psa_key_agreement_raw_internal(ka_alg, private_key, peer_key,
                                            peer_key_length, shared_secret,
                                            sizeof(shared_secret),
                                            &shared_secret_length);
    if (status != PSA_SUCCESS)
        goto exit;

    /* Step 2: set up the key derivation to generate key material from
     * the shared secret. A shared secret is permitted wherever a key
     * of type DERIVE is permitted. */
    status =
        psa_key_derivation_input_internal(operation, step, PSA_KEY_TYPE_DERIVE,
                                          shared_secret, shared_secret_length);
exit:
    mbedtls_platform_zeroize(shared_secret, shared_secret_length);
    return status;
}

psa_status_t
psa_key_derivation_key_agreement(psa_key_derivation_operation_t *operation,
                                 psa_key_derivation_step_t step,
                                 mbedtls_svc_key_id_t private_key,
                                 const uint8_t *peer_key,
                                 size_t peer_key_length)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_key_slot_t *slot;

    if (!PSA_ALG_IS_KEY_AGREEMENT(operation->alg))
        return PSA_ERROR_INVALID_ARGUMENT;
    status = psa_get_and_lock_transparent_key_slot_with_policy(
        private_key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg);
    if (status != PSA_SUCCESS)
        return status;
    status = psa_key_agreement_internal(operation, step, slot, peer_key,
                                        peer_key_length);
    if (status != PSA_SUCCESS)
        psa_key_derivation_abort(operation);
    else {
        /* If a private key has been added as SECRET, we allow the derived
         * key material to be used as a key in PSA Crypto. */
        if (step == PSA_KEY_DERIVATION_INPUT_SECRET)
            operation->can_output_key = 1;
    }

    unlock_status = psa_unlock_key_slot(slot);

    return (status == PSA_SUCCESS) ? unlock_status : status;
}

psa_status_t psa_raw_key_agreement(psa_algorithm_t alg,
                                   mbedtls_svc_key_id_t private_key,
                                   const uint8_t *peer_key,
                                   size_t peer_key_length,
                                   uint8_t *output,
                                   size_t output_size,
                                   size_t *output_length)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_key_slot_t *slot = NULL;

    if (!PSA_ALG_IS_KEY_AGREEMENT(alg)) {
        status = PSA_ERROR_INVALID_ARGUMENT;
        goto exit;
    }
    status = psa_get_and_lock_transparent_key_slot_with_policy(
        private_key, &slot, PSA_KEY_USAGE_DERIVE, alg);
    if (status != PSA_SUCCESS)
        goto exit;

    status = psa_key_agreement_raw_internal(alg, slot, peer_key,
                                            peer_key_length, output,
                                            output_size, output_length);

exit:
    if (status != PSA_SUCCESS) {
        /* If an error happens and is not handled properly, the output
         * may be used as a key to protect sensitive data. Arrange for such
         * a key to be random, which is likely to result in decryption or
         * verification errors. This is better than filling the buffer with
         * some constant data such as zeros, which would result in the data
         * being protected with a reproducible, easily knowable key.
         */
        psa_generate_random(output, output_size);
        *output_length = output_size;
    }

    unlock_status = psa_unlock_key_slot(slot);

    return (status == PSA_SUCCESS) ? unlock_status : status;
}

/****************************************************************/
/* Random generation */
/****************************************************************/

/** Initialize the PSA random generator.
 */
static void mbedtls_psa_random_init(mbedtls_psa_random_context_t *rng)
{
#    if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
    memset(rng, 0, sizeof(*rng));
#    else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */

    /* Set default configuration if
     * mbedtls_psa_crypto_configure_entropy_sources() hasn't been called. */
    if (rng->entropy_init == NULL)
        rng->entropy_init = mbedtls_entropy_init;
    if (rng->entropy_free == NULL)
        rng->entropy_free = mbedtls_entropy_free;

    rng->entropy_init(&rng->entropy);
#        if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \
            defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES)
    /* The PSA entropy injection feature depends on using NV seed as an entropy
     * source. Add NV seed as an entropy source for PSA entropy injection. */
    mbedtls_entropy_add_source(&rng->entropy, mbedtls_nv_seed_poll, NULL,
                               MBEDTLS_ENTROPY_BLOCK_SIZE,
                               MBEDTLS_ENTROPY_SOURCE_STRONG);
#        endif

    mbedtls_psa_drbg_init(MBEDTLS_PSA_RANDOM_STATE);
#    endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
}

/** Deinitialize the PSA random generator.
 */
static void mbedtls_psa_random_free(mbedtls_psa_random_context_t *rng)
{
#    if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
    memset(rng, 0, sizeof(*rng));
#    else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
    mbedtls_psa_drbg_free(MBEDTLS_PSA_RANDOM_STATE);
    rng->entropy_free(&rng->entropy);
#    endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
}

/** Seed the PSA random generator.
 */
static psa_status_t mbedtls_psa_random_seed(mbedtls_psa_random_context_t *rng)
{
#    if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
    /* Do nothing: the external RNG seeds itself. */
    (void)rng;
    return PSA_SUCCESS;
#    else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
    const unsigned char drbg_seed[] = "PSA";
    int ret =
        mbedtls_psa_drbg_seed(&rng->entropy, drbg_seed, sizeof(drbg_seed) - 1);
    return mbedtls_to_psa_error(ret);
#    endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
}

psa_status_t psa_generate_random(uint8_t *output, size_t output_size)
{
    GUARD_MODULE_INITIALIZED;

#    if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)

    size_t output_length = 0;
    psa_status_t status = mbedtls_psa_external_get_random(
        &global_data.rng, output, output_size, &output_length);
    if (status != PSA_SUCCESS)
        return status;
    /* Breaking up a request into smaller chunks is currently not supported
     * for the extrernal RNG interface. */
    if (output_length != output_size)
        return PSA_ERROR_INSUFFICIENT_ENTROPY;
    return PSA_SUCCESS;

#    else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */

    while (output_size > 0) {
        size_t request_size = (output_size > MBEDTLS_PSA_RANDOM_MAX_REQUEST ?
                                   MBEDTLS_PSA_RANDOM_MAX_REQUEST :
                                   output_size);
        int ret = mbedtls_psa_get_random(MBEDTLS_PSA_RANDOM_STATE, output,
                                         request_size);
        if (ret != 0)
            return mbedtls_to_psa_error(ret);
        output_size -= request_size;
        output += request_size;
    }
    return PSA_SUCCESS;
#    endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
}

/* Wrapper function allowing the classic API to use the PSA RNG.
 *
 * `mbedtls_psa_get_random(MBEDTLS_PSA_RANDOM_STATE, ...)` calls
 * `psa_generate_random(...)`. The state parameter is ignored since the
 * PSA API doesn't support passing an explicit state.
 *
 * In the non-external case, psa_generate_random() calls an
 * `mbedtls_xxx_drbg_random` function which has exactly the same signature
 * and semantics as mbedtls_psa_get_random(). As an optimization,
 * instead of doing this back-and-forth between the PSA API and the
 * classic API, psa_crypto_random_impl.h defines `mbedtls_psa_get_random`
 * as a constant function pointer to `mbedtls_xxx_drbg_random`.
 */
#    if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
int mbedtls_psa_get_random(void *p_rng,
                           unsigned char *output,
                           size_t output_size)
{
    /* This function takes a pointer to the RNG state because that's what
     * classic mbedtls functions using an RNG expect. The PSA RNG manages
     * its own state internally and doesn't let the caller access that state.
     * So we just ignore the state parameter, and in practice we'll pass
     * NULL. */
    (void)p_rng;
    psa_status_t status = psa_generate_random(output, output_size);
    if (status == PSA_SUCCESS)
        return 0;
    else
        return MBEDTLS_ERR_ENTROPY_SOURCE_FAILED;
}
#    endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */

#    if defined(MBEDTLS_PSA_INJECT_ENTROPY)
#        include "entropy_poll.h"

psa_status_t mbedtls_psa_inject_entropy(const uint8_t *seed, size_t seed_size)
{
    if (global_data.initialized)
        return PSA_ERROR_NOT_PERMITTED;

    if (((seed_size < MBEDTLS_ENTROPY_MIN_PLATFORM) ||
         (seed_size < MBEDTLS_ENTROPY_BLOCK_SIZE)) ||
        (seed_size > MBEDTLS_ENTROPY_MAX_SEED_SIZE))
        return PSA_ERROR_INVALID_ARGUMENT;

    return mbedtls_psa_storage_inject_entropy(seed, seed_size);
}
#    endif /* MBEDTLS_PSA_INJECT_ENTROPY */

/** Validate the key type and size for key generation
 *
 * \param  type  The key type
 * \param  bits  The number of bits of the key
 *
 * \retval #PSA_SUCCESS
 *         The key type and size are valid.
 * \retval #PSA_ERROR_INVALID_ARGUMENT
 *         The size in bits of the key is not valid.
 * \retval #PSA_ERROR_NOT_SUPPORTED
 *         The type and/or the size in bits of the key or the combination of
 *         the two is not supported.
 */
static psa_status_t
psa_validate_key_type_and_size_for_key_generation(psa_key_type_t type,
                                                  size_t bits)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;

    if (key_type_is_raw_bytes(type)) {
        status = validate_unstructured_key_bit_size(type, bits);
        if (status != PSA_SUCCESS)
            return status;
    } else
#    if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR)
        if (PSA_KEY_TYPE_IS_RSA(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
        if (bits > PSA_VENDOR_RSA_MAX_KEY_BITS)
            return PSA_ERROR_NOT_SUPPORTED;

        /* Accept only byte-aligned keys, for the same reasons as
         * in psa_import_rsa_key(). */
        if (bits % 8 != 0)
            return PSA_ERROR_NOT_SUPPORTED;
    } else
#    endif /* defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR) */

#    if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR)
        if (PSA_KEY_TYPE_IS_ECC(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
        /* To avoid empty block, return successfully here. */
        return PSA_SUCCESS;
    } else
#    endif /* defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR) */
    {
        return PSA_ERROR_NOT_SUPPORTED;
    }

    return PSA_SUCCESS;
}

psa_status_t psa_generate_key_internal(const psa_key_attributes_t *attributes,
                                       uint8_t *key_buffer,
                                       size_t key_buffer_size,
                                       size_t *key_buffer_length)
{
    psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
    psa_key_type_t type = attributes->core.type;

    if ((attributes->domain_parameters == NULL) &&
        (attributes->domain_parameters_size != 0))
        return PSA_ERROR_INVALID_ARGUMENT;

    if (key_type_is_raw_bytes(type)) {
        status = psa_generate_random(key_buffer, key_buffer_size);
        if (status != PSA_SUCCESS)
            return status;

#    if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
        if (type == PSA_KEY_TYPE_DES)
            psa_des_set_key_parity(key_buffer, key_buffer_size);
#    endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */
    } else
#    if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) && \
        defined(MBEDTLS_GENPRIME)
        if (type == PSA_KEY_TYPE_RSA_KEY_PAIR) {
        return (mbedtls_psa_rsa_generate_key(
            attributes, key_buffer, key_buffer_size, key_buffer_length));
    } else
#    endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) \
            * defined(MBEDTLS_GENPRIME) */

#    if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR)
        if (PSA_KEY_TYPE_IS_ECC(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
        return (mbedtls_psa_ecp_generate_key(
            attributes, key_buffer, key_buffer_size, key_buffer_length));
    } else
#    endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) */
    {
        (void)key_buffer_length;
        return PSA_ERROR_NOT_SUPPORTED;
    }

    return PSA_SUCCESS;
}

psa_status_t psa_generate_key(const psa_key_attributes_t *attributes,
                              mbedtls_svc_key_id_t *key)
{
    psa_status_t status;
    psa_key_slot_t *slot = NULL;
    psa_se_drv_table_entry_t *driver = NULL;
    size_t key_buffer_size;

    *key = MBEDTLS_SVC_KEY_ID_INIT;

    /* Reject any attempt to create a zero-length key so that we don't
     * risk tripping up later, e.g. on a malloc(0) that returns NULL. */
    if (psa_get_key_bits(attributes) == 0)
        return PSA_ERROR_INVALID_ARGUMENT;

    status = psa_start_key_creation(PSA_KEY_CREATION_GENERATE, attributes,
                                    &slot, &driver);
    if (status != PSA_SUCCESS)
        goto exit;

    /* In the case of a transparent key or an opaque key stored in local
     * storage (thus not in the case of generating a key in a secure element
     * or cryptoprocessor with storage), we have to allocate a buffer to
     * hold the generated key material. */
    if (slot->key.data == NULL) {
        if (PSA_KEY_LIFETIME_GET_LOCATION(attributes->core.lifetime) ==
            PSA_KEY_LOCATION_LOCAL_STORAGE) {
            status = psa_validate_key_type_and_size_for_key_generation(
                attributes->core.type, attributes->core.bits);
            if (status != PSA_SUCCESS)
                goto exit;

            key_buffer_size = PSA_EXPORT_KEY_OUTPUT_SIZE(attributes->core.type,
                                                         attributes->core.bits);
        } else {
            status = psa_driver_wrapper_get_key_buffer_size(attributes,
                                                            &key_buffer_size);
            if (status != PSA_SUCCESS)
                goto exit;
        }

        status = psa_allocate_buffer_to_slot(slot, key_buffer_size);
        if (status != PSA_SUCCESS)
            goto exit;
    }

    status = psa_driver_wrapper_generate_key(attributes, slot->key.data,
                                             slot->key.bytes, &slot->key.bytes);

    if (status != PSA_SUCCESS)
        psa_remove_key_data_from_memory(slot);

exit:
    if (status == PSA_SUCCESS)
        status = psa_finish_key_creation(slot, driver, key);
    if (status != PSA_SUCCESS)
        psa_fail_key_creation(slot, driver);

    return status;
}

/****************************************************************/
/* Module setup */
/****************************************************************/

#    if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
psa_status_t mbedtls_psa_crypto_configure_entropy_sources(
    void (*entropy_init)(mbedtls_entropy_context *ctx),
    void (*entropy_free)(mbedtls_entropy_context *ctx))
{
    if (global_data.rng_state != RNG_NOT_INITIALIZED)
        return PSA_ERROR_BAD_STATE;
    global_data.rng.entropy_init = entropy_init;
    global_data.rng.entropy_free = entropy_free;
    return PSA_SUCCESS;
}
#    endif /* !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) */

void mbedtls_psa_crypto_free(void)
{
    psa_wipe_all_key_slots();
    if (global_data.rng_state != RNG_NOT_INITIALIZED) {
        mbedtls_psa_random_free(&global_data.rng);
    }
    /* Wipe all remaining data, including configuration.
     * In particular, this sets all state indicator to the value
     * indicating "uninitialized". */
    mbedtls_platform_zeroize(&global_data, sizeof(global_data));
#    if defined(MBEDTLS_PSA_CRYPTO_SE_C)
    /* Unregister all secure element drivers, so that we restart from
     * a pristine state. */
    psa_unregister_all_se_drivers();
#    endif /* MBEDTLS_PSA_CRYPTO_SE_C */
}

#    if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
/** Recover a transaction that was interrupted by a power failure.
 *
 * This function is called during initialization, before psa_crypto_init()
 * returns. If this function returns a failure status, the initialization
 * fails.
 */
static psa_status_t
psa_crypto_recover_transaction(const psa_crypto_transaction_t *transaction)
{
    switch (transaction->unknown.type) {
        case PSA_CRYPTO_TRANSACTION_CREATE_KEY:
        case PSA_CRYPTO_TRANSACTION_DESTROY_KEY:
            /* TODO - fall through to the failure case until this
             * is implemented.
             * https://github.com/ARMmbed/mbed-crypto/issues/218
             */
        default:
            /* We found an unsupported transaction in the storage.
             * We don't know what state the storage is in. Give up. */
            return PSA_ERROR_DATA_INVALID;
    }
}
#    endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */

psa_status_t psa_crypto_init(void)
{
    psa_status_t status;

    /* Double initialization is explicitly allowed. */
    if (global_data.initialized != 0)
        return PSA_SUCCESS;

    /* Initialize and seed the random generator. */
    mbedtls_psa_random_init(&global_data.rng);
    global_data.rng_state = RNG_INITIALIZED;
    status = mbedtls_psa_random_seed(&global_data.rng);
    if (status != PSA_SUCCESS)
        goto exit;
    global_data.rng_state = RNG_SEEDED;

    status = psa_initialize_key_slots();
    if (status != PSA_SUCCESS)
        goto exit;

#    if defined(MBEDTLS_PSA_CRYPTO_SE_C)
    status = psa_init_all_se_drivers();
    if (status != PSA_SUCCESS)
        goto exit;
#    endif /* MBEDTLS_PSA_CRYPTO_SE_C */

#    if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
    status = psa_crypto_load_transaction();
    if (status == PSA_SUCCESS) {
        status = psa_crypto_recover_transaction(&psa_crypto_transaction);
        if (status != PSA_SUCCESS)
            goto exit;
        status = psa_crypto_stop_transaction();
    } else if (status == PSA_ERROR_DOES_NOT_EXIST) {
        /* There's no transaction to complete. It's all good. */
        status = PSA_SUCCESS;
    }
#    endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */

    /* All done. */
    global_data.initialized = 1;

exit:
    if (status != PSA_SUCCESS)
        mbedtls_psa_crypto_free();
    return status;
}

#endif /* MBEDTLS_PSA_CRYPTO_C */