blob: fbd7195ccdafa294b497c9dd7ed710742851732b [file] [log] [blame]
Gilles Peskinee59236f2018-01-27 23:32:46 +01001/* BEGIN_HEADER */
itayzafrir3e02b3b2018-06-12 17:06:52 +03002#include <stdint.h>
mohammad160327010052018-07-03 13:16:15 +03003
Gilles Peskinedd2f95b2018-08-11 01:22:42 +02004#include "mbedtls/asn1.h"
Gilles Peskine0b352bc2018-06-28 00:16:11 +02005#include "mbedtls/asn1write.h"
Gilles Peskinedd2f95b2018-08-11 01:22:42 +02006#include "mbedtls/oid.h"
7
Gilles Peskinebdc96fd2019-08-07 12:08:04 +02008/* For MBEDTLS_CTR_DRBG_MAX_REQUEST, knowing that psa_generate_random()
9 * uses mbedtls_ctr_drbg internally. */
10#include "mbedtls/ctr_drbg.h"
11
Ronald Cron02c78b72020-05-27 09:22:32 +020012#include "test/psa_crypto_helpers.h"
itayzafrir3e02b3b2018-06-12 17:06:52 +030013
Gilles Peskinec744d992019-07-30 17:26:54 +020014/* Tests that require more than 128kB of RAM plus change have this symbol
15 * as a dependency. Currently we always define this symbol, so the tests
16 * are always executed. In the future we should make this conditional
17 * so that tests that require a lot of memory are skipped on constrained
18 * platforms. */
Gilles Peskine49232e82019-08-07 11:01:30 +020019#define HAVE_RAM_AVAILABLE_128K
Gilles Peskinec744d992019-07-30 17:26:54 +020020
Gilles Peskinebdc96fd2019-08-07 12:08:04 +020021#include "psa/crypto.h"
22
Jaeden Amerof24c7f82018-06-27 17:20:43 +010023/** An invalid export length that will never be set by psa_export_key(). */
24static const size_t INVALID_EXPORT_LENGTH = ~0U;
25
Gilles Peskinef426e0f2019-02-25 17:42:03 +010026/* A hash algorithm that is known to be supported.
27 *
28 * This is used in some smoke tests.
29 */
30#if defined(MBEDTLS_MD2_C)
31#define KNOWN_SUPPORTED_HASH_ALG PSA_ALG_MD2
32#elif defined(MBEDTLS_MD4_C)
33#define KNOWN_SUPPORTED_HASH_ALG PSA_ALG_MD4
34#elif defined(MBEDTLS_MD5_C)
35#define KNOWN_SUPPORTED_HASH_ALG PSA_ALG_MD5
36/* MBEDTLS_RIPEMD160_C omitted. This is necessary for the sake of
37 * exercise_signature_key() because Mbed TLS doesn't support RIPEMD160
38 * in RSA PKCS#1v1.5 signatures. A RIPEMD160-only configuration would be
39 * implausible anyway. */
40#elif defined(MBEDTLS_SHA1_C)
41#define KNOWN_SUPPORTED_HASH_ALG PSA_ALG_SHA_1
42#elif defined(MBEDTLS_SHA256_C)
43#define KNOWN_SUPPORTED_HASH_ALG PSA_ALG_SHA_256
44#elif defined(MBEDTLS_SHA512_C)
45#define KNOWN_SUPPORTED_HASH_ALG PSA_ALG_SHA_384
46#elif defined(MBEDTLS_SHA3_C)
47#define KNOWN_SUPPORTED_HASH_ALG PSA_ALG_SHA3_256
48#else
49#undef KNOWN_SUPPORTED_HASH_ALG
50#endif
51
52/* A block cipher that is known to be supported.
53 *
54 * For simplicity's sake, stick to block ciphers with 16-byte blocks.
55 */
56#if defined(MBEDTLS_AES_C)
57#define KNOWN_SUPPORTED_BLOCK_CIPHER PSA_KEY_TYPE_AES
58#elif defined(MBEDTLS_ARIA_C)
59#define KNOWN_SUPPORTED_BLOCK_CIPHER PSA_KEY_TYPE_ARIA
60#elif defined(MBEDTLS_CAMELLIA_C)
61#define KNOWN_SUPPORTED_BLOCK_CIPHER PSA_KEY_TYPE_CAMELLIA
62#undef KNOWN_SUPPORTED_BLOCK_CIPHER
63#endif
64
65/* A MAC mode that is known to be supported.
66 *
67 * It must either be HMAC with #KNOWN_SUPPORTED_HASH_ALG or
68 * a block cipher-based MAC with #KNOWN_SUPPORTED_BLOCK_CIPHER.
69 *
70 * This is used in some smoke tests.
71 */
72#if defined(KNOWN_SUPPORTED_HASH_ALG)
73#define KNOWN_SUPPORTED_MAC_ALG ( PSA_ALG_HMAC( KNOWN_SUPPORTED_HASH_ALG ) )
74#define KNOWN_SUPPORTED_MAC_KEY_TYPE PSA_KEY_TYPE_HMAC
75#elif defined(KNOWN_SUPPORTED_BLOCK_CIPHER) && defined(MBEDTLS_CMAC_C)
76#define KNOWN_SUPPORTED_MAC_ALG PSA_ALG_CMAC
77#define KNOWN_SUPPORTED_MAC_KEY_TYPE KNOWN_SUPPORTED_BLOCK_CIPHER
78#else
79#undef KNOWN_SUPPORTED_MAC_ALG
80#undef KNOWN_SUPPORTED_MAC_KEY_TYPE
81#endif
82
83/* A cipher algorithm and key type that are known to be supported.
84 *
85 * This is used in some smoke tests.
86 */
87#if defined(KNOWN_SUPPORTED_BLOCK_CIPHER) && defined(MBEDTLS_CIPHER_MODE_CTR)
88#define KNOWN_SUPPORTED_BLOCK_CIPHER_ALG PSA_ALG_CTR
89#elif defined(KNOWN_SUPPORTED_BLOCK_CIPHER) && defined(MBEDTLS_CIPHER_MODE_CBC)
90#define KNOWN_SUPPORTED_BLOCK_CIPHER_ALG PSA_ALG_CBC_NO_PADDING
91#elif defined(KNOWN_SUPPORTED_BLOCK_CIPHER) && defined(MBEDTLS_CIPHER_MODE_CFB)
92#define KNOWN_SUPPORTED_BLOCK_CIPHER_ALG PSA_ALG_CFB
93#elif defined(KNOWN_SUPPORTED_BLOCK_CIPHER) && defined(MBEDTLS_CIPHER_MODE_OFB)
94#define KNOWN_SUPPORTED_BLOCK_CIPHER_ALG PSA_ALG_OFB
95#else
96#undef KNOWN_SUPPORTED_BLOCK_CIPHER_ALG
97#endif
98#if defined(KNOWN_SUPPORTED_BLOCK_CIPHER_ALG)
99#define KNOWN_SUPPORTED_CIPHER_ALG KNOWN_SUPPORTED_BLOCK_CIPHER_ALG
100#define KNOWN_SUPPORTED_CIPHER_KEY_TYPE KNOWN_SUPPORTED_BLOCK_CIPHER
101#elif defined(MBEDTLS_RC4_C)
102#define KNOWN_SUPPORTED_CIPHER_ALG PSA_ALG_RC4
103#define KNOWN_SUPPORTED_CIPHER_KEY_TYPE PSA_KEY_TYPE_RC4
104#else
105#undef KNOWN_SUPPORTED_CIPHER_ALG
106#undef KNOWN_SUPPORTED_CIPHER_KEY_TYPE
107#endif
108
Gilles Peskine667c1112019-12-03 19:03:20 +0100109#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
110int lifetime_is_secure_element( psa_key_lifetime_t lifetime )
111{
112 /* At the moment, anything that isn't a built-in lifetime is either
113 * a secure element or unassigned. */
114 return( lifetime != PSA_KEY_LIFETIME_VOLATILE &&
115 lifetime != PSA_KEY_LIFETIME_PERSISTENT );
116}
117#else
118int lifetime_is_secure_element( psa_key_lifetime_t lifetime )
119{
120 (void) lifetime;
121 return( 0 );
122}
123#endif
124
Gilles Peskinea7aa4422018-08-14 15:17:54 +0200125/** Test if a buffer contains a constant byte value.
126 *
127 * `mem_is_char(buffer, c, size)` is true after `memset(buffer, c, size)`.
Gilles Peskinee66ca3b2018-06-20 00:11:45 +0200128 *
129 * \param buffer Pointer to the beginning of the buffer.
Gilles Peskinea7aa4422018-08-14 15:17:54 +0200130 * \param c Expected value of every byte.
Gilles Peskinee66ca3b2018-06-20 00:11:45 +0200131 * \param size Size of the buffer in bytes.
132 *
Gilles Peskine3f669c32018-06-21 09:21:51 +0200133 * \return 1 if the buffer is all-bits-zero.
134 * \return 0 if there is at least one nonzero byte.
Gilles Peskinee66ca3b2018-06-20 00:11:45 +0200135 */
Gilles Peskinea7aa4422018-08-14 15:17:54 +0200136static int mem_is_char( void *buffer, unsigned char c, size_t size )
Gilles Peskinee66ca3b2018-06-20 00:11:45 +0200137{
138 size_t i;
139 for( i = 0; i < size; i++ )
140 {
Gilles Peskinea7aa4422018-08-14 15:17:54 +0200141 if( ( (unsigned char *) buffer )[i] != c )
Gilles Peskine3f669c32018-06-21 09:21:51 +0200142 return( 0 );
Gilles Peskinee66ca3b2018-06-20 00:11:45 +0200143 }
Gilles Peskine3f669c32018-06-21 09:21:51 +0200144 return( 1 );
Gilles Peskinee66ca3b2018-06-20 00:11:45 +0200145}
Gilles Peskine818ca122018-06-20 18:16:48 +0200146
Gilles Peskine0b352bc2018-06-28 00:16:11 +0200147/* Write the ASN.1 INTEGER with the value 2^(bits-1)+x backwards from *p. */
148static int asn1_write_10x( unsigned char **p,
149 unsigned char *start,
150 size_t bits,
151 unsigned char x )
152{
153 int ret;
154 int len = bits / 8 + 1;
Gilles Peskine480416a2018-06-28 19:04:07 +0200155 if( bits == 0 )
156 return( MBEDTLS_ERR_ASN1_INVALID_DATA );
157 if( bits <= 8 && x >= 1 << ( bits - 1 ) )
Gilles Peskine0b352bc2018-06-28 00:16:11 +0200158 return( MBEDTLS_ERR_ASN1_INVALID_DATA );
Moran Pekercb088e72018-07-17 17:36:59 +0300159 if( *p < start || *p - start < (ptrdiff_t) len )
Gilles Peskine0b352bc2018-06-28 00:16:11 +0200160 return( MBEDTLS_ERR_ASN1_BUF_TOO_SMALL );
161 *p -= len;
162 ( *p )[len-1] = x;
163 if( bits % 8 == 0 )
164 ( *p )[1] |= 1;
165 else
166 ( *p )[0] |= 1 << ( bits % 8 );
167 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( p, start, len ) );
168 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( p, start,
169 MBEDTLS_ASN1_INTEGER ) );
170 return( len );
171}
172
173static int construct_fake_rsa_key( unsigned char *buffer,
174 size_t buffer_size,
175 unsigned char **p,
176 size_t bits,
177 int keypair )
178{
179 size_t half_bits = ( bits + 1 ) / 2;
180 int ret;
181 int len = 0;
182 /* Construct something that looks like a DER encoding of
183 * as defined by PKCS#1 v2.2 (RFC 8017) section A.1.2:
184 * RSAPrivateKey ::= SEQUENCE {
185 * version Version,
186 * modulus INTEGER, -- n
187 * publicExponent INTEGER, -- e
188 * privateExponent INTEGER, -- d
189 * prime1 INTEGER, -- p
190 * prime2 INTEGER, -- q
191 * exponent1 INTEGER, -- d mod (p-1)
192 * exponent2 INTEGER, -- d mod (q-1)
193 * coefficient INTEGER, -- (inverse of q) mod p
194 * otherPrimeInfos OtherPrimeInfos OPTIONAL
195 * }
196 * Or, for a public key, the same structure with only
197 * version, modulus and publicExponent.
198 */
199 *p = buffer + buffer_size;
200 if( keypair )
201 {
202 MBEDTLS_ASN1_CHK_ADD( len, /* pq */
203 asn1_write_10x( p, buffer, half_bits, 1 ) );
204 MBEDTLS_ASN1_CHK_ADD( len, /* dq */
205 asn1_write_10x( p, buffer, half_bits, 1 ) );
206 MBEDTLS_ASN1_CHK_ADD( len, /* dp */
207 asn1_write_10x( p, buffer, half_bits, 1 ) );
208 MBEDTLS_ASN1_CHK_ADD( len, /* q */
209 asn1_write_10x( p, buffer, half_bits, 1 ) );
210 MBEDTLS_ASN1_CHK_ADD( len, /* p != q to pass mbedtls sanity checks */
211 asn1_write_10x( p, buffer, half_bits, 3 ) );
212 MBEDTLS_ASN1_CHK_ADD( len, /* d */
213 asn1_write_10x( p, buffer, bits, 1 ) );
214 }
215 MBEDTLS_ASN1_CHK_ADD( len, /* e = 65537 */
216 asn1_write_10x( p, buffer, 17, 1 ) );
217 MBEDTLS_ASN1_CHK_ADD( len, /* n */
218 asn1_write_10x( p, buffer, bits, 1 ) );
219 if( keypair )
220 MBEDTLS_ASN1_CHK_ADD( len, /* version = 0 */
221 mbedtls_asn1_write_int( p, buffer, 0 ) );
222 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( p, buffer, len ) );
223 {
224 const unsigned char tag =
225 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE;
226 MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( p, buffer, tag ) );
227 }
228 return( len );
229}
230
Gilles Peskine667c1112019-12-03 19:03:20 +0100231int check_key_attributes_sanity( psa_key_handle_t key )
232{
233 int ok = 0;
234 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
235 psa_key_lifetime_t lifetime;
Ronald Cron71016a92020-08-28 19:01:50 +0200236 mbedtls_svc_key_id_t id;
Gilles Peskine667c1112019-12-03 19:03:20 +0100237 psa_key_type_t type;
238 psa_key_type_t bits;
239
240 PSA_ASSERT( psa_get_key_attributes( key, &attributes ) );
241 lifetime = psa_get_key_lifetime( &attributes );
242 id = psa_get_key_id( &attributes );
243 type = psa_get_key_type( &attributes );
244 bits = psa_get_key_bits( &attributes );
245
246 /* Persistence */
247 if( lifetime == PSA_KEY_LIFETIME_VOLATILE )
Ronald Cronecfb2372020-07-23 17:13:42 +0200248 TEST_ASSERT( MBEDTLS_SVC_KEY_ID_GET_KEY_ID( id ) == 0 );
Gilles Peskine667c1112019-12-03 19:03:20 +0100249 else
250 {
251 TEST_ASSERT(
Ronald Cronecfb2372020-07-23 17:13:42 +0200252 ( PSA_KEY_ID_USER_MIN <= MBEDTLS_SVC_KEY_ID_GET_KEY_ID( id ) ) &&
253 ( MBEDTLS_SVC_KEY_ID_GET_KEY_ID( id ) <= PSA_KEY_ID_USER_MAX ) );
Gilles Peskine667c1112019-12-03 19:03:20 +0100254 }
255#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
256 /* randomly-generated 64-bit constant, should never appear in test data */
257 psa_key_slot_number_t slot_number = 0xec94d4a5058a1a21;
258 psa_status_t status = psa_get_key_slot_number( &attributes, &slot_number );
259 if( lifetime_is_secure_element( lifetime ) )
260 {
261 /* Mbed Crypto currently always exposes the slot number to
262 * applications. This is not mandated by the PSA specification
263 * and may change in future versions. */
264 TEST_EQUAL( status, 0 );
265 TEST_ASSERT( slot_number != 0xec94d4a5058a1a21 );
266 }
267 else
268 {
269 TEST_EQUAL( status, PSA_ERROR_INVALID_ARGUMENT );
270 }
271#endif
272
273 /* Type and size */
274 TEST_ASSERT( type != 0 );
275 TEST_ASSERT( bits != 0 );
276 TEST_ASSERT( bits <= PSA_MAX_KEY_BITS );
277 if( PSA_KEY_TYPE_IS_UNSTRUCTURED( type ) )
278 TEST_ASSERT( bits % 8 == 0 );
279
280 /* MAX macros concerning specific key types */
281 if( PSA_KEY_TYPE_IS_ECC( type ) )
282 TEST_ASSERT( bits <= PSA_VENDOR_ECC_MAX_CURVE_BITS );
283 else if( PSA_KEY_TYPE_IS_RSA( type ) )
284 TEST_ASSERT( bits <= PSA_VENDOR_RSA_MAX_KEY_BITS );
285 TEST_ASSERT( PSA_BLOCK_CIPHER_BLOCK_SIZE( type ) <= PSA_MAX_BLOCK_CIPHER_BLOCK_SIZE );
286
287 ok = 1;
288
289exit:
290 psa_reset_key_attributes( &attributes );
291 return( ok );
292}
293
Gilles Peskinef426e0f2019-02-25 17:42:03 +0100294int exercise_mac_setup( psa_key_type_t key_type,
295 const unsigned char *key_bytes,
296 size_t key_length,
297 psa_algorithm_t alg,
298 psa_mac_operation_t *operation,
299 psa_status_t *status )
300{
Ronald Cron91e95152020-07-30 17:48:03 +0200301 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +0200302 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskinef426e0f2019-02-25 17:42:03 +0100303
Gilles Peskine89d8c5c2019-11-26 17:01:59 +0100304 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_SIGN_HASH );
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +0200305 psa_set_key_algorithm( &attributes, alg );
306 psa_set_key_type( &attributes, key_type );
Gilles Peskine049c7532019-05-15 20:22:09 +0200307 PSA_ASSERT( psa_import_key( &attributes, key_bytes, key_length,
308 &handle ) );
Gilles Peskinef426e0f2019-02-25 17:42:03 +0100309
310 *status = psa_mac_sign_setup( operation, handle, alg );
Gilles Peskine9e0a4a52019-02-25 22:11:18 +0100311 /* Whether setup succeeded or failed, abort must succeed. */
312 PSA_ASSERT( psa_mac_abort( operation ) );
313 /* If setup failed, reproduce the failure, so that the caller can
314 * test the resulting state of the operation object. */
315 if( *status != PSA_SUCCESS )
Gilles Peskinef426e0f2019-02-25 17:42:03 +0100316 {
Gilles Peskine9e0a4a52019-02-25 22:11:18 +0100317 TEST_EQUAL( psa_mac_sign_setup( operation, handle, alg ),
318 *status );
Gilles Peskinef426e0f2019-02-25 17:42:03 +0100319 }
320
321 psa_destroy_key( handle );
322 return( 1 );
323
324exit:
325 psa_destroy_key( handle );
326 return( 0 );
327}
328
329int exercise_cipher_setup( psa_key_type_t key_type,
330 const unsigned char *key_bytes,
331 size_t key_length,
332 psa_algorithm_t alg,
333 psa_cipher_operation_t *operation,
334 psa_status_t *status )
335{
Ronald Cron91e95152020-07-30 17:48:03 +0200336 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +0200337 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskinef426e0f2019-02-25 17:42:03 +0100338
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +0200339 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_ENCRYPT );
340 psa_set_key_algorithm( &attributes, alg );
341 psa_set_key_type( &attributes, key_type );
Gilles Peskine049c7532019-05-15 20:22:09 +0200342 PSA_ASSERT( psa_import_key( &attributes, key_bytes, key_length,
343 &handle ) );
Gilles Peskinef426e0f2019-02-25 17:42:03 +0100344
345 *status = psa_cipher_encrypt_setup( operation, handle, alg );
Gilles Peskine9e0a4a52019-02-25 22:11:18 +0100346 /* Whether setup succeeded or failed, abort must succeed. */
347 PSA_ASSERT( psa_cipher_abort( operation ) );
348 /* If setup failed, reproduce the failure, so that the caller can
349 * test the resulting state of the operation object. */
350 if( *status != PSA_SUCCESS )
Gilles Peskinef426e0f2019-02-25 17:42:03 +0100351 {
Gilles Peskine9e0a4a52019-02-25 22:11:18 +0100352 TEST_EQUAL( psa_cipher_encrypt_setup( operation, handle, alg ),
353 *status );
Gilles Peskinef426e0f2019-02-25 17:42:03 +0100354 }
355
356 psa_destroy_key( handle );
357 return( 1 );
358
359exit:
360 psa_destroy_key( handle );
361 return( 0 );
362}
363
Gilles Peskinebdf309c2018-12-03 15:36:32 +0100364static int exercise_mac_key( psa_key_handle_t handle,
Gilles Peskine818ca122018-06-20 18:16:48 +0200365 psa_key_usage_t usage,
366 psa_algorithm_t alg )
367{
Jaeden Amero769ce272019-01-04 11:48:03 +0000368 psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT;
Gilles Peskine818ca122018-06-20 18:16:48 +0200369 const unsigned char input[] = "foo";
Gilles Peskine69c12672018-06-28 00:07:19 +0200370 unsigned char mac[PSA_MAC_MAX_SIZE] = {0};
Gilles Peskine818ca122018-06-20 18:16:48 +0200371 size_t mac_length = sizeof( mac );
372
Gilles Peskine89d8c5c2019-11-26 17:01:59 +0100373 if( usage & PSA_KEY_USAGE_SIGN_HASH )
Gilles Peskine818ca122018-06-20 18:16:48 +0200374 {
Gilles Peskine8817f612018-12-18 00:18:46 +0100375 PSA_ASSERT( psa_mac_sign_setup( &operation,
376 handle, alg ) );
377 PSA_ASSERT( psa_mac_update( &operation,
378 input, sizeof( input ) ) );
379 PSA_ASSERT( psa_mac_sign_finish( &operation,
380 mac, sizeof( mac ),
381 &mac_length ) );
Gilles Peskine818ca122018-06-20 18:16:48 +0200382 }
383
Gilles Peskine89d8c5c2019-11-26 17:01:59 +0100384 if( usage & PSA_KEY_USAGE_VERIFY_HASH )
Gilles Peskine818ca122018-06-20 18:16:48 +0200385 {
386 psa_status_t verify_status =
Gilles Peskine89d8c5c2019-11-26 17:01:59 +0100387 ( usage & PSA_KEY_USAGE_SIGN_HASH ?
Gilles Peskine818ca122018-06-20 18:16:48 +0200388 PSA_SUCCESS :
389 PSA_ERROR_INVALID_SIGNATURE );
Gilles Peskine8817f612018-12-18 00:18:46 +0100390 PSA_ASSERT( psa_mac_verify_setup( &operation,
391 handle, alg ) );
392 PSA_ASSERT( psa_mac_update( &operation,
393 input, sizeof( input ) ) );
Gilles Peskinef812dcf2018-12-18 00:33:25 +0100394 TEST_EQUAL( psa_mac_verify_finish( &operation, mac, mac_length ),
395 verify_status );
Gilles Peskine818ca122018-06-20 18:16:48 +0200396 }
397
398 return( 1 );
399
400exit:
401 psa_mac_abort( &operation );
402 return( 0 );
403}
404
Gilles Peskinebdf309c2018-12-03 15:36:32 +0100405static int exercise_cipher_key( psa_key_handle_t handle,
Gilles Peskine818ca122018-06-20 18:16:48 +0200406 psa_key_usage_t usage,
407 psa_algorithm_t alg )
408{
Jaeden Amero5bae2272019-01-04 11:48:27 +0000409 psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT;
Gilles Peskine818ca122018-06-20 18:16:48 +0200410 unsigned char iv[16] = {0};
411 size_t iv_length = sizeof( iv );
412 const unsigned char plaintext[16] = "Hello, world...";
413 unsigned char ciphertext[32] = "(wabblewebblewibblewobblewubble)";
414 size_t ciphertext_length = sizeof( ciphertext );
415 unsigned char decrypted[sizeof( ciphertext )];
416 size_t part_length;
417
418 if( usage & PSA_KEY_USAGE_ENCRYPT )
419 {
Gilles Peskine8817f612018-12-18 00:18:46 +0100420 PSA_ASSERT( psa_cipher_encrypt_setup( &operation,
421 handle, alg ) );
422 PSA_ASSERT( psa_cipher_generate_iv( &operation,
423 iv, sizeof( iv ),
424 &iv_length ) );
425 PSA_ASSERT( psa_cipher_update( &operation,
426 plaintext, sizeof( plaintext ),
427 ciphertext, sizeof( ciphertext ),
428 &ciphertext_length ) );
429 PSA_ASSERT( psa_cipher_finish( &operation,
430 ciphertext + ciphertext_length,
431 sizeof( ciphertext ) - ciphertext_length,
432 &part_length ) );
Gilles Peskine818ca122018-06-20 18:16:48 +0200433 ciphertext_length += part_length;
434 }
435
436 if( usage & PSA_KEY_USAGE_DECRYPT )
437 {
438 psa_status_t status;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +0200439 int maybe_invalid_padding = 0;
Gilles Peskine818ca122018-06-20 18:16:48 +0200440 if( ! ( usage & PSA_KEY_USAGE_ENCRYPT ) )
441 {
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +0200442 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
443 PSA_ASSERT( psa_get_key_attributes( handle, &attributes ) );
444 /* This should be PSA_CIPHER_GET_IV_SIZE but the API doesn't
445 * have this macro yet. */
446 iv_length = PSA_BLOCK_CIPHER_BLOCK_SIZE(
447 psa_get_key_type( &attributes ) );
448 maybe_invalid_padding = ! PSA_ALG_IS_STREAM_CIPHER( alg );
Gilles Peskine818ca122018-06-20 18:16:48 +0200449 }
Gilles Peskine8817f612018-12-18 00:18:46 +0100450 PSA_ASSERT( psa_cipher_decrypt_setup( &operation,
451 handle, alg ) );
452 PSA_ASSERT( psa_cipher_set_iv( &operation,
453 iv, iv_length ) );
454 PSA_ASSERT( psa_cipher_update( &operation,
455 ciphertext, ciphertext_length,
456 decrypted, sizeof( decrypted ),
457 &part_length ) );
Gilles Peskine818ca122018-06-20 18:16:48 +0200458 status = psa_cipher_finish( &operation,
459 decrypted + part_length,
460 sizeof( decrypted ) - part_length,
461 &part_length );
462 /* For a stream cipher, all inputs are valid. For a block cipher,
463 * if the input is some aribtrary data rather than an actual
464 ciphertext, a padding error is likely. */
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +0200465 if( maybe_invalid_padding )
Gilles Peskine818ca122018-06-20 18:16:48 +0200466 TEST_ASSERT( status == PSA_SUCCESS ||
467 status == PSA_ERROR_INVALID_PADDING );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +0200468 else
469 PSA_ASSERT( status );
Gilles Peskine818ca122018-06-20 18:16:48 +0200470 }
471
472 return( 1 );
473
474exit:
475 psa_cipher_abort( &operation );
476 return( 0 );
477}
478
Gilles Peskinebdf309c2018-12-03 15:36:32 +0100479static int exercise_aead_key( psa_key_handle_t handle,
Gilles Peskine818ca122018-06-20 18:16:48 +0200480 psa_key_usage_t usage,
481 psa_algorithm_t alg )
482{
483 unsigned char nonce[16] = {0};
484 size_t nonce_length = sizeof( nonce );
485 unsigned char plaintext[16] = "Hello, world...";
486 unsigned char ciphertext[48] = "(wabblewebblewibblewobblewubble)";
487 size_t ciphertext_length = sizeof( ciphertext );
488 size_t plaintext_length = sizeof( ciphertext );
489
490 if( usage & PSA_KEY_USAGE_ENCRYPT )
491 {
Gilles Peskine8817f612018-12-18 00:18:46 +0100492 PSA_ASSERT( psa_aead_encrypt( handle, alg,
493 nonce, nonce_length,
494 NULL, 0,
495 plaintext, sizeof( plaintext ),
496 ciphertext, sizeof( ciphertext ),
497 &ciphertext_length ) );
Gilles Peskine818ca122018-06-20 18:16:48 +0200498 }
499
500 if( usage & PSA_KEY_USAGE_DECRYPT )
501 {
502 psa_status_t verify_status =
503 ( usage & PSA_KEY_USAGE_ENCRYPT ?
504 PSA_SUCCESS :
505 PSA_ERROR_INVALID_SIGNATURE );
Gilles Peskinefe11b722018-12-18 00:24:04 +0100506 TEST_EQUAL( psa_aead_decrypt( handle, alg,
507 nonce, nonce_length,
508 NULL, 0,
509 ciphertext, ciphertext_length,
510 plaintext, sizeof( plaintext ),
Gilles Peskinef812dcf2018-12-18 00:33:25 +0100511 &plaintext_length ),
512 verify_status );
Gilles Peskine818ca122018-06-20 18:16:48 +0200513 }
514
515 return( 1 );
516
517exit:
518 return( 0 );
519}
520
Gilles Peskinebdf309c2018-12-03 15:36:32 +0100521static int exercise_signature_key( psa_key_handle_t handle,
Gilles Peskine818ca122018-06-20 18:16:48 +0200522 psa_key_usage_t usage,
523 psa_algorithm_t alg )
524{
Gilles Peskinef969b3a2018-06-30 00:20:25 +0200525 unsigned char payload[PSA_HASH_MAX_SIZE] = {1};
526 size_t payload_length = 16;
Gilles Peskine89d8c5c2019-11-26 17:01:59 +0100527 unsigned char signature[PSA_SIGNATURE_MAX_SIZE] = {0};
Gilles Peskine818ca122018-06-20 18:16:48 +0200528 size_t signature_length = sizeof( signature );
Gilles Peskine57ab7212019-01-28 13:03:09 +0100529 psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH( alg );
530
531 /* If the policy allows signing with any hash, just pick one. */
532 if( PSA_ALG_IS_HASH_AND_SIGN( alg ) && hash_alg == PSA_ALG_ANY_HASH )
533 {
Gilles Peskinef426e0f2019-02-25 17:42:03 +0100534#if defined(KNOWN_SUPPORTED_HASH_ALG)
535 hash_alg = KNOWN_SUPPORTED_HASH_ALG;
536 alg ^= PSA_ALG_ANY_HASH ^ hash_alg;
Gilles Peskine57ab7212019-01-28 13:03:09 +0100537#else
538 test_fail( "No hash algorithm for hash-and-sign testing", __LINE__, __FILE__ );
Gilles Peskinef426e0f2019-02-25 17:42:03 +0100539 return( 1 );
Gilles Peskine57ab7212019-01-28 13:03:09 +0100540#endif
Gilles Peskine57ab7212019-01-28 13:03:09 +0100541 }
Gilles Peskine818ca122018-06-20 18:16:48 +0200542
Gilles Peskine89d8c5c2019-11-26 17:01:59 +0100543 if( usage & PSA_KEY_USAGE_SIGN_HASH )
Gilles Peskine818ca122018-06-20 18:16:48 +0200544 {
Gilles Peskinef969b3a2018-06-30 00:20:25 +0200545 /* Some algorithms require the payload to have the size of
546 * the hash encoded in the algorithm. Use this input size
547 * even for algorithms that allow other input sizes. */
Gilles Peskinef969b3a2018-06-30 00:20:25 +0200548 if( hash_alg != 0 )
549 payload_length = PSA_HASH_SIZE( hash_alg );
Gilles Peskine89d8c5c2019-11-26 17:01:59 +0100550 PSA_ASSERT( psa_sign_hash( handle, alg,
551 payload, payload_length,
552 signature, sizeof( signature ),
553 &signature_length ) );
Gilles Peskine818ca122018-06-20 18:16:48 +0200554 }
555
Gilles Peskine89d8c5c2019-11-26 17:01:59 +0100556 if( usage & PSA_KEY_USAGE_VERIFY_HASH )
Gilles Peskine818ca122018-06-20 18:16:48 +0200557 {
558 psa_status_t verify_status =
Gilles Peskine89d8c5c2019-11-26 17:01:59 +0100559 ( usage & PSA_KEY_USAGE_SIGN_HASH ?
Gilles Peskine818ca122018-06-20 18:16:48 +0200560 PSA_SUCCESS :
561 PSA_ERROR_INVALID_SIGNATURE );
Gilles Peskine89d8c5c2019-11-26 17:01:59 +0100562 TEST_EQUAL( psa_verify_hash( handle, alg,
563 payload, payload_length,
564 signature, signature_length ),
Gilles Peskinefe11b722018-12-18 00:24:04 +0100565 verify_status );
Gilles Peskine818ca122018-06-20 18:16:48 +0200566 }
567
568 return( 1 );
569
570exit:
571 return( 0 );
572}
573
Gilles Peskinebdf309c2018-12-03 15:36:32 +0100574static int exercise_asymmetric_encryption_key( psa_key_handle_t handle,
Gilles Peskine818ca122018-06-20 18:16:48 +0200575 psa_key_usage_t usage,
576 psa_algorithm_t alg )
577{
578 unsigned char plaintext[256] = "Hello, world...";
579 unsigned char ciphertext[256] = "(wabblewebblewibblewobblewubble)";
580 size_t ciphertext_length = sizeof( ciphertext );
581 size_t plaintext_length = 16;
582
583 if( usage & PSA_KEY_USAGE_ENCRYPT )
584 {
Gilles Peskinef812dcf2018-12-18 00:33:25 +0100585 PSA_ASSERT( psa_asymmetric_encrypt( handle, alg,
586 plaintext, plaintext_length,
587 NULL, 0,
588 ciphertext, sizeof( ciphertext ),
589 &ciphertext_length ) );
Gilles Peskine818ca122018-06-20 18:16:48 +0200590 }
591
592 if( usage & PSA_KEY_USAGE_DECRYPT )
593 {
594 psa_status_t status =
Gilles Peskinebdf309c2018-12-03 15:36:32 +0100595 psa_asymmetric_decrypt( handle, alg,
Gilles Peskine818ca122018-06-20 18:16:48 +0200596 ciphertext, ciphertext_length,
597 NULL, 0,
598 plaintext, sizeof( plaintext ),
599 &plaintext_length );
600 TEST_ASSERT( status == PSA_SUCCESS ||
601 ( ( usage & PSA_KEY_USAGE_ENCRYPT ) == 0 &&
602 ( status == PSA_ERROR_INVALID_ARGUMENT ||
603 status == PSA_ERROR_INVALID_PADDING ) ) );
604 }
605
606 return( 1 );
607
608exit:
609 return( 0 );
610}
Gilles Peskine02b75072018-07-01 22:31:34 +0200611
Janos Follathf2815ea2019-07-03 12:41:36 +0100612static int setup_key_derivation_wrap( psa_key_derivation_operation_t* operation,
613 psa_key_handle_t handle,
614 psa_algorithm_t alg,
615 unsigned char* input1, size_t input1_length,
616 unsigned char* input2, size_t input2_length,
617 size_t capacity )
618{
619 PSA_ASSERT( psa_key_derivation_setup( operation, alg ) );
620 if( PSA_ALG_IS_HKDF( alg ) )
621 {
622 PSA_ASSERT( psa_key_derivation_input_bytes( operation,
623 PSA_KEY_DERIVATION_INPUT_SALT,
624 input1, input1_length ) );
625 PSA_ASSERT( psa_key_derivation_input_key( operation,
626 PSA_KEY_DERIVATION_INPUT_SECRET,
627 handle ) );
628 PSA_ASSERT( psa_key_derivation_input_bytes( operation,
629 PSA_KEY_DERIVATION_INPUT_INFO,
630 input2,
631 input2_length ) );
632 }
633 else if( PSA_ALG_IS_TLS12_PRF( alg ) ||
634 PSA_ALG_IS_TLS12_PSK_TO_MS( alg ) )
635 {
636 PSA_ASSERT( psa_key_derivation_input_bytes( operation,
637 PSA_KEY_DERIVATION_INPUT_SEED,
638 input1, input1_length ) );
639 PSA_ASSERT( psa_key_derivation_input_key( operation,
640 PSA_KEY_DERIVATION_INPUT_SECRET,
641 handle ) );
642 PSA_ASSERT( psa_key_derivation_input_bytes( operation,
643 PSA_KEY_DERIVATION_INPUT_LABEL,
644 input2, input2_length ) );
645 }
646 else
647 {
648 TEST_ASSERT( ! "Key derivation algorithm not supported" );
649 }
650
Gilles Peskinec744d992019-07-30 17:26:54 +0200651 if( capacity != SIZE_MAX )
652 PSA_ASSERT( psa_key_derivation_set_capacity( operation, capacity ) );
Janos Follathf2815ea2019-07-03 12:41:36 +0100653
654 return( 1 );
655
656exit:
657 return( 0 );
658}
659
660
Gilles Peskinebdf309c2018-12-03 15:36:32 +0100661static int exercise_key_derivation_key( psa_key_handle_t handle,
Gilles Peskineea0fb492018-07-12 17:17:20 +0200662 psa_key_usage_t usage,
663 psa_algorithm_t alg )
664{
Gilles Peskine51ae0e42019-05-16 17:31:03 +0200665 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
Janos Follathf2815ea2019-07-03 12:41:36 +0100666 unsigned char input1[] = "Input 1";
667 size_t input1_length = sizeof( input1 );
668 unsigned char input2[] = "Input 2";
669 size_t input2_length = sizeof( input2 );
Gilles Peskineea0fb492018-07-12 17:17:20 +0200670 unsigned char output[1];
Janos Follathf2815ea2019-07-03 12:41:36 +0100671 size_t capacity = sizeof( output );
Gilles Peskineea0fb492018-07-12 17:17:20 +0200672
673 if( usage & PSA_KEY_USAGE_DERIVE )
674 {
Janos Follathf2815ea2019-07-03 12:41:36 +0100675 if( !setup_key_derivation_wrap( &operation, handle, alg,
676 input1, input1_length,
677 input2, input2_length, capacity ) )
678 goto exit;
Gilles Peskine7607cd62019-05-29 17:35:00 +0200679
Gilles Peskine51ae0e42019-05-16 17:31:03 +0200680 PSA_ASSERT( psa_key_derivation_output_bytes( &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +0200681 output,
Janos Follathf2815ea2019-07-03 12:41:36 +0100682 capacity ) );
Gilles Peskine51ae0e42019-05-16 17:31:03 +0200683 PSA_ASSERT( psa_key_derivation_abort( &operation ) );
Gilles Peskineea0fb492018-07-12 17:17:20 +0200684 }
685
686 return( 1 );
687
688exit:
689 return( 0 );
690}
691
Gilles Peskinec7998b72018-11-07 18:45:02 +0100692/* We need two keys to exercise key agreement. Exercise the
693 * private key against its own public key. */
Gilles Peskinecf7292e2019-05-16 17:53:40 +0200694static psa_status_t key_agreement_with_self(
695 psa_key_derivation_operation_t *operation,
696 psa_key_handle_t handle )
Gilles Peskinec7998b72018-11-07 18:45:02 +0100697{
698 psa_key_type_t private_key_type;
699 psa_key_type_t public_key_type;
700 size_t key_bits;
701 uint8_t *public_key = NULL;
702 size_t public_key_length;
David Saadab4ecc272019-02-14 13:48:10 +0200703 /* Return GENERIC_ERROR if something other than the final call to
Gilles Peskinecf7292e2019-05-16 17:53:40 +0200704 * psa_key_derivation_key_agreement fails. This isn't fully satisfactory,
705 * but it's good enough: callers will report it as a failed test anyway. */
David Saadab4ecc272019-02-14 13:48:10 +0200706 psa_status_t status = PSA_ERROR_GENERIC_ERROR;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +0200707 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskinec7998b72018-11-07 18:45:02 +0100708
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +0200709 PSA_ASSERT( psa_get_key_attributes( handle, &attributes ) );
710 private_key_type = psa_get_key_type( &attributes );
711 key_bits = psa_get_key_bits( &attributes );
Gilles Peskinec93b80c2019-05-16 19:39:54 +0200712 public_key_type = PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR( private_key_type );
Gilles Peskinec7998b72018-11-07 18:45:02 +0100713 public_key_length = PSA_KEY_EXPORT_MAX_SIZE( public_key_type, key_bits );
714 ASSERT_ALLOC( public_key, public_key_length );
Gilles Peskine8817f612018-12-18 00:18:46 +0100715 PSA_ASSERT( psa_export_public_key( handle,
716 public_key, public_key_length,
717 &public_key_length ) );
Gilles Peskinec7998b72018-11-07 18:45:02 +0100718
Gilles Peskinecf7292e2019-05-16 17:53:40 +0200719 status = psa_key_derivation_key_agreement(
720 operation, PSA_KEY_DERIVATION_INPUT_SECRET, handle,
721 public_key, public_key_length );
Gilles Peskinec7998b72018-11-07 18:45:02 +0100722exit:
723 mbedtls_free( public_key );
Gilles Peskinea1ace9c2019-04-26 16:03:33 +0200724 psa_reset_key_attributes( &attributes );
Gilles Peskinec7998b72018-11-07 18:45:02 +0100725 return( status );
726}
727
Gilles Peskine2e46e9c2019-04-11 21:24:55 +0200728/* We need two keys to exercise key agreement. Exercise the
729 * private key against its own public key. */
730static psa_status_t raw_key_agreement_with_self( psa_algorithm_t alg,
731 psa_key_handle_t handle )
732{
733 psa_key_type_t private_key_type;
734 psa_key_type_t public_key_type;
735 size_t key_bits;
736 uint8_t *public_key = NULL;
737 size_t public_key_length;
738 uint8_t output[1024];
739 size_t output_length;
740 /* Return GENERIC_ERROR if something other than the final call to
Gilles Peskinecf7292e2019-05-16 17:53:40 +0200741 * psa_key_derivation_key_agreement fails. This isn't fully satisfactory,
742 * but it's good enough: callers will report it as a failed test anyway. */
Gilles Peskine2e46e9c2019-04-11 21:24:55 +0200743 psa_status_t status = PSA_ERROR_GENERIC_ERROR;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +0200744 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine2e46e9c2019-04-11 21:24:55 +0200745
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +0200746 PSA_ASSERT( psa_get_key_attributes( handle, &attributes ) );
747 private_key_type = psa_get_key_type( &attributes );
748 key_bits = psa_get_key_bits( &attributes );
Gilles Peskinec93b80c2019-05-16 19:39:54 +0200749 public_key_type = PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR( private_key_type );
Gilles Peskine2e46e9c2019-04-11 21:24:55 +0200750 public_key_length = PSA_KEY_EXPORT_MAX_SIZE( public_key_type, key_bits );
751 ASSERT_ALLOC( public_key, public_key_length );
752 PSA_ASSERT( psa_export_public_key( handle,
753 public_key, public_key_length,
754 &public_key_length ) );
755
Gilles Peskinebe697d82019-05-16 18:00:41 +0200756 status = psa_raw_key_agreement( alg, handle,
757 public_key, public_key_length,
758 output, sizeof( output ), &output_length );
Gilles Peskine2e46e9c2019-04-11 21:24:55 +0200759exit:
760 mbedtls_free( public_key );
Gilles Peskinea1ace9c2019-04-26 16:03:33 +0200761 psa_reset_key_attributes( &attributes );
Gilles Peskine2e46e9c2019-04-11 21:24:55 +0200762 return( status );
763}
764
765static int exercise_raw_key_agreement_key( psa_key_handle_t handle,
766 psa_key_usage_t usage,
767 psa_algorithm_t alg )
768{
769 int ok = 0;
770
771 if( usage & PSA_KEY_USAGE_DERIVE )
772 {
773 /* We need two keys to exercise key agreement. Exercise the
774 * private key against its own public key. */
775 PSA_ASSERT( raw_key_agreement_with_self( alg, handle ) );
776 }
777 ok = 1;
778
779exit:
780 return( ok );
781}
782
Gilles Peskinebdf309c2018-12-03 15:36:32 +0100783static int exercise_key_agreement_key( psa_key_handle_t handle,
Gilles Peskine01d718c2018-09-18 12:01:02 +0200784 psa_key_usage_t usage,
785 psa_algorithm_t alg )
786{
Gilles Peskine51ae0e42019-05-16 17:31:03 +0200787 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
Gilles Peskine01d718c2018-09-18 12:01:02 +0200788 unsigned char output[1];
789 int ok = 0;
790
791 if( usage & PSA_KEY_USAGE_DERIVE )
792 {
793 /* We need two keys to exercise key agreement. Exercise the
794 * private key against its own public key. */
Gilles Peskine51ae0e42019-05-16 17:31:03 +0200795 PSA_ASSERT( psa_key_derivation_setup( &operation, alg ) );
796 PSA_ASSERT( key_agreement_with_self( &operation, handle ) );
797 PSA_ASSERT( psa_key_derivation_output_bytes( &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +0200798 output,
799 sizeof( output ) ) );
Gilles Peskine51ae0e42019-05-16 17:31:03 +0200800 PSA_ASSERT( psa_key_derivation_abort( &operation ) );
Gilles Peskine01d718c2018-09-18 12:01:02 +0200801 }
802 ok = 1;
803
804exit:
Gilles Peskine01d718c2018-09-18 12:01:02 +0200805 return( ok );
806}
807
Jaeden Amerof7dca862019-06-27 17:31:33 +0100808int asn1_skip_integer( unsigned char **p, const unsigned char *end,
809 size_t min_bits, size_t max_bits,
810 int must_be_odd )
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200811{
812 size_t len;
813 size_t actual_bits;
814 unsigned char msb;
Gilles Peskinefe11b722018-12-18 00:24:04 +0100815 TEST_EQUAL( mbedtls_asn1_get_tag( p, end, &len,
Gilles Peskinef812dcf2018-12-18 00:33:25 +0100816 MBEDTLS_ASN1_INTEGER ),
817 0 );
k-stachowiak9b88efc2019-09-13 15:26:53 +0200818
819 /* Check if the retrieved length doesn't extend the actual buffer's size.
820 * It is assumed here, that end >= p, which validates casting to size_t. */
821 TEST_ASSERT( len <= (size_t)( end - *p) );
822
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200823 /* Tolerate a slight departure from DER encoding:
824 * - 0 may be represented by an empty string or a 1-byte string.
825 * - The sign bit may be used as a value bit. */
826 if( ( len == 1 && ( *p )[0] == 0 ) ||
827 ( len > 1 && ( *p )[0] == 0 && ( ( *p )[1] & 0x80 ) != 0 ) )
828 {
829 ++( *p );
830 --len;
831 }
832 if( min_bits == 0 && len == 0 )
833 return( 1 );
834 msb = ( *p )[0];
835 TEST_ASSERT( msb != 0 );
836 actual_bits = 8 * ( len - 1 );
837 while( msb != 0 )
838 {
839 msb >>= 1;
840 ++actual_bits;
841 }
842 TEST_ASSERT( actual_bits >= min_bits );
843 TEST_ASSERT( actual_bits <= max_bits );
844 if( must_be_odd )
845 TEST_ASSERT( ( ( *p )[len-1] & 1 ) != 0 );
846 *p += len;
847 return( 1 );
848exit:
849 return( 0 );
850}
851
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200852static int exported_key_sanity_check( psa_key_type_t type, size_t bits,
853 uint8_t *exported, size_t exported_length )
854{
855 if( PSA_KEY_TYPE_IS_UNSTRUCTURED( type ) )
Gilles Peskinefe11b722018-12-18 00:24:04 +0100856 TEST_EQUAL( exported_length, ( bits + 7 ) / 8 );
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200857 else
858 TEST_ASSERT( exported_length <= PSA_KEY_EXPORT_MAX_SIZE( type, bits ) );
Gilles Peskined14664a2018-08-10 19:07:32 +0200859
860#if defined(MBEDTLS_DES_C)
861 if( type == PSA_KEY_TYPE_DES )
862 {
863 /* Check the parity bits. */
864 unsigned i;
865 for( i = 0; i < bits / 8; i++ )
866 {
867 unsigned bit_count = 0;
868 unsigned m;
869 for( m = 1; m <= 0x100; m <<= 1 )
870 {
871 if( exported[i] & m )
872 ++bit_count;
873 }
874 TEST_ASSERT( bit_count % 2 != 0 );
875 }
876 }
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200877 else
Gilles Peskined14664a2018-08-10 19:07:32 +0200878#endif
879
880#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PK_PARSE_C)
Gilles Peskinec93b80c2019-05-16 19:39:54 +0200881 if( type == PSA_KEY_TYPE_RSA_KEY_PAIR )
Gilles Peskined14664a2018-08-10 19:07:32 +0200882 {
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200883 uint8_t *p = exported;
884 uint8_t *end = exported + exported_length;
885 size_t len;
886 /* RSAPrivateKey ::= SEQUENCE {
Gilles Peskinedea46cf2018-08-21 16:12:54 +0200887 * version INTEGER, -- must be 0
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200888 * modulus INTEGER, -- n
889 * publicExponent INTEGER, -- e
890 * privateExponent INTEGER, -- d
891 * prime1 INTEGER, -- p
892 * prime2 INTEGER, -- q
893 * exponent1 INTEGER, -- d mod (p-1)
894 * exponent2 INTEGER, -- d mod (q-1)
895 * coefficient INTEGER, -- (inverse of q) mod p
896 * }
897 */
Gilles Peskinefe11b722018-12-18 00:24:04 +0100898 TEST_EQUAL( mbedtls_asn1_get_tag( &p, end, &len,
899 MBEDTLS_ASN1_SEQUENCE |
900 MBEDTLS_ASN1_CONSTRUCTED ), 0 );
901 TEST_EQUAL( p + len, end );
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200902 if( ! asn1_skip_integer( &p, end, 0, 0, 0 ) )
903 goto exit;
904 if( ! asn1_skip_integer( &p, end, bits, bits, 1 ) )
905 goto exit;
906 if( ! asn1_skip_integer( &p, end, 2, bits, 1 ) )
907 goto exit;
908 /* Require d to be at least half the size of n. */
909 if( ! asn1_skip_integer( &p, end, bits / 2, bits, 1 ) )
910 goto exit;
911 /* Require p and q to be at most half the size of n, rounded up. */
912 if( ! asn1_skip_integer( &p, end, bits / 2, bits / 2 + 1, 1 ) )
913 goto exit;
914 if( ! asn1_skip_integer( &p, end, bits / 2, bits / 2 + 1, 1 ) )
915 goto exit;
916 if( ! asn1_skip_integer( &p, end, 1, bits / 2 + 1, 0 ) )
917 goto exit;
918 if( ! asn1_skip_integer( &p, end, 1, bits / 2 + 1, 0 ) )
919 goto exit;
920 if( ! asn1_skip_integer( &p, end, 1, bits / 2 + 1, 0 ) )
921 goto exit;
Gilles Peskinefe11b722018-12-18 00:24:04 +0100922 TEST_EQUAL( p, end );
Gilles Peskine0f915f12018-12-17 23:35:42 +0100923 }
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200924 else
Gilles Peskined14664a2018-08-10 19:07:32 +0200925#endif /* MBEDTLS_RSA_C */
926
927#if defined(MBEDTLS_ECP_C)
Gilles Peskinec93b80c2019-05-16 19:39:54 +0200928 if( PSA_KEY_TYPE_IS_ECC_KEY_PAIR( type ) )
Gilles Peskined14664a2018-08-10 19:07:32 +0200929 {
Gilles Peskine5b802a32018-10-29 19:21:41 +0100930 /* Just the secret value */
Gilles Peskinefe11b722018-12-18 00:24:04 +0100931 TEST_EQUAL( exported_length, PSA_BITS_TO_BYTES( bits ) );
Gilles Peskine5b802a32018-10-29 19:21:41 +0100932 }
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200933 else
Gilles Peskined14664a2018-08-10 19:07:32 +0200934#endif /* MBEDTLS_ECP_C */
935
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200936 if( PSA_KEY_TYPE_IS_PUBLIC_KEY( type ) )
937 {
938 uint8_t *p = exported;
939 uint8_t *end = exported + exported_length;
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200940#if defined(MBEDTLS_RSA_C)
941 if( type == PSA_KEY_TYPE_RSA_PUBLIC_KEY )
942 {
Jaeden Amerof7dca862019-06-27 17:31:33 +0100943 size_t len;
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200944 /* RSAPublicKey ::= SEQUENCE {
945 * modulus INTEGER, -- n
946 * publicExponent INTEGER } -- e
947 */
Gilles Peskinefe11b722018-12-18 00:24:04 +0100948 TEST_EQUAL( mbedtls_asn1_get_tag( &p, end, &len,
949 MBEDTLS_ASN1_SEQUENCE |
Gilles Peskinef812dcf2018-12-18 00:33:25 +0100950 MBEDTLS_ASN1_CONSTRUCTED ),
951 0 );
Gilles Peskinefe11b722018-12-18 00:24:04 +0100952 TEST_EQUAL( p + len, end );
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200953 if( ! asn1_skip_integer( &p, end, bits, bits, 1 ) )
954 goto exit;
955 if( ! asn1_skip_integer( &p, end, 2, bits, 1 ) )
956 goto exit;
Gilles Peskinefe11b722018-12-18 00:24:04 +0100957 TEST_EQUAL( p, end );
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200958 }
959 else
960#endif /* MBEDTLS_RSA_C */
961#if defined(MBEDTLS_ECP_C)
962 if( PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY( type ) )
963 {
Steven Cooreman3fa684e2020-07-30 15:04:07 +0200964 if( PSA_KEY_TYPE_ECC_GET_FAMILY( type ) == PSA_ECC_FAMILY_MONTGOMERY )
965 {
966 /* The representation of an ECC Montgomery public key is
967 * the raw compressed point */
968 TEST_EQUAL( p + PSA_BITS_TO_BYTES( bits ), end );
969 }
970 else
971 {
972 /* The representation of an ECC Weierstrass public key is:
973 * - The byte 0x04;
974 * - `x_P` as a `ceiling(m/8)`-byte string, big-endian;
975 * - `y_P` as a `ceiling(m/8)`-byte string, big-endian;
976 * - where m is the bit size associated with the curve.
977 */
978 TEST_EQUAL( p + 1 + 2 * PSA_BITS_TO_BYTES( bits ), end );
979 TEST_EQUAL( p[0], 4 );
980 }
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200981 }
982 else
983#endif /* MBEDTLS_ECP_C */
984 {
Jaeden Amero594a3302018-10-26 17:07:22 +0100985 char message[47];
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200986 mbedtls_snprintf( message, sizeof( message ),
987 "No sanity check for public key type=0x%08lx",
988 (unsigned long) type );
989 test_fail( message, __LINE__, __FILE__ );
Gilles Peskineb16841e2019-10-10 20:36:12 +0200990 (void) p;
991 (void) end;
Gilles Peskinedd2f95b2018-08-11 01:22:42 +0200992 return( 0 );
993 }
994 }
995 else
996
997 {
998 /* No sanity checks for other types */
999 }
1000
1001 return( 1 );
Gilles Peskined14664a2018-08-10 19:07:32 +02001002
1003exit:
Gilles Peskinedd2f95b2018-08-11 01:22:42 +02001004 return( 0 );
Gilles Peskined14664a2018-08-10 19:07:32 +02001005}
1006
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001007static int exercise_export_key( psa_key_handle_t handle,
Gilles Peskined14664a2018-08-10 19:07:32 +02001008 psa_key_usage_t usage )
1009{
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001010 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskined14664a2018-08-10 19:07:32 +02001011 uint8_t *exported = NULL;
1012 size_t exported_size = 0;
1013 size_t exported_length = 0;
1014 int ok = 0;
1015
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001016 PSA_ASSERT( psa_get_key_attributes( handle, &attributes ) );
Gilles Peskineacec7b6f2018-09-13 20:34:11 +02001017
1018 if( ( usage & PSA_KEY_USAGE_EXPORT ) == 0 &&
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001019 ! PSA_KEY_TYPE_IS_PUBLIC_KEY( psa_get_key_type( &attributes ) ) )
Gilles Peskined14664a2018-08-10 19:07:32 +02001020 {
Gilles Peskinefe11b722018-12-18 00:24:04 +01001021 TEST_EQUAL( psa_export_key( handle, NULL, 0, &exported_length ),
1022 PSA_ERROR_NOT_PERMITTED );
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02001023 ok = 1;
1024 goto exit;
Gilles Peskined14664a2018-08-10 19:07:32 +02001025 }
1026
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001027 exported_size = PSA_KEY_EXPORT_MAX_SIZE( psa_get_key_type( &attributes ),
1028 psa_get_key_bits( &attributes ) );
Gilles Peskine8cebbba2018-09-27 13:54:18 +02001029 ASSERT_ALLOC( exported, exported_size );
Gilles Peskined14664a2018-08-10 19:07:32 +02001030
Gilles Peskine8817f612018-12-18 00:18:46 +01001031 PSA_ASSERT( psa_export_key( handle,
1032 exported, exported_size,
1033 &exported_length ) );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001034 ok = exported_key_sanity_check( psa_get_key_type( &attributes ),
1035 psa_get_key_bits( &attributes ),
1036 exported, exported_length );
Gilles Peskined14664a2018-08-10 19:07:32 +02001037
1038exit:
1039 mbedtls_free( exported );
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02001040 psa_reset_key_attributes( &attributes );
Gilles Peskined14664a2018-08-10 19:07:32 +02001041 return( ok );
1042}
1043
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001044static int exercise_export_public_key( psa_key_handle_t handle )
Gilles Peskined14664a2018-08-10 19:07:32 +02001045{
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001046 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskined14664a2018-08-10 19:07:32 +02001047 psa_key_type_t public_type;
Gilles Peskined14664a2018-08-10 19:07:32 +02001048 uint8_t *exported = NULL;
1049 size_t exported_size = 0;
1050 size_t exported_length = 0;
1051 int ok = 0;
1052
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001053 PSA_ASSERT( psa_get_key_attributes( handle, &attributes ) );
1054 if( ! PSA_KEY_TYPE_IS_ASYMMETRIC( psa_get_key_type( &attributes ) ) )
Gilles Peskined14664a2018-08-10 19:07:32 +02001055 {
Gilles Peskinef812dcf2018-12-18 00:33:25 +01001056 TEST_EQUAL( psa_export_public_key( handle, NULL, 0, &exported_length ),
Gilles Peskinefe11b722018-12-18 00:24:04 +01001057 PSA_ERROR_INVALID_ARGUMENT );
Gilles Peskined14664a2018-08-10 19:07:32 +02001058 return( 1 );
1059 }
1060
Gilles Peskinec93b80c2019-05-16 19:39:54 +02001061 public_type = PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001062 psa_get_key_type( &attributes ) );
1063 exported_size = PSA_KEY_EXPORT_MAX_SIZE( public_type,
1064 psa_get_key_bits( &attributes ) );
Gilles Peskine8cebbba2018-09-27 13:54:18 +02001065 ASSERT_ALLOC( exported, exported_size );
Gilles Peskined14664a2018-08-10 19:07:32 +02001066
Gilles Peskine8817f612018-12-18 00:18:46 +01001067 PSA_ASSERT( psa_export_public_key( handle,
1068 exported, exported_size,
1069 &exported_length ) );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001070 ok = exported_key_sanity_check( public_type,
1071 psa_get_key_bits( &attributes ),
Gilles Peskined14664a2018-08-10 19:07:32 +02001072 exported, exported_length );
1073
1074exit:
1075 mbedtls_free( exported );
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02001076 psa_reset_key_attributes( &attributes );
Gilles Peskined14664a2018-08-10 19:07:32 +02001077 return( ok );
1078}
1079
Gilles Peskinec9516fb2019-02-05 20:32:06 +01001080/** Do smoke tests on a key.
1081 *
1082 * Perform one of each operation indicated by \p alg (decrypt/encrypt,
1083 * sign/verify, or derivation) that is permitted according to \p usage.
1084 * \p usage and \p alg should correspond to the expected policy on the
1085 * key.
1086 *
1087 * Export the key if permitted by \p usage, and check that the output
1088 * looks sensible. If \p usage forbids export, check that
1089 * \p psa_export_key correctly rejects the attempt. If the key is
1090 * asymmetric, also check \p psa_export_public_key.
1091 *
1092 * If the key fails the tests, this function calls the test framework's
1093 * `test_fail` function and returns false. Otherwise this function returns
1094 * true. Therefore it should be used as follows:
1095 * ```
1096 * if( ! exercise_key( ... ) ) goto exit;
1097 * ```
1098 *
1099 * \param handle The key to exercise. It should be capable of performing
1100 * \p alg.
1101 * \param usage The usage flags to assume.
1102 * \param alg The algorithm to exercise.
1103 *
1104 * \retval 0 The key failed the smoke tests.
1105 * \retval 1 The key passed the smoke tests.
1106 */
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001107static int exercise_key( psa_key_handle_t handle,
Gilles Peskine02b75072018-07-01 22:31:34 +02001108 psa_key_usage_t usage,
1109 psa_algorithm_t alg )
1110{
1111 int ok;
Gilles Peskine667c1112019-12-03 19:03:20 +01001112
1113 if( ! check_key_attributes_sanity( handle ) )
1114 return( 0 );
1115
Gilles Peskine02b75072018-07-01 22:31:34 +02001116 if( alg == 0 )
1117 ok = 1; /* If no algorihm, do nothing (used for raw data "keys"). */
1118 else if( PSA_ALG_IS_MAC( alg ) )
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001119 ok = exercise_mac_key( handle, usage, alg );
Gilles Peskine02b75072018-07-01 22:31:34 +02001120 else if( PSA_ALG_IS_CIPHER( alg ) )
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001121 ok = exercise_cipher_key( handle, usage, alg );
Gilles Peskine02b75072018-07-01 22:31:34 +02001122 else if( PSA_ALG_IS_AEAD( alg ) )
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001123 ok = exercise_aead_key( handle, usage, alg );
Gilles Peskine02b75072018-07-01 22:31:34 +02001124 else if( PSA_ALG_IS_SIGN( alg ) )
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001125 ok = exercise_signature_key( handle, usage, alg );
Gilles Peskine02b75072018-07-01 22:31:34 +02001126 else if( PSA_ALG_IS_ASYMMETRIC_ENCRYPTION( alg ) )
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001127 ok = exercise_asymmetric_encryption_key( handle, usage, alg );
Gilles Peskineea0fb492018-07-12 17:17:20 +02001128 else if( PSA_ALG_IS_KEY_DERIVATION( alg ) )
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001129 ok = exercise_key_derivation_key( handle, usage, alg );
Gilles Peskine2e46e9c2019-04-11 21:24:55 +02001130 else if( PSA_ALG_IS_RAW_KEY_AGREEMENT( alg ) )
1131 ok = exercise_raw_key_agreement_key( handle, usage, alg );
Gilles Peskine01d718c2018-09-18 12:01:02 +02001132 else if( PSA_ALG_IS_KEY_AGREEMENT( alg ) )
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001133 ok = exercise_key_agreement_key( handle, usage, alg );
Gilles Peskine02b75072018-07-01 22:31:34 +02001134 else
1135 {
1136 char message[40];
1137 mbedtls_snprintf( message, sizeof( message ),
1138 "No code to exercise alg=0x%08lx",
1139 (unsigned long) alg );
1140 test_fail( message, __LINE__, __FILE__ );
1141 ok = 0;
1142 }
Gilles Peskined14664a2018-08-10 19:07:32 +02001143
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001144 ok = ok && exercise_export_key( handle, usage );
1145 ok = ok && exercise_export_public_key( handle );
Gilles Peskined14664a2018-08-10 19:07:32 +02001146
Gilles Peskine02b75072018-07-01 22:31:34 +02001147 return( ok );
1148}
1149
Gilles Peskine10df3412018-10-25 22:35:43 +02001150static psa_key_usage_t usage_to_exercise( psa_key_type_t type,
1151 psa_algorithm_t alg )
1152{
1153 if( PSA_ALG_IS_MAC( alg ) || PSA_ALG_IS_SIGN( alg ) )
1154 {
1155 return( PSA_KEY_TYPE_IS_PUBLIC_KEY( type ) ?
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01001156 PSA_KEY_USAGE_VERIFY_HASH :
1157 PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_VERIFY_HASH );
Gilles Peskine10df3412018-10-25 22:35:43 +02001158 }
1159 else if( PSA_ALG_IS_CIPHER( alg ) || PSA_ALG_IS_AEAD( alg ) ||
1160 PSA_ALG_IS_ASYMMETRIC_ENCRYPTION( alg ) )
1161 {
1162 return( PSA_KEY_TYPE_IS_PUBLIC_KEY( type ) ?
1163 PSA_KEY_USAGE_ENCRYPT :
1164 PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT );
1165 }
1166 else if( PSA_ALG_IS_KEY_DERIVATION( alg ) ||
1167 PSA_ALG_IS_KEY_AGREEMENT( alg ) )
1168 {
1169 return( PSA_KEY_USAGE_DERIVE );
1170 }
1171 else
1172 {
1173 return( 0 );
1174 }
1175
1176}
Darryl Green0c6575a2018-11-07 16:05:30 +00001177
Gilles Peskine4cf3a432019-04-18 22:28:52 +02001178static int test_operations_on_invalid_handle( psa_key_handle_t handle )
1179{
1180 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Ronald Cronecfb2372020-07-23 17:13:42 +02001181 mbedtls_svc_key_id_t key_id = mbedtls_svc_key_id_make( 1, 0x6964 );
Gilles Peskine4cf3a432019-04-18 22:28:52 +02001182 uint8_t buffer[1];
1183 size_t length;
1184 int ok = 0;
1185
Ronald Cronecfb2372020-07-23 17:13:42 +02001186 psa_set_key_id( &attributes, key_id );
Gilles Peskine4cf3a432019-04-18 22:28:52 +02001187 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_ENCRYPT );
1188 psa_set_key_algorithm( &attributes, PSA_ALG_CTR );
1189 psa_set_key_type( &attributes, PSA_KEY_TYPE_AES );
1190 TEST_EQUAL( psa_get_key_attributes( handle, &attributes ),
1191 PSA_ERROR_INVALID_HANDLE );
Ronald Cronecfb2372020-07-23 17:13:42 +02001192 TEST_EQUAL(
1193 MBEDTLS_SVC_KEY_ID_GET_KEY_ID( psa_get_key_id( &attributes ) ), 0 );
1194 TEST_EQUAL(
1195 MBEDTLS_SVC_KEY_ID_GET_OWNER_ID( psa_get_key_id( &attributes ) ), 0 );
Gilles Peskine5c648ab2019-04-19 14:06:53 +02001196 TEST_EQUAL( psa_get_key_lifetime( &attributes ), 0 );
Gilles Peskine4cf3a432019-04-18 22:28:52 +02001197 TEST_EQUAL( psa_get_key_usage_flags( &attributes ), 0 );
1198 TEST_EQUAL( psa_get_key_algorithm( &attributes ), 0 );
1199 TEST_EQUAL( psa_get_key_type( &attributes ), 0 );
1200 TEST_EQUAL( psa_get_key_bits( &attributes ), 0 );
1201
1202 TEST_EQUAL( psa_export_key( handle,
1203 buffer, sizeof( buffer ), &length ),
1204 PSA_ERROR_INVALID_HANDLE );
1205 TEST_EQUAL( psa_export_public_key( handle,
1206 buffer, sizeof( buffer ), &length ),
1207 PSA_ERROR_INVALID_HANDLE );
1208
Gilles Peskine4cf3a432019-04-18 22:28:52 +02001209 ok = 1;
1210
1211exit:
1212 psa_reset_key_attributes( &attributes );
1213 return( ok );
1214}
1215
Gilles Peskine5fe5e272019-08-02 20:30:01 +02001216/* Assert that a key isn't reported as having a slot number. */
1217#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1218#define ASSERT_NO_SLOT_NUMBER( attributes ) \
1219 do \
1220 { \
1221 psa_key_slot_number_t ASSERT_NO_SLOT_NUMBER_slot_number; \
1222 TEST_EQUAL( psa_get_key_slot_number( \
1223 attributes, \
1224 &ASSERT_NO_SLOT_NUMBER_slot_number ), \
1225 PSA_ERROR_INVALID_ARGUMENT ); \
1226 } \
1227 while( 0 )
1228#else /* MBEDTLS_PSA_CRYPTO_SE_C */
1229#define ASSERT_NO_SLOT_NUMBER( attributes ) \
1230 ( (void) 0 )
1231#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1232
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001233/* An overapproximation of the amount of storage needed for a key of the
1234 * given type and with the given content. The API doesn't make it easy
1235 * to find a good value for the size. The current implementation doesn't
1236 * care about the value anyway. */
1237#define KEY_BITS_FROM_DATA( type, data ) \
1238 ( data )->len
1239
Darryl Green0c6575a2018-11-07 16:05:30 +00001240typedef enum {
1241 IMPORT_KEY = 0,
1242 GENERATE_KEY = 1,
1243 DERIVE_KEY = 2
1244} generate_method;
1245
Gilles Peskinee59236f2018-01-27 23:32:46 +01001246/* END_HEADER */
1247
1248/* BEGIN_DEPENDENCIES
1249 * depends_on:MBEDTLS_PSA_CRYPTO_C
1250 * END_DEPENDENCIES
1251 */
1252
1253/* BEGIN_CASE */
Gilles Peskinee1f2d7d2018-08-21 14:54:54 +02001254void static_checks( )
1255{
1256 size_t max_truncated_mac_size =
1257 PSA_ALG_MAC_TRUNCATION_MASK >> PSA_MAC_TRUNCATION_OFFSET;
1258
1259 /* Check that the length for a truncated MAC always fits in the algorithm
1260 * encoding. The shifted mask is the maximum truncated value. The
1261 * untruncated algorithm may be one byte larger. */
1262 TEST_ASSERT( PSA_MAC_MAX_SIZE <= 1 + max_truncated_mac_size );
Gilles Peskine841b14b2019-11-26 17:37:37 +01001263
1264#if defined(MBEDTLS_TEST_DEPRECATED)
1265 /* Check deprecated constants. */
1266 TEST_EQUAL( PSA_ERROR_UNKNOWN_ERROR, PSA_ERROR_GENERIC_ERROR );
1267 TEST_EQUAL( PSA_ERROR_OCCUPIED_SLOT, PSA_ERROR_ALREADY_EXISTS );
1268 TEST_EQUAL( PSA_ERROR_EMPTY_SLOT, PSA_ERROR_DOES_NOT_EXIST );
1269 TEST_EQUAL( PSA_ERROR_INSUFFICIENT_CAPACITY, PSA_ERROR_INSUFFICIENT_DATA );
1270 TEST_EQUAL( PSA_ERROR_TAMPERING_DETECTED, PSA_ERROR_CORRUPTION_DETECTED );
1271 TEST_EQUAL( PSA_KEY_USAGE_SIGN, PSA_KEY_USAGE_SIGN_HASH );
1272 TEST_EQUAL( PSA_KEY_USAGE_VERIFY, PSA_KEY_USAGE_VERIFY_HASH );
1273 TEST_EQUAL( PSA_ASYMMETRIC_SIGNATURE_MAX_SIZE, PSA_SIGNATURE_MAX_SIZE );
Gilles Peskineb87b7192019-12-04 16:24:10 +01001274
Paul Elliott8ff510a2020-06-02 17:19:28 +01001275 TEST_EQUAL( PSA_ECC_CURVE_SECP160K1, PSA_ECC_FAMILY_SECP_K1 );
1276 TEST_EQUAL( PSA_ECC_CURVE_SECP192K1, PSA_ECC_FAMILY_SECP_K1 );
1277 TEST_EQUAL( PSA_ECC_CURVE_SECP224K1, PSA_ECC_FAMILY_SECP_K1 );
1278 TEST_EQUAL( PSA_ECC_CURVE_SECP256K1, PSA_ECC_FAMILY_SECP_K1 );
1279 TEST_EQUAL( PSA_ECC_CURVE_SECP160R1, PSA_ECC_FAMILY_SECP_R1 );
1280 TEST_EQUAL( PSA_ECC_CURVE_SECP192R1, PSA_ECC_FAMILY_SECP_R1 );
1281 TEST_EQUAL( PSA_ECC_CURVE_SECP224R1, PSA_ECC_FAMILY_SECP_R1 );
1282 TEST_EQUAL( PSA_ECC_CURVE_SECP256R1, PSA_ECC_FAMILY_SECP_R1 );
1283 TEST_EQUAL( PSA_ECC_CURVE_SECP384R1, PSA_ECC_FAMILY_SECP_R1 );
1284 TEST_EQUAL( PSA_ECC_CURVE_SECP521R1, PSA_ECC_FAMILY_SECP_R1 );
1285 TEST_EQUAL( PSA_ECC_CURVE_SECP160R2, PSA_ECC_FAMILY_SECP_R2 );
1286 TEST_EQUAL( PSA_ECC_CURVE_SECT163K1, PSA_ECC_FAMILY_SECT_K1 );
1287 TEST_EQUAL( PSA_ECC_CURVE_SECT233K1, PSA_ECC_FAMILY_SECT_K1 );
1288 TEST_EQUAL( PSA_ECC_CURVE_SECT239K1, PSA_ECC_FAMILY_SECT_K1 );
1289 TEST_EQUAL( PSA_ECC_CURVE_SECT283K1, PSA_ECC_FAMILY_SECT_K1 );
1290 TEST_EQUAL( PSA_ECC_CURVE_SECT409K1, PSA_ECC_FAMILY_SECT_K1 );
1291 TEST_EQUAL( PSA_ECC_CURVE_SECT571K1, PSA_ECC_FAMILY_SECT_K1 );
1292 TEST_EQUAL( PSA_ECC_CURVE_SECT163R1, PSA_ECC_FAMILY_SECT_R1 );
1293 TEST_EQUAL( PSA_ECC_CURVE_SECT193R1, PSA_ECC_FAMILY_SECT_R1 );
1294 TEST_EQUAL( PSA_ECC_CURVE_SECT233R1, PSA_ECC_FAMILY_SECT_R1 );
1295 TEST_EQUAL( PSA_ECC_CURVE_SECT283R1, PSA_ECC_FAMILY_SECT_R1 );
1296 TEST_EQUAL( PSA_ECC_CURVE_SECT409R1, PSA_ECC_FAMILY_SECT_R1 );
1297 TEST_EQUAL( PSA_ECC_CURVE_SECT571R1, PSA_ECC_FAMILY_SECT_R1 );
1298 TEST_EQUAL( PSA_ECC_CURVE_SECT163R2, PSA_ECC_FAMILY_SECT_R2 );
1299 TEST_EQUAL( PSA_ECC_CURVE_SECT193R2, PSA_ECC_FAMILY_SECT_R2 );
1300 TEST_EQUAL( PSA_ECC_CURVE_BRAINPOOL_P256R1, PSA_ECC_FAMILY_BRAINPOOL_P_R1 );
1301 TEST_EQUAL( PSA_ECC_CURVE_BRAINPOOL_P384R1, PSA_ECC_FAMILY_BRAINPOOL_P_R1 );
1302 TEST_EQUAL( PSA_ECC_CURVE_BRAINPOOL_P512R1, PSA_ECC_FAMILY_BRAINPOOL_P_R1 );
1303 TEST_EQUAL( PSA_ECC_CURVE_CURVE25519, PSA_ECC_FAMILY_MONTGOMERY );
1304 TEST_EQUAL( PSA_ECC_CURVE_CURVE448, PSA_ECC_FAMILY_MONTGOMERY );
1305
1306 TEST_EQUAL( PSA_ECC_CURVE_SECP_K1, PSA_ECC_FAMILY_SECP_K1 );
1307 TEST_EQUAL( PSA_ECC_CURVE_SECP_R1, PSA_ECC_FAMILY_SECP_R1 );
1308 TEST_EQUAL( PSA_ECC_CURVE_SECP_R2, PSA_ECC_FAMILY_SECP_R2 );
1309 TEST_EQUAL( PSA_ECC_CURVE_SECT_K1, PSA_ECC_FAMILY_SECT_K1 );
1310 TEST_EQUAL( PSA_ECC_CURVE_SECT_R1, PSA_ECC_FAMILY_SECT_R1 );
1311 TEST_EQUAL( PSA_ECC_CURVE_SECT_R2, PSA_ECC_FAMILY_SECT_R2 );
1312 TEST_EQUAL( PSA_ECC_CURVE_BRAINPOOL_P_R1, PSA_ECC_FAMILY_BRAINPOOL_P_R1 );
1313 TEST_EQUAL( PSA_ECC_CURVE_MONTGOMERY, PSA_ECC_FAMILY_MONTGOMERY );
Gilles Peskineb87b7192019-12-04 16:24:10 +01001314
Paul Elliott75e27032020-06-03 15:17:39 +01001315 TEST_EQUAL( PSA_DH_GROUP_FFDHE2048, PSA_DH_FAMILY_RFC7919 );
1316 TEST_EQUAL( PSA_DH_GROUP_FFDHE3072, PSA_DH_FAMILY_RFC7919 );
1317 TEST_EQUAL( PSA_DH_GROUP_FFDHE4096, PSA_DH_FAMILY_RFC7919 );
1318 TEST_EQUAL( PSA_DH_GROUP_FFDHE6144, PSA_DH_FAMILY_RFC7919 );
1319 TEST_EQUAL( PSA_DH_GROUP_FFDHE8192, PSA_DH_FAMILY_RFC7919 );
1320
1321 TEST_EQUAL( PSA_DH_GROUP_RFC7919, PSA_DH_FAMILY_RFC7919 );
1322 TEST_EQUAL( PSA_DH_GROUP_CUSTOM, PSA_DH_FAMILY_CUSTOM );
Gilles Peskineb87b7192019-12-04 16:24:10 +01001323#endif
Gilles Peskinee1f2d7d2018-08-21 14:54:54 +02001324}
1325/* END_CASE */
1326
1327/* BEGIN_CASE */
Ronald Cron81e00502020-07-28 15:06:14 +02001328void attributes_set_get( int owner_id_arg, int id_arg, int lifetime_arg,
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001329 int usage_flags_arg, int alg_arg,
Gilles Peskine3a4f1f82019-04-26 13:49:28 +02001330 int type_arg, int bits_arg )
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001331{
Gilles Peskine4747d192019-04-17 15:05:45 +02001332 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Ronald Cron81e00502020-07-28 15:06:14 +02001333 mbedtls_svc_key_id_t id = mbedtls_svc_key_id_make( owner_id_arg, id_arg );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001334 psa_key_lifetime_t lifetime = lifetime_arg;
1335 psa_key_usage_t usage_flags = usage_flags_arg;
1336 psa_algorithm_t alg = alg_arg;
1337 psa_key_type_t type = type_arg;
Gilles Peskine3a4f1f82019-04-26 13:49:28 +02001338 size_t bits = bits_arg;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001339
Ronald Cronecfb2372020-07-23 17:13:42 +02001340 TEST_EQUAL(
1341 MBEDTLS_SVC_KEY_ID_GET_KEY_ID( psa_get_key_id( &attributes ) ), 0 );
1342 TEST_EQUAL(
1343 MBEDTLS_SVC_KEY_ID_GET_OWNER_ID( psa_get_key_id( &attributes ) ), 0 );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001344 TEST_EQUAL( psa_get_key_lifetime( &attributes ), 0 );
1345 TEST_EQUAL( psa_get_key_usage_flags( &attributes ), 0 );
1346 TEST_EQUAL( psa_get_key_algorithm( &attributes ), 0 );
1347 TEST_EQUAL( psa_get_key_type( &attributes ), 0 );
Gilles Peskine3a4f1f82019-04-26 13:49:28 +02001348 TEST_EQUAL( psa_get_key_bits( &attributes ), 0 );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001349
Gilles Peskinec87af662019-05-15 16:12:22 +02001350 psa_set_key_id( &attributes, id );
1351 psa_set_key_lifetime( &attributes, lifetime );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001352 psa_set_key_usage_flags( &attributes, usage_flags );
1353 psa_set_key_algorithm( &attributes, alg );
1354 psa_set_key_type( &attributes, type );
Gilles Peskine3a4f1f82019-04-26 13:49:28 +02001355 psa_set_key_bits( &attributes, bits );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001356
Ronald Cronecfb2372020-07-23 17:13:42 +02001357 TEST_ASSERT( mbedtls_svc_key_id_equal(
1358 psa_get_key_id( &attributes ), id ) );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001359 TEST_EQUAL( psa_get_key_lifetime( &attributes ), lifetime );
1360 TEST_EQUAL( psa_get_key_usage_flags( &attributes ), usage_flags );
1361 TEST_EQUAL( psa_get_key_algorithm( &attributes ), alg );
1362 TEST_EQUAL( psa_get_key_type( &attributes ), type );
Gilles Peskine3a4f1f82019-04-26 13:49:28 +02001363 TEST_EQUAL( psa_get_key_bits( &attributes ), bits );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001364
1365 psa_reset_key_attributes( &attributes );
1366
Ronald Cronecfb2372020-07-23 17:13:42 +02001367 TEST_EQUAL(
1368 MBEDTLS_SVC_KEY_ID_GET_KEY_ID( psa_get_key_id( &attributes ) ), 0 );
1369 TEST_EQUAL(
1370 MBEDTLS_SVC_KEY_ID_GET_OWNER_ID( psa_get_key_id( &attributes ) ), 0 );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001371 TEST_EQUAL( psa_get_key_lifetime( &attributes ), 0 );
1372 TEST_EQUAL( psa_get_key_usage_flags( &attributes ), 0 );
1373 TEST_EQUAL( psa_get_key_algorithm( &attributes ), 0 );
1374 TEST_EQUAL( psa_get_key_type( &attributes ), 0 );
Gilles Peskine3a4f1f82019-04-26 13:49:28 +02001375 TEST_EQUAL( psa_get_key_bits( &attributes ), 0 );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001376}
1377/* END_CASE */
1378
1379/* BEGIN_CASE */
Ronald Cronecfb2372020-07-23 17:13:42 +02001380void persistence_attributes( int id1_arg, int owner_id1_arg, int lifetime_arg,
1381 int id2_arg, int owner_id2_arg,
1382 int expected_id_arg, int expected_owner_id_arg,
1383 int expected_lifetime_arg )
Gilles Peskinedd835cb2019-05-15 16:14:57 +02001384{
1385 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Ronald Cronecfb2372020-07-23 17:13:42 +02001386 mbedtls_svc_key_id_t id1 =
1387 mbedtls_svc_key_id_make( owner_id1_arg, id1_arg );
Gilles Peskinedd835cb2019-05-15 16:14:57 +02001388 psa_key_lifetime_t lifetime = lifetime_arg;
Ronald Cronecfb2372020-07-23 17:13:42 +02001389 mbedtls_svc_key_id_t id2 =
1390 mbedtls_svc_key_id_make( owner_id2_arg, id2_arg );
Ronald Cron71016a92020-08-28 19:01:50 +02001391 mbedtls_svc_key_id_t expected_id =
Ronald Cronecfb2372020-07-23 17:13:42 +02001392 mbedtls_svc_key_id_make( expected_owner_id_arg, expected_id_arg );
Gilles Peskinedd835cb2019-05-15 16:14:57 +02001393 psa_key_lifetime_t expected_lifetime = expected_lifetime_arg;
1394
1395 if( id1_arg != -1 )
1396 psa_set_key_id( &attributes, id1 );
1397 if( lifetime_arg != -1 )
1398 psa_set_key_lifetime( &attributes, lifetime );
1399 if( id2_arg != -1 )
1400 psa_set_key_id( &attributes, id2 );
1401
Ronald Cronecfb2372020-07-23 17:13:42 +02001402 TEST_ASSERT( mbedtls_svc_key_id_equal(
1403 psa_get_key_id( &attributes ), expected_id ) );
Gilles Peskinedd835cb2019-05-15 16:14:57 +02001404 TEST_EQUAL( psa_get_key_lifetime( &attributes ), expected_lifetime );
1405}
1406/* END_CASE */
1407
Gilles Peskine5fe5e272019-08-02 20:30:01 +02001408/* BEGIN_CASE depends_on:MBEDTLS_PSA_CRYPTO_SE_C */
1409void slot_number_attribute( )
1410{
1411 psa_key_slot_number_t slot_number = 0xdeadbeef;
1412 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
1413
1414 /* Initially, there is no slot number. */
1415 TEST_EQUAL( psa_get_key_slot_number( &attributes, &slot_number ),
1416 PSA_ERROR_INVALID_ARGUMENT );
1417
1418 /* Test setting a slot number. */
1419 psa_set_key_slot_number( &attributes, 0 );
1420 PSA_ASSERT( psa_get_key_slot_number( &attributes, &slot_number ) );
1421 TEST_EQUAL( slot_number, 0 );
1422
1423 /* Test changing the slot number. */
1424 psa_set_key_slot_number( &attributes, 42 );
1425 PSA_ASSERT( psa_get_key_slot_number( &attributes, &slot_number ) );
1426 TEST_EQUAL( slot_number, 42 );
1427
1428 /* Test clearing the slot number. */
1429 psa_clear_key_slot_number( &attributes );
1430 TEST_EQUAL( psa_get_key_slot_number( &attributes, &slot_number ),
1431 PSA_ERROR_INVALID_ARGUMENT );
1432
1433 /* Clearing again should have no effect. */
1434 psa_clear_key_slot_number( &attributes );
1435 TEST_EQUAL( psa_get_key_slot_number( &attributes, &slot_number ),
1436 PSA_ERROR_INVALID_ARGUMENT );
1437
1438 /* Test that reset clears the slot number. */
1439 psa_set_key_slot_number( &attributes, 42 );
1440 PSA_ASSERT( psa_get_key_slot_number( &attributes, &slot_number ) );
1441 TEST_EQUAL( slot_number, 42 );
1442 psa_reset_key_attributes( &attributes );
1443 TEST_EQUAL( psa_get_key_slot_number( &attributes, &slot_number ),
1444 PSA_ERROR_INVALID_ARGUMENT );
1445}
1446/* END_CASE */
1447
Gilles Peskinedd835cb2019-05-15 16:14:57 +02001448/* BEGIN_CASE */
Gilles Peskine6edfa292019-07-31 15:53:45 +02001449void import_with_policy( int type_arg,
1450 int usage_arg, int alg_arg,
1451 int expected_status_arg )
1452{
1453 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
1454 psa_key_attributes_t got_attributes = PSA_KEY_ATTRIBUTES_INIT;
Ronald Cron91e95152020-07-30 17:48:03 +02001455 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskine6edfa292019-07-31 15:53:45 +02001456 psa_key_type_t type = type_arg;
1457 psa_key_usage_t usage = usage_arg;
1458 psa_algorithm_t alg = alg_arg;
1459 psa_status_t expected_status = expected_status_arg;
1460 const uint8_t key_material[16] = {0};
1461 psa_status_t status;
1462
1463 PSA_ASSERT( psa_crypto_init( ) );
1464
1465 psa_set_key_type( &attributes, type );
1466 psa_set_key_usage_flags( &attributes, usage );
1467 psa_set_key_algorithm( &attributes, alg );
1468
1469 status = psa_import_key( &attributes,
1470 key_material, sizeof( key_material ),
1471 &handle );
1472 TEST_EQUAL( status, expected_status );
1473 if( status != PSA_SUCCESS )
1474 goto exit;
1475
1476 PSA_ASSERT( psa_get_key_attributes( handle, &got_attributes ) );
1477 TEST_EQUAL( psa_get_key_type( &got_attributes ), type );
1478 TEST_EQUAL( psa_get_key_usage_flags( &got_attributes ), usage );
1479 TEST_EQUAL( psa_get_key_algorithm( &got_attributes ), alg );
Gilles Peskine5fe5e272019-08-02 20:30:01 +02001480 ASSERT_NO_SLOT_NUMBER( &got_attributes );
Gilles Peskine6edfa292019-07-31 15:53:45 +02001481
1482 PSA_ASSERT( psa_destroy_key( handle ) );
1483 test_operations_on_invalid_handle( handle );
1484
1485exit:
1486 psa_destroy_key( handle );
1487 psa_reset_key_attributes( &got_attributes );
1488 PSA_DONE( );
1489}
1490/* END_CASE */
1491
1492/* BEGIN_CASE */
1493void import_with_data( data_t *data, int type_arg,
1494 int attr_bits_arg,
1495 int expected_status_arg )
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001496{
1497 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
1498 psa_key_attributes_t got_attributes = PSA_KEY_ATTRIBUTES_INIT;
Ronald Cron91e95152020-07-30 17:48:03 +02001499 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001500 psa_key_type_t type = type_arg;
Gilles Peskine8fb3a9e2019-05-03 16:59:21 +02001501 size_t attr_bits = attr_bits_arg;
Gilles Peskineb866e2b2018-06-21 09:25:10 +02001502 psa_status_t expected_status = expected_status_arg;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001503 psa_status_t status;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001504
Gilles Peskine8817f612018-12-18 00:18:46 +01001505 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001506
Gilles Peskine4747d192019-04-17 15:05:45 +02001507 psa_set_key_type( &attributes, type );
Gilles Peskine8fb3a9e2019-05-03 16:59:21 +02001508 psa_set_key_bits( &attributes, attr_bits );
Gilles Peskine6edfa292019-07-31 15:53:45 +02001509
Gilles Peskine73676cb2019-05-15 20:15:10 +02001510 status = psa_import_key( &attributes, data->x, data->len, &handle );
Gilles Peskinefe11b722018-12-18 00:24:04 +01001511 TEST_EQUAL( status, expected_status );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001512 if( status != PSA_SUCCESS )
1513 goto exit;
1514
1515 PSA_ASSERT( psa_get_key_attributes( handle, &got_attributes ) );
1516 TEST_EQUAL( psa_get_key_type( &got_attributes ), type );
Gilles Peskine8fb3a9e2019-05-03 16:59:21 +02001517 if( attr_bits != 0 )
Gilles Peskine7e0cff92019-07-30 13:48:52 +02001518 TEST_EQUAL( attr_bits, psa_get_key_bits( &got_attributes ) );
Gilles Peskine5fe5e272019-08-02 20:30:01 +02001519 ASSERT_NO_SLOT_NUMBER( &got_attributes );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001520
1521 PSA_ASSERT( psa_destroy_key( handle ) );
Gilles Peskine4cf3a432019-04-18 22:28:52 +02001522 test_operations_on_invalid_handle( handle );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001523
1524exit:
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001525 psa_destroy_key( handle );
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02001526 psa_reset_key_attributes( &got_attributes );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02001527 PSA_DONE( );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001528}
1529/* END_CASE */
1530
1531/* BEGIN_CASE */
Gilles Peskinec744d992019-07-30 17:26:54 +02001532void import_large_key( int type_arg, int byte_size_arg,
1533 int expected_status_arg )
1534{
1535 psa_key_type_t type = type_arg;
1536 size_t byte_size = byte_size_arg;
1537 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
1538 psa_status_t expected_status = expected_status_arg;
Ronald Cron91e95152020-07-30 17:48:03 +02001539 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskinec744d992019-07-30 17:26:54 +02001540 psa_status_t status;
1541 uint8_t *buffer = NULL;
1542 size_t buffer_size = byte_size + 1;
1543 size_t n;
1544
1545 /* It would be better to skip the test than fail it if the allocation
1546 * fails, but the test framework doesn't support this yet. */
1547 ASSERT_ALLOC( buffer, buffer_size );
1548 memset( buffer, 'K', byte_size );
1549
1550 PSA_ASSERT( psa_crypto_init( ) );
1551
1552 /* Try importing the key */
1553 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_EXPORT );
1554 psa_set_key_type( &attributes, type );
1555 status = psa_import_key( &attributes, buffer, byte_size, &handle );
1556 TEST_EQUAL( status, expected_status );
1557
1558 if( status == PSA_SUCCESS )
1559 {
1560 PSA_ASSERT( psa_get_key_attributes( handle, &attributes ) );
1561 TEST_EQUAL( psa_get_key_type( &attributes ), type );
1562 TEST_EQUAL( psa_get_key_bits( &attributes ),
1563 PSA_BYTES_TO_BITS( byte_size ) );
Gilles Peskine5fe5e272019-08-02 20:30:01 +02001564 ASSERT_NO_SLOT_NUMBER( &attributes );
Gilles Peskinec744d992019-07-30 17:26:54 +02001565 memset( buffer, 0, byte_size + 1 );
1566 PSA_ASSERT( psa_export_key( handle, buffer, byte_size, &n ) );
1567 for( n = 0; n < byte_size; n++ )
1568 TEST_EQUAL( buffer[n], 'K' );
1569 for( n = byte_size; n < buffer_size; n++ )
1570 TEST_EQUAL( buffer[n], 0 );
1571 }
1572
1573exit:
1574 psa_destroy_key( handle );
1575 PSA_DONE( );
1576 mbedtls_free( buffer );
1577}
1578/* END_CASE */
1579
1580/* BEGIN_CASE */
Gilles Peskine0b352bc2018-06-28 00:16:11 +02001581void import_rsa_made_up( int bits_arg, int keypair, int expected_status_arg )
1582{
Ronald Cron91e95152020-07-30 17:48:03 +02001583 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskine0b352bc2018-06-28 00:16:11 +02001584 size_t bits = bits_arg;
1585 psa_status_t expected_status = expected_status_arg;
1586 psa_status_t status;
1587 psa_key_type_t type =
Gilles Peskinec93b80c2019-05-16 19:39:54 +02001588 keypair ? PSA_KEY_TYPE_RSA_KEY_PAIR : PSA_KEY_TYPE_RSA_PUBLIC_KEY;
Gilles Peskine0b352bc2018-06-28 00:16:11 +02001589 size_t buffer_size = /* Slight overapproximations */
1590 keypair ? bits * 9 / 16 + 80 : bits / 8 + 20;
Gilles Peskine8cebbba2018-09-27 13:54:18 +02001591 unsigned char *buffer = NULL;
Gilles Peskine0b352bc2018-06-28 00:16:11 +02001592 unsigned char *p;
1593 int ret;
1594 size_t length;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02001595 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine0b352bc2018-06-28 00:16:11 +02001596
Gilles Peskine8817f612018-12-18 00:18:46 +01001597 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine8cebbba2018-09-27 13:54:18 +02001598 ASSERT_ALLOC( buffer, buffer_size );
Gilles Peskine0b352bc2018-06-28 00:16:11 +02001599
1600 TEST_ASSERT( ( ret = construct_fake_rsa_key( buffer, buffer_size, &p,
1601 bits, keypair ) ) >= 0 );
1602 length = ret;
1603
1604 /* Try importing the key */
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02001605 psa_set_key_type( &attributes, type );
Gilles Peskine73676cb2019-05-15 20:15:10 +02001606 status = psa_import_key( &attributes, p, length, &handle );
Gilles Peskinefe11b722018-12-18 00:24:04 +01001607 TEST_EQUAL( status, expected_status );
Gilles Peskine76b29a72019-05-28 14:08:50 +02001608
Gilles Peskine0b352bc2018-06-28 00:16:11 +02001609 if( status == PSA_SUCCESS )
Gilles Peskine8817f612018-12-18 00:18:46 +01001610 PSA_ASSERT( psa_destroy_key( handle ) );
Gilles Peskine0b352bc2018-06-28 00:16:11 +02001611
1612exit:
1613 mbedtls_free( buffer );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02001614 PSA_DONE( );
Gilles Peskine0b352bc2018-06-28 00:16:11 +02001615}
1616/* END_CASE */
1617
1618/* BEGIN_CASE */
itayzafrir3e02b3b2018-06-12 17:06:52 +03001619void import_export( data_t *data,
Moran Pekera964a8f2018-06-04 18:42:36 +03001620 int type_arg,
Gilles Peskine1ecf92c22019-05-24 15:00:06 +02001621 int usage_arg, int alg_arg,
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001622 int expected_bits,
1623 int export_size_delta,
Gilles Peskineb866e2b2018-06-21 09:25:10 +02001624 int expected_export_status_arg,
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001625 int canonical_input )
1626{
Ronald Cron91e95152020-07-30 17:48:03 +02001627 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001628 psa_key_type_t type = type_arg;
Gilles Peskine4abf7412018-06-18 16:35:34 +02001629 psa_algorithm_t alg = alg_arg;
Gilles Peskineb866e2b2018-06-21 09:25:10 +02001630 psa_status_t expected_export_status = expected_export_status_arg;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001631 psa_status_t status;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001632 unsigned char *exported = NULL;
1633 unsigned char *reexported = NULL;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001634 size_t export_size;
Jaeden Amerof24c7f82018-06-27 17:20:43 +01001635 size_t exported_length = INVALID_EXPORT_LENGTH;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001636 size_t reexported_length;
Gilles Peskine4747d192019-04-17 15:05:45 +02001637 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001638 psa_key_attributes_t got_attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001639
Moran Pekercb088e72018-07-17 17:36:59 +03001640 export_size = (ptrdiff_t) data->len + export_size_delta;
Gilles Peskine8cebbba2018-09-27 13:54:18 +02001641 ASSERT_ALLOC( exported, export_size );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001642 if( ! canonical_input )
Gilles Peskine8cebbba2018-09-27 13:54:18 +02001643 ASSERT_ALLOC( reexported, export_size );
Gilles Peskine8817f612018-12-18 00:18:46 +01001644 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001645
Gilles Peskine4747d192019-04-17 15:05:45 +02001646 psa_set_key_usage_flags( &attributes, usage_arg );
1647 psa_set_key_algorithm( &attributes, alg );
1648 psa_set_key_type( &attributes, type );
mohammad1603a97cb8c2018-03-28 03:46:26 -07001649
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001650 /* Import the key */
Gilles Peskine73676cb2019-05-15 20:15:10 +02001651 PSA_ASSERT( psa_import_key( &attributes, data->x, data->len, &handle ) );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001652
1653 /* Test the key information */
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001654 PSA_ASSERT( psa_get_key_attributes( handle, &got_attributes ) );
1655 TEST_EQUAL( psa_get_key_type( &got_attributes ), type );
1656 TEST_EQUAL( psa_get_key_bits( &got_attributes ), (size_t) expected_bits );
Gilles Peskine5fe5e272019-08-02 20:30:01 +02001657 ASSERT_NO_SLOT_NUMBER( &got_attributes );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001658
1659 /* Export the key */
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001660 status = psa_export_key( handle,
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001661 exported, export_size,
1662 &exported_length );
Gilles Peskinefe11b722018-12-18 00:24:04 +01001663 TEST_EQUAL( status, expected_export_status );
Jaeden Amerof24c7f82018-06-27 17:20:43 +01001664
1665 /* The exported length must be set by psa_export_key() to a value between 0
1666 * and export_size. On errors, the exported length must be 0. */
1667 TEST_ASSERT( exported_length != INVALID_EXPORT_LENGTH );
1668 TEST_ASSERT( status == PSA_SUCCESS || exported_length == 0 );
1669 TEST_ASSERT( exported_length <= export_size );
1670
Gilles Peskinea7aa4422018-08-14 15:17:54 +02001671 TEST_ASSERT( mem_is_char( exported + exported_length, 0,
Gilles Peskine3f669c32018-06-21 09:21:51 +02001672 export_size - exported_length ) );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001673 if( status != PSA_SUCCESS )
Gilles Peskinee66ca3b2018-06-20 00:11:45 +02001674 {
Gilles Peskinefe11b722018-12-18 00:24:04 +01001675 TEST_EQUAL( exported_length, 0 );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001676 goto destroy;
Gilles Peskinee66ca3b2018-06-20 00:11:45 +02001677 }
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001678
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001679 if( ! exercise_export_key( handle, usage_arg ) )
Gilles Peskine8f609232018-08-11 01:24:55 +02001680 goto exit;
1681
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001682 if( canonical_input )
Gilles Peskinebd7dea92018-09-27 13:57:19 +02001683 ASSERT_COMPARE( data->x, data->len, exported, exported_length );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001684 else
1685 {
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001686 psa_key_handle_t handle2;
Gilles Peskine049c7532019-05-15 20:22:09 +02001687 PSA_ASSERT( psa_import_key( &attributes, exported, exported_length,
1688 &handle2 ) );
Gilles Peskine8817f612018-12-18 00:18:46 +01001689 PSA_ASSERT( psa_export_key( handle2,
1690 reexported,
1691 export_size,
1692 &reexported_length ) );
Gilles Peskinebd7dea92018-09-27 13:57:19 +02001693 ASSERT_COMPARE( exported, exported_length,
1694 reexported, reexported_length );
Gilles Peskine8817f612018-12-18 00:18:46 +01001695 PSA_ASSERT( psa_close_key( handle2 ) );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001696 }
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001697 TEST_ASSERT( exported_length <= PSA_KEY_EXPORT_MAX_SIZE( type, psa_get_key_bits( &got_attributes ) ) );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001698
1699destroy:
1700 /* Destroy the key */
Gilles Peskine8817f612018-12-18 00:18:46 +01001701 PSA_ASSERT( psa_destroy_key( handle ) );
Gilles Peskine4cf3a432019-04-18 22:28:52 +02001702 test_operations_on_invalid_handle( handle );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001703
1704exit:
itayzafrir3e02b3b2018-06-12 17:06:52 +03001705 mbedtls_free( exported );
1706 mbedtls_free( reexported );
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02001707 psa_reset_key_attributes( &got_attributes );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02001708 PSA_DONE( );
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001709}
1710/* END_CASE */
Gilles Peskine20035e32018-02-03 22:44:14 +01001711
Moran Pekerf709f4a2018-06-06 17:26:04 +03001712/* BEGIN_CASE */
itayzafrir3e02b3b2018-06-12 17:06:52 +03001713void import_export_public_key( data_t *data,
Gilles Peskine2d277862018-06-18 15:41:12 +02001714 int type_arg,
1715 int alg_arg,
Gilles Peskine49c25912018-10-29 15:15:31 +01001716 int export_size_delta,
1717 int expected_export_status_arg,
1718 data_t *expected_public_key )
Moran Pekerf709f4a2018-06-06 17:26:04 +03001719{
Ronald Cron91e95152020-07-30 17:48:03 +02001720 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Moran Pekerf709f4a2018-06-06 17:26:04 +03001721 psa_key_type_t type = type_arg;
Gilles Peskine4abf7412018-06-18 16:35:34 +02001722 psa_algorithm_t alg = alg_arg;
Gilles Peskineb866e2b2018-06-21 09:25:10 +02001723 psa_status_t expected_export_status = expected_export_status_arg;
Moran Pekerf709f4a2018-06-06 17:26:04 +03001724 psa_status_t status;
Moran Pekerf709f4a2018-06-06 17:26:04 +03001725 unsigned char *exported = NULL;
Gilles Peskine49c25912018-10-29 15:15:31 +01001726 size_t export_size = expected_public_key->len + export_size_delta;
Jaeden Amero2a671e92018-06-27 17:47:40 +01001727 size_t exported_length = INVALID_EXPORT_LENGTH;
Gilles Peskine4747d192019-04-17 15:05:45 +02001728 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Moran Pekerf709f4a2018-06-06 17:26:04 +03001729
Gilles Peskine8817f612018-12-18 00:18:46 +01001730 PSA_ASSERT( psa_crypto_init( ) );
Moran Pekerf709f4a2018-06-06 17:26:04 +03001731
Gilles Peskine4747d192019-04-17 15:05:45 +02001732 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_EXPORT );
1733 psa_set_key_algorithm( &attributes, alg );
1734 psa_set_key_type( &attributes, type );
Moran Pekerf709f4a2018-06-06 17:26:04 +03001735
1736 /* Import the key */
Gilles Peskine73676cb2019-05-15 20:15:10 +02001737 PSA_ASSERT( psa_import_key( &attributes, data->x, data->len, &handle ) );
Moran Pekerf709f4a2018-06-06 17:26:04 +03001738
Gilles Peskine49c25912018-10-29 15:15:31 +01001739 /* Export the public key */
1740 ASSERT_ALLOC( exported, export_size );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001741 status = psa_export_public_key( handle,
Gilles Peskine2d277862018-06-18 15:41:12 +02001742 exported, export_size,
1743 &exported_length );
Gilles Peskinefe11b722018-12-18 00:24:04 +01001744 TEST_EQUAL( status, expected_export_status );
Gilles Peskine49c25912018-10-29 15:15:31 +01001745 if( status == PSA_SUCCESS )
Gilles Peskined8b7d4f2018-10-29 15:18:41 +01001746 {
Gilles Peskinec93b80c2019-05-16 19:39:54 +02001747 psa_key_type_t public_type = PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR( type );
Gilles Peskined8b7d4f2018-10-29 15:18:41 +01001748 size_t bits;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001749 PSA_ASSERT( psa_get_key_attributes( handle, &attributes ) );
1750 bits = psa_get_key_bits( &attributes );
Gilles Peskined8b7d4f2018-10-29 15:18:41 +01001751 TEST_ASSERT( expected_public_key->len <=
1752 PSA_KEY_EXPORT_MAX_SIZE( public_type, bits ) );
Gilles Peskine49c25912018-10-29 15:15:31 +01001753 ASSERT_COMPARE( expected_public_key->x, expected_public_key->len,
1754 exported, exported_length );
Gilles Peskined8b7d4f2018-10-29 15:18:41 +01001755 }
Moran Pekerf709f4a2018-06-06 17:26:04 +03001756
1757exit:
itayzafrir3e02b3b2018-06-12 17:06:52 +03001758 mbedtls_free( exported );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001759 psa_destroy_key( handle );
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02001760 psa_reset_key_attributes( &attributes );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02001761 PSA_DONE( );
Moran Pekerf709f4a2018-06-06 17:26:04 +03001762}
1763/* END_CASE */
1764
Gilles Peskine20035e32018-02-03 22:44:14 +01001765/* BEGIN_CASE */
Gilles Peskinea680c7a2018-06-26 16:12:43 +02001766void import_and_exercise_key( data_t *data,
1767 int type_arg,
1768 int bits_arg,
1769 int alg_arg )
1770{
Ronald Cron91e95152020-07-30 17:48:03 +02001771 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskinea680c7a2018-06-26 16:12:43 +02001772 psa_key_type_t type = type_arg;
1773 size_t bits = bits_arg;
1774 psa_algorithm_t alg = alg_arg;
Gilles Peskine10df3412018-10-25 22:35:43 +02001775 psa_key_usage_t usage = usage_to_exercise( type, alg );
Gilles Peskine4747d192019-04-17 15:05:45 +02001776 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001777 psa_key_attributes_t got_attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskinea680c7a2018-06-26 16:12:43 +02001778
Gilles Peskine8817f612018-12-18 00:18:46 +01001779 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskinea680c7a2018-06-26 16:12:43 +02001780
Gilles Peskine4747d192019-04-17 15:05:45 +02001781 psa_set_key_usage_flags( &attributes, usage );
1782 psa_set_key_algorithm( &attributes, alg );
1783 psa_set_key_type( &attributes, type );
Gilles Peskinea680c7a2018-06-26 16:12:43 +02001784
1785 /* Import the key */
Gilles Peskine73676cb2019-05-15 20:15:10 +02001786 PSA_ASSERT( psa_import_key( &attributes, data->x, data->len, &handle ) );
Gilles Peskinea680c7a2018-06-26 16:12:43 +02001787
1788 /* Test the key information */
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001789 PSA_ASSERT( psa_get_key_attributes( handle, &got_attributes ) );
1790 TEST_EQUAL( psa_get_key_type( &got_attributes ), type );
1791 TEST_EQUAL( psa_get_key_bits( &got_attributes ), bits );
Gilles Peskinea680c7a2018-06-26 16:12:43 +02001792
1793 /* Do something with the key according to its type and permitted usage. */
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001794 if( ! exercise_key( handle, usage, alg ) )
Gilles Peskine02b75072018-07-01 22:31:34 +02001795 goto exit;
Gilles Peskinea680c7a2018-06-26 16:12:43 +02001796
Gilles Peskine4cf3a432019-04-18 22:28:52 +02001797 PSA_ASSERT( psa_destroy_key( handle ) );
1798 test_operations_on_invalid_handle( handle );
1799
Gilles Peskinea680c7a2018-06-26 16:12:43 +02001800exit:
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001801 psa_destroy_key( handle );
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02001802 psa_reset_key_attributes( &got_attributes );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02001803 PSA_DONE( );
Gilles Peskinea680c7a2018-06-26 16:12:43 +02001804}
1805/* END_CASE */
1806
1807/* BEGIN_CASE */
Gilles Peskine06c28892019-11-26 18:07:46 +01001808void effective_key_attributes( int type_arg, int expected_type_arg,
1809 int bits_arg, int expected_bits_arg,
1810 int usage_arg, int expected_usage_arg,
1811 int alg_arg, int expected_alg_arg )
Gilles Peskined5b33222018-06-18 22:20:03 +02001812{
Ronald Cron91e95152020-07-30 17:48:03 +02001813 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskine1a960492019-11-26 17:12:21 +01001814 psa_key_type_t key_type = type_arg;
Gilles Peskine06c28892019-11-26 18:07:46 +01001815 psa_key_type_t expected_key_type = expected_type_arg;
Gilles Peskine1a960492019-11-26 17:12:21 +01001816 size_t bits = bits_arg;
Gilles Peskine06c28892019-11-26 18:07:46 +01001817 size_t expected_bits = expected_bits_arg;
Gilles Peskined5b33222018-06-18 22:20:03 +02001818 psa_algorithm_t alg = alg_arg;
Gilles Peskine06c28892019-11-26 18:07:46 +01001819 psa_algorithm_t expected_alg = expected_alg_arg;
Gilles Peskined5b33222018-06-18 22:20:03 +02001820 psa_key_usage_t usage = usage_arg;
Gilles Peskine06c28892019-11-26 18:07:46 +01001821 psa_key_usage_t expected_usage = expected_usage_arg;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001822 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskined5b33222018-06-18 22:20:03 +02001823
Gilles Peskine8817f612018-12-18 00:18:46 +01001824 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskined5b33222018-06-18 22:20:03 +02001825
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001826 psa_set_key_usage_flags( &attributes, usage );
1827 psa_set_key_algorithm( &attributes, alg );
1828 psa_set_key_type( &attributes, key_type );
Gilles Peskine1a960492019-11-26 17:12:21 +01001829 psa_set_key_bits( &attributes, bits );
Gilles Peskined5b33222018-06-18 22:20:03 +02001830
Gilles Peskine1a960492019-11-26 17:12:21 +01001831 PSA_ASSERT( psa_generate_key( &attributes, &handle ) );
1832 psa_reset_key_attributes( &attributes );
Gilles Peskined5b33222018-06-18 22:20:03 +02001833
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001834 PSA_ASSERT( psa_get_key_attributes( handle, &attributes ) );
Gilles Peskine06c28892019-11-26 18:07:46 +01001835 TEST_EQUAL( psa_get_key_type( &attributes ), expected_key_type );
1836 TEST_EQUAL( psa_get_key_bits( &attributes ), expected_bits );
1837 TEST_EQUAL( psa_get_key_usage_flags( &attributes ), expected_usage );
1838 TEST_EQUAL( psa_get_key_algorithm( &attributes ), expected_alg );
Gilles Peskined5b33222018-06-18 22:20:03 +02001839
1840exit:
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001841 psa_destroy_key( handle );
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02001842 psa_reset_key_attributes( &attributes );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02001843 PSA_DONE( );
Gilles Peskined5b33222018-06-18 22:20:03 +02001844}
1845/* END_CASE */
1846
1847/* BEGIN_CASE */
Gilles Peskine06c28892019-11-26 18:07:46 +01001848void check_key_policy( int type_arg, int bits_arg,
1849 int usage_arg, int alg_arg )
1850{
1851 test_effective_key_attributes( type_arg, type_arg, bits_arg, bits_arg,
1852 usage_arg, usage_arg, alg_arg, alg_arg );
1853 goto exit;
1854}
1855/* END_CASE */
1856
1857/* BEGIN_CASE */
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02001858void key_attributes_init( )
Jaeden Amero70261c52019-01-04 11:47:20 +00001859{
1860 /* Test each valid way of initializing the object, except for `= {0}`, as
1861 * Clang 5 complains when `-Wmissing-field-initializers` is used, even
1862 * though it's OK by the C standard. We could test for this, but we'd need
1863 * to supress the Clang warning for the test. */
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02001864 psa_key_attributes_t func = psa_key_attributes_init( );
1865 psa_key_attributes_t init = PSA_KEY_ATTRIBUTES_INIT;
1866 psa_key_attributes_t zero;
Jaeden Amero70261c52019-01-04 11:47:20 +00001867
1868 memset( &zero, 0, sizeof( zero ) );
1869
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02001870 TEST_EQUAL( psa_get_key_lifetime( &func ), PSA_KEY_LIFETIME_VOLATILE );
1871 TEST_EQUAL( psa_get_key_lifetime( &init ), PSA_KEY_LIFETIME_VOLATILE );
1872 TEST_EQUAL( psa_get_key_lifetime( &zero ), PSA_KEY_LIFETIME_VOLATILE );
Jaeden Amero5229bbb2019-02-07 16:33:37 +00001873
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02001874 TEST_EQUAL( psa_get_key_type( &func ), 0 );
1875 TEST_EQUAL( psa_get_key_type( &init ), 0 );
1876 TEST_EQUAL( psa_get_key_type( &zero ), 0 );
1877
1878 TEST_EQUAL( psa_get_key_bits( &func ), 0 );
1879 TEST_EQUAL( psa_get_key_bits( &init ), 0 );
1880 TEST_EQUAL( psa_get_key_bits( &zero ), 0 );
1881
1882 TEST_EQUAL( psa_get_key_usage_flags( &func ), 0 );
1883 TEST_EQUAL( psa_get_key_usage_flags( &init ), 0 );
1884 TEST_EQUAL( psa_get_key_usage_flags( &zero ), 0 );
1885
1886 TEST_EQUAL( psa_get_key_algorithm( &func ), 0 );
1887 TEST_EQUAL( psa_get_key_algorithm( &init ), 0 );
1888 TEST_EQUAL( psa_get_key_algorithm( &zero ), 0 );
Jaeden Amero70261c52019-01-04 11:47:20 +00001889}
1890/* END_CASE */
1891
1892/* BEGIN_CASE */
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001893void mac_key_policy( int policy_usage,
1894 int policy_alg,
1895 int key_type,
1896 data_t *key_data,
1897 int exercise_alg )
Gilles Peskined5b33222018-06-18 22:20:03 +02001898{
Ronald Cron91e95152020-07-30 17:48:03 +02001899 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02001900 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Jaeden Amero769ce272019-01-04 11:48:03 +00001901 psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT;
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001902 psa_status_t status;
1903 unsigned char mac[PSA_MAC_MAX_SIZE];
Gilles Peskined5b33222018-06-18 22:20:03 +02001904
Gilles Peskine8817f612018-12-18 00:18:46 +01001905 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskined5b33222018-06-18 22:20:03 +02001906
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02001907 psa_set_key_usage_flags( &attributes, policy_usage );
1908 psa_set_key_algorithm( &attributes, policy_alg );
1909 psa_set_key_type( &attributes, key_type );
Gilles Peskined5b33222018-06-18 22:20:03 +02001910
Gilles Peskine049c7532019-05-15 20:22:09 +02001911 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
1912 &handle ) );
Gilles Peskined5b33222018-06-18 22:20:03 +02001913
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001914 status = psa_mac_sign_setup( &operation, handle, exercise_alg );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001915 if( policy_alg == exercise_alg &&
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01001916 ( policy_usage & PSA_KEY_USAGE_SIGN_HASH ) != 0 )
Gilles Peskine8817f612018-12-18 00:18:46 +01001917 PSA_ASSERT( status );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001918 else
Gilles Peskinefe11b722018-12-18 00:24:04 +01001919 TEST_EQUAL( status, PSA_ERROR_NOT_PERMITTED );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001920 psa_mac_abort( &operation );
Gilles Peskined5b33222018-06-18 22:20:03 +02001921
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001922 memset( mac, 0, sizeof( mac ) );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001923 status = psa_mac_verify_setup( &operation, handle, exercise_alg );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001924 if( policy_alg == exercise_alg &&
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01001925 ( policy_usage & PSA_KEY_USAGE_VERIFY_HASH ) != 0 )
Gilles Peskine8817f612018-12-18 00:18:46 +01001926 PSA_ASSERT( status );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001927 else
Gilles Peskinefe11b722018-12-18 00:24:04 +01001928 TEST_EQUAL( status, PSA_ERROR_NOT_PERMITTED );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001929
1930exit:
1931 psa_mac_abort( &operation );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001932 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02001933 PSA_DONE( );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001934}
1935/* END_CASE */
1936
1937/* BEGIN_CASE */
1938void cipher_key_policy( int policy_usage,
1939 int policy_alg,
1940 int key_type,
1941 data_t *key_data,
1942 int exercise_alg )
1943{
Ronald Cron91e95152020-07-30 17:48:03 +02001944 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02001945 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Jaeden Amero5bae2272019-01-04 11:48:27 +00001946 psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT;
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001947 psa_status_t status;
1948
Gilles Peskine8817f612018-12-18 00:18:46 +01001949 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001950
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02001951 psa_set_key_usage_flags( &attributes, policy_usage );
1952 psa_set_key_algorithm( &attributes, policy_alg );
1953 psa_set_key_type( &attributes, key_type );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001954
Gilles Peskine049c7532019-05-15 20:22:09 +02001955 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
1956 &handle ) );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001957
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001958 status = psa_cipher_encrypt_setup( &operation, handle, exercise_alg );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001959 if( policy_alg == exercise_alg &&
1960 ( policy_usage & PSA_KEY_USAGE_ENCRYPT ) != 0 )
Gilles Peskine8817f612018-12-18 00:18:46 +01001961 PSA_ASSERT( status );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001962 else
Gilles Peskinefe11b722018-12-18 00:24:04 +01001963 TEST_EQUAL( status, PSA_ERROR_NOT_PERMITTED );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001964 psa_cipher_abort( &operation );
1965
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001966 status = psa_cipher_decrypt_setup( &operation, handle, exercise_alg );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001967 if( policy_alg == exercise_alg &&
1968 ( policy_usage & PSA_KEY_USAGE_DECRYPT ) != 0 )
Gilles Peskine8817f612018-12-18 00:18:46 +01001969 PSA_ASSERT( status );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001970 else
Gilles Peskinefe11b722018-12-18 00:24:04 +01001971 TEST_EQUAL( status, PSA_ERROR_NOT_PERMITTED );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001972
1973exit:
1974 psa_cipher_abort( &operation );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01001975 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02001976 PSA_DONE( );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001977}
1978/* END_CASE */
1979
1980/* BEGIN_CASE */
1981void aead_key_policy( int policy_usage,
1982 int policy_alg,
1983 int key_type,
1984 data_t *key_data,
1985 int nonce_length_arg,
1986 int tag_length_arg,
1987 int exercise_alg )
1988{
Ronald Cron91e95152020-07-30 17:48:03 +02001989 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02001990 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02001991 psa_status_t status;
1992 unsigned char nonce[16] = {0};
1993 size_t nonce_length = nonce_length_arg;
1994 unsigned char tag[16];
1995 size_t tag_length = tag_length_arg;
1996 size_t output_length;
1997
1998 TEST_ASSERT( nonce_length <= sizeof( nonce ) );
1999 TEST_ASSERT( tag_length <= sizeof( tag ) );
2000
Gilles Peskine8817f612018-12-18 00:18:46 +01002001 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02002002
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02002003 psa_set_key_usage_flags( &attributes, policy_usage );
2004 psa_set_key_algorithm( &attributes, policy_alg );
2005 psa_set_key_type( &attributes, key_type );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02002006
Gilles Peskine049c7532019-05-15 20:22:09 +02002007 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
2008 &handle ) );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02002009
Gilles Peskinebdf309c2018-12-03 15:36:32 +01002010 status = psa_aead_encrypt( handle, exercise_alg,
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02002011 nonce, nonce_length,
2012 NULL, 0,
2013 NULL, 0,
2014 tag, tag_length,
2015 &output_length );
2016 if( policy_alg == exercise_alg &&
2017 ( policy_usage & PSA_KEY_USAGE_ENCRYPT ) != 0 )
Gilles Peskine8817f612018-12-18 00:18:46 +01002018 PSA_ASSERT( status );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02002019 else
Gilles Peskinefe11b722018-12-18 00:24:04 +01002020 TEST_EQUAL( status, PSA_ERROR_NOT_PERMITTED );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02002021
2022 memset( tag, 0, sizeof( tag ) );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01002023 status = psa_aead_decrypt( handle, exercise_alg,
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02002024 nonce, nonce_length,
2025 NULL, 0,
2026 tag, tag_length,
2027 NULL, 0,
2028 &output_length );
2029 if( policy_alg == exercise_alg &&
2030 ( policy_usage & PSA_KEY_USAGE_DECRYPT ) != 0 )
Gilles Peskinefe11b722018-12-18 00:24:04 +01002031 TEST_EQUAL( status, PSA_ERROR_INVALID_SIGNATURE );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02002032 else
Gilles Peskinefe11b722018-12-18 00:24:04 +01002033 TEST_EQUAL( status, PSA_ERROR_NOT_PERMITTED );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02002034
2035exit:
Gilles Peskinebdf309c2018-12-03 15:36:32 +01002036 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002037 PSA_DONE( );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02002038}
2039/* END_CASE */
2040
2041/* BEGIN_CASE */
2042void asymmetric_encryption_key_policy( int policy_usage,
2043 int policy_alg,
2044 int key_type,
2045 data_t *key_data,
2046 int exercise_alg )
2047{
Ronald Cron91e95152020-07-30 17:48:03 +02002048 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02002049 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02002050 psa_status_t status;
2051 size_t key_bits;
2052 size_t buffer_length;
2053 unsigned char *buffer = NULL;
2054 size_t output_length;
2055
Gilles Peskine8817f612018-12-18 00:18:46 +01002056 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02002057
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02002058 psa_set_key_usage_flags( &attributes, policy_usage );
2059 psa_set_key_algorithm( &attributes, policy_alg );
2060 psa_set_key_type( &attributes, key_type );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02002061
Gilles Peskine049c7532019-05-15 20:22:09 +02002062 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
2063 &handle ) );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02002064
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002065 PSA_ASSERT( psa_get_key_attributes( handle, &attributes ) );
2066 key_bits = psa_get_key_bits( &attributes );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02002067 buffer_length = PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE( key_type, key_bits,
2068 exercise_alg );
Gilles Peskine8cebbba2018-09-27 13:54:18 +02002069 ASSERT_ALLOC( buffer, buffer_length );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02002070
Gilles Peskinebdf309c2018-12-03 15:36:32 +01002071 status = psa_asymmetric_encrypt( handle, exercise_alg,
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02002072 NULL, 0,
2073 NULL, 0,
2074 buffer, buffer_length,
2075 &output_length );
2076 if( policy_alg == exercise_alg &&
2077 ( policy_usage & PSA_KEY_USAGE_ENCRYPT ) != 0 )
Gilles Peskine8817f612018-12-18 00:18:46 +01002078 PSA_ASSERT( status );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02002079 else
Gilles Peskinefe11b722018-12-18 00:24:04 +01002080 TEST_EQUAL( status, PSA_ERROR_NOT_PERMITTED );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02002081
Gilles Peskinef7ab5ad2018-09-26 18:19:24 +02002082 if( buffer_length != 0 )
2083 memset( buffer, 0, buffer_length );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01002084 status = psa_asymmetric_decrypt( handle, exercise_alg,
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02002085 buffer, buffer_length,
2086 NULL, 0,
2087 buffer, buffer_length,
2088 &output_length );
2089 if( policy_alg == exercise_alg &&
2090 ( policy_usage & PSA_KEY_USAGE_DECRYPT ) != 0 )
Gilles Peskinefe11b722018-12-18 00:24:04 +01002091 TEST_EQUAL( status, PSA_ERROR_INVALID_PADDING );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02002092 else
Gilles Peskinefe11b722018-12-18 00:24:04 +01002093 TEST_EQUAL( status, PSA_ERROR_NOT_PERMITTED );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02002094
2095exit:
Gilles Peskinebdf309c2018-12-03 15:36:32 +01002096 psa_destroy_key( handle );
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02002097 psa_reset_key_attributes( &attributes );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002098 PSA_DONE( );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02002099 mbedtls_free( buffer );
2100}
2101/* END_CASE */
2102
2103/* BEGIN_CASE */
2104void asymmetric_signature_key_policy( int policy_usage,
2105 int policy_alg,
2106 int key_type,
2107 data_t *key_data,
Gilles Peskine30f77cd2019-01-14 16:06:39 +01002108 int exercise_alg,
2109 int payload_length_arg )
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02002110{
Ronald Cron91e95152020-07-30 17:48:03 +02002111 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02002112 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02002113 psa_status_t status;
Gilles Peskine30f77cd2019-01-14 16:06:39 +01002114 unsigned char payload[PSA_HASH_MAX_SIZE] = {1};
2115 /* If `payload_length_arg > 0`, `exercise_alg` is supposed to be
2116 * compatible with the policy and `payload_length_arg` is supposed to be
2117 * a valid input length to sign. If `payload_length_arg <= 0`,
2118 * `exercise_alg` is supposed to be forbidden by the policy. */
2119 int compatible_alg = payload_length_arg > 0;
2120 size_t payload_length = compatible_alg ? payload_length_arg : 0;
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01002121 unsigned char signature[PSA_SIGNATURE_MAX_SIZE] = {0};
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02002122 size_t signature_length;
2123
Gilles Peskine8817f612018-12-18 00:18:46 +01002124 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02002125
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02002126 psa_set_key_usage_flags( &attributes, policy_usage );
2127 psa_set_key_algorithm( &attributes, policy_alg );
2128 psa_set_key_type( &attributes, key_type );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02002129
Gilles Peskine049c7532019-05-15 20:22:09 +02002130 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
2131 &handle ) );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02002132
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01002133 status = psa_sign_hash( handle, exercise_alg,
2134 payload, payload_length,
2135 signature, sizeof( signature ),
2136 &signature_length );
2137 if( compatible_alg && ( policy_usage & PSA_KEY_USAGE_SIGN_HASH ) != 0 )
Gilles Peskine8817f612018-12-18 00:18:46 +01002138 PSA_ASSERT( status );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02002139 else
Gilles Peskinefe11b722018-12-18 00:24:04 +01002140 TEST_EQUAL( status, PSA_ERROR_NOT_PERMITTED );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02002141
2142 memset( signature, 0, sizeof( signature ) );
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01002143 status = psa_verify_hash( handle, exercise_alg,
2144 payload, payload_length,
2145 signature, sizeof( signature ) );
2146 if( compatible_alg && ( policy_usage & PSA_KEY_USAGE_VERIFY_HASH ) != 0 )
Gilles Peskinefe11b722018-12-18 00:24:04 +01002147 TEST_EQUAL( status, PSA_ERROR_INVALID_SIGNATURE );
Gilles Peskine76f5c7b2018-07-06 16:53:09 +02002148 else
Gilles Peskinefe11b722018-12-18 00:24:04 +01002149 TEST_EQUAL( status, PSA_ERROR_NOT_PERMITTED );
Gilles Peskined5b33222018-06-18 22:20:03 +02002150
2151exit:
Gilles Peskinebdf309c2018-12-03 15:36:32 +01002152 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002153 PSA_DONE( );
Gilles Peskined5b33222018-06-18 22:20:03 +02002154}
2155/* END_CASE */
2156
Janos Follathba3fab92019-06-11 14:50:16 +01002157/* BEGIN_CASE */
Gilles Peskineea0fb492018-07-12 17:17:20 +02002158void derive_key_policy( int policy_usage,
2159 int policy_alg,
2160 int key_type,
2161 data_t *key_data,
2162 int exercise_alg )
2163{
Ronald Cron91e95152020-07-30 17:48:03 +02002164 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02002165 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02002166 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
Gilles Peskineea0fb492018-07-12 17:17:20 +02002167 psa_status_t status;
2168
Gilles Peskine8817f612018-12-18 00:18:46 +01002169 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskineea0fb492018-07-12 17:17:20 +02002170
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02002171 psa_set_key_usage_flags( &attributes, policy_usage );
2172 psa_set_key_algorithm( &attributes, policy_alg );
2173 psa_set_key_type( &attributes, key_type );
Gilles Peskineea0fb492018-07-12 17:17:20 +02002174
Gilles Peskine049c7532019-05-15 20:22:09 +02002175 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
2176 &handle ) );
Gilles Peskineea0fb492018-07-12 17:17:20 +02002177
Janos Follathba3fab92019-06-11 14:50:16 +01002178 PSA_ASSERT( psa_key_derivation_setup( &operation, exercise_alg ) );
2179
2180 if( PSA_ALG_IS_TLS12_PRF( exercise_alg ) ||
2181 PSA_ALG_IS_TLS12_PSK_TO_MS( exercise_alg ) )
Janos Follath0c1ed842019-06-28 13:35:36 +01002182 {
Janos Follathba3fab92019-06-11 14:50:16 +01002183 PSA_ASSERT( psa_key_derivation_input_bytes(
2184 &operation,
2185 PSA_KEY_DERIVATION_INPUT_SEED,
2186 (const uint8_t*) "", 0) );
Janos Follath0c1ed842019-06-28 13:35:36 +01002187 }
Janos Follathba3fab92019-06-11 14:50:16 +01002188
2189 status = psa_key_derivation_input_key( &operation,
2190 PSA_KEY_DERIVATION_INPUT_SECRET,
2191 handle );
2192
Gilles Peskineea0fb492018-07-12 17:17:20 +02002193 if( policy_alg == exercise_alg &&
2194 ( policy_usage & PSA_KEY_USAGE_DERIVE ) != 0 )
Gilles Peskine8817f612018-12-18 00:18:46 +01002195 PSA_ASSERT( status );
Gilles Peskineea0fb492018-07-12 17:17:20 +02002196 else
Gilles Peskinefe11b722018-12-18 00:24:04 +01002197 TEST_EQUAL( status, PSA_ERROR_NOT_PERMITTED );
Gilles Peskineea0fb492018-07-12 17:17:20 +02002198
2199exit:
Gilles Peskine51ae0e42019-05-16 17:31:03 +02002200 psa_key_derivation_abort( &operation );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01002201 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002202 PSA_DONE( );
Gilles Peskineea0fb492018-07-12 17:17:20 +02002203}
2204/* END_CASE */
2205
2206/* BEGIN_CASE */
Gilles Peskine01d718c2018-09-18 12:01:02 +02002207void agreement_key_policy( int policy_usage,
2208 int policy_alg,
2209 int key_type_arg,
2210 data_t *key_data,
Steven Cooremance48e852020-10-05 16:02:45 +02002211 int exercise_alg,
2212 int expected_status_arg )
Gilles Peskine01d718c2018-09-18 12:01:02 +02002213{
Ronald Cron91e95152020-07-30 17:48:03 +02002214 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02002215 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine01d718c2018-09-18 12:01:02 +02002216 psa_key_type_t key_type = key_type_arg;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02002217 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
Gilles Peskine01d718c2018-09-18 12:01:02 +02002218 psa_status_t status;
Steven Cooremance48e852020-10-05 16:02:45 +02002219 psa_status_t expected_status = expected_status_arg;
Gilles Peskine01d718c2018-09-18 12:01:02 +02002220
Gilles Peskine8817f612018-12-18 00:18:46 +01002221 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine01d718c2018-09-18 12:01:02 +02002222
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02002223 psa_set_key_usage_flags( &attributes, policy_usage );
2224 psa_set_key_algorithm( &attributes, policy_alg );
2225 psa_set_key_type( &attributes, key_type );
Gilles Peskine01d718c2018-09-18 12:01:02 +02002226
Gilles Peskine049c7532019-05-15 20:22:09 +02002227 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
2228 &handle ) );
Gilles Peskine01d718c2018-09-18 12:01:02 +02002229
Gilles Peskine51ae0e42019-05-16 17:31:03 +02002230 PSA_ASSERT( psa_key_derivation_setup( &operation, exercise_alg ) );
2231 status = key_agreement_with_self( &operation, handle );
Gilles Peskine01d718c2018-09-18 12:01:02 +02002232
Steven Cooremance48e852020-10-05 16:02:45 +02002233 TEST_EQUAL( status, expected_status );
Gilles Peskine01d718c2018-09-18 12:01:02 +02002234
2235exit:
Gilles Peskine51ae0e42019-05-16 17:31:03 +02002236 psa_key_derivation_abort( &operation );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01002237 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002238 PSA_DONE( );
Gilles Peskine01d718c2018-09-18 12:01:02 +02002239}
2240/* END_CASE */
2241
2242/* BEGIN_CASE */
Gilles Peskine96f0b3b2019-05-10 19:33:38 +02002243void key_policy_alg2( int key_type_arg, data_t *key_data,
2244 int usage_arg, int alg_arg, int alg2_arg )
2245{
Ronald Cron91e95152020-07-30 17:48:03 +02002246 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskine96f0b3b2019-05-10 19:33:38 +02002247 psa_key_type_t key_type = key_type_arg;
2248 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
2249 psa_key_attributes_t got_attributes = PSA_KEY_ATTRIBUTES_INIT;
2250 psa_key_usage_t usage = usage_arg;
2251 psa_algorithm_t alg = alg_arg;
2252 psa_algorithm_t alg2 = alg2_arg;
2253
2254 PSA_ASSERT( psa_crypto_init( ) );
2255
2256 psa_set_key_usage_flags( &attributes, usage );
2257 psa_set_key_algorithm( &attributes, alg );
2258 psa_set_key_enrollment_algorithm( &attributes, alg2 );
2259 psa_set_key_type( &attributes, key_type );
2260 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
2261 &handle ) );
2262
2263 PSA_ASSERT( psa_get_key_attributes( handle, &got_attributes ) );
2264 TEST_EQUAL( psa_get_key_usage_flags( &got_attributes ), usage );
2265 TEST_EQUAL( psa_get_key_algorithm( &got_attributes ), alg );
2266 TEST_EQUAL( psa_get_key_enrollment_algorithm( &got_attributes ), alg2 );
2267
2268 if( ! exercise_key( handle, usage, alg ) )
2269 goto exit;
2270 if( ! exercise_key( handle, usage, alg2 ) )
2271 goto exit;
2272
2273exit:
2274 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002275 PSA_DONE( );
Gilles Peskine96f0b3b2019-05-10 19:33:38 +02002276}
2277/* END_CASE */
2278
2279/* BEGIN_CASE */
Gilles Peskine04ee2d22019-04-11 21:25:46 +02002280void raw_agreement_key_policy( int policy_usage,
2281 int policy_alg,
2282 int key_type_arg,
2283 data_t *key_data,
Steven Cooremance48e852020-10-05 16:02:45 +02002284 int exercise_alg,
2285 int expected_status_arg )
Gilles Peskine04ee2d22019-04-11 21:25:46 +02002286{
Ronald Cron91e95152020-07-30 17:48:03 +02002287 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02002288 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine04ee2d22019-04-11 21:25:46 +02002289 psa_key_type_t key_type = key_type_arg;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02002290 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
Gilles Peskine04ee2d22019-04-11 21:25:46 +02002291 psa_status_t status;
Steven Cooremance48e852020-10-05 16:02:45 +02002292 psa_status_t expected_status = expected_status_arg;
Gilles Peskine04ee2d22019-04-11 21:25:46 +02002293
2294 PSA_ASSERT( psa_crypto_init( ) );
2295
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02002296 psa_set_key_usage_flags( &attributes, policy_usage );
2297 psa_set_key_algorithm( &attributes, policy_alg );
2298 psa_set_key_type( &attributes, key_type );
Gilles Peskine04ee2d22019-04-11 21:25:46 +02002299
Gilles Peskine049c7532019-05-15 20:22:09 +02002300 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
2301 &handle ) );
Gilles Peskine04ee2d22019-04-11 21:25:46 +02002302
2303 status = raw_key_agreement_with_self( exercise_alg, handle );
2304
Steven Cooremance48e852020-10-05 16:02:45 +02002305 TEST_EQUAL( status, expected_status );
Gilles Peskine04ee2d22019-04-11 21:25:46 +02002306
2307exit:
Gilles Peskine51ae0e42019-05-16 17:31:03 +02002308 psa_key_derivation_abort( &operation );
Gilles Peskine04ee2d22019-04-11 21:25:46 +02002309 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002310 PSA_DONE( );
Gilles Peskine04ee2d22019-04-11 21:25:46 +02002311}
2312/* END_CASE */
2313
2314/* BEGIN_CASE */
Gilles Peskinebcdd44b2019-05-20 17:28:11 +02002315void copy_success( int source_usage_arg,
2316 int source_alg_arg, int source_alg2_arg,
Gilles Peskine4a644642019-05-03 17:14:08 +02002317 int type_arg, data_t *material,
2318 int copy_attributes,
Gilles Peskinebcdd44b2019-05-20 17:28:11 +02002319 int target_usage_arg,
2320 int target_alg_arg, int target_alg2_arg,
2321 int expected_usage_arg,
2322 int expected_alg_arg, int expected_alg2_arg )
Gilles Peskine57ab7212019-01-28 13:03:09 +01002323{
Gilles Peskineca25db92019-04-19 11:43:08 +02002324 psa_key_attributes_t source_attributes = PSA_KEY_ATTRIBUTES_INIT;
2325 psa_key_attributes_t target_attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine57ab7212019-01-28 13:03:09 +01002326 psa_key_usage_t expected_usage = expected_usage_arg;
2327 psa_algorithm_t expected_alg = expected_alg_arg;
Gilles Peskinebcdd44b2019-05-20 17:28:11 +02002328 psa_algorithm_t expected_alg2 = expected_alg2_arg;
Ronald Cron91e95152020-07-30 17:48:03 +02002329 psa_key_handle_t source_handle = PSA_KEY_HANDLE_INIT;
2330 psa_key_handle_t target_handle = PSA_KEY_HANDLE_INIT;
Gilles Peskine57ab7212019-01-28 13:03:09 +01002331 uint8_t *export_buffer = NULL;
2332
Gilles Peskine57ab7212019-01-28 13:03:09 +01002333 PSA_ASSERT( psa_crypto_init( ) );
2334
Gilles Peskineca25db92019-04-19 11:43:08 +02002335 /* Prepare the source key. */
2336 psa_set_key_usage_flags( &source_attributes, source_usage_arg );
2337 psa_set_key_algorithm( &source_attributes, source_alg_arg );
Gilles Peskinebcdd44b2019-05-20 17:28:11 +02002338 psa_set_key_enrollment_algorithm( &source_attributes, source_alg2_arg );
Gilles Peskineca25db92019-04-19 11:43:08 +02002339 psa_set_key_type( &source_attributes, type_arg );
Gilles Peskine049c7532019-05-15 20:22:09 +02002340 PSA_ASSERT( psa_import_key( &source_attributes,
2341 material->x, material->len,
2342 &source_handle ) );
Gilles Peskineca25db92019-04-19 11:43:08 +02002343 PSA_ASSERT( psa_get_key_attributes( source_handle, &source_attributes ) );
Gilles Peskine57ab7212019-01-28 13:03:09 +01002344
Gilles Peskineca25db92019-04-19 11:43:08 +02002345 /* Prepare the target attributes. */
2346 if( copy_attributes )
2347 target_attributes = source_attributes;
2348 if( target_usage_arg != -1 )
2349 psa_set_key_usage_flags( &target_attributes, target_usage_arg );
2350 if( target_alg_arg != -1 )
2351 psa_set_key_algorithm( &target_attributes, target_alg_arg );
Gilles Peskinebcdd44b2019-05-20 17:28:11 +02002352 if( target_alg2_arg != -1 )
2353 psa_set_key_enrollment_algorithm( &target_attributes, target_alg2_arg );
Gilles Peskine57ab7212019-01-28 13:03:09 +01002354
2355 /* Copy the key. */
Gilles Peskine4a644642019-05-03 17:14:08 +02002356 PSA_ASSERT( psa_copy_key( source_handle,
2357 &target_attributes, &target_handle ) );
Gilles Peskine57ab7212019-01-28 13:03:09 +01002358
2359 /* Destroy the source to ensure that this doesn't affect the target. */
2360 PSA_ASSERT( psa_destroy_key( source_handle ) );
2361
2362 /* Test that the target slot has the expected content and policy. */
Gilles Peskineca25db92019-04-19 11:43:08 +02002363 PSA_ASSERT( psa_get_key_attributes( target_handle, &target_attributes ) );
2364 TEST_EQUAL( psa_get_key_type( &source_attributes ),
2365 psa_get_key_type( &target_attributes ) );
2366 TEST_EQUAL( psa_get_key_bits( &source_attributes ),
2367 psa_get_key_bits( &target_attributes ) );
2368 TEST_EQUAL( expected_usage, psa_get_key_usage_flags( &target_attributes ) );
2369 TEST_EQUAL( expected_alg, psa_get_key_algorithm( &target_attributes ) );
Gilles Peskinebcdd44b2019-05-20 17:28:11 +02002370 TEST_EQUAL( expected_alg2,
2371 psa_get_key_enrollment_algorithm( &target_attributes ) );
Gilles Peskine57ab7212019-01-28 13:03:09 +01002372 if( expected_usage & PSA_KEY_USAGE_EXPORT )
2373 {
2374 size_t length;
2375 ASSERT_ALLOC( export_buffer, material->len );
2376 PSA_ASSERT( psa_export_key( target_handle, export_buffer,
2377 material->len, &length ) );
2378 ASSERT_COMPARE( material->x, material->len,
2379 export_buffer, length );
2380 }
2381 if( ! exercise_key( target_handle, expected_usage, expected_alg ) )
2382 goto exit;
Gilles Peskinebcdd44b2019-05-20 17:28:11 +02002383 if( ! exercise_key( target_handle, expected_usage, expected_alg2 ) )
2384 goto exit;
Gilles Peskine57ab7212019-01-28 13:03:09 +01002385
2386 PSA_ASSERT( psa_close_key( target_handle ) );
2387
2388exit:
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02002389 psa_reset_key_attributes( &source_attributes );
2390 psa_reset_key_attributes( &target_attributes );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002391 PSA_DONE( );
Gilles Peskine57ab7212019-01-28 13:03:09 +01002392 mbedtls_free( export_buffer );
2393}
2394/* END_CASE */
2395
2396/* BEGIN_CASE */
Gilles Peskinebcdd44b2019-05-20 17:28:11 +02002397void copy_fail( int source_usage_arg,
2398 int source_alg_arg, int source_alg2_arg,
Gilles Peskine4a644642019-05-03 17:14:08 +02002399 int type_arg, data_t *material,
2400 int target_type_arg, int target_bits_arg,
Gilles Peskinebcdd44b2019-05-20 17:28:11 +02002401 int target_usage_arg,
2402 int target_alg_arg, int target_alg2_arg,
Gilles Peskine4a644642019-05-03 17:14:08 +02002403 int expected_status_arg )
2404{
2405 psa_key_attributes_t source_attributes = PSA_KEY_ATTRIBUTES_INIT;
2406 psa_key_attributes_t target_attributes = PSA_KEY_ATTRIBUTES_INIT;
Ronald Cron91e95152020-07-30 17:48:03 +02002407 psa_key_handle_t source_handle = PSA_KEY_HANDLE_INIT;
2408 psa_key_handle_t target_handle = PSA_KEY_HANDLE_INIT;
Gilles Peskine4a644642019-05-03 17:14:08 +02002409
2410 PSA_ASSERT( psa_crypto_init( ) );
2411
2412 /* Prepare the source key. */
2413 psa_set_key_usage_flags( &source_attributes, source_usage_arg );
2414 psa_set_key_algorithm( &source_attributes, source_alg_arg );
Gilles Peskinebcdd44b2019-05-20 17:28:11 +02002415 psa_set_key_enrollment_algorithm( &source_attributes, source_alg2_arg );
Gilles Peskine4a644642019-05-03 17:14:08 +02002416 psa_set_key_type( &source_attributes, type_arg );
Gilles Peskine049c7532019-05-15 20:22:09 +02002417 PSA_ASSERT( psa_import_key( &source_attributes,
2418 material->x, material->len,
2419 &source_handle ) );
Gilles Peskine4a644642019-05-03 17:14:08 +02002420
2421 /* Prepare the target attributes. */
2422 psa_set_key_type( &target_attributes, target_type_arg );
2423 psa_set_key_bits( &target_attributes, target_bits_arg );
2424 psa_set_key_usage_flags( &target_attributes, target_usage_arg );
2425 psa_set_key_algorithm( &target_attributes, target_alg_arg );
Gilles Peskinebcdd44b2019-05-20 17:28:11 +02002426 psa_set_key_enrollment_algorithm( &target_attributes, target_alg2_arg );
Gilles Peskine4a644642019-05-03 17:14:08 +02002427
2428 /* Try to copy the key. */
2429 TEST_EQUAL( psa_copy_key( source_handle,
2430 &target_attributes, &target_handle ),
2431 expected_status_arg );
Gilles Peskine76b29a72019-05-28 14:08:50 +02002432
2433 PSA_ASSERT( psa_destroy_key( source_handle ) );
2434
Gilles Peskine4a644642019-05-03 17:14:08 +02002435exit:
2436 psa_reset_key_attributes( &source_attributes );
2437 psa_reset_key_attributes( &target_attributes );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002438 PSA_DONE( );
Gilles Peskine4a644642019-05-03 17:14:08 +02002439}
2440/* END_CASE */
2441
2442/* BEGIN_CASE */
Jaeden Amero6a25b412019-01-04 11:47:44 +00002443void hash_operation_init( )
2444{
Jaeden Ameroa0f625a2019-02-15 13:52:25 +00002445 const uint8_t input[1] = { 0 };
Jaeden Amero6a25b412019-01-04 11:47:44 +00002446 /* Test each valid way of initializing the object, except for `= {0}`, as
2447 * Clang 5 complains when `-Wmissing-field-initializers` is used, even
2448 * though it's OK by the C standard. We could test for this, but we'd need
2449 * to supress the Clang warning for the test. */
2450 psa_hash_operation_t func = psa_hash_operation_init( );
2451 psa_hash_operation_t init = PSA_HASH_OPERATION_INIT;
2452 psa_hash_operation_t zero;
2453
2454 memset( &zero, 0, sizeof( zero ) );
2455
Jaeden Amero11aa7ee2019-02-19 11:44:55 +00002456 /* A freshly-initialized hash operation should not be usable. */
Jaeden Ameroa0f625a2019-02-15 13:52:25 +00002457 TEST_EQUAL( psa_hash_update( &func, input, sizeof( input ) ),
2458 PSA_ERROR_BAD_STATE );
2459 TEST_EQUAL( psa_hash_update( &init, input, sizeof( input ) ),
2460 PSA_ERROR_BAD_STATE );
2461 TEST_EQUAL( psa_hash_update( &zero, input, sizeof( input ) ),
2462 PSA_ERROR_BAD_STATE );
2463
Jaeden Amero5229bbb2019-02-07 16:33:37 +00002464 /* A default hash operation should be abortable without error. */
2465 PSA_ASSERT( psa_hash_abort( &func ) );
2466 PSA_ASSERT( psa_hash_abort( &init ) );
2467 PSA_ASSERT( psa_hash_abort( &zero ) );
Jaeden Amero6a25b412019-01-04 11:47:44 +00002468}
2469/* END_CASE */
2470
2471/* BEGIN_CASE */
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002472void hash_setup( int alg_arg,
2473 int expected_status_arg )
2474{
2475 psa_algorithm_t alg = alg_arg;
Gilles Peskineb866e2b2018-06-21 09:25:10 +02002476 psa_status_t expected_status = expected_status_arg;
Jaeden Amero6a25b412019-01-04 11:47:44 +00002477 psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002478 psa_status_t status;
2479
Gilles Peskine8817f612018-12-18 00:18:46 +01002480 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002481
Gilles Peskineda8191d1c2018-07-08 19:46:38 +02002482 status = psa_hash_setup( &operation, alg );
Gilles Peskinefe11b722018-12-18 00:24:04 +01002483 TEST_EQUAL( status, expected_status );
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002484
Gilles Peskine9e0a4a52019-02-25 22:11:18 +01002485 /* Whether setup succeeded or failed, abort must succeed. */
2486 PSA_ASSERT( psa_hash_abort( &operation ) );
2487
2488 /* If setup failed, reproduce the failure, so as to
2489 * test the resulting state of the operation object. */
2490 if( status != PSA_SUCCESS )
2491 TEST_EQUAL( psa_hash_setup( &operation, alg ), status );
2492
Gilles Peskinef426e0f2019-02-25 17:42:03 +01002493 /* Now the operation object should be reusable. */
2494#if defined(KNOWN_SUPPORTED_HASH_ALG)
2495 PSA_ASSERT( psa_hash_setup( &operation, KNOWN_SUPPORTED_HASH_ALG ) );
2496 PSA_ASSERT( psa_hash_abort( &operation ) );
2497#endif
2498
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002499exit:
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002500 PSA_DONE( );
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002501}
2502/* END_CASE */
2503
2504/* BEGIN_CASE */
Gilles Peskine0a749c82019-11-28 19:33:58 +01002505void hash_compute_fail( int alg_arg, data_t *input,
2506 int output_size_arg, int expected_status_arg )
2507{
2508 psa_algorithm_t alg = alg_arg;
2509 uint8_t *output = NULL;
2510 size_t output_size = output_size_arg;
2511 size_t output_length = INVALID_EXPORT_LENGTH;
2512 psa_status_t expected_status = expected_status_arg;
2513 psa_status_t status;
2514
2515 ASSERT_ALLOC( output, output_size );
2516
2517 PSA_ASSERT( psa_crypto_init( ) );
2518
2519 status = psa_hash_compute( alg, input->x, input->len,
2520 output, output_size, &output_length );
2521 TEST_EQUAL( status, expected_status );
2522 TEST_ASSERT( output_length <= output_size );
2523
2524exit:
2525 mbedtls_free( output );
2526 PSA_DONE( );
2527}
2528/* END_CASE */
2529
2530/* BEGIN_CASE */
Gilles Peskine88e08462020-01-28 20:43:00 +01002531void hash_compare_fail( int alg_arg, data_t *input,
2532 data_t *reference_hash,
2533 int expected_status_arg )
2534{
2535 psa_algorithm_t alg = alg_arg;
2536 psa_status_t expected_status = expected_status_arg;
2537 psa_status_t status;
2538
2539 PSA_ASSERT( psa_crypto_init( ) );
2540
2541 status = psa_hash_compare( alg, input->x, input->len,
2542 reference_hash->x, reference_hash->len );
2543 TEST_EQUAL( status, expected_status );
2544
2545exit:
2546 PSA_DONE( );
2547}
2548/* END_CASE */
2549
2550/* BEGIN_CASE */
Gilles Peskine0a749c82019-11-28 19:33:58 +01002551void hash_compute_compare( int alg_arg, data_t *input,
2552 data_t *expected_output )
2553{
2554 psa_algorithm_t alg = alg_arg;
2555 uint8_t output[PSA_HASH_MAX_SIZE + 1];
2556 size_t output_length = INVALID_EXPORT_LENGTH;
2557 size_t i;
2558
2559 PSA_ASSERT( psa_crypto_init( ) );
2560
2561 /* Compute with tight buffer */
2562 PSA_ASSERT( psa_hash_compute( alg, input->x, input->len,
2563 output, PSA_HASH_SIZE( alg ),
2564 &output_length ) );
2565 TEST_EQUAL( output_length, PSA_HASH_SIZE( alg ) );
2566 ASSERT_COMPARE( output, output_length,
2567 expected_output->x, expected_output->len );
2568
2569 /* Compute with larger buffer */
2570 PSA_ASSERT( psa_hash_compute( alg, input->x, input->len,
2571 output, sizeof( output ),
2572 &output_length ) );
2573 TEST_EQUAL( output_length, PSA_HASH_SIZE( alg ) );
2574 ASSERT_COMPARE( output, output_length,
2575 expected_output->x, expected_output->len );
2576
2577 /* Compare with correct hash */
2578 PSA_ASSERT( psa_hash_compare( alg, input->x, input->len,
2579 output, output_length ) );
2580
2581 /* Compare with trailing garbage */
2582 TEST_EQUAL( psa_hash_compare( alg, input->x, input->len,
2583 output, output_length + 1 ),
2584 PSA_ERROR_INVALID_SIGNATURE );
2585
2586 /* Compare with truncated hash */
2587 TEST_EQUAL( psa_hash_compare( alg, input->x, input->len,
2588 output, output_length - 1 ),
2589 PSA_ERROR_INVALID_SIGNATURE );
2590
2591 /* Compare with corrupted value */
2592 for( i = 0; i < output_length; i++ )
2593 {
2594 test_set_step( i );
2595 output[i] ^= 1;
2596 TEST_EQUAL( psa_hash_compare( alg, input->x, input->len,
2597 output, output_length ),
2598 PSA_ERROR_INVALID_SIGNATURE );
2599 output[i] ^= 1;
2600 }
2601
2602exit:
2603 PSA_DONE( );
2604}
2605/* END_CASE */
2606
2607/* BEGIN_CASE */
itayzafrirf86548d2018-11-01 10:44:32 +02002608void hash_bad_order( )
2609{
Jaeden Amero11aa7ee2019-02-19 11:44:55 +00002610 psa_algorithm_t alg = PSA_ALG_SHA_256;
itayzafrirf86548d2018-11-01 10:44:32 +02002611 unsigned char input[] = "";
2612 /* SHA-256 hash of an empty string */
Jaeden Amero11aa7ee2019-02-19 11:44:55 +00002613 const unsigned char valid_hash[] = {
itayzafrirf86548d2018-11-01 10:44:32 +02002614 0xe3, 0xb0, 0xc4, 0x42, 0x98, 0xfc, 0x1c, 0x14, 0x9a, 0xfb, 0xf4, 0xc8,
2615 0x99, 0x6f, 0xb9, 0x24, 0x27, 0xae, 0x41, 0xe4, 0x64, 0x9b, 0x93, 0x4c,
2616 0xa4, 0x95, 0x99, 0x1b, 0x78, 0x52, 0xb8, 0x55 };
Jaeden Amero11aa7ee2019-02-19 11:44:55 +00002617 unsigned char hash[sizeof(valid_hash)] = { 0 };
itayzafrirf86548d2018-11-01 10:44:32 +02002618 size_t hash_len;
Jaeden Amero6a25b412019-01-04 11:47:44 +00002619 psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT;
itayzafrirf86548d2018-11-01 10:44:32 +02002620
Gilles Peskine8817f612018-12-18 00:18:46 +01002621 PSA_ASSERT( psa_crypto_init( ) );
itayzafrirf86548d2018-11-01 10:44:32 +02002622
Jaeden Amero36ee5d02019-02-19 09:25:10 +00002623 /* Call setup twice in a row. */
2624 PSA_ASSERT( psa_hash_setup( &operation, alg ) );
2625 TEST_EQUAL( psa_hash_setup( &operation, alg ),
2626 PSA_ERROR_BAD_STATE );
2627 PSA_ASSERT( psa_hash_abort( &operation ) );
2628
Jaeden Amero11aa7ee2019-02-19 11:44:55 +00002629 /* Call update without calling setup beforehand. */
Gilles Peskinef812dcf2018-12-18 00:33:25 +01002630 TEST_EQUAL( psa_hash_update( &operation, input, sizeof( input ) ),
Jaeden Ameroa0f625a2019-02-15 13:52:25 +00002631 PSA_ERROR_BAD_STATE );
Jaeden Amero11aa7ee2019-02-19 11:44:55 +00002632 PSA_ASSERT( psa_hash_abort( &operation ) );
itayzafrirf86548d2018-11-01 10:44:32 +02002633
Jaeden Amero11aa7ee2019-02-19 11:44:55 +00002634 /* Call update after finish. */
2635 PSA_ASSERT( psa_hash_setup( &operation, alg ) );
2636 PSA_ASSERT( psa_hash_finish( &operation,
2637 hash, sizeof( hash ), &hash_len ) );
2638 TEST_EQUAL( psa_hash_update( &operation, input, sizeof( input ) ),
Jaeden Ameroa0f625a2019-02-15 13:52:25 +00002639 PSA_ERROR_BAD_STATE );
Jaeden Amero11aa7ee2019-02-19 11:44:55 +00002640 PSA_ASSERT( psa_hash_abort( &operation ) );
itayzafrirf86548d2018-11-01 10:44:32 +02002641
Jaeden Amero11aa7ee2019-02-19 11:44:55 +00002642 /* Call verify without calling setup beforehand. */
2643 TEST_EQUAL( psa_hash_verify( &operation,
2644 valid_hash, sizeof( valid_hash ) ),
2645 PSA_ERROR_BAD_STATE );
2646 PSA_ASSERT( psa_hash_abort( &operation ) );
2647
2648 /* Call verify after finish. */
2649 PSA_ASSERT( psa_hash_setup( &operation, alg ) );
2650 PSA_ASSERT( psa_hash_finish( &operation,
2651 hash, sizeof( hash ), &hash_len ) );
2652 TEST_EQUAL( psa_hash_verify( &operation,
2653 valid_hash, sizeof( valid_hash ) ),
2654 PSA_ERROR_BAD_STATE );
2655 PSA_ASSERT( psa_hash_abort( &operation ) );
2656
2657 /* Call verify twice in a row. */
2658 PSA_ASSERT( psa_hash_setup( &operation, alg ) );
2659 PSA_ASSERT( psa_hash_verify( &operation,
2660 valid_hash, sizeof( valid_hash ) ) );
2661 TEST_EQUAL( psa_hash_verify( &operation,
2662 valid_hash, sizeof( valid_hash ) ),
2663 PSA_ERROR_BAD_STATE );
2664 PSA_ASSERT( psa_hash_abort( &operation ) );
2665
2666 /* Call finish without calling setup beforehand. */
Gilles Peskinefe11b722018-12-18 00:24:04 +01002667 TEST_EQUAL( psa_hash_finish( &operation,
2668 hash, sizeof( hash ), &hash_len ),
Jaeden Ameroa0f625a2019-02-15 13:52:25 +00002669 PSA_ERROR_BAD_STATE );
Jaeden Amero11aa7ee2019-02-19 11:44:55 +00002670 PSA_ASSERT( psa_hash_abort( &operation ) );
2671
2672 /* Call finish twice in a row. */
2673 PSA_ASSERT( psa_hash_setup( &operation, alg ) );
2674 PSA_ASSERT( psa_hash_finish( &operation,
2675 hash, sizeof( hash ), &hash_len ) );
2676 TEST_EQUAL( psa_hash_finish( &operation,
2677 hash, sizeof( hash ), &hash_len ),
2678 PSA_ERROR_BAD_STATE );
2679 PSA_ASSERT( psa_hash_abort( &operation ) );
2680
2681 /* Call finish after calling verify. */
2682 PSA_ASSERT( psa_hash_setup( &operation, alg ) );
2683 PSA_ASSERT( psa_hash_verify( &operation,
2684 valid_hash, sizeof( valid_hash ) ) );
2685 TEST_EQUAL( psa_hash_finish( &operation,
2686 hash, sizeof( hash ), &hash_len ),
2687 PSA_ERROR_BAD_STATE );
2688 PSA_ASSERT( psa_hash_abort( &operation ) );
itayzafrirf86548d2018-11-01 10:44:32 +02002689
2690exit:
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002691 PSA_DONE( );
itayzafrirf86548d2018-11-01 10:44:32 +02002692}
2693/* END_CASE */
2694
itayzafrir27e69452018-11-01 14:26:34 +02002695/* BEGIN_CASE depends_on:MBEDTLS_SHA256_C */
2696void hash_verify_bad_args( )
itayzafrirec93d302018-10-18 18:01:10 +03002697{
2698 psa_algorithm_t alg = PSA_ALG_SHA_256;
itayzafrir27e69452018-11-01 14:26:34 +02002699 /* SHA-256 hash of an empty string with 2 extra bytes (0xaa and 0xbb)
2700 * appended to it */
2701 unsigned char hash[] = {
2702 0xe3, 0xb0, 0xc4, 0x42, 0x98, 0xfc, 0x1c, 0x14, 0x9a, 0xfb, 0xf4, 0xc8,
2703 0x99, 0x6f, 0xb9, 0x24, 0x27, 0xae, 0x41, 0xe4, 0x64, 0x9b, 0x93, 0x4c,
2704 0xa4, 0x95, 0x99, 0x1b, 0x78, 0x52, 0xb8, 0x55, 0xaa, 0xbb };
itayzafrirec93d302018-10-18 18:01:10 +03002705 size_t expected_size = PSA_HASH_SIZE( alg );
Jaeden Amero6a25b412019-01-04 11:47:44 +00002706 psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT;
itayzafrirec93d302018-10-18 18:01:10 +03002707
Gilles Peskine8817f612018-12-18 00:18:46 +01002708 PSA_ASSERT( psa_crypto_init( ) );
itayzafrirec93d302018-10-18 18:01:10 +03002709
itayzafrir27e69452018-11-01 14:26:34 +02002710 /* psa_hash_verify with a smaller hash than expected */
Gilles Peskine8817f612018-12-18 00:18:46 +01002711 PSA_ASSERT( psa_hash_setup( &operation, alg ) );
Gilles Peskinef812dcf2018-12-18 00:33:25 +01002712 TEST_EQUAL( psa_hash_verify( &operation, hash, expected_size - 1 ),
Gilles Peskinefe11b722018-12-18 00:24:04 +01002713 PSA_ERROR_INVALID_SIGNATURE );
itayzafrirec93d302018-10-18 18:01:10 +03002714
itayzafrir27e69452018-11-01 14:26:34 +02002715 /* psa_hash_verify with a non-matching hash */
Gilles Peskine8817f612018-12-18 00:18:46 +01002716 PSA_ASSERT( psa_hash_setup( &operation, alg ) );
Gilles Peskinef812dcf2018-12-18 00:33:25 +01002717 TEST_EQUAL( psa_hash_verify( &operation, hash + 1, expected_size ),
Gilles Peskinefe11b722018-12-18 00:24:04 +01002718 PSA_ERROR_INVALID_SIGNATURE );
itayzafrirec93d302018-10-18 18:01:10 +03002719
itayzafrir27e69452018-11-01 14:26:34 +02002720 /* psa_hash_verify with a hash longer than expected */
Gilles Peskine8817f612018-12-18 00:18:46 +01002721 PSA_ASSERT( psa_hash_setup( &operation, alg ) );
Gilles Peskinef812dcf2018-12-18 00:33:25 +01002722 TEST_EQUAL( psa_hash_verify( &operation, hash, sizeof( hash ) ),
Gilles Peskinefe11b722018-12-18 00:24:04 +01002723 PSA_ERROR_INVALID_SIGNATURE );
itayzafrir4271df92018-10-24 18:16:19 +03002724
itayzafrirec93d302018-10-18 18:01:10 +03002725exit:
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002726 PSA_DONE( );
itayzafrirec93d302018-10-18 18:01:10 +03002727}
2728/* END_CASE */
2729
itayzafrirb2dd5ed2018-11-01 11:58:59 +02002730/* BEGIN_CASE depends_on:MBEDTLS_SHA256_C */
2731void hash_finish_bad_args( )
itayzafrir58028322018-10-25 10:22:01 +03002732{
2733 psa_algorithm_t alg = PSA_ALG_SHA_256;
itayzafrirb2dd5ed2018-11-01 11:58:59 +02002734 unsigned char hash[PSA_HASH_MAX_SIZE];
itayzafrir58028322018-10-25 10:22:01 +03002735 size_t expected_size = PSA_HASH_SIZE( alg );
Jaeden Amero6a25b412019-01-04 11:47:44 +00002736 psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT;
itayzafrir58028322018-10-25 10:22:01 +03002737 size_t hash_len;
2738
Gilles Peskine8817f612018-12-18 00:18:46 +01002739 PSA_ASSERT( psa_crypto_init( ) );
itayzafrir58028322018-10-25 10:22:01 +03002740
itayzafrir58028322018-10-25 10:22:01 +03002741 /* psa_hash_finish with a smaller hash buffer than expected */
Gilles Peskine8817f612018-12-18 00:18:46 +01002742 PSA_ASSERT( psa_hash_setup( &operation, alg ) );
Gilles Peskinefe11b722018-12-18 00:24:04 +01002743 TEST_EQUAL( psa_hash_finish( &operation,
Gilles Peskinef812dcf2018-12-18 00:33:25 +01002744 hash, expected_size - 1, &hash_len ),
2745 PSA_ERROR_BUFFER_TOO_SMALL );
itayzafrir58028322018-10-25 10:22:01 +03002746
2747exit:
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002748 PSA_DONE( );
itayzafrir58028322018-10-25 10:22:01 +03002749}
2750/* END_CASE */
2751
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002752/* BEGIN_CASE depends_on:MBEDTLS_SHA256_C */
2753void hash_clone_source_state( )
2754{
2755 psa_algorithm_t alg = PSA_ALG_SHA_256;
2756 unsigned char hash[PSA_HASH_MAX_SIZE];
2757 psa_hash_operation_t op_source = PSA_HASH_OPERATION_INIT;
2758 psa_hash_operation_t op_init = PSA_HASH_OPERATION_INIT;
2759 psa_hash_operation_t op_setup = PSA_HASH_OPERATION_INIT;
2760 psa_hash_operation_t op_finished = PSA_HASH_OPERATION_INIT;
2761 psa_hash_operation_t op_aborted = PSA_HASH_OPERATION_INIT;
2762 size_t hash_len;
2763
2764 PSA_ASSERT( psa_crypto_init( ) );
2765 PSA_ASSERT( psa_hash_setup( &op_source, alg ) );
2766
2767 PSA_ASSERT( psa_hash_setup( &op_setup, alg ) );
2768 PSA_ASSERT( psa_hash_setup( &op_finished, alg ) );
2769 PSA_ASSERT( psa_hash_finish( &op_finished,
2770 hash, sizeof( hash ), &hash_len ) );
2771 PSA_ASSERT( psa_hash_setup( &op_aborted, alg ) );
2772 PSA_ASSERT( psa_hash_abort( &op_aborted ) );
2773
2774 TEST_EQUAL( psa_hash_clone( &op_source, &op_setup ),
2775 PSA_ERROR_BAD_STATE );
2776
2777 PSA_ASSERT( psa_hash_clone( &op_source, &op_init ) );
2778 PSA_ASSERT( psa_hash_finish( &op_init,
2779 hash, sizeof( hash ), &hash_len ) );
2780 PSA_ASSERT( psa_hash_clone( &op_source, &op_finished ) );
2781 PSA_ASSERT( psa_hash_finish( &op_finished,
2782 hash, sizeof( hash ), &hash_len ) );
2783 PSA_ASSERT( psa_hash_clone( &op_source, &op_aborted ) );
2784 PSA_ASSERT( psa_hash_finish( &op_aborted,
2785 hash, sizeof( hash ), &hash_len ) );
2786
2787exit:
2788 psa_hash_abort( &op_source );
2789 psa_hash_abort( &op_init );
2790 psa_hash_abort( &op_setup );
2791 psa_hash_abort( &op_finished );
2792 psa_hash_abort( &op_aborted );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002793 PSA_DONE( );
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002794}
2795/* END_CASE */
2796
2797/* BEGIN_CASE depends_on:MBEDTLS_SHA256_C */
2798void hash_clone_target_state( )
2799{
2800 psa_algorithm_t alg = PSA_ALG_SHA_256;
2801 unsigned char hash[PSA_HASH_MAX_SIZE];
2802 psa_hash_operation_t op_init = PSA_HASH_OPERATION_INIT;
2803 psa_hash_operation_t op_setup = PSA_HASH_OPERATION_INIT;
2804 psa_hash_operation_t op_finished = PSA_HASH_OPERATION_INIT;
2805 psa_hash_operation_t op_aborted = PSA_HASH_OPERATION_INIT;
2806 psa_hash_operation_t op_target = PSA_HASH_OPERATION_INIT;
2807 size_t hash_len;
2808
2809 PSA_ASSERT( psa_crypto_init( ) );
2810
2811 PSA_ASSERT( psa_hash_setup( &op_setup, alg ) );
2812 PSA_ASSERT( psa_hash_setup( &op_finished, alg ) );
2813 PSA_ASSERT( psa_hash_finish( &op_finished,
2814 hash, sizeof( hash ), &hash_len ) );
2815 PSA_ASSERT( psa_hash_setup( &op_aborted, alg ) );
2816 PSA_ASSERT( psa_hash_abort( &op_aborted ) );
2817
2818 PSA_ASSERT( psa_hash_clone( &op_setup, &op_target ) );
2819 PSA_ASSERT( psa_hash_finish( &op_target,
2820 hash, sizeof( hash ), &hash_len ) );
2821
2822 TEST_EQUAL( psa_hash_clone( &op_init, &op_target ), PSA_ERROR_BAD_STATE );
2823 TEST_EQUAL( psa_hash_clone( &op_finished, &op_target ),
2824 PSA_ERROR_BAD_STATE );
2825 TEST_EQUAL( psa_hash_clone( &op_aborted, &op_target ),
2826 PSA_ERROR_BAD_STATE );
2827
2828exit:
2829 psa_hash_abort( &op_target );
2830 psa_hash_abort( &op_init );
2831 psa_hash_abort( &op_setup );
2832 psa_hash_abort( &op_finished );
2833 psa_hash_abort( &op_aborted );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002834 PSA_DONE( );
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002835}
2836/* END_CASE */
2837
itayzafrir58028322018-10-25 10:22:01 +03002838/* BEGIN_CASE */
Jaeden Amero769ce272019-01-04 11:48:03 +00002839void mac_operation_init( )
2840{
Jaeden Amero252ef282019-02-15 14:05:35 +00002841 const uint8_t input[1] = { 0 };
2842
Jaeden Amero769ce272019-01-04 11:48:03 +00002843 /* Test each valid way of initializing the object, except for `= {0}`, as
2844 * Clang 5 complains when `-Wmissing-field-initializers` is used, even
2845 * though it's OK by the C standard. We could test for this, but we'd need
2846 * to supress the Clang warning for the test. */
2847 psa_mac_operation_t func = psa_mac_operation_init( );
2848 psa_mac_operation_t init = PSA_MAC_OPERATION_INIT;
2849 psa_mac_operation_t zero;
2850
2851 memset( &zero, 0, sizeof( zero ) );
2852
Jaeden Amero252ef282019-02-15 14:05:35 +00002853 /* A freshly-initialized MAC operation should not be usable. */
2854 TEST_EQUAL( psa_mac_update( &func,
2855 input, sizeof( input ) ),
2856 PSA_ERROR_BAD_STATE );
2857 TEST_EQUAL( psa_mac_update( &init,
2858 input, sizeof( input ) ),
2859 PSA_ERROR_BAD_STATE );
2860 TEST_EQUAL( psa_mac_update( &zero,
2861 input, sizeof( input ) ),
2862 PSA_ERROR_BAD_STATE );
2863
Jaeden Amero5229bbb2019-02-07 16:33:37 +00002864 /* A default MAC operation should be abortable without error. */
2865 PSA_ASSERT( psa_mac_abort( &func ) );
2866 PSA_ASSERT( psa_mac_abort( &init ) );
2867 PSA_ASSERT( psa_mac_abort( &zero ) );
Jaeden Amero769ce272019-01-04 11:48:03 +00002868}
2869/* END_CASE */
2870
2871/* BEGIN_CASE */
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002872void mac_setup( int key_type_arg,
2873 data_t *key,
2874 int alg_arg,
2875 int expected_status_arg )
2876{
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002877 psa_key_type_t key_type = key_type_arg;
2878 psa_algorithm_t alg = alg_arg;
Gilles Peskineb866e2b2018-06-21 09:25:10 +02002879 psa_status_t expected_status = expected_status_arg;
Jaeden Amero769ce272019-01-04 11:48:03 +00002880 psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT;
Gilles Peskinef426e0f2019-02-25 17:42:03 +01002881 psa_status_t status = PSA_ERROR_GENERIC_ERROR;
2882#if defined(KNOWN_SUPPORTED_MAC_ALG)
2883 const uint8_t smoke_test_key_data[16] = "kkkkkkkkkkkkkkkk";
2884#endif
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002885
Gilles Peskine8817f612018-12-18 00:18:46 +01002886 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002887
Gilles Peskinef426e0f2019-02-25 17:42:03 +01002888 if( ! exercise_mac_setup( key_type, key->x, key->len, alg,
2889 &operation, &status ) )
2890 goto exit;
Gilles Peskinefe11b722018-12-18 00:24:04 +01002891 TEST_EQUAL( status, expected_status );
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002892
Gilles Peskinef426e0f2019-02-25 17:42:03 +01002893 /* The operation object should be reusable. */
2894#if defined(KNOWN_SUPPORTED_MAC_ALG)
2895 if( ! exercise_mac_setup( KNOWN_SUPPORTED_MAC_KEY_TYPE,
2896 smoke_test_key_data,
2897 sizeof( smoke_test_key_data ),
2898 KNOWN_SUPPORTED_MAC_ALG,
2899 &operation, &status ) )
2900 goto exit;
2901 TEST_EQUAL( status, PSA_SUCCESS );
2902#endif
2903
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002904exit:
Gilles Peskine1153e7b2019-05-28 15:10:21 +02002905 PSA_DONE( );
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002906}
2907/* END_CASE */
2908
2909/* BEGIN_CASE */
Jaeden Amero252ef282019-02-15 14:05:35 +00002910void mac_bad_order( )
2911{
Ronald Cron91e95152020-07-30 17:48:03 +02002912 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Jaeden Amero252ef282019-02-15 14:05:35 +00002913 psa_key_type_t key_type = PSA_KEY_TYPE_HMAC;
2914 psa_algorithm_t alg = PSA_ALG_HMAC(PSA_ALG_SHA_256);
2915 const uint8_t key[] = {
2916 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
2917 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
2918 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa };
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02002919 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Jaeden Amero252ef282019-02-15 14:05:35 +00002920 psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT;
2921 uint8_t sign_mac[PSA_MAC_MAX_SIZE + 10] = { 0 };
2922 size_t sign_mac_length = 0;
2923 const uint8_t input[] = { 0xbb, 0xbb, 0xbb, 0xbb };
2924 const uint8_t verify_mac[] = {
2925 0x74, 0x65, 0x93, 0x8c, 0xeb, 0x1d, 0xb3, 0x76, 0x5a, 0x38, 0xe7, 0xdd,
2926 0x85, 0xc5, 0xad, 0x4f, 0x07, 0xe7, 0xd5, 0xb2, 0x64, 0xf0, 0x1a, 0x1a,
2927 0x2c, 0xf9, 0x18, 0xca, 0x59, 0x7e, 0x5d, 0xf6 };
2928
2929 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01002930 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_VERIFY_HASH );
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02002931 psa_set_key_algorithm( &attributes, alg );
2932 psa_set_key_type( &attributes, key_type );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002933
Gilles Peskine73676cb2019-05-15 20:15:10 +02002934 PSA_ASSERT( psa_import_key( &attributes, key, sizeof( key ), &handle ) );
Gilles Peskine4abf7412018-06-18 16:35:34 +02002935
Jaeden Amero252ef282019-02-15 14:05:35 +00002936 /* Call update without calling setup beforehand. */
2937 TEST_EQUAL( psa_mac_update( &operation, input, sizeof( input ) ),
2938 PSA_ERROR_BAD_STATE );
2939 PSA_ASSERT( psa_mac_abort( &operation ) );
2940
2941 /* Call sign finish without calling setup beforehand. */
2942 TEST_EQUAL( psa_mac_sign_finish( &operation, sign_mac, sizeof( sign_mac ),
2943 &sign_mac_length),
2944 PSA_ERROR_BAD_STATE );
2945 PSA_ASSERT( psa_mac_abort( &operation ) );
2946
2947 /* Call verify finish without calling setup beforehand. */
2948 TEST_EQUAL( psa_mac_verify_finish( &operation,
2949 verify_mac, sizeof( verify_mac ) ),
2950 PSA_ERROR_BAD_STATE );
2951 PSA_ASSERT( psa_mac_abort( &operation ) );
2952
Jaeden Amero36ee5d02019-02-19 09:25:10 +00002953 /* Call setup twice in a row. */
2954 PSA_ASSERT( psa_mac_sign_setup( &operation,
2955 handle, alg ) );
2956 TEST_EQUAL( psa_mac_sign_setup( &operation,
2957 handle, alg ),
2958 PSA_ERROR_BAD_STATE );
2959 PSA_ASSERT( psa_mac_abort( &operation ) );
2960
Jaeden Amero252ef282019-02-15 14:05:35 +00002961 /* Call update after sign finish. */
2962 PSA_ASSERT( psa_mac_sign_setup( &operation,
2963 handle, alg ) );
2964 PSA_ASSERT( psa_mac_update( &operation, input, sizeof( input ) ) );
2965 PSA_ASSERT( psa_mac_sign_finish( &operation,
2966 sign_mac, sizeof( sign_mac ),
2967 &sign_mac_length ) );
2968 TEST_EQUAL( psa_mac_update( &operation, input, sizeof( input ) ),
2969 PSA_ERROR_BAD_STATE );
2970 PSA_ASSERT( psa_mac_abort( &operation ) );
2971
2972 /* Call update after verify finish. */
2973 PSA_ASSERT( psa_mac_verify_setup( &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02002974 handle, alg ) );
Jaeden Amero252ef282019-02-15 14:05:35 +00002975 PSA_ASSERT( psa_mac_update( &operation, input, sizeof( input ) ) );
2976 PSA_ASSERT( psa_mac_verify_finish( &operation,
2977 verify_mac, sizeof( verify_mac ) ) );
2978 TEST_EQUAL( psa_mac_update( &operation, input, sizeof( input ) ),
2979 PSA_ERROR_BAD_STATE );
2980 PSA_ASSERT( psa_mac_abort( &operation ) );
2981
2982 /* Call sign finish twice in a row. */
2983 PSA_ASSERT( psa_mac_sign_setup( &operation,
2984 handle, alg ) );
2985 PSA_ASSERT( psa_mac_update( &operation, input, sizeof( input ) ) );
2986 PSA_ASSERT( psa_mac_sign_finish( &operation,
2987 sign_mac, sizeof( sign_mac ),
2988 &sign_mac_length ) );
2989 TEST_EQUAL( psa_mac_sign_finish( &operation,
2990 sign_mac, sizeof( sign_mac ),
2991 &sign_mac_length ),
2992 PSA_ERROR_BAD_STATE );
2993 PSA_ASSERT( psa_mac_abort( &operation ) );
2994
2995 /* Call verify finish twice in a row. */
2996 PSA_ASSERT( psa_mac_verify_setup( &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02002997 handle, alg ) );
Jaeden Amero252ef282019-02-15 14:05:35 +00002998 PSA_ASSERT( psa_mac_update( &operation, input, sizeof( input ) ) );
2999 PSA_ASSERT( psa_mac_verify_finish( &operation,
3000 verify_mac, sizeof( verify_mac ) ) );
3001 TEST_EQUAL( psa_mac_verify_finish( &operation,
3002 verify_mac, sizeof( verify_mac ) ),
3003 PSA_ERROR_BAD_STATE );
3004 PSA_ASSERT( psa_mac_abort( &operation ) );
3005
3006 /* Setup sign but try verify. */
3007 PSA_ASSERT( psa_mac_sign_setup( &operation,
3008 handle, alg ) );
3009 PSA_ASSERT( psa_mac_update( &operation, input, sizeof( input ) ) );
3010 TEST_EQUAL( psa_mac_verify_finish( &operation,
3011 verify_mac, sizeof( verify_mac ) ),
3012 PSA_ERROR_BAD_STATE );
3013 PSA_ASSERT( psa_mac_abort( &operation ) );
3014
3015 /* Setup verify but try sign. */
3016 PSA_ASSERT( psa_mac_verify_setup( &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02003017 handle, alg ) );
Jaeden Amero252ef282019-02-15 14:05:35 +00003018 PSA_ASSERT( psa_mac_update( &operation, input, sizeof( input ) ) );
3019 TEST_EQUAL( psa_mac_sign_finish( &operation,
3020 sign_mac, sizeof( sign_mac ),
3021 &sign_mac_length ),
3022 PSA_ERROR_BAD_STATE );
3023 PSA_ASSERT( psa_mac_abort( &operation ) );
Gilles Peskine4abf7412018-06-18 16:35:34 +02003024
Gilles Peskine76b29a72019-05-28 14:08:50 +02003025 PSA_ASSERT( psa_destroy_key( handle ) );
3026
Gilles Peskine9ef733f2018-02-07 21:05:37 +01003027exit:
Gilles Peskine1153e7b2019-05-28 15:10:21 +02003028 PSA_DONE( );
Gilles Peskine9ef733f2018-02-07 21:05:37 +01003029}
3030/* END_CASE */
3031
3032/* BEGIN_CASE */
Gilles Peskinea7aa4422018-08-14 15:17:54 +02003033void mac_sign( int key_type_arg,
3034 data_t *key,
3035 int alg_arg,
3036 data_t *input,
3037 data_t *expected_mac )
3038{
Ronald Cron91e95152020-07-30 17:48:03 +02003039 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskinea7aa4422018-08-14 15:17:54 +02003040 psa_key_type_t key_type = key_type_arg;
3041 psa_algorithm_t alg = alg_arg;
Jaeden Amero769ce272019-01-04 11:48:03 +00003042 psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003043 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine5e65cec2020-08-25 23:38:39 +02003044 uint8_t *actual_mac = NULL;
Gilles Peskinea7aa4422018-08-14 15:17:54 +02003045 size_t mac_buffer_size =
3046 PSA_MAC_FINAL_SIZE( key_type, PSA_BYTES_TO_BITS( key->len ), alg );
3047 size_t mac_length = 0;
Gilles Peskine8b356b52020-08-25 23:44:59 +02003048 const size_t output_sizes_to_test[] = {
3049 0,
3050 1,
3051 expected_mac->len - 1,
3052 expected_mac->len,
3053 expected_mac->len + 1,
3054 };
Gilles Peskinea7aa4422018-08-14 15:17:54 +02003055
Gilles Peskinea7aa4422018-08-14 15:17:54 +02003056 TEST_ASSERT( mac_buffer_size <= PSA_MAC_MAX_SIZE );
Gilles Peskine3d404d62020-08-25 23:47:36 +02003057 /* We expect PSA_MAC_FINAL_SIZE to be exact. */
3058 TEST_ASSERT( expected_mac->len == mac_buffer_size );
Gilles Peskinea7aa4422018-08-14 15:17:54 +02003059
Gilles Peskine8817f612018-12-18 00:18:46 +01003060 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskinea7aa4422018-08-14 15:17:54 +02003061
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01003062 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_SIGN_HASH );
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003063 psa_set_key_algorithm( &attributes, alg );
3064 psa_set_key_type( &attributes, key_type );
Gilles Peskinea7aa4422018-08-14 15:17:54 +02003065
Gilles Peskine73676cb2019-05-15 20:15:10 +02003066 PSA_ASSERT( psa_import_key( &attributes, key->x, key->len, &handle ) );
Gilles Peskinea7aa4422018-08-14 15:17:54 +02003067
Gilles Peskine8b356b52020-08-25 23:44:59 +02003068 for( size_t i = 0; i < ARRAY_LENGTH( output_sizes_to_test ); i++ )
3069 {
3070 const size_t output_size = output_sizes_to_test[i];
3071 psa_status_t expected_status =
3072 ( output_size >= expected_mac->len ? PSA_SUCCESS :
3073 PSA_ERROR_BUFFER_TOO_SMALL );
Gilles Peskine5e65cec2020-08-25 23:38:39 +02003074
Gilles Peskine8b356b52020-08-25 23:44:59 +02003075 test_set_step( output_size );
3076 ASSERT_ALLOC( actual_mac, output_size );
Gilles Peskinea7aa4422018-08-14 15:17:54 +02003077
Gilles Peskine8b356b52020-08-25 23:44:59 +02003078 /* Calculate the MAC. */
3079 PSA_ASSERT( psa_mac_sign_setup( &operation,
3080 handle, alg ) );
3081 PSA_ASSERT( psa_mac_update( &operation,
3082 input->x, input->len ) );
3083 TEST_EQUAL( psa_mac_sign_finish( &operation,
3084 actual_mac, output_size,
3085 &mac_length ),
3086 expected_status );
3087 PSA_ASSERT( psa_mac_abort( &operation ) );
3088
3089 if( expected_status == PSA_SUCCESS )
3090 {
3091 ASSERT_COMPARE( expected_mac->x, expected_mac->len,
3092 actual_mac, mac_length );
3093 }
3094 mbedtls_free( actual_mac );
3095 actual_mac = NULL;
3096 }
Gilles Peskinea7aa4422018-08-14 15:17:54 +02003097
Gilles Peskinea7aa4422018-08-14 15:17:54 +02003098exit:
Gilles Peskine64f13ef2020-08-25 23:15:20 +02003099 psa_mac_abort( &operation );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003100 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02003101 PSA_DONE( );
Gilles Peskine5e65cec2020-08-25 23:38:39 +02003102 mbedtls_free( actual_mac );
Gilles Peskinea7aa4422018-08-14 15:17:54 +02003103}
3104/* END_CASE */
3105
3106/* BEGIN_CASE */
Gilles Peskinec0ec9722018-06-18 17:03:37 +02003107void mac_verify( int key_type_arg,
3108 data_t *key,
3109 int alg_arg,
3110 data_t *input,
3111 data_t *expected_mac )
Gilles Peskine8c9def32018-02-08 10:02:12 +01003112{
Ronald Cron91e95152020-07-30 17:48:03 +02003113 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskine8c9def32018-02-08 10:02:12 +01003114 psa_key_type_t key_type = key_type_arg;
3115 psa_algorithm_t alg = alg_arg;
Jaeden Amero769ce272019-01-04 11:48:03 +00003116 psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003117 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine29c4a6c2020-08-26 00:01:39 +02003118 uint8_t *perturbed_mac = NULL;
Gilles Peskine8c9def32018-02-08 10:02:12 +01003119
Gilles Peskine69c12672018-06-28 00:07:19 +02003120 TEST_ASSERT( expected_mac->len <= PSA_MAC_MAX_SIZE );
3121
Gilles Peskine8817f612018-12-18 00:18:46 +01003122 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine8c9def32018-02-08 10:02:12 +01003123
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01003124 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_VERIFY_HASH );
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003125 psa_set_key_algorithm( &attributes, alg );
3126 psa_set_key_type( &attributes, key_type );
mohammad16036df908f2018-04-02 08:34:15 -07003127
Gilles Peskine73676cb2019-05-15 20:15:10 +02003128 PSA_ASSERT( psa_import_key( &attributes, key->x, key->len, &handle ) );
Gilles Peskinec0ec9722018-06-18 17:03:37 +02003129
Gilles Peskine29c4a6c2020-08-26 00:01:39 +02003130 /* Test the correct MAC. */
Gilles Peskine8817f612018-12-18 00:18:46 +01003131 PSA_ASSERT( psa_mac_verify_setup( &operation,
3132 handle, alg ) );
Gilles Peskine8817f612018-12-18 00:18:46 +01003133 PSA_ASSERT( psa_mac_update( &operation,
3134 input->x, input->len ) );
3135 PSA_ASSERT( psa_mac_verify_finish( &operation,
3136 expected_mac->x,
3137 expected_mac->len ) );
Gilles Peskine8c9def32018-02-08 10:02:12 +01003138
Gilles Peskine29c4a6c2020-08-26 00:01:39 +02003139 /* Test a MAC that's too short. */
3140 PSA_ASSERT( psa_mac_verify_setup( &operation,
3141 handle, alg ) );
3142 PSA_ASSERT( psa_mac_update( &operation,
3143 input->x, input->len ) );
3144 TEST_EQUAL( psa_mac_verify_finish( &operation,
3145 expected_mac->x,
3146 expected_mac->len - 1 ),
3147 PSA_ERROR_INVALID_SIGNATURE );
3148
3149 /* Test a MAC that's too long. */
3150 ASSERT_ALLOC( perturbed_mac, expected_mac->len + 1 );
3151 memcpy( perturbed_mac, expected_mac->x, expected_mac->len );
3152 PSA_ASSERT( psa_mac_verify_setup( &operation,
3153 handle, alg ) );
3154 PSA_ASSERT( psa_mac_update( &operation,
3155 input->x, input->len ) );
3156 TEST_EQUAL( psa_mac_verify_finish( &operation,
3157 perturbed_mac,
3158 expected_mac->len + 1 ),
3159 PSA_ERROR_INVALID_SIGNATURE );
3160
3161 /* Test changing one byte. */
3162 for( size_t i = 0; i < expected_mac->len; i++ )
3163 {
3164 test_set_step( i );
3165 perturbed_mac[i] ^= 1;
3166 PSA_ASSERT( psa_mac_verify_setup( &operation,
3167 handle, alg ) );
3168 PSA_ASSERT( psa_mac_update( &operation,
3169 input->x, input->len ) );
3170 TEST_EQUAL( psa_mac_verify_finish( &operation,
3171 perturbed_mac,
3172 expected_mac->len ),
3173 PSA_ERROR_INVALID_SIGNATURE );
3174 perturbed_mac[i] ^= 1;
3175 }
3176
Gilles Peskine8c9def32018-02-08 10:02:12 +01003177exit:
Gilles Peskine64f13ef2020-08-25 23:15:20 +02003178 psa_mac_abort( &operation );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003179 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02003180 PSA_DONE( );
Gilles Peskine29c4a6c2020-08-26 00:01:39 +02003181 mbedtls_free( perturbed_mac );
Gilles Peskine8c9def32018-02-08 10:02:12 +01003182}
3183/* END_CASE */
3184
3185/* BEGIN_CASE */
Jaeden Amero5bae2272019-01-04 11:48:27 +00003186void cipher_operation_init( )
3187{
Jaeden Ameroab439972019-02-15 14:12:05 +00003188 const uint8_t input[1] = { 0 };
3189 unsigned char output[1] = { 0 };
3190 size_t output_length;
Jaeden Amero5bae2272019-01-04 11:48:27 +00003191 /* Test each valid way of initializing the object, except for `= {0}`, as
3192 * Clang 5 complains when `-Wmissing-field-initializers` is used, even
3193 * though it's OK by the C standard. We could test for this, but we'd need
3194 * to supress the Clang warning for the test. */
3195 psa_cipher_operation_t func = psa_cipher_operation_init( );
3196 psa_cipher_operation_t init = PSA_CIPHER_OPERATION_INIT;
3197 psa_cipher_operation_t zero;
3198
3199 memset( &zero, 0, sizeof( zero ) );
3200
Jaeden Ameroab439972019-02-15 14:12:05 +00003201 /* A freshly-initialized cipher operation should not be usable. */
3202 TEST_EQUAL( psa_cipher_update( &func,
3203 input, sizeof( input ),
3204 output, sizeof( output ),
3205 &output_length ),
3206 PSA_ERROR_BAD_STATE );
3207 TEST_EQUAL( psa_cipher_update( &init,
3208 input, sizeof( input ),
3209 output, sizeof( output ),
3210 &output_length ),
3211 PSA_ERROR_BAD_STATE );
3212 TEST_EQUAL( psa_cipher_update( &zero,
3213 input, sizeof( input ),
3214 output, sizeof( output ),
3215 &output_length ),
3216 PSA_ERROR_BAD_STATE );
3217
Jaeden Amero5229bbb2019-02-07 16:33:37 +00003218 /* A default cipher operation should be abortable without error. */
3219 PSA_ASSERT( psa_cipher_abort( &func ) );
3220 PSA_ASSERT( psa_cipher_abort( &init ) );
3221 PSA_ASSERT( psa_cipher_abort( &zero ) );
Jaeden Amero5bae2272019-01-04 11:48:27 +00003222}
3223/* END_CASE */
3224
3225/* BEGIN_CASE */
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02003226void cipher_setup( int key_type_arg,
3227 data_t *key,
3228 int alg_arg,
3229 int expected_status_arg )
3230{
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02003231 psa_key_type_t key_type = key_type_arg;
3232 psa_algorithm_t alg = alg_arg;
Gilles Peskineb866e2b2018-06-21 09:25:10 +02003233 psa_status_t expected_status = expected_status_arg;
Jaeden Amero5bae2272019-01-04 11:48:27 +00003234 psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02003235 psa_status_t status;
Gilles Peskinef426e0f2019-02-25 17:42:03 +01003236#if defined(KNOWN_SUPPORTED_MAC_ALG)
3237 const uint8_t smoke_test_key_data[16] = "kkkkkkkkkkkkkkkk";
3238#endif
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02003239
Gilles Peskine8817f612018-12-18 00:18:46 +01003240 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02003241
Gilles Peskinef426e0f2019-02-25 17:42:03 +01003242 if( ! exercise_cipher_setup( key_type, key->x, key->len, alg,
3243 &operation, &status ) )
3244 goto exit;
Gilles Peskinefe11b722018-12-18 00:24:04 +01003245 TEST_EQUAL( status, expected_status );
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02003246
Gilles Peskinef426e0f2019-02-25 17:42:03 +01003247 /* The operation object should be reusable. */
3248#if defined(KNOWN_SUPPORTED_CIPHER_ALG)
3249 if( ! exercise_cipher_setup( KNOWN_SUPPORTED_CIPHER_KEY_TYPE,
3250 smoke_test_key_data,
3251 sizeof( smoke_test_key_data ),
3252 KNOWN_SUPPORTED_CIPHER_ALG,
3253 &operation, &status ) )
3254 goto exit;
3255 TEST_EQUAL( status, PSA_SUCCESS );
3256#endif
3257
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02003258exit:
Gilles Peskine64f13ef2020-08-25 23:15:20 +02003259 psa_cipher_abort( &operation );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02003260 PSA_DONE( );
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02003261}
3262/* END_CASE */
3263
3264/* BEGIN_CASE */
Jaeden Ameroab439972019-02-15 14:12:05 +00003265void cipher_bad_order( )
3266{
Ronald Cron91e95152020-07-30 17:48:03 +02003267 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Jaeden Ameroab439972019-02-15 14:12:05 +00003268 psa_key_type_t key_type = PSA_KEY_TYPE_AES;
3269 psa_algorithm_t alg = PSA_ALG_CBC_PKCS7;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003270 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Jaeden Ameroab439972019-02-15 14:12:05 +00003271 psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT;
3272 unsigned char iv[PSA_BLOCK_CIPHER_BLOCK_SIZE(PSA_KEY_TYPE_AES)] = { 0 };
3273 const uint8_t key[] = {
3274 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
3275 0xaa, 0xaa, 0xaa, 0xaa };
3276 const uint8_t text[] = {
3277 0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0xbb,
3278 0xbb, 0xbb, 0xbb, 0xbb };
3279 uint8_t buffer[PSA_BLOCK_CIPHER_BLOCK_SIZE(PSA_KEY_TYPE_AES)] = { 0 };
3280 size_t length = 0;
3281
3282 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003283 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT );
3284 psa_set_key_algorithm( &attributes, alg );
3285 psa_set_key_type( &attributes, key_type );
Gilles Peskine73676cb2019-05-15 20:15:10 +02003286 PSA_ASSERT( psa_import_key( &attributes, key, sizeof( key ), &handle ) );
Jaeden Ameroab439972019-02-15 14:12:05 +00003287
3288
Jaeden Amero36ee5d02019-02-19 09:25:10 +00003289 /* Call encrypt setup twice in a row. */
3290 PSA_ASSERT( psa_cipher_encrypt_setup( &operation, handle, alg ) );
3291 TEST_EQUAL( psa_cipher_encrypt_setup( &operation, handle, alg ),
3292 PSA_ERROR_BAD_STATE );
3293 PSA_ASSERT( psa_cipher_abort( &operation ) );
3294
3295 /* Call decrypt setup twice in a row. */
3296 PSA_ASSERT( psa_cipher_decrypt_setup( &operation, handle, alg ) );
3297 TEST_EQUAL( psa_cipher_decrypt_setup( &operation, handle, alg ),
3298 PSA_ERROR_BAD_STATE );
3299 PSA_ASSERT( psa_cipher_abort( &operation ) );
3300
Jaeden Ameroab439972019-02-15 14:12:05 +00003301 /* Generate an IV without calling setup beforehand. */
3302 TEST_EQUAL( psa_cipher_generate_iv( &operation,
3303 buffer, sizeof( buffer ),
3304 &length ),
3305 PSA_ERROR_BAD_STATE );
3306 PSA_ASSERT( psa_cipher_abort( &operation ) );
3307
3308 /* Generate an IV twice in a row. */
3309 PSA_ASSERT( psa_cipher_encrypt_setup( &operation, handle, alg ) );
3310 PSA_ASSERT( psa_cipher_generate_iv( &operation,
3311 buffer, sizeof( buffer ),
3312 &length ) );
3313 TEST_EQUAL( psa_cipher_generate_iv( &operation,
3314 buffer, sizeof( buffer ),
3315 &length ),
3316 PSA_ERROR_BAD_STATE );
3317 PSA_ASSERT( psa_cipher_abort( &operation ) );
3318
3319 /* Generate an IV after it's already set. */
3320 PSA_ASSERT( psa_cipher_encrypt_setup( &operation, handle, alg ) );
3321 PSA_ASSERT( psa_cipher_set_iv( &operation,
3322 iv, sizeof( iv ) ) );
3323 TEST_EQUAL( psa_cipher_generate_iv( &operation,
3324 buffer, sizeof( buffer ),
3325 &length ),
3326 PSA_ERROR_BAD_STATE );
3327 PSA_ASSERT( psa_cipher_abort( &operation ) );
3328
3329 /* Set an IV without calling setup beforehand. */
3330 TEST_EQUAL( psa_cipher_set_iv( &operation,
3331 iv, sizeof( iv ) ),
3332 PSA_ERROR_BAD_STATE );
3333 PSA_ASSERT( psa_cipher_abort( &operation ) );
3334
3335 /* Set an IV after it's already set. */
3336 PSA_ASSERT( psa_cipher_encrypt_setup( &operation, handle, alg ) );
3337 PSA_ASSERT( psa_cipher_set_iv( &operation,
3338 iv, sizeof( iv ) ) );
3339 TEST_EQUAL( psa_cipher_set_iv( &operation,
3340 iv, sizeof( iv ) ),
3341 PSA_ERROR_BAD_STATE );
3342 PSA_ASSERT( psa_cipher_abort( &operation ) );
3343
3344 /* Set an IV after it's already generated. */
3345 PSA_ASSERT( psa_cipher_encrypt_setup( &operation, handle, alg ) );
3346 PSA_ASSERT( psa_cipher_generate_iv( &operation,
3347 buffer, sizeof( buffer ),
3348 &length ) );
3349 TEST_EQUAL( psa_cipher_set_iv( &operation,
3350 iv, sizeof( iv ) ),
3351 PSA_ERROR_BAD_STATE );
3352 PSA_ASSERT( psa_cipher_abort( &operation ) );
3353
3354 /* Call update without calling setup beforehand. */
3355 TEST_EQUAL( psa_cipher_update( &operation,
3356 text, sizeof( text ),
3357 buffer, sizeof( buffer ),
3358 &length ),
3359 PSA_ERROR_BAD_STATE );
3360 PSA_ASSERT( psa_cipher_abort( &operation ) );
3361
3362 /* Call update without an IV where an IV is required. */
3363 TEST_EQUAL( psa_cipher_update( &operation,
3364 text, sizeof( text ),
3365 buffer, sizeof( buffer ),
3366 &length ),
3367 PSA_ERROR_BAD_STATE );
3368 PSA_ASSERT( psa_cipher_abort( &operation ) );
3369
3370 /* Call update after finish. */
3371 PSA_ASSERT( psa_cipher_encrypt_setup( &operation, handle, alg ) );
3372 PSA_ASSERT( psa_cipher_set_iv( &operation,
3373 iv, sizeof( iv ) ) );
3374 PSA_ASSERT( psa_cipher_finish( &operation,
3375 buffer, sizeof( buffer ), &length ) );
3376 TEST_EQUAL( psa_cipher_update( &operation,
3377 text, sizeof( text ),
3378 buffer, sizeof( buffer ),
3379 &length ),
3380 PSA_ERROR_BAD_STATE );
3381 PSA_ASSERT( psa_cipher_abort( &operation ) );
3382
3383 /* Call finish without calling setup beforehand. */
3384 TEST_EQUAL( psa_cipher_finish( &operation,
3385 buffer, sizeof( buffer ), &length ),
3386 PSA_ERROR_BAD_STATE );
3387 PSA_ASSERT( psa_cipher_abort( &operation ) );
3388
3389 /* Call finish without an IV where an IV is required. */
3390 PSA_ASSERT( psa_cipher_encrypt_setup( &operation, handle, alg ) );
3391 /* Not calling update means we are encrypting an empty buffer, which is OK
3392 * for cipher modes with padding. */
3393 TEST_EQUAL( psa_cipher_finish( &operation,
3394 buffer, sizeof( buffer ), &length ),
3395 PSA_ERROR_BAD_STATE );
3396 PSA_ASSERT( psa_cipher_abort( &operation ) );
3397
3398 /* Call finish twice in a row. */
3399 PSA_ASSERT( psa_cipher_encrypt_setup( &operation, handle, alg ) );
3400 PSA_ASSERT( psa_cipher_set_iv( &operation,
3401 iv, sizeof( iv ) ) );
3402 PSA_ASSERT( psa_cipher_finish( &operation,
3403 buffer, sizeof( buffer ), &length ) );
3404 TEST_EQUAL( psa_cipher_finish( &operation,
3405 buffer, sizeof( buffer ), &length ),
3406 PSA_ERROR_BAD_STATE );
3407 PSA_ASSERT( psa_cipher_abort( &operation ) );
3408
Gilles Peskine76b29a72019-05-28 14:08:50 +02003409 PSA_ASSERT( psa_destroy_key( handle ) );
3410
Jaeden Ameroab439972019-02-15 14:12:05 +00003411exit:
Gilles Peskine64f13ef2020-08-25 23:15:20 +02003412 psa_cipher_abort( &operation );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02003413 PSA_DONE( );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003414}
3415/* END_CASE */
Gilles Peskine50e586b2018-06-08 14:28:46 +02003416
Gilles Peskine50e586b2018-06-08 14:28:46 +02003417/* BEGIN_CASE */
Gilles Peskine50e586b2018-06-08 14:28:46 +02003418void cipher_encrypt( int alg_arg, int key_type_arg,
Gilles Peskine423005e2019-05-06 15:22:57 +02003419 data_t *key, data_t *iv,
Gilles Peskine50e586b2018-06-08 14:28:46 +02003420 data_t *input, data_t *expected_output,
Gilles Peskineb866e2b2018-06-21 09:25:10 +02003421 int expected_status_arg )
Gilles Peskine50e586b2018-06-08 14:28:46 +02003422{
Ronald Cron91e95152020-07-30 17:48:03 +02003423 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskine50e586b2018-06-08 14:28:46 +02003424 psa_status_t status;
3425 psa_key_type_t key_type = key_type_arg;
3426 psa_algorithm_t alg = alg_arg;
Gilles Peskineb866e2b2018-06-21 09:25:10 +02003427 psa_status_t expected_status = expected_status_arg;
Gilles Peskine50e586b2018-06-08 14:28:46 +02003428 unsigned char *output = NULL;
3429 size_t output_buffer_size = 0;
3430 size_t function_output_length = 0;
3431 size_t total_output_length = 0;
Jaeden Amero5bae2272019-01-04 11:48:27 +00003432 psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003433 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine50e586b2018-06-08 14:28:46 +02003434
Gilles Peskine8817f612018-12-18 00:18:46 +01003435 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003436
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003437 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_ENCRYPT );
3438 psa_set_key_algorithm( &attributes, alg );
3439 psa_set_key_type( &attributes, key_type );
Moran Pekered346952018-07-05 15:22:45 +03003440
Gilles Peskine73676cb2019-05-15 20:15:10 +02003441 PSA_ASSERT( psa_import_key( &attributes, key->x, key->len, &handle ) );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003442
Gilles Peskine8817f612018-12-18 00:18:46 +01003443 PSA_ASSERT( psa_cipher_encrypt_setup( &operation,
3444 handle, alg ) );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003445
Steven Cooremaned3c9ec2020-07-06 14:08:59 +02003446 if( iv->len > 0 )
3447 {
Steven Cooremana6033e92020-08-25 11:47:50 +02003448 PSA_ASSERT( psa_cipher_set_iv( &operation, iv->x, iv->len ) );
Steven Cooremaned3c9ec2020-07-06 14:08:59 +02003449 }
3450
Gilles Peskine9d8eea72018-12-17 23:34:57 +01003451 output_buffer_size = ( (size_t) input->len +
3452 PSA_BLOCK_CIPHER_BLOCK_SIZE( key_type ) );
Gilles Peskine8cebbba2018-09-27 13:54:18 +02003453 ASSERT_ALLOC( output, output_buffer_size );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003454
Gilles Peskine8817f612018-12-18 00:18:46 +01003455 PSA_ASSERT( psa_cipher_update( &operation,
3456 input->x, input->len,
3457 output, output_buffer_size,
3458 &function_output_length ) );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003459 total_output_length += function_output_length;
3460 status = psa_cipher_finish( &operation,
Gilles Peskineee46fe72019-02-19 19:05:33 +01003461 output + total_output_length,
3462 output_buffer_size - total_output_length,
Gilles Peskine50e586b2018-06-08 14:28:46 +02003463 &function_output_length );
3464 total_output_length += function_output_length;
3465
Gilles Peskinefe11b722018-12-18 00:24:04 +01003466 TEST_EQUAL( status, expected_status );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003467 if( expected_status == PSA_SUCCESS )
3468 {
Gilles Peskine8817f612018-12-18 00:18:46 +01003469 PSA_ASSERT( psa_cipher_abort( &operation ) );
Gilles Peskinebd7dea92018-09-27 13:57:19 +02003470 ASSERT_COMPARE( expected_output->x, expected_output->len,
3471 output, total_output_length );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003472 }
3473
3474exit:
Gilles Peskine64f13ef2020-08-25 23:15:20 +02003475 psa_cipher_abort( &operation );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003476 mbedtls_free( output );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003477 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02003478 PSA_DONE( );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003479}
3480/* END_CASE */
3481
3482/* BEGIN_CASE */
3483void cipher_encrypt_multipart( int alg_arg, int key_type_arg,
Gilles Peskine423005e2019-05-06 15:22:57 +02003484 data_t *key, data_t *iv,
Gilles Peskine50e586b2018-06-08 14:28:46 +02003485 data_t *input,
Gilles Peskinee0866522019-02-19 19:44:00 +01003486 int first_part_size_arg,
3487 int output1_length_arg, int output2_length_arg,
Gilles Peskine50e586b2018-06-08 14:28:46 +02003488 data_t *expected_output )
3489{
Ronald Cron91e95152020-07-30 17:48:03 +02003490 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskine50e586b2018-06-08 14:28:46 +02003491 psa_key_type_t key_type = key_type_arg;
3492 psa_algorithm_t alg = alg_arg;
Gilles Peskinee0866522019-02-19 19:44:00 +01003493 size_t first_part_size = first_part_size_arg;
3494 size_t output1_length = output1_length_arg;
3495 size_t output2_length = output2_length_arg;
Gilles Peskine50e586b2018-06-08 14:28:46 +02003496 unsigned char *output = NULL;
3497 size_t output_buffer_size = 0;
3498 size_t function_output_length = 0;
3499 size_t total_output_length = 0;
Jaeden Amero5bae2272019-01-04 11:48:27 +00003500 psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003501 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine50e586b2018-06-08 14:28:46 +02003502
Gilles Peskine8817f612018-12-18 00:18:46 +01003503 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003504
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003505 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_ENCRYPT );
3506 psa_set_key_algorithm( &attributes, alg );
3507 psa_set_key_type( &attributes, key_type );
Moran Pekered346952018-07-05 15:22:45 +03003508
Gilles Peskine73676cb2019-05-15 20:15:10 +02003509 PSA_ASSERT( psa_import_key( &attributes, key->x, key->len, &handle ) );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003510
Gilles Peskine8817f612018-12-18 00:18:46 +01003511 PSA_ASSERT( psa_cipher_encrypt_setup( &operation,
3512 handle, alg ) );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003513
Steven Cooremaned3c9ec2020-07-06 14:08:59 +02003514 if( iv->len > 0 )
3515 {
Steven Cooremana6033e92020-08-25 11:47:50 +02003516 PSA_ASSERT( psa_cipher_set_iv( &operation, iv->x, iv->len ) );
Steven Cooremaned3c9ec2020-07-06 14:08:59 +02003517 }
3518
Gilles Peskine9d8eea72018-12-17 23:34:57 +01003519 output_buffer_size = ( (size_t) input->len +
3520 PSA_BLOCK_CIPHER_BLOCK_SIZE( key_type ) );
Gilles Peskine8cebbba2018-09-27 13:54:18 +02003521 ASSERT_ALLOC( output, output_buffer_size );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003522
Gilles Peskinee0866522019-02-19 19:44:00 +01003523 TEST_ASSERT( first_part_size <= input->len );
Gilles Peskine8817f612018-12-18 00:18:46 +01003524 PSA_ASSERT( psa_cipher_update( &operation, input->x, first_part_size,
3525 output, output_buffer_size,
3526 &function_output_length ) );
Gilles Peskinee0866522019-02-19 19:44:00 +01003527 TEST_ASSERT( function_output_length == output1_length );
Gilles Peskinea7ec95f2018-06-08 14:40:59 +02003528 total_output_length += function_output_length;
Gilles Peskine8817f612018-12-18 00:18:46 +01003529 PSA_ASSERT( psa_cipher_update( &operation,
3530 input->x + first_part_size,
3531 input->len - first_part_size,
Gilles Peskineee46fe72019-02-19 19:05:33 +01003532 output + total_output_length,
3533 output_buffer_size - total_output_length,
Gilles Peskine8817f612018-12-18 00:18:46 +01003534 &function_output_length ) );
Gilles Peskinee0866522019-02-19 19:44:00 +01003535 TEST_ASSERT( function_output_length == output2_length );
Gilles Peskinea7ec95f2018-06-08 14:40:59 +02003536 total_output_length += function_output_length;
Gilles Peskine8817f612018-12-18 00:18:46 +01003537 PSA_ASSERT( psa_cipher_finish( &operation,
Gilles Peskineee46fe72019-02-19 19:05:33 +01003538 output + total_output_length,
3539 output_buffer_size - total_output_length,
Gilles Peskine8817f612018-12-18 00:18:46 +01003540 &function_output_length ) );
Gilles Peskinea7ec95f2018-06-08 14:40:59 +02003541 total_output_length += function_output_length;
Gilles Peskine8817f612018-12-18 00:18:46 +01003542 PSA_ASSERT( psa_cipher_abort( &operation ) );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003543
Gilles Peskinebd7dea92018-09-27 13:57:19 +02003544 ASSERT_COMPARE( expected_output->x, expected_output->len,
3545 output, total_output_length );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003546
3547exit:
Gilles Peskine64f13ef2020-08-25 23:15:20 +02003548 psa_cipher_abort( &operation );
itayzafrir3e02b3b2018-06-12 17:06:52 +03003549 mbedtls_free( output );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003550 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02003551 PSA_DONE( );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003552}
3553/* END_CASE */
3554
3555/* BEGIN_CASE */
3556void cipher_decrypt_multipart( int alg_arg, int key_type_arg,
Gilles Peskine423005e2019-05-06 15:22:57 +02003557 data_t *key, data_t *iv,
itayzafrir3e02b3b2018-06-12 17:06:52 +03003558 data_t *input,
Gilles Peskinee0866522019-02-19 19:44:00 +01003559 int first_part_size_arg,
3560 int output1_length_arg, int output2_length_arg,
itayzafrir3e02b3b2018-06-12 17:06:52 +03003561 data_t *expected_output )
Gilles Peskine50e586b2018-06-08 14:28:46 +02003562{
Ronald Cron91e95152020-07-30 17:48:03 +02003563 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskine50e586b2018-06-08 14:28:46 +02003564 psa_key_type_t key_type = key_type_arg;
3565 psa_algorithm_t alg = alg_arg;
Gilles Peskinee0866522019-02-19 19:44:00 +01003566 size_t first_part_size = first_part_size_arg;
3567 size_t output1_length = output1_length_arg;
3568 size_t output2_length = output2_length_arg;
itayzafrir3e02b3b2018-06-12 17:06:52 +03003569 unsigned char *output = NULL;
Gilles Peskine50e586b2018-06-08 14:28:46 +02003570 size_t output_buffer_size = 0;
3571 size_t function_output_length = 0;
Gilles Peskinea7ec95f2018-06-08 14:40:59 +02003572 size_t total_output_length = 0;
Jaeden Amero5bae2272019-01-04 11:48:27 +00003573 psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003574 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine50e586b2018-06-08 14:28:46 +02003575
Gilles Peskine8817f612018-12-18 00:18:46 +01003576 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003577
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003578 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DECRYPT );
3579 psa_set_key_algorithm( &attributes, alg );
3580 psa_set_key_type( &attributes, key_type );
Moran Pekered346952018-07-05 15:22:45 +03003581
Gilles Peskine73676cb2019-05-15 20:15:10 +02003582 PSA_ASSERT( psa_import_key( &attributes, key->x, key->len, &handle ) );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003583
Gilles Peskine8817f612018-12-18 00:18:46 +01003584 PSA_ASSERT( psa_cipher_decrypt_setup( &operation,
3585 handle, alg ) );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003586
Steven Cooreman177deba2020-09-07 17:14:14 +02003587 if( iv->len > 0 )
3588 {
Steven Cooremana6033e92020-08-25 11:47:50 +02003589 PSA_ASSERT( psa_cipher_set_iv( &operation, iv->x, iv->len ) );
Steven Cooremaned3c9ec2020-07-06 14:08:59 +02003590 }
Gilles Peskine50e586b2018-06-08 14:28:46 +02003591
Gilles Peskine9d8eea72018-12-17 23:34:57 +01003592 output_buffer_size = ( (size_t) input->len +
3593 PSA_BLOCK_CIPHER_BLOCK_SIZE( key_type ) );
Gilles Peskine8cebbba2018-09-27 13:54:18 +02003594 ASSERT_ALLOC( output, output_buffer_size );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003595
Gilles Peskinee0866522019-02-19 19:44:00 +01003596 TEST_ASSERT( first_part_size <= input->len );
Gilles Peskine8817f612018-12-18 00:18:46 +01003597 PSA_ASSERT( psa_cipher_update( &operation,
3598 input->x, first_part_size,
3599 output, output_buffer_size,
3600 &function_output_length ) );
Gilles Peskinee0866522019-02-19 19:44:00 +01003601 TEST_ASSERT( function_output_length == output1_length );
Gilles Peskinea7ec95f2018-06-08 14:40:59 +02003602 total_output_length += function_output_length;
Gilles Peskine8817f612018-12-18 00:18:46 +01003603 PSA_ASSERT( psa_cipher_update( &operation,
3604 input->x + first_part_size,
3605 input->len - first_part_size,
Gilles Peskineee46fe72019-02-19 19:05:33 +01003606 output + total_output_length,
3607 output_buffer_size - total_output_length,
Gilles Peskine8817f612018-12-18 00:18:46 +01003608 &function_output_length ) );
Gilles Peskinee0866522019-02-19 19:44:00 +01003609 TEST_ASSERT( function_output_length == output2_length );
Gilles Peskinea7ec95f2018-06-08 14:40:59 +02003610 total_output_length += function_output_length;
Gilles Peskine8817f612018-12-18 00:18:46 +01003611 PSA_ASSERT( psa_cipher_finish( &operation,
Gilles Peskineee46fe72019-02-19 19:05:33 +01003612 output + total_output_length,
3613 output_buffer_size - total_output_length,
Gilles Peskine8817f612018-12-18 00:18:46 +01003614 &function_output_length ) );
Gilles Peskinea7ec95f2018-06-08 14:40:59 +02003615 total_output_length += function_output_length;
Gilles Peskine8817f612018-12-18 00:18:46 +01003616 PSA_ASSERT( psa_cipher_abort( &operation ) );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003617
Gilles Peskinebd7dea92018-09-27 13:57:19 +02003618 ASSERT_COMPARE( expected_output->x, expected_output->len,
3619 output, total_output_length );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003620
3621exit:
Gilles Peskine64f13ef2020-08-25 23:15:20 +02003622 psa_cipher_abort( &operation );
itayzafrir3e02b3b2018-06-12 17:06:52 +03003623 mbedtls_free( output );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003624 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02003625 PSA_DONE( );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003626}
3627/* END_CASE */
3628
Gilles Peskine50e586b2018-06-08 14:28:46 +02003629/* BEGIN_CASE */
3630void cipher_decrypt( int alg_arg, int key_type_arg,
Gilles Peskine423005e2019-05-06 15:22:57 +02003631 data_t *key, data_t *iv,
itayzafrir3e02b3b2018-06-12 17:06:52 +03003632 data_t *input, data_t *expected_output,
Gilles Peskineb866e2b2018-06-21 09:25:10 +02003633 int expected_status_arg )
Gilles Peskine50e586b2018-06-08 14:28:46 +02003634{
Ronald Cron91e95152020-07-30 17:48:03 +02003635 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskine50e586b2018-06-08 14:28:46 +02003636 psa_status_t status;
3637 psa_key_type_t key_type = key_type_arg;
3638 psa_algorithm_t alg = alg_arg;
Gilles Peskineb866e2b2018-06-21 09:25:10 +02003639 psa_status_t expected_status = expected_status_arg;
itayzafrir3e02b3b2018-06-12 17:06:52 +03003640 unsigned char *output = NULL;
Gilles Peskine50e586b2018-06-08 14:28:46 +02003641 size_t output_buffer_size = 0;
3642 size_t function_output_length = 0;
Gilles Peskinea7ec95f2018-06-08 14:40:59 +02003643 size_t total_output_length = 0;
Jaeden Amero5bae2272019-01-04 11:48:27 +00003644 psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003645 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine50e586b2018-06-08 14:28:46 +02003646
Gilles Peskine8817f612018-12-18 00:18:46 +01003647 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003648
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003649 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DECRYPT );
3650 psa_set_key_algorithm( &attributes, alg );
3651 psa_set_key_type( &attributes, key_type );
Moran Pekered346952018-07-05 15:22:45 +03003652
Gilles Peskine73676cb2019-05-15 20:15:10 +02003653 PSA_ASSERT( psa_import_key( &attributes, key->x, key->len, &handle ) );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003654
Gilles Peskine8817f612018-12-18 00:18:46 +01003655 PSA_ASSERT( psa_cipher_decrypt_setup( &operation,
3656 handle, alg ) );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003657
Steven Cooreman177deba2020-09-07 17:14:14 +02003658 if( iv->len > 0 )
3659 {
Steven Cooremana6033e92020-08-25 11:47:50 +02003660 PSA_ASSERT( psa_cipher_set_iv( &operation, iv->x, iv->len ) );
Steven Cooremaned3c9ec2020-07-06 14:08:59 +02003661 }
Gilles Peskine50e586b2018-06-08 14:28:46 +02003662
Gilles Peskine9d8eea72018-12-17 23:34:57 +01003663 output_buffer_size = ( (size_t) input->len +
3664 PSA_BLOCK_CIPHER_BLOCK_SIZE( key_type ) );
Gilles Peskine8cebbba2018-09-27 13:54:18 +02003665 ASSERT_ALLOC( output, output_buffer_size );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003666
Gilles Peskine8817f612018-12-18 00:18:46 +01003667 PSA_ASSERT( psa_cipher_update( &operation,
3668 input->x, input->len,
3669 output, output_buffer_size,
3670 &function_output_length ) );
Gilles Peskinea7ec95f2018-06-08 14:40:59 +02003671 total_output_length += function_output_length;
Gilles Peskine50e586b2018-06-08 14:28:46 +02003672 status = psa_cipher_finish( &operation,
Gilles Peskineee46fe72019-02-19 19:05:33 +01003673 output + total_output_length,
3674 output_buffer_size - total_output_length,
Gilles Peskine50e586b2018-06-08 14:28:46 +02003675 &function_output_length );
Gilles Peskinea7ec95f2018-06-08 14:40:59 +02003676 total_output_length += function_output_length;
Gilles Peskinefe11b722018-12-18 00:24:04 +01003677 TEST_EQUAL( status, expected_status );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003678
3679 if( expected_status == PSA_SUCCESS )
3680 {
Gilles Peskine8817f612018-12-18 00:18:46 +01003681 PSA_ASSERT( psa_cipher_abort( &operation ) );
Gilles Peskinebd7dea92018-09-27 13:57:19 +02003682 ASSERT_COMPARE( expected_output->x, expected_output->len,
3683 output, total_output_length );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003684 }
3685
Gilles Peskine50e586b2018-06-08 14:28:46 +02003686exit:
Gilles Peskine64f13ef2020-08-25 23:15:20 +02003687 psa_cipher_abort( &operation );
itayzafrir3e02b3b2018-06-12 17:06:52 +03003688 mbedtls_free( output );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003689 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02003690 PSA_DONE( );
Gilles Peskine50e586b2018-06-08 14:28:46 +02003691}
3692/* END_CASE */
3693
Gilles Peskine50e586b2018-06-08 14:28:46 +02003694/* BEGIN_CASE */
3695void cipher_verify_output( int alg_arg, int key_type_arg,
itayzafrir3e02b3b2018-06-12 17:06:52 +03003696 data_t *key,
3697 data_t *input )
mohammad1603d7d7ba52018-03-12 18:51:53 +02003698{
Ronald Cron91e95152020-07-30 17:48:03 +02003699 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
mohammad1603d7d7ba52018-03-12 18:51:53 +02003700 psa_key_type_t key_type = key_type_arg;
3701 psa_algorithm_t alg = alg_arg;
mohammad1603e6b67a12018-03-12 10:38:49 -07003702 unsigned char iv[16] = {0};
mohammad1603d7d7ba52018-03-12 18:51:53 +02003703 size_t iv_size = 16;
3704 size_t iv_length = 0;
itayzafrir3e02b3b2018-06-12 17:06:52 +03003705 unsigned char *output1 = NULL;
mohammad1603d7d7ba52018-03-12 18:51:53 +02003706 size_t output1_size = 0;
3707 size_t output1_length = 0;
itayzafrir3e02b3b2018-06-12 17:06:52 +03003708 unsigned char *output2 = NULL;
mohammad1603d7d7ba52018-03-12 18:51:53 +02003709 size_t output2_size = 0;
3710 size_t output2_length = 0;
Gilles Peskine048b7f02018-06-08 14:20:49 +02003711 size_t function_output_length = 0;
Jaeden Amero5bae2272019-01-04 11:48:27 +00003712 psa_cipher_operation_t operation1 = PSA_CIPHER_OPERATION_INIT;
3713 psa_cipher_operation_t operation2 = PSA_CIPHER_OPERATION_INIT;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003714 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
mohammad1603d7d7ba52018-03-12 18:51:53 +02003715
Gilles Peskine8817f612018-12-18 00:18:46 +01003716 PSA_ASSERT( psa_crypto_init( ) );
mohammad1603d7d7ba52018-03-12 18:51:53 +02003717
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003718 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT );
3719 psa_set_key_algorithm( &attributes, alg );
3720 psa_set_key_type( &attributes, key_type );
Moran Pekered346952018-07-05 15:22:45 +03003721
Gilles Peskine73676cb2019-05-15 20:15:10 +02003722 PSA_ASSERT( psa_import_key( &attributes, key->x, key->len, &handle ) );
mohammad1603d7d7ba52018-03-12 18:51:53 +02003723
Gilles Peskine8817f612018-12-18 00:18:46 +01003724 PSA_ASSERT( psa_cipher_encrypt_setup( &operation1,
3725 handle, alg ) );
3726 PSA_ASSERT( psa_cipher_decrypt_setup( &operation2,
3727 handle, alg ) );
mohammad1603d7d7ba52018-03-12 18:51:53 +02003728
Steven Cooreman177deba2020-09-07 17:14:14 +02003729 if( alg != PSA_ALG_ECB_NO_PADDING )
3730 {
Steven Cooremana6033e92020-08-25 11:47:50 +02003731 PSA_ASSERT( psa_cipher_generate_iv( &operation1,
3732 iv, iv_size,
3733 &iv_length ) );
Steven Cooremaned3c9ec2020-07-06 14:08:59 +02003734 }
Gilles Peskine9d8eea72018-12-17 23:34:57 +01003735 output1_size = ( (size_t) input->len +
3736 PSA_BLOCK_CIPHER_BLOCK_SIZE( key_type ) );
Gilles Peskine8cebbba2018-09-27 13:54:18 +02003737 ASSERT_ALLOC( output1, output1_size );
Moran Pekerded84402018-06-06 16:36:50 +03003738
Gilles Peskine8817f612018-12-18 00:18:46 +01003739 PSA_ASSERT( psa_cipher_update( &operation1, input->x, input->len,
3740 output1, output1_size,
3741 &output1_length ) );
3742 PSA_ASSERT( psa_cipher_finish( &operation1,
Gilles Peskineee46fe72019-02-19 19:05:33 +01003743 output1 + output1_length,
3744 output1_size - output1_length,
Gilles Peskine8817f612018-12-18 00:18:46 +01003745 &function_output_length ) );
Gilles Peskine4ca9c3f2018-06-06 18:44:09 +02003746
Gilles Peskine048b7f02018-06-08 14:20:49 +02003747 output1_length += function_output_length;
Moran Pekerded84402018-06-06 16:36:50 +03003748
Gilles Peskine8817f612018-12-18 00:18:46 +01003749 PSA_ASSERT( psa_cipher_abort( &operation1 ) );
Moran Pekerded84402018-06-06 16:36:50 +03003750
3751 output2_size = output1_length;
Gilles Peskine8cebbba2018-09-27 13:54:18 +02003752 ASSERT_ALLOC( output2, output2_size );
Moran Pekerded84402018-06-06 16:36:50 +03003753
Steven Cooreman177deba2020-09-07 17:14:14 +02003754 if( iv_length > 0 )
3755 {
Steven Cooremana6033e92020-08-25 11:47:50 +02003756 PSA_ASSERT( psa_cipher_set_iv( &operation2,
3757 iv, iv_length ) );
Steven Cooremaned3c9ec2020-07-06 14:08:59 +02003758 }
3759
Gilles Peskine8817f612018-12-18 00:18:46 +01003760 PSA_ASSERT( psa_cipher_update( &operation2, output1, output1_length,
3761 output2, output2_size,
3762 &output2_length ) );
Gilles Peskine048b7f02018-06-08 14:20:49 +02003763 function_output_length = 0;
Gilles Peskine8817f612018-12-18 00:18:46 +01003764 PSA_ASSERT( psa_cipher_finish( &operation2,
3765 output2 + output2_length,
Gilles Peskineee46fe72019-02-19 19:05:33 +01003766 output2_size - output2_length,
Gilles Peskine8817f612018-12-18 00:18:46 +01003767 &function_output_length ) );
Moran Pekerded84402018-06-06 16:36:50 +03003768
Gilles Peskine048b7f02018-06-08 14:20:49 +02003769 output2_length += function_output_length;
Gilles Peskine4ca9c3f2018-06-06 18:44:09 +02003770
Gilles Peskine8817f612018-12-18 00:18:46 +01003771 PSA_ASSERT( psa_cipher_abort( &operation2 ) );
Moran Pekerded84402018-06-06 16:36:50 +03003772
Gilles Peskinebd7dea92018-09-27 13:57:19 +02003773 ASSERT_COMPARE( input->x, input->len, output2, output2_length );
Moran Pekerded84402018-06-06 16:36:50 +03003774
3775exit:
Gilles Peskine64f13ef2020-08-25 23:15:20 +02003776 psa_cipher_abort( &operation1 );
3777 psa_cipher_abort( &operation2 );
itayzafrir3e02b3b2018-06-12 17:06:52 +03003778 mbedtls_free( output1 );
3779 mbedtls_free( output2 );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003780 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02003781 PSA_DONE( );
Moran Pekerded84402018-06-06 16:36:50 +03003782}
3783/* END_CASE */
3784
3785/* BEGIN_CASE */
Gilles Peskine50e586b2018-06-08 14:28:46 +02003786void cipher_verify_output_multipart( int alg_arg,
3787 int key_type_arg,
itayzafrir3e02b3b2018-06-12 17:06:52 +03003788 data_t *key,
3789 data_t *input,
Gilles Peskinee0866522019-02-19 19:44:00 +01003790 int first_part_size_arg )
Moran Pekerded84402018-06-06 16:36:50 +03003791{
Ronald Cron91e95152020-07-30 17:48:03 +02003792 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Moran Pekerded84402018-06-06 16:36:50 +03003793 psa_key_type_t key_type = key_type_arg;
3794 psa_algorithm_t alg = alg_arg;
Gilles Peskinee0866522019-02-19 19:44:00 +01003795 size_t first_part_size = first_part_size_arg;
Moran Pekerded84402018-06-06 16:36:50 +03003796 unsigned char iv[16] = {0};
3797 size_t iv_size = 16;
3798 size_t iv_length = 0;
itayzafrir3e02b3b2018-06-12 17:06:52 +03003799 unsigned char *output1 = NULL;
Gilles Peskine048b7f02018-06-08 14:20:49 +02003800 size_t output1_buffer_size = 0;
Moran Pekerded84402018-06-06 16:36:50 +03003801 size_t output1_length = 0;
itayzafrir3e02b3b2018-06-12 17:06:52 +03003802 unsigned char *output2 = NULL;
Gilles Peskine048b7f02018-06-08 14:20:49 +02003803 size_t output2_buffer_size = 0;
Moran Pekerded84402018-06-06 16:36:50 +03003804 size_t output2_length = 0;
Gilles Peskine048b7f02018-06-08 14:20:49 +02003805 size_t function_output_length;
Jaeden Amero5bae2272019-01-04 11:48:27 +00003806 psa_cipher_operation_t operation1 = PSA_CIPHER_OPERATION_INIT;
3807 psa_cipher_operation_t operation2 = PSA_CIPHER_OPERATION_INIT;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003808 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Moran Pekerded84402018-06-06 16:36:50 +03003809
Gilles Peskine8817f612018-12-18 00:18:46 +01003810 PSA_ASSERT( psa_crypto_init( ) );
Moran Pekerded84402018-06-06 16:36:50 +03003811
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003812 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT );
3813 psa_set_key_algorithm( &attributes, alg );
3814 psa_set_key_type( &attributes, key_type );
Moran Pekered346952018-07-05 15:22:45 +03003815
Gilles Peskine73676cb2019-05-15 20:15:10 +02003816 PSA_ASSERT( psa_import_key( &attributes, key->x, key->len, &handle ) );
Moran Pekerded84402018-06-06 16:36:50 +03003817
Gilles Peskine8817f612018-12-18 00:18:46 +01003818 PSA_ASSERT( psa_cipher_encrypt_setup( &operation1,
3819 handle, alg ) );
3820 PSA_ASSERT( psa_cipher_decrypt_setup( &operation2,
3821 handle, alg ) );
Moran Pekerded84402018-06-06 16:36:50 +03003822
Steven Cooreman177deba2020-09-07 17:14:14 +02003823 if( alg != PSA_ALG_ECB_NO_PADDING )
3824 {
Steven Cooremana6033e92020-08-25 11:47:50 +02003825 PSA_ASSERT( psa_cipher_generate_iv( &operation1,
3826 iv, iv_size,
3827 &iv_length ) );
Steven Cooremaned3c9ec2020-07-06 14:08:59 +02003828 }
3829
Gilles Peskine9d8eea72018-12-17 23:34:57 +01003830 output1_buffer_size = ( (size_t) input->len +
3831 PSA_BLOCK_CIPHER_BLOCK_SIZE( key_type ) );
Gilles Peskine8cebbba2018-09-27 13:54:18 +02003832 ASSERT_ALLOC( output1, output1_buffer_size );
Moran Pekerded84402018-06-06 16:36:50 +03003833
Gilles Peskinee0866522019-02-19 19:44:00 +01003834 TEST_ASSERT( first_part_size <= input->len );
Gilles Peskine4ca9c3f2018-06-06 18:44:09 +02003835
Gilles Peskine8817f612018-12-18 00:18:46 +01003836 PSA_ASSERT( psa_cipher_update( &operation1, input->x, first_part_size,
3837 output1, output1_buffer_size,
3838 &function_output_length ) );
Gilles Peskine048b7f02018-06-08 14:20:49 +02003839 output1_length += function_output_length;
Moran Pekerded84402018-06-06 16:36:50 +03003840
Gilles Peskine8817f612018-12-18 00:18:46 +01003841 PSA_ASSERT( psa_cipher_update( &operation1,
3842 input->x + first_part_size,
3843 input->len - first_part_size,
3844 output1, output1_buffer_size,
3845 &function_output_length ) );
Gilles Peskine048b7f02018-06-08 14:20:49 +02003846 output1_length += function_output_length;
Moran Pekerded84402018-06-06 16:36:50 +03003847
Gilles Peskine8817f612018-12-18 00:18:46 +01003848 PSA_ASSERT( psa_cipher_finish( &operation1,
3849 output1 + output1_length,
3850 output1_buffer_size - output1_length,
3851 &function_output_length ) );
Gilles Peskine048b7f02018-06-08 14:20:49 +02003852 output1_length += function_output_length;
mohammad1603d7d7ba52018-03-12 18:51:53 +02003853
Gilles Peskine8817f612018-12-18 00:18:46 +01003854 PSA_ASSERT( psa_cipher_abort( &operation1 ) );
mohammad1603d7d7ba52018-03-12 18:51:53 +02003855
Gilles Peskine048b7f02018-06-08 14:20:49 +02003856 output2_buffer_size = output1_length;
Gilles Peskine8cebbba2018-09-27 13:54:18 +02003857 ASSERT_ALLOC( output2, output2_buffer_size );
mohammad1603d7d7ba52018-03-12 18:51:53 +02003858
Steven Cooreman177deba2020-09-07 17:14:14 +02003859 if( iv_length > 0 )
3860 {
Steven Cooremana6033e92020-08-25 11:47:50 +02003861 PSA_ASSERT( psa_cipher_set_iv( &operation2,
3862 iv, iv_length ) );
Steven Cooremaned3c9ec2020-07-06 14:08:59 +02003863 }
Moran Pekerded84402018-06-06 16:36:50 +03003864
Gilles Peskine8817f612018-12-18 00:18:46 +01003865 PSA_ASSERT( psa_cipher_update( &operation2, output1, first_part_size,
3866 output2, output2_buffer_size,
3867 &function_output_length ) );
Gilles Peskine048b7f02018-06-08 14:20:49 +02003868 output2_length += function_output_length;
Moran Pekerded84402018-06-06 16:36:50 +03003869
Gilles Peskine8817f612018-12-18 00:18:46 +01003870 PSA_ASSERT( psa_cipher_update( &operation2,
3871 output1 + first_part_size,
3872 output1_length - first_part_size,
3873 output2, output2_buffer_size,
3874 &function_output_length ) );
Gilles Peskine048b7f02018-06-08 14:20:49 +02003875 output2_length += function_output_length;
Moran Pekerded84402018-06-06 16:36:50 +03003876
Gilles Peskine8817f612018-12-18 00:18:46 +01003877 PSA_ASSERT( psa_cipher_finish( &operation2,
3878 output2 + output2_length,
3879 output2_buffer_size - output2_length,
3880 &function_output_length ) );
Gilles Peskine048b7f02018-06-08 14:20:49 +02003881 output2_length += function_output_length;
Gilles Peskine4ca9c3f2018-06-06 18:44:09 +02003882
Gilles Peskine8817f612018-12-18 00:18:46 +01003883 PSA_ASSERT( psa_cipher_abort( &operation2 ) );
mohammad1603d7d7ba52018-03-12 18:51:53 +02003884
Gilles Peskinebd7dea92018-09-27 13:57:19 +02003885 ASSERT_COMPARE( input->x, input->len, output2, output2_length );
mohammad1603d7d7ba52018-03-12 18:51:53 +02003886
3887exit:
Gilles Peskine64f13ef2020-08-25 23:15:20 +02003888 psa_cipher_abort( &operation1 );
3889 psa_cipher_abort( &operation2 );
itayzafrir3e02b3b2018-06-12 17:06:52 +03003890 mbedtls_free( output1 );
3891 mbedtls_free( output2 );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003892 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02003893 PSA_DONE( );
mohammad1603d7d7ba52018-03-12 18:51:53 +02003894}
3895/* END_CASE */
Gilles Peskine7268afc2018-06-06 15:19:24 +02003896
Gilles Peskine20035e32018-02-03 22:44:14 +01003897/* BEGIN_CASE */
Gilles Peskine7da96b02018-08-17 18:45:42 +02003898void aead_encrypt_decrypt( int key_type_arg, data_t *key_data,
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02003899 int alg_arg,
Gilles Peskine7da96b02018-08-17 18:45:42 +02003900 data_t *nonce,
3901 data_t *additional_data,
3902 data_t *input_data,
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02003903 int expected_result_arg )
Gilles Peskinea1cac842018-06-11 19:33:02 +02003904{
Ronald Cron91e95152020-07-30 17:48:03 +02003905 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskinea1cac842018-06-11 19:33:02 +02003906 psa_key_type_t key_type = key_type_arg;
3907 psa_algorithm_t alg = alg_arg;
Gilles Peskinea1cac842018-06-11 19:33:02 +02003908 unsigned char *output_data = NULL;
3909 size_t output_size = 0;
3910 size_t output_length = 0;
3911 unsigned char *output_data2 = NULL;
3912 size_t output_length2 = 0;
Gilles Peskine003a4a92019-05-14 16:09:40 +02003913 size_t tag_length = PSA_AEAD_TAG_LENGTH( alg );
Gilles Peskine4abf7412018-06-18 16:35:34 +02003914 psa_status_t expected_result = expected_result_arg;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003915 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskinea1cac842018-06-11 19:33:02 +02003916
Gilles Peskine4abf7412018-06-18 16:35:34 +02003917 output_size = input_data->len + tag_length;
Gilles Peskine003a4a92019-05-14 16:09:40 +02003918 /* For all currently defined algorithms, PSA_AEAD_ENCRYPT_OUTPUT_SIZE
3919 * should be exact. */
3920 if( expected_result != PSA_ERROR_INVALID_ARGUMENT )
3921 TEST_EQUAL( output_size,
3922 PSA_AEAD_ENCRYPT_OUTPUT_SIZE( alg, input_data->len ) );
Gilles Peskine8cebbba2018-09-27 13:54:18 +02003923 ASSERT_ALLOC( output_data, output_size );
Gilles Peskinea1cac842018-06-11 19:33:02 +02003924
Gilles Peskine8817f612018-12-18 00:18:46 +01003925 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskinea1cac842018-06-11 19:33:02 +02003926
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003927 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT );
3928 psa_set_key_algorithm( &attributes, alg );
3929 psa_set_key_type( &attributes, key_type );
Gilles Peskinea1cac842018-06-11 19:33:02 +02003930
Gilles Peskine049c7532019-05-15 20:22:09 +02003931 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
3932 &handle ) );
Gilles Peskinea1cac842018-06-11 19:33:02 +02003933
Gilles Peskinefe11b722018-12-18 00:24:04 +01003934 TEST_EQUAL( psa_aead_encrypt( handle, alg,
3935 nonce->x, nonce->len,
3936 additional_data->x,
3937 additional_data->len,
3938 input_data->x, input_data->len,
3939 output_data, output_size,
Gilles Peskinef812dcf2018-12-18 00:33:25 +01003940 &output_length ),
3941 expected_result );
Gilles Peskinea1cac842018-06-11 19:33:02 +02003942
3943 if( PSA_SUCCESS == expected_result )
3944 {
Gilles Peskine8cebbba2018-09-27 13:54:18 +02003945 ASSERT_ALLOC( output_data2, output_length );
Gilles Peskinea1cac842018-06-11 19:33:02 +02003946
Gilles Peskine003a4a92019-05-14 16:09:40 +02003947 /* For all currently defined algorithms, PSA_AEAD_DECRYPT_OUTPUT_SIZE
3948 * should be exact. */
3949 TEST_EQUAL( input_data->len,
3950 PSA_AEAD_DECRYPT_OUTPUT_SIZE( alg, output_length ) );
3951
Gilles Peskinefe11b722018-12-18 00:24:04 +01003952 TEST_EQUAL( psa_aead_decrypt( handle, alg,
3953 nonce->x, nonce->len,
3954 additional_data->x,
3955 additional_data->len,
3956 output_data, output_length,
3957 output_data2, output_length,
Gilles Peskinef812dcf2018-12-18 00:33:25 +01003958 &output_length2 ),
3959 expected_result );
Gilles Peskine2d277862018-06-18 15:41:12 +02003960
Gilles Peskinebd7dea92018-09-27 13:57:19 +02003961 ASSERT_COMPARE( input_data->x, input_data->len,
3962 output_data2, output_length2 );
Gilles Peskinea1cac842018-06-11 19:33:02 +02003963 }
Gilles Peskine2d277862018-06-18 15:41:12 +02003964
Gilles Peskinea1cac842018-06-11 19:33:02 +02003965exit:
Gilles Peskinebdf309c2018-12-03 15:36:32 +01003966 psa_destroy_key( handle );
Gilles Peskinea1cac842018-06-11 19:33:02 +02003967 mbedtls_free( output_data );
3968 mbedtls_free( output_data2 );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02003969 PSA_DONE( );
Gilles Peskinea1cac842018-06-11 19:33:02 +02003970}
3971/* END_CASE */
3972
3973/* BEGIN_CASE */
Gilles Peskine7da96b02018-08-17 18:45:42 +02003974void aead_encrypt( int key_type_arg, data_t *key_data,
3975 int alg_arg,
3976 data_t *nonce,
3977 data_t *additional_data,
3978 data_t *input_data,
3979 data_t *expected_result )
Gilles Peskinea1cac842018-06-11 19:33:02 +02003980{
Ronald Cron91e95152020-07-30 17:48:03 +02003981 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskinea1cac842018-06-11 19:33:02 +02003982 psa_key_type_t key_type = key_type_arg;
3983 psa_algorithm_t alg = alg_arg;
Gilles Peskinea1cac842018-06-11 19:33:02 +02003984 unsigned char *output_data = NULL;
3985 size_t output_size = 0;
3986 size_t output_length = 0;
Gilles Peskine003a4a92019-05-14 16:09:40 +02003987 size_t tag_length = PSA_AEAD_TAG_LENGTH( alg );
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003988 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskinea1cac842018-06-11 19:33:02 +02003989
Gilles Peskine4abf7412018-06-18 16:35:34 +02003990 output_size = input_data->len + tag_length;
Gilles Peskine003a4a92019-05-14 16:09:40 +02003991 /* For all currently defined algorithms, PSA_AEAD_ENCRYPT_OUTPUT_SIZE
3992 * should be exact. */
3993 TEST_EQUAL( output_size,
3994 PSA_AEAD_ENCRYPT_OUTPUT_SIZE( alg, input_data->len ) );
Gilles Peskine8cebbba2018-09-27 13:54:18 +02003995 ASSERT_ALLOC( output_data, output_size );
Gilles Peskine2d277862018-06-18 15:41:12 +02003996
Gilles Peskine8817f612018-12-18 00:18:46 +01003997 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskinea1cac842018-06-11 19:33:02 +02003998
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02003999 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_ENCRYPT );
4000 psa_set_key_algorithm( &attributes, alg );
4001 psa_set_key_type( &attributes, key_type );
Gilles Peskinea1cac842018-06-11 19:33:02 +02004002
Gilles Peskine049c7532019-05-15 20:22:09 +02004003 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
4004 &handle ) );
Gilles Peskinea1cac842018-06-11 19:33:02 +02004005
Gilles Peskine8817f612018-12-18 00:18:46 +01004006 PSA_ASSERT( psa_aead_encrypt( handle, alg,
4007 nonce->x, nonce->len,
4008 additional_data->x, additional_data->len,
4009 input_data->x, input_data->len,
4010 output_data, output_size,
4011 &output_length ) );
Gilles Peskinea1cac842018-06-11 19:33:02 +02004012
Gilles Peskinebd7dea92018-09-27 13:57:19 +02004013 ASSERT_COMPARE( expected_result->x, expected_result->len,
4014 output_data, output_length );
Gilles Peskine2d277862018-06-18 15:41:12 +02004015
Gilles Peskinea1cac842018-06-11 19:33:02 +02004016exit:
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004017 psa_destroy_key( handle );
Gilles Peskinea1cac842018-06-11 19:33:02 +02004018 mbedtls_free( output_data );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02004019 PSA_DONE( );
Gilles Peskinea1cac842018-06-11 19:33:02 +02004020}
4021/* END_CASE */
4022
4023/* BEGIN_CASE */
Gilles Peskine7da96b02018-08-17 18:45:42 +02004024void aead_decrypt( int key_type_arg, data_t *key_data,
4025 int alg_arg,
4026 data_t *nonce,
4027 data_t *additional_data,
4028 data_t *input_data,
4029 data_t *expected_data,
4030 int expected_result_arg )
Gilles Peskinea1cac842018-06-11 19:33:02 +02004031{
Ronald Cron91e95152020-07-30 17:48:03 +02004032 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskinea1cac842018-06-11 19:33:02 +02004033 psa_key_type_t key_type = key_type_arg;
4034 psa_algorithm_t alg = alg_arg;
Gilles Peskinea1cac842018-06-11 19:33:02 +02004035 unsigned char *output_data = NULL;
4036 size_t output_size = 0;
4037 size_t output_length = 0;
Gilles Peskine003a4a92019-05-14 16:09:40 +02004038 size_t tag_length = PSA_AEAD_TAG_LENGTH( alg );
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02004039 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine4abf7412018-06-18 16:35:34 +02004040 psa_status_t expected_result = expected_result_arg;
Gilles Peskinea1cac842018-06-11 19:33:02 +02004041
Gilles Peskine003a4a92019-05-14 16:09:40 +02004042 output_size = input_data->len - tag_length;
4043 /* For all currently defined algorithms, PSA_AEAD_DECRYPT_OUTPUT_SIZE
4044 * should be exact. */
4045 if( expected_result != PSA_ERROR_INVALID_ARGUMENT )
4046 TEST_EQUAL( output_size,
4047 PSA_AEAD_DECRYPT_OUTPUT_SIZE( alg, input_data->len ) );
Gilles Peskine8cebbba2018-09-27 13:54:18 +02004048 ASSERT_ALLOC( output_data, output_size );
Gilles Peskine2d277862018-06-18 15:41:12 +02004049
Gilles Peskine8817f612018-12-18 00:18:46 +01004050 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskinea1cac842018-06-11 19:33:02 +02004051
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02004052 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DECRYPT );
4053 psa_set_key_algorithm( &attributes, alg );
4054 psa_set_key_type( &attributes, key_type );
Gilles Peskinea1cac842018-06-11 19:33:02 +02004055
Gilles Peskine049c7532019-05-15 20:22:09 +02004056 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
4057 &handle ) );
Gilles Peskinea1cac842018-06-11 19:33:02 +02004058
Gilles Peskinefe11b722018-12-18 00:24:04 +01004059 TEST_EQUAL( psa_aead_decrypt( handle, alg,
4060 nonce->x, nonce->len,
4061 additional_data->x,
4062 additional_data->len,
4063 input_data->x, input_data->len,
4064 output_data, output_size,
Gilles Peskinef812dcf2018-12-18 00:33:25 +01004065 &output_length ),
4066 expected_result );
Gilles Peskinea1cac842018-06-11 19:33:02 +02004067
Gilles Peskine2d277862018-06-18 15:41:12 +02004068 if( expected_result == PSA_SUCCESS )
Gilles Peskinebd7dea92018-09-27 13:57:19 +02004069 ASSERT_COMPARE( expected_data->x, expected_data->len,
4070 output_data, output_length );
Gilles Peskinea1cac842018-06-11 19:33:02 +02004071
Gilles Peskinea1cac842018-06-11 19:33:02 +02004072exit:
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004073 psa_destroy_key( handle );
Gilles Peskinea1cac842018-06-11 19:33:02 +02004074 mbedtls_free( output_data );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02004075 PSA_DONE( );
Gilles Peskinea1cac842018-06-11 19:33:02 +02004076}
4077/* END_CASE */
4078
4079/* BEGIN_CASE */
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02004080void signature_size( int type_arg,
4081 int bits,
4082 int alg_arg,
4083 int expected_size_arg )
Gilles Peskinee59236f2018-01-27 23:32:46 +01004084{
4085 psa_key_type_t type = type_arg;
4086 psa_algorithm_t alg = alg_arg;
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01004087 size_t actual_size = PSA_SIGN_OUTPUT_SIZE( type, bits, alg );
Gilles Peskine841b14b2019-11-26 17:37:37 +01004088
Gilles Peskinefe11b722018-12-18 00:24:04 +01004089 TEST_EQUAL( actual_size, (size_t) expected_size_arg );
Gilles Peskine841b14b2019-11-26 17:37:37 +01004090#if defined(MBEDTLS_TEST_DEPRECATED)
4091 TEST_EQUAL( actual_size,
4092 PSA_ASYMMETRIC_SIGN_OUTPUT_SIZE( type, bits, alg ) );
4093#endif /* MBEDTLS_TEST_DEPRECATED */
4094
Gilles Peskinee59236f2018-01-27 23:32:46 +01004095exit:
4096 ;
4097}
4098/* END_CASE */
4099
4100/* BEGIN_CASE */
itayzafrir3e02b3b2018-06-12 17:06:52 +03004101void sign_deterministic( int key_type_arg, data_t *key_data,
4102 int alg_arg, data_t *input_data,
4103 data_t *output_data )
Gilles Peskinee59236f2018-01-27 23:32:46 +01004104{
Ronald Cron91e95152020-07-30 17:48:03 +02004105 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskinee59236f2018-01-27 23:32:46 +01004106 psa_key_type_t key_type = key_type_arg;
4107 psa_algorithm_t alg = alg_arg;
Gilles Peskine20035e32018-02-03 22:44:14 +01004108 size_t key_bits;
Gilles Peskine20035e32018-02-03 22:44:14 +01004109 unsigned char *signature = NULL;
4110 size_t signature_size;
4111 size_t signature_length = 0xdeadbeef;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02004112 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine20035e32018-02-03 22:44:14 +01004113
Gilles Peskine8817f612018-12-18 00:18:46 +01004114 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine20035e32018-02-03 22:44:14 +01004115
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01004116 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_SIGN_HASH );
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02004117 psa_set_key_algorithm( &attributes, alg );
4118 psa_set_key_type( &attributes, key_type );
mohammad1603a97cb8c2018-03-28 03:46:26 -07004119
Gilles Peskine049c7532019-05-15 20:22:09 +02004120 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
4121 &handle ) );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02004122 PSA_ASSERT( psa_get_key_attributes( handle, &attributes ) );
4123 key_bits = psa_get_key_bits( &attributes );
Gilles Peskine20035e32018-02-03 22:44:14 +01004124
Gilles Peskine860ce9d2018-06-28 12:23:00 +02004125 /* Allocate a buffer which has the size advertized by the
4126 * library. */
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01004127 signature_size = PSA_SIGN_OUTPUT_SIZE( key_type,
Gilles Peskinec1bb6c82018-06-18 16:04:39 +02004128 key_bits, alg );
Gilles Peskine20035e32018-02-03 22:44:14 +01004129 TEST_ASSERT( signature_size != 0 );
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01004130 TEST_ASSERT( signature_size <= PSA_SIGNATURE_MAX_SIZE );
Gilles Peskine8cebbba2018-09-27 13:54:18 +02004131 ASSERT_ALLOC( signature, signature_size );
Gilles Peskine20035e32018-02-03 22:44:14 +01004132
Gilles Peskine860ce9d2018-06-28 12:23:00 +02004133 /* Perform the signature. */
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01004134 PSA_ASSERT( psa_sign_hash( handle, alg,
4135 input_data->x, input_data->len,
4136 signature, signature_size,
4137 &signature_length ) );
Gilles Peskine9911b022018-06-29 17:30:48 +02004138 /* Verify that the signature is what is expected. */
Gilles Peskinebd7dea92018-09-27 13:57:19 +02004139 ASSERT_COMPARE( output_data->x, output_data->len,
4140 signature, signature_length );
Gilles Peskine20035e32018-02-03 22:44:14 +01004141
Gilles Peskine0627f982019-11-26 19:12:16 +01004142#if defined(MBEDTLS_TEST_DEPRECATED)
Gilles Peskine895242b2019-11-29 12:15:40 +01004143 memset( signature, 0, signature_size );
4144 signature_length = INVALID_EXPORT_LENGTH;
Gilles Peskine0627f982019-11-26 19:12:16 +01004145 PSA_ASSERT( psa_asymmetric_sign( handle, alg,
4146 input_data->x, input_data->len,
4147 signature, signature_size,
4148 &signature_length ) );
4149 ASSERT_COMPARE( output_data->x, output_data->len,
4150 signature, signature_length );
4151#endif /* MBEDTLS_TEST_DEPRECATED */
4152
Gilles Peskine20035e32018-02-03 22:44:14 +01004153exit:
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02004154 psa_reset_key_attributes( &attributes );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004155 psa_destroy_key( handle );
Gilles Peskine0189e752018-02-03 23:57:22 +01004156 mbedtls_free( signature );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02004157 PSA_DONE( );
Gilles Peskine20035e32018-02-03 22:44:14 +01004158}
4159/* END_CASE */
4160
4161/* BEGIN_CASE */
itayzafrir3e02b3b2018-06-12 17:06:52 +03004162void sign_fail( int key_type_arg, data_t *key_data,
4163 int alg_arg, data_t *input_data,
Gilles Peskine860ce9d2018-06-28 12:23:00 +02004164 int signature_size_arg, int expected_status_arg )
Gilles Peskine20035e32018-02-03 22:44:14 +01004165{
Ronald Cron91e95152020-07-30 17:48:03 +02004166 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskine20035e32018-02-03 22:44:14 +01004167 psa_key_type_t key_type = key_type_arg;
4168 psa_algorithm_t alg = alg_arg;
Gilles Peskine860ce9d2018-06-28 12:23:00 +02004169 size_t signature_size = signature_size_arg;
Gilles Peskine20035e32018-02-03 22:44:14 +01004170 psa_status_t actual_status;
4171 psa_status_t expected_status = expected_status_arg;
Gilles Peskine40f68b92018-03-07 16:43:36 +01004172 unsigned char *signature = NULL;
Gilles Peskine93aa0332018-02-03 23:58:03 +01004173 size_t signature_length = 0xdeadbeef;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02004174 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine20035e32018-02-03 22:44:14 +01004175
Gilles Peskine8cebbba2018-09-27 13:54:18 +02004176 ASSERT_ALLOC( signature, signature_size );
Gilles Peskine20035e32018-02-03 22:44:14 +01004177
Gilles Peskine8817f612018-12-18 00:18:46 +01004178 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine20035e32018-02-03 22:44:14 +01004179
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01004180 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_SIGN_HASH );
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02004181 psa_set_key_algorithm( &attributes, alg );
4182 psa_set_key_type( &attributes, key_type );
mohammad1603a97cb8c2018-03-28 03:46:26 -07004183
Gilles Peskine049c7532019-05-15 20:22:09 +02004184 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
4185 &handle ) );
Gilles Peskine20035e32018-02-03 22:44:14 +01004186
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01004187 actual_status = psa_sign_hash( handle, alg,
4188 input_data->x, input_data->len,
4189 signature, signature_size,
4190 &signature_length );
Gilles Peskinefe11b722018-12-18 00:24:04 +01004191 TEST_EQUAL( actual_status, expected_status );
Gilles Peskine860ce9d2018-06-28 12:23:00 +02004192 /* The value of *signature_length is unspecified on error, but
4193 * whatever it is, it should be less than signature_size, so that
4194 * if the caller tries to read *signature_length bytes without
4195 * checking the error code then they don't overflow a buffer. */
4196 TEST_ASSERT( signature_length <= signature_size );
Gilles Peskine20035e32018-02-03 22:44:14 +01004197
Gilles Peskine895242b2019-11-29 12:15:40 +01004198#if defined(MBEDTLS_TEST_DEPRECATED)
4199 signature_length = INVALID_EXPORT_LENGTH;
4200 TEST_EQUAL( psa_asymmetric_sign( handle, alg,
4201 input_data->x, input_data->len,
4202 signature, signature_size,
4203 &signature_length ),
4204 expected_status );
4205 TEST_ASSERT( signature_length <= signature_size );
4206#endif /* MBEDTLS_TEST_DEPRECATED */
4207
Gilles Peskine20035e32018-02-03 22:44:14 +01004208exit:
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02004209 psa_reset_key_attributes( &attributes );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004210 psa_destroy_key( handle );
Gilles Peskine20035e32018-02-03 22:44:14 +01004211 mbedtls_free( signature );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02004212 PSA_DONE( );
Gilles Peskine20035e32018-02-03 22:44:14 +01004213}
4214/* END_CASE */
mohammad16038cc1cee2018-03-28 01:21:33 +03004215
4216/* BEGIN_CASE */
Gilles Peskine9911b022018-06-29 17:30:48 +02004217void sign_verify( int key_type_arg, data_t *key_data,
4218 int alg_arg, data_t *input_data )
4219{
Ronald Cron91e95152020-07-30 17:48:03 +02004220 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskine9911b022018-06-29 17:30:48 +02004221 psa_key_type_t key_type = key_type_arg;
4222 psa_algorithm_t alg = alg_arg;
4223 size_t key_bits;
4224 unsigned char *signature = NULL;
4225 size_t signature_size;
4226 size_t signature_length = 0xdeadbeef;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02004227 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine9911b022018-06-29 17:30:48 +02004228
Gilles Peskine8817f612018-12-18 00:18:46 +01004229 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine9911b022018-06-29 17:30:48 +02004230
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01004231 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_VERIFY_HASH );
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02004232 psa_set_key_algorithm( &attributes, alg );
4233 psa_set_key_type( &attributes, key_type );
Gilles Peskine9911b022018-06-29 17:30:48 +02004234
Gilles Peskine049c7532019-05-15 20:22:09 +02004235 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
4236 &handle ) );
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02004237 PSA_ASSERT( psa_get_key_attributes( handle, &attributes ) );
4238 key_bits = psa_get_key_bits( &attributes );
Gilles Peskine9911b022018-06-29 17:30:48 +02004239
4240 /* Allocate a buffer which has the size advertized by the
4241 * library. */
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01004242 signature_size = PSA_SIGN_OUTPUT_SIZE( key_type,
Gilles Peskine9911b022018-06-29 17:30:48 +02004243 key_bits, alg );
4244 TEST_ASSERT( signature_size != 0 );
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01004245 TEST_ASSERT( signature_size <= PSA_SIGNATURE_MAX_SIZE );
Gilles Peskine8cebbba2018-09-27 13:54:18 +02004246 ASSERT_ALLOC( signature, signature_size );
Gilles Peskine9911b022018-06-29 17:30:48 +02004247
4248 /* Perform the signature. */
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01004249 PSA_ASSERT( psa_sign_hash( handle, alg,
4250 input_data->x, input_data->len,
4251 signature, signature_size,
4252 &signature_length ) );
Gilles Peskine9911b022018-06-29 17:30:48 +02004253 /* Check that the signature length looks sensible. */
4254 TEST_ASSERT( signature_length <= signature_size );
4255 TEST_ASSERT( signature_length > 0 );
4256
4257 /* Use the library to verify that the signature is correct. */
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01004258 PSA_ASSERT( psa_verify_hash( handle, alg,
4259 input_data->x, input_data->len,
4260 signature, signature_length ) );
Gilles Peskine9911b022018-06-29 17:30:48 +02004261
4262 if( input_data->len != 0 )
4263 {
4264 /* Flip a bit in the input and verify that the signature is now
4265 * detected as invalid. Flip a bit at the beginning, not at the end,
4266 * because ECDSA may ignore the last few bits of the input. */
4267 input_data->x[0] ^= 1;
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01004268 TEST_EQUAL( psa_verify_hash( handle, alg,
4269 input_data->x, input_data->len,
4270 signature, signature_length ),
Gilles Peskinef812dcf2018-12-18 00:33:25 +01004271 PSA_ERROR_INVALID_SIGNATURE );
Gilles Peskine9911b022018-06-29 17:30:48 +02004272 }
4273
4274exit:
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02004275 psa_reset_key_attributes( &attributes );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004276 psa_destroy_key( handle );
Gilles Peskine9911b022018-06-29 17:30:48 +02004277 mbedtls_free( signature );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02004278 PSA_DONE( );
Gilles Peskine9911b022018-06-29 17:30:48 +02004279}
4280/* END_CASE */
4281
4282/* BEGIN_CASE */
itayzafrir3e02b3b2018-06-12 17:06:52 +03004283void asymmetric_verify( int key_type_arg, data_t *key_data,
4284 int alg_arg, data_t *hash_data,
4285 data_t *signature_data )
itayzafrir5c753392018-05-08 11:18:38 +03004286{
Ronald Cron91e95152020-07-30 17:48:03 +02004287 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
itayzafrir5c753392018-05-08 11:18:38 +03004288 psa_key_type_t key_type = key_type_arg;
4289 psa_algorithm_t alg = alg_arg;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02004290 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
itayzafrir5c753392018-05-08 11:18:38 +03004291
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01004292 TEST_ASSERT( signature_data->len <= PSA_SIGNATURE_MAX_SIZE );
Gilles Peskine69c12672018-06-28 00:07:19 +02004293
Gilles Peskine8817f612018-12-18 00:18:46 +01004294 PSA_ASSERT( psa_crypto_init( ) );
itayzafrir5c753392018-05-08 11:18:38 +03004295
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01004296 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_VERIFY_HASH );
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02004297 psa_set_key_algorithm( &attributes, alg );
4298 psa_set_key_type( &attributes, key_type );
itayzafrir5c753392018-05-08 11:18:38 +03004299
Gilles Peskine049c7532019-05-15 20:22:09 +02004300 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
4301 &handle ) );
itayzafrir5c753392018-05-08 11:18:38 +03004302
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01004303 PSA_ASSERT( psa_verify_hash( handle, alg,
4304 hash_data->x, hash_data->len,
4305 signature_data->x, signature_data->len ) );
Gilles Peskine0627f982019-11-26 19:12:16 +01004306
4307#if defined(MBEDTLS_TEST_DEPRECATED)
4308 PSA_ASSERT( psa_asymmetric_verify( handle, alg,
4309 hash_data->x, hash_data->len,
4310 signature_data->x,
4311 signature_data->len ) );
4312
4313#endif /* MBEDTLS_TEST_DEPRECATED */
4314
itayzafrir5c753392018-05-08 11:18:38 +03004315exit:
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02004316 psa_reset_key_attributes( &attributes );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004317 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02004318 PSA_DONE( );
itayzafrir5c753392018-05-08 11:18:38 +03004319}
4320/* END_CASE */
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004321
4322/* BEGIN_CASE */
itayzafrir3e02b3b2018-06-12 17:06:52 +03004323void asymmetric_verify_fail( int key_type_arg, data_t *key_data,
4324 int alg_arg, data_t *hash_data,
4325 data_t *signature_data,
4326 int expected_status_arg )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004327{
Ronald Cron91e95152020-07-30 17:48:03 +02004328 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004329 psa_key_type_t key_type = key_type_arg;
4330 psa_algorithm_t alg = alg_arg;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004331 psa_status_t actual_status;
4332 psa_status_t expected_status = expected_status_arg;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02004333 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004334
Gilles Peskine8817f612018-12-18 00:18:46 +01004335 PSA_ASSERT( psa_crypto_init( ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004336
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01004337 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_VERIFY_HASH );
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02004338 psa_set_key_algorithm( &attributes, alg );
4339 psa_set_key_type( &attributes, key_type );
Nir Sonnenscheind7082602018-06-04 16:45:27 +03004340
Gilles Peskine049c7532019-05-15 20:22:09 +02004341 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
4342 &handle ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004343
Gilles Peskine89d8c5c2019-11-26 17:01:59 +01004344 actual_status = psa_verify_hash( handle, alg,
4345 hash_data->x, hash_data->len,
4346 signature_data->x, signature_data->len );
Gilles Peskinefe11b722018-12-18 00:24:04 +01004347 TEST_EQUAL( actual_status, expected_status );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004348
Gilles Peskine895242b2019-11-29 12:15:40 +01004349#if defined(MBEDTLS_TEST_DEPRECATED)
4350 TEST_EQUAL( psa_asymmetric_verify( handle, alg,
4351 hash_data->x, hash_data->len,
4352 signature_data->x, signature_data->len ),
4353 expected_status );
4354#endif /* MBEDTLS_TEST_DEPRECATED */
4355
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004356exit:
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02004357 psa_reset_key_attributes( &attributes );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004358 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02004359 PSA_DONE( );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004360}
4361/* END_CASE */
4362
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004363/* BEGIN_CASE */
Gilles Peskine656896e2018-06-29 19:12:28 +02004364void asymmetric_encrypt( int key_type_arg,
4365 data_t *key_data,
4366 int alg_arg,
4367 data_t *input_data,
Gilles Peskine68428122018-06-30 18:42:41 +02004368 data_t *label,
Gilles Peskine656896e2018-06-29 19:12:28 +02004369 int expected_output_length_arg,
4370 int expected_status_arg )
4371{
Ronald Cron91e95152020-07-30 17:48:03 +02004372 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskine656896e2018-06-29 19:12:28 +02004373 psa_key_type_t key_type = key_type_arg;
4374 psa_algorithm_t alg = alg_arg;
4375 size_t expected_output_length = expected_output_length_arg;
4376 size_t key_bits;
4377 unsigned char *output = NULL;
4378 size_t output_size;
4379 size_t output_length = ~0;
4380 psa_status_t actual_status;
4381 psa_status_t expected_status = expected_status_arg;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02004382 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine656896e2018-06-29 19:12:28 +02004383
Gilles Peskine8817f612018-12-18 00:18:46 +01004384 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004385
Gilles Peskine656896e2018-06-29 19:12:28 +02004386 /* Import the key */
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02004387 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_ENCRYPT );
4388 psa_set_key_algorithm( &attributes, alg );
4389 psa_set_key_type( &attributes, key_type );
Gilles Peskine049c7532019-05-15 20:22:09 +02004390 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
4391 &handle ) );
Gilles Peskine656896e2018-06-29 19:12:28 +02004392
4393 /* Determine the maximum output length */
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02004394 PSA_ASSERT( psa_get_key_attributes( handle, &attributes ) );
4395 key_bits = psa_get_key_bits( &attributes );
Gilles Peskine656896e2018-06-29 19:12:28 +02004396 output_size = PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE( key_type, key_bits, alg );
Gilles Peskine8cebbba2018-09-27 13:54:18 +02004397 ASSERT_ALLOC( output, output_size );
Gilles Peskine656896e2018-06-29 19:12:28 +02004398
4399 /* Encrypt the input */
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004400 actual_status = psa_asymmetric_encrypt( handle, alg,
Gilles Peskine656896e2018-06-29 19:12:28 +02004401 input_data->x, input_data->len,
Gilles Peskine68428122018-06-30 18:42:41 +02004402 label->x, label->len,
Gilles Peskine656896e2018-06-29 19:12:28 +02004403 output, output_size,
4404 &output_length );
Gilles Peskinefe11b722018-12-18 00:24:04 +01004405 TEST_EQUAL( actual_status, expected_status );
4406 TEST_EQUAL( output_length, expected_output_length );
Gilles Peskine656896e2018-06-29 19:12:28 +02004407
Gilles Peskine68428122018-06-30 18:42:41 +02004408 /* If the label is empty, the test framework puts a non-null pointer
4409 * in label->x. Test that a null pointer works as well. */
4410 if( label->len == 0 )
4411 {
4412 output_length = ~0;
Gilles Peskinef7ab5ad2018-09-26 18:19:24 +02004413 if( output_size != 0 )
4414 memset( output, 0, output_size );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004415 actual_status = psa_asymmetric_encrypt( handle, alg,
Gilles Peskine68428122018-06-30 18:42:41 +02004416 input_data->x, input_data->len,
4417 NULL, label->len,
4418 output, output_size,
4419 &output_length );
Gilles Peskinefe11b722018-12-18 00:24:04 +01004420 TEST_EQUAL( actual_status, expected_status );
4421 TEST_EQUAL( output_length, expected_output_length );
Gilles Peskine68428122018-06-30 18:42:41 +02004422 }
4423
Gilles Peskine656896e2018-06-29 19:12:28 +02004424exit:
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02004425 psa_reset_key_attributes( &attributes );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004426 psa_destroy_key( handle );
Gilles Peskine656896e2018-06-29 19:12:28 +02004427 mbedtls_free( output );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02004428 PSA_DONE( );
Gilles Peskine656896e2018-06-29 19:12:28 +02004429}
4430/* END_CASE */
4431
4432/* BEGIN_CASE */
Gilles Peskine68428122018-06-30 18:42:41 +02004433void asymmetric_encrypt_decrypt( int key_type_arg,
4434 data_t *key_data,
4435 int alg_arg,
4436 data_t *input_data,
4437 data_t *label )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004438{
Ronald Cron91e95152020-07-30 17:48:03 +02004439 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004440 psa_key_type_t key_type = key_type_arg;
4441 psa_algorithm_t alg = alg_arg;
Gilles Peskine55c94dd2018-06-30 18:54:48 +02004442 size_t key_bits;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004443 unsigned char *output = NULL;
Gilles Peskine55c94dd2018-06-30 18:54:48 +02004444 size_t output_size;
4445 size_t output_length = ~0;
Nir Sonnenschein0f3bdbd2018-05-02 23:56:12 +03004446 unsigned char *output2 = NULL;
Gilles Peskine55c94dd2018-06-30 18:54:48 +02004447 size_t output2_size;
4448 size_t output2_length = ~0;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02004449 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004450
Gilles Peskine8817f612018-12-18 00:18:46 +01004451 PSA_ASSERT( psa_crypto_init( ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004452
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02004453 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT );
4454 psa_set_key_algorithm( &attributes, alg );
4455 psa_set_key_type( &attributes, key_type );
Nir Sonnenscheind7082602018-06-04 16:45:27 +03004456
Gilles Peskine049c7532019-05-15 20:22:09 +02004457 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
4458 &handle ) );
Gilles Peskine55c94dd2018-06-30 18:54:48 +02004459
4460 /* Determine the maximum ciphertext length */
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02004461 PSA_ASSERT( psa_get_key_attributes( handle, &attributes ) );
4462 key_bits = psa_get_key_bits( &attributes );
Gilles Peskine55c94dd2018-06-30 18:54:48 +02004463 output_size = PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE( key_type, key_bits, alg );
Gilles Peskine8cebbba2018-09-27 13:54:18 +02004464 ASSERT_ALLOC( output, output_size );
Gilles Peskine55c94dd2018-06-30 18:54:48 +02004465 output2_size = input_data->len;
Gilles Peskine8cebbba2018-09-27 13:54:18 +02004466 ASSERT_ALLOC( output2, output2_size );
Gilles Peskine55c94dd2018-06-30 18:54:48 +02004467
Gilles Peskineeebd7382018-06-08 18:11:54 +02004468 /* We test encryption by checking that encrypt-then-decrypt gives back
4469 * the original plaintext because of the non-optional random
4470 * part of encryption process which prevents using fixed vectors. */
Gilles Peskine8817f612018-12-18 00:18:46 +01004471 PSA_ASSERT( psa_asymmetric_encrypt( handle, alg,
4472 input_data->x, input_data->len,
4473 label->x, label->len,
4474 output, output_size,
4475 &output_length ) );
Gilles Peskine55c94dd2018-06-30 18:54:48 +02004476 /* We don't know what ciphertext length to expect, but check that
4477 * it looks sensible. */
4478 TEST_ASSERT( output_length <= output_size );
Nir Sonnenschein0f3bdbd2018-05-02 23:56:12 +03004479
Gilles Peskine8817f612018-12-18 00:18:46 +01004480 PSA_ASSERT( psa_asymmetric_decrypt( handle, alg,
4481 output, output_length,
4482 label->x, label->len,
4483 output2, output2_size,
4484 &output2_length ) );
Gilles Peskinebd7dea92018-09-27 13:57:19 +02004485 ASSERT_COMPARE( input_data->x, input_data->len,
4486 output2, output2_length );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004487
4488exit:
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02004489 psa_reset_key_attributes( &attributes );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004490 psa_destroy_key( handle );
itayzafrir3e02b3b2018-06-12 17:06:52 +03004491 mbedtls_free( output );
4492 mbedtls_free( output2 );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02004493 PSA_DONE( );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004494}
4495/* END_CASE */
4496
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004497/* BEGIN_CASE */
Gilles Peskine68428122018-06-30 18:42:41 +02004498void asymmetric_decrypt( int key_type_arg,
4499 data_t *key_data,
4500 int alg_arg,
4501 data_t *input_data,
4502 data_t *label,
Gilles Peskine66763a02018-06-29 21:54:10 +02004503 data_t *expected_data )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004504{
Ronald Cron91e95152020-07-30 17:48:03 +02004505 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004506 psa_key_type_t key_type = key_type_arg;
4507 psa_algorithm_t alg = alg_arg;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004508 unsigned char *output = NULL;
Nir Sonnenscheind70bc482018-06-04 16:31:13 +03004509 size_t output_size = 0;
Gilles Peskine55c94dd2018-06-30 18:54:48 +02004510 size_t output_length = ~0;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02004511 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004512
Jaeden Amero412654a2019-02-06 12:57:46 +00004513 output_size = expected_data->len;
Gilles Peskine8cebbba2018-09-27 13:54:18 +02004514 ASSERT_ALLOC( output, output_size );
Gilles Peskine5b051bc2018-05-31 13:25:48 +02004515
Gilles Peskine8817f612018-12-18 00:18:46 +01004516 PSA_ASSERT( psa_crypto_init( ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004517
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02004518 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DECRYPT );
4519 psa_set_key_algorithm( &attributes, alg );
4520 psa_set_key_type( &attributes, key_type );
Nir Sonnenscheind7082602018-06-04 16:45:27 +03004521
Gilles Peskine049c7532019-05-15 20:22:09 +02004522 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
4523 &handle ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004524
Gilles Peskine8817f612018-12-18 00:18:46 +01004525 PSA_ASSERT( psa_asymmetric_decrypt( handle, alg,
4526 input_data->x, input_data->len,
4527 label->x, label->len,
4528 output,
4529 output_size,
4530 &output_length ) );
Gilles Peskinebd7dea92018-09-27 13:57:19 +02004531 ASSERT_COMPARE( expected_data->x, expected_data->len,
4532 output, output_length );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004533
Gilles Peskine68428122018-06-30 18:42:41 +02004534 /* If the label is empty, the test framework puts a non-null pointer
4535 * in label->x. Test that a null pointer works as well. */
4536 if( label->len == 0 )
4537 {
4538 output_length = ~0;
Gilles Peskinef7ab5ad2018-09-26 18:19:24 +02004539 if( output_size != 0 )
4540 memset( output, 0, output_size );
Gilles Peskine8817f612018-12-18 00:18:46 +01004541 PSA_ASSERT( psa_asymmetric_decrypt( handle, alg,
4542 input_data->x, input_data->len,
4543 NULL, label->len,
4544 output,
4545 output_size,
4546 &output_length ) );
Gilles Peskinebd7dea92018-09-27 13:57:19 +02004547 ASSERT_COMPARE( expected_data->x, expected_data->len,
4548 output, output_length );
Gilles Peskine68428122018-06-30 18:42:41 +02004549 }
4550
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004551exit:
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02004552 psa_reset_key_attributes( &attributes );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004553 psa_destroy_key( handle );
itayzafrir3e02b3b2018-06-12 17:06:52 +03004554 mbedtls_free( output );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02004555 PSA_DONE( );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004556}
4557/* END_CASE */
4558
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004559/* BEGIN_CASE */
Gilles Peskine68428122018-06-30 18:42:41 +02004560void asymmetric_decrypt_fail( int key_type_arg,
4561 data_t *key_data,
4562 int alg_arg,
4563 data_t *input_data,
4564 data_t *label,
Jaeden Amerof8daab72019-02-06 12:57:46 +00004565 int output_size_arg,
Gilles Peskine2d277862018-06-18 15:41:12 +02004566 int expected_status_arg )
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004567{
Ronald Cron91e95152020-07-30 17:48:03 +02004568 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004569 psa_key_type_t key_type = key_type_arg;
4570 psa_algorithm_t alg = alg_arg;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004571 unsigned char *output = NULL;
Jaeden Amerof8daab72019-02-06 12:57:46 +00004572 size_t output_size = output_size_arg;
Gilles Peskine55c94dd2018-06-30 18:54:48 +02004573 size_t output_length = ~0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004574 psa_status_t actual_status;
4575 psa_status_t expected_status = expected_status_arg;
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02004576 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004577
Gilles Peskine8cebbba2018-09-27 13:54:18 +02004578 ASSERT_ALLOC( output, output_size );
Gilles Peskine5b051bc2018-05-31 13:25:48 +02004579
Gilles Peskine8817f612018-12-18 00:18:46 +01004580 PSA_ASSERT( psa_crypto_init( ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004581
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02004582 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DECRYPT );
4583 psa_set_key_algorithm( &attributes, alg );
4584 psa_set_key_type( &attributes, key_type );
Nir Sonnenscheind7082602018-06-04 16:45:27 +03004585
Gilles Peskine049c7532019-05-15 20:22:09 +02004586 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
4587 &handle ) );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004588
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004589 actual_status = psa_asymmetric_decrypt( handle, alg,
Gilles Peskine4abf7412018-06-18 16:35:34 +02004590 input_data->x, input_data->len,
Gilles Peskine68428122018-06-30 18:42:41 +02004591 label->x, label->len,
Gilles Peskine4abf7412018-06-18 16:35:34 +02004592 output, output_size,
Gilles Peskine2d277862018-06-18 15:41:12 +02004593 &output_length );
Gilles Peskinefe11b722018-12-18 00:24:04 +01004594 TEST_EQUAL( actual_status, expected_status );
Gilles Peskine55c94dd2018-06-30 18:54:48 +02004595 TEST_ASSERT( output_length <= output_size );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004596
Gilles Peskine68428122018-06-30 18:42:41 +02004597 /* If the label is empty, the test framework puts a non-null pointer
4598 * in label->x. Test that a null pointer works as well. */
4599 if( label->len == 0 )
4600 {
4601 output_length = ~0;
Gilles Peskinef7ab5ad2018-09-26 18:19:24 +02004602 if( output_size != 0 )
4603 memset( output, 0, output_size );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004604 actual_status = psa_asymmetric_decrypt( handle, alg,
Gilles Peskine68428122018-06-30 18:42:41 +02004605 input_data->x, input_data->len,
4606 NULL, label->len,
4607 output, output_size,
4608 &output_length );
Gilles Peskinefe11b722018-12-18 00:24:04 +01004609 TEST_EQUAL( actual_status, expected_status );
Gilles Peskine55c94dd2018-06-30 18:54:48 +02004610 TEST_ASSERT( output_length <= output_size );
Gilles Peskine68428122018-06-30 18:42:41 +02004611 }
4612
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004613exit:
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02004614 psa_reset_key_attributes( &attributes );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004615 psa_destroy_key( handle );
Gilles Peskine2d277862018-06-18 15:41:12 +02004616 mbedtls_free( output );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02004617 PSA_DONE( );
Nir Sonnenschein39e59142018-05-02 23:16:26 +03004618}
Gilles Peskine5b051bc2018-05-31 13:25:48 +02004619/* END_CASE */
Gilles Peskine05d69892018-06-19 22:00:52 +02004620
4621/* BEGIN_CASE */
Gilles Peskinecbe66502019-05-16 16:59:18 +02004622void key_derivation_init( )
Jaeden Amerod94d6712019-01-04 14:11:48 +00004623{
4624 /* Test each valid way of initializing the object, except for `= {0}`, as
4625 * Clang 5 complains when `-Wmissing-field-initializers` is used, even
4626 * though it's OK by the C standard. We could test for this, but we'd need
4627 * to supress the Clang warning for the test. */
Jaeden Amero5229bbb2019-02-07 16:33:37 +00004628 size_t capacity;
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02004629 psa_key_derivation_operation_t func = psa_key_derivation_operation_init( );
4630 psa_key_derivation_operation_t init = PSA_KEY_DERIVATION_OPERATION_INIT;
4631 psa_key_derivation_operation_t zero;
Jaeden Amerod94d6712019-01-04 14:11:48 +00004632
4633 memset( &zero, 0, sizeof( zero ) );
4634
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004635 /* A default operation should not be able to report its capacity. */
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02004636 TEST_EQUAL( psa_key_derivation_get_capacity( &func, &capacity ),
Jaeden Amerocf2010c2019-02-15 13:05:49 +00004637 PSA_ERROR_BAD_STATE );
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02004638 TEST_EQUAL( psa_key_derivation_get_capacity( &init, &capacity ),
Jaeden Amerocf2010c2019-02-15 13:05:49 +00004639 PSA_ERROR_BAD_STATE );
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02004640 TEST_EQUAL( psa_key_derivation_get_capacity( &zero, &capacity ),
Jaeden Amerocf2010c2019-02-15 13:05:49 +00004641 PSA_ERROR_BAD_STATE );
Jaeden Amero5229bbb2019-02-07 16:33:37 +00004642
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004643 /* A default operation should be abortable without error. */
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02004644 PSA_ASSERT( psa_key_derivation_abort(&func) );
4645 PSA_ASSERT( psa_key_derivation_abort(&init) );
4646 PSA_ASSERT( psa_key_derivation_abort(&zero) );
Jaeden Amerod94d6712019-01-04 14:11:48 +00004647}
4648/* END_CASE */
4649
Janos Follath16de4a42019-06-13 16:32:24 +01004650/* BEGIN_CASE */
4651void derive_setup( int alg_arg, int expected_status_arg )
Gilles Peskineea0fb492018-07-12 17:17:20 +02004652{
Gilles Peskineea0fb492018-07-12 17:17:20 +02004653 psa_algorithm_t alg = alg_arg;
Gilles Peskineea0fb492018-07-12 17:17:20 +02004654 psa_status_t expected_status = expected_status_arg;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004655 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
Gilles Peskineea0fb492018-07-12 17:17:20 +02004656
Gilles Peskine8817f612018-12-18 00:18:46 +01004657 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskineea0fb492018-07-12 17:17:20 +02004658
Janos Follath16de4a42019-06-13 16:32:24 +01004659 TEST_EQUAL( psa_key_derivation_setup( &operation, alg ),
Gilles Peskinef812dcf2018-12-18 00:33:25 +01004660 expected_status );
Gilles Peskineea0fb492018-07-12 17:17:20 +02004661
4662exit:
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004663 psa_key_derivation_abort( &operation );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02004664 PSA_DONE( );
Gilles Peskineea0fb492018-07-12 17:17:20 +02004665}
4666/* END_CASE */
4667
Janos Follathaf3c2a02019-06-12 12:34:34 +01004668/* BEGIN_CASE */
Janos Follatha27c9272019-06-14 09:59:36 +01004669void derive_set_capacity( int alg_arg, int capacity_arg,
4670 int expected_status_arg )
4671{
4672 psa_algorithm_t alg = alg_arg;
4673 size_t capacity = capacity_arg;
4674 psa_status_t expected_status = expected_status_arg;
4675 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
4676
4677 PSA_ASSERT( psa_crypto_init( ) );
4678
4679 PSA_ASSERT( psa_key_derivation_setup( &operation, alg ) );
4680
4681 TEST_EQUAL( psa_key_derivation_set_capacity( &operation, capacity ),
4682 expected_status );
4683
4684exit:
4685 psa_key_derivation_abort( &operation );
4686 PSA_DONE( );
4687}
4688/* END_CASE */
4689
4690/* BEGIN_CASE */
Janos Follathaf3c2a02019-06-12 12:34:34 +01004691void derive_input( int alg_arg,
Gilles Peskine6842ba42019-09-23 13:49:33 +02004692 int step_arg1, int key_type_arg1, data_t *input1,
Janos Follathaf3c2a02019-06-12 12:34:34 +01004693 int expected_status_arg1,
Gilles Peskine2058c072019-09-24 17:19:33 +02004694 int step_arg2, int key_type_arg2, data_t *input2,
Janos Follathaf3c2a02019-06-12 12:34:34 +01004695 int expected_status_arg2,
Gilles Peskine2058c072019-09-24 17:19:33 +02004696 int step_arg3, int key_type_arg3, data_t *input3,
Gilles Peskine1a2904c2019-09-24 17:45:07 +02004697 int expected_status_arg3,
4698 int output_key_type_arg, int expected_output_status_arg )
Janos Follathaf3c2a02019-06-12 12:34:34 +01004699{
4700 psa_algorithm_t alg = alg_arg;
Gilles Peskine6842ba42019-09-23 13:49:33 +02004701 psa_key_derivation_step_t steps[] = {step_arg1, step_arg2, step_arg3};
4702 psa_key_type_t key_types[] = {key_type_arg1, key_type_arg2, key_type_arg3};
Janos Follathaf3c2a02019-06-12 12:34:34 +01004703 psa_status_t expected_statuses[] = {expected_status_arg1,
4704 expected_status_arg2,
4705 expected_status_arg3};
4706 data_t *inputs[] = {input1, input2, input3};
Ronald Cron91e95152020-07-30 17:48:03 +02004707 psa_key_handle_t handles[] = { PSA_KEY_HANDLE_INIT,
4708 PSA_KEY_HANDLE_INIT,
4709 PSA_KEY_HANDLE_INIT};
Janos Follathaf3c2a02019-06-12 12:34:34 +01004710 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
4711 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
4712 size_t i;
Gilles Peskine1a2904c2019-09-24 17:45:07 +02004713 psa_key_type_t output_key_type = output_key_type_arg;
Ronald Cron91e95152020-07-30 17:48:03 +02004714 psa_key_handle_t output_handle = PSA_KEY_HANDLE_INIT;
Gilles Peskine1a2904c2019-09-24 17:45:07 +02004715 psa_status_t expected_output_status = expected_output_status_arg;
4716 psa_status_t actual_output_status;
Janos Follathaf3c2a02019-06-12 12:34:34 +01004717
4718 PSA_ASSERT( psa_crypto_init( ) );
4719
4720 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DERIVE );
4721 psa_set_key_algorithm( &attributes, alg );
Janos Follathaf3c2a02019-06-12 12:34:34 +01004722
4723 PSA_ASSERT( psa_key_derivation_setup( &operation, alg ) );
4724
4725 for( i = 0; i < ARRAY_LENGTH( steps ); i++ )
4726 {
Gilles Peskineb8965192019-09-24 16:21:10 +02004727 if( key_types[i] != PSA_KEY_TYPE_NONE )
Janos Follathaf3c2a02019-06-12 12:34:34 +01004728 {
Gilles Peskine6842ba42019-09-23 13:49:33 +02004729 psa_set_key_type( &attributes, key_types[i] );
4730 PSA_ASSERT( psa_import_key( &attributes,
4731 inputs[i]->x, inputs[i]->len,
4732 &handles[i] ) );
Steven Cooreman0ee0d522020-10-05 16:03:42 +02004733 if( PSA_KEY_TYPE_IS_KEY_PAIR( key_types[i] ) &&
4734 steps[i] == PSA_KEY_DERIVATION_INPUT_SECRET )
4735 {
4736 // When taking a private key as secret input, use key agreement
4737 // to add the shared secret to the derivation
4738 TEST_EQUAL( key_agreement_with_self( &operation, handles[i] ),
4739 expected_statuses[i] );
4740 }
4741 else
4742 {
4743 TEST_EQUAL( psa_key_derivation_input_key( &operation, steps[i],
4744 handles[i] ),
4745 expected_statuses[i] );
4746 }
Gilles Peskine6842ba42019-09-23 13:49:33 +02004747 }
4748 else
4749 {
4750 TEST_EQUAL( psa_key_derivation_input_bytes(
4751 &operation, steps[i],
4752 inputs[i]->x, inputs[i]->len ),
4753 expected_statuses[i] );
Janos Follathaf3c2a02019-06-12 12:34:34 +01004754 }
4755 }
4756
Gilles Peskine1a2904c2019-09-24 17:45:07 +02004757 if( output_key_type != PSA_KEY_TYPE_NONE )
4758 {
4759 psa_reset_key_attributes( &attributes );
4760 psa_set_key_type( &attributes, PSA_KEY_TYPE_RAW_DATA );
4761 psa_set_key_bits( &attributes, 8 );
4762 actual_output_status =
4763 psa_key_derivation_output_key( &attributes, &operation,
4764 &output_handle );
4765 }
4766 else
4767 {
4768 uint8_t buffer[1];
4769 actual_output_status =
4770 psa_key_derivation_output_bytes( &operation,
4771 buffer, sizeof( buffer ) );
4772 }
4773 TEST_EQUAL( actual_output_status, expected_output_status );
4774
Janos Follathaf3c2a02019-06-12 12:34:34 +01004775exit:
4776 psa_key_derivation_abort( &operation );
4777 for( i = 0; i < ARRAY_LENGTH( handles ); i++ )
4778 psa_destroy_key( handles[i] );
Gilles Peskine1a2904c2019-09-24 17:45:07 +02004779 psa_destroy_key( output_handle );
Janos Follathaf3c2a02019-06-12 12:34:34 +01004780 PSA_DONE( );
4781}
4782/* END_CASE */
4783
Janos Follathd958bb72019-07-03 15:02:16 +01004784/* BEGIN_CASE */
4785void test_derive_invalid_key_derivation_state( int alg_arg )
Nir Sonnenscheine5204c92018-10-22 17:24:55 +03004786{
Janos Follathd958bb72019-07-03 15:02:16 +01004787 psa_algorithm_t alg = alg_arg;
Ronald Cron91e95152020-07-30 17:48:03 +02004788 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Nir Sonnenschein4eda37b2018-10-31 12:15:58 +02004789 size_t key_type = PSA_KEY_TYPE_DERIVE;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004790 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
Janos Follathd958bb72019-07-03 15:02:16 +01004791 unsigned char input1[] = "Input 1";
4792 size_t input1_length = sizeof( input1 );
4793 unsigned char input2[] = "Input 2";
4794 size_t input2_length = sizeof( input2 );
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004795 uint8_t buffer[42];
Nir Sonnenschein1caf6d22018-11-01 12:27:20 +02004796 size_t capacity = sizeof( buffer );
Nir Sonnenscheindd69d8b2018-11-01 12:24:23 +02004797 const uint8_t key_data[22] = { 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
4798 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b,
4799 0x0b, 0x0b, 0x0b, 0x0b, 0x0b, 0x0b};
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02004800 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Nir Sonnenscheine5204c92018-10-22 17:24:55 +03004801
Gilles Peskine8817f612018-12-18 00:18:46 +01004802 PSA_ASSERT( psa_crypto_init( ) );
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004803
Gilles Peskine2c2cf0e2019-04-19 19:58:20 +02004804 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DERIVE );
4805 psa_set_key_algorithm( &attributes, alg );
4806 psa_set_key_type( &attributes, key_type );
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004807
Gilles Peskine73676cb2019-05-15 20:15:10 +02004808 PSA_ASSERT( psa_import_key( &attributes,
4809 key_data, sizeof( key_data ),
4810 &handle ) );
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004811
4812 /* valid key derivation */
Janos Follathd958bb72019-07-03 15:02:16 +01004813 if( !setup_key_derivation_wrap( &operation, handle, alg,
4814 input1, input1_length,
4815 input2, input2_length,
4816 capacity ) )
4817 goto exit;
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004818
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004819 /* state of operation shouldn't allow additional generation */
Janos Follathd958bb72019-07-03 15:02:16 +01004820 TEST_EQUAL( psa_key_derivation_setup( &operation, alg ),
Gilles Peskinef812dcf2018-12-18 00:33:25 +01004821 PSA_ERROR_BAD_STATE );
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004822
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004823 PSA_ASSERT( psa_key_derivation_output_bytes( &operation, buffer, capacity ) );
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004824
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004825 TEST_EQUAL( psa_key_derivation_output_bytes( &operation, buffer, capacity ),
David Saadab4ecc272019-02-14 13:48:10 +02004826 PSA_ERROR_INSUFFICIENT_DATA );
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004827
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004828exit:
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004829 psa_key_derivation_abort( &operation );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01004830 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02004831 PSA_DONE( );
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004832}
4833/* END_CASE */
4834
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004835/* BEGIN_CASE */
Gilles Peskinecbe66502019-05-16 16:59:18 +02004836void test_derive_invalid_key_derivation_tests( )
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004837{
4838 uint8_t output_buffer[16];
4839 size_t buffer_size = 16;
4840 size_t capacity = 0;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004841 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004842
Gilles Peskinecf7292e2019-05-16 17:53:40 +02004843 TEST_ASSERT( psa_key_derivation_output_bytes( &operation,
4844 output_buffer, buffer_size )
Jaeden Amerocf2010c2019-02-15 13:05:49 +00004845 == PSA_ERROR_BAD_STATE );
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004846
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004847 TEST_ASSERT( psa_key_derivation_get_capacity( &operation, &capacity )
Jaeden Amerocf2010c2019-02-15 13:05:49 +00004848 == PSA_ERROR_BAD_STATE );
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004849
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004850 PSA_ASSERT( psa_key_derivation_abort( &operation ) );
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004851
Gilles Peskinecf7292e2019-05-16 17:53:40 +02004852 TEST_ASSERT( psa_key_derivation_output_bytes( &operation,
4853 output_buffer, buffer_size )
Jaeden Amerocf2010c2019-02-15 13:05:49 +00004854 == PSA_ERROR_BAD_STATE );
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004855
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004856 TEST_ASSERT( psa_key_derivation_get_capacity( &operation, &capacity )
Jaeden Amerocf2010c2019-02-15 13:05:49 +00004857 == PSA_ERROR_BAD_STATE );
Nir Sonnenscheinb46e7ca2018-10-25 14:46:09 +03004858
4859exit:
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004860 psa_key_derivation_abort( &operation );
Nir Sonnenscheine5204c92018-10-22 17:24:55 +03004861}
4862/* END_CASE */
4863
4864/* BEGIN_CASE */
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004865void derive_output( int alg_arg,
Gilles Peskine1468da72019-05-29 17:35:49 +02004866 int step1_arg, data_t *input1,
4867 int step2_arg, data_t *input2,
4868 int step3_arg, data_t *input3,
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004869 int requested_capacity_arg,
4870 data_t *expected_output1,
4871 data_t *expected_output2 )
4872{
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004873 psa_algorithm_t alg = alg_arg;
Gilles Peskine1468da72019-05-29 17:35:49 +02004874 psa_key_derivation_step_t steps[] = {step1_arg, step2_arg, step3_arg};
4875 data_t *inputs[] = {input1, input2, input3};
Ronald Cron91e95152020-07-30 17:48:03 +02004876 psa_key_handle_t handles[] = { PSA_KEY_HANDLE_INIT,
4877 PSA_KEY_HANDLE_INIT,
4878 PSA_KEY_HANDLE_INIT};
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004879 size_t requested_capacity = requested_capacity_arg;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004880 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004881 uint8_t *expected_outputs[2] =
4882 {expected_output1->x, expected_output2->x};
4883 size_t output_sizes[2] =
4884 {expected_output1->len, expected_output2->len};
4885 size_t output_buffer_size = 0;
4886 uint8_t *output_buffer = NULL;
4887 size_t expected_capacity;
4888 size_t current_capacity;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004889 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004890 psa_status_t status;
Gilles Peskine1468da72019-05-29 17:35:49 +02004891 size_t i;
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004892
4893 for( i = 0; i < ARRAY_LENGTH( expected_outputs ); i++ )
4894 {
4895 if( output_sizes[i] > output_buffer_size )
4896 output_buffer_size = output_sizes[i];
4897 if( output_sizes[i] == 0 )
4898 expected_outputs[i] = NULL;
4899 }
Gilles Peskine8cebbba2018-09-27 13:54:18 +02004900 ASSERT_ALLOC( output_buffer, output_buffer_size );
Gilles Peskine8817f612018-12-18 00:18:46 +01004901 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004902
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004903 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DERIVE );
4904 psa_set_key_algorithm( &attributes, alg );
4905 psa_set_key_type( &attributes, PSA_KEY_TYPE_DERIVE );
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004906
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004907 /* Extraction phase. */
Gilles Peskine1468da72019-05-29 17:35:49 +02004908 PSA_ASSERT( psa_key_derivation_setup( &operation, alg ) );
4909 PSA_ASSERT( psa_key_derivation_set_capacity( &operation,
4910 requested_capacity ) );
4911 for( i = 0; i < ARRAY_LENGTH( steps ); i++ )
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004912 {
Gilles Peskine1468da72019-05-29 17:35:49 +02004913 switch( steps[i] )
4914 {
4915 case 0:
4916 break;
4917 case PSA_KEY_DERIVATION_INPUT_SECRET:
4918 PSA_ASSERT( psa_import_key( &attributes,
4919 inputs[i]->x, inputs[i]->len,
4920 &handles[i] ) );
4921 PSA_ASSERT( psa_key_derivation_input_key(
4922 &operation, steps[i],
4923 handles[i] ) );
4924 break;
4925 default:
4926 PSA_ASSERT( psa_key_derivation_input_bytes(
4927 &operation, steps[i],
4928 inputs[i]->x, inputs[i]->len ) );
4929 break;
4930 }
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01004931 }
Gilles Peskine1468da72019-05-29 17:35:49 +02004932
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004933 PSA_ASSERT( psa_key_derivation_get_capacity( &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02004934 &current_capacity ) );
Gilles Peskinefe11b722018-12-18 00:24:04 +01004935 TEST_EQUAL( current_capacity, requested_capacity );
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004936 expected_capacity = requested_capacity;
4937
4938 /* Expansion phase. */
4939 for( i = 0; i < ARRAY_LENGTH( expected_outputs ); i++ )
4940 {
4941 /* Read some bytes. */
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004942 status = psa_key_derivation_output_bytes( &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02004943 output_buffer, output_sizes[i] );
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004944 if( expected_capacity == 0 && output_sizes[i] == 0 )
4945 {
4946 /* Reading 0 bytes when 0 bytes are available can go either way. */
4947 TEST_ASSERT( status == PSA_SUCCESS ||
David Saadab4ecc272019-02-14 13:48:10 +02004948 status == PSA_ERROR_INSUFFICIENT_DATA );
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004949 continue;
4950 }
4951 else if( expected_capacity == 0 ||
4952 output_sizes[i] > expected_capacity )
4953 {
4954 /* Capacity exceeded. */
David Saadab4ecc272019-02-14 13:48:10 +02004955 TEST_EQUAL( status, PSA_ERROR_INSUFFICIENT_DATA );
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004956 expected_capacity = 0;
4957 continue;
4958 }
4959 /* Success. Check the read data. */
Gilles Peskine8817f612018-12-18 00:18:46 +01004960 PSA_ASSERT( status );
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004961 if( output_sizes[i] != 0 )
Gilles Peskine0dfba2d2018-12-18 00:40:50 +01004962 ASSERT_COMPARE( output_buffer, output_sizes[i],
4963 expected_outputs[i], output_sizes[i] );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004964 /* Check the operation status. */
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004965 expected_capacity -= output_sizes[i];
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004966 PSA_ASSERT( psa_key_derivation_get_capacity( &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02004967 &current_capacity ) );
Gilles Peskinefe11b722018-12-18 00:24:04 +01004968 TEST_EQUAL( expected_capacity, current_capacity );
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004969 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004970 PSA_ASSERT( psa_key_derivation_abort( &operation ) );
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004971
4972exit:
4973 mbedtls_free( output_buffer );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004974 psa_key_derivation_abort( &operation );
Gilles Peskine1468da72019-05-29 17:35:49 +02004975 for( i = 0; i < ARRAY_LENGTH( handles ); i++ )
4976 psa_destroy_key( handles[i] );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02004977 PSA_DONE( );
Gilles Peskine96ee5c72018-07-12 17:24:54 +02004978}
4979/* END_CASE */
4980
4981/* BEGIN_CASE */
Gilles Peskined54931c2018-07-17 21:06:59 +02004982void derive_full( int alg_arg,
4983 data_t *key_data,
Janos Follath47f27ed2019-06-25 13:24:52 +01004984 data_t *input1,
4985 data_t *input2,
Gilles Peskined54931c2018-07-17 21:06:59 +02004986 int requested_capacity_arg )
4987{
Ronald Cron91e95152020-07-30 17:48:03 +02004988 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskined54931c2018-07-17 21:06:59 +02004989 psa_algorithm_t alg = alg_arg;
4990 size_t requested_capacity = requested_capacity_arg;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02004991 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
Gilles Peskined54931c2018-07-17 21:06:59 +02004992 unsigned char output_buffer[16];
4993 size_t expected_capacity = requested_capacity;
4994 size_t current_capacity;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004995 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskined54931c2018-07-17 21:06:59 +02004996
Gilles Peskine8817f612018-12-18 00:18:46 +01004997 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskined54931c2018-07-17 21:06:59 +02004998
Gilles Peskineff5f0e72019-04-18 12:53:30 +02004999 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DERIVE );
5000 psa_set_key_algorithm( &attributes, alg );
5001 psa_set_key_type( &attributes, PSA_KEY_TYPE_DERIVE );
Gilles Peskined54931c2018-07-17 21:06:59 +02005002
Gilles Peskine049c7532019-05-15 20:22:09 +02005003 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
5004 &handle ) );
Gilles Peskined54931c2018-07-17 21:06:59 +02005005
Janos Follathf2815ea2019-07-03 12:41:36 +01005006 if( !setup_key_derivation_wrap( &operation, handle, alg,
5007 input1->x, input1->len,
5008 input2->x, input2->len,
5009 requested_capacity ) )
5010 goto exit;
Janos Follath47f27ed2019-06-25 13:24:52 +01005011
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005012 PSA_ASSERT( psa_key_derivation_get_capacity( &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02005013 &current_capacity ) );
Gilles Peskinefe11b722018-12-18 00:24:04 +01005014 TEST_EQUAL( current_capacity, expected_capacity );
Gilles Peskined54931c2018-07-17 21:06:59 +02005015
5016 /* Expansion phase. */
5017 while( current_capacity > 0 )
5018 {
5019 size_t read_size = sizeof( output_buffer );
5020 if( read_size > current_capacity )
5021 read_size = current_capacity;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005022 PSA_ASSERT( psa_key_derivation_output_bytes( &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02005023 output_buffer,
5024 read_size ) );
Gilles Peskined54931c2018-07-17 21:06:59 +02005025 expected_capacity -= read_size;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005026 PSA_ASSERT( psa_key_derivation_get_capacity( &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02005027 &current_capacity ) );
Gilles Peskinefe11b722018-12-18 00:24:04 +01005028 TEST_EQUAL( current_capacity, expected_capacity );
Gilles Peskined54931c2018-07-17 21:06:59 +02005029 }
5030
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005031 /* Check that the operation refuses to go over capacity. */
5032 TEST_EQUAL( psa_key_derivation_output_bytes( &operation, output_buffer, 1 ),
David Saadab4ecc272019-02-14 13:48:10 +02005033 PSA_ERROR_INSUFFICIENT_DATA );
Gilles Peskined54931c2018-07-17 21:06:59 +02005034
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005035 PSA_ASSERT( psa_key_derivation_abort( &operation ) );
Gilles Peskined54931c2018-07-17 21:06:59 +02005036
5037exit:
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005038 psa_key_derivation_abort( &operation );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01005039 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02005040 PSA_DONE( );
Gilles Peskined54931c2018-07-17 21:06:59 +02005041}
5042/* END_CASE */
5043
Janos Follathe60c9052019-07-03 13:51:30 +01005044/* BEGIN_CASE */
Gilles Peskine0386fba2018-07-12 17:29:22 +02005045void derive_key_exercise( int alg_arg,
5046 data_t *key_data,
Janos Follathe60c9052019-07-03 13:51:30 +01005047 data_t *input1,
5048 data_t *input2,
Gilles Peskine0386fba2018-07-12 17:29:22 +02005049 int derived_type_arg,
5050 int derived_bits_arg,
5051 int derived_usage_arg,
5052 int derived_alg_arg )
5053{
Ronald Cron91e95152020-07-30 17:48:03 +02005054 psa_key_handle_t base_handle = PSA_KEY_HANDLE_INIT;
5055 psa_key_handle_t derived_handle = PSA_KEY_HANDLE_INIT;
Gilles Peskine0386fba2018-07-12 17:29:22 +02005056 psa_algorithm_t alg = alg_arg;
5057 psa_key_type_t derived_type = derived_type_arg;
5058 size_t derived_bits = derived_bits_arg;
5059 psa_key_usage_t derived_usage = derived_usage_arg;
5060 psa_algorithm_t derived_alg = derived_alg_arg;
5061 size_t capacity = PSA_BITS_TO_BYTES( derived_bits );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005062 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005063 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02005064 psa_key_attributes_t got_attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine0386fba2018-07-12 17:29:22 +02005065
Gilles Peskine8817f612018-12-18 00:18:46 +01005066 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine0386fba2018-07-12 17:29:22 +02005067
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005068 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DERIVE );
5069 psa_set_key_algorithm( &attributes, alg );
5070 psa_set_key_type( &attributes, PSA_KEY_TYPE_DERIVE );
Gilles Peskine049c7532019-05-15 20:22:09 +02005071 PSA_ASSERT( psa_import_key( &attributes, key_data->x, key_data->len,
5072 &base_handle ) );
Gilles Peskine0386fba2018-07-12 17:29:22 +02005073
5074 /* Derive a key. */
Janos Follathe60c9052019-07-03 13:51:30 +01005075 if ( setup_key_derivation_wrap( &operation, base_handle, alg,
5076 input1->x, input1->len,
5077 input2->x, input2->len, capacity ) )
5078 goto exit;
5079
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005080 psa_set_key_usage_flags( &attributes, derived_usage );
5081 psa_set_key_algorithm( &attributes, derived_alg );
5082 psa_set_key_type( &attributes, derived_type );
Gilles Peskine3a4f1f82019-04-26 13:49:28 +02005083 psa_set_key_bits( &attributes, derived_bits );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005084 PSA_ASSERT( psa_key_derivation_output_key( &attributes, &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02005085 &derived_handle ) );
Gilles Peskine0386fba2018-07-12 17:29:22 +02005086
5087 /* Test the key information */
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02005088 PSA_ASSERT( psa_get_key_attributes( derived_handle, &got_attributes ) );
5089 TEST_EQUAL( psa_get_key_type( &got_attributes ), derived_type );
5090 TEST_EQUAL( psa_get_key_bits( &got_attributes ), derived_bits );
Gilles Peskine0386fba2018-07-12 17:29:22 +02005091
5092 /* Exercise the derived key. */
Gilles Peskinebdf309c2018-12-03 15:36:32 +01005093 if( ! exercise_key( derived_handle, derived_usage, derived_alg ) )
Gilles Peskine0386fba2018-07-12 17:29:22 +02005094 goto exit;
5095
5096exit:
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005097 psa_key_derivation_abort( &operation );
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02005098 psa_reset_key_attributes( &got_attributes );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01005099 psa_destroy_key( base_handle );
5100 psa_destroy_key( derived_handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02005101 PSA_DONE( );
Gilles Peskine0386fba2018-07-12 17:29:22 +02005102}
5103/* END_CASE */
5104
Janos Follath42fd8882019-07-03 14:17:09 +01005105/* BEGIN_CASE */
Gilles Peskine0386fba2018-07-12 17:29:22 +02005106void derive_key_export( int alg_arg,
5107 data_t *key_data,
Janos Follath42fd8882019-07-03 14:17:09 +01005108 data_t *input1,
5109 data_t *input2,
Gilles Peskine0386fba2018-07-12 17:29:22 +02005110 int bytes1_arg,
5111 int bytes2_arg )
5112{
Ronald Cron91e95152020-07-30 17:48:03 +02005113 psa_key_handle_t base_handle = PSA_KEY_HANDLE_INIT;
5114 psa_key_handle_t derived_handle = PSA_KEY_HANDLE_INIT;
Gilles Peskine0386fba2018-07-12 17:29:22 +02005115 psa_algorithm_t alg = alg_arg;
5116 size_t bytes1 = bytes1_arg;
5117 size_t bytes2 = bytes2_arg;
5118 size_t capacity = bytes1 + bytes2;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005119 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
Gilles Peskine8cebbba2018-09-27 13:54:18 +02005120 uint8_t *output_buffer = NULL;
5121 uint8_t *export_buffer = NULL;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005122 psa_key_attributes_t base_attributes = PSA_KEY_ATTRIBUTES_INIT;
5123 psa_key_attributes_t derived_attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine0386fba2018-07-12 17:29:22 +02005124 size_t length;
5125
Gilles Peskine8cebbba2018-09-27 13:54:18 +02005126 ASSERT_ALLOC( output_buffer, capacity );
5127 ASSERT_ALLOC( export_buffer, capacity );
Gilles Peskine8817f612018-12-18 00:18:46 +01005128 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine0386fba2018-07-12 17:29:22 +02005129
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005130 psa_set_key_usage_flags( &base_attributes, PSA_KEY_USAGE_DERIVE );
5131 psa_set_key_algorithm( &base_attributes, alg );
5132 psa_set_key_type( &base_attributes, PSA_KEY_TYPE_DERIVE );
Gilles Peskine049c7532019-05-15 20:22:09 +02005133 PSA_ASSERT( psa_import_key( &base_attributes, key_data->x, key_data->len,
5134 &base_handle ) );
Gilles Peskine0386fba2018-07-12 17:29:22 +02005135
5136 /* Derive some material and output it. */
Janos Follath42fd8882019-07-03 14:17:09 +01005137 if( !setup_key_derivation_wrap( &operation, base_handle, alg,
5138 input1->x, input1->len,
5139 input2->x, input2->len, capacity ) )
5140 goto exit;
5141
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005142 PSA_ASSERT( psa_key_derivation_output_bytes( &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02005143 output_buffer,
5144 capacity ) );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005145 PSA_ASSERT( psa_key_derivation_abort( &operation ) );
Gilles Peskine0386fba2018-07-12 17:29:22 +02005146
5147 /* Derive the same output again, but this time store it in key objects. */
Janos Follath42fd8882019-07-03 14:17:09 +01005148 if( !setup_key_derivation_wrap( &operation, base_handle, alg,
5149 input1->x, input1->len,
5150 input2->x, input2->len, capacity ) )
5151 goto exit;
5152
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005153 psa_set_key_usage_flags( &derived_attributes, PSA_KEY_USAGE_EXPORT );
5154 psa_set_key_algorithm( &derived_attributes, 0 );
5155 psa_set_key_type( &derived_attributes, PSA_KEY_TYPE_RAW_DATA );
Gilles Peskine3a4f1f82019-04-26 13:49:28 +02005156 psa_set_key_bits( &derived_attributes, PSA_BYTES_TO_BITS( bytes1 ) );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005157 PSA_ASSERT( psa_key_derivation_output_key( &derived_attributes, &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02005158 &derived_handle ) );
Gilles Peskine8817f612018-12-18 00:18:46 +01005159 PSA_ASSERT( psa_export_key( derived_handle,
5160 export_buffer, bytes1,
5161 &length ) );
Gilles Peskinefe11b722018-12-18 00:24:04 +01005162 TEST_EQUAL( length, bytes1 );
Gilles Peskine8817f612018-12-18 00:18:46 +01005163 PSA_ASSERT( psa_destroy_key( derived_handle ) );
Gilles Peskine3a4f1f82019-04-26 13:49:28 +02005164 psa_set_key_bits( &derived_attributes, PSA_BYTES_TO_BITS( bytes2 ) );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005165 PSA_ASSERT( psa_key_derivation_output_key( &derived_attributes, &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02005166 &derived_handle ) );
Gilles Peskine8817f612018-12-18 00:18:46 +01005167 PSA_ASSERT( psa_export_key( derived_handle,
5168 export_buffer + bytes1, bytes2,
5169 &length ) );
Gilles Peskinefe11b722018-12-18 00:24:04 +01005170 TEST_EQUAL( length, bytes2 );
Gilles Peskine0386fba2018-07-12 17:29:22 +02005171
5172 /* Compare the outputs from the two runs. */
Gilles Peskine0dfba2d2018-12-18 00:40:50 +01005173 ASSERT_COMPARE( output_buffer, bytes1 + bytes2,
5174 export_buffer, capacity );
Gilles Peskine0386fba2018-07-12 17:29:22 +02005175
5176exit:
5177 mbedtls_free( output_buffer );
5178 mbedtls_free( export_buffer );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005179 psa_key_derivation_abort( &operation );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01005180 psa_destroy_key( base_handle );
5181 psa_destroy_key( derived_handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02005182 PSA_DONE( );
Gilles Peskine0386fba2018-07-12 17:29:22 +02005183}
5184/* END_CASE */
5185
5186/* BEGIN_CASE */
Gilles Peskine7c227ae2019-07-31 15:14:44 +02005187void derive_key( int alg_arg,
5188 data_t *key_data, data_t *input1, data_t *input2,
5189 int type_arg, int bits_arg,
5190 int expected_status_arg )
Gilles Peskinec744d992019-07-30 17:26:54 +02005191{
Ronald Cron91e95152020-07-30 17:48:03 +02005192 psa_key_handle_t base_handle = PSA_KEY_HANDLE_INIT;
5193 psa_key_handle_t derived_handle = PSA_KEY_HANDLE_INIT;
Gilles Peskinec744d992019-07-30 17:26:54 +02005194 psa_algorithm_t alg = alg_arg;
Gilles Peskine7c227ae2019-07-31 15:14:44 +02005195 psa_key_type_t type = type_arg;
Gilles Peskinec744d992019-07-30 17:26:54 +02005196 size_t bits = bits_arg;
5197 psa_status_t expected_status = expected_status_arg;
5198 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
5199 psa_key_attributes_t base_attributes = PSA_KEY_ATTRIBUTES_INIT;
5200 psa_key_attributes_t derived_attributes = PSA_KEY_ATTRIBUTES_INIT;
5201
5202 PSA_ASSERT( psa_crypto_init( ) );
5203
5204 psa_set_key_usage_flags( &base_attributes, PSA_KEY_USAGE_DERIVE );
5205 psa_set_key_algorithm( &base_attributes, alg );
5206 psa_set_key_type( &base_attributes, PSA_KEY_TYPE_DERIVE );
5207 PSA_ASSERT( psa_import_key( &base_attributes, key_data->x, key_data->len,
5208 &base_handle ) );
5209
5210 if( !setup_key_derivation_wrap( &operation, base_handle, alg,
5211 input1->x, input1->len,
5212 input2->x, input2->len, SIZE_MAX ) )
5213 goto exit;
5214
5215 psa_set_key_usage_flags( &derived_attributes, PSA_KEY_USAGE_EXPORT );
5216 psa_set_key_algorithm( &derived_attributes, 0 );
Gilles Peskine7c227ae2019-07-31 15:14:44 +02005217 psa_set_key_type( &derived_attributes, type );
Gilles Peskinec744d992019-07-30 17:26:54 +02005218 psa_set_key_bits( &derived_attributes, bits );
5219 TEST_EQUAL( psa_key_derivation_output_key( &derived_attributes, &operation,
5220 &derived_handle ),
5221 expected_status );
5222
5223exit:
5224 psa_key_derivation_abort( &operation );
5225 psa_destroy_key( base_handle );
5226 psa_destroy_key( derived_handle );
5227 PSA_DONE( );
5228}
5229/* END_CASE */
5230
5231/* BEGIN_CASE */
Gilles Peskine01d718c2018-09-18 12:01:02 +02005232void key_agreement_setup( int alg_arg,
Steven Cooremance48e852020-10-05 16:02:45 +02005233 int our_key_type_arg, int our_key_alg_arg,
5234 data_t *our_key_data, data_t *peer_key_data,
Gilles Peskine01d718c2018-09-18 12:01:02 +02005235 int expected_status_arg )
5236{
Ronald Cron91e95152020-07-30 17:48:03 +02005237 psa_key_handle_t our_key = PSA_KEY_HANDLE_INIT;
Gilles Peskine01d718c2018-09-18 12:01:02 +02005238 psa_algorithm_t alg = alg_arg;
Steven Cooremanfa5e6312020-10-15 17:07:12 +02005239 psa_algorithm_t our_key_alg = our_key_alg_arg;
Gilles Peskine01d718c2018-09-18 12:01:02 +02005240 psa_key_type_t our_key_type = our_key_type_arg;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005241 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005242 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine77f40d82019-04-11 21:27:06 +02005243 psa_status_t expected_status = expected_status_arg;
5244 psa_status_t status;
Gilles Peskine01d718c2018-09-18 12:01:02 +02005245
Gilles Peskine8817f612018-12-18 00:18:46 +01005246 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine01d718c2018-09-18 12:01:02 +02005247
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005248 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DERIVE );
Steven Cooremanfa5e6312020-10-15 17:07:12 +02005249 psa_set_key_algorithm( &attributes, our_key_alg );
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005250 psa_set_key_type( &attributes, our_key_type );
Gilles Peskine049c7532019-05-15 20:22:09 +02005251 PSA_ASSERT( psa_import_key( &attributes,
5252 our_key_data->x, our_key_data->len,
5253 &our_key ) );
Gilles Peskine01d718c2018-09-18 12:01:02 +02005254
Gilles Peskine77f40d82019-04-11 21:27:06 +02005255 /* The tests currently include inputs that should fail at either step.
5256 * Test cases that fail at the setup step should be changed to call
5257 * key_derivation_setup instead, and this function should be renamed
5258 * to key_agreement_fail. */
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005259 status = psa_key_derivation_setup( &operation, alg );
Gilles Peskine77f40d82019-04-11 21:27:06 +02005260 if( status == PSA_SUCCESS )
5261 {
Gilles Peskinecf7292e2019-05-16 17:53:40 +02005262 TEST_EQUAL( psa_key_derivation_key_agreement(
5263 &operation, PSA_KEY_DERIVATION_INPUT_SECRET,
5264 our_key,
5265 peer_key_data->x, peer_key_data->len ),
Gilles Peskine77f40d82019-04-11 21:27:06 +02005266 expected_status );
5267 }
5268 else
5269 {
5270 TEST_ASSERT( status == expected_status );
5271 }
Gilles Peskine01d718c2018-09-18 12:01:02 +02005272
5273exit:
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005274 psa_key_derivation_abort( &operation );
Gilles Peskine01d718c2018-09-18 12:01:02 +02005275 psa_destroy_key( our_key );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02005276 PSA_DONE( );
Gilles Peskine01d718c2018-09-18 12:01:02 +02005277}
5278/* END_CASE */
5279
5280/* BEGIN_CASE */
Gilles Peskinef0cba732019-04-11 22:12:38 +02005281void raw_key_agreement( int alg_arg,
5282 int our_key_type_arg, data_t *our_key_data,
5283 data_t *peer_key_data,
5284 data_t *expected_output )
5285{
Ronald Cron91e95152020-07-30 17:48:03 +02005286 psa_key_handle_t our_key = PSA_KEY_HANDLE_INIT;
Gilles Peskinef0cba732019-04-11 22:12:38 +02005287 psa_algorithm_t alg = alg_arg;
5288 psa_key_type_t our_key_type = our_key_type_arg;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005289 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskinef0cba732019-04-11 22:12:38 +02005290 unsigned char *output = NULL;
5291 size_t output_length = ~0;
5292
5293 ASSERT_ALLOC( output, expected_output->len );
5294 PSA_ASSERT( psa_crypto_init( ) );
5295
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005296 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DERIVE );
5297 psa_set_key_algorithm( &attributes, alg );
5298 psa_set_key_type( &attributes, our_key_type );
Gilles Peskine049c7532019-05-15 20:22:09 +02005299 PSA_ASSERT( psa_import_key( &attributes,
5300 our_key_data->x, our_key_data->len,
5301 &our_key ) );
Gilles Peskinef0cba732019-04-11 22:12:38 +02005302
Gilles Peskinebe697d82019-05-16 18:00:41 +02005303 PSA_ASSERT( psa_raw_key_agreement( alg, our_key,
5304 peer_key_data->x, peer_key_data->len,
5305 output, expected_output->len,
5306 &output_length ) );
Gilles Peskinef0cba732019-04-11 22:12:38 +02005307 ASSERT_COMPARE( output, output_length,
5308 expected_output->x, expected_output->len );
5309
5310exit:
5311 mbedtls_free( output );
5312 psa_destroy_key( our_key );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02005313 PSA_DONE( );
Gilles Peskinef0cba732019-04-11 22:12:38 +02005314}
5315/* END_CASE */
5316
5317/* BEGIN_CASE */
Gilles Peskine59685592018-09-18 12:11:34 +02005318void key_agreement_capacity( int alg_arg,
5319 int our_key_type_arg, data_t *our_key_data,
5320 data_t *peer_key_data,
5321 int expected_capacity_arg )
5322{
Ronald Cron91e95152020-07-30 17:48:03 +02005323 psa_key_handle_t our_key = PSA_KEY_HANDLE_INIT;
Gilles Peskine59685592018-09-18 12:11:34 +02005324 psa_algorithm_t alg = alg_arg;
5325 psa_key_type_t our_key_type = our_key_type_arg;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005326 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005327 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine59685592018-09-18 12:11:34 +02005328 size_t actual_capacity;
Gilles Peskinebf491972018-10-25 22:36:12 +02005329 unsigned char output[16];
Gilles Peskine59685592018-09-18 12:11:34 +02005330
Gilles Peskine8817f612018-12-18 00:18:46 +01005331 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine59685592018-09-18 12:11:34 +02005332
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005333 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DERIVE );
5334 psa_set_key_algorithm( &attributes, alg );
5335 psa_set_key_type( &attributes, our_key_type );
Gilles Peskine049c7532019-05-15 20:22:09 +02005336 PSA_ASSERT( psa_import_key( &attributes,
5337 our_key_data->x, our_key_data->len,
5338 &our_key ) );
Gilles Peskine59685592018-09-18 12:11:34 +02005339
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005340 PSA_ASSERT( psa_key_derivation_setup( &operation, alg ) );
Gilles Peskinecf7292e2019-05-16 17:53:40 +02005341 PSA_ASSERT( psa_key_derivation_key_agreement(
5342 &operation,
5343 PSA_KEY_DERIVATION_INPUT_SECRET, our_key,
5344 peer_key_data->x, peer_key_data->len ) );
Gilles Peskinef8a9d942019-04-11 22:13:20 +02005345 if( PSA_ALG_IS_HKDF( PSA_ALG_KEY_AGREEMENT_GET_KDF( alg ) ) )
5346 {
5347 /* The test data is for info="" */
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005348 PSA_ASSERT( psa_key_derivation_input_bytes( &operation,
Gilles Peskine03410b52019-05-16 16:05:19 +02005349 PSA_KEY_DERIVATION_INPUT_INFO,
Gilles Peskinef8a9d942019-04-11 22:13:20 +02005350 NULL, 0 ) );
5351 }
Gilles Peskine59685592018-09-18 12:11:34 +02005352
Gilles Peskinebf491972018-10-25 22:36:12 +02005353 /* Test the advertized capacity. */
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02005354 PSA_ASSERT( psa_key_derivation_get_capacity(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005355 &operation, &actual_capacity ) );
Gilles Peskinefe11b722018-12-18 00:24:04 +01005356 TEST_EQUAL( actual_capacity, (size_t) expected_capacity_arg );
Gilles Peskine59685592018-09-18 12:11:34 +02005357
Gilles Peskinebf491972018-10-25 22:36:12 +02005358 /* Test the actual capacity by reading the output. */
5359 while( actual_capacity > sizeof( output ) )
5360 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005361 PSA_ASSERT( psa_key_derivation_output_bytes( &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02005362 output, sizeof( output ) ) );
Gilles Peskinebf491972018-10-25 22:36:12 +02005363 actual_capacity -= sizeof( output );
5364 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005365 PSA_ASSERT( psa_key_derivation_output_bytes( &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02005366 output, actual_capacity ) );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005367 TEST_EQUAL( psa_key_derivation_output_bytes( &operation, output, 1 ),
David Saadab4ecc272019-02-14 13:48:10 +02005368 PSA_ERROR_INSUFFICIENT_DATA );
Gilles Peskinebf491972018-10-25 22:36:12 +02005369
Gilles Peskine59685592018-09-18 12:11:34 +02005370exit:
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005371 psa_key_derivation_abort( &operation );
Gilles Peskine59685592018-09-18 12:11:34 +02005372 psa_destroy_key( our_key );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02005373 PSA_DONE( );
Gilles Peskine59685592018-09-18 12:11:34 +02005374}
5375/* END_CASE */
5376
5377/* BEGIN_CASE */
5378void key_agreement_output( int alg_arg,
5379 int our_key_type_arg, data_t *our_key_data,
5380 data_t *peer_key_data,
Gilles Peskine3ec8ed82018-10-25 22:37:15 +02005381 data_t *expected_output1, data_t *expected_output2 )
Gilles Peskine59685592018-09-18 12:11:34 +02005382{
Ronald Cron91e95152020-07-30 17:48:03 +02005383 psa_key_handle_t our_key = PSA_KEY_HANDLE_INIT;
Gilles Peskine59685592018-09-18 12:11:34 +02005384 psa_algorithm_t alg = alg_arg;
5385 psa_key_type_t our_key_type = our_key_type_arg;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005386 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005387 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine3ec8ed82018-10-25 22:37:15 +02005388 uint8_t *actual_output = NULL;
Gilles Peskine59685592018-09-18 12:11:34 +02005389
Gilles Peskine3ec8ed82018-10-25 22:37:15 +02005390 ASSERT_ALLOC( actual_output, MAX( expected_output1->len,
5391 expected_output2->len ) );
Gilles Peskine59685592018-09-18 12:11:34 +02005392
Gilles Peskine8817f612018-12-18 00:18:46 +01005393 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine59685592018-09-18 12:11:34 +02005394
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005395 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DERIVE );
5396 psa_set_key_algorithm( &attributes, alg );
5397 psa_set_key_type( &attributes, our_key_type );
Gilles Peskine049c7532019-05-15 20:22:09 +02005398 PSA_ASSERT( psa_import_key( &attributes,
5399 our_key_data->x, our_key_data->len,
5400 &our_key ) );
Gilles Peskine59685592018-09-18 12:11:34 +02005401
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005402 PSA_ASSERT( psa_key_derivation_setup( &operation, alg ) );
Gilles Peskinecf7292e2019-05-16 17:53:40 +02005403 PSA_ASSERT( psa_key_derivation_key_agreement(
5404 &operation,
5405 PSA_KEY_DERIVATION_INPUT_SECRET, our_key,
5406 peer_key_data->x, peer_key_data->len ) );
Gilles Peskinef8a9d942019-04-11 22:13:20 +02005407 if( PSA_ALG_IS_HKDF( PSA_ALG_KEY_AGREEMENT_GET_KDF( alg ) ) )
5408 {
5409 /* The test data is for info="" */
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005410 PSA_ASSERT( psa_key_derivation_input_bytes( &operation,
Gilles Peskine03410b52019-05-16 16:05:19 +02005411 PSA_KEY_DERIVATION_INPUT_INFO,
Gilles Peskinef8a9d942019-04-11 22:13:20 +02005412 NULL, 0 ) );
5413 }
Gilles Peskine59685592018-09-18 12:11:34 +02005414
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005415 PSA_ASSERT( psa_key_derivation_output_bytes( &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02005416 actual_output,
5417 expected_output1->len ) );
Gilles Peskine0dfba2d2018-12-18 00:40:50 +01005418 ASSERT_COMPARE( actual_output, expected_output1->len,
5419 expected_output1->x, expected_output1->len );
Gilles Peskine3ec8ed82018-10-25 22:37:15 +02005420 if( expected_output2->len != 0 )
5421 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005422 PSA_ASSERT( psa_key_derivation_output_bytes( &operation,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02005423 actual_output,
5424 expected_output2->len ) );
Gilles Peskine0dfba2d2018-12-18 00:40:50 +01005425 ASSERT_COMPARE( actual_output, expected_output2->len,
5426 expected_output2->x, expected_output2->len );
Gilles Peskine3ec8ed82018-10-25 22:37:15 +02005427 }
Gilles Peskine59685592018-09-18 12:11:34 +02005428
5429exit:
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005430 psa_key_derivation_abort( &operation );
Gilles Peskine59685592018-09-18 12:11:34 +02005431 psa_destroy_key( our_key );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02005432 PSA_DONE( );
Gilles Peskine59685592018-09-18 12:11:34 +02005433 mbedtls_free( actual_output );
5434}
5435/* END_CASE */
5436
5437/* BEGIN_CASE */
Gilles Peskinea50d7392018-06-21 10:22:13 +02005438void generate_random( int bytes_arg )
Gilles Peskine05d69892018-06-19 22:00:52 +02005439{
Gilles Peskinea50d7392018-06-21 10:22:13 +02005440 size_t bytes = bytes_arg;
5441 const unsigned char trail[] = "don't overwrite me";
Gilles Peskine8cebbba2018-09-27 13:54:18 +02005442 unsigned char *output = NULL;
5443 unsigned char *changed = NULL;
Gilles Peskinea50d7392018-06-21 10:22:13 +02005444 size_t i;
5445 unsigned run;
Gilles Peskine05d69892018-06-19 22:00:52 +02005446
Simon Butcher49f8e312020-03-03 15:51:50 +00005447 TEST_ASSERT( bytes_arg >= 0 );
5448
Gilles Peskine8cebbba2018-09-27 13:54:18 +02005449 ASSERT_ALLOC( output, bytes + sizeof( trail ) );
5450 ASSERT_ALLOC( changed, bytes );
Gilles Peskinea50d7392018-06-21 10:22:13 +02005451 memcpy( output + bytes, trail, sizeof( trail ) );
Gilles Peskine05d69892018-06-19 22:00:52 +02005452
Gilles Peskine8817f612018-12-18 00:18:46 +01005453 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine05d69892018-06-19 22:00:52 +02005454
Gilles Peskinea50d7392018-06-21 10:22:13 +02005455 /* Run several times, to ensure that every output byte will be
5456 * nonzero at least once with overwhelming probability
5457 * (2^(-8*number_of_runs)). */
5458 for( run = 0; run < 10; run++ )
Gilles Peskine05d69892018-06-19 22:00:52 +02005459 {
Gilles Peskinef7ab5ad2018-09-26 18:19:24 +02005460 if( bytes != 0 )
5461 memset( output, 0, bytes );
Gilles Peskine8817f612018-12-18 00:18:46 +01005462 PSA_ASSERT( psa_generate_random( output, bytes ) );
Gilles Peskinea50d7392018-06-21 10:22:13 +02005463
5464 /* Check that no more than bytes have been overwritten */
Gilles Peskine0dfba2d2018-12-18 00:40:50 +01005465 ASSERT_COMPARE( output + bytes, sizeof( trail ),
5466 trail, sizeof( trail ) );
Gilles Peskinea50d7392018-06-21 10:22:13 +02005467
5468 for( i = 0; i < bytes; i++ )
5469 {
5470 if( output[i] != 0 )
5471 ++changed[i];
5472 }
Gilles Peskine05d69892018-06-19 22:00:52 +02005473 }
Gilles Peskinea50d7392018-06-21 10:22:13 +02005474
5475 /* Check that every byte was changed to nonzero at least once. This
5476 * validates that psa_generate_random is overwriting every byte of
5477 * the output buffer. */
5478 for( i = 0; i < bytes; i++ )
5479 {
5480 TEST_ASSERT( changed[i] != 0 );
5481 }
Gilles Peskine05d69892018-06-19 22:00:52 +02005482
5483exit:
Gilles Peskine1153e7b2019-05-28 15:10:21 +02005484 PSA_DONE( );
Gilles Peskinea50d7392018-06-21 10:22:13 +02005485 mbedtls_free( output );
5486 mbedtls_free( changed );
Gilles Peskine05d69892018-06-19 22:00:52 +02005487}
5488/* END_CASE */
Gilles Peskine12313cd2018-06-20 00:20:32 +02005489
5490/* BEGIN_CASE */
5491void generate_key( int type_arg,
5492 int bits_arg,
5493 int usage_arg,
5494 int alg_arg,
5495 int expected_status_arg )
5496{
Ronald Cron91e95152020-07-30 17:48:03 +02005497 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskine12313cd2018-06-20 00:20:32 +02005498 psa_key_type_t type = type_arg;
5499 psa_key_usage_t usage = usage_arg;
5500 size_t bits = bits_arg;
5501 psa_algorithm_t alg = alg_arg;
5502 psa_status_t expected_status = expected_status_arg;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005503 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02005504 psa_key_attributes_t got_attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine12313cd2018-06-20 00:20:32 +02005505
Gilles Peskine8817f612018-12-18 00:18:46 +01005506 PSA_ASSERT( psa_crypto_init( ) );
Gilles Peskine12313cd2018-06-20 00:20:32 +02005507
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005508 psa_set_key_usage_flags( &attributes, usage );
5509 psa_set_key_algorithm( &attributes, alg );
5510 psa_set_key_type( &attributes, type );
Gilles Peskine3a4f1f82019-04-26 13:49:28 +02005511 psa_set_key_bits( &attributes, bits );
Gilles Peskine12313cd2018-06-20 00:20:32 +02005512
5513 /* Generate a key */
Gilles Peskine35ef36b2019-05-16 19:42:05 +02005514 TEST_EQUAL( psa_generate_key( &attributes, &handle ), expected_status );
Gilles Peskinee56e8782019-04-26 17:34:02 +02005515 if( expected_status != PSA_SUCCESS )
Gilles Peskineff5f0e72019-04-18 12:53:30 +02005516 goto exit;
Gilles Peskine12313cd2018-06-20 00:20:32 +02005517
5518 /* Test the key information */
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02005519 PSA_ASSERT( psa_get_key_attributes( handle, &got_attributes ) );
5520 TEST_EQUAL( psa_get_key_type( &got_attributes ), type );
5521 TEST_EQUAL( psa_get_key_bits( &got_attributes ), bits );
Gilles Peskine12313cd2018-06-20 00:20:32 +02005522
Gilles Peskine818ca122018-06-20 18:16:48 +02005523 /* Do something with the key according to its type and permitted usage. */
Gilles Peskinebdf309c2018-12-03 15:36:32 +01005524 if( ! exercise_key( handle, usage, alg ) )
Gilles Peskine02b75072018-07-01 22:31:34 +02005525 goto exit;
Gilles Peskine12313cd2018-06-20 00:20:32 +02005526
5527exit:
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02005528 psa_reset_key_attributes( &got_attributes );
Gilles Peskinebdf309c2018-12-03 15:36:32 +01005529 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02005530 PSA_DONE( );
Gilles Peskine12313cd2018-06-20 00:20:32 +02005531}
5532/* END_CASE */
itayzafrir0adf0fc2018-09-06 16:24:41 +03005533
Gilles Peskinee56e8782019-04-26 17:34:02 +02005534/* BEGIN_CASE depends_on:MBEDTLS_RSA_C:MBEDTLS_GENPRIME:MBEDTLS_PKCS1_V15 */
5535void generate_key_rsa( int bits_arg,
5536 data_t *e_arg,
5537 int expected_status_arg )
5538{
Ronald Cron91e95152020-07-30 17:48:03 +02005539 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
Gilles Peskinec93b80c2019-05-16 19:39:54 +02005540 psa_key_type_t type = PSA_KEY_TYPE_RSA_KEY_PAIR;
Gilles Peskinee56e8782019-04-26 17:34:02 +02005541 size_t bits = bits_arg;
5542 psa_key_usage_t usage = PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT;
5543 psa_algorithm_t alg = PSA_ALG_RSA_PKCS1V15_SIGN_RAW;
5544 psa_status_t expected_status = expected_status_arg;
5545 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
5546 uint8_t *exported = NULL;
5547 size_t exported_size =
5548 PSA_KEY_EXPORT_MAX_SIZE( PSA_KEY_TYPE_RSA_PUBLIC_KEY, bits );
5549 size_t exported_length = SIZE_MAX;
5550 uint8_t *e_read_buffer = NULL;
5551 int is_default_public_exponent = 0;
Gilles Peskineaa02c172019-04-28 11:44:17 +02005552 size_t e_read_size = PSA_KEY_DOMAIN_PARAMETERS_SIZE( type, bits );
Gilles Peskinee56e8782019-04-26 17:34:02 +02005553 size_t e_read_length = SIZE_MAX;
5554
5555 if( e_arg->len == 0 ||
5556 ( e_arg->len == 3 &&
5557 e_arg->x[0] == 1 && e_arg->x[1] == 0 && e_arg->x[2] == 1 ) )
5558 {
5559 is_default_public_exponent = 1;
5560 e_read_size = 0;
5561 }
5562 ASSERT_ALLOC( e_read_buffer, e_read_size );
5563 ASSERT_ALLOC( exported, exported_size );
5564
5565 PSA_ASSERT( psa_crypto_init( ) );
5566
5567 psa_set_key_usage_flags( &attributes, usage );
5568 psa_set_key_algorithm( &attributes, alg );
5569 PSA_ASSERT( psa_set_key_domain_parameters( &attributes, type,
5570 e_arg->x, e_arg->len ) );
5571 psa_set_key_bits( &attributes, bits );
5572
5573 /* Generate a key */
Gilles Peskine35ef36b2019-05-16 19:42:05 +02005574 TEST_EQUAL( psa_generate_key( &attributes, &handle ), expected_status );
Gilles Peskinee56e8782019-04-26 17:34:02 +02005575 if( expected_status != PSA_SUCCESS )
5576 goto exit;
5577
5578 /* Test the key information */
5579 PSA_ASSERT( psa_get_key_attributes( handle, &attributes ) );
5580 TEST_EQUAL( psa_get_key_type( &attributes ), type );
5581 TEST_EQUAL( psa_get_key_bits( &attributes ), bits );
5582 PSA_ASSERT( psa_get_key_domain_parameters( &attributes,
5583 e_read_buffer, e_read_size,
5584 &e_read_length ) );
5585 if( is_default_public_exponent )
5586 TEST_EQUAL( e_read_length, 0 );
5587 else
5588 ASSERT_COMPARE( e_read_buffer, e_read_length, e_arg->x, e_arg->len );
5589
5590 /* Do something with the key according to its type and permitted usage. */
5591 if( ! exercise_key( handle, usage, alg ) )
5592 goto exit;
5593
5594 /* Export the key and check the public exponent. */
5595 PSA_ASSERT( psa_export_public_key( handle,
5596 exported, exported_size,
5597 &exported_length ) );
5598 {
5599 uint8_t *p = exported;
5600 uint8_t *end = exported + exported_length;
5601 size_t len;
5602 /* RSAPublicKey ::= SEQUENCE {
5603 * modulus INTEGER, -- n
5604 * publicExponent INTEGER } -- e
5605 */
5606 TEST_EQUAL( 0, mbedtls_asn1_get_tag( &p, end, &len,
Gilles Peskinecf7292e2019-05-16 17:53:40 +02005607 MBEDTLS_ASN1_SEQUENCE |
5608 MBEDTLS_ASN1_CONSTRUCTED ) );
Gilles Peskinee56e8782019-04-26 17:34:02 +02005609 TEST_ASSERT( asn1_skip_integer( &p, end, bits, bits, 1 ) );
5610 TEST_EQUAL( 0, mbedtls_asn1_get_tag( &p, end, &len,
5611 MBEDTLS_ASN1_INTEGER ) );
5612 if( len >= 1 && p[0] == 0 )
5613 {
5614 ++p;
5615 --len;
5616 }
5617 if( e_arg->len == 0 )
5618 {
5619 TEST_EQUAL( len, 3 );
5620 TEST_EQUAL( p[0], 1 );
5621 TEST_EQUAL( p[1], 0 );
5622 TEST_EQUAL( p[2], 1 );
5623 }
5624 else
5625 ASSERT_COMPARE( p, len, e_arg->x, e_arg->len );
5626 }
5627
5628exit:
5629 psa_reset_key_attributes( &attributes );
5630 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02005631 PSA_DONE( );
Gilles Peskinee56e8782019-04-26 17:34:02 +02005632 mbedtls_free( e_read_buffer );
5633 mbedtls_free( exported );
5634}
5635/* END_CASE */
5636
Darryl Greend49a4992018-06-18 17:27:26 +01005637/* BEGIN_CASE depends_on:MBEDTLS_PSA_CRYPTO_STORAGE_C */
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005638void persistent_key_load_key_from_storage( data_t *data,
5639 int type_arg, int bits_arg,
5640 int usage_flags_arg, int alg_arg,
5641 int generation_method )
Darryl Greend49a4992018-06-18 17:27:26 +01005642{
Ronald Cron71016a92020-08-28 19:01:50 +02005643 mbedtls_svc_key_id_t key_id = mbedtls_svc_key_id_make( 1, 1 );
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005644 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Ronald Cron91e95152020-07-30 17:48:03 +02005645 psa_key_handle_t handle = PSA_KEY_HANDLE_INIT;
5646 psa_key_handle_t base_key = PSA_KEY_HANDLE_INIT;
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005647 psa_key_type_t type = type_arg;
5648 size_t bits = bits_arg;
5649 psa_key_usage_t usage_flags = usage_flags_arg;
5650 psa_algorithm_t alg = alg_arg;
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005651 psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
Darryl Greend49a4992018-06-18 17:27:26 +01005652 unsigned char *first_export = NULL;
5653 unsigned char *second_export = NULL;
5654 size_t export_size = PSA_KEY_EXPORT_MAX_SIZE( type, bits );
5655 size_t first_exported_length;
5656 size_t second_exported_length;
5657
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005658 if( usage_flags & PSA_KEY_USAGE_EXPORT )
5659 {
5660 ASSERT_ALLOC( first_export, export_size );
5661 ASSERT_ALLOC( second_export, export_size );
5662 }
Darryl Greend49a4992018-06-18 17:27:26 +01005663
Gilles Peskine8817f612018-12-18 00:18:46 +01005664 PSA_ASSERT( psa_crypto_init() );
Darryl Greend49a4992018-06-18 17:27:26 +01005665
Gilles Peskinec87af662019-05-15 16:12:22 +02005666 psa_set_key_id( &attributes, key_id );
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005667 psa_set_key_usage_flags( &attributes, usage_flags );
5668 psa_set_key_algorithm( &attributes, alg );
5669 psa_set_key_type( &attributes, type );
Gilles Peskine3a4f1f82019-04-26 13:49:28 +02005670 psa_set_key_bits( &attributes, bits );
Darryl Greend49a4992018-06-18 17:27:26 +01005671
Darryl Green0c6575a2018-11-07 16:05:30 +00005672 switch( generation_method )
5673 {
5674 case IMPORT_KEY:
5675 /* Import the key */
Gilles Peskine049c7532019-05-15 20:22:09 +02005676 PSA_ASSERT( psa_import_key( &attributes, data->x, data->len,
5677 &handle ) );
Darryl Green0c6575a2018-11-07 16:05:30 +00005678 break;
Darryl Greend49a4992018-06-18 17:27:26 +01005679
Darryl Green0c6575a2018-11-07 16:05:30 +00005680 case GENERATE_KEY:
5681 /* Generate a key */
Gilles Peskine35ef36b2019-05-16 19:42:05 +02005682 PSA_ASSERT( psa_generate_key( &attributes, &handle ) );
Darryl Green0c6575a2018-11-07 16:05:30 +00005683 break;
5684
5685 case DERIVE_KEY:
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005686 {
5687 /* Create base key */
5688 psa_algorithm_t derive_alg = PSA_ALG_HKDF( PSA_ALG_SHA_256 );
5689 psa_key_attributes_t base_attributes = PSA_KEY_ATTRIBUTES_INIT;
5690 psa_set_key_usage_flags( &base_attributes,
5691 PSA_KEY_USAGE_DERIVE );
5692 psa_set_key_algorithm( &base_attributes, derive_alg );
5693 psa_set_key_type( &base_attributes, PSA_KEY_TYPE_DERIVE );
Gilles Peskine049c7532019-05-15 20:22:09 +02005694 PSA_ASSERT( psa_import_key( &base_attributes,
5695 data->x, data->len,
5696 &base_key ) );
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005697 /* Derive a key. */
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005698 PSA_ASSERT( psa_key_derivation_setup( &operation, derive_alg ) );
Gilles Peskinecf7292e2019-05-16 17:53:40 +02005699 PSA_ASSERT( psa_key_derivation_input_key(
5700 &operation,
5701 PSA_KEY_DERIVATION_INPUT_SECRET, base_key ) );
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005702 PSA_ASSERT( psa_key_derivation_input_bytes(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005703 &operation, PSA_KEY_DERIVATION_INPUT_INFO,
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005704 NULL, 0 ) );
Gilles Peskinecf7292e2019-05-16 17:53:40 +02005705 PSA_ASSERT( psa_key_derivation_output_key( &attributes,
5706 &operation,
5707 &handle ) );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005708 PSA_ASSERT( psa_key_derivation_abort( &operation ) );
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005709 PSA_ASSERT( psa_destroy_key( base_key ) );
Ronald Cron91e95152020-07-30 17:48:03 +02005710 base_key = PSA_KEY_HANDLE_INIT;
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005711 }
Gilles Peskinecf7292e2019-05-16 17:53:40 +02005712 break;
Darryl Green0c6575a2018-11-07 16:05:30 +00005713 }
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005714 psa_reset_key_attributes( &attributes );
Darryl Greend49a4992018-06-18 17:27:26 +01005715
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005716 /* Export the key if permitted by the key policy. */
5717 if( usage_flags & PSA_KEY_USAGE_EXPORT )
5718 {
5719 PSA_ASSERT( psa_export_key( handle,
5720 first_export, export_size,
5721 &first_exported_length ) );
5722 if( generation_method == IMPORT_KEY )
5723 ASSERT_COMPARE( data->x, data->len,
5724 first_export, first_exported_length );
5725 }
Darryl Greend49a4992018-06-18 17:27:26 +01005726
5727 /* Shutdown and restart */
Gilles Peskine76b29a72019-05-28 14:08:50 +02005728 PSA_ASSERT( psa_close_key( handle ) );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02005729 PSA_DONE();
Gilles Peskine8817f612018-12-18 00:18:46 +01005730 PSA_ASSERT( psa_crypto_init() );
Darryl Greend49a4992018-06-18 17:27:26 +01005731
Darryl Greend49a4992018-06-18 17:27:26 +01005732 /* Check key slot still contains key data */
Gilles Peskine225010f2019-05-06 18:44:55 +02005733 PSA_ASSERT( psa_open_key( key_id, &handle ) );
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005734 PSA_ASSERT( psa_get_key_attributes( handle, &attributes ) );
Ronald Cronecfb2372020-07-23 17:13:42 +02005735 TEST_ASSERT( mbedtls_svc_key_id_equal(
5736 psa_get_key_id( &attributes ), key_id ) );
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005737 TEST_EQUAL( psa_get_key_lifetime( &attributes ),
5738 PSA_KEY_LIFETIME_PERSISTENT );
5739 TEST_EQUAL( psa_get_key_type( &attributes ), type );
5740 TEST_EQUAL( psa_get_key_bits( &attributes ), bits );
5741 TEST_EQUAL( psa_get_key_usage_flags( &attributes ), usage_flags );
5742 TEST_EQUAL( psa_get_key_algorithm( &attributes ), alg );
Darryl Greend49a4992018-06-18 17:27:26 +01005743
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005744 /* Export the key again if permitted by the key policy. */
5745 if( usage_flags & PSA_KEY_USAGE_EXPORT )
Darryl Green0c6575a2018-11-07 16:05:30 +00005746 {
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005747 PSA_ASSERT( psa_export_key( handle,
5748 second_export, export_size,
5749 &second_exported_length ) );
Darryl Green0c6575a2018-11-07 16:05:30 +00005750 ASSERT_COMPARE( first_export, first_exported_length,
5751 second_export, second_exported_length );
Darryl Green0c6575a2018-11-07 16:05:30 +00005752 }
5753
5754 /* Do something with the key according to its type and permitted usage. */
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005755 if( ! exercise_key( handle, usage_flags, alg ) )
Darryl Green0c6575a2018-11-07 16:05:30 +00005756 goto exit;
Darryl Greend49a4992018-06-18 17:27:26 +01005757
5758exit:
Gilles Peskinea1ace9c2019-04-26 16:03:33 +02005759 psa_reset_key_attributes( &attributes );
Darryl Greend49a4992018-06-18 17:27:26 +01005760 mbedtls_free( first_export );
5761 mbedtls_free( second_export );
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005762 psa_key_derivation_abort( &operation );
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005763 psa_destroy_key( base_key );
Ronald Cronc26f8d42020-09-01 10:51:51 +02005764 if( psa_key_handle_is_null( handle ) )
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005765 {
5766 /* In case there was a test failure after creating the persistent key
5767 * but while it was not open, try to re-open the persistent key
5768 * to delete it. */
Gilles Peskinee92c68a2020-08-26 00:06:25 +02005769 (void) psa_open_key( key_id, &handle );
Gilles Peskine5c648ab2019-04-19 14:06:53 +02005770 }
Gilles Peskinebdf309c2018-12-03 15:36:32 +01005771 psa_destroy_key( handle );
Gilles Peskine1153e7b2019-05-28 15:10:21 +02005772 PSA_DONE();
Darryl Greend49a4992018-06-18 17:27:26 +01005773}
5774/* END_CASE */