blob: 8c2c543d0906ecec91a4ae9287d06fe4a6ba1226 [file] [log] [blame]
Gilles Peskinee59236f2018-01-27 23:32:46 +01001/*
2 * PSA crypto layer on top of Mbed TLS crypto
3 */
Bence Szépkúti86974652020-06-15 11:59:37 +02004/*
Bence Szépkúti1e148272020-08-07 13:07:28 +02005 * Copyright The Mbed TLS Contributors
Dave Rodgman16799db2023-11-02 19:47:20 +00006 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
Gilles Peskinee59236f2018-01-27 23:32:46 +01007 */
8
Gilles Peskinedb09ef62020-06-03 01:43:33 +02009#include "common.h"
Ronald Cronafbc7ed2023-01-24 16:02:04 +010010#include "psa_crypto_core_common.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010011
12#if defined(MBEDTLS_PSA_CRYPTO_C)
mohammad160327010052018-07-03 13:16:15 +030013
John Durkop07cc04a2020-11-16 22:08:34 -080014#if defined(MBEDTLS_PSA_CRYPTO_CONFIG)
15#include "check_crypto_config.h"
16#endif
17
Gilles Peskinee59236f2018-01-27 23:32:46 +010018#include "psa/crypto.h"
Przemyslaw Stekiel705fb0f2021-11-24 08:47:29 +010019#include "psa/crypto_values.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010020
Ronald Crond6d28882020-12-14 14:56:02 +010021#include "psa_crypto_cipher.h"
Gilles Peskine039b90c2018-12-07 18:24:41 +010022#include "psa_crypto_core.h"
Gilles Peskine5e769522018-11-20 21:59:56 +010023#include "psa_crypto_invasive.h"
Xiaokang Qiane9c39c42023-08-09 08:50:19 +000024#include "psa_crypto_driver_wrappers.h"
Xiaokang Qianfe9666b2023-09-11 10:36:20 +000025#include "psa_crypto_driver_wrappers_no_static.h"
Ronald Cron00b7bfc2020-11-25 15:25:26 +010026#include "psa_crypto_ecp.h"
Przemek Stekiel359f4622022-12-05 14:11:55 +010027#include "psa_crypto_ffdh.h"
Steven Cooreman5f88e772021-03-15 11:07:12 +010028#include "psa_crypto_hash.h"
Steven Cooreman82c66b62021-03-19 17:39:17 +010029#include "psa_crypto_mac.h"
Ronald Cron00b7bfc2020-11-25 15:25:26 +010030#include "psa_crypto_rsa.h"
Ronald Cron7023db52020-11-20 18:17:42 +010031#include "psa_crypto_ecp.h"
Gilles Peskinea8ade162019-06-26 11:24:49 +020032#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined0890212019-06-24 14:34:43 +020033#include "psa_crypto_se.h"
Gilles Peskinea8ade162019-06-26 11:24:49 +020034#endif
Gilles Peskine961849f2018-11-30 18:54:54 +010035#include "psa_crypto_slot_management.h"
Darryl Greend49a4992018-06-18 17:27:26 +010036/* Include internal declarations that are useful for implementing persistently
37 * stored keys. */
38#include "psa_crypto_storage.h"
39
Gilles Peskineb2b64d32020-12-14 16:43:58 +010040#include "psa_crypto_random_impl.h"
Gilles Peskine90edc992020-11-13 15:39:19 +010041
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010042#include <stdlib.h>
43#include <string.h>
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010044#include "mbedtls/platform.h"
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010045
Gilles Peskine1c49f1a2020-11-13 18:46:25 +010046#include "mbedtls/aes.h"
Gilles Peskine9a944802018-06-21 09:35:35 +020047#include "mbedtls/asn1.h"
Jaeden Amero25384a22019-01-10 10:23:21 +000048#include "mbedtls/asn1write.h"
Gilles Peskinea81d85b2018-06-26 16:10:23 +020049#include "mbedtls/bignum.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010050#include "mbedtls/camellia.h"
Gilles Peskine26869f22019-05-06 15:25:00 +020051#include "mbedtls/chacha20.h"
52#include "mbedtls/chachapoly.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010053#include "mbedtls/cipher.h"
54#include "mbedtls/ccm.h"
55#include "mbedtls/cmac.h"
Dave Rodgman78701152023-08-29 14:20:18 +010056#include "mbedtls/constant_time.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010057#include "mbedtls/des.h"
Gilles Peskineb7ecdf02018-09-18 12:11:27 +020058#include "mbedtls/ecdh.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010059#include "mbedtls/ecp.h"
Gilles Peskinee59236f2018-01-27 23:32:46 +010060#include "mbedtls/entropy.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010061#include "mbedtls/error.h"
62#include "mbedtls/gcm.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010063#include "mbedtls/md5.h"
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010064#include "mbedtls/pk.h"
Chris Jonesdaacb592021-03-09 17:03:29 +000065#include "pk_wrap.h"
Gilles Peskine3f108122018-12-07 18:14:53 +010066#include "mbedtls/platform_util.h"
Janos Follath24eed8d2019-11-22 13:21:35 +000067#include "mbedtls/error.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010068#include "mbedtls/ripemd160.h"
Gilles Peskine969ac722018-01-28 18:16:59 +010069#include "mbedtls/rsa.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010070#include "mbedtls/sha1.h"
71#include "mbedtls/sha256.h"
72#include "mbedtls/sha512.h"
Valerio Setti384fbde2024-01-02 13:26:40 +010073#include "mbedtls/psa_util.h"
Paul Elliott600472b2024-02-23 17:26:58 +000074#include "mbedtls/threading.h"
Gilles Peskinea5905292018-02-07 20:59:33 +010075
Przemek Stekiel75fe3fb2022-06-09 14:44:55 +020076#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF) || \
77 defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT) || \
78 defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Przemek Stekiel69c46792022-06-10 12:59:51 +020079#define BUILTIN_ALG_ANY_HKDF 1
Przemek Stekiel75fe3fb2022-06-09 14:44:55 +020080#endif
81
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +010082/****************************************************************/
83/* Global data, support functions and library management */
84/****************************************************************/
85
Gilles Peskine449bd832023-01-11 14:50:10 +010086static int key_type_is_raw_bytes(psa_key_type_t type)
Gilles Peskine48c0ea12018-06-21 14:15:31 +020087{
Gilles Peskine449bd832023-01-11 14:50:10 +010088 return PSA_KEY_TYPE_IS_UNSTRUCTURED(type);
Gilles Peskine48c0ea12018-06-21 14:15:31 +020089}
90
Gilles Peskine5a3c50e2018-12-04 12:27:09 +010091/* Values for psa_global_data_t::rng_state */
92#define RNG_NOT_INITIALIZED 0
93#define RNG_INITIALIZED 1
94#define RNG_SEEDED 2
Gilles Peskinec6b69072018-11-20 21:42:52 +010095
Paul Elliott0db6a902024-03-15 13:48:20 +000096/* IDs for PSA crypto subsystems. Starts at 1 to catch potential uninitialized
97 * variables as arguments. */
Paul Elliott47cee8e2024-03-08 21:38:02 +000098typedef enum {
Paul Elliott0db6a902024-03-15 13:48:20 +000099 PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS = 1,
Paul Elliott47cee8e2024-03-08 21:38:02 +0000100 PSA_CRYPTO_SUBSYSTEM_KEY_SLOTS,
101 PSA_CRYPTO_SUBSYSTEM_RNG,
102 PSA_CRYPTO_SUBSYSTEM_TRANSACTION,
103} mbedtls_psa_crypto_subsystem;
104
Paul Elliottb24e36d2024-03-15 16:25:48 +0000105/* Initialization flags for global_data::initialized */
Paul Elliott47cee8e2024-03-08 21:38:02 +0000106#define PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS_INITIALIZED 0x01
107#define PSA_CRYPTO_SUBSYSTEM_KEY_SLOTS_INITIALIZED 0x02
108#define PSA_CRYPTO_SUBSYSTEM_TRANSACTION_INITIALIZED 0x04
109
110#define PSA_CRYPTO_SUBSYSTEM_ALL_INITIALISED ( \
111 PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS_INITIALIZED | \
112 PSA_CRYPTO_SUBSYSTEM_KEY_SLOTS_INITIALIZED | \
113 PSA_CRYPTO_SUBSYSTEM_TRANSACTION_INITIALIZED)
114
Gilles Peskine449bd832023-01-11 14:50:10 +0100115typedef struct {
Dave Rodgman864f5942023-08-16 18:04:44 +0100116 uint8_t initialized;
117 uint8_t rng_state;
Gilles Peskine2d8a1822021-11-08 22:20:03 +0100118 mbedtls_psa_random_context_t rng;
Gilles Peskinee59236f2018-01-27 23:32:46 +0100119} psa_global_data_t;
120
121static psa_global_data_t global_data;
122
Paul Elliott600472b2024-02-23 17:26:58 +0000123static uint8_t psa_get_initialized(void)
124{
125 uint8_t initialized;
126
127#if defined(MBEDTLS_THREADING_C)
Paul Elliott47cee8e2024-03-08 21:38:02 +0000128 mbedtls_mutex_lock(&mbedtls_threading_psa_rngdata_mutex);
129#endif /* defined(MBEDTLS_THREADING_C) */
130
131 initialized = global_data.rng_state == RNG_SEEDED;
132
133#if defined(MBEDTLS_THREADING_C)
134 mbedtls_mutex_unlock(&mbedtls_threading_psa_rngdata_mutex);
135#endif /* defined(MBEDTLS_THREADING_C) */
136
137#if defined(MBEDTLS_THREADING_C)
Paul Elliott600472b2024-02-23 17:26:58 +0000138 mbedtls_mutex_lock(&mbedtls_threading_psa_globaldata_mutex);
139#endif /* defined(MBEDTLS_THREADING_C) */
140
Paul Elliott47cee8e2024-03-08 21:38:02 +0000141 initialized =
142 (initialized && (global_data.initialized == PSA_CRYPTO_SUBSYSTEM_ALL_INITIALISED));
Paul Elliott600472b2024-02-23 17:26:58 +0000143
144#if defined(MBEDTLS_THREADING_C)
145 mbedtls_mutex_unlock(&mbedtls_threading_psa_globaldata_mutex);
146#endif /* defined(MBEDTLS_THREADING_C) */
147
148 return initialized;
149}
150
Paul Elliott35816522024-02-23 17:47:42 +0000151static uint8_t psa_get_drivers_initialized(void)
152{
153 uint8_t initialized;
154
155#if defined(MBEDTLS_THREADING_C)
156 mbedtls_mutex_lock(&mbedtls_threading_psa_globaldata_mutex);
157#endif /* defined(MBEDTLS_THREADING_C) */
158
Paul Elliott47cee8e2024-03-08 21:38:02 +0000159 initialized = (global_data.initialized & PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS_INITIALIZED) != 0;
Paul Elliott35816522024-02-23 17:47:42 +0000160
161#if defined(MBEDTLS_THREADING_C)
162 mbedtls_mutex_unlock(&mbedtls_threading_psa_globaldata_mutex);
163#endif /* defined(MBEDTLS_THREADING_C) */
164
165 return initialized;
166}
167
itayzafrir0adf0fc2018-09-06 16:24:41 +0300168#define GUARD_MODULE_INITIALIZED \
Paul Elliott600472b2024-02-23 17:26:58 +0000169 if (psa_get_initialized() == 0) \
Gilles Peskine449bd832023-01-11 14:50:10 +0100170 return PSA_ERROR_BAD_STATE;
itayzafrir0adf0fc2018-09-06 16:24:41 +0300171
David Horstmann4a48bec2024-03-13 15:42:31 +0000172#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
David Horstmann36df4b22023-12-13 15:55:25 +0000173
David Horstmann62a56d92023-12-14 18:12:47 +0000174/* Declare a local copy of an input buffer and a variable that will be used
175 * to store a pointer to the start of the buffer.
David Horstmann36df4b22023-12-13 15:55:25 +0000176 *
177 * Note: This macro must be called before any operations which may jump to
178 * the exit label, so that the local input copy object is safe to be freed.
179 *
180 * Assumptions:
181 * - input is the name of a pointer to the buffer to be copied
182 * - The name LOCAL_INPUT_COPY_OF_input is unused in the current scope
David Horstmann62a56d92023-12-14 18:12:47 +0000183 * - input_copy_name is a name that is unused in the current scope
David Horstmann36df4b22023-12-13 15:55:25 +0000184 */
David Horstmann62a56d92023-12-14 18:12:47 +0000185#define LOCAL_INPUT_DECLARE(input, input_copy_name) \
186 psa_crypto_local_input_t LOCAL_INPUT_COPY_OF_##input = PSA_CRYPTO_LOCAL_INPUT_INIT; \
187 const uint8_t *input_copy_name = NULL;
David Horstmann36df4b22023-12-13 15:55:25 +0000188
David Horstmann62a56d92023-12-14 18:12:47 +0000189/* Allocate a copy of the buffer input and set the pointer input_copy to
190 * point to the start of the copy.
David Horstmann36df4b22023-12-13 15:55:25 +0000191 *
David Horstmanne9a88ab2023-11-29 17:07:13 +0000192 * Assumptions:
193 * - psa_status_t status exists
194 * - An exit label is declared
David Horstmann36df4b22023-12-13 15:55:25 +0000195 * - input is the name of a pointer to the buffer to be copied
David Horstmann62a56d92023-12-14 18:12:47 +0000196 * - LOCAL_INPUT_DECLARE(input, input_copy) has previously been called
David Horstmanne9a88ab2023-11-29 17:07:13 +0000197 */
David Horstmann62a56d92023-12-14 18:12:47 +0000198#define LOCAL_INPUT_ALLOC(input, length, input_copy) \
David Horstmann36df4b22023-12-13 15:55:25 +0000199 status = psa_crypto_local_input_alloc(input, length, \
200 &LOCAL_INPUT_COPY_OF_##input); \
David Horstmanne9a88ab2023-11-29 17:07:13 +0000201 if (status != PSA_SUCCESS) { \
202 goto exit; \
203 } \
David Horstmann62a56d92023-12-14 18:12:47 +0000204 input_copy = LOCAL_INPUT_COPY_OF_##input.buffer;
David Horstmanne9a88ab2023-11-29 17:07:13 +0000205
David Horstmann36df4b22023-12-13 15:55:25 +0000206/* Free the local input copy allocated previously by LOCAL_INPUT_ALLOC()
207 *
David Horstmann3e72db42023-12-08 14:08:18 +0000208 * Assumptions:
David Horstmann62a56d92023-12-14 18:12:47 +0000209 * - input_copy is the name of the input copy pointer set by LOCAL_INPUT_ALLOC()
David Horstmann36df4b22023-12-13 15:55:25 +0000210 * - input is the name of the original buffer that was copied
David Horstmann3e72db42023-12-08 14:08:18 +0000211 */
David Horstmann62a56d92023-12-14 18:12:47 +0000212#define LOCAL_INPUT_FREE(input, input_copy) \
213 input_copy = NULL; \
David Horstmann36df4b22023-12-13 15:55:25 +0000214 psa_crypto_local_input_free(&LOCAL_INPUT_COPY_OF_##input);
David Horstmanne9a88ab2023-11-29 17:07:13 +0000215
David Horstmann62a56d92023-12-14 18:12:47 +0000216/* Declare a local copy of an output buffer and a variable that will be used
217 * to store a pointer to the start of the buffer.
David Horstmann36df4b22023-12-13 15:55:25 +0000218 *
219 * Note: This macro must be called before any operations which may jump to
220 * the exit label, so that the local output copy object is safe to be freed.
221 *
222 * Assumptions:
223 * - output is the name of a pointer to the buffer to be copied
224 * - The name LOCAL_OUTPUT_COPY_OF_output is unused in the current scope
David Horstmann62a56d92023-12-14 18:12:47 +0000225 * - output_copy_name is a name that is unused in the current scope
David Horstmann36df4b22023-12-13 15:55:25 +0000226 */
David Horstmann62a56d92023-12-14 18:12:47 +0000227#define LOCAL_OUTPUT_DECLARE(output, output_copy_name) \
228 psa_crypto_local_output_t LOCAL_OUTPUT_COPY_OF_##output = PSA_CRYPTO_LOCAL_OUTPUT_INIT; \
229 uint8_t *output_copy_name = NULL;
David Horstmann36df4b22023-12-13 15:55:25 +0000230
David Horstmann62a56d92023-12-14 18:12:47 +0000231/* Allocate a copy of the buffer output and set the pointer output_copy to
232 * point to the start of the copy.
David Horstmann36df4b22023-12-13 15:55:25 +0000233 *
David Horstmanne9a88ab2023-11-29 17:07:13 +0000234 * Assumptions:
235 * - psa_status_t status exists
236 * - An exit label is declared
David Horstmann36df4b22023-12-13 15:55:25 +0000237 * - output is the name of a pointer to the buffer to be copied
David Horstmann62a56d92023-12-14 18:12:47 +0000238 * - LOCAL_OUTPUT_DECLARE(output, output_copy) has previously been called
David Horstmanne9a88ab2023-11-29 17:07:13 +0000239 */
David Horstmann62a56d92023-12-14 18:12:47 +0000240#define LOCAL_OUTPUT_ALLOC(output, length, output_copy) \
David Horstmann36df4b22023-12-13 15:55:25 +0000241 status = psa_crypto_local_output_alloc(output, length, \
242 &LOCAL_OUTPUT_COPY_OF_##output); \
David Horstmanne9a88ab2023-11-29 17:07:13 +0000243 if (status != PSA_SUCCESS) { \
244 goto exit; \
245 } \
David Horstmann62a56d92023-12-14 18:12:47 +0000246 output_copy = LOCAL_OUTPUT_COPY_OF_##output.buffer;
David Horstmanne9a88ab2023-11-29 17:07:13 +0000247
David Horstmann62a56d92023-12-14 18:12:47 +0000248/* Free the local output copy allocated previously by LOCAL_OUTPUT_ALLOC()
David Horstmann3e72db42023-12-08 14:08:18 +0000249 * after first copying back its contents to the original buffer.
David Horstmann36df4b22023-12-13 15:55:25 +0000250 *
David Horstmann3e72db42023-12-08 14:08:18 +0000251 * Assumptions:
David Horstmann3e72db42023-12-08 14:08:18 +0000252 * - psa_status_t status exists
David Horstmann62a56d92023-12-14 18:12:47 +0000253 * - output_copy is the name of the output copy pointer set by LOCAL_OUTPUT_ALLOC()
254 * - output is the name of the original buffer that was copied
David Horstmann3e72db42023-12-08 14:08:18 +0000255 */
David Horstmann62a56d92023-12-14 18:12:47 +0000256#define LOCAL_OUTPUT_FREE(output, output_copy) \
257 output_copy = NULL; \
David Horstmann5a945f52023-12-13 14:09:08 +0000258 do { \
259 psa_status_t local_output_status; \
David Horstmann36df4b22023-12-13 15:55:25 +0000260 local_output_status = psa_crypto_local_output_free(&LOCAL_OUTPUT_COPY_OF_##output); \
David Horstmann5a945f52023-12-13 14:09:08 +0000261 if (local_output_status != PSA_SUCCESS) { \
262 /* Since this error case is an internal error, it's more serious than \
263 * any existing error code and so it's fine to overwrite the existing \
264 * status. */ \
265 status = local_output_status; \
266 } \
267 } while (0)
David Horstmann4a48bec2024-03-13 15:42:31 +0000268#else /* !MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS */
David Horstmann62a56d92023-12-14 18:12:47 +0000269#define LOCAL_INPUT_DECLARE(input, input_copy_name) \
270 const uint8_t *input_copy_name = NULL;
271#define LOCAL_INPUT_ALLOC(input, length, input_copy) \
272 input_copy = input;
273#define LOCAL_INPUT_FREE(input, input_copy) \
274 input_copy = NULL;
275#define LOCAL_OUTPUT_DECLARE(output, output_copy_name) \
276 uint8_t *output_copy_name = NULL;
277#define LOCAL_OUTPUT_ALLOC(output, length, output_copy) \
278 output_copy = output;
279#define LOCAL_OUTPUT_FREE(output, output_copy) \
280 output_copy = NULL;
David Horstmann4a48bec2024-03-13 15:42:31 +0000281#endif /* !MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS */
David Horstmanne9a88ab2023-11-29 17:07:13 +0000282
283
Manuel Pégourié-Gonnard7abdf7e2023-03-09 11:17:43 +0100284int psa_can_do_hash(psa_algorithm_t hash_alg)
285{
286 (void) hash_alg;
Paul Elliott35816522024-02-23 17:47:42 +0000287 return psa_get_drivers_initialized();
Manuel Pégourié-Gonnard7abdf7e2023-03-09 11:17:43 +0100288}
Valerio Settic6f004f2023-12-12 11:27:36 +0100289
Valerio Setti1fff4f22023-12-28 14:19:34 +0100290int psa_can_do_cipher(psa_key_type_t key_type, psa_algorithm_t cipher_alg)
Valerio Settic6f004f2023-12-12 11:27:36 +0100291{
Valerio Setti1fff4f22023-12-28 14:19:34 +0100292 (void) key_type;
Valerio Settic6f004f2023-12-12 11:27:36 +0100293 (void) cipher_alg;
Paul Elliott35816522024-02-23 17:47:42 +0000294 return psa_get_drivers_initialized();
Valerio Settic6f004f2023-12-12 11:27:36 +0100295}
296
297
Valerio Settia55f0422023-07-10 15:34:41 +0200298#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT) || \
Przemek Stekiel53410502023-04-28 13:18:43 +0200299 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY) || \
Valerio Settia55f0422023-07-10 15:34:41 +0200300 defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE)
Przemek Stekiel134cc2e2023-05-05 10:13:37 +0200301static int psa_is_dh_key_size_valid(size_t bits)
302{
Valerio Setti504a1022024-01-17 15:19:30 +0100303 switch (bits) {
304#if defined(PSA_WANT_DH_RFC7919_2048)
305 case 2048:
306 return 1;
307#endif /* PSA_WANT_DH_RFC7919_2048 */
308#if defined(PSA_WANT_DH_RFC7919_3072)
309 case 3072:
310 return 1;
311#endif /* PSA_WANT_DH_RFC7919_3072 */
312#if defined(PSA_WANT_DH_RFC7919_4096)
313 case 4096:
314 return 1;
315#endif /* PSA_WANT_DH_RFC7919_4096 */
316#if defined(PSA_WANT_DH_RFC7919_6144)
317 case 6144:
318 return 1;
319#endif /* PSA_WANT_DH_RFC7919_6144 */
320#if defined(PSA_WANT_DH_RFC7919_8192)
321 case 8192:
322 return 1;
323#endif /* PSA_WANT_DH_RFC7919_8192 */
324 default:
325 return 0;
Przemek Stekield1cf1ba2023-04-27 12:04:21 +0200326 }
Przemek Stekield1cf1ba2023-04-27 12:04:21 +0200327}
Valerio Settia55f0422023-07-10 15:34:41 +0200328#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT ||
Przemek Stekiel53410502023-04-28 13:18:43 +0200329 MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY ||
Valerio Settia55f0422023-07-10 15:34:41 +0200330 PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE */
Manuel Pégourié-Gonnard7abdf7e2023-03-09 11:17:43 +0100331
Gilles Peskine449bd832023-01-11 14:50:10 +0100332psa_status_t mbedtls_to_psa_error(int ret)
Gilles Peskinee59236f2018-01-27 23:32:46 +0100333{
Gilles Peskinedbf68962021-01-06 20:04:23 +0100334 /* Mbed TLS error codes can combine a high-level error code and a
335 * low-level error code. The low-level error usually reflects the
336 * root cause better, so dispatch on that preferably. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100337 int low_level_ret = -(-ret & 0x007f);
338 switch (low_level_ret != 0 ? low_level_ret : ret) {
Gilles Peskinee59236f2018-01-27 23:32:46 +0100339 case 0:
Gilles Peskine449bd832023-01-11 14:50:10 +0100340 return PSA_SUCCESS;
Gilles Peskinea5905292018-02-07 20:59:33 +0100341
Dave Rodgman4f47f3d2023-08-31 12:10:00 +0100342#if defined(MBEDTLS_AES_C)
Gilles Peskinea5905292018-02-07 20:59:33 +0100343 case MBEDTLS_ERR_AES_INVALID_KEY_LENGTH:
344 case MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100345 return PSA_ERROR_NOT_SUPPORTED;
Dave Rodgman09a9e582023-08-31 11:05:22 +0100346 case MBEDTLS_ERR_AES_BAD_INPUT_DATA:
347 return PSA_ERROR_INVALID_ARGUMENT;
Dave Rodgman509b5672023-08-16 19:26:23 +0100348#endif
349
350#if defined(MBEDTLS_ASN1_PARSE_C) || defined(MBEDTLS_ASN1_WRITE_C)
Gilles Peskine9a944802018-06-21 09:35:35 +0200351 case MBEDTLS_ERR_ASN1_OUT_OF_DATA:
352 case MBEDTLS_ERR_ASN1_UNEXPECTED_TAG:
353 case MBEDTLS_ERR_ASN1_INVALID_LENGTH:
354 case MBEDTLS_ERR_ASN1_LENGTH_MISMATCH:
355 case MBEDTLS_ERR_ASN1_INVALID_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100356 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine9a944802018-06-21 09:35:35 +0200357 case MBEDTLS_ERR_ASN1_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100358 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskine9a944802018-06-21 09:35:35 +0200359 case MBEDTLS_ERR_ASN1_BUF_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100360 return PSA_ERROR_BUFFER_TOO_SMALL;
Dave Rodgman509b5672023-08-16 19:26:23 +0100361#endif
Gilles Peskine9a944802018-06-21 09:35:35 +0200362
Dave Rodgman4f47f3d2023-08-31 12:10:00 +0100363#if defined(MBEDTLS_CAMELLIA_C)
Jaeden Amero892cd6d2019-02-11 12:21:12 +0000364 case MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA:
Gilles Peskinea5905292018-02-07 20:59:33 +0100365 case MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100366 return PSA_ERROR_NOT_SUPPORTED;
Dave Rodgman509b5672023-08-16 19:26:23 +0100367#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100368
Dave Rodgman4f47f3d2023-08-31 12:10:00 +0100369#if defined(MBEDTLS_CCM_C)
Gilles Peskinea5905292018-02-07 20:59:33 +0100370 case MBEDTLS_ERR_CCM_BAD_INPUT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100371 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100372 case MBEDTLS_ERR_CCM_AUTH_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100373 return PSA_ERROR_INVALID_SIGNATURE;
Dave Rodgman509b5672023-08-16 19:26:23 +0100374#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100375
Dave Rodgman4f47f3d2023-08-31 12:10:00 +0100376#if defined(MBEDTLS_CHACHA20_C)
Gilles Peskine26869f22019-05-06 15:25:00 +0200377 case MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100378 return PSA_ERROR_INVALID_ARGUMENT;
Dave Rodgman509b5672023-08-16 19:26:23 +0100379#endif
Gilles Peskine26869f22019-05-06 15:25:00 +0200380
Dave Rodgman4f47f3d2023-08-31 12:10:00 +0100381#if defined(MBEDTLS_CHACHAPOLY_C)
Gilles Peskine26869f22019-05-06 15:25:00 +0200382 case MBEDTLS_ERR_CHACHAPOLY_BAD_STATE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100383 return PSA_ERROR_BAD_STATE;
Gilles Peskine26869f22019-05-06 15:25:00 +0200384 case MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100385 return PSA_ERROR_INVALID_SIGNATURE;
Dave Rodgman509b5672023-08-16 19:26:23 +0100386#endif
Gilles Peskine26869f22019-05-06 15:25:00 +0200387
Dave Rodgman509b5672023-08-16 19:26:23 +0100388#if defined(MBEDTLS_CIPHER_C)
Gilles Peskinea5905292018-02-07 20:59:33 +0100389 case MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100390 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100391 case MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100392 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100393 case MBEDTLS_ERR_CIPHER_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100394 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskinea5905292018-02-07 20:59:33 +0100395 case MBEDTLS_ERR_CIPHER_INVALID_PADDING:
Gilles Peskine449bd832023-01-11 14:50:10 +0100396 return PSA_ERROR_INVALID_PADDING;
Gilles Peskinea5905292018-02-07 20:59:33 +0100397 case MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100398 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100399 case MBEDTLS_ERR_CIPHER_AUTH_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100400 return PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskinea5905292018-02-07 20:59:33 +0100401 case MBEDTLS_ERR_CIPHER_INVALID_CONTEXT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100402 return PSA_ERROR_CORRUPTION_DETECTED;
Dave Rodgman509b5672023-08-16 19:26:23 +0100403#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100404
Gilles Peskine449bd832023-01-11 14:50:10 +0100405#if !(defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) || \
406 defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE))
Gilles Peskinebee96c82020-11-23 21:00:09 +0100407 /* Only check CTR_DRBG error codes if underlying mbedtls_xxx
408 * functions are passed a CTR_DRBG instance. */
Gilles Peskinea5905292018-02-07 20:59:33 +0100409 case MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100410 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskinea5905292018-02-07 20:59:33 +0100411 case MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG:
412 case MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG:
Gilles Peskine449bd832023-01-11 14:50:10 +0100413 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100414 case MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100415 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskine82e57d12020-11-13 21:31:17 +0100416#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100417
Dave Rodgman4f47f3d2023-08-31 12:10:00 +0100418#if defined(MBEDTLS_DES_C)
Gilles Peskinea5905292018-02-07 20:59:33 +0100419 case MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100420 return PSA_ERROR_NOT_SUPPORTED;
Dave Rodgman509b5672023-08-16 19:26:23 +0100421#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100422
Gilles Peskinee59236f2018-01-27 23:32:46 +0100423 case MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED:
424 case MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE:
425 case MBEDTLS_ERR_ENTROPY_SOURCE_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100426 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskinea5905292018-02-07 20:59:33 +0100427
Dave Rodgman4f47f3d2023-08-31 12:10:00 +0100428#if defined(MBEDTLS_GCM_C)
Gilles Peskinea5905292018-02-07 20:59:33 +0100429 case MBEDTLS_ERR_GCM_AUTH_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100430 return PSA_ERROR_INVALID_SIGNATURE;
Mateusz Starzykf28261f2021-09-30 16:39:07 +0200431 case MBEDTLS_ERR_GCM_BUFFER_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100432 return PSA_ERROR_BUFFER_TOO_SMALL;
Gilles Peskinea5905292018-02-07 20:59:33 +0100433 case MBEDTLS_ERR_GCM_BAD_INPUT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100434 return PSA_ERROR_INVALID_ARGUMENT;
Dave Rodgman509b5672023-08-16 19:26:23 +0100435#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100436
Gilles Peskine82e57d12020-11-13 21:31:17 +0100437#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) && \
Gilles Peskine449bd832023-01-11 14:50:10 +0100438 defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE)
Gilles Peskinebee96c82020-11-23 21:00:09 +0100439 /* Only check HMAC_DRBG error codes if underlying mbedtls_xxx
440 * functions are passed a HMAC_DRBG instance. */
Gilles Peskine82e57d12020-11-13 21:31:17 +0100441 case MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100442 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskine82e57d12020-11-13 21:31:17 +0100443 case MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG:
444 case MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG:
Gilles Peskine449bd832023-01-11 14:50:10 +0100445 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine82e57d12020-11-13 21:31:17 +0100446 case MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100447 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskine82e57d12020-11-13 21:31:17 +0100448#endif
449
Dave Rodgmandea266f2023-08-31 11:52:43 +0100450#if defined(MBEDTLS_MD_LIGHT)
Gilles Peskinea5905292018-02-07 20:59:33 +0100451 case MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100452 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100453 case MBEDTLS_ERR_MD_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100454 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100455 case MBEDTLS_ERR_MD_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100456 return PSA_ERROR_INSUFFICIENT_MEMORY;
Dave Rodgman509b5672023-08-16 19:26:23 +0100457#if defined(MBEDTLS_FS_IO)
Gilles Peskinea5905292018-02-07 20:59:33 +0100458 case MBEDTLS_ERR_MD_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100459 return PSA_ERROR_STORAGE_FAILURE;
Dave Rodgman509b5672023-08-16 19:26:23 +0100460#endif
461#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100462
Dave Rodgman509b5672023-08-16 19:26:23 +0100463#if defined(MBEDTLS_BIGNUM_C)
464#if defined(MBEDTLS_FS_IO)
Gilles Peskinef76aa772018-10-29 19:24:33 +0100465 case MBEDTLS_ERR_MPI_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100466 return PSA_ERROR_STORAGE_FAILURE;
Dave Rodgman509b5672023-08-16 19:26:23 +0100467#endif
Gilles Peskinef76aa772018-10-29 19:24:33 +0100468 case MBEDTLS_ERR_MPI_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100469 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100470 case MBEDTLS_ERR_MPI_INVALID_CHARACTER:
Gilles Peskine449bd832023-01-11 14:50:10 +0100471 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100472 case MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100473 return PSA_ERROR_BUFFER_TOO_SMALL;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100474 case MBEDTLS_ERR_MPI_NEGATIVE_VALUE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100475 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100476 case MBEDTLS_ERR_MPI_DIVISION_BY_ZERO:
Gilles Peskine449bd832023-01-11 14:50:10 +0100477 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100478 case MBEDTLS_ERR_MPI_NOT_ACCEPTABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100479 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinef76aa772018-10-29 19:24:33 +0100480 case MBEDTLS_ERR_MPI_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100481 return PSA_ERROR_INSUFFICIENT_MEMORY;
Dave Rodgman509b5672023-08-16 19:26:23 +0100482#endif
Gilles Peskinef76aa772018-10-29 19:24:33 +0100483
Dave Rodgman509b5672023-08-16 19:26:23 +0100484#if defined(MBEDTLS_PK_C)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100485 case MBEDTLS_ERR_PK_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100486 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100487 case MBEDTLS_ERR_PK_TYPE_MISMATCH:
488 case MBEDTLS_ERR_PK_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100489 return PSA_ERROR_INVALID_ARGUMENT;
Dave Rodgman509b5672023-08-16 19:26:23 +0100490#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) || defined(MBEDTLS_FS_IO) || \
491 defined(MBEDTLS_PSA_ITS_FILE_C)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100492 case MBEDTLS_ERR_PK_FILE_IO_ERROR:
Gilles Peskine449bd832023-01-11 14:50:10 +0100493 return PSA_ERROR_STORAGE_FAILURE;
Dave Rodgman509b5672023-08-16 19:26:23 +0100494#endif
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100495 case MBEDTLS_ERR_PK_KEY_INVALID_VERSION:
496 case MBEDTLS_ERR_PK_KEY_INVALID_FORMAT:
Gilles Peskine449bd832023-01-11 14:50:10 +0100497 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100498 case MBEDTLS_ERR_PK_UNKNOWN_PK_ALG:
Gilles Peskine449bd832023-01-11 14:50:10 +0100499 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100500 case MBEDTLS_ERR_PK_PASSWORD_REQUIRED:
501 case MBEDTLS_ERR_PK_PASSWORD_MISMATCH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100502 return PSA_ERROR_NOT_PERMITTED;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100503 case MBEDTLS_ERR_PK_INVALID_PUBKEY:
Gilles Peskine449bd832023-01-11 14:50:10 +0100504 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100505 case MBEDTLS_ERR_PK_INVALID_ALG:
506 case MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE:
507 case MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100508 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100509 case MBEDTLS_ERR_PK_SIG_LEN_MISMATCH:
Gilles Peskine449bd832023-01-11 14:50:10 +0100510 return PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskinef9f1bdf2021-06-23 20:32:27 +0200511 case MBEDTLS_ERR_PK_BUFFER_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100512 return PSA_ERROR_BUFFER_TOO_SMALL;
Dave Rodgman509b5672023-08-16 19:26:23 +0100513#endif
Gilles Peskinea5905292018-02-07 20:59:33 +0100514
Gilles Peskineff2d2002019-05-06 15:26:23 +0200515 case MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100516 return PSA_ERROR_HARDWARE_FAILURE;
Gilles Peskineff2d2002019-05-06 15:26:23 +0200517 case MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100518 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskineff2d2002019-05-06 15:26:23 +0200519
Dave Rodgman509b5672023-08-16 19:26:23 +0100520#if defined(MBEDTLS_RSA_C)
Gilles Peskinea5905292018-02-07 20:59:33 +0100521 case MBEDTLS_ERR_RSA_BAD_INPUT_DATA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100522 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100523 case MBEDTLS_ERR_RSA_INVALID_PADDING:
Gilles Peskine449bd832023-01-11 14:50:10 +0100524 return PSA_ERROR_INVALID_PADDING;
Gilles Peskinea5905292018-02-07 20:59:33 +0100525 case MBEDTLS_ERR_RSA_KEY_GEN_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100526 return PSA_ERROR_HARDWARE_FAILURE;
Gilles Peskinea5905292018-02-07 20:59:33 +0100527 case MBEDTLS_ERR_RSA_KEY_CHECK_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100528 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinea5905292018-02-07 20:59:33 +0100529 case MBEDTLS_ERR_RSA_PUBLIC_FAILED:
530 case MBEDTLS_ERR_RSA_PRIVATE_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100531 return PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskinea5905292018-02-07 20:59:33 +0100532 case MBEDTLS_ERR_RSA_VERIFY_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100533 return PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskinea5905292018-02-07 20:59:33 +0100534 case MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100535 return PSA_ERROR_BUFFER_TOO_SMALL;
Gilles Peskinea5905292018-02-07 20:59:33 +0100536 case MBEDTLS_ERR_RSA_RNG_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100537 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Dave Rodgman509b5672023-08-16 19:26:23 +0100538#endif
Manuel Pégourié-Gonnard93c08472021-04-15 12:23:55 +0200539
Dave Rodgman1dab4452023-09-01 09:59:51 +0100540#if defined(MBEDTLS_ECP_LIGHT)
itayzafrir5c753392018-05-08 11:18:38 +0300541 case MBEDTLS_ERR_ECP_BAD_INPUT_DATA:
itayzafrir7b30f8b2018-05-09 16:07:36 +0300542 case MBEDTLS_ERR_ECP_INVALID_KEY:
Gilles Peskine449bd832023-01-11 14:50:10 +0100543 return PSA_ERROR_INVALID_ARGUMENT;
itayzafrir7b30f8b2018-05-09 16:07:36 +0300544 case MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL:
Gilles Peskine449bd832023-01-11 14:50:10 +0100545 return PSA_ERROR_BUFFER_TOO_SMALL;
itayzafrir7b30f8b2018-05-09 16:07:36 +0300546 case MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE:
Gilles Peskine449bd832023-01-11 14:50:10 +0100547 return PSA_ERROR_NOT_SUPPORTED;
itayzafrir7b30f8b2018-05-09 16:07:36 +0300548 case MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH:
549 case MBEDTLS_ERR_ECP_VERIFY_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100550 return PSA_ERROR_INVALID_SIGNATURE;
itayzafrir7b30f8b2018-05-09 16:07:36 +0300551 case MBEDTLS_ERR_ECP_ALLOC_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100552 return PSA_ERROR_INSUFFICIENT_MEMORY;
Gilles Peskine40d81602020-11-25 00:09:47 +0100553 case MBEDTLS_ERR_ECP_RANDOM_FAILED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100554 return PSA_ERROR_INSUFFICIENT_ENTROPY;
Gilles Peskine40d81602020-11-25 00:09:47 +0100555
Dave Rodgman509b5672023-08-16 19:26:23 +0100556#if defined(MBEDTLS_ECP_RESTARTABLE)
Paul Elliott588f8ed2022-12-02 18:10:26 +0000557 case MBEDTLS_ERR_ECP_IN_PROGRESS:
558 return PSA_OPERATION_INCOMPLETE;
Dave Rodgman509b5672023-08-16 19:26:23 +0100559#endif
560#endif
Paul Elliott588f8ed2022-12-02 18:10:26 +0000561
Janos Follatha13b9052019-11-22 12:48:59 +0000562 case MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED:
Gilles Peskine449bd832023-01-11 14:50:10 +0100563 return PSA_ERROR_CORRUPTION_DETECTED;
itayzafrir5c753392018-05-08 11:18:38 +0300564
Gilles Peskinee59236f2018-01-27 23:32:46 +0100565 default:
Gilles Peskine449bd832023-01-11 14:50:10 +0100566 return PSA_ERROR_GENERIC_ERROR;
Gilles Peskinee59236f2018-01-27 23:32:46 +0100567 }
568}
569
Paul Elliottdc42ca82023-02-24 18:11:59 +0000570/**
571 * \brief For output buffers which contain "tags"
572 * (outputs that may be checked for validity like
573 * hashes, MACs and signatures), fill the unused
574 * part of the output buffer (the whole buffer on
575 * error, the trailing part on success) with
576 * something that isn't a valid tag (barring an
577 * attack on the tag and deliberately-crafted
578 * input), in case the caller doesn't check the
579 * return status properly.
580 *
581 * \param output_buffer Pointer to buffer to wipe. May not be NULL
582 * unless \p output_buffer_size is zero.
583 * \param status Status of function called to generate
584 * output_buffer originally
585 * \param output_buffer_size Size of output buffer. If zero, \p output_buffer
586 * could be NULL.
587 * \param output_buffer_length Length of data written to output_buffer, must be
588 * less than \p output_buffer_size
589 */
590static void psa_wipe_tag_output_buffer(uint8_t *output_buffer, psa_status_t status,
Paul Elliott7118d172023-02-26 16:57:05 +0000591 size_t output_buffer_size, size_t output_buffer_length)
592{
Paul Elliottdc42ca82023-02-24 18:11:59 +0000593 size_t offset = 0;
594
595 if (output_buffer_size == 0) {
596 /* If output_buffer_size is 0 then we have nothing to do. We must not
597 call memset because output_buffer may be NULL in this case */
598 return;
599 }
600
601 if (status == PSA_SUCCESS) {
602 offset = output_buffer_length;
603 }
604
605 memset(output_buffer + offset, '!', output_buffer_size - offset);
606}
607
Gilles Peskineb0b255c2018-07-06 17:01:38 +0200608
Gilles Peskine449bd832023-01-11 14:50:10 +0100609psa_status_t psa_validate_unstructured_key_bit_size(psa_key_type_t type,
610 size_t bits)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200611{
612 /* Check that the bit size is acceptable for the key type */
Gilles Peskine449bd832023-01-11 14:50:10 +0100613 switch (type) {
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200614 case PSA_KEY_TYPE_RAW_DATA:
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200615 case PSA_KEY_TYPE_HMAC:
Gilles Peskineea0fb492018-07-12 17:17:20 +0200616 case PSA_KEY_TYPE_DERIVE:
Neil Armstrong4b5710f2022-05-25 11:30:27 +0200617 case PSA_KEY_TYPE_PASSWORD:
618 case PSA_KEY_TYPE_PASSWORD_HASH:
Gilles Peskineea0fb492018-07-12 17:17:20 +0200619 break;
Ronald Cron1f0db802021-03-12 09:59:30 +0100620#if defined(PSA_WANT_KEY_TYPE_AES)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200621 case PSA_KEY_TYPE_AES:
Gilles Peskine449bd832023-01-11 14:50:10 +0100622 if (bits != 128 && bits != 192 && bits != 256) {
623 return PSA_ERROR_INVALID_ARGUMENT;
624 }
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200625 break;
626#endif
Gilles Peskine6c12a1e2021-09-21 11:59:39 +0200627#if defined(PSA_WANT_KEY_TYPE_ARIA)
628 case PSA_KEY_TYPE_ARIA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100629 if (bits != 128 && bits != 192 && bits != 256) {
630 return PSA_ERROR_INVALID_ARGUMENT;
631 }
Gilles Peskine6c12a1e2021-09-21 11:59:39 +0200632 break;
633#endif
Ronald Cron1f0db802021-03-12 09:59:30 +0100634#if defined(PSA_WANT_KEY_TYPE_CAMELLIA)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200635 case PSA_KEY_TYPE_CAMELLIA:
Gilles Peskine449bd832023-01-11 14:50:10 +0100636 if (bits != 128 && bits != 192 && bits != 256) {
637 return PSA_ERROR_INVALID_ARGUMENT;
638 }
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200639 break;
640#endif
Ronald Cron1f0db802021-03-12 09:59:30 +0100641#if defined(PSA_WANT_KEY_TYPE_DES)
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200642 case PSA_KEY_TYPE_DES:
Gilles Peskine449bd832023-01-11 14:50:10 +0100643 if (bits != 64 && bits != 128 && bits != 192) {
644 return PSA_ERROR_INVALID_ARGUMENT;
645 }
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200646 break;
647#endif
Ronald Cron1f0db802021-03-12 09:59:30 +0100648#if defined(PSA_WANT_KEY_TYPE_CHACHA20)
Gilles Peskine26869f22019-05-06 15:25:00 +0200649 case PSA_KEY_TYPE_CHACHA20:
Gilles Peskine449bd832023-01-11 14:50:10 +0100650 if (bits != 256) {
651 return PSA_ERROR_INVALID_ARGUMENT;
652 }
Gilles Peskine26869f22019-05-06 15:25:00 +0200653 break;
654#endif
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200655 default:
Gilles Peskine449bd832023-01-11 14:50:10 +0100656 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200657 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100658 if (bits % 8 != 0) {
659 return PSA_ERROR_INVALID_ARGUMENT;
660 }
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200661
Gilles Peskine449bd832023-01-11 14:50:10 +0100662 return PSA_SUCCESS;
Gilles Peskine0ff4b0f2018-06-19 21:31:50 +0200663}
664
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100665/** Check whether a given key type is valid for use with a given MAC algorithm
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100666 *
Steven Cooremancd640932021-03-08 12:00:27 +0100667 * Upon successful return of this function, the behavior of #PSA_MAC_LENGTH
668 * when called with the validated \p algorithm and \p key_type is well-defined.
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100669 *
670 * \param[in] algorithm The specific MAC algorithm (can be wildcard).
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100671 * \param[in] key_type The key type of the key to be used with the
672 * \p algorithm.
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100673 *
674 * \retval #PSA_SUCCESS
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100675 * The \p key_type is valid for use with the \p algorithm
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100676 * \retval #PSA_ERROR_INVALID_ARGUMENT
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100677 * The \p key_type is not valid for use with the \p algorithm
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100678 */
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100679MBEDTLS_STATIC_TESTABLE psa_status_t psa_mac_key_can_do(
Steven Cooreman58c94d32021-03-02 21:31:17 +0100680 psa_algorithm_t algorithm,
Gilles Peskine449bd832023-01-11 14:50:10 +0100681 psa_key_type_t key_type)
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100682{
Gilles Peskine449bd832023-01-11 14:50:10 +0100683 if (PSA_ALG_IS_HMAC(algorithm)) {
684 if (key_type == PSA_KEY_TYPE_HMAC) {
685 return PSA_SUCCESS;
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100686 }
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100687 }
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100688
Gilles Peskine449bd832023-01-11 14:50:10 +0100689 if (PSA_ALG_IS_BLOCK_CIPHER_MAC(algorithm)) {
690 /* Check that we're calling PSA_BLOCK_CIPHER_BLOCK_LENGTH with a cipher
691 * key. */
692 if ((key_type & PSA_KEY_TYPE_CATEGORY_MASK) ==
693 PSA_KEY_TYPE_CATEGORY_SYMMETRIC) {
694 /* PSA_BLOCK_CIPHER_BLOCK_LENGTH returns 1 for stream ciphers and
695 * the block length (larger than 1) for block ciphers. */
696 if (PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type) > 1) {
697 return PSA_SUCCESS;
698 }
699 }
700 }
701
702 return PSA_ERROR_INVALID_ARGUMENT;
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100703}
704
Gilles Peskine449bd832023-01-11 14:50:10 +0100705psa_status_t psa_allocate_buffer_to_slot(psa_key_slot_t *slot,
706 size_t buffer_length)
Steven Cooreman75b74362020-07-28 14:30:13 +0200707{
Valerio Setti8d4f1502024-06-14 07:49:05 +0200708#if defined(MBEDTLS_PSA_STATIC_KEY_SLOTS)
Valerio Setti8d4f1502024-06-14 07:49:05 +0200709 if (buffer_length > ((size_t) MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE)) {
710 return PSA_ERROR_NOT_SUPPORTED;
711 }
Valerio Setti8d4f1502024-06-14 07:49:05 +0200712#else
Gilles Peskine449bd832023-01-11 14:50:10 +0100713 if (slot->key.data != NULL) {
714 return PSA_ERROR_ALREADY_EXISTS;
715 }
Steven Cooreman75b74362020-07-28 14:30:13 +0200716
Gilles Peskine449bd832023-01-11 14:50:10 +0100717 slot->key.data = mbedtls_calloc(1, buffer_length);
718 if (slot->key.data == NULL) {
719 return PSA_ERROR_INSUFFICIENT_MEMORY;
720 }
Valerio Setti8d4f1502024-06-14 07:49:05 +0200721#endif
Steven Cooreman75b74362020-07-28 14:30:13 +0200722
Ronald Cronea0f8a62020-11-25 17:52:23 +0100723 slot->key.bytes = buffer_length;
Gilles Peskine449bd832023-01-11 14:50:10 +0100724 return PSA_SUCCESS;
Steven Cooreman75b74362020-07-28 14:30:13 +0200725}
726
Gilles Peskine449bd832023-01-11 14:50:10 +0100727psa_status_t psa_copy_key_material_into_slot(psa_key_slot_t *slot,
728 const uint8_t *data,
729 size_t data_length)
Steven Cooremanf7cebd42020-10-13 20:27:40 +0200730{
Gilles Peskine449bd832023-01-11 14:50:10 +0100731 psa_status_t status = psa_allocate_buffer_to_slot(slot,
732 data_length);
733 if (status != PSA_SUCCESS) {
734 return status;
735 }
Steven Cooremanf7cebd42020-10-13 20:27:40 +0200736
Gilles Peskine449bd832023-01-11 14:50:10 +0100737 memcpy(slot->key.data, data, data_length);
738 return PSA_SUCCESS;
Steven Cooremanf7cebd42020-10-13 20:27:40 +0200739}
740
Ronald Crona0fe59f2020-11-29 11:14:53 +0100741psa_status_t psa_import_key_into_slot(
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100742 const psa_key_attributes_t *attributes,
743 const uint8_t *data, size_t data_length,
744 uint8_t *key_buffer, size_t key_buffer_size,
Gilles Peskine449bd832023-01-11 14:50:10 +0100745 size_t *key_buffer_length, size_t *bits)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100746{
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100747 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f107ae2024-02-28 01:26:46 +0100748 psa_key_type_t type = attributes->type;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +0100749
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200750 /* zero-length keys are never supported. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100751 if (data_length == 0) {
752 return PSA_ERROR_NOT_SUPPORTED;
753 }
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200754
Gilles Peskine449bd832023-01-11 14:50:10 +0100755 if (key_type_is_raw_bytes(type)) {
756 *bits = PSA_BYTES_TO_BITS(data_length);
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200757
Gilles Peskine2f107ae2024-02-28 01:26:46 +0100758 status = psa_validate_unstructured_key_bit_size(attributes->type,
Gilles Peskine449bd832023-01-11 14:50:10 +0100759 *bits);
760 if (status != PSA_SUCCESS) {
761 return status;
762 }
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200763
Ronald Crondd04d422020-11-28 15:14:42 +0100764 /* Copy the key material. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100765 memcpy(key_buffer, data, data_length);
Ronald Crondd04d422020-11-28 15:14:42 +0100766 *key_buffer_length = data_length;
Gilles Peskine449bd832023-01-11 14:50:10 +0100767 (void) key_buffer_size;
Steven Cooreman81be2fa2020-07-24 22:04:59 +0200768
Gilles Peskine449bd832023-01-11 14:50:10 +0100769 return PSA_SUCCESS;
770 } else if (PSA_KEY_TYPE_IS_ASYMMETRIC(type)) {
Valerio Settia55f0422023-07-10 15:34:41 +0200771#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT) || \
Przemek Stekiel6d85afa2023-04-28 11:42:17 +0200772 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY)
Przemek Stekiel472b3f32022-12-01 14:38:49 +0100773 if (PSA_KEY_TYPE_IS_DH(type)) {
Przemek Stekield1cf1ba2023-04-27 12:04:21 +0200774 if (psa_is_dh_key_size_valid(PSA_BYTES_TO_BITS(data_length)) == 0) {
Valerio Setti504a1022024-01-17 15:19:30 +0100775 return PSA_ERROR_NOT_SUPPORTED;
Przemek Stekiel472b3f32022-12-01 14:38:49 +0100776 }
Przemek Stekiel33c91eb2023-05-30 15:16:35 +0200777 return mbedtls_psa_ffdh_import_key(attributes,
778 data, data_length,
779 key_buffer, key_buffer_size,
780 key_buffer_length,
781 bits);
Przemek Stekiel472b3f32022-12-01 14:38:49 +0100782 }
Valerio Settia55f0422023-07-10 15:34:41 +0200783#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT) ||
Przemek Stekiel6d85afa2023-04-28 11:42:17 +0200784 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY) */
Valerio Setti27c501a2023-06-27 16:58:52 +0200785#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT) || \
Gilles Peskine449bd832023-01-11 14:50:10 +0100786 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)
787 if (PSA_KEY_TYPE_IS_ECC(type)) {
788 return mbedtls_psa_ecp_import_key(attributes,
789 data, data_length,
790 key_buffer, key_buffer_size,
791 key_buffer_length,
792 bits);
Steven Cooreman40120f62020-10-29 11:42:22 +0100793 }
Valerio Setti27c501a2023-06-27 16:58:52 +0200794#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT) ||
John Durkop9814fa22020-11-04 12:28:15 -0800795 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
Valerio Settife478902023-07-25 12:27:19 +0200796#if (defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT) && \
797 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT)) || \
Gilles Peskine449bd832023-01-11 14:50:10 +0100798 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
799 if (PSA_KEY_TYPE_IS_RSA(type)) {
800 return mbedtls_psa_rsa_import_key(attributes,
801 data, data_length,
802 key_buffer, key_buffer_size,
803 key_buffer_length,
804 bits);
Steven Cooreman3ea0ce42020-10-23 11:37:05 +0200805 }
Valerio Settife478902023-07-25 12:27:19 +0200806#endif /* (defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT) &&
807 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT)) ||
John Durkop9814fa22020-11-04 12:28:15 -0800808 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Ronald Cron2ebfdcc2020-11-28 15:54:54 +0100809 }
Steven Cooreman40120f62020-10-29 11:42:22 +0100810
Gilles Peskine449bd832023-01-11 14:50:10 +0100811 return PSA_ERROR_NOT_SUPPORTED;
Darryl Green06fd18d2018-07-16 11:21:11 +0100812}
813
Gilles Peskinef603c712019-01-19 13:40:11 +0100814/** Calculate the intersection of two algorithm usage policies.
815 *
816 * Return 0 (which allows no operation) on incompatibility.
817 */
818static psa_algorithm_t psa_key_policy_algorithm_intersection(
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100819 psa_key_type_t key_type,
Gilles Peskinef603c712019-01-19 13:40:11 +0100820 psa_algorithm_t alg1,
Gilles Peskine449bd832023-01-11 14:50:10 +0100821 psa_algorithm_t alg2)
Gilles Peskinef603c712019-01-19 13:40:11 +0100822{
Gilles Peskine549ea862019-05-22 11:45:59 +0200823 /* Common case: both sides actually specify the same policy. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100824 if (alg1 == alg2) {
825 return alg1;
826 }
Steven Cooreman03488022021-02-18 12:07:20 +0100827 /* If the policies are from the same hash-and-sign family, check
828 * if one is a wildcard. If so the other has the specific algorithm. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100829 if (PSA_ALG_IS_SIGN_HASH(alg1) &&
830 PSA_ALG_IS_SIGN_HASH(alg2) &&
831 (alg1 & ~PSA_ALG_HASH_MASK) == (alg2 & ~PSA_ALG_HASH_MASK)) {
832 if (PSA_ALG_SIGN_GET_HASH(alg1) == PSA_ALG_ANY_HASH) {
833 return alg2;
834 }
835 if (PSA_ALG_SIGN_GET_HASH(alg2) == PSA_ALG_ANY_HASH) {
836 return alg1;
837 }
Steven Cooreman03488022021-02-18 12:07:20 +0100838 }
839 /* If the policies are from the same AEAD family, check whether
Steven Cooreman7de9e2d2021-02-22 17:05:56 +0100840 * one of them is a minimum-tag-length wildcard. Calculate the most
Steven Cooreman03488022021-02-18 12:07:20 +0100841 * restrictive tag length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100842 if (PSA_ALG_IS_AEAD(alg1) && PSA_ALG_IS_AEAD(alg2) &&
843 (PSA_ALG_AEAD_WITH_SHORTENED_TAG(alg1, 0) ==
844 PSA_ALG_AEAD_WITH_SHORTENED_TAG(alg2, 0))) {
845 size_t alg1_len = PSA_ALG_AEAD_GET_TAG_LENGTH(alg1);
846 size_t alg2_len = PSA_ALG_AEAD_GET_TAG_LENGTH(alg2);
Steven Cooremancd640932021-03-08 12:00:27 +0100847 size_t restricted_len = alg1_len > alg2_len ? alg1_len : alg2_len;
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100848
Steven Cooreman7de9e2d2021-02-22 17:05:56 +0100849 /* If both are wildcards, return most restrictive wildcard */
Gilles Peskine449bd832023-01-11 14:50:10 +0100850 if (((alg1 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
851 ((alg2 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0)) {
852 return PSA_ALG_AEAD_WITH_AT_LEAST_THIS_LENGTH_TAG(
853 alg1, restricted_len);
Steven Cooreman03488022021-02-18 12:07:20 +0100854 }
855 /* If only one is a wildcard, return specific algorithm if compatible. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100856 if (((alg1 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
857 (alg1_len <= alg2_len)) {
858 return alg2;
Steven Cooreman03488022021-02-18 12:07:20 +0100859 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100860 if (((alg2 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
861 (alg2_len <= alg1_len)) {
862 return alg1;
Steven Cooreman03488022021-02-18 12:07:20 +0100863 }
864 }
865 /* If the policies are from the same MAC family, check whether one
866 * of them is a minimum-MAC-length policy. Calculate the most
867 * restrictive tag length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100868 if (PSA_ALG_IS_MAC(alg1) && PSA_ALG_IS_MAC(alg2) &&
869 (PSA_ALG_FULL_LENGTH_MAC(alg1) ==
870 PSA_ALG_FULL_LENGTH_MAC(alg2))) {
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100871 /* Validate the combination of key type and algorithm. Since the base
872 * algorithm of alg1 and alg2 are the same, we only need this once. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100873 if (PSA_SUCCESS != psa_mac_key_can_do(alg1, key_type)) {
874 return 0;
875 }
Steven Cooreman1ac5ce32021-03-02 16:34:49 +0100876
Steven Cooreman31a876d2021-03-03 20:47:40 +0100877 /* Get the (exact or at-least) output lengths for both sides of the
878 * requested intersection. None of the currently supported algorithms
879 * have an output length dependent on the actual key size, so setting it
880 * to a bogus value of 0 is currently OK.
881 *
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100882 * Note that for at-least-this-length wildcard algorithms, the output
883 * length is set to the shortest allowed length, which allows us to
884 * calculate the most restrictive tag length for the intersection. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100885 size_t alg1_len = PSA_MAC_LENGTH(key_type, 0, alg1);
886 size_t alg2_len = PSA_MAC_LENGTH(key_type, 0, alg2);
Steven Cooremancd640932021-03-08 12:00:27 +0100887 size_t restricted_len = alg1_len > alg2_len ? alg1_len : alg2_len;
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100888
Steven Cooremana1d83222021-02-25 10:20:29 +0100889 /* If both are wildcards, return most restrictive wildcard */
Gilles Peskine449bd832023-01-11 14:50:10 +0100890 if (((alg1 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
891 ((alg2 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0)) {
892 return PSA_ALG_AT_LEAST_THIS_LENGTH_MAC(alg1, restricted_len);
Steven Cooreman03488022021-02-18 12:07:20 +0100893 }
Steven Cooreman31a876d2021-03-03 20:47:40 +0100894
895 /* If only one is an at-least-this-length policy, the intersection would
896 * be the other (fixed-length) policy as long as said fixed length is
897 * equal to or larger than the shortest allowed length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100898 if ((alg1 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) {
899 return (alg1_len <= alg2_len) ? alg2 : 0;
Steven Cooreman03488022021-02-18 12:07:20 +0100900 }
Gilles Peskine449bd832023-01-11 14:50:10 +0100901 if ((alg2 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) {
902 return (alg2_len <= alg1_len) ? alg1 : 0;
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100903 }
Steven Cooreman31a876d2021-03-03 20:47:40 +0100904
Steven Cooremancd640932021-03-08 12:00:27 +0100905 /* If none of them are wildcards, check whether they define the same tag
906 * length. This is still possible here when one is default-length and
907 * the other specific-length. Ensure to always return the
908 * specific-length version for the intersection. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100909 if (alg1_len == alg2_len) {
910 return PSA_ALG_TRUNCATED_MAC(alg1, alg1_len);
911 }
Gilles Peskinef603c712019-01-19 13:40:11 +0100912 }
913 /* If the policies are incompatible, allow nothing. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100914 return 0;
Gilles Peskinef603c712019-01-19 13:40:11 +0100915}
916
Gilles Peskine449bd832023-01-11 14:50:10 +0100917static int psa_key_algorithm_permits(psa_key_type_t key_type,
918 psa_algorithm_t policy_alg,
919 psa_algorithm_t requested_alg)
Gilles Peskined6f371b2019-05-10 19:33:38 +0200920{
Gilles Peskine549ea862019-05-22 11:45:59 +0200921 /* Common case: the policy only allows requested_alg. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100922 if (requested_alg == policy_alg) {
923 return 1;
924 }
Steven Cooreman03488022021-02-18 12:07:20 +0100925 /* If policy_alg is a hash-and-sign with a wildcard for the hash,
926 * and requested_alg is the same hash-and-sign family with any hash,
927 * then requested_alg is compliant with policy_alg. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100928 if (PSA_ALG_IS_SIGN_HASH(requested_alg) &&
929 PSA_ALG_SIGN_GET_HASH(policy_alg) == PSA_ALG_ANY_HASH) {
930 return (policy_alg & ~PSA_ALG_HASH_MASK) ==
931 (requested_alg & ~PSA_ALG_HASH_MASK);
Steven Cooreman03488022021-02-18 12:07:20 +0100932 }
933 /* If policy_alg is a wildcard AEAD algorithm of the same base as
934 * the requested algorithm, check the requested tag length to be
935 * equal-length or longer than the wildcard-specified length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100936 if (PSA_ALG_IS_AEAD(policy_alg) &&
937 PSA_ALG_IS_AEAD(requested_alg) &&
938 (PSA_ALG_AEAD_WITH_SHORTENED_TAG(policy_alg, 0) ==
939 PSA_ALG_AEAD_WITH_SHORTENED_TAG(requested_alg, 0)) &&
940 ((policy_alg & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0)) {
941 return PSA_ALG_AEAD_GET_TAG_LENGTH(policy_alg) <=
942 PSA_ALG_AEAD_GET_TAG_LENGTH(requested_alg);
Steven Cooreman03488022021-02-18 12:07:20 +0100943 }
Steven Cooremancd640932021-03-08 12:00:27 +0100944 /* If policy_alg is a MAC algorithm of the same base as the requested
945 * algorithm, check whether their MAC lengths are compatible. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100946 if (PSA_ALG_IS_MAC(policy_alg) &&
947 PSA_ALG_IS_MAC(requested_alg) &&
948 (PSA_ALG_FULL_LENGTH_MAC(policy_alg) ==
949 PSA_ALG_FULL_LENGTH_MAC(requested_alg))) {
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100950 /* Validate the combination of key type and algorithm. Since the policy
951 * and requested algorithms are the same, we only need this once. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100952 if (PSA_SUCCESS != psa_mac_key_can_do(policy_alg, key_type)) {
953 return 0;
954 }
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100955
Steven Cooreman31a876d2021-03-03 20:47:40 +0100956 /* Get both the requested output length for the algorithm which is to be
957 * verified, and the default output length for the base algorithm.
958 * Note that none of the currently supported algorithms have an output
959 * length dependent on actual key size, so setting it to a bogus value
960 * of 0 is currently OK. */
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100961 size_t requested_output_length = PSA_MAC_LENGTH(
Gilles Peskine449bd832023-01-11 14:50:10 +0100962 key_type, 0, requested_alg);
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +0100963 size_t default_output_length = PSA_MAC_LENGTH(
Gilles Peskine449bd832023-01-11 14:50:10 +0100964 key_type, 0,
965 PSA_ALG_FULL_LENGTH_MAC(requested_alg));
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100966
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100967 /* If the policy is default-length, only allow an algorithm with
968 * a declared exact-length matching the default. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100969 if (PSA_MAC_TRUNCATED_LENGTH(policy_alg) == 0) {
970 return requested_output_length == default_output_length;
971 }
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100972
973 /* If the requested algorithm is default-length, allow it if the policy
Steven Cooremancd640932021-03-08 12:00:27 +0100974 * length exactly matches the default length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100975 if (PSA_MAC_TRUNCATED_LENGTH(requested_alg) == 0 &&
976 PSA_MAC_TRUNCATED_LENGTH(policy_alg) == default_output_length) {
977 return 1;
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100978 }
979
Steven Cooremancd640932021-03-08 12:00:27 +0100980 /* If policy_alg is an at-least-this-length wildcard MAC algorithm,
981 * check for the requested MAC length to be equal to or longer than the
982 * minimum allowed length. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100983 if ((policy_alg & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) {
984 return PSA_MAC_TRUNCATED_LENGTH(policy_alg) <=
985 requested_output_length;
Steven Cooreman5ad4bf72021-03-02 15:11:57 +0100986 }
Gilles Peskined6f371b2019-05-10 19:33:38 +0200987 }
Steven Cooremance48e852020-10-05 16:02:45 +0200988 /* If policy_alg is a generic key agreement operation, then using it for
Steven Cooremanfa5e6312020-10-15 17:07:12 +0200989 * a key derivation with that key agreement should also be allowed. This
990 * behaviour is expected to be defined in a future specification version. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100991 if (PSA_ALG_IS_RAW_KEY_AGREEMENT(policy_alg) &&
992 PSA_ALG_IS_KEY_AGREEMENT(requested_alg)) {
993 return PSA_ALG_KEY_AGREEMENT_GET_BASE(requested_alg) ==
994 policy_alg;
Steven Cooremance48e852020-10-05 16:02:45 +0200995 }
Steven Cooremanb3ce8152021-02-18 12:03:50 +0100996 /* If it isn't explicitly permitted, it's forbidden. */
Gilles Peskine449bd832023-01-11 14:50:10 +0100997 return 0;
Gilles Peskined6f371b2019-05-10 19:33:38 +0200998}
999
Gilles Peskine30f77cd2019-01-14 16:06:39 +01001000/** Test whether a policy permits an algorithm.
1001 *
1002 * The caller must test usage flags separately.
Steven Cooreman7e39f052021-02-23 14:18:32 +01001003 *
Steven Cooreman5a172672021-03-02 21:27:42 +01001004 * \note This function requires providing the key type for which the policy is
1005 * being validated, since some algorithm policy definitions (e.g. MAC)
1006 * have different properties depending on what kind of cipher it is
1007 * combined with.
1008 *
Steven Cooreman7e39f052021-02-23 14:18:32 +01001009 * \retval PSA_SUCCESS When \p alg is a specific algorithm
1010 * allowed by the \p policy.
1011 * \retval PSA_ERROR_INVALID_ARGUMENT When \p alg is not a specific algorithm
1012 * \retval PSA_ERROR_NOT_PERMITTED When \p alg is a specific algorithm, but
1013 * the \p policy does not allow it.
Gilles Peskine30f77cd2019-01-14 16:06:39 +01001014 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001015static psa_status_t psa_key_policy_permits(const psa_key_policy_t *policy,
1016 psa_key_type_t key_type,
1017 psa_algorithm_t alg)
Gilles Peskine30f77cd2019-01-14 16:06:39 +01001018{
Steven Cooremand788fab2021-02-25 11:29:17 +01001019 /* '0' is not a valid algorithm */
Gilles Peskine449bd832023-01-11 14:50:10 +01001020 if (alg == 0) {
1021 return PSA_ERROR_INVALID_ARGUMENT;
1022 }
Steven Cooremand788fab2021-02-25 11:29:17 +01001023
Steven Cooreman7e39f052021-02-23 14:18:32 +01001024 /* A requested algorithm cannot be a wildcard. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001025 if (PSA_ALG_IS_WILDCARD(alg)) {
1026 return PSA_ERROR_INVALID_ARGUMENT;
1027 }
Steven Cooreman7e39f052021-02-23 14:18:32 +01001028
Gilles Peskine449bd832023-01-11 14:50:10 +01001029 if (psa_key_algorithm_permits(key_type, policy->alg, alg) ||
1030 psa_key_algorithm_permits(key_type, policy->alg2, alg)) {
1031 return PSA_SUCCESS;
1032 } else {
1033 return PSA_ERROR_NOT_PERMITTED;
1034 }
Gilles Peskine30f77cd2019-01-14 16:06:39 +01001035}
1036
Gilles Peskinef603c712019-01-19 13:40:11 +01001037/** Restrict a key policy based on a constraint.
1038 *
Steven Cooreman5a172672021-03-02 21:27:42 +01001039 * \note This function requires providing the key type for which the policy is
1040 * being restricted, since some algorithm policy definitions (e.g. MAC)
1041 * have different properties depending on what kind of cipher it is
1042 * combined with.
1043 *
Steven Cooreman1ac5ce32021-03-02 16:34:49 +01001044 * \param[in] key_type The key type for which to restrict the policy
Gilles Peskinef603c712019-01-19 13:40:11 +01001045 * \param[in,out] policy The policy to restrict.
1046 * \param[in] constraint The policy constraint to apply.
1047 *
1048 * \retval #PSA_SUCCESS
1049 * \c *policy contains the intersection of the original value of
1050 * \c *policy and \c *constraint.
1051 * \retval #PSA_ERROR_INVALID_ARGUMENT
Steven Cooreman1ac5ce32021-03-02 16:34:49 +01001052 * \c key_type, \c *policy and \c *constraint are incompatible.
Gilles Peskinef603c712019-01-19 13:40:11 +01001053 * \c *policy is unchanged.
1054 */
1055static psa_status_t psa_restrict_key_policy(
Steven Cooreman1ac5ce32021-03-02 16:34:49 +01001056 psa_key_type_t key_type,
Gilles Peskinef603c712019-01-19 13:40:11 +01001057 psa_key_policy_t *policy,
Gilles Peskine449bd832023-01-11 14:50:10 +01001058 const psa_key_policy_t *constraint)
Gilles Peskinef603c712019-01-19 13:40:11 +01001059{
1060 psa_algorithm_t intersection_alg =
Gilles Peskine449bd832023-01-11 14:50:10 +01001061 psa_key_policy_algorithm_intersection(key_type, policy->alg,
1062 constraint->alg);
Gilles Peskined6f371b2019-05-10 19:33:38 +02001063 psa_algorithm_t intersection_alg2 =
Gilles Peskine449bd832023-01-11 14:50:10 +01001064 psa_key_policy_algorithm_intersection(key_type, policy->alg2,
1065 constraint->alg2);
1066 if (intersection_alg == 0 && policy->alg != 0 && constraint->alg != 0) {
1067 return PSA_ERROR_INVALID_ARGUMENT;
1068 }
1069 if (intersection_alg2 == 0 && policy->alg2 != 0 && constraint->alg2 != 0) {
1070 return PSA_ERROR_INVALID_ARGUMENT;
1071 }
Gilles Peskinef603c712019-01-19 13:40:11 +01001072 policy->usage &= constraint->usage;
1073 policy->alg = intersection_alg;
Gilles Peskined6f371b2019-05-10 19:33:38 +02001074 policy->alg2 = intersection_alg2;
Gilles Peskine449bd832023-01-11 14:50:10 +01001075 return PSA_SUCCESS;
Gilles Peskinef603c712019-01-19 13:40:11 +01001076}
1077
Przemek Stekiel061f6942022-11-30 10:51:35 +01001078/** Get the description of a key given its identifier and policy constraints
1079 * and lock it.
1080 *
1081 * The key must have allow all the usage flags set in \p usage. If \p alg is
1082 * nonzero, the key must allow operations with this algorithm. If \p alg is
1083 * zero, the algorithm is not checked.
1084 *
1085 * In case of a persistent key, the function loads the description of the key
1086 * into a key slot if not already done.
1087 *
Ryan Everett098c6652024-01-03 13:03:36 +00001088 * On success, the returned key slot has been registered for reading.
Ryan Everett93cea572024-02-20 18:01:29 +00001089 * It is the responsibility of the caller to then unregister
1090 * once they have finished reading the contents of the slot.
1091 * The caller unregisters by calling psa_unregister_read() or
1092 * psa_unregister_read_under_mutex(). psa_unregister_read() must be called
1093 * if and only if the caller already holds the global key slot mutex
1094 * (when mutexes are enabled). psa_unregister_read_under_mutex() encapsulates
1095 * the unregister with mutex lock and unlock operations.
Przemek Stekiel061f6942022-11-30 10:51:35 +01001096 */
1097static psa_status_t psa_get_and_lock_key_slot_with_policy(
Ronald Cron5c522922020-11-14 16:35:34 +01001098 mbedtls_svc_key_id_t key,
1099 psa_key_slot_t **p_slot,
1100 psa_key_usage_t usage,
Gilles Peskine449bd832023-01-11 14:50:10 +01001101 psa_algorithm_t alg)
Darryl Green06fd18d2018-07-16 11:21:11 +01001102{
Ronald Cronf95a2b12020-10-22 15:24:49 +02001103 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01001104 psa_key_slot_t *slot = NULL;
Darryl Green06fd18d2018-07-16 11:21:11 +01001105
Gilles Peskine449bd832023-01-11 14:50:10 +01001106 status = psa_get_and_lock_key_slot(key, p_slot);
1107 if (status != PSA_SUCCESS) {
1108 return status;
1109 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02001110 slot = *p_slot;
Darryl Green06fd18d2018-07-16 11:21:11 +01001111
1112 /* Enforce that usage policy for the key slot contains all the flags
1113 * required by the usage parameter. There is one exception: public
1114 * keys can always be exported, so we treat public key objects as
1115 * if they had the export flag. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001116 if (PSA_KEY_TYPE_IS_PUBLIC_KEY(slot->attr.type)) {
Darryl Green06fd18d2018-07-16 11:21:11 +01001117 usage &= ~PSA_KEY_USAGE_EXPORT;
Gilles Peskine449bd832023-01-11 14:50:10 +01001118 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02001119
Gilles Peskine449bd832023-01-11 14:50:10 +01001120 if ((slot->attr.policy.usage & usage) != usage) {
Steven Cooreman328f11c2021-03-02 11:44:51 +01001121 status = PSA_ERROR_NOT_PERMITTED;
Ronald Cronf95a2b12020-10-22 15:24:49 +02001122 goto error;
Steven Cooreman328f11c2021-03-02 11:44:51 +01001123 }
Gilles Peskine30f77cd2019-01-14 16:06:39 +01001124
Shaun Case8b0ecbc2021-12-20 21:14:10 -08001125 /* Enforce that the usage policy permits the requested algorithm. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001126 if (alg != 0) {
1127 status = psa_key_policy_permits(&slot->attr.policy,
1128 slot->attr.type,
1129 alg);
1130 if (status != PSA_SUCCESS) {
Steven Cooreman7e39f052021-02-23 14:18:32 +01001131 goto error;
Gilles Peskine449bd832023-01-11 14:50:10 +01001132 }
Steven Cooreman7e39f052021-02-23 14:18:32 +01001133 }
Darryl Green06fd18d2018-07-16 11:21:11 +01001134
Gilles Peskine449bd832023-01-11 14:50:10 +01001135 return PSA_SUCCESS;
Ronald Cronf95a2b12020-10-22 15:24:49 +02001136
1137error:
1138 *p_slot = NULL;
Ryan Everettfb792ca2024-01-31 13:40:05 +00001139 psa_unregister_read_under_mutex(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02001140
Gilles Peskine449bd832023-01-11 14:50:10 +01001141 return status;
Darryl Green06fd18d2018-07-16 11:21:11 +01001142}
Darryl Green940d72c2018-07-13 13:18:51 +01001143
Ronald Cron5c522922020-11-14 16:35:34 +01001144/** Get a key slot containing a transparent key and lock it.
Gilles Peskine28f8f302019-07-24 13:30:31 +02001145 *
1146 * A transparent key is a key for which the key material is directly
Ronald Cronddae0f52021-08-24 15:39:44 +02001147 * available, as opposed to a key in a secure element and/or to be used
1148 * by a secure element.
Gilles Peskine28f8f302019-07-24 13:30:31 +02001149 *
Ronald Cronddae0f52021-08-24 15:39:44 +02001150 * This is a temporary function that may be used instead of
1151 * psa_get_and_lock_key_slot_with_policy() when there is no opaque key support
1152 * for a cryptographic operation.
Ronald Cronf95a2b12020-10-22 15:24:49 +02001153 *
Ryan Everett098c6652024-01-03 13:03:36 +00001154 * On success, the returned key slot has been registered for reading.
Ryan Everett93cea572024-02-20 18:01:29 +00001155 * It is the responsibility of the caller to then unregister
1156 * once they have finished reading the contents of the slot.
1157 * The caller unregisters by calling psa_unregister_read() or
1158 * psa_unregister_read_under_mutex(). psa_unregister_read() must be called
1159 * if and only if the caller already holds the global key slot mutex
1160 * (when mutexes are enabled). psa_unregister_read_under_mutex() encapsulates
1161 * psa_unregister_read() with mutex lock and unlock operations.
Gilles Peskine28f8f302019-07-24 13:30:31 +02001162 */
Ronald Cron5c522922020-11-14 16:35:34 +01001163static psa_status_t psa_get_and_lock_transparent_key_slot_with_policy(
1164 mbedtls_svc_key_id_t key,
1165 psa_key_slot_t **p_slot,
1166 psa_key_usage_t usage,
Gilles Peskine449bd832023-01-11 14:50:10 +01001167 psa_algorithm_t alg)
Gilles Peskine28f8f302019-07-24 13:30:31 +02001168{
Gilles Peskine449bd832023-01-11 14:50:10 +01001169 psa_status_t status = psa_get_and_lock_key_slot_with_policy(key, p_slot,
1170 usage, alg);
1171 if (status != PSA_SUCCESS) {
1172 return status;
Gilles Peskine28f8f302019-07-24 13:30:31 +02001173 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02001174
Gilles Peskine449bd832023-01-11 14:50:10 +01001175 if (psa_key_lifetime_is_external((*p_slot)->attr.lifetime)) {
Ryan Everettfb792ca2024-01-31 13:40:05 +00001176 psa_unregister_read_under_mutex(*p_slot);
Gilles Peskine449bd832023-01-11 14:50:10 +01001177 *p_slot = NULL;
1178 return PSA_ERROR_NOT_SUPPORTED;
1179 }
1180
1181 return PSA_SUCCESS;
Gilles Peskine28f8f302019-07-24 13:30:31 +02001182}
Gilles Peskine28f8f302019-07-24 13:30:31 +02001183
Gilles Peskine449bd832023-01-11 14:50:10 +01001184psa_status_t psa_remove_key_data_from_memory(psa_key_slot_t *slot)
Darryl Green40225ba2018-11-15 14:48:15 +00001185{
Valerio Setti70fa89c2024-08-14 05:12:45 +02001186#if !defined(MBEDTLS_PSA_STATIC_KEY_SLOTS)
Gilles Peskine449bd832023-01-11 14:50:10 +01001187 if (slot->key.data != NULL) {
Tom Cosgrove52f7e182023-08-01 09:08:48 +01001188 mbedtls_zeroize_and_free(slot->key.data, slot->key.bytes);
Gilles Peskine449bd832023-01-11 14:50:10 +01001189 }
Ronald Cronea0f8a62020-11-25 17:52:23 +01001190
Ronald Cronea0f8a62020-11-25 17:52:23 +01001191 slot->key.data = NULL;
Valerio Setti8d4f1502024-06-14 07:49:05 +02001192#endif /* MBEDTLS_PSA_STATIC_KEY_SLOTS */
1193
Ronald Cronea0f8a62020-11-25 17:52:23 +01001194 slot->key.bytes = 0;
Darryl Green40225ba2018-11-15 14:48:15 +00001195
Gilles Peskine449bd832023-01-11 14:50:10 +01001196 return PSA_SUCCESS;
Darryl Green40225ba2018-11-15 14:48:15 +00001197}
1198
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001199/** Completely wipe a slot in memory, including its policy.
1200 * Persistent storage is not affected. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001201psa_status_t psa_wipe_key_slot(psa_key_slot_t *slot)
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001202{
Gilles Peskine449bd832023-01-11 14:50:10 +01001203 psa_status_t status = psa_remove_key_data_from_memory(slot);
Ronald Cronddd3d052020-10-30 14:07:07 +01001204
Gilles Peskine449bd832023-01-11 14:50:10 +01001205 /*
1206 * As the return error code may not be handled in case of multiple errors,
Ryan Everett7ed542e2024-01-17 11:39:09 +00001207 * do our best to report an unexpected amount of registered readers or
1208 * an unexpected state.
1209 * Assert with MBEDTLS_TEST_HOOK_TEST_ASSERT that the slot is valid for
1210 * wiping.
Gilles Peskine449bd832023-01-11 14:50:10 +01001211 * if the MBEDTLS_TEST_HOOKS configuration option is enabled and the
1212 * function is called as part of the execution of a test suite, the
1213 * execution of the test suite is stopped in error if the assertion fails.
1214 */
Ryan Everett7ed542e2024-01-17 11:39:09 +00001215 switch (slot->state) {
1216 case PSA_SLOT_FULL:
1217 /* In this state psa_wipe_key_slot() must only be called if the
1218 * caller is the last reader. */
1219 case PSA_SLOT_PENDING_DELETION:
1220 /* In this state psa_wipe_key_slot() must only be called if the
1221 * caller is the last reader. */
Gilles Peskine47ad2f72024-06-10 11:42:41 +02001222 if (slot->var.occupied.registered_readers != 1) {
1223 MBEDTLS_TEST_HOOK_TEST_ASSERT(slot->var.occupied.registered_readers == 1);
Ryan Everett7ed542e2024-01-17 11:39:09 +00001224 status = PSA_ERROR_CORRUPTION_DETECTED;
1225 }
1226 break;
1227 case PSA_SLOT_FILLING:
1228 /* In this state registered_readers must be 0. */
Gilles Peskine47ad2f72024-06-10 11:42:41 +02001229 if (slot->var.occupied.registered_readers != 0) {
1230 MBEDTLS_TEST_HOOK_TEST_ASSERT(slot->var.occupied.registered_readers == 0);
Ryan Everett7ed542e2024-01-17 11:39:09 +00001231 status = PSA_ERROR_CORRUPTION_DETECTED;
1232 }
1233 break;
1234 case PSA_SLOT_EMPTY:
1235 /* The slot is already empty, it cannot be wiped. */
1236 MBEDTLS_TEST_HOOK_TEST_ASSERT(slot->state != PSA_SLOT_EMPTY);
1237 status = PSA_ERROR_CORRUPTION_DETECTED;
1238 break;
1239 default:
1240 /* The slot's state is invalid. */
1241 status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cronddd3d052020-10-30 14:07:07 +01001242 }
1243
Gilles Peskinee8199f52024-06-10 11:53:33 +02001244#if defined(MBEDTLS_PSA_KEY_STORE_DYNAMIC)
1245 size_t slice_index = slot->slice_index;
1246#endif /* MBEDTLS_PSA_KEY_STORE_DYNAMIC */
1247
1248
Gilles Peskine3f7cd622019-08-13 15:01:08 +02001249 /* Multipart operations may still be using the key. This is safe
1250 * because all multipart operation objects are independent from
1251 * the key slot: if they need to access the key after the setup
1252 * phase, they have a copy of the key. Note that this means that
1253 * key material can linger until all operations are completed. */
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001254 /* At this point, key material and other type-specific content has
1255 * been wiped. Clear remaining metadata. We can call memset and not
Ryan Everettaa33c512023-12-21 17:32:07 +00001256 * zeroize because the metadata is not particularly sensitive.
1257 * This memset also sets the slot's state to PSA_SLOT_EMPTY. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001258 memset(slot, 0, sizeof(*slot));
Gilles Peskinee8199f52024-06-10 11:53:33 +02001259
1260#if defined(MBEDTLS_PSA_KEY_STORE_DYNAMIC)
1261 /* If the slot is already corrupted, something went deeply wrong,
1262 * like a thread still using the slot or a stray pointer leading
1263 * to the slot's memory being used for another object. Let the slot
1264 * leak rather than make the corruption worse. */
1265 if (status == PSA_SUCCESS) {
1266 status = psa_free_key_slot(slice_index, slot);
1267 }
1268#endif /* MBEDTLS_PSA_KEY_STORE_DYNAMIC */
1269
Gilles Peskine449bd832023-01-11 14:50:10 +01001270 return status;
Gilles Peskinef77ed1f2018-12-03 11:58:46 +01001271}
1272
Gilles Peskine449bd832023-01-11 14:50:10 +01001273psa_status_t psa_destroy_key(mbedtls_svc_key_id_t key)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001274{
Gilles Peskine2f060a82018-12-04 17:12:32 +01001275 psa_key_slot_t *slot;
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001276 psa_status_t status; /* status of the last operation */
1277 psa_status_t overall_status = PSA_SUCCESS;
Gilles Peskine354f7672019-07-12 23:46:38 +02001278#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1279 psa_se_drv_table_entry_t *driver;
1280#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001281
Gilles Peskine449bd832023-01-11 14:50:10 +01001282 if (mbedtls_svc_key_id_is_null(key)) {
1283 return PSA_SUCCESS;
1284 }
Gilles Peskine1841cf42019-10-08 15:48:25 +02001285
Ronald Cronf2911112020-10-29 17:51:10 +01001286 /*
Ryan Everett7ed542e2024-01-17 11:39:09 +00001287 * Get the description of the key in a key slot, and register to read it.
1288 * In the case of a persistent key, this will load the key description
1289 * from persistent memory if not done yet.
1290 * We cannot avoid this loading as without it we don't know if
Ronald Cronf2911112020-10-29 17:51:10 +01001291 * the key is operated by an SE or not and this information is needed by
Ryan Everett7ed542e2024-01-17 11:39:09 +00001292 * the current implementation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001293 status = psa_get_and_lock_key_slot(key, &slot);
1294 if (status != PSA_SUCCESS) {
1295 return status;
1296 }
Gilles Peskine354f7672019-07-12 23:46:38 +02001297
Ryan Everettc053d962024-01-25 17:56:32 +00001298#if defined(MBEDTLS_THREADING_C)
Ryan Everett763971f2024-01-29 17:13:36 +00001299 /* We cannot unlock between setting the state to PENDING_DELETION
1300 * and destroying the key in storage, as otherwise another thread
1301 * could load the key into a new slot and the key will not be
1302 * fully destroyed. */
Ryan Everettc053d962024-01-25 17:56:32 +00001303 PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_lock(
1304 &mbedtls_threading_key_slot_mutex));
Ryan Everettd868b742024-03-08 18:35:09 +00001305
1306 if (slot->state == PSA_SLOT_PENDING_DELETION) {
1307 /* Another thread has destroyed the key between us locking the slot
1308 * and us gaining the mutex. Unregister from the slot,
1309 * and report that the key does not exist. */
1310 status = psa_unregister_read(slot);
1311
1312 PSA_THREADING_CHK_RET(mbedtls_mutex_unlock(
1313 &mbedtls_threading_key_slot_mutex));
1314 return (status == PSA_SUCCESS) ? PSA_ERROR_INVALID_HANDLE : status;
1315 }
Ryan Everettc053d962024-01-25 17:56:32 +00001316#endif
Ryan Everett7ed542e2024-01-17 11:39:09 +00001317 /* Set the key slot containing the key description's state to
1318 * PENDING_DELETION. This stops new operations from registering
1319 * to read the slot. Current readers can safely continue to access
1320 * the key within the slot; the last registered reader will
1321 * automatically wipe the slot when they call psa_unregister_read().
1322 * If the key is persistent, we can now delete the copy of the key
1323 * from memory. If the key is opaque, we require the driver to
1324 * deal with the deletion. */
Ryan Everettd868b742024-03-08 18:35:09 +00001325 overall_status = psa_key_slot_state_transition(slot, PSA_SLOT_FULL,
1326 PSA_SLOT_PENDING_DELETION);
Ryan Everettc053d962024-01-25 17:56:32 +00001327
Ryan Everettd868b742024-03-08 18:35:09 +00001328 if (overall_status != PSA_SUCCESS) {
Ryan Everettc053d962024-01-25 17:56:32 +00001329 goto exit;
1330 }
Ronald Cronf2911112020-10-29 17:51:10 +01001331
Gilles Peskine449bd832023-01-11 14:50:10 +01001332 if (PSA_KEY_LIFETIME_IS_READ_ONLY(slot->attr.lifetime)) {
Gilles Peskine6687cd02021-04-21 22:32:05 +02001333 /* Refuse the destruction of a read-only key (which may or may not work
1334 * if we attempt it, depending on whether the key is merely read-only
1335 * by policy or actually physically read-only).
Gilles Peskinef9a046e2021-06-07 23:27:54 +02001336 * Just do the best we can, which is to wipe the copy in memory
1337 * (done in this function's cleanup code). */
1338 overall_status = PSA_ERROR_NOT_PERMITTED;
1339 goto exit;
Gilles Peskine6687cd02021-04-21 22:32:05 +02001340 }
1341
Gilles Peskine354f7672019-07-12 23:46:38 +02001342#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001343 driver = psa_get_se_driver_entry(slot->attr.lifetime);
1344 if (driver != NULL) {
Gilles Peskine60450a42019-07-25 11:32:45 +02001345 /* For a key in a secure element, we need to do three things:
1346 * remove the key file in internal storage, destroy the
1347 * key inside the secure element, and update the driver's
1348 * persistent data. Start a transaction that will encompass these
1349 * three actions. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001350 psa_crypto_prepare_transaction(PSA_CRYPTO_TRANSACTION_DESTROY_KEY);
Gilles Peskine8e338702019-07-30 20:06:31 +02001351 psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
Gilles Peskine449bd832023-01-11 14:50:10 +01001352 psa_crypto_transaction.key.slot = psa_key_slot_get_slot_number(slot);
Gilles Peskine8e338702019-07-30 20:06:31 +02001353 psa_crypto_transaction.key.id = slot->attr.id;
Gilles Peskine449bd832023-01-11 14:50:10 +01001354 status = psa_crypto_save_transaction();
1355 if (status != PSA_SUCCESS) {
1356 (void) psa_crypto_stop_transaction();
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001357 /* We should still try to destroy the key in the secure
1358 * element and the key metadata in storage. This is especially
1359 * important if the error is that the storage is full.
1360 * But how to do it exactly without risking an inconsistent
1361 * state after a reset?
1362 * https://github.com/ARMmbed/mbed-crypto/issues/215
1363 */
1364 overall_status = status;
1365 goto exit;
Gilles Peskinefc762652019-07-22 19:30:34 +02001366 }
1367
Gilles Peskine449bd832023-01-11 14:50:10 +01001368 status = psa_destroy_se_key(driver,
1369 psa_key_slot_get_slot_number(slot));
1370 if (overall_status == PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001371 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001372 }
Gilles Peskinefc762652019-07-22 19:30:34 +02001373 }
Gilles Peskine354f7672019-07-12 23:46:38 +02001374#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1375
Darryl Greend49a4992018-06-18 17:27:26 +01001376#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001377 if (!PSA_KEY_LIFETIME_IS_VOLATILE(slot->attr.lifetime)) {
Ryan Everett4a0ba802024-01-17 14:12:33 +00001378 /* Destroy the copy of the persistent key from storage.
Ryan Everett7ed542e2024-01-17 11:39:09 +00001379 * The slot will still hold a copy of the key until the last reader
1380 * unregisters. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001381 status = psa_destroy_persistent_key(slot->attr.id);
1382 if (overall_status == PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001383 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001384 }
Darryl Greend49a4992018-06-18 17:27:26 +01001385 }
1386#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
Gilles Peskine354f7672019-07-12 23:46:38 +02001387
Gilles Peskinefc762652019-07-22 19:30:34 +02001388#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001389 if (driver != NULL) {
1390 status = psa_save_se_persistent_data(driver);
1391 if (overall_status == PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001392 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001393 }
1394 status = psa_crypto_stop_transaction();
1395 if (overall_status == PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001396 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001397 }
Gilles Peskinefc762652019-07-22 19:30:34 +02001398 }
1399#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1400
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001401exit:
Ryan Everett7ed542e2024-01-17 11:39:09 +00001402 /* Unregister from reading the slot. If we are the last active reader
1403 * then this will wipe the slot. */
1404 status = psa_unregister_read(slot);
1405 /* Prioritize CORRUPTION_DETECTED from unregistering over
1406 * a storage error. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001407 if (status != PSA_SUCCESS) {
Gilles Peskine4b7f3402019-08-13 15:58:36 +02001408 overall_status = status;
Gilles Peskine449bd832023-01-11 14:50:10 +01001409 }
Ryan Everettc053d962024-01-25 17:56:32 +00001410
1411#if defined(MBEDTLS_THREADING_C)
Ryan Everett7fee4f72024-02-09 14:11:27 +00001412 /* Don't overwrite existing errors if the unlock fails. */
1413 status = overall_status;
Ryan Everettc053d962024-01-25 17:56:32 +00001414 PSA_THREADING_CHK_RET(mbedtls_mutex_unlock(
1415 &mbedtls_threading_key_slot_mutex));
1416#endif
1417
Gilles Peskine449bd832023-01-11 14:50:10 +01001418 return overall_status;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001419}
1420
Gilles Peskinebfd322f2019-07-23 11:58:03 +02001421/** Retrieve all the publicly-accessible attributes of a key.
1422 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001423psa_status_t psa_get_key_attributes(mbedtls_svc_key_id_t key,
1424 psa_key_attributes_t *attributes)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001425{
Ronald Cronf95a2b12020-10-22 15:24:49 +02001426 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01001427 psa_key_slot_t *slot;
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001428
Gilles Peskine449bd832023-01-11 14:50:10 +01001429 psa_reset_key_attributes(attributes);
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02001430
Gilles Peskine449bd832023-01-11 14:50:10 +01001431 status = psa_get_and_lock_key_slot_with_policy(key, &slot, 0, 0);
1432 if (status != PSA_SUCCESS) {
1433 return status;
1434 }
Gilles Peskineb870b182018-07-06 16:02:09 +02001435
Gilles Peskine7fad3ef2024-02-28 01:08:27 +01001436 *attributes = slot->attr;
Gilles Peskinec8000c02019-08-02 20:15:51 +02001437
1438#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001439 if (psa_get_se_driver_entry(slot->attr.lifetime) != NULL) {
1440 psa_set_key_slot_number(attributes,
1441 psa_key_slot_get_slot_number(slot));
1442 }
Gilles Peskinec8000c02019-08-02 20:15:51 +02001443#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskineb699f072019-04-26 16:06:02 +02001444
Gilles Peskine97c0b2f2024-02-16 00:49:46 +01001445 return psa_unregister_read_under_mutex(slot);
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001446}
1447
Gilles Peskinec8000c02019-08-02 20:15:51 +02001448#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1449psa_status_t psa_get_key_slot_number(
1450 const psa_key_attributes_t *attributes,
Gilles Peskine449bd832023-01-11 14:50:10 +01001451 psa_key_slot_number_t *slot_number)
Gilles Peskinec8000c02019-08-02 20:15:51 +02001452{
Gilles Peskine972539c2024-02-28 01:49:45 +01001453 if (attributes->has_slot_number) {
Gilles Peskinec8000c02019-08-02 20:15:51 +02001454 *slot_number = attributes->slot_number;
Gilles Peskine449bd832023-01-11 14:50:10 +01001455 return PSA_SUCCESS;
1456 } else {
1457 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskinec8000c02019-08-02 20:15:51 +02001458 }
Gilles Peskinec8000c02019-08-02 20:15:51 +02001459}
1460#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1461
Gilles Peskine449bd832023-01-11 14:50:10 +01001462static psa_status_t psa_export_key_buffer_internal(const uint8_t *key_buffer,
1463 size_t key_buffer_size,
1464 uint8_t *data,
1465 size_t data_size,
1466 size_t *data_length)
Steven Cooremana01795d2020-07-24 22:48:15 +02001467{
Gilles Peskine449bd832023-01-11 14:50:10 +01001468 if (key_buffer_size > data_size) {
1469 return PSA_ERROR_BUFFER_TOO_SMALL;
1470 }
1471 memcpy(data, key_buffer, key_buffer_size);
1472 memset(data + key_buffer_size, 0,
1473 data_size - key_buffer_size);
Ronald Crond18b5f82020-11-25 16:46:05 +01001474 *data_length = key_buffer_size;
Gilles Peskine449bd832023-01-11 14:50:10 +01001475 return PSA_SUCCESS;
Steven Cooremana01795d2020-07-24 22:48:15 +02001476}
1477
Ronald Cron7285cda2020-11-26 14:46:37 +01001478psa_status_t psa_export_key_internal(
Ronald Crond18b5f82020-11-25 16:46:05 +01001479 const psa_key_attributes_t *attributes,
1480 const uint8_t *key_buffer, size_t key_buffer_size,
Gilles Peskine449bd832023-01-11 14:50:10 +01001481 uint8_t *data, size_t data_size, size_t *data_length)
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001482{
Gilles Peskine2f107ae2024-02-28 01:26:46 +01001483 psa_key_type_t type = attributes->type;
Ronald Crond18b5f82020-11-25 16:46:05 +01001484
Gilles Peskine449bd832023-01-11 14:50:10 +01001485 if (key_type_is_raw_bytes(type) ||
1486 PSA_KEY_TYPE_IS_RSA(type) ||
Przemek Stekiel472b3f32022-12-01 14:38:49 +01001487 PSA_KEY_TYPE_IS_ECC(type) ||
1488 PSA_KEY_TYPE_IS_DH(type)) {
Gilles Peskine449bd832023-01-11 14:50:10 +01001489 return psa_export_key_buffer_internal(
1490 key_buffer, key_buffer_size,
1491 data, data_size, data_length);
1492 } else {
Ronald Cron9486f9d2020-11-26 13:36:23 +01001493 /* This shouldn't happen in the reference implementation, but
1494 it is valid for a special-purpose implementation to omit
1495 support for exporting certain key types. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001496 return PSA_ERROR_NOT_SUPPORTED;
Ronald Cron9486f9d2020-11-26 13:36:23 +01001497 }
1498}
1499
Gilles Peskine449bd832023-01-11 14:50:10 +01001500psa_status_t psa_export_key(mbedtls_svc_key_id_t key,
Ryan Everett45ac5262024-01-08 17:15:19 +00001501 uint8_t *data_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01001502 size_t data_size,
1503 size_t *data_length)
Ronald Cron9486f9d2020-11-26 13:36:23 +01001504{
1505 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
1506 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
1507 psa_key_slot_t *slot;
Ryan Everett45ac5262024-01-08 17:15:19 +00001508 LOCAL_OUTPUT_DECLARE(data_external, data);
Ronald Cron9486f9d2020-11-26 13:36:23 +01001509
Ronald Crone907e552021-01-18 13:22:38 +01001510 /* Reject a zero-length output buffer now, since this can never be a
1511 * valid key representation. This way we know that data must be a valid
1512 * pointer and we can do things like memset(data, ..., data_size). */
Gilles Peskine449bd832023-01-11 14:50:10 +01001513 if (data_size == 0) {
1514 return PSA_ERROR_BUFFER_TOO_SMALL;
1515 }
Ronald Crone907e552021-01-18 13:22:38 +01001516
Ronald Cron9486f9d2020-11-26 13:36:23 +01001517 /* Set the key to empty now, so that even when there are errors, we always
1518 * set data_length to a value between 0 and data_size. On error, setting
1519 * the key to empty is a good choice because an empty key representation is
1520 * unlikely to be accepted anywhere. */
Jaeden Amerof24c7f82018-06-27 17:20:43 +01001521 *data_length = 0;
1522
Ronald Cron9486f9d2020-11-26 13:36:23 +01001523 /* Export requires the EXPORT flag. There is an exception for public keys,
1524 * which don't require any flag, but
1525 * psa_get_and_lock_key_slot_with_policy() takes care of this.
1526 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001527 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
1528 PSA_KEY_USAGE_EXPORT, 0);
1529 if (status != PSA_SUCCESS) {
1530 return status;
1531 }
mohammad160306e79202018-03-28 13:17:44 +03001532
Ryan Everett45ac5262024-01-08 17:15:19 +00001533 LOCAL_OUTPUT_ALLOC(data_external, data_size, data);
1534
Gilles Peskine7a5d9202024-02-28 01:18:23 +01001535 status = psa_driver_wrapper_export_key(&slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01001536 slot->key.data, slot->key.bytes,
1537 data, data_size, data_length);
Ronald Cron9486f9d2020-11-26 13:36:23 +01001538
David Horstmann4a48bec2024-03-13 15:42:31 +00001539#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
Ryan Everett45ac5262024-01-08 17:15:19 +00001540exit:
Ryan Everett35f68532024-01-25 12:02:03 +00001541#endif
Ryan Everetta103ec92024-01-31 13:59:57 +00001542 unlock_status = psa_unregister_read_under_mutex(slot);
Ronald Cron9486f9d2020-11-26 13:36:23 +01001543
Ryan Everett45ac5262024-01-08 17:15:19 +00001544 LOCAL_OUTPUT_FREE(data_external, data);
Gilles Peskine449bd832023-01-11 14:50:10 +01001545 return (status == PSA_SUCCESS) ? unlock_status : status;
Ronald Cron9486f9d2020-11-26 13:36:23 +01001546}
1547
Ronald Cron7285cda2020-11-26 14:46:37 +01001548psa_status_t psa_export_public_key_internal(
Ronald Crond18b5f82020-11-25 16:46:05 +01001549 const psa_key_attributes_t *attributes,
1550 const uint8_t *key_buffer,
1551 size_t key_buffer_size,
1552 uint8_t *data,
1553 size_t data_size,
Gilles Peskine449bd832023-01-11 14:50:10 +01001554 size_t *data_length)
Ronald Cron9486f9d2020-11-26 13:36:23 +01001555{
Gilles Peskine2f107ae2024-02-28 01:26:46 +01001556 psa_key_type_t type = attributes->type;
Ronald Crond18b5f82020-11-25 16:46:05 +01001557
Przemek Stekiel6fd72b62023-04-27 10:20:56 +02001558 if (PSA_KEY_TYPE_IS_PUBLIC_KEY(type) &&
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001559 (PSA_KEY_TYPE_IS_RSA(type) || PSA_KEY_TYPE_IS_ECC(type) ||
1560 PSA_KEY_TYPE_IS_DH(type))) {
Przemek Stekiel6fd72b62023-04-27 10:20:56 +02001561 /* Exporting public -> public */
1562 return psa_export_key_buffer_internal(
1563 key_buffer, key_buffer_size,
1564 data, data_size, data_length);
1565 } else if (PSA_KEY_TYPE_IS_RSA(type)) {
Valerio Settib2bcedb2023-07-10 11:24:00 +02001566#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT) || \
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001567 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
1568 return mbedtls_psa_rsa_export_public_key(attributes,
1569 key_buffer,
1570 key_buffer_size,
1571 data,
1572 data_size,
1573 data_length);
Darryl Green9e2d7a02018-07-24 16:33:30 +01001574#else
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001575 /* We don't know how to convert a private RSA key to public. */
1576 return PSA_ERROR_NOT_SUPPORTED;
Valerio Settib2bcedb2023-07-10 11:24:00 +02001577#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT) ||
John Durkop9814fa22020-11-04 12:28:15 -08001578 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Przemek Stekiel6fd72b62023-04-27 10:20:56 +02001579 } else if (PSA_KEY_TYPE_IS_ECC(type)) {
Valerio Setti27c501a2023-06-27 16:58:52 +02001580#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT) || \
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001581 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)
1582 return mbedtls_psa_ecp_export_public_key(attributes,
1583 key_buffer,
1584 key_buffer_size,
1585 data,
1586 data_size,
1587 data_length);
Steven Cooreman560c28a2020-07-24 23:20:24 +02001588#else
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001589 /* We don't know how to convert a private ECC key to public */
1590 return PSA_ERROR_NOT_SUPPORTED;
Valerio Setti27c501a2023-06-27 16:58:52 +02001591#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT) ||
John Durkop9814fa22020-11-04 12:28:15 -08001592 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
Przemek Stekiel6fd72b62023-04-27 10:20:56 +02001593 } else if (PSA_KEY_TYPE_IS_DH(type)) {
Valerio Settia55f0422023-07-10 15:34:41 +02001594#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_EXPORT) || \
Przemek Stekiel6d85afa2023-04-28 11:42:17 +02001595 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY)
Przemek Stekiel152bb462023-06-01 11:52:39 +02001596 return mbedtls_psa_ffdh_export_public_key(attributes,
Przemek Stekiel134cc2e2023-05-05 10:13:37 +02001597 key_buffer,
1598 key_buffer_size,
1599 data, data_size,
1600 data_length);
Przemek Stekiel472b3f32022-12-01 14:38:49 +01001601#else
Przemek Stekiel472b3f32022-12-01 14:38:49 +01001602 return PSA_ERROR_NOT_SUPPORTED;
Valerio Settia55f0422023-07-10 15:34:41 +02001603#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_EXPORT) ||
Przemek Stekiel6d85afa2023-04-28 11:42:17 +02001604 * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY) */
Gilles Peskine449bd832023-01-11 14:50:10 +01001605 } else {
Przemek Stekiel0b11ee02023-05-16 13:26:06 +02001606 (void) key_buffer;
1607 (void) key_buffer_size;
1608 (void) data;
1609 (void) data_size;
1610 (void) data_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01001611 return PSA_ERROR_NOT_SUPPORTED;
Steven Cooreman560c28a2020-07-24 23:20:24 +02001612 }
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01001613}
Ronald Crond18b5f82020-11-25 16:46:05 +01001614
Gilles Peskine449bd832023-01-11 14:50:10 +01001615psa_status_t psa_export_public_key(mbedtls_svc_key_id_t key,
Ryan Everettb1d2c672024-01-08 17:19:30 +00001616 uint8_t *data_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01001617 size_t data_size,
1618 size_t *data_length)
Moran Pekerdd4ea382018-04-03 15:30:03 +03001619{
Ronald Cronf95a2b12020-10-22 15:24:49 +02001620 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01001621 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01001622 psa_key_slot_t *slot;
Darryl Greendd8fb772018-11-07 16:00:44 +00001623
Ryan Everettb1d2c672024-01-08 17:19:30 +00001624 LOCAL_OUTPUT_DECLARE(data_external, data);
Darryl Greendd8fb772018-11-07 16:00:44 +00001625
Ronald Crone907e552021-01-18 13:22:38 +01001626 /* Reject a zero-length output buffer now, since this can never be a
1627 * valid key representation. This way we know that data must be a valid
1628 * pointer and we can do things like memset(data, ..., data_size). */
Gilles Peskine449bd832023-01-11 14:50:10 +01001629 if (data_size == 0) {
1630 return PSA_ERROR_BUFFER_TOO_SMALL;
1631 }
Ronald Crone907e552021-01-18 13:22:38 +01001632
Darryl Greendd8fb772018-11-07 16:00:44 +00001633 /* Set the key to empty now, so that even when there are errors, we always
1634 * set data_length to a value between 0 and data_size. On error, setting
1635 * the key to empty is a good choice because an empty key representation is
1636 * unlikely to be accepted anywhere. */
1637 *data_length = 0;
1638
1639 /* Exporting a public key doesn't require a usage flag. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001640 status = psa_get_and_lock_key_slot_with_policy(key, &slot, 0, 0);
1641 if (status != PSA_SUCCESS) {
1642 return status;
1643 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02001644
Ryan Everettb1d2c672024-01-08 17:19:30 +00001645 LOCAL_OUTPUT_ALLOC(data_external, data_size, data);
1646
Gilles Peskine449bd832023-01-11 14:50:10 +01001647 if (!PSA_KEY_TYPE_IS_ASYMMETRIC(slot->attr.type)) {
1648 status = PSA_ERROR_INVALID_ARGUMENT;
1649 goto exit;
Ronald Cron9486f9d2020-11-26 13:36:23 +01001650 }
1651
Ronald Cron67227982020-11-26 15:16:05 +01001652 status = psa_driver_wrapper_export_public_key(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01001653 &slot->attr, slot->key.data, slot->key.bytes,
Gilles Peskine449bd832023-01-11 14:50:10 +01001654 data, data_size, data_length);
Ronald Cron9486f9d2020-11-26 13:36:23 +01001655
1656exit:
Ryan Everetta103ec92024-01-31 13:59:57 +00001657 unlock_status = psa_unregister_read_under_mutex(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02001658
Ryan Everettb1d2c672024-01-08 17:19:30 +00001659 LOCAL_OUTPUT_FREE(data_external, data);
Gilles Peskine449bd832023-01-11 14:50:10 +01001660 return (status == PSA_SUCCESS) ? unlock_status : status;
Moran Pekerdd4ea382018-04-03 15:30:03 +03001661}
1662
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001663/** Validate that a key policy is internally well-formed.
1664 *
1665 * This function only rejects invalid policies. It does not validate the
1666 * consistency of the policy with respect to other attributes of the key
1667 * such as the key type.
1668 */
Gilles Peskine449bd832023-01-11 14:50:10 +01001669static psa_status_t psa_validate_key_policy(const psa_key_policy_t *policy)
Gilles Peskine4747d192019-04-17 15:05:45 +02001670{
Gilles Peskine449bd832023-01-11 14:50:10 +01001671 if ((policy->usage & ~(PSA_KEY_USAGE_EXPORT |
1672 PSA_KEY_USAGE_COPY |
1673 PSA_KEY_USAGE_ENCRYPT |
1674 PSA_KEY_USAGE_DECRYPT |
1675 PSA_KEY_USAGE_SIGN_MESSAGE |
1676 PSA_KEY_USAGE_VERIFY_MESSAGE |
1677 PSA_KEY_USAGE_SIGN_HASH |
1678 PSA_KEY_USAGE_VERIFY_HASH |
1679 PSA_KEY_USAGE_VERIFY_DERIVATION |
1680 PSA_KEY_USAGE_DERIVE)) != 0) {
1681 return PSA_ERROR_INVALID_ARGUMENT;
1682 }
Gilles Peskine4747d192019-04-17 15:05:45 +02001683
Gilles Peskine449bd832023-01-11 14:50:10 +01001684 return PSA_SUCCESS;
Gilles Peskine4747d192019-04-17 15:05:45 +02001685}
1686
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001687/** Validate the internal consistency of key attributes.
1688 *
1689 * This function only rejects invalid attribute values. If does not
1690 * validate the consistency of the attributes with any key data that may
1691 * be involved in the creation of the key.
1692 *
1693 * Call this function early in the key creation process.
1694 *
1695 * \param[in] attributes Key attributes for the new key.
1696 * \param[out] p_drv On any return, the driver for the key, if any.
1697 * NULL for a transparent key.
1698 *
1699 */
1700static psa_status_t psa_validate_key_attributes(
1701 const psa_key_attributes_t *attributes,
Gilles Peskine449bd832023-01-11 14:50:10 +01001702 psa_se_drv_table_entry_t **p_drv)
Darryl Green0c6575a2018-11-07 16:05:30 +00001703{
Steven Cooreman81fe7c32020-06-08 18:37:19 +02001704 psa_status_t status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine449bd832023-01-11 14:50:10 +01001705 psa_key_lifetime_t lifetime = psa_get_key_lifetime(attributes);
1706 mbedtls_svc_key_id_t key = psa_get_key_id(attributes);
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001707
Gilles Peskine449bd832023-01-11 14:50:10 +01001708 status = psa_validate_key_location(lifetime, p_drv);
1709 if (status != PSA_SUCCESS) {
1710 return status;
Ronald Crond2ed4812020-07-17 16:11:30 +02001711 }
1712
Gilles Peskine449bd832023-01-11 14:50:10 +01001713 status = psa_validate_key_persistence(lifetime);
1714 if (status != PSA_SUCCESS) {
1715 return status;
1716 }
1717
1718 if (PSA_KEY_LIFETIME_IS_VOLATILE(lifetime)) {
1719 if (MBEDTLS_SVC_KEY_ID_GET_KEY_ID(key) != 0) {
1720 return PSA_ERROR_INVALID_ARGUMENT;
1721 }
1722 } else {
1723 if (!psa_is_valid_key_id(psa_get_key_id(attributes), 0)) {
1724 return PSA_ERROR_INVALID_ARGUMENT;
1725 }
1726 }
1727
Gilles Peskine2f107ae2024-02-28 01:26:46 +01001728 status = psa_validate_key_policy(&attributes->policy);
Gilles Peskine449bd832023-01-11 14:50:10 +01001729 if (status != PSA_SUCCESS) {
1730 return status;
1731 }
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001732
1733 /* Refuse to create overly large keys.
1734 * Note that this doesn't trigger on import if the attributes don't
1735 * explicitly specify a size (so psa_get_key_bits returns 0), so
1736 * psa_import_key() needs its own checks. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001737 if (psa_get_key_bits(attributes) > PSA_MAX_KEY_BITS) {
1738 return PSA_ERROR_NOT_SUPPORTED;
1739 }
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001740
Gilles Peskine449bd832023-01-11 14:50:10 +01001741 return PSA_SUCCESS;
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001742}
1743
Gilles Peskine4747d192019-04-17 15:05:45 +02001744/** Prepare a key slot to receive key material.
1745 *
1746 * This function allocates a key slot and sets its metadata.
1747 *
1748 * If this function fails, call psa_fail_key_creation().
1749 *
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001750 * This function is intended to be used as follows:
1751 * -# Call psa_start_key_creation() to allocate a key slot, prepare
Ronald Croncf56a0a2020-08-04 09:51:30 +02001752 * it with the specified attributes, and in case of a volatile key assign it
1753 * a volatile key identifier.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001754 * -# Populate the slot with the key material.
1755 * -# Call psa_finish_key_creation() to finalize the creation of the slot.
1756 * In case of failure at any step, stop the sequence and call
1757 * psa_fail_key_creation().
1758 *
Ryan Everettb69118e2024-01-02 15:54:32 +00001759 * On success, the key slot's state is PSA_SLOT_FILLING.
1760 * It is the responsibility of the caller to change the slot's state to
1761 * PSA_SLOT_EMPTY/FULL once key creation has finished.
Ronald Cronf95a2b12020-10-22 15:24:49 +02001762 *
Gilles Peskinedf179142019-07-15 22:02:14 +02001763 * \param method An identification of the calling function.
Gilles Peskine011e4282019-06-26 18:34:38 +02001764 * \param[in] attributes Key attributes for the new key.
Gilles Peskine011e4282019-06-26 18:34:38 +02001765 * \param[out] p_slot On success, a pointer to the prepared slot.
1766 * \param[out] p_drv On any return, the driver for the key, if any.
1767 * NULL for a transparent key.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001768 *
1769 * \retval #PSA_SUCCESS
1770 * The key slot is ready to receive key material.
1771 * \return If this function fails, the key slot is an invalid state.
1772 * You must call psa_fail_key_creation() to wipe and free the slot.
Gilles Peskine4747d192019-04-17 15:05:45 +02001773 */
1774static psa_status_t psa_start_key_creation(
Gilles Peskinedf179142019-07-15 22:02:14 +02001775 psa_key_creation_method_t method,
Gilles Peskine4747d192019-04-17 15:05:45 +02001776 const psa_key_attributes_t *attributes,
Gilles Peskine011e4282019-06-26 18:34:38 +02001777 psa_key_slot_t **p_slot,
Gilles Peskine449bd832023-01-11 14:50:10 +01001778 psa_se_drv_table_entry_t **p_drv)
Gilles Peskine4747d192019-04-17 15:05:45 +02001779{
1780 psa_status_t status;
Gilles Peskine4747d192019-04-17 15:05:45 +02001781
Gilles Peskinedf179142019-07-15 22:02:14 +02001782 (void) method;
Gilles Peskine011e4282019-06-26 18:34:38 +02001783 *p_drv = NULL;
1784
Gilles Peskine449bd832023-01-11 14:50:10 +01001785 status = psa_validate_key_attributes(attributes, p_drv);
1786 if (status != PSA_SUCCESS) {
1787 return status;
1788 }
Gilles Peskine1b8594a2019-07-31 17:21:46 +02001789
Gilles Peskinee8199f52024-06-10 11:53:33 +02001790 int key_is_volatile = PSA_KEY_LIFETIME_IS_VOLATILE(attributes->lifetime);
1791 psa_key_id_t volatile_key_id;
1792
Ryan Everett3d8118d2024-01-30 16:58:47 +00001793#if defined(MBEDTLS_THREADING_C)
1794 PSA_THREADING_CHK_RET(mbedtls_mutex_lock(
1795 &mbedtls_threading_key_slot_mutex));
1796#endif
Gilles Peskinee8199f52024-06-10 11:53:33 +02001797 status = psa_reserve_free_key_slot(
1798 key_is_volatile ? &volatile_key_id : NULL,
1799 p_slot);
Ryan Everett3d8118d2024-01-30 16:58:47 +00001800#if defined(MBEDTLS_THREADING_C)
1801 PSA_THREADING_CHK_RET(mbedtls_mutex_unlock(
1802 &mbedtls_threading_key_slot_mutex));
1803#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01001804 if (status != PSA_SUCCESS) {
1805 return status;
1806 }
Gilles Peskinee8199f52024-06-10 11:53:33 +02001807 psa_key_slot_t *slot = *p_slot;
Gilles Peskine4747d192019-04-17 15:05:45 +02001808
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001809 /* We're storing the declared bit-size of the key. It's up to each
1810 * creation mechanism to verify that this information is correct.
1811 * It's automatically correct for mechanisms that use the bit-size as
Gilles Peskineb46bef22019-07-30 21:32:04 +02001812 * an input (generate, device) but not for those where the bit-size
Ronald Cronc4d1b512020-07-31 11:26:37 +02001813 * is optional (import, copy). In case of a volatile key, assign it the
1814 * volatile key identifier associated to the slot returned to contain its
1815 * definition. */
Gilles Peskine76aa09c2019-07-31 14:15:34 +02001816
Gilles Peskine7fad3ef2024-02-28 01:08:27 +01001817 slot->attr = *attributes;
Gilles Peskinee8199f52024-06-10 11:53:33 +02001818 if (key_is_volatile) {
Ronald Cronc4d1b512020-07-31 11:26:37 +02001819#if !defined(MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER)
1820 slot->attr.id = volatile_key_id;
1821#else
1822 slot->attr.id.key_id = volatile_key_id;
1823#endif
1824 }
Gilles Peskinec744d992019-07-30 17:26:54 +02001825
Gilles Peskinecbaff462019-07-12 23:46:04 +02001826#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined7729582019-08-05 15:55:54 +02001827 /* For a key in a secure element, we need to do three things
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001828 * when creating or registering a persistent key:
Gilles Peskine60450a42019-07-25 11:32:45 +02001829 * create the key file in internal storage, create the
1830 * key inside the secure element, and update the driver's
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001831 * persistent data. This is done by starting a transaction that will
1832 * encompass these three actions.
1833 * For registering a volatile key, we just need to find an appropriate
1834 * slot number inside the SE. Since the key is designated volatile, creating
1835 * a transaction is not required. */
Gilles Peskine60450a42019-07-25 11:32:45 +02001836 /* The first thing to do is to find a slot number for the new key.
1837 * We save the slot number in persistent storage as part of the
1838 * transaction data. It will be needed to recover if the power
1839 * fails during the key creation process, to clean up on the secure
1840 * element side after restarting. Obtaining a slot number from the
1841 * secure element driver updates its persistent state, but we do not yet
1842 * save the driver's persistent state, so that if the power fails,
Gilles Peskinefc762652019-07-22 19:30:34 +02001843 * we can roll back to a state where the key doesn't exist. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001844 if (*p_drv != NULL) {
Ronald Cronea0f8a62020-11-25 17:52:23 +01001845 psa_key_slot_number_t slot_number;
Gilles Peskine449bd832023-01-11 14:50:10 +01001846 status = psa_find_se_slot_for_key(attributes, method, *p_drv,
1847 &slot_number);
1848 if (status != PSA_SUCCESS) {
1849 return status;
1850 }
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001851
Gilles Peskine2f107ae2024-02-28 01:26:46 +01001852 if (!PSA_KEY_LIFETIME_IS_VOLATILE(attributes->lifetime)) {
Gilles Peskine449bd832023-01-11 14:50:10 +01001853 psa_crypto_prepare_transaction(PSA_CRYPTO_TRANSACTION_CREATE_KEY);
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001854 psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
Ronald Cronea0f8a62020-11-25 17:52:23 +01001855 psa_crypto_transaction.key.slot = slot_number;
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001856 psa_crypto_transaction.key.id = slot->attr.id;
Gilles Peskine449bd832023-01-11 14:50:10 +01001857 status = psa_crypto_save_transaction();
1858 if (status != PSA_SUCCESS) {
1859 (void) psa_crypto_stop_transaction();
1860 return status;
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001861 }
Gilles Peskine66be51c2019-07-25 18:02:52 +02001862 }
Ronald Cronea0f8a62020-11-25 17:52:23 +01001863
1864 status = psa_copy_key_material_into_slot(
Gilles Peskine449bd832023-01-11 14:50:10 +01001865 slot, (uint8_t *) (&slot_number), sizeof(slot_number));
Ryan Everettb5a20d32023-11-15 16:26:01 +00001866 if (status != PSA_SUCCESS) {
1867 return status;
1868 }
Darryl Green0c6575a2018-11-07 16:05:30 +00001869 }
Gilles Peskine3efcebb2019-10-01 14:18:35 +02001870
Gilles Peskine449bd832023-01-11 14:50:10 +01001871 if (*p_drv == NULL && method == PSA_KEY_CREATION_REGISTER) {
Gilles Peskine3efcebb2019-10-01 14:18:35 +02001872 /* Key registration only makes sense with a secure element. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001873 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine3efcebb2019-10-01 14:18:35 +02001874 }
Gilles Peskinecbaff462019-07-12 23:46:04 +02001875#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1876
Gilles Peskine449bd832023-01-11 14:50:10 +01001877 return PSA_SUCCESS;
Darryl Green0c6575a2018-11-07 16:05:30 +00001878}
Gilles Peskine4747d192019-04-17 15:05:45 +02001879
1880/** Finalize the creation of a key once its key material has been set.
1881 *
1882 * This entails writing the key to persistent storage.
1883 *
1884 * If this function fails, call psa_fail_key_creation().
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001885 * See the documentation of psa_start_key_creation() for the intended use
1886 * of this function.
Gilles Peskine4747d192019-04-17 15:05:45 +02001887 *
Ryan Everettb69118e2024-01-02 15:54:32 +00001888 * If the finalization succeeds, the function sets the key slot's state to
1889 * PSA_SLOT_FULL, and the key slot can no longer be accessed as part of the
1890 * key creation process.
Ronald Cron50972942020-11-14 11:28:25 +01001891 *
Gilles Peskine011e4282019-06-26 18:34:38 +02001892 * \param[in,out] slot Pointer to the slot with key material.
1893 * \param[in] driver The secure element driver for the key,
1894 * or NULL for a transparent key.
Ronald Cron81709fc2020-11-14 12:10:32 +01001895 * \param[out] key On success, identifier of the key. Note that the
1896 * key identifier is also stored in the key slot.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001897 *
1898 * \retval #PSA_SUCCESS
Ronald Croncf56a0a2020-08-04 09:51:30 +02001899 * The key was successfully created.
Gilles Peskineed733552023-02-14 19:21:09 +01001900 * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription
1901 * \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription
1902 * \retval #PSA_ERROR_ALREADY_EXISTS \emptydescription
1903 * \retval #PSA_ERROR_DATA_INVALID \emptydescription
1904 * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription
1905 * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription
gabor-mezei-arm452b0a32020-11-09 17:42:55 +01001906 *
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001907 * \return If this function fails, the key slot is an invalid state.
1908 * You must call psa_fail_key_creation() to wipe and free the slot.
Gilles Peskine4747d192019-04-17 15:05:45 +02001909 */
Gilles Peskine011e4282019-06-26 18:34:38 +02001910static psa_status_t psa_finish_key_creation(
1911 psa_key_slot_t *slot,
Ronald Cron81709fc2020-11-14 12:10:32 +01001912 psa_se_drv_table_entry_t *driver,
1913 mbedtls_svc_key_id_t *key)
Gilles Peskine4747d192019-04-17 15:05:45 +02001914{
1915 psa_status_t status = PSA_SUCCESS;
Gilles Peskine30afafd2019-04-25 13:47:40 +02001916 (void) slot;
Gilles Peskine011e4282019-06-26 18:34:38 +02001917 (void) driver;
Gilles Peskine4747d192019-04-17 15:05:45 +02001918
Ryan Everett91ffe5b2024-01-23 20:05:42 +00001919#if defined(MBEDTLS_THREADING_C)
1920 PSA_THREADING_CHK_RET(mbedtls_mutex_lock(
1921 &mbedtls_threading_key_slot_mutex));
1922#endif
1923
Gilles Peskine4747d192019-04-17 15:05:45 +02001924#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001925 if (!PSA_KEY_LIFETIME_IS_VOLATILE(slot->attr.lifetime)) {
Gilles Peskine1df83d42019-07-23 16:13:14 +02001926#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01001927 if (driver != NULL) {
Gilles Peskineb46bef22019-07-30 21:32:04 +02001928 psa_se_key_data_storage_t data;
Ronald Cronea0f8a62020-11-25 17:52:23 +01001929 psa_key_slot_number_t slot_number =
Gilles Peskine449bd832023-01-11 14:50:10 +01001930 psa_key_slot_get_slot_number(slot);
Ronald Cronea0f8a62020-11-25 17:52:23 +01001931
Tom Cosgrove6ef9bb32023-03-08 14:19:51 +00001932 MBEDTLS_STATIC_ASSERT(sizeof(slot_number) ==
1933 sizeof(data.slot_number),
1934 "Slot number size does not match psa_se_key_data_storage_t");
1935
Gilles Peskine449bd832023-01-11 14:50:10 +01001936 memcpy(&data.slot_number, &slot_number, sizeof(slot_number));
1937 status = psa_save_persistent_key(&slot->attr,
1938 (uint8_t *) &data,
1939 sizeof(data));
1940 } else
Gilles Peskine1df83d42019-07-23 16:13:14 +02001941#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1942 {
Steven Cooreman40120f62020-10-29 11:42:22 +01001943 /* Key material is saved in export representation in the slot, so
1944 * just pass the slot buffer for storage. */
Gilles Peskine449bd832023-01-11 14:50:10 +01001945 status = psa_save_persistent_key(&slot->attr,
1946 slot->key.data,
1947 slot->key.bytes);
Gilles Peskine1df83d42019-07-23 16:13:14 +02001948 }
Gilles Peskine4747d192019-04-17 15:05:45 +02001949 }
Darryl Green0c6575a2018-11-07 16:05:30 +00001950#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
1951
Gilles Peskinecbaff462019-07-12 23:46:04 +02001952#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskined7729582019-08-05 15:55:54 +02001953 /* Finish the transaction for a key creation. This does not
1954 * happen when registering an existing key. Detect this case
1955 * by checking whether a transaction is in progress (actual
Steven Cooremanbbeaf182020-06-08 18:29:44 +02001956 * creation of a persistent key in a secure element requires a transaction,
1957 * but registration or volatile key creation doesn't use one). */
Gilles Peskine449bd832023-01-11 14:50:10 +01001958 if (driver != NULL &&
1959 psa_crypto_transaction.unknown.type == PSA_CRYPTO_TRANSACTION_CREATE_KEY) {
1960 status = psa_save_se_persistent_data(driver);
1961 if (status != PSA_SUCCESS) {
1962 psa_destroy_persistent_key(slot->attr.id);
Ryan Everett91ffe5b2024-01-23 20:05:42 +00001963
1964#if defined(MBEDTLS_THREADING_C)
1965 PSA_THREADING_CHK_RET(mbedtls_mutex_unlock(
1966 &mbedtls_threading_key_slot_mutex));
1967#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01001968 return status;
Gilles Peskinecbaff462019-07-12 23:46:04 +02001969 }
Gilles Peskine449bd832023-01-11 14:50:10 +01001970 status = psa_crypto_stop_transaction();
Gilles Peskinecbaff462019-07-12 23:46:04 +02001971 }
1972#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1973
Gilles Peskine449bd832023-01-11 14:50:10 +01001974 if (status == PSA_SUCCESS) {
Ronald Cron81709fc2020-11-14 12:10:32 +01001975 *key = slot->attr.id;
Ryan Everettb69118e2024-01-02 15:54:32 +00001976 status = psa_key_slot_state_transition(slot, PSA_SLOT_FILLING,
1977 PSA_SLOT_FULL);
Gilles Peskine449bd832023-01-11 14:50:10 +01001978 if (status != PSA_SUCCESS) {
Ronald Cron81709fc2020-11-14 12:10:32 +01001979 *key = MBEDTLS_SVC_KEY_ID_INIT;
Gilles Peskine449bd832023-01-11 14:50:10 +01001980 }
Ronald Cron81709fc2020-11-14 12:10:32 +01001981 }
Ronald Cron50972942020-11-14 11:28:25 +01001982
Ryan Everett91ffe5b2024-01-23 20:05:42 +00001983#if defined(MBEDTLS_THREADING_C)
1984 PSA_THREADING_CHK_RET(mbedtls_mutex_unlock(
1985 &mbedtls_threading_key_slot_mutex));
1986#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01001987 return status;
Gilles Peskine4747d192019-04-17 15:05:45 +02001988}
1989
1990/** Abort the creation of a key.
1991 *
1992 * You may call this function after calling psa_start_key_creation(),
1993 * or after psa_finish_key_creation() fails. In other circumstances, this
1994 * function may not clean up persistent storage.
Gilles Peskine9bc88c62019-04-28 11:37:03 +02001995 * See the documentation of psa_start_key_creation() for the intended use
Ryan Everettb69118e2024-01-02 15:54:32 +00001996 * of this function. Sets the slot's state to PSA_SLOT_EMPTY.
Gilles Peskine4747d192019-04-17 15:05:45 +02001997 *
Gilles Peskine011e4282019-06-26 18:34:38 +02001998 * \param[in,out] slot Pointer to the slot with key material.
1999 * \param[in] driver The secure element driver for the key,
2000 * or NULL for a transparent key.
Gilles Peskine4747d192019-04-17 15:05:45 +02002001 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002002static void psa_fail_key_creation(psa_key_slot_t *slot,
2003 psa_se_drv_table_entry_t *driver)
Gilles Peskine4747d192019-04-17 15:05:45 +02002004{
Gilles Peskine011e4282019-06-26 18:34:38 +02002005 (void) driver;
2006
Gilles Peskine449bd832023-01-11 14:50:10 +01002007 if (slot == NULL) {
Gilles Peskine4747d192019-04-17 15:05:45 +02002008 return;
Gilles Peskine449bd832023-01-11 14:50:10 +01002009 }
Gilles Peskine011e4282019-06-26 18:34:38 +02002010
Ryan Everettb7101442024-01-23 20:09:49 +00002011#if defined(MBEDTLS_THREADING_C)
Ryan Everett73feaf22024-02-14 11:36:41 +00002012 /* If the lock operation fails we still wipe the slot.
2013 * Operations will no longer work after a failed lock,
2014 * but we still need to wipe the slot of confidential data. */
Ryan Everettb7101442024-01-23 20:09:49 +00002015 mbedtls_mutex_lock(&mbedtls_threading_key_slot_mutex);
2016#endif
2017
Gilles Peskine011e4282019-06-26 18:34:38 +02002018#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Janos Follath1d57a202019-08-13 12:15:34 +01002019 /* TODO: If the key has already been created in the secure
Gilles Peskine011e4282019-06-26 18:34:38 +02002020 * element, and the failure happened later (when saving metadata
2021 * to internal storage), we need to destroy the key in the secure
Gilles Peskinec9d7f942019-08-13 16:17:16 +02002022 * element.
2023 * https://github.com/ARMmbed/mbed-crypto/issues/217
2024 */
Gilles Peskinefc762652019-07-22 19:30:34 +02002025
Gilles Peskined7729582019-08-05 15:55:54 +02002026 /* Abort the ongoing transaction if any (there may not be one if
2027 * the creation process failed before starting one, or if the
2028 * key creation is a registration of a key in a secure element).
2029 * Earlier functions must already have done what it takes to undo any
2030 * partial creation. All that's left is to update the transaction data
2031 * itself. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002032 (void) psa_crypto_stop_transaction();
Gilles Peskine011e4282019-06-26 18:34:38 +02002033#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
2034
Gilles Peskine449bd832023-01-11 14:50:10 +01002035 psa_wipe_key_slot(slot);
Ryan Everettb7101442024-01-23 20:09:49 +00002036
2037#if defined(MBEDTLS_THREADING_C)
2038 mbedtls_mutex_unlock(&mbedtls_threading_key_slot_mutex);
2039#endif
Gilles Peskine4747d192019-04-17 15:05:45 +02002040}
2041
Gilles Peskine1b8594a2019-07-31 17:21:46 +02002042/** Validate optional attributes during key creation.
2043 *
2044 * Some key attributes are optional during key creation. If they are
2045 * specified in the attributes structure, check that they are consistent
2046 * with the data in the slot.
2047 *
2048 * This function should be called near the end of key creation, after
2049 * the slot in memory is fully populated but before saving persistent data.
2050 */
2051static psa_status_t psa_validate_optional_attributes(
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002052 const psa_key_slot_t *slot,
Gilles Peskine449bd832023-01-11 14:50:10 +01002053 const psa_key_attributes_t *attributes)
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002054{
Gilles Peskine2f107ae2024-02-28 01:26:46 +01002055 if (attributes->type != 0) {
2056 if (attributes->type != slot->attr.type) {
Gilles Peskine449bd832023-01-11 14:50:10 +01002057 return PSA_ERROR_INVALID_ARGUMENT;
2058 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002059 }
2060
Gilles Peskine2f107ae2024-02-28 01:26:46 +01002061 if (attributes->bits != 0) {
2062 if (attributes->bits != slot->attr.bits) {
Gilles Peskine449bd832023-01-11 14:50:10 +01002063 return PSA_ERROR_INVALID_ARGUMENT;
2064 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002065 }
2066
Gilles Peskine449bd832023-01-11 14:50:10 +01002067 return PSA_SUCCESS;
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002068}
2069
Gilles Peskine449bd832023-01-11 14:50:10 +01002070psa_status_t psa_import_key(const psa_key_attributes_t *attributes,
Ryan Everettf028fe12024-01-08 17:14:44 +00002071 const uint8_t *data_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01002072 size_t data_length,
2073 mbedtls_svc_key_id_t *key)
Gilles Peskine4747d192019-04-17 15:05:45 +02002074{
2075 psa_status_t status;
Ryan Everettf028fe12024-01-08 17:14:44 +00002076 LOCAL_INPUT_DECLARE(data_external, data);
Gilles Peskine4747d192019-04-17 15:05:45 +02002077 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02002078 psa_se_drv_table_entry_t *driver = NULL;
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01002079 size_t bits;
Archanad8a83dc2021-06-14 10:04:16 +05302080 size_t storage_size = data_length;
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002081
Ronald Cron81709fc2020-11-14 12:10:32 +01002082 *key = MBEDTLS_SVC_KEY_ID_INIT;
2083
Gilles Peskine0f84d622019-09-12 19:03:13 +02002084 /* Reject zero-length symmetric keys (including raw data key objects).
2085 * This also rejects any key which might be encoded as an empty string,
2086 * which is never valid. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002087 if (data_length == 0) {
2088 return PSA_ERROR_INVALID_ARGUMENT;
2089 }
Gilles Peskine0f84d622019-09-12 19:03:13 +02002090
Archana449608b2021-09-08 15:36:05 +05302091 /* Ensure that the bytes-to-bits conversion cannot overflow. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002092 if (data_length > SIZE_MAX / 8) {
2093 return PSA_ERROR_NOT_SUPPORTED;
2094 }
Archana6ed4bda2021-08-04 10:47:15 +05302095
Ryan Everettf028fe12024-01-08 17:14:44 +00002096 LOCAL_INPUT_ALLOC(data_external, data_length, data);
2097
Gilles Peskine449bd832023-01-11 14:50:10 +01002098 status = psa_start_key_creation(PSA_KEY_CREATION_IMPORT, attributes,
2099 &slot, &driver);
2100 if (status != PSA_SUCCESS) {
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002101 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002102 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002103
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01002104 /* In the case of a transparent key or an opaque key stored in local
Archana449608b2021-09-08 15:36:05 +05302105 * storage ( thus not in the case of importing a key in a secure element
2106 * with storage ( MBEDTLS_PSA_CRYPTO_SE_C ) ),we have to allocate a
2107 * buffer to hold the imported key material. */
Valerio Setti70fa89c2024-08-14 05:12:45 +02002108 if (slot->key.bytes == 0) {
Gilles Peskine2f107ae2024-02-28 01:26:46 +01002109 if (psa_key_lifetime_is_external(attributes->lifetime)) {
Archana449608b2021-09-08 15:36:05 +05302110 status = psa_driver_wrapper_get_key_buffer_size_from_key_data(
Gilles Peskine449bd832023-01-11 14:50:10 +01002111 attributes, data, data_length, &storage_size);
2112 if (status != PSA_SUCCESS) {
Archanad8a83dc2021-06-14 10:04:16 +05302113 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002114 }
Archanad8a83dc2021-06-14 10:04:16 +05302115 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002116 status = psa_allocate_buffer_to_slot(slot, storage_size);
2117 if (status != PSA_SUCCESS) {
Gilles Peskineb46bef22019-07-30 21:32:04 +02002118 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002119 }
Gilles Peskine5d309672019-07-12 23:47:28 +02002120 }
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01002121
2122 bits = slot->attr.bits;
Gilles Peskine449bd832023-01-11 14:50:10 +01002123 status = psa_driver_wrapper_import_key(attributes,
2124 data, data_length,
2125 slot->key.data,
2126 slot->key.bytes,
2127 &slot->key.bytes, &bits);
2128 if (status != PSA_SUCCESS) {
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01002129 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002130 }
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01002131
Gilles Peskine449bd832023-01-11 14:50:10 +01002132 if (slot->attr.bits == 0) {
Ronald Cronfb2ed5b2020-11-30 12:11:01 +01002133 slot->attr.bits = (psa_key_bits_t) bits;
Gilles Peskine449bd832023-01-11 14:50:10 +01002134 } else if (bits != slot->attr.bits) {
Steven Cooremanac3434f2021-01-15 17:36:02 +01002135 status = PSA_ERROR_INVALID_ARGUMENT;
2136 goto exit;
Gilles Peskine5d309672019-07-12 23:47:28 +02002137 }
Ronald Cron2ebfdcc2020-11-28 15:54:54 +01002138
Archana6ed4bda2021-08-04 10:47:15 +05302139 /* Enforce a size limit, and in particular ensure that the bit
2140 * size fits in its representation type.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01002141 if (bits > PSA_MAX_KEY_BITS) {
Archana6ed4bda2021-08-04 10:47:15 +05302142 status = PSA_ERROR_NOT_SUPPORTED;
2143 goto exit;
2144 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002145 status = psa_validate_optional_attributes(slot, attributes);
2146 if (status != PSA_SUCCESS) {
Gilles Peskine18017402019-07-24 20:25:59 +02002147 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002148 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002149
Gilles Peskine449bd832023-01-11 14:50:10 +01002150 status = psa_finish_key_creation(slot, driver, key);
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002151exit:
Ryan Everettf028fe12024-01-08 17:14:44 +00002152 LOCAL_INPUT_FREE(data_external, data);
Gilles Peskine449bd832023-01-11 14:50:10 +01002153 if (status != PSA_SUCCESS) {
2154 psa_fail_key_creation(slot, driver);
2155 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02002156
Gilles Peskine449bd832023-01-11 14:50:10 +01002157 return status;
Gilles Peskine4747d192019-04-17 15:05:45 +02002158}
2159
Gilles Peskined7729582019-08-05 15:55:54 +02002160#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
2161psa_status_t mbedtls_psa_register_se_key(
Gilles Peskine449bd832023-01-11 14:50:10 +01002162 const psa_key_attributes_t *attributes)
Gilles Peskined7729582019-08-05 15:55:54 +02002163{
2164 psa_status_t status;
2165 psa_key_slot_t *slot = NULL;
2166 psa_se_drv_table_entry_t *driver = NULL;
Ronald Croncf56a0a2020-08-04 09:51:30 +02002167 mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT;
Gilles Peskined7729582019-08-05 15:55:54 +02002168
2169 /* Leaving attributes unspecified is not currently supported.
2170 * It could make sense to query the key type and size from the
2171 * secure element, but not all secure elements support this
2172 * and the driver HAL doesn't currently support it. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002173 if (psa_get_key_type(attributes) == PSA_KEY_TYPE_NONE) {
2174 return PSA_ERROR_NOT_SUPPORTED;
2175 }
2176 if (psa_get_key_bits(attributes) == 0) {
2177 return PSA_ERROR_NOT_SUPPORTED;
2178 }
Gilles Peskined7729582019-08-05 15:55:54 +02002179
Gilles Peskined72ad732024-06-13 16:06:45 +02002180 /* Not usable with volatile keys, even with an appropriate location,
2181 * due to the API design.
2182 * https://github.com/Mbed-TLS/mbedtls/issues/9253
2183 */
2184 if (PSA_KEY_LIFETIME_IS_VOLATILE(psa_get_key_lifetime(attributes))) {
2185 return PSA_ERROR_INVALID_ARGUMENT;
2186 }
2187
Gilles Peskine449bd832023-01-11 14:50:10 +01002188 status = psa_start_key_creation(PSA_KEY_CREATION_REGISTER, attributes,
2189 &slot, &driver);
2190 if (status != PSA_SUCCESS) {
Gilles Peskined7729582019-08-05 15:55:54 +02002191 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002192 }
Gilles Peskined7729582019-08-05 15:55:54 +02002193
Gilles Peskine449bd832023-01-11 14:50:10 +01002194 status = psa_finish_key_creation(slot, driver, &key);
Gilles Peskined7729582019-08-05 15:55:54 +02002195
2196exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002197 if (status != PSA_SUCCESS) {
2198 psa_fail_key_creation(slot, driver);
2199 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02002200
Gilles Peskined7729582019-08-05 15:55:54 +02002201 /* Registration doesn't keep the key in RAM. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002202 psa_close_key(key);
2203 return status;
Gilles Peskined7729582019-08-05 15:55:54 +02002204}
2205#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
2206
Gilles Peskine449bd832023-01-11 14:50:10 +01002207psa_status_t psa_copy_key(mbedtls_svc_key_id_t source_key,
2208 const psa_key_attributes_t *specified_attributes,
2209 mbedtls_svc_key_id_t *target_key)
Gilles Peskinef603c712019-01-19 13:40:11 +01002210{
Ronald Cronf95a2b12020-10-22 15:24:49 +02002211 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01002212 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskinef603c712019-01-19 13:40:11 +01002213 psa_key_slot_t *source_slot = NULL;
2214 psa_key_slot_t *target_slot = NULL;
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002215 psa_key_attributes_t actual_attributes = *specified_attributes;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02002216 psa_se_drv_table_entry_t *driver = NULL;
Archana8a180362021-07-05 02:18:48 +05302217 size_t storage_size = 0;
Gilles Peskinef603c712019-01-19 13:40:11 +01002218
Ronald Cron81709fc2020-11-14 12:10:32 +01002219 *target_key = MBEDTLS_SVC_KEY_ID_INIT;
2220
Archana8a180362021-07-05 02:18:48 +05302221 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01002222 source_key, &source_slot, PSA_KEY_USAGE_COPY, 0);
2223 if (status != PSA_SUCCESS) {
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002224 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002225 }
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002226
Gilles Peskine449bd832023-01-11 14:50:10 +01002227 status = psa_validate_optional_attributes(source_slot,
2228 specified_attributes);
2229 if (status != PSA_SUCCESS) {
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002230 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002231 }
Gilles Peskine4ce2a9d2019-05-03 16:57:15 +02002232
Archana9d17bf42021-09-10 06:22:44 +05302233 /* The target key type and number of bits have been validated by
2234 * psa_validate_optional_attributes() to be either equal to zero or
2235 * equal to the ones of the source key. So it is safe to inherit
2236 * them from the source key now."
Archana374fe5b2021-09-08 15:50:28 +05302237 * */
Gilles Peskine2f107ae2024-02-28 01:26:46 +01002238 actual_attributes.bits = source_slot->attr.bits;
2239 actual_attributes.type = source_slot->attr.type;
Archana374fe5b2021-09-08 15:50:28 +05302240
2241
Gilles Peskine449bd832023-01-11 14:50:10 +01002242 status = psa_restrict_key_policy(source_slot->attr.type,
Gilles Peskine2f107ae2024-02-28 01:26:46 +01002243 &actual_attributes.policy,
Gilles Peskine449bd832023-01-11 14:50:10 +01002244 &source_slot->attr.policy);
2245 if (status != PSA_SUCCESS) {
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002246 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002247 }
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002248
Gilles Peskine449bd832023-01-11 14:50:10 +01002249 status = psa_start_key_creation(PSA_KEY_CREATION_COPY, &actual_attributes,
2250 &target_slot, &driver);
2251 if (status != PSA_SUCCESS) {
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002252 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002253 }
2254 if (PSA_KEY_LIFETIME_GET_LOCATION(target_slot->attr.lifetime) !=
2255 PSA_KEY_LIFETIME_GET_LOCATION(source_slot->attr.lifetime)) {
Archana8a180362021-07-05 02:18:48 +05302256 /*
Archana9d17bf42021-09-10 06:22:44 +05302257 * If the source and target keys are stored in different locations,
Archana8a180362021-07-05 02:18:48 +05302258 * the source key would need to be exported as plaintext and re-imported
2259 * in the other location. This has security implications which have not
Archana449608b2021-09-08 15:36:05 +05302260 * been fully mapped. For now, this can be achieved through
Archana8a180362021-07-05 02:18:48 +05302261 * appropriate API invocations from the application, if needed.
2262 * */
Gilles Peskinef4ee6622019-07-24 13:44:30 +02002263 status = PSA_ERROR_NOT_SUPPORTED;
2264 goto exit;
Gilles Peskinef603c712019-01-19 13:40:11 +01002265 }
Archana8a180362021-07-05 02:18:48 +05302266 /*
2267 * When the source and target keys are within the same location,
Archana449608b2021-09-08 15:36:05 +05302268 * - For transparent keys it is a blind copy without any driver invocation,
Archana8a180362021-07-05 02:18:48 +05302269 * - For opaque keys this translates to an invocation of the drivers'
2270 * copy_key entry point through the dispatch layer.
2271 * */
Gilles Peskine2f107ae2024-02-28 01:26:46 +01002272 if (psa_key_lifetime_is_external(actual_attributes.lifetime)) {
Gilles Peskine449bd832023-01-11 14:50:10 +01002273 status = psa_driver_wrapper_get_key_buffer_size(&actual_attributes,
2274 &storage_size);
2275 if (status != PSA_SUCCESS) {
Archana8a180362021-07-05 02:18:48 +05302276 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002277 }
Archana374fe5b2021-09-08 15:50:28 +05302278
Gilles Peskine449bd832023-01-11 14:50:10 +01002279 status = psa_allocate_buffer_to_slot(target_slot, storage_size);
2280 if (status != PSA_SUCCESS) {
Archana8a180362021-07-05 02:18:48 +05302281 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002282 }
Archana374fe5b2021-09-08 15:50:28 +05302283
Gilles Peskine449bd832023-01-11 14:50:10 +01002284 status = psa_driver_wrapper_copy_key(&actual_attributes,
2285 source_slot->key.data,
2286 source_slot->key.bytes,
2287 target_slot->key.data,
2288 target_slot->key.bytes,
2289 &target_slot->key.bytes);
2290 if (status != PSA_SUCCESS) {
Archana8a180362021-07-05 02:18:48 +05302291 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002292 }
2293 } else {
2294 status = psa_copy_key_material_into_slot(target_slot,
Archana9d17bf42021-09-10 06:22:44 +05302295 source_slot->key.data,
Gilles Peskine449bd832023-01-11 14:50:10 +01002296 source_slot->key.bytes);
2297 if (status != PSA_SUCCESS) {
Archana8a180362021-07-05 02:18:48 +05302298 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002299 }
Archana8a180362021-07-05 02:18:48 +05302300 }
Gilles Peskine449bd832023-01-11 14:50:10 +01002301 status = psa_finish_key_creation(target_slot, driver, target_key);
Gilles Peskine8c8f2ab2019-04-18 21:44:46 +02002302exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002303 if (status != PSA_SUCCESS) {
2304 psa_fail_key_creation(target_slot, driver);
2305 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02002306
Ryan Everetta103ec92024-01-31 13:59:57 +00002307 unlock_status = psa_unregister_read_under_mutex(source_slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02002308
Gilles Peskine449bd832023-01-11 14:50:10 +01002309 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskinef603c712019-01-19 13:40:11 +01002310}
2311
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02002312
2313
Gilles Peskine2f9c4dc2018-01-28 13:16:24 +01002314/****************************************************************/
Gilles Peskine20035e32018-02-03 22:44:14 +01002315/* Message digests */
2316/****************************************************************/
2317
Gilles Peskine449bd832023-01-11 14:50:10 +01002318psa_status_t psa_hash_abort(psa_hash_operation_t *operation)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002319{
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002320 /* Aborting a non-active operation is allowed */
Gilles Peskine449bd832023-01-11 14:50:10 +01002321 if (operation->id == 0) {
2322 return PSA_SUCCESS;
2323 }
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002324
Gilles Peskine449bd832023-01-11 14:50:10 +01002325 psa_status_t status = psa_driver_wrapper_hash_abort(operation);
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002326 operation->id = 0;
2327
Gilles Peskine449bd832023-01-11 14:50:10 +01002328 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002329}
2330
Gilles Peskine449bd832023-01-11 14:50:10 +01002331psa_status_t psa_hash_setup(psa_hash_operation_t *operation,
2332 psa_algorithm_t alg)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002333{
Dave Rodgman685b6a72021-06-24 11:49:14 +01002334 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002335
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002336 /* A context must be freshly initialized before it can be set up. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002337 if (operation->id != 0) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002338 status = PSA_ERROR_BAD_STATE;
2339 goto exit;
2340 }
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002341
Gilles Peskine449bd832023-01-11 14:50:10 +01002342 if (!PSA_ALG_IS_HASH(alg)) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002343 status = PSA_ERROR_INVALID_ARGUMENT;
2344 goto exit;
2345 }
Jaeden Amero36ee5d02019-02-19 09:25:10 +00002346
Steven Cooremanb6bf4bb2021-03-15 19:00:14 +01002347 /* Ensure all of the context is zeroized, since PSA_HASH_OPERATION_INIT only
2348 * directly zeroes the int-sized dummy member of the context union. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002349 memset(&operation->ctx, 0, sizeof(operation->ctx));
Steven Cooreman893232f2021-03-15 12:23:37 +01002350
Gilles Peskine449bd832023-01-11 14:50:10 +01002351 status = psa_driver_wrapper_hash_setup(operation, alg);
Dave Rodgman685b6a72021-06-24 11:49:14 +01002352
2353exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002354 if (status != PSA_SUCCESS) {
2355 psa_hash_abort(operation);
2356 }
Dave Rodgman685b6a72021-06-24 11:49:14 +01002357
2358 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002359}
2360
Gilles Peskine449bd832023-01-11 14:50:10 +01002361psa_status_t psa_hash_update(psa_hash_operation_t *operation,
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002362 const uint8_t *input_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01002363 size_t input_length)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002364{
Dave Rodgman685b6a72021-06-24 11:49:14 +01002365 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002366 LOCAL_INPUT_DECLARE(input_external, input);
Dave Rodgman685b6a72021-06-24 11:49:14 +01002367
Gilles Peskine449bd832023-01-11 14:50:10 +01002368 if (operation->id == 0) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002369 status = PSA_ERROR_BAD_STATE;
2370 goto exit;
2371 }
Gilles Peskine94e44542018-07-12 16:58:43 +02002372
Steven Cooremanc8288352021-03-04 14:02:19 +01002373 /* Don't require hash implementations to behave correctly on a
2374 * zero-length input, which may have an invalid pointer. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002375 if (input_length == 0) {
2376 return PSA_SUCCESS;
2377 }
Steven Cooremanc8288352021-03-04 14:02:19 +01002378
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002379 LOCAL_INPUT_ALLOC(input_external, input_length, input);
Gilles Peskine449bd832023-01-11 14:50:10 +01002380 status = psa_driver_wrapper_hash_update(operation, input, input_length);
Dave Rodgman685b6a72021-06-24 11:49:14 +01002381
2382exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002383 if (status != PSA_SUCCESS) {
2384 psa_hash_abort(operation);
2385 }
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002386
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002387 LOCAL_INPUT_FREE(input_external, input);
Gilles Peskine449bd832023-01-11 14:50:10 +01002388 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002389}
2390
Thomas Daubney31d8c0b2024-01-18 15:26:59 +00002391static psa_status_t psa_hash_finish_internal(psa_hash_operation_t *operation,
Thomas Daubneyd2411562024-01-25 17:25:07 +00002392 uint8_t *hash,
2393 size_t hash_size,
2394 size_t *hash_length)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002395{
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002396 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2397
Steven Cooremanfbe09282021-03-08 18:41:12 +01002398 *hash_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01002399 if (operation->id == 0) {
2400 return PSA_ERROR_BAD_STATE;
2401 }
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002402
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002403 status = psa_driver_wrapper_hash_finish(
Gilles Peskine449bd832023-01-11 14:50:10 +01002404 operation, hash, hash_size, hash_length);
2405 psa_hash_abort(operation);
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002406
2407 return status;
2408}
2409
2410psa_status_t psa_hash_finish(psa_hash_operation_t *operation,
2411 uint8_t *hash_external,
2412 size_t hash_size,
2413 size_t *hash_length)
2414{
2415 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2416 LOCAL_OUTPUT_DECLARE(hash_external, hash);
2417
2418 LOCAL_OUTPUT_ALLOC(hash_external, hash_size, hash);
2419 status = psa_hash_finish_internal(operation, hash, hash_size, hash_length);
2420
David Horstmann4a48bec2024-03-13 15:42:31 +00002421#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002422exit:
Thomas Daubneydedd1002024-01-25 16:52:50 +00002423#endif
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002424 LOCAL_OUTPUT_FREE(hash_external, hash);
Gilles Peskine449bd832023-01-11 14:50:10 +01002425 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002426}
2427
Gilles Peskine449bd832023-01-11 14:50:10 +01002428psa_status_t psa_hash_verify(psa_hash_operation_t *operation,
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002429 const uint8_t *hash_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01002430 size_t hash_length)
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002431{
Ronald Cron69a63422021-10-18 09:47:58 +02002432 uint8_t actual_hash[PSA_HASH_MAX_SIZE];
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002433 size_t actual_hash_length;
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002434 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2435 LOCAL_INPUT_DECLARE(hash_external, hash);
2436
2437 status = psa_hash_finish_internal(
Gilles Peskine449bd832023-01-11 14:50:10 +01002438 operation,
2439 actual_hash, sizeof(actual_hash),
2440 &actual_hash_length);
Dave Rodgman685b6a72021-06-24 11:49:14 +01002441
Gilles Peskine449bd832023-01-11 14:50:10 +01002442 if (status != PSA_SUCCESS) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002443 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002444 }
Dave Rodgman685b6a72021-06-24 11:49:14 +01002445
Gilles Peskine449bd832023-01-11 14:50:10 +01002446 if (actual_hash_length != hash_length) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002447 status = PSA_ERROR_INVALID_SIGNATURE;
2448 goto exit;
2449 }
2450
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002451 LOCAL_INPUT_ALLOC(hash_external, hash_length, hash);
Dave Rodgman78701152023-08-29 14:20:18 +01002452 if (mbedtls_ct_memcmp(hash, actual_hash, actual_hash_length) != 0) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002453 status = PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskine449bd832023-01-11 14:50:10 +01002454 }
Dave Rodgman685b6a72021-06-24 11:49:14 +01002455
2456exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002457 mbedtls_platform_zeroize(actual_hash, sizeof(actual_hash));
2458 if (status != PSA_SUCCESS) {
Dave Rodgman685b6a72021-06-24 11:49:14 +01002459 psa_hash_abort(operation);
Gilles Peskine449bd832023-01-11 14:50:10 +01002460 }
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002461 LOCAL_INPUT_FREE(hash_external, hash);
Gilles Peskine449bd832023-01-11 14:50:10 +01002462 return status;
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002463}
2464
Gilles Peskine449bd832023-01-11 14:50:10 +01002465psa_status_t psa_hash_compute(psa_algorithm_t alg,
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002466 const uint8_t *input_external, size_t input_length,
2467 uint8_t *hash_external, size_t hash_size,
Gilles Peskine449bd832023-01-11 14:50:10 +01002468 size_t *hash_length)
Gilles Peskine0a749c82019-11-28 19:33:58 +01002469{
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002470 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2471 LOCAL_INPUT_DECLARE(input_external, input);
2472 LOCAL_OUTPUT_DECLARE(hash_external, hash);
2473
Steven Cooremanfbe09282021-03-08 18:41:12 +01002474 *hash_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01002475 if (!PSA_ALG_IS_HASH(alg)) {
2476 return PSA_ERROR_INVALID_ARGUMENT;
2477 }
Steven Cooremanf66d5fd2021-03-08 18:40:40 +01002478
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002479 LOCAL_INPUT_ALLOC(input_external, input_length, input);
2480 LOCAL_OUTPUT_ALLOC(hash_external, hash_size, hash);
2481 status = psa_driver_wrapper_hash_compute(alg, input, input_length,
Thomas Daubneyd2411562024-01-25 17:25:07 +00002482 hash, hash_size, hash_length);
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002483
David Horstmann4a48bec2024-03-13 15:42:31 +00002484#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002485exit:
Thomas Daubneydedd1002024-01-25 16:52:50 +00002486#endif
Thomas Daubney1c5118e2024-01-12 16:50:26 +00002487 LOCAL_INPUT_FREE(input_external, input);
2488 LOCAL_OUTPUT_FREE(hash_external, hash);
2489 return status;
Gilles Peskine0a749c82019-11-28 19:33:58 +01002490}
2491
Gilles Peskine449bd832023-01-11 14:50:10 +01002492psa_status_t psa_hash_compare(psa_algorithm_t alg,
Thomas Daubney51ffac92024-01-18 15:46:26 +00002493 const uint8_t *input_external, size_t input_length,
2494 const uint8_t *hash_external, size_t hash_length)
Gilles Peskine0a749c82019-11-28 19:33:58 +01002495{
Ronald Cron69a63422021-10-18 09:47:58 +02002496 uint8_t actual_hash[PSA_HASH_MAX_SIZE];
Steven Cooreman84d670d2021-02-18 16:22:53 +01002497 size_t actual_hash_length;
Thomas Daubney51ffac92024-01-18 15:46:26 +00002498 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2499
2500 LOCAL_INPUT_DECLARE(input_external, input);
2501 LOCAL_INPUT_DECLARE(hash_external, hash);
Steven Cooremanf66d5fd2021-03-08 18:40:40 +01002502
Gilles Peskine449bd832023-01-11 14:50:10 +01002503 if (!PSA_ALG_IS_HASH(alg)) {
Thomas Daubney51ffac92024-01-18 15:46:26 +00002504 status = PSA_ERROR_INVALID_ARGUMENT;
2505 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01002506 }
Steven Cooremanf66d5fd2021-03-08 18:40:40 +01002507
Thomas Daubney51ffac92024-01-18 15:46:26 +00002508 LOCAL_INPUT_ALLOC(input_external, input_length, input);
2509 status = psa_driver_wrapper_hash_compute(
Gilles Peskine449bd832023-01-11 14:50:10 +01002510 alg, input, input_length,
2511 actual_hash, sizeof(actual_hash),
2512 &actual_hash_length);
2513 if (status != PSA_SUCCESS) {
Gilles Peskine60aebec2021-12-13 12:33:18 +01002514 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002515 }
2516 if (actual_hash_length != hash_length) {
Gilles Peskine60aebec2021-12-13 12:33:18 +01002517 status = PSA_ERROR_INVALID_SIGNATURE;
2518 goto exit;
2519 }
Thomas Daubney51ffac92024-01-18 15:46:26 +00002520
2521 LOCAL_INPUT_ALLOC(hash_external, hash_length, hash);
Dave Rodgman78701152023-08-29 14:20:18 +01002522 if (mbedtls_ct_memcmp(hash, actual_hash, actual_hash_length) != 0) {
Gilles Peskine60aebec2021-12-13 12:33:18 +01002523 status = PSA_ERROR_INVALID_SIGNATURE;
Gilles Peskine449bd832023-01-11 14:50:10 +01002524 }
Gilles Peskine60aebec2021-12-13 12:33:18 +01002525
2526exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002527 mbedtls_platform_zeroize(actual_hash, sizeof(actual_hash));
Thomas Daubney51ffac92024-01-18 15:46:26 +00002528
2529 LOCAL_INPUT_FREE(input_external, input);
2530 LOCAL_INPUT_FREE(hash_external, hash);
2531
Gilles Peskine449bd832023-01-11 14:50:10 +01002532 return status;
Gilles Peskine0a749c82019-11-28 19:33:58 +01002533}
2534
Gilles Peskine449bd832023-01-11 14:50:10 +01002535psa_status_t psa_hash_clone(const psa_hash_operation_t *source_operation,
2536 psa_hash_operation_t *target_operation)
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002537{
Gilles Peskine449bd832023-01-11 14:50:10 +01002538 if (source_operation->id == 0 ||
2539 target_operation->id != 0) {
2540 return PSA_ERROR_BAD_STATE;
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002541 }
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002542
Gilles Peskine449bd832023-01-11 14:50:10 +01002543 psa_status_t status = psa_driver_wrapper_hash_clone(source_operation,
2544 target_operation);
2545 if (status != PSA_SUCCESS) {
2546 psa_hash_abort(target_operation);
2547 }
Steven Cooremandbf8ced2021-03-04 13:01:18 +01002548
Gilles Peskine449bd832023-01-11 14:50:10 +01002549 return status;
Gilles Peskineebb2c3e2019-01-19 12:03:41 +01002550}
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002551
2552
Gilles Peskine9ef733f2018-02-07 21:05:37 +01002553/****************************************************************/
Gilles Peskine8c9def32018-02-08 10:02:12 +01002554/* MAC */
2555/****************************************************************/
2556
Gilles Peskine449bd832023-01-11 14:50:10 +01002557psa_status_t psa_mac_abort(psa_mac_operation_t *operation)
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002558{
Steven Cooremane6804192021-03-19 18:28:56 +01002559 /* Aborting a non-active operation is allowed */
Gilles Peskine449bd832023-01-11 14:50:10 +01002560 if (operation->id == 0) {
2561 return PSA_SUCCESS;
2562 }
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002563
Gilles Peskine449bd832023-01-11 14:50:10 +01002564 psa_status_t status = psa_driver_wrapper_mac_abort(operation);
Steven Cooreman72f736a2021-05-07 14:14:37 +02002565 operation->mac_size = 0;
2566 operation->is_sign = 0;
Steven Cooremane6804192021-03-19 18:28:56 +01002567 operation->id = 0;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002568
Gilles Peskine449bd832023-01-11 14:50:10 +01002569 return status;
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02002570}
2571
Ronald Cron2dff3b22021-06-17 16:33:22 +02002572static psa_status_t psa_mac_finalize_alg_and_key_validation(
2573 psa_algorithm_t alg,
Ronald Cron79bdd822021-06-17 16:46:44 +02002574 const psa_key_attributes_t *attributes,
Gilles Peskine449bd832023-01-11 14:50:10 +01002575 uint8_t *mac_size)
Gilles Peskine8c9def32018-02-08 10:02:12 +01002576{
Ronald Cronf95a2b12020-10-22 15:24:49 +02002577 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine449bd832023-01-11 14:50:10 +01002578 psa_key_type_t key_type = psa_get_key_type(attributes);
2579 size_t key_bits = psa_get_key_bits(attributes);
Steven Cooreman77e2cc52021-03-19 17:05:52 +01002580
Gilles Peskine449bd832023-01-11 14:50:10 +01002581 if (!PSA_ALG_IS_MAC(alg)) {
2582 return PSA_ERROR_INVALID_ARGUMENT;
2583 }
Steven Cooremane6804192021-03-19 18:28:56 +01002584
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +01002585 /* Validate the combination of key type and algorithm */
Gilles Peskine449bd832023-01-11 14:50:10 +01002586 status = psa_mac_key_can_do(alg, key_type);
2587 if (status != PSA_SUCCESS) {
2588 return status;
2589 }
Steven Cooreman15472f82021-03-02 16:16:22 +01002590
Steven Cooremand1a68f12021-05-10 11:13:41 +02002591 /* Get the output length for the algorithm and key combination */
Gilles Peskine449bd832023-01-11 14:50:10 +01002592 *mac_size = PSA_MAC_LENGTH(key_type, key_bits, alg);
Steven Cooreman15472f82021-03-02 16:16:22 +01002593
Gilles Peskine449bd832023-01-11 14:50:10 +01002594 if (*mac_size < 4) {
Steven Cooreman15472f82021-03-02 16:16:22 +01002595 /* A very short MAC is too short for security since it can be
2596 * brute-forced. Ancient protocols with 32-bit MACs do exist,
2597 * so we make this our minimum, even though 32 bits is still
2598 * too small for security. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002599 return PSA_ERROR_NOT_SUPPORTED;
Steven Cooreman15472f82021-03-02 16:16:22 +01002600 }
Gilles Peskineab1d7ab2018-07-06 16:07:47 +02002601
Gilles Peskine449bd832023-01-11 14:50:10 +01002602 if (*mac_size > PSA_MAC_LENGTH(key_type, key_bits,
2603 PSA_ALG_FULL_LENGTH_MAC(alg))) {
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +01002604 /* It's impossible to "truncate" to a larger length than the full length
2605 * of the algorithm. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002606 return PSA_ERROR_INVALID_ARGUMENT;
Steven Cooremanf9f7fdf2021-03-03 19:04:05 +01002607 }
2608
Gilles Peskine449bd832023-01-11 14:50:10 +01002609 if (*mac_size > PSA_MAC_MAX_SIZE) {
Gilles Peskinea9b6c802022-03-16 13:54:49 +01002610 /* PSA_MAC_LENGTH returns the correct length even for a MAC algorithm
2611 * that is disabled in the compile-time configuration. The result can
2612 * therefore be larger than PSA_MAC_MAX_SIZE, which does take the
2613 * configuration into account. In this case, force a return of
2614 * PSA_ERROR_NOT_SUPPORTED here. Otherwise psa_mac_verify(), or
2615 * psa_mac_compute(mac_size=PSA_MAC_MAX_SIZE), would return
2616 * PSA_ERROR_BUFFER_TOO_SMALL for an unsupported algorithm whose MAC size
2617 * is larger than PSA_MAC_MAX_SIZE, which is misleading and which breaks
2618 * systematically generated tests. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002619 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskinea9b6c802022-03-16 13:54:49 +01002620 }
2621
Gilles Peskine449bd832023-01-11 14:50:10 +01002622 return PSA_SUCCESS;
Ronald Cron2dff3b22021-06-17 16:33:22 +02002623}
2624
Gilles Peskine449bd832023-01-11 14:50:10 +01002625static psa_status_t psa_mac_setup(psa_mac_operation_t *operation,
2626 mbedtls_svc_key_id_t key,
2627 psa_algorithm_t alg,
2628 int is_sign)
Gilles Peskinee59236f2018-01-27 23:32:46 +01002629{
2630 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2631 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Dave Rodgman54648242021-06-24 11:49:45 +01002632 psa_key_slot_t *slot = NULL;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002633
2634 /* A context must be freshly initialized before it can be set up. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002635 if (operation->id != 0) {
Dave Rodgman54648242021-06-24 11:49:45 +01002636 status = PSA_ERROR_BAD_STATE;
2637 goto exit;
2638 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01002639
2640 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01002641 key,
2642 &slot,
2643 is_sign ? PSA_KEY_USAGE_SIGN_MESSAGE : PSA_KEY_USAGE_VERIFY_MESSAGE,
2644 alg);
2645 if (status != PSA_SUCCESS) {
Dave Rodgman54648242021-06-24 11:49:45 +01002646 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002647 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01002648
Gilles Peskine7a5d9202024-02-28 01:18:23 +01002649 status = psa_mac_finalize_alg_and_key_validation(alg, &slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01002650 &operation->mac_size);
2651 if (status != PSA_SUCCESS) {
Gilles Peskine8c9def32018-02-08 10:02:12 +01002652 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002653 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01002654
2655 operation->is_sign = is_sign;
Steven Cooremane6804192021-03-19 18:28:56 +01002656 /* Dispatch the MAC setup call with validated input */
Gilles Peskine449bd832023-01-11 14:50:10 +01002657 if (is_sign) {
2658 status = psa_driver_wrapper_mac_sign_setup(operation,
Gilles Peskine7a5d9202024-02-28 01:18:23 +01002659 &slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01002660 slot->key.data,
2661 slot->key.bytes,
2662 alg);
2663 } else {
2664 status = psa_driver_wrapper_mac_verify_setup(operation,
Gilles Peskine7a5d9202024-02-28 01:18:23 +01002665 &slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01002666 slot->key.data,
2667 slot->key.bytes,
2668 alg);
Gilles Peskine8c9def32018-02-08 10:02:12 +01002669 }
Gilles Peskine7e454bc2018-06-11 17:26:17 +02002670
Gilles Peskinefbfac682018-07-08 20:51:54 +02002671exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002672 if (status != PSA_SUCCESS) {
2673 psa_mac_abort(operation);
2674 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02002675
Ryan Everettfb9857f2024-02-14 12:16:41 +00002676 unlock_status = psa_unregister_read_under_mutex(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02002677
Gilles Peskine449bd832023-01-11 14:50:10 +01002678 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002679}
2680
Gilles Peskine449bd832023-01-11 14:50:10 +01002681psa_status_t psa_mac_sign_setup(psa_mac_operation_t *operation,
2682 mbedtls_svc_key_id_t key,
2683 psa_algorithm_t alg)
Gilles Peskine89167cb2018-07-08 20:12:23 +02002684{
Gilles Peskine449bd832023-01-11 14:50:10 +01002685 return psa_mac_setup(operation, key, alg, 1);
Gilles Peskine89167cb2018-07-08 20:12:23 +02002686}
2687
Gilles Peskine449bd832023-01-11 14:50:10 +01002688psa_status_t psa_mac_verify_setup(psa_mac_operation_t *operation,
2689 mbedtls_svc_key_id_t key,
2690 psa_algorithm_t alg)
Gilles Peskine89167cb2018-07-08 20:12:23 +02002691{
Gilles Peskine449bd832023-01-11 14:50:10 +01002692 return psa_mac_setup(operation, key, alg, 0);
Gilles Peskine89167cb2018-07-08 20:12:23 +02002693}
2694
Gilles Peskine449bd832023-01-11 14:50:10 +01002695psa_status_t psa_mac_update(psa_mac_operation_t *operation,
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002696 const uint8_t *input_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01002697 size_t input_length)
Gilles Peskine8c9def32018-02-08 10:02:12 +01002698{
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002699 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2700 LOCAL_INPUT_DECLARE(input_external, input);
2701
Gilles Peskine449bd832023-01-11 14:50:10 +01002702 if (operation->id == 0) {
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002703 status = PSA_ERROR_BAD_STATE;
2704 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01002705 }
Gilles Peskine8c9def32018-02-08 10:02:12 +01002706
Steven Cooreman6e7f2912021-03-19 18:38:46 +01002707 /* Don't require hash implementations to behave correctly on a
2708 * zero-length input, which may have an invalid pointer. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002709 if (input_length == 0) {
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002710 status = PSA_SUCCESS;
2711 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01002712 }
Nir Sonnenscheindcd636a2018-06-04 16:03:32 +03002713
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002714 LOCAL_INPUT_ALLOC(input_external, input_length, input);
2715 status = psa_driver_wrapper_mac_update(operation, input, input_length);
2716
Gilles Peskine449bd832023-01-11 14:50:10 +01002717 if (status != PSA_SUCCESS) {
2718 psa_mac_abort(operation);
2719 }
Steven Cooreman6e7f2912021-03-19 18:38:46 +01002720
David Horstmann4a48bec2024-03-13 15:42:31 +00002721#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002722exit:
Thomas Daubneyc6705c62024-01-30 11:21:47 +00002723#endif
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002724 LOCAL_INPUT_FREE(input_external, input);
2725
Gilles Peskine449bd832023-01-11 14:50:10 +01002726 return status;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002727}
2728
Gilles Peskine449bd832023-01-11 14:50:10 +01002729psa_status_t psa_mac_sign_finish(psa_mac_operation_t *operation,
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002730 uint8_t *mac_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01002731 size_t mac_size,
2732 size_t *mac_length)
mohammad16036df908f2018-04-02 08:34:15 -07002733{
Steven Cooremana5b860a2021-03-19 19:04:39 +01002734 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2735 psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED;
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002736 LOCAL_OUTPUT_DECLARE(mac_external, mac);
Thomas Daubney1ffc5cb2024-01-31 18:09:36 +00002737 LOCAL_OUTPUT_ALLOC(mac_external, mac_size, mac);
Steven Cooreman77e2cc52021-03-19 17:05:52 +01002738
Gilles Peskine449bd832023-01-11 14:50:10 +01002739 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002740 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002741 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002742 }
Jaeden Amero252ef282019-02-15 14:05:35 +00002743
Gilles Peskine449bd832023-01-11 14:50:10 +01002744 if (!operation->is_sign) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002745 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002746 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002747 }
Steven Cooreman72f736a2021-05-07 14:14:37 +02002748
Steven Cooreman8af5c5c2021-05-11 11:09:13 +02002749 /* Sanity check. This will guarantee that mac_size != 0 (and so mac != NULL)
2750 * once all the error checks are done. */
Gilles Peskine449bd832023-01-11 14:50:10 +01002751 if (operation->mac_size == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002752 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002753 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002754 }
Steven Cooreman8af5c5c2021-05-11 11:09:13 +02002755
Gilles Peskine449bd832023-01-11 14:50:10 +01002756 if (mac_size < operation->mac_size) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002757 status = PSA_ERROR_BUFFER_TOO_SMALL;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002758 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002759 }
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002760
Thomas Daubney1ffc5cb2024-01-31 18:09:36 +00002761
Gilles Peskine449bd832023-01-11 14:50:10 +01002762 status = psa_driver_wrapper_mac_sign_finish(operation,
2763 mac, operation->mac_size,
2764 mac_length);
Steven Cooreman72f736a2021-05-07 14:14:37 +02002765
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002766exit:
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002767 /* In case of success, set the potential excess room in the output buffer
2768 * to an invalid value, to avoid potentially leaking a longer MAC.
2769 * In case of error, set the output length and content to a safe default,
2770 * such that in case the caller misses an error check, the output would be
2771 * an unachievable MAC.
2772 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002773 if (status != PSA_SUCCESS) {
Steven Cooreman72f736a2021-05-07 14:14:37 +02002774 *mac_length = mac_size;
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002775 operation->mac_size = 0;
Steven Cooreman72f736a2021-05-07 14:14:37 +02002776 }
mohammad16036df908f2018-04-02 08:34:15 -07002777
Thomas Daubney03f1ea32024-02-01 16:16:27 +00002778 if (mac != NULL) {
Thomas Daubney1ffc5cb2024-01-31 18:09:36 +00002779 psa_wipe_tag_output_buffer(mac, status, mac_size, *mac_length);
2780 }
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002781
Gilles Peskine449bd832023-01-11 14:50:10 +01002782 abort_status = psa_mac_abort(operation);
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002783 LOCAL_OUTPUT_FREE(mac_external, mac);
Gilles Peskine5d0b8642018-07-08 20:35:02 +02002784
Gilles Peskine449bd832023-01-11 14:50:10 +01002785 return status == PSA_SUCCESS ? abort_status : status;
mohammad16036df908f2018-04-02 08:34:15 -07002786}
2787
Gilles Peskine449bd832023-01-11 14:50:10 +01002788psa_status_t psa_mac_verify_finish(psa_mac_operation_t *operation,
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002789 const uint8_t *mac_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01002790 size_t mac_length)
Gilles Peskine8c9def32018-02-08 10:02:12 +01002791{
Steven Cooremana5b860a2021-03-19 19:04:39 +01002792 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2793 psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED;
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002794 LOCAL_INPUT_DECLARE(mac_external, mac);
Steven Cooreman77e2cc52021-03-19 17:05:52 +01002795
Gilles Peskine449bd832023-01-11 14:50:10 +01002796 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002797 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002798 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002799 }
Jaeden Amero252ef282019-02-15 14:05:35 +00002800
Gilles Peskine449bd832023-01-11 14:50:10 +01002801 if (operation->is_sign) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002802 status = PSA_ERROR_BAD_STATE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002803 goto exit;
Dave Rodgman38e62ae2021-06-23 11:38:39 +01002804 }
Steven Cooreman72f736a2021-05-07 14:14:37 +02002805
Gilles Peskine449bd832023-01-11 14:50:10 +01002806 if (operation->mac_size != mac_length) {
Steven Cooreman72f736a2021-05-07 14:14:37 +02002807 status = PSA_ERROR_INVALID_SIGNATURE;
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002808 goto exit;
Steven Cooreman72f736a2021-05-07 14:14:37 +02002809 }
2810
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002811 LOCAL_INPUT_ALLOC(mac_external, mac_length, mac);
Gilles Peskine449bd832023-01-11 14:50:10 +01002812 status = psa_driver_wrapper_mac_verify_finish(operation,
2813 mac, mac_length);
Steven Cooreman72f736a2021-05-07 14:14:37 +02002814
Dave Rodgman90d1cb82021-06-25 09:09:02 +01002815exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002816 abort_status = psa_mac_abort(operation);
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002817 LOCAL_INPUT_FREE(mac_external, mac);
mohammad16036df908f2018-04-02 08:34:15 -07002818
Gilles Peskine449bd832023-01-11 14:50:10 +01002819 return status == PSA_SUCCESS ? abort_status : status;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002820}
2821
Gilles Peskine449bd832023-01-11 14:50:10 +01002822static psa_status_t psa_mac_compute_internal(mbedtls_svc_key_id_t key,
2823 psa_algorithm_t alg,
2824 const uint8_t *input,
2825 size_t input_length,
2826 uint8_t *mac,
2827 size_t mac_size,
2828 size_t *mac_length,
2829 int is_sign)
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002830{
2831 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron51131b52021-06-17 17:17:20 +02002832 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
2833 psa_key_slot_t *slot;
2834 uint8_t operation_mac_size = 0;
Gilles Peskine8c9def32018-02-08 10:02:12 +01002835
Ronald Cron51131b52021-06-17 17:17:20 +02002836 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01002837 key,
2838 &slot,
2839 is_sign ? PSA_KEY_USAGE_SIGN_MESSAGE : PSA_KEY_USAGE_VERIFY_MESSAGE,
2840 alg);
2841 if (status != PSA_SUCCESS) {
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002842 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002843 }
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002844
Gilles Peskine7a5d9202024-02-28 01:18:23 +01002845 status = psa_mac_finalize_alg_and_key_validation(alg, &slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01002846 &operation_mac_size);
2847 if (status != PSA_SUCCESS) {
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002848 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002849 }
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002850
Gilles Peskine449bd832023-01-11 14:50:10 +01002851 if (mac_size < operation_mac_size) {
Ronald Cron51131b52021-06-17 17:17:20 +02002852 status = PSA_ERROR_BUFFER_TOO_SMALL;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002853 goto exit;
Ronald Cron51131b52021-06-17 17:17:20 +02002854 }
2855
2856 status = psa_driver_wrapper_mac_compute(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01002857 &slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01002858 slot->key.data, slot->key.bytes,
2859 alg,
2860 input, input_length,
2861 mac, operation_mac_size, mac_length);
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002862
2863exit:
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002864 /* In case of success, set the potential excess room in the output buffer
2865 * to an invalid value, to avoid potentially leaking a longer MAC.
2866 * In case of error, set the output length and content to a safe default,
2867 * such that in case the caller misses an error check, the output would be
2868 * an unachievable MAC.
2869 */
Gilles Peskine449bd832023-01-11 14:50:10 +01002870 if (status != PSA_SUCCESS) {
Ronald Cron51131b52021-06-17 17:17:20 +02002871 *mac_length = mac_size;
Ronald Cronc3dd75f2021-06-18 13:05:48 +02002872 operation_mac_size = 0;
Ronald Cron51131b52021-06-17 17:17:20 +02002873 }
Paul Elliottdc42ca82023-02-24 18:11:59 +00002874
2875 psa_wipe_tag_output_buffer(mac, status, mac_size, *mac_length);
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002876
Ryan Everetta103ec92024-01-31 13:59:57 +00002877 unlock_status = psa_unregister_read_under_mutex(slot);
Ronald Cron51131b52021-06-17 17:17:20 +02002878
Gilles Peskine449bd832023-01-11 14:50:10 +01002879 return (status == PSA_SUCCESS) ? unlock_status : status;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002880}
2881
Gilles Peskine449bd832023-01-11 14:50:10 +01002882psa_status_t psa_mac_compute(mbedtls_svc_key_id_t key,
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002883 psa_algorithm_t alg,
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002884 const uint8_t *input_external,
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002885 size_t input_length,
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002886 uint8_t *mac_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01002887 size_t mac_size,
2888 size_t *mac_length)
2889{
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002890 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2891 LOCAL_INPUT_DECLARE(input_external, input);
2892 LOCAL_OUTPUT_DECLARE(mac_external, mac);
2893
2894 LOCAL_INPUT_ALLOC(input_external, input_length, input);
2895 LOCAL_OUTPUT_ALLOC(mac_external, mac_size, mac);
2896 status = psa_mac_compute_internal(key, alg,
Thomas Daubney7480a742024-01-30 11:29:47 +00002897 input, input_length,
2898 mac, mac_size, mac_length, 1);
Thomas Daubneyc6705c62024-01-30 11:21:47 +00002899
David Horstmann4a48bec2024-03-13 15:42:31 +00002900#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002901exit:
Thomas Daubneyc6705c62024-01-30 11:21:47 +00002902#endif
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002903 LOCAL_INPUT_FREE(input_external, input);
2904 LOCAL_OUTPUT_FREE(mac_external, mac);
2905
2906 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01002907}
2908
2909psa_status_t psa_mac_verify(mbedtls_svc_key_id_t key,
2910 psa_algorithm_t alg,
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002911 const uint8_t *input_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01002912 size_t input_length,
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002913 const uint8_t *mac_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01002914 size_t mac_length)
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002915{
2916 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Crona587cbc2021-06-18 14:51:29 +02002917 uint8_t actual_mac[PSA_MAC_MAX_SIZE];
2918 size_t actual_mac_length;
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002919 LOCAL_INPUT_DECLARE(input_external, input);
2920 LOCAL_INPUT_DECLARE(mac_external, mac);
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002921
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002922 LOCAL_INPUT_ALLOC(input_external, input_length, input);
Gilles Peskine449bd832023-01-11 14:50:10 +01002923 status = psa_mac_compute_internal(key, alg,
2924 input, input_length,
2925 actual_mac, sizeof(actual_mac),
2926 &actual_mac_length, 0);
2927 if (status != PSA_SUCCESS) {
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002928 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01002929 }
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002930
Gilles Peskine449bd832023-01-11 14:50:10 +01002931 if (mac_length != actual_mac_length) {
Ronald Crona587cbc2021-06-18 14:51:29 +02002932 status = PSA_ERROR_INVALID_SIGNATURE;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002933 goto exit;
Ronald Crona587cbc2021-06-18 14:51:29 +02002934 }
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002935
2936 LOCAL_INPUT_ALLOC(mac_external, mac_length, mac);
Dave Rodgman78701152023-08-29 14:20:18 +01002937 if (mbedtls_ct_memcmp(mac, actual_mac, actual_mac_length) != 0) {
Ronald Crona587cbc2021-06-18 14:51:29 +02002938 status = PSA_ERROR_INVALID_SIGNATURE;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002939 goto exit;
Ronald Crona587cbc2021-06-18 14:51:29 +02002940 }
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002941
2942exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01002943 mbedtls_platform_zeroize(actual_mac, sizeof(actual_mac));
Thomas Daubney8db8d1a2024-01-18 13:18:58 +00002944 LOCAL_INPUT_FREE(input_external, input);
2945 LOCAL_INPUT_FREE(mac_external, mac);
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002946
Gilles Peskine449bd832023-01-11 14:50:10 +01002947 return status;
gabor-mezei-arm4076d3e2021-03-01 15:34:18 +01002948}
Gilles Peskinee59236f2018-01-27 23:32:46 +01002949
Gilles Peskinee59236f2018-01-27 23:32:46 +01002950/****************************************************************/
2951/* Asymmetric cryptography */
2952/****************************************************************/
2953
Gilles Peskine449bd832023-01-11 14:50:10 +01002954static psa_status_t psa_sign_verify_check_alg(int input_is_message,
2955 psa_algorithm_t alg)
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002956{
Gilles Peskine449bd832023-01-11 14:50:10 +01002957 if (input_is_message) {
2958 if (!PSA_ALG_IS_SIGN_MESSAGE(alg)) {
2959 return PSA_ERROR_INVALID_ARGUMENT;
2960 }
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002961
Gilles Peskine449bd832023-01-11 14:50:10 +01002962 if (PSA_ALG_IS_SIGN_HASH(alg)) {
2963 if (!PSA_ALG_IS_HASH(PSA_ALG_SIGN_GET_HASH(alg))) {
2964 return PSA_ERROR_INVALID_ARGUMENT;
2965 }
2966 }
2967 } else {
2968 if (!PSA_ALG_IS_SIGN_HASH(alg)) {
2969 return PSA_ERROR_INVALID_ARGUMENT;
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002970 }
2971 }
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002972
Gilles Peskine449bd832023-01-11 14:50:10 +01002973 return PSA_SUCCESS;
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002974}
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002975
Gilles Peskine449bd832023-01-11 14:50:10 +01002976static psa_status_t psa_sign_internal(mbedtls_svc_key_id_t key,
2977 int input_is_message,
2978 psa_algorithm_t alg,
2979 const uint8_t *input,
2980 size_t input_length,
2981 uint8_t *signature,
2982 size_t signature_size,
2983 size_t *signature_length)
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002984{
2985 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2986 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
2987 psa_key_slot_t *slot;
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002988
2989 *signature_length = 0;
2990
Gilles Peskine449bd832023-01-11 14:50:10 +01002991 status = psa_sign_verify_check_alg(input_is_message, alg);
2992 if (status != PSA_SUCCESS) {
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02002993 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01002994 }
gabor-mezei-arm5b446522021-04-20 12:11:35 +02002995
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002996 /* Immediately reject a zero-length signature buffer. This guarantees
gabor-mezei-arm12b4f342021-05-05 13:54:55 +02002997 * that signature must be a valid pointer. (On the other hand, the input
gabor-mezei-arm4a210192021-04-14 21:14:28 +02002998 * buffer can in principle be empty since it doesn't actually have
2999 * to be a hash.) */
Gilles Peskine449bd832023-01-11 14:50:10 +01003000 if (signature_size == 0) {
3001 return PSA_ERROR_BUFFER_TOO_SMALL;
3002 }
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003003
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003004 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01003005 key, &slot,
3006 input_is_message ? PSA_KEY_USAGE_SIGN_MESSAGE :
3007 PSA_KEY_USAGE_SIGN_HASH,
3008 alg);
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003009
Gilles Peskine449bd832023-01-11 14:50:10 +01003010 if (status != PSA_SUCCESS) {
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003011 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01003012 }
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003013
Gilles Peskine449bd832023-01-11 14:50:10 +01003014 if (!PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type)) {
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003015 status = PSA_ERROR_INVALID_ARGUMENT;
3016 goto exit;
3017 }
3018
Gilles Peskine449bd832023-01-11 14:50:10 +01003019 if (input_is_message) {
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003020 status = psa_driver_wrapper_sign_message(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01003021 &slot->attr, slot->key.data, slot->key.bytes,
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003022 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003023 signature, signature_size, signature_length);
3024 } else {
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003025
3026 status = psa_driver_wrapper_sign_hash(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01003027 &slot->attr, slot->key.data, slot->key.bytes,
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003028 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003029 signature, signature_size, signature_length);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003030 }
3031
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003032
3033exit:
Paul Elliott59200a22023-02-21 15:07:40 +00003034 psa_wipe_tag_output_buffer(signature, status, signature_size,
3035 *signature_length);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003036
Ryan Everetta103ec92024-01-31 13:59:57 +00003037 unlock_status = psa_unregister_read_under_mutex(slot);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003038
Gilles Peskine449bd832023-01-11 14:50:10 +01003039 return (status == PSA_SUCCESS) ? unlock_status : status;
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003040}
3041
Gilles Peskine449bd832023-01-11 14:50:10 +01003042static psa_status_t psa_verify_internal(mbedtls_svc_key_id_t key,
3043 int input_is_message,
3044 psa_algorithm_t alg,
3045 const uint8_t *input,
3046 size_t input_length,
3047 const uint8_t *signature,
3048 size_t signature_length)
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003049{
3050 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3051 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
3052 psa_key_slot_t *slot;
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003053
Gilles Peskine449bd832023-01-11 14:50:10 +01003054 status = psa_sign_verify_check_alg(input_is_message, alg);
3055 if (status != PSA_SUCCESS) {
gabor-mezei-arm8b3e8862021-05-05 13:56:27 +02003056 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01003057 }
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003058
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003059 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01003060 key, &slot,
3061 input_is_message ? PSA_KEY_USAGE_VERIFY_MESSAGE :
3062 PSA_KEY_USAGE_VERIFY_HASH,
3063 alg);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003064
Gilles Peskine449bd832023-01-11 14:50:10 +01003065 if (status != PSA_SUCCESS) {
3066 return status;
3067 }
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003068
Gilles Peskine449bd832023-01-11 14:50:10 +01003069 if (input_is_message) {
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003070 status = psa_driver_wrapper_verify_message(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01003071 &slot->attr, slot->key.data, slot->key.bytes,
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003072 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003073 signature, signature_length);
3074 } else {
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003075 status = psa_driver_wrapper_verify_hash(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01003076 &slot->attr, slot->key.data, slot->key.bytes,
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003077 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003078 signature, signature_length);
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003079 }
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003080
Ryan Everetta103ec92024-01-31 13:59:57 +00003081 unlock_status = psa_unregister_read_under_mutex(slot);
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003082
Gilles Peskine449bd832023-01-11 14:50:10 +01003083 return (status == PSA_SUCCESS) ? unlock_status : status;
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003084
3085}
3086
gabor-mezei-arm6883fd22021-05-05 14:18:36 +02003087psa_status_t psa_sign_message_builtin(
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003088 const psa_key_attributes_t *attributes,
3089 const uint8_t *key_buffer,
3090 size_t key_buffer_size,
3091 psa_algorithm_t alg,
3092 const uint8_t *input,
3093 size_t input_length,
3094 uint8_t *signature,
3095 size_t signature_size,
Gilles Peskine449bd832023-01-11 14:50:10 +01003096 size_t *signature_length)
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003097{
3098 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003099
Gilles Peskine449bd832023-01-11 14:50:10 +01003100 if (PSA_ALG_IS_SIGN_HASH(alg)) {
gabor-mezei-armf9820f92021-05-03 16:26:20 +02003101 size_t hash_length;
3102 uint8_t hash[PSA_HASH_MAX_SIZE];
3103
gabor-mezei-arm0f622402021-04-29 16:48:44 +02003104 status = psa_driver_wrapper_hash_compute(
Gilles Peskine449bd832023-01-11 14:50:10 +01003105 PSA_ALG_SIGN_GET_HASH(alg),
3106 input, input_length,
3107 hash, sizeof(hash), &hash_length);
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003108
Gilles Peskine449bd832023-01-11 14:50:10 +01003109 if (status != PSA_SUCCESS) {
gabor-mezei-arm0f622402021-04-29 16:48:44 +02003110 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01003111 }
gabor-mezei-armf9820f92021-05-03 16:26:20 +02003112
3113 return psa_driver_wrapper_sign_hash(
Gilles Peskine449bd832023-01-11 14:50:10 +01003114 attributes, key_buffer, key_buffer_size,
3115 alg, hash, hash_length,
3116 signature, signature_size, signature_length);
gabor-mezei-arm0f622402021-04-29 16:48:44 +02003117 }
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003118
Gilles Peskine449bd832023-01-11 14:50:10 +01003119 return PSA_ERROR_NOT_SUPPORTED;
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003120}
3121
Gilles Peskine449bd832023-01-11 14:50:10 +01003122psa_status_t psa_sign_message(mbedtls_svc_key_id_t key,
3123 psa_algorithm_t alg,
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003124 const uint8_t *input_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01003125 size_t input_length,
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003126 uint8_t *signature_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01003127 size_t signature_size,
3128 size_t *signature_length)
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003129{
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003130 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3131 LOCAL_INPUT_DECLARE(input_external, input);
3132 LOCAL_OUTPUT_DECLARE(signature_external, signature);
3133
3134 LOCAL_INPUT_ALLOC(input_external, input_length, input);
3135 LOCAL_OUTPUT_ALLOC(signature_external, signature_size, signature);
3136 status = psa_sign_internal(key, 1, alg, input, input_length, signature,
3137 signature_size, signature_length);
3138
David Horstmann4a48bec2024-03-13 15:42:31 +00003139#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003140exit:
Thomas Daubney3e65f522024-01-30 12:37:25 +00003141#endif
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003142 LOCAL_INPUT_FREE(input_external, input);
3143 LOCAL_OUTPUT_FREE(signature_external, signature);
3144 return status;
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003145}
3146
gabor-mezei-arm6883fd22021-05-05 14:18:36 +02003147psa_status_t psa_verify_message_builtin(
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003148 const psa_key_attributes_t *attributes,
3149 const uint8_t *key_buffer,
3150 size_t key_buffer_size,
3151 psa_algorithm_t alg,
3152 const uint8_t *input,
3153 size_t input_length,
3154 const uint8_t *signature,
Gilles Peskine449bd832023-01-11 14:50:10 +01003155 size_t signature_length)
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003156{
3157 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003158
Gilles Peskine449bd832023-01-11 14:50:10 +01003159 if (PSA_ALG_IS_SIGN_HASH(alg)) {
gabor-mezei-armf9820f92021-05-03 16:26:20 +02003160 size_t hash_length;
3161 uint8_t hash[PSA_HASH_MAX_SIZE];
3162
gabor-mezei-arm0f622402021-04-29 16:48:44 +02003163 status = psa_driver_wrapper_hash_compute(
Gilles Peskine449bd832023-01-11 14:50:10 +01003164 PSA_ALG_SIGN_GET_HASH(alg),
3165 input, input_length,
3166 hash, sizeof(hash), &hash_length);
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003167
Gilles Peskine449bd832023-01-11 14:50:10 +01003168 if (status != PSA_SUCCESS) {
gabor-mezei-arm0f622402021-04-29 16:48:44 +02003169 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01003170 }
gabor-mezei-armf9820f92021-05-03 16:26:20 +02003171
3172 return psa_driver_wrapper_verify_hash(
Gilles Peskine449bd832023-01-11 14:50:10 +01003173 attributes, key_buffer, key_buffer_size,
3174 alg, hash, hash_length,
3175 signature, signature_length);
gabor-mezei-arm0f622402021-04-29 16:48:44 +02003176 }
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003177
Gilles Peskine449bd832023-01-11 14:50:10 +01003178 return PSA_ERROR_NOT_SUPPORTED;
gabor-mezei-arm50eac352021-04-22 11:32:19 +02003179}
3180
Gilles Peskine449bd832023-01-11 14:50:10 +01003181psa_status_t psa_verify_message(mbedtls_svc_key_id_t key,
3182 psa_algorithm_t alg,
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003183 const uint8_t *input_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01003184 size_t input_length,
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003185 const uint8_t *signature_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01003186 size_t signature_length)
gabor-mezei-arm5b446522021-04-20 12:11:35 +02003187{
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003188 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3189 LOCAL_INPUT_DECLARE(input_external, input);
3190 LOCAL_INPUT_DECLARE(signature_external, signature);
3191
3192 LOCAL_INPUT_ALLOC(input_external, input_length, input);
3193 LOCAL_INPUT_ALLOC(signature_external, signature_length, signature);
3194 status = psa_verify_internal(key, 1, alg, input, input_length, signature,
3195 signature_length);
3196
David Horstmann4a48bec2024-03-13 15:42:31 +00003197#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003198exit:
Thomas Daubney3e65f522024-01-30 12:37:25 +00003199#endif
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003200 LOCAL_INPUT_FREE(input_external, input);
3201 LOCAL_INPUT_FREE(signature_external, signature);
3202
3203 return status;
gabor-mezei-arm4a210192021-04-14 21:14:28 +02003204}
3205
gabor-mezei-arm6883fd22021-05-05 14:18:36 +02003206psa_status_t psa_sign_hash_builtin(
Ronald Cron18659932020-12-08 16:32:23 +01003207 const psa_key_attributes_t *attributes,
3208 const uint8_t *key_buffer, size_t key_buffer_size,
3209 psa_algorithm_t alg, const uint8_t *hash, size_t hash_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003210 uint8_t *signature, size_t signature_size, size_t *signature_length)
Gilles Peskinee59236f2018-01-27 23:32:46 +01003211{
Gilles Peskine2f107ae2024-02-28 01:26:46 +01003212 if (attributes->type == PSA_KEY_TYPE_RSA_KEY_PAIR) {
Gilles Peskine449bd832023-01-11 14:50:10 +01003213 if (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) ||
3214 PSA_ALG_IS_RSA_PSS(alg)) {
Ronald Cron4501c982021-03-19 20:09:32 +01003215#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
Gilles Peskine449bd832023-01-11 14:50:10 +01003216 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
3217 return mbedtls_psa_rsa_sign_hash(
3218 attributes,
3219 key_buffer, key_buffer_size,
3220 alg, hash, hash_length,
3221 signature, signature_size, signature_length);
Ronald Cron4501c982021-03-19 20:09:32 +01003222#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
3223 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
Gilles Peskine449bd832023-01-11 14:50:10 +01003224 } else {
3225 return PSA_ERROR_INVALID_ARGUMENT;
Steven Cooremanacda8342020-07-24 23:09:52 +02003226 }
Gilles Peskine2f107ae2024-02-28 01:26:46 +01003227 } else if (PSA_KEY_TYPE_IS_ECC(attributes->type)) {
Gilles Peskine449bd832023-01-11 14:50:10 +01003228 if (PSA_ALG_IS_ECDSA(alg)) {
Ronald Cron4501c982021-03-19 20:09:32 +01003229#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
Gilles Peskine449bd832023-01-11 14:50:10 +01003230 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
3231 return mbedtls_psa_ecdsa_sign_hash(
3232 attributes,
3233 key_buffer, key_buffer_size,
3234 alg, hash, hash_length,
3235 signature, signature_size, signature_length);
Gilles Peskinee59236f2018-01-27 23:32:46 +01003236#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3237 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Gilles Peskine449bd832023-01-11 14:50:10 +01003238 } else {
3239 return PSA_ERROR_INVALID_ARGUMENT;
Ronald Cron4501c982021-03-19 20:09:32 +01003240 }
Ronald Cron8a494f32021-02-17 09:49:51 +01003241 }
Ronald Cron4501c982021-03-19 20:09:32 +01003242
Gilles Peskine449bd832023-01-11 14:50:10 +01003243 (void) key_buffer;
3244 (void) key_buffer_size;
3245 (void) hash;
3246 (void) hash_length;
3247 (void) signature;
3248 (void) signature_size;
3249 (void) signature_length;
Ronald Cron4501c982021-03-19 20:09:32 +01003250
Gilles Peskine449bd832023-01-11 14:50:10 +01003251 return PSA_ERROR_NOT_SUPPORTED;
Ronald Cron18659932020-12-08 16:32:23 +01003252}
Gilles Peskinee59236f2018-01-27 23:32:46 +01003253
Gilles Peskine449bd832023-01-11 14:50:10 +01003254psa_status_t psa_sign_hash(mbedtls_svc_key_id_t key,
3255 psa_algorithm_t alg,
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003256 const uint8_t *hash_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01003257 size_t hash_length,
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003258 uint8_t *signature_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01003259 size_t signature_size,
3260 size_t *signature_length)
Gilles Peskinee59236f2018-01-27 23:32:46 +01003261{
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003262 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3263 LOCAL_INPUT_DECLARE(hash_external, hash);
3264 LOCAL_OUTPUT_DECLARE(signature_external, signature);
3265
3266 LOCAL_INPUT_ALLOC(hash_external, hash_length, hash);
3267 LOCAL_OUTPUT_ALLOC(signature_external, signature_size, signature);
3268 status = psa_sign_internal(key, 0, alg, hash, hash_length, signature,
3269 signature_size, signature_length);
3270
David Horstmann4a48bec2024-03-13 15:42:31 +00003271#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003272exit:
Thomas Daubney3e65f522024-01-30 12:37:25 +00003273#endif
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003274 LOCAL_INPUT_FREE(hash_external, hash);
3275 LOCAL_OUTPUT_FREE(signature_external, signature);
3276
3277 return status;
itayzafrir5c753392018-05-08 11:18:38 +03003278}
3279
gabor-mezei-arm6883fd22021-05-05 14:18:36 +02003280psa_status_t psa_verify_hash_builtin(
Ronald Cron18659932020-12-08 16:32:23 +01003281 const psa_key_attributes_t *attributes,
3282 const uint8_t *key_buffer, size_t key_buffer_size,
3283 psa_algorithm_t alg, const uint8_t *hash, size_t hash_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003284 const uint8_t *signature, size_t signature_length)
itayzafrir5c753392018-05-08 11:18:38 +03003285{
Gilles Peskine2f107ae2024-02-28 01:26:46 +01003286 if (PSA_KEY_TYPE_IS_RSA(attributes->type)) {
Gilles Peskine449bd832023-01-11 14:50:10 +01003287 if (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) ||
3288 PSA_ALG_IS_RSA_PSS(alg)) {
Ronald Cron4501c982021-03-19 20:09:32 +01003289#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
Gilles Peskine449bd832023-01-11 14:50:10 +01003290 defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
3291 return mbedtls_psa_rsa_verify_hash(
3292 attributes,
3293 key_buffer, key_buffer_size,
3294 alg, hash, hash_length,
3295 signature, signature_length);
Ronald Cron4501c982021-03-19 20:09:32 +01003296#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
3297 * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
Gilles Peskine449bd832023-01-11 14:50:10 +01003298 } else {
3299 return PSA_ERROR_INVALID_ARGUMENT;
Steven Cooremanacda8342020-07-24 23:09:52 +02003300 }
Gilles Peskine2f107ae2024-02-28 01:26:46 +01003301 } else if (PSA_KEY_TYPE_IS_ECC(attributes->type)) {
Gilles Peskine449bd832023-01-11 14:50:10 +01003302 if (PSA_ALG_IS_ECDSA(alg)) {
Ronald Cron4501c982021-03-19 20:09:32 +01003303#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
Gilles Peskine449bd832023-01-11 14:50:10 +01003304 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
3305 return mbedtls_psa_ecdsa_verify_hash(
3306 attributes,
3307 key_buffer, key_buffer_size,
3308 alg, hash, hash_length,
3309 signature, signature_length);
Ronald Cron4501c982021-03-19 20:09:32 +01003310#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3311 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Gilles Peskine449bd832023-01-11 14:50:10 +01003312 } else {
3313 return PSA_ERROR_INVALID_ARGUMENT;
Ronald Cron4501c982021-03-19 20:09:32 +01003314 }
Ronald Cron8a494f32021-02-17 09:49:51 +01003315 }
Ronald Cron4501c982021-03-19 20:09:32 +01003316
Gilles Peskine449bd832023-01-11 14:50:10 +01003317 (void) key_buffer;
3318 (void) key_buffer_size;
3319 (void) hash;
3320 (void) hash_length;
3321 (void) signature;
3322 (void) signature_length;
Ronald Cron4501c982021-03-19 20:09:32 +01003323
Gilles Peskine449bd832023-01-11 14:50:10 +01003324 return PSA_ERROR_NOT_SUPPORTED;
Ronald Cron18659932020-12-08 16:32:23 +01003325}
3326
Gilles Peskine449bd832023-01-11 14:50:10 +01003327psa_status_t psa_verify_hash(mbedtls_svc_key_id_t key,
3328 psa_algorithm_t alg,
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003329 const uint8_t *hash_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01003330 size_t hash_length,
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003331 const uint8_t *signature_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01003332 size_t signature_length)
itayzafrir5c753392018-05-08 11:18:38 +03003333{
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003334 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3335 LOCAL_INPUT_DECLARE(hash_external, hash);
3336 LOCAL_INPUT_DECLARE(signature_external, signature);
3337
3338 LOCAL_INPUT_ALLOC(hash_external, hash_length, hash);
3339 LOCAL_INPUT_ALLOC(signature_external, signature_length, signature);
3340 status = psa_verify_internal(key, 0, alg, hash, hash_length, signature,
3341 signature_length);
3342
David Horstmann4a48bec2024-03-13 15:42:31 +00003343#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003344exit:
Thomas Daubney3e65f522024-01-30 12:37:25 +00003345#endif
Thomas Daubney4f8847b2024-01-18 17:23:02 +00003346 LOCAL_INPUT_FREE(hash_external, hash);
3347 LOCAL_INPUT_FREE(signature_external, signature);
3348
3349 return status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01003350}
3351
Gilles Peskine449bd832023-01-11 14:50:10 +01003352psa_status_t psa_asymmetric_encrypt(mbedtls_svc_key_id_t key,
3353 psa_algorithm_t alg,
Thomas Daubney6adbb2a2024-01-18 18:10:32 +00003354 const uint8_t *input_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01003355 size_t input_length,
Thomas Daubney6adbb2a2024-01-18 18:10:32 +00003356 const uint8_t *salt_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01003357 size_t salt_length,
Thomas Daubney6adbb2a2024-01-18 18:10:32 +00003358 uint8_t *output_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01003359 size_t output_size,
3360 size_t *output_length)
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003361{
Ronald Cronf95a2b12020-10-22 15:24:49 +02003362 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01003363 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01003364 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003365
Thomas Daubney6adbb2a2024-01-18 18:10:32 +00003366 LOCAL_INPUT_DECLARE(input_external, input);
3367 LOCAL_INPUT_DECLARE(salt_external, salt);
3368 LOCAL_OUTPUT_DECLARE(output_external, output);
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003369
Darryl Green5cc689a2018-07-24 15:34:10 +01003370 (void) input;
3371 (void) input_length;
3372 (void) salt;
3373 (void) output;
3374 (void) output_size;
3375
Nir Sonnenscheinca466c82018-06-04 16:43:12 +03003376 *output_length = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003377
Gilles Peskine449bd832023-01-11 14:50:10 +01003378 if (!PSA_ALG_IS_RSA_OAEP(alg) && salt_length != 0) {
3379 return PSA_ERROR_INVALID_ARGUMENT;
3380 }
Gilles Peskineb3fc05d2018-06-30 19:04:35 +02003381
Valerio Setti5bb454a2024-01-15 10:43:16 +01003382 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01003383 key, &slot, PSA_KEY_USAGE_ENCRYPT, alg);
3384 if (status != PSA_SUCCESS) {
3385 return status;
3386 }
3387 if (!(PSA_KEY_TYPE_IS_PUBLIC_KEY(slot->attr.type) ||
3388 PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type))) {
Ronald Cronf95a2b12020-10-22 15:24:49 +02003389 status = PSA_ERROR_INVALID_ARGUMENT;
3390 goto exit;
3391 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003392
Thomas Daubney6adbb2a2024-01-18 18:10:32 +00003393 LOCAL_INPUT_ALLOC(input_external, input_length, input);
3394 LOCAL_INPUT_ALLOC(salt_external, salt_length, salt);
3395 LOCAL_OUTPUT_ALLOC(output_external, output_size, output);
David Horstmann93fa4e12024-03-12 15:02:28 +00003396
Przemyslaw Stekiel19e61422021-12-09 11:09:11 +01003397 status = psa_driver_wrapper_asymmetric_encrypt(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01003398 &slot->attr, slot->key.data, slot->key.bytes,
Przemyslaw Stekiel19e61422021-12-09 11:09:11 +01003399 alg, input, input_length, salt, salt_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003400 output, output_size, output_length);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003401exit:
Ryan Everetta103ec92024-01-31 13:59:57 +00003402 unlock_status = psa_unregister_read_under_mutex(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003403
Thomas Daubney6adbb2a2024-01-18 18:10:32 +00003404 LOCAL_INPUT_FREE(input_external, input);
3405 LOCAL_INPUT_FREE(salt_external, salt);
3406 LOCAL_OUTPUT_FREE(output_external, output);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003407
Gilles Peskine449bd832023-01-11 14:50:10 +01003408 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskine5b051bc2018-05-31 13:25:48 +02003409}
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003410
Gilles Peskine449bd832023-01-11 14:50:10 +01003411psa_status_t psa_asymmetric_decrypt(mbedtls_svc_key_id_t key,
3412 psa_algorithm_t alg,
Thomas Daubney6adbb2a2024-01-18 18:10:32 +00003413 const uint8_t *input_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01003414 size_t input_length,
Thomas Daubney6adbb2a2024-01-18 18:10:32 +00003415 const uint8_t *salt_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01003416 size_t salt_length,
Thomas Daubney6adbb2a2024-01-18 18:10:32 +00003417 uint8_t *output_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01003418 size_t output_size,
3419 size_t *output_length)
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003420{
Ronald Cronf95a2b12020-10-22 15:24:49 +02003421 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01003422 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01003423 psa_key_slot_t *slot;
Gilles Peskineb0b255c2018-07-06 17:01:38 +02003424
Thomas Daubney6adbb2a2024-01-18 18:10:32 +00003425 LOCAL_INPUT_DECLARE(input_external, input);
3426 LOCAL_INPUT_DECLARE(salt_external, salt);
3427 LOCAL_OUTPUT_DECLARE(output_external, output);
3428
Darryl Green5cc689a2018-07-24 15:34:10 +01003429 (void) input;
3430 (void) input_length;
3431 (void) salt;
3432 (void) output;
3433 (void) output_size;
3434
Nir Sonnenscheinca466c82018-06-04 16:43:12 +03003435 *output_length = 0;
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003436
Gilles Peskine449bd832023-01-11 14:50:10 +01003437 if (!PSA_ALG_IS_RSA_OAEP(alg) && salt_length != 0) {
3438 return PSA_ERROR_INVALID_ARGUMENT;
3439 }
Gilles Peskineb3fc05d2018-06-30 19:04:35 +02003440
Valerio Setti5bb454a2024-01-15 10:43:16 +01003441 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01003442 key, &slot, PSA_KEY_USAGE_DECRYPT, alg);
3443 if (status != PSA_SUCCESS) {
3444 return status;
3445 }
3446 if (!PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type)) {
Ronald Cronf95a2b12020-10-22 15:24:49 +02003447 status = PSA_ERROR_INVALID_ARGUMENT;
3448 goto exit;
3449 }
Nir Sonnenschein39e59142018-05-02 23:16:26 +03003450
Thomas Daubney6adbb2a2024-01-18 18:10:32 +00003451 LOCAL_INPUT_ALLOC(input_external, input_length, input);
3452 LOCAL_INPUT_ALLOC(salt_external, salt_length, salt);
3453 LOCAL_OUTPUT_ALLOC(output_external, output_size, output);
David Horstmann93fa4e12024-03-12 15:02:28 +00003454
Przemyslaw Stekiel8d45c002021-12-13 08:58:19 +01003455 status = psa_driver_wrapper_asymmetric_decrypt(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01003456 &slot->attr, slot->key.data, slot->key.bytes,
Przemyslaw Stekiel8d45c002021-12-13 08:58:19 +01003457 alg, input, input_length, salt, salt_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01003458 output, output_size, output_length);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003459
3460exit:
Ryan Everetta103ec92024-01-31 13:59:57 +00003461 unlock_status = psa_unregister_read_under_mutex(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003462
Thomas Daubney6adbb2a2024-01-18 18:10:32 +00003463 LOCAL_INPUT_FREE(input_external, input);
3464 LOCAL_INPUT_FREE(salt_external, salt);
3465 LOCAL_OUTPUT_FREE(output_external, output);
Ronald Cronf95a2b12020-10-22 15:24:49 +02003466
Gilles Peskine449bd832023-01-11 14:50:10 +01003467 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskine5b051bc2018-05-31 13:25:48 +02003468}
Gilles Peskinee59236f2018-01-27 23:32:46 +01003469
Paul Elliott9fe12f62022-11-30 19:16:02 +00003470/****************************************************************/
3471/* Asymmetric interruptible cryptography */
3472/****************************************************************/
3473
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003474static uint32_t psa_interruptible_max_ops = PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED;
3475
Paul Elliott9fe12f62022-11-30 19:16:02 +00003476void psa_interruptible_set_max_ops(uint32_t max_ops)
3477{
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003478 psa_interruptible_max_ops = max_ops;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003479}
3480
3481uint32_t psa_interruptible_get_max_ops(void)
3482{
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003483 return psa_interruptible_max_ops;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003484}
3485
Paul Elliott9fe12f62022-11-30 19:16:02 +00003486uint32_t psa_sign_hash_get_num_ops(
3487 const psa_sign_hash_interruptible_operation_t *operation)
3488{
Paul Elliott296ede92022-12-15 17:00:30 +00003489 return operation->num_ops;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003490}
3491
3492uint32_t psa_verify_hash_get_num_ops(
3493 const psa_verify_hash_interruptible_operation_t *operation)
3494{
Paul Elliott296ede92022-12-15 17:00:30 +00003495 return operation->num_ops;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003496}
3497
Paul Elliott59ad9452022-12-18 15:09:02 +00003498static psa_status_t psa_sign_hash_abort_internal(
3499 psa_sign_hash_interruptible_operation_t *operation)
3500{
3501 if (operation->id == 0) {
3502 /* The object has (apparently) been initialized but it is not (yet)
3503 * in use. It's ok to call abort on such an object, and there's
3504 * nothing to do. */
3505 return PSA_SUCCESS;
3506 }
3507
3508 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3509
3510 status = psa_driver_wrapper_sign_hash_abort(operation);
3511
3512 operation->id = 0;
3513
Paul Elliotte6145dc2023-02-07 12:51:21 +00003514 /* Do not clear either the error_occurred or num_ops elements here as they
3515 * only want to be cleared by the application calling abort, not by abort
3516 * being called at completion of an operation. */
3517
Paul Elliott59ad9452022-12-18 15:09:02 +00003518 return status;
3519}
3520
Paul Elliott9fe12f62022-11-30 19:16:02 +00003521psa_status_t psa_sign_hash_start(
3522 psa_sign_hash_interruptible_operation_t *operation,
3523 mbedtls_svc_key_id_t key, psa_algorithm_t alg,
David Horstmann4a523a62024-03-11 13:32:16 +00003524 const uint8_t *hash_external, size_t hash_length)
Paul Elliott9fe12f62022-11-30 19:16:02 +00003525{
3526 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3527 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
3528 psa_key_slot_t *slot;
3529
David Horstmann4a523a62024-03-11 13:32:16 +00003530 LOCAL_INPUT_DECLARE(hash_external, hash);
3531
Paul Elliottc9774412023-02-06 15:14:07 +00003532 /* Check that start has not been previously called, or operation has not
3533 * previously errored. */
3534 if (operation->id != 0 || operation->error_occurred) {
Paul Elliott9fe12f62022-11-30 19:16:02 +00003535 return PSA_ERROR_BAD_STATE;
3536 }
3537
Paul Elliott9fe12f62022-11-30 19:16:02 +00003538 status = psa_sign_verify_check_alg(0, alg);
3539 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003540 operation->error_occurred = 1;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003541 return status;
3542 }
3543
3544 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
3545 PSA_KEY_USAGE_SIGN_HASH,
3546 alg);
3547
3548 if (status != PSA_SUCCESS) {
3549 goto exit;
3550 }
3551
3552 if (!PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type)) {
3553 status = PSA_ERROR_INVALID_ARGUMENT;
3554 goto exit;
3555 }
3556
David Horstmann4a523a62024-03-11 13:32:16 +00003557 LOCAL_INPUT_ALLOC(hash_external, hash_length, hash);
3558
Paul Elliott296ede92022-12-15 17:00:30 +00003559 /* Ensure ops count gets reset, in case of operation re-use. */
3560 operation->num_ops = 0;
3561
Gilles Peskine7a5d9202024-02-28 01:18:23 +01003562 status = psa_driver_wrapper_sign_hash_start(operation, &slot->attr,
Paul Elliott9fe12f62022-11-30 19:16:02 +00003563 slot->key.data,
3564 slot->key.bytes, alg,
3565 hash, hash_length);
3566exit:
3567
3568 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003569 operation->error_occurred = 1;
Paul Elliott59ad9452022-12-18 15:09:02 +00003570 psa_sign_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003571 }
3572
Ryan Everettdcc03d52024-02-14 15:44:13 +00003573 unlock_status = psa_unregister_read_under_mutex(slot);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003574
Paul Elliottc9774412023-02-06 15:14:07 +00003575 if (unlock_status != PSA_SUCCESS) {
3576 operation->error_occurred = 1;
3577 }
Paul Elliott9fe12f62022-11-30 19:16:02 +00003578
David Horstmann4a523a62024-03-11 13:32:16 +00003579 LOCAL_INPUT_FREE(hash_external, hash);
3580
Paul Elliottc9774412023-02-06 15:14:07 +00003581 return (status == PSA_SUCCESS) ? unlock_status : status;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003582}
3583
3584
3585psa_status_t psa_sign_hash_complete(
3586 psa_sign_hash_interruptible_operation_t *operation,
David Horstmann4a523a62024-03-11 13:32:16 +00003587 uint8_t *signature_external, size_t signature_size,
Paul Elliott9fe12f62022-11-30 19:16:02 +00003588 size_t *signature_length)
3589{
3590 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3591
David Horstmann4a523a62024-03-11 13:32:16 +00003592 LOCAL_OUTPUT_DECLARE(signature_external, signature);
3593
Paul Elliott9fe12f62022-11-30 19:16:02 +00003594 *signature_length = 0;
3595
Paul Elliottc9774412023-02-06 15:14:07 +00003596 /* Check that start has been called first, and that operation has not
3597 * previously errored. */
3598 if (operation->id == 0 || operation->error_occurred) {
Paul Elliott9fe12f62022-11-30 19:16:02 +00003599 status = PSA_ERROR_BAD_STATE;
3600 goto exit;
3601 }
3602
Paul Elliott096abc42023-02-03 18:33:23 +00003603 /* Immediately reject a zero-length signature buffer. This guarantees that
3604 * signature must be a valid pointer. */
Paul Elliott9fe12f62022-11-30 19:16:02 +00003605 if (signature_size == 0) {
3606 status = PSA_ERROR_BUFFER_TOO_SMALL;
3607 goto exit;
3608 }
3609
David Horstmann4a523a62024-03-11 13:32:16 +00003610 LOCAL_OUTPUT_ALLOC(signature_external, signature_size, signature);
3611
Paul Elliott9fe12f62022-11-30 19:16:02 +00003612 status = psa_driver_wrapper_sign_hash_complete(operation, signature,
3613 signature_size,
3614 signature_length);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003615
Paul Elliott296ede92022-12-15 17:00:30 +00003616 /* Update ops count with work done. */
Paul Elliottde1114c2023-02-07 12:43:11 +00003617 operation->num_ops = psa_driver_wrapper_sign_hash_get_num_ops(operation);
Paul Elliott296ede92022-12-15 17:00:30 +00003618
Paul Elliottebe225c2023-02-10 14:32:53 +00003619exit:
3620
David Horstmannc5064c82024-03-11 17:02:03 +00003621 if (signature != NULL) {
3622 psa_wipe_tag_output_buffer(signature, status, signature_size,
3623 *signature_length);
3624 }
Paul Elliott9fe12f62022-11-30 19:16:02 +00003625
Paul Elliott53bb3122023-02-10 14:22:22 +00003626 if (status != PSA_OPERATION_INCOMPLETE) {
Paul Elliottc9774412023-02-06 15:14:07 +00003627 if (status != PSA_SUCCESS) {
3628 operation->error_occurred = 1;
3629 }
3630
Paul Elliott59ad9452022-12-18 15:09:02 +00003631 psa_sign_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003632 }
3633
David Horstmann4a523a62024-03-11 13:32:16 +00003634 LOCAL_OUTPUT_FREE(signature_external, signature);
3635
Paul Elliott9fe12f62022-11-30 19:16:02 +00003636 return status;
3637}
3638
3639psa_status_t psa_sign_hash_abort(
3640 psa_sign_hash_interruptible_operation_t *operation)
3641{
Paul Elliott59ad9452022-12-18 15:09:02 +00003642 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3643
3644 status = psa_sign_hash_abort_internal(operation);
3645
3646 /* We clear the number of ops done here, so that it is not cleared when
3647 * the operation fails or succeeds, only on manual abort. */
3648 operation->num_ops = 0;
3649
Paul Elliottc9774412023-02-06 15:14:07 +00003650 /* Likewise, failure state. */
3651 operation->error_occurred = 0;
3652
Paul Elliott59ad9452022-12-18 15:09:02 +00003653 return status;
3654}
3655
3656static psa_status_t psa_verify_hash_abort_internal(
3657 psa_verify_hash_interruptible_operation_t *operation)
3658{
Paul Elliott9fe12f62022-11-30 19:16:02 +00003659 if (operation->id == 0) {
3660 /* The object has (apparently) been initialized but it is not (yet)
3661 * in use. It's ok to call abort on such an object, and there's
3662 * nothing to do. */
3663 return PSA_SUCCESS;
3664 }
3665
Paul Elliott59ad9452022-12-18 15:09:02 +00003666 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3667
3668 status = psa_driver_wrapper_verify_hash_abort(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003669
3670 operation->id = 0;
3671
Paul Elliotte6145dc2023-02-07 12:51:21 +00003672 /* Do not clear either the error_occurred or num_ops elements here as they
3673 * only want to be cleared by the application calling abort, not by abort
3674 * being called at completion of an operation. */
3675
Paul Elliott59ad9452022-12-18 15:09:02 +00003676 return status;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003677}
3678
3679psa_status_t psa_verify_hash_start(
3680 psa_verify_hash_interruptible_operation_t *operation,
3681 mbedtls_svc_key_id_t key, psa_algorithm_t alg,
David Horstmann0fea6a52024-03-11 13:41:05 +00003682 const uint8_t *hash_external, size_t hash_length,
3683 const uint8_t *signature_external, size_t signature_length)
Paul Elliott9fe12f62022-11-30 19:16:02 +00003684{
3685 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3686 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
3687 psa_key_slot_t *slot;
3688
David Horstmann0fea6a52024-03-11 13:41:05 +00003689 LOCAL_INPUT_DECLARE(hash_external, hash);
3690 LOCAL_INPUT_DECLARE(signature_external, signature);
3691
Paul Elliottc9774412023-02-06 15:14:07 +00003692 /* Check that start has not been previously called, or operation has not
3693 * previously errored. */
3694 if (operation->id != 0 || operation->error_occurred) {
Paul Elliott9fe12f62022-11-30 19:16:02 +00003695 return PSA_ERROR_BAD_STATE;
3696 }
3697
3698 status = psa_sign_verify_check_alg(0, alg);
3699 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003700 operation->error_occurred = 1;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003701 return status;
3702 }
3703
3704 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
3705 PSA_KEY_USAGE_VERIFY_HASH,
3706 alg);
3707
3708 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003709 operation->error_occurred = 1;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003710 return status;
3711 }
3712
David Horstmann0fea6a52024-03-11 13:41:05 +00003713 LOCAL_INPUT_ALLOC(hash_external, hash_length, hash);
3714 LOCAL_INPUT_ALLOC(signature_external, signature_length, signature);
3715
Paul Elliott296ede92022-12-15 17:00:30 +00003716 /* Ensure ops count gets reset, in case of operation re-use. */
3717 operation->num_ops = 0;
3718
Gilles Peskine7a5d9202024-02-28 01:18:23 +01003719 status = psa_driver_wrapper_verify_hash_start(operation, &slot->attr,
Paul Elliott9fe12f62022-11-30 19:16:02 +00003720 slot->key.data,
3721 slot->key.bytes,
3722 alg, hash, hash_length,
3723 signature, signature_length);
David Horstmann4a48bec2024-03-13 15:42:31 +00003724#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
David Horstmann0fea6a52024-03-11 13:41:05 +00003725exit:
3726#endif
Paul Elliott9fe12f62022-11-30 19:16:02 +00003727
3728 if (status != PSA_SUCCESS) {
Paul Elliottc9774412023-02-06 15:14:07 +00003729 operation->error_occurred = 1;
Paul Elliott59ad9452022-12-18 15:09:02 +00003730 psa_verify_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003731 }
3732
Ryan Everett291267f2024-02-14 15:59:15 +00003733 unlock_status = psa_unregister_read_under_mutex(slot);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003734
Paul Elliottc9774412023-02-06 15:14:07 +00003735 if (unlock_status != PSA_SUCCESS) {
3736 operation->error_occurred = 1;
3737 }
Paul Elliott9fe12f62022-11-30 19:16:02 +00003738
David Horstmann0fea6a52024-03-11 13:41:05 +00003739 LOCAL_INPUT_FREE(hash_external, hash);
3740 LOCAL_INPUT_FREE(signature_external, signature);
3741
Paul Elliottc9774412023-02-06 15:14:07 +00003742 return (status == PSA_SUCCESS) ? unlock_status : status;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003743}
3744
3745psa_status_t psa_verify_hash_complete(
3746 psa_verify_hash_interruptible_operation_t *operation)
3747{
3748 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
3749
Paul Elliottc9774412023-02-06 15:14:07 +00003750 /* Check that start has been called first, and that operation has not
3751 * previously errored. */
3752 if (operation->id == 0 || operation->error_occurred) {
Paul Elliott9fe12f62022-11-30 19:16:02 +00003753 status = PSA_ERROR_BAD_STATE;
3754 goto exit;
3755 }
3756
3757 status = psa_driver_wrapper_verify_hash_complete(operation);
3758
Paul Elliott296ede92022-12-15 17:00:30 +00003759 /* Update ops count with work done. */
Paul Elliottde1114c2023-02-07 12:43:11 +00003760 operation->num_ops = psa_driver_wrapper_verify_hash_get_num_ops(
Paul Elliott296ede92022-12-15 17:00:30 +00003761 operation);
3762
Paul Elliottebe225c2023-02-10 14:32:53 +00003763exit:
3764
Paul Elliott9fe12f62022-11-30 19:16:02 +00003765 if (status != PSA_OPERATION_INCOMPLETE) {
Paul Elliottc9774412023-02-06 15:14:07 +00003766 if (status != PSA_SUCCESS) {
3767 operation->error_occurred = 1;
3768 }
3769
Paul Elliott59ad9452022-12-18 15:09:02 +00003770 psa_verify_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003771 }
3772
3773 return status;
3774}
3775
3776psa_status_t psa_verify_hash_abort(
3777 psa_verify_hash_interruptible_operation_t *operation)
3778{
Paul Elliott59ad9452022-12-18 15:09:02 +00003779 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003780
Paul Elliott59ad9452022-12-18 15:09:02 +00003781 status = psa_verify_hash_abort_internal(operation);
Paul Elliott9fe12f62022-11-30 19:16:02 +00003782
Paul Elliott59ad9452022-12-18 15:09:02 +00003783 /* We clear the number of ops done here, so that it is not cleared when
3784 * the operation fails or succeeds, only on manual abort. */
3785 operation->num_ops = 0;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003786
Paul Elliottc9774412023-02-06 15:14:07 +00003787 /* Likewise, failure state. */
3788 operation->error_occurred = 0;
3789
Paul Elliott59ad9452022-12-18 15:09:02 +00003790 return status;
Paul Elliott9fe12f62022-11-30 19:16:02 +00003791}
3792
Paul Elliott588f8ed2022-12-02 18:10:26 +00003793/****************************************************************/
3794/* Asymmetric interruptible cryptography internal */
3795/* implementations */
3796/****************************************************************/
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02003797
Paul Elliott588f8ed2022-12-02 18:10:26 +00003798void mbedtls_psa_interruptible_set_max_ops(uint32_t max_ops)
3799{
Paul Elliott7cc4e812023-01-10 17:14:11 +00003800
Paul Elliott588f8ed2022-12-02 18:10:26 +00003801#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3802 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3803 defined(MBEDTLS_ECP_RESTARTABLE)
3804
3805 /* Internal implementation uses zero to indicate infinite number max ops,
3806 * therefore avoid this value, and set to minimum possible. */
3807 if (max_ops == 0) {
3808 max_ops = 1;
3809 }
3810
Paul Elliott588f8ed2022-12-02 18:10:26 +00003811 mbedtls_ecp_set_max_ops(max_ops);
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003812#else
3813 (void) max_ops;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003814#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3815 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3816 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3817}
3818
Paul Elliott588f8ed2022-12-02 18:10:26 +00003819uint32_t mbedtls_psa_sign_hash_get_num_ops(
Paul Elliottf8e5b562023-02-19 18:43:45 +00003820 const mbedtls_psa_sign_hash_interruptible_operation_t *operation)
Paul Elliott588f8ed2022-12-02 18:10:26 +00003821{
3822#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3823 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3824 defined(MBEDTLS_ECP_RESTARTABLE)
3825
Paul Elliott93d9ca82023-02-15 18:14:21 +00003826 return operation->num_ops;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003827#else
3828 (void) operation;
3829 return 0;
3830#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3831 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3832 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3833}
3834
3835uint32_t mbedtls_psa_verify_hash_get_num_ops(
Paul Elliottf8e5b562023-02-19 18:43:45 +00003836 const mbedtls_psa_verify_hash_interruptible_operation_t *operation)
Paul Elliott588f8ed2022-12-02 18:10:26 +00003837{
3838 #if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3839 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3840 defined(MBEDTLS_ECP_RESTARTABLE)
3841
Paul Elliott93d9ca82023-02-15 18:14:21 +00003842 return operation->num_ops;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003843#else
3844 (void) operation;
3845 return 0;
3846#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3847 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3848 * defined( MBEDTLS_ECP_RESTARTABLE ) */
3849}
3850
3851psa_status_t mbedtls_psa_sign_hash_start(
3852 mbedtls_psa_sign_hash_interruptible_operation_t *operation,
3853 const psa_key_attributes_t *attributes, const uint8_t *key_buffer,
3854 size_t key_buffer_size, psa_algorithm_t alg,
3855 const uint8_t *hash, size_t hash_length)
3856{
3857 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott0290a762023-02-09 14:30:24 +00003858 size_t required_hash_length;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003859
Gilles Peskine2f107ae2024-02-28 01:26:46 +01003860 if (!PSA_KEY_TYPE_IS_ECC(attributes->type)) {
Paul Elliott068fe072023-01-16 13:59:15 +00003861 return PSA_ERROR_NOT_SUPPORTED;
3862 }
3863
3864 if (!PSA_ALG_IS_ECDSA(alg)) {
Paul Elliott813f9cd2023-02-05 15:28:46 +00003865 return PSA_ERROR_NOT_SUPPORTED;
Paul Elliott068fe072023-01-16 13:59:15 +00003866 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003867
3868#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
Paul Elliott068fe072023-01-16 13:59:15 +00003869 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3870 defined(MBEDTLS_ECP_RESTARTABLE)
Paul Elliott588f8ed2022-12-02 18:10:26 +00003871
Paul Elliotta1c94092023-02-15 16:38:04 +00003872 mbedtls_ecdsa_restart_init(&operation->restart_ctx);
3873
Paul Elliott93d9ca82023-02-15 18:14:21 +00003874 /* Ensure num_ops is zero'ed in case of context re-use. */
3875 operation->num_ops = 0;
3876
Gilles Peskine2f107ae2024-02-28 01:26:46 +01003877 status = mbedtls_psa_ecp_load_representation(attributes->type,
3878 attributes->bits,
Paul Elliott068fe072023-01-16 13:59:15 +00003879 key_buffer,
3880 key_buffer_size,
3881 &operation->ctx);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003882
Paul Elliott068fe072023-01-16 13:59:15 +00003883 if (status != PSA_SUCCESS) {
3884 return status;
3885 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00003886
Paul Elliott1bc59df2023-02-05 13:41:57 +00003887 operation->coordinate_bytes = PSA_BITS_TO_BYTES(
Paul Elliottc569fc22023-02-10 13:02:54 +00003888 operation->ctx->grp.nbits);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003889
Paul Elliott068fe072023-01-16 13:59:15 +00003890 psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH(alg);
Manuel Pégourié-Gonnard2d6d9932023-03-28 11:38:08 +02003891 operation->md_alg = mbedtls_md_type_from_psa_alg(hash_alg);
Paul Elliott068fe072023-01-16 13:59:15 +00003892 operation->alg = alg;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003893
Paul Elliott0290a762023-02-09 14:30:24 +00003894 /* We only need to store the same length of hash as the private key size
3895 * here, it would be truncated by the internal implementation anyway. */
3896 required_hash_length = (hash_length < operation->coordinate_bytes ?
3897 hash_length : operation->coordinate_bytes);
3898
Paul Elliottba70ad42023-02-15 18:23:53 +00003899 if (required_hash_length > sizeof(operation->hash)) {
3900 /* Shouldn't happen, but better safe than sorry. */
3901 return PSA_ERROR_CORRUPTION_DETECTED;
3902 }
3903
Paul Elliott0290a762023-02-09 14:30:24 +00003904 memcpy(operation->hash, hash, required_hash_length);
3905 operation->hash_length = required_hash_length;
Paul Elliott068fe072023-01-16 13:59:15 +00003906
3907 return PSA_SUCCESS;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003908
3909#else
Paul Elliott068fe072023-01-16 13:59:15 +00003910 (void) operation;
3911 (void) key_buffer;
3912 (void) key_buffer_size;
3913 (void) alg;
3914 (void) hash;
3915 (void) hash_length;
3916 (void) status;
Paul Elliott0290a762023-02-09 14:30:24 +00003917 (void) required_hash_length;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003918
Paul Elliott068fe072023-01-16 13:59:15 +00003919 return PSA_ERROR_NOT_SUPPORTED;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003920#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3921 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
3922 * defined( MBEDTLS_ECP_RESTARTABLE ) */
Paul Elliott588f8ed2022-12-02 18:10:26 +00003923}
3924
3925psa_status_t mbedtls_psa_sign_hash_complete(
3926 mbedtls_psa_sign_hash_interruptible_operation_t *operation,
3927 uint8_t *signature, size_t signature_size,
3928 size_t *signature_length)
3929{
Paul Elliott588f8ed2022-12-02 18:10:26 +00003930#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3931 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
3932 defined(MBEDTLS_ECP_RESTARTABLE)
3933
Paul Elliotta1c94092023-02-15 16:38:04 +00003934 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott1243f932023-02-07 11:21:10 +00003935 mbedtls_mpi r;
3936 mbedtls_mpi s;
3937
Paul Elliott46845252023-02-03 14:59:11 +00003938 mbedtls_mpi_init(&r);
3939 mbedtls_mpi_init(&s);
Paul Elliott588f8ed2022-12-02 18:10:26 +00003940
Paul Elliotta16ce9f2023-02-21 14:19:23 +00003941 /* Ensure max_ops is set to the current value (or default). */
3942 mbedtls_psa_interruptible_set_max_ops(psa_interruptible_get_max_ops());
3943
Paul Elliotta1c94092023-02-15 16:38:04 +00003944 if (signature_size < 2 * operation->coordinate_bytes) {
3945 status = PSA_ERROR_BUFFER_TOO_SMALL;
3946 goto exit;
3947 }
3948
Paul Elliott588f8ed2022-12-02 18:10:26 +00003949 if (PSA_ALG_ECDSA_IS_DETERMINISTIC(operation->alg)) {
Paul Elliott46845252023-02-03 14:59:11 +00003950
Paul Elliott588f8ed2022-12-02 18:10:26 +00003951#if defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
3952 status = mbedtls_to_psa_error(
3953 mbedtls_ecdsa_sign_det_restartable(&operation->ctx->grp,
Paul Elliott46845252023-02-03 14:59:11 +00003954 &r,
3955 &s,
Paul Elliott588f8ed2022-12-02 18:10:26 +00003956 &operation->ctx->d,
3957 operation->hash,
3958 operation->hash_length,
3959 operation->md_alg,
3960 mbedtls_psa_get_random,
3961 MBEDTLS_PSA_RANDOM_STATE,
3962 &operation->restart_ctx));
3963#else /* defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Paul Elliott724bd252023-02-08 12:35:08 +00003964 status = PSA_ERROR_NOT_SUPPORTED;
3965 goto exit;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003966#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
3967 } else {
Paul Elliott588f8ed2022-12-02 18:10:26 +00003968 status = mbedtls_to_psa_error(
3969 mbedtls_ecdsa_sign_restartable(&operation->ctx->grp,
Paul Elliott46845252023-02-03 14:59:11 +00003970 &r,
3971 &s,
Paul Elliott588f8ed2022-12-02 18:10:26 +00003972 &operation->ctx->d,
3973 operation->hash,
3974 operation->hash_length,
3975 mbedtls_psa_get_random,
3976 MBEDTLS_PSA_RANDOM_STATE,
3977 mbedtls_psa_get_random,
3978 MBEDTLS_PSA_RANDOM_STATE,
3979 &operation->restart_ctx));
3980 }
3981
Paul Elliottf8e5b562023-02-19 18:43:45 +00003982 /* Hide the fact that the restart context only holds a delta of number of
3983 * ops done during the last operation, not an absolute value. */
3984 operation->num_ops += operation->restart_ctx.ecp.ops_done;
3985
Paul Elliott724bd252023-02-08 12:35:08 +00003986 if (status == PSA_SUCCESS) {
Paul Elliott588f8ed2022-12-02 18:10:26 +00003987 status = mbedtls_to_psa_error(
Paul Elliott46845252023-02-03 14:59:11 +00003988 mbedtls_mpi_write_binary(&r,
Paul Elliott588f8ed2022-12-02 18:10:26 +00003989 signature,
Paul Elliott1bc59df2023-02-05 13:41:57 +00003990 operation->coordinate_bytes)
3991 );
Paul Elliott588f8ed2022-12-02 18:10:26 +00003992
3993 if (status != PSA_SUCCESS) {
Paul Elliott724bd252023-02-08 12:35:08 +00003994 goto exit;
Paul Elliott588f8ed2022-12-02 18:10:26 +00003995 }
3996
3997 status = mbedtls_to_psa_error(
Paul Elliott46845252023-02-03 14:59:11 +00003998 mbedtls_mpi_write_binary(&s,
Paul Elliott588f8ed2022-12-02 18:10:26 +00003999 signature +
Paul Elliott1bc59df2023-02-05 13:41:57 +00004000 operation->coordinate_bytes,
4001 operation->coordinate_bytes)
4002 );
Paul Elliott588f8ed2022-12-02 18:10:26 +00004003
4004 if (status != PSA_SUCCESS) {
Paul Elliott724bd252023-02-08 12:35:08 +00004005 goto exit;
Paul Elliott588f8ed2022-12-02 18:10:26 +00004006 }
4007
Paul Elliott1bc59df2023-02-05 13:41:57 +00004008 *signature_length = operation->coordinate_bytes * 2;
Paul Elliott588f8ed2022-12-02 18:10:26 +00004009
Paul Elliott724bd252023-02-08 12:35:08 +00004010 status = PSA_SUCCESS;
Paul Elliott588f8ed2022-12-02 18:10:26 +00004011 }
Paul Elliott724bd252023-02-08 12:35:08 +00004012
4013exit:
4014
4015 mbedtls_mpi_free(&r);
4016 mbedtls_mpi_free(&s);
4017 return status;
4018
Paul Elliott588f8ed2022-12-02 18:10:26 +00004019 #else
4020
4021 (void) operation;
Paul Elliott588f8ed2022-12-02 18:10:26 +00004022 (void) signature;
4023 (void) signature_size;
4024 (void) signature_length;
4025
4026 return PSA_ERROR_NOT_SUPPORTED;
4027
4028#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
4029 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
4030 * defined( MBEDTLS_ECP_RESTARTABLE ) */
4031}
4032
4033psa_status_t mbedtls_psa_sign_hash_abort(
4034 mbedtls_psa_sign_hash_interruptible_operation_t *operation)
4035{
4036
4037#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
4038 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
4039 defined(MBEDTLS_ECP_RESTARTABLE)
4040
4041 if (operation->ctx) {
4042 mbedtls_ecdsa_free(operation->ctx);
4043 mbedtls_free(operation->ctx);
Paul Elliottf9c91a72023-02-05 18:06:38 +00004044 operation->ctx = NULL;
Paul Elliott588f8ed2022-12-02 18:10:26 +00004045 }
4046
4047 mbedtls_ecdsa_restart_free(&operation->restart_ctx);
4048
Paul Elliott93d9ca82023-02-15 18:14:21 +00004049 operation->num_ops = 0;
4050
Paul Elliott588f8ed2022-12-02 18:10:26 +00004051 return PSA_SUCCESS;
4052
4053#else
4054
4055 (void) operation;
4056
4057 return PSA_ERROR_NOT_SUPPORTED;
4058
4059#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
4060 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
4061 * defined( MBEDTLS_ECP_RESTARTABLE ) */
4062}
4063
4064psa_status_t mbedtls_psa_verify_hash_start(
4065 mbedtls_psa_verify_hash_interruptible_operation_t *operation,
4066 const psa_key_attributes_t *attributes,
4067 const uint8_t *key_buffer, size_t key_buffer_size,
4068 psa_algorithm_t alg,
4069 const uint8_t *hash, size_t hash_length,
4070 const uint8_t *signature, size_t signature_length)
4071{
4072 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott1bc59df2023-02-05 13:41:57 +00004073 size_t coordinate_bytes = 0;
Paul Elliott0290a762023-02-09 14:30:24 +00004074 size_t required_hash_length = 0;
Paul Elliott588f8ed2022-12-02 18:10:26 +00004075
Gilles Peskine2f107ae2024-02-28 01:26:46 +01004076 if (!PSA_KEY_TYPE_IS_ECC(attributes->type)) {
Paul Elliott068fe072023-01-16 13:59:15 +00004077 return PSA_ERROR_NOT_SUPPORTED;
4078 }
4079
4080 if (!PSA_ALG_IS_ECDSA(alg)) {
Paul Elliott813f9cd2023-02-05 15:28:46 +00004081 return PSA_ERROR_NOT_SUPPORTED;
Paul Elliott068fe072023-01-16 13:59:15 +00004082 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00004083
4084#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
Paul Elliott068fe072023-01-16 13:59:15 +00004085 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
4086 defined(MBEDTLS_ECP_RESTARTABLE)
Paul Elliott588f8ed2022-12-02 18:10:26 +00004087
Paul Elliotta1c94092023-02-15 16:38:04 +00004088 mbedtls_ecdsa_restart_init(&operation->restart_ctx);
4089 mbedtls_mpi_init(&operation->r);
4090 mbedtls_mpi_init(&operation->s);
4091
Paul Elliott93d9ca82023-02-15 18:14:21 +00004092 /* Ensure num_ops is zero'ed in case of context re-use. */
4093 operation->num_ops = 0;
4094
Gilles Peskine2f107ae2024-02-28 01:26:46 +01004095 status = mbedtls_psa_ecp_load_representation(attributes->type,
4096 attributes->bits,
Paul Elliott068fe072023-01-16 13:59:15 +00004097 key_buffer,
4098 key_buffer_size,
4099 &operation->ctx);
Paul Elliott588f8ed2022-12-02 18:10:26 +00004100
Paul Elliott068fe072023-01-16 13:59:15 +00004101 if (status != PSA_SUCCESS) {
4102 return status;
4103 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00004104
Paul Elliottc569fc22023-02-10 13:02:54 +00004105 coordinate_bytes = PSA_BITS_TO_BYTES(operation->ctx->grp.nbits);
Paul Elliott588f8ed2022-12-02 18:10:26 +00004106
Paul Elliott1bc59df2023-02-05 13:41:57 +00004107 if (signature_length != 2 * coordinate_bytes) {
Paul Elliott068fe072023-01-16 13:59:15 +00004108 return PSA_ERROR_INVALID_SIGNATURE;
4109 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00004110
Paul Elliott068fe072023-01-16 13:59:15 +00004111 status = mbedtls_to_psa_error(
4112 mbedtls_mpi_read_binary(&operation->r,
4113 signature,
Paul Elliott1bc59df2023-02-05 13:41:57 +00004114 coordinate_bytes));
Paul Elliott588f8ed2022-12-02 18:10:26 +00004115
Paul Elliott068fe072023-01-16 13:59:15 +00004116 if (status != PSA_SUCCESS) {
4117 return status;
4118 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00004119
Paul Elliott068fe072023-01-16 13:59:15 +00004120 status = mbedtls_to_psa_error(
4121 mbedtls_mpi_read_binary(&operation->s,
4122 signature +
Paul Elliott1bc59df2023-02-05 13:41:57 +00004123 coordinate_bytes,
4124 coordinate_bytes));
Paul Elliott588f8ed2022-12-02 18:10:26 +00004125
Paul Elliott068fe072023-01-16 13:59:15 +00004126 if (status != PSA_SUCCESS) {
4127 return status;
4128 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00004129
Paul Elliott2c9843f2023-02-15 17:32:42 +00004130 status = mbedtls_psa_ecp_load_public_part(operation->ctx);
Paul Elliott588f8ed2022-12-02 18:10:26 +00004131
Paul Elliott2c9843f2023-02-15 17:32:42 +00004132 if (status != PSA_SUCCESS) {
4133 return status;
Paul Elliott068fe072023-01-16 13:59:15 +00004134 }
Paul Elliott588f8ed2022-12-02 18:10:26 +00004135
Paul Elliott0290a762023-02-09 14:30:24 +00004136 /* We only need to store the same length of hash as the private key size
4137 * here, it would be truncated by the internal implementation anyway. */
4138 required_hash_length = (hash_length < coordinate_bytes ? hash_length :
4139 coordinate_bytes);
4140
Paul Elliottba70ad42023-02-15 18:23:53 +00004141 if (required_hash_length > sizeof(operation->hash)) {
4142 /* Shouldn't happen, but better safe than sorry. */
4143 return PSA_ERROR_CORRUPTION_DETECTED;
4144 }
4145
Paul Elliott0290a762023-02-09 14:30:24 +00004146 memcpy(operation->hash, hash, required_hash_length);
4147 operation->hash_length = required_hash_length;
Paul Elliott068fe072023-01-16 13:59:15 +00004148
4149 return PSA_SUCCESS;
Paul Elliott588f8ed2022-12-02 18:10:26 +00004150#else
Paul Elliott068fe072023-01-16 13:59:15 +00004151 (void) operation;
4152 (void) key_buffer;
4153 (void) key_buffer_size;
4154 (void) alg;
4155 (void) hash;
4156 (void) hash_length;
4157 (void) signature;
4158 (void) signature_length;
4159 (void) status;
Paul Elliott1243f932023-02-07 11:21:10 +00004160 (void) coordinate_bytes;
Paul Elliott0290a762023-02-09 14:30:24 +00004161 (void) required_hash_length;
Paul Elliott588f8ed2022-12-02 18:10:26 +00004162
Paul Elliott068fe072023-01-16 13:59:15 +00004163 return PSA_ERROR_NOT_SUPPORTED;
Paul Elliott588f8ed2022-12-02 18:10:26 +00004164#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
4165 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
4166 * defined( MBEDTLS_ECP_RESTARTABLE ) */
Paul Elliott588f8ed2022-12-02 18:10:26 +00004167}
4168
4169psa_status_t mbedtls_psa_verify_hash_complete(
4170 mbedtls_psa_verify_hash_interruptible_operation_t *operation)
4171{
4172
4173#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
4174 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
4175 defined(MBEDTLS_ECP_RESTARTABLE)
4176
Paul Elliottf8e5b562023-02-19 18:43:45 +00004177 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4178
Paul Elliotta16ce9f2023-02-21 14:19:23 +00004179 /* Ensure max_ops is set to the current value (or default). */
4180 mbedtls_psa_interruptible_set_max_ops(psa_interruptible_get_max_ops());
4181
Paul Elliottf8e5b562023-02-19 18:43:45 +00004182 status = mbedtls_to_psa_error(
Paul Elliott588f8ed2022-12-02 18:10:26 +00004183 mbedtls_ecdsa_verify_restartable(&operation->ctx->grp,
4184 operation->hash,
4185 operation->hash_length,
4186 &operation->ctx->Q,
4187 &operation->r,
4188 &operation->s,
4189 &operation->restart_ctx));
4190
Paul Elliottf8e5b562023-02-19 18:43:45 +00004191 /* Hide the fact that the restart context only holds a delta of number of
4192 * ops done during the last operation, not an absolute value. */
4193 operation->num_ops += operation->restart_ctx.ecp.ops_done;
4194
4195 return status;
Paul Elliott588f8ed2022-12-02 18:10:26 +00004196#else
4197 (void) operation;
4198
4199 return PSA_ERROR_NOT_SUPPORTED;
4200
4201#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
4202 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
4203 * defined( MBEDTLS_ECP_RESTARTABLE ) */
4204}
4205
4206psa_status_t mbedtls_psa_verify_hash_abort(
4207 mbedtls_psa_verify_hash_interruptible_operation_t *operation)
4208{
4209
4210#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
4211 defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \
4212 defined(MBEDTLS_ECP_RESTARTABLE)
4213
4214 if (operation->ctx) {
4215 mbedtls_ecdsa_free(operation->ctx);
4216 mbedtls_free(operation->ctx);
Paul Elliottf9c91a72023-02-05 18:06:38 +00004217 operation->ctx = NULL;
Paul Elliott588f8ed2022-12-02 18:10:26 +00004218 }
4219
4220 mbedtls_ecdsa_restart_free(&operation->restart_ctx);
4221
Paul Elliott93d9ca82023-02-15 18:14:21 +00004222 operation->num_ops = 0;
4223
Paul Elliott588f8ed2022-12-02 18:10:26 +00004224 mbedtls_mpi_free(&operation->r);
4225 mbedtls_mpi_free(&operation->s);
4226
4227 return PSA_SUCCESS;
4228
4229#else
4230 (void) operation;
4231
4232 return PSA_ERROR_NOT_SUPPORTED;
4233
4234#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
4235 * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) &&
4236 * defined( MBEDTLS_ECP_RESTARTABLE ) */
4237}
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02004238
David Horstmann6e99bb22024-02-06 15:27:49 +00004239static psa_status_t psa_generate_random_internal(uint8_t *output,
4240 size_t output_size)
4241{
4242 GUARD_MODULE_INITIALIZED;
4243
David Horstmann6e99bb22024-02-06 15:27:49 +00004244#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
4245
David Horstmanndb909142024-03-12 16:07:08 +00004246 psa_status_t status;
David Horstmann6e99bb22024-02-06 15:27:49 +00004247 size_t output_length = 0;
4248 status = mbedtls_psa_external_get_random(&global_data.rng,
4249 output, output_size,
4250 &output_length);
4251 if (status != PSA_SUCCESS) {
David Horstmanndb909142024-03-12 16:07:08 +00004252 return status;
David Horstmann6e99bb22024-02-06 15:27:49 +00004253 }
4254 /* Breaking up a request into smaller chunks is currently not supported
4255 * for the external RNG interface. */
4256 if (output_length != output_size) {
David Horstmanndb909142024-03-12 16:07:08 +00004257 return PSA_ERROR_INSUFFICIENT_ENTROPY;
David Horstmann6e99bb22024-02-06 15:27:49 +00004258 }
David Horstmanndb909142024-03-12 16:07:08 +00004259 return PSA_SUCCESS;
David Horstmann6e99bb22024-02-06 15:27:49 +00004260
4261#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
4262
4263 while (output_size > 0) {
David Horstmann93fa4e12024-03-12 15:02:28 +00004264 int ret = MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED;
David Horstmann6e99bb22024-02-06 15:27:49 +00004265 size_t request_size =
4266 (output_size > MBEDTLS_PSA_RANDOM_MAX_REQUEST ?
4267 MBEDTLS_PSA_RANDOM_MAX_REQUEST :
4268 output_size);
David Horstmann93fa4e12024-03-12 15:02:28 +00004269#if defined(MBEDTLS_CTR_DRBG_C)
4270 ret = mbedtls_ctr_drbg_random(&global_data.rng.drbg, output, request_size);
4271#elif defined(MBEDTLS_HMAC_DRBG_C)
4272 ret = mbedtls_hmac_drbg_random(&global_data.rng.drbg, output, request_size);
4273#endif /* !MBEDTLS_CTR_DRBG_C && !MBEDTLS_HMAC_DRBG_C */
David Horstmann6e99bb22024-02-06 15:27:49 +00004274 if (ret != 0) {
David Horstmann93fa4e12024-03-12 15:02:28 +00004275 return mbedtls_to_psa_error(ret);
David Horstmann6e99bb22024-02-06 15:27:49 +00004276 }
4277 output_size -= request_size;
4278 output += request_size;
4279 }
David Horstmann93fa4e12024-03-12 15:02:28 +00004280 return PSA_SUCCESS;
David Horstmann6e99bb22024-02-06 15:27:49 +00004281#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
David Horstmann6e99bb22024-02-06 15:27:49 +00004282}
4283
4284
mohammad1603503973b2018-03-12 15:59:30 +02004285/****************************************************************/
4286/* Symmetric cryptography */
4287/****************************************************************/
4288
Gilles Peskine449bd832023-01-11 14:50:10 +01004289static psa_status_t psa_cipher_setup(psa_cipher_operation_t *operation,
4290 mbedtls_svc_key_id_t key,
4291 psa_algorithm_t alg,
4292 mbedtls_operation_t cipher_operation)
Ronald Cronab99ac22020-10-01 16:38:28 +02004293{
4294 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4295 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Dave Rodgman54648242021-06-24 11:49:45 +01004296 psa_key_slot_t *slot = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +01004297 psa_key_usage_t usage = (cipher_operation == MBEDTLS_ENCRYPT ?
4298 PSA_KEY_USAGE_ENCRYPT :
4299 PSA_KEY_USAGE_DECRYPT);
Ronald Cronab99ac22020-10-01 16:38:28 +02004300
4301 /* A context must be freshly initialized before it can be set up. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004302 if (operation->id != 0) {
Dave Rodgman54648242021-06-24 11:49:45 +01004303 status = PSA_ERROR_BAD_STATE;
4304 goto exit;
4305 }
Ronald Cronab99ac22020-10-01 16:38:28 +02004306
Gilles Peskine449bd832023-01-11 14:50:10 +01004307 if (!PSA_ALG_IS_CIPHER(alg)) {
Dave Rodgman54648242021-06-24 11:49:45 +01004308 status = PSA_ERROR_INVALID_ARGUMENT;
4309 goto exit;
4310 }
Ronald Cronab99ac22020-10-01 16:38:28 +02004311
Gilles Peskine449bd832023-01-11 14:50:10 +01004312 status = psa_get_and_lock_key_slot_with_policy(key, &slot, usage, alg);
4313 if (status != PSA_SUCCESS) {
Ronald Cronab99ac22020-10-01 16:38:28 +02004314 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004315 }
Ronald Cronab99ac22020-10-01 16:38:28 +02004316
Ronald Cron49fafa92021-03-10 08:34:23 +01004317 /* Initialize the operation struct members, except for id. The id member
Ronald Cronab99ac22020-10-01 16:38:28 +02004318 * is used to indicate to psa_cipher_abort that there are resources to free,
Ronald Cron49fafa92021-03-10 08:34:23 +01004319 * so we only set it (in the driver wrapper) after resources have been
4320 * allocated/initialized. */
Ronald Cronab99ac22020-10-01 16:38:28 +02004321 operation->iv_set = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01004322 if (alg == PSA_ALG_ECB_NO_PADDING) {
Ronald Cronab99ac22020-10-01 16:38:28 +02004323 operation->iv_required = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01004324 } else {
Ronald Cronab99ac22020-10-01 16:38:28 +02004325 operation->iv_required = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004326 }
4327 operation->default_iv_length = PSA_CIPHER_IV_LENGTH(slot->attr.type, alg);
Ronald Cronab99ac22020-10-01 16:38:28 +02004328
4329 /* Try doing the operation through a driver before using software fallback. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004330 if (cipher_operation == MBEDTLS_ENCRYPT) {
4331 status = psa_driver_wrapper_cipher_encrypt_setup(operation,
Gilles Peskine7a5d9202024-02-28 01:18:23 +01004332 &slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01004333 slot->key.data,
4334 slot->key.bytes,
4335 alg);
4336 } else {
4337 status = psa_driver_wrapper_cipher_decrypt_setup(operation,
Gilles Peskine7a5d9202024-02-28 01:18:23 +01004338 &slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01004339 slot->key.data,
4340 slot->key.bytes,
4341 alg);
4342 }
Ronald Cronab99ac22020-10-01 16:38:28 +02004343
Gilles Peskine9ab61b62019-02-25 17:43:14 +01004344exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004345 if (status != PSA_SUCCESS) {
4346 psa_cipher_abort(operation);
4347 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02004348
Ryan Everettc0053cc2024-02-14 16:27:13 +00004349 unlock_status = psa_unregister_read_under_mutex(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02004350
Gilles Peskine449bd832023-01-11 14:50:10 +01004351 return (status == PSA_SUCCESS) ? unlock_status : status;
mohammad1603503973b2018-03-12 15:59:30 +02004352}
4353
Gilles Peskine449bd832023-01-11 14:50:10 +01004354psa_status_t psa_cipher_encrypt_setup(psa_cipher_operation_t *operation,
4355 mbedtls_svc_key_id_t key,
4356 psa_algorithm_t alg)
mohammad16038481e742018-03-18 13:57:31 +02004357{
Gilles Peskine449bd832023-01-11 14:50:10 +01004358 return psa_cipher_setup(operation, key, alg, MBEDTLS_ENCRYPT);
mohammad16038481e742018-03-18 13:57:31 +02004359}
4360
Gilles Peskine449bd832023-01-11 14:50:10 +01004361psa_status_t psa_cipher_decrypt_setup(psa_cipher_operation_t *operation,
4362 mbedtls_svc_key_id_t key,
4363 psa_algorithm_t alg)
mohammad16038481e742018-03-18 13:57:31 +02004364{
Gilles Peskine449bd832023-01-11 14:50:10 +01004365 return psa_cipher_setup(operation, key, alg, MBEDTLS_DECRYPT);
mohammad16038481e742018-03-18 13:57:31 +02004366}
4367
Gilles Peskine449bd832023-01-11 14:50:10 +01004368psa_status_t psa_cipher_generate_iv(psa_cipher_operation_t *operation,
Gabor Mezei358eb212024-02-07 18:10:13 +01004369 uint8_t *iv_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004370 size_t iv_size,
4371 size_t *iv_length)
mohammad1603503973b2018-03-12 15:59:30 +02004372{
Ronald Cron6d051732020-10-01 14:10:20 +02004373 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Sergeybef1f632023-03-06 15:25:06 -07004374 size_t default_iv_length = 0;
Ronald Cron5618a392021-03-26 09:52:26 +01004375
Gabor Mezei358eb212024-02-07 18:10:13 +01004376 LOCAL_OUTPUT_DECLARE(iv_external, iv);
4377
Gilles Peskine449bd832023-01-11 14:50:10 +01004378 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004379 status = PSA_ERROR_BAD_STATE;
4380 goto exit;
Ronald Cronc45b4af2020-09-29 16:18:05 +02004381 }
4382
Gilles Peskine449bd832023-01-11 14:50:10 +01004383 if (operation->iv_set || !operation->iv_required) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004384 status = PSA_ERROR_BAD_STATE;
4385 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02004386 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02004387
Ronald Cron2fb90522021-07-05 12:31:44 +02004388 default_iv_length = operation->default_iv_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01004389 if (iv_size < default_iv_length) {
Ronald Cron5618a392021-03-26 09:52:26 +01004390 status = PSA_ERROR_BUFFER_TOO_SMALL;
4391 goto exit;
4392 }
Gilles Peskinee553c652018-06-04 16:22:46 +02004393
Gilles Peskine449bd832023-01-11 14:50:10 +01004394 if (default_iv_length > PSA_CIPHER_IV_MAX_SIZE) {
Ronald Cron2fb90522021-07-05 12:31:44 +02004395 status = PSA_ERROR_GENERIC_ERROR;
4396 goto exit;
4397 }
4398
Gabor Mezei358eb212024-02-07 18:10:13 +01004399 LOCAL_OUTPUT_ALLOC(iv_external, default_iv_length, iv);
4400
Gabor Mezei1b5b58d2024-03-04 17:15:08 +01004401 status = psa_generate_random_internal(iv, default_iv_length);
Gilles Peskine449bd832023-01-11 14:50:10 +01004402 if (status != PSA_SUCCESS) {
Ronald Cron5618a392021-03-26 09:52:26 +01004403 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004404 }
Ronald Cron5618a392021-03-26 09:52:26 +01004405
Gilles Peskine449bd832023-01-11 14:50:10 +01004406 status = psa_driver_wrapper_cipher_set_iv(operation,
Gabor Mezei358eb212024-02-07 18:10:13 +01004407 iv, default_iv_length);
Ronald Cron5618a392021-03-26 09:52:26 +01004408
4409exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004410 if (status == PSA_SUCCESS) {
Ronald Cron2fb90522021-07-05 12:31:44 +02004411 *iv_length = default_iv_length;
Steven Cooreman7df02922020-09-09 15:28:49 +02004412 operation->iv_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004413 } else {
Ronald Cron2fb90522021-07-05 12:31:44 +02004414 *iv_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01004415 psa_cipher_abort(operation);
Gabor Mezei358eb212024-02-07 18:10:13 +01004416 if (iv != NULL) {
4417 mbedtls_platform_zeroize(iv, default_iv_length);
4418 }
Ronald Cron2fb90522021-07-05 12:31:44 +02004419 }
Ronald Cron6d051732020-10-01 14:10:20 +02004420
Gabor Mezei358eb212024-02-07 18:10:13 +01004421 LOCAL_OUTPUT_FREE(iv_external, iv);
Gilles Peskine449bd832023-01-11 14:50:10 +01004422 return status;
mohammad1603503973b2018-03-12 15:59:30 +02004423}
4424
Gilles Peskine449bd832023-01-11 14:50:10 +01004425psa_status_t psa_cipher_set_iv(psa_cipher_operation_t *operation,
Gabor Mezei7abf8ee2024-02-01 10:39:26 +01004426 const uint8_t *iv_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004427 size_t iv_length)
mohammad1603503973b2018-03-12 15:59:30 +02004428{
Ronald Cron6d051732020-10-01 14:10:20 +02004429 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cronc45b4af2020-09-29 16:18:05 +02004430
Gabor Mezei7abf8ee2024-02-01 10:39:26 +01004431 LOCAL_INPUT_DECLARE(iv_external, iv);
4432
Gilles Peskine449bd832023-01-11 14:50:10 +01004433 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004434 status = PSA_ERROR_BAD_STATE;
4435 goto exit;
4436 }
Ronald Cronc45b4af2020-09-29 16:18:05 +02004437
Gilles Peskine449bd832023-01-11 14:50:10 +01004438 if (operation->iv_set || !operation->iv_required) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004439 status = PSA_ERROR_BAD_STATE;
4440 goto exit;
4441 }
Ronald Crona0d68172021-03-26 10:15:08 +01004442
Gilles Peskine449bd832023-01-11 14:50:10 +01004443 if (iv_length > PSA_CIPHER_IV_MAX_SIZE) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004444 status = PSA_ERROR_INVALID_ARGUMENT;
4445 goto exit;
4446 }
Steven Cooremand3feccd2020-09-01 15:56:14 +02004447
Gabor Mezei7abf8ee2024-02-01 10:39:26 +01004448 LOCAL_INPUT_ALLOC(iv_external, iv_length, iv);
4449
Gilles Peskine449bd832023-01-11 14:50:10 +01004450 status = psa_driver_wrapper_cipher_set_iv(operation,
4451 iv,
4452 iv_length);
Steven Cooremand3feccd2020-09-01 15:56:14 +02004453
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004454exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004455 if (status == PSA_SUCCESS) {
itayzafrir534bd7c2018-08-02 13:56:32 +03004456 operation->iv_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01004457 } else {
4458 psa_cipher_abort(operation);
4459 }
Gabor Mezei7abf8ee2024-02-01 10:39:26 +01004460
4461 LOCAL_INPUT_FREE(iv_external, iv);
4462
Gilles Peskine449bd832023-01-11 14:50:10 +01004463 return status;
mohammad1603503973b2018-03-12 15:59:30 +02004464}
4465
Gilles Peskine449bd832023-01-11 14:50:10 +01004466psa_status_t psa_cipher_update(psa_cipher_operation_t *operation,
Gabor Mezei212eb082024-01-24 16:56:00 +01004467 const uint8_t *input_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004468 size_t input_length,
Gabor Mezei212eb082024-01-24 16:56:00 +01004469 uint8_t *output_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004470 size_t output_size,
4471 size_t *output_length)
mohammad1603503973b2018-03-12 15:59:30 +02004472{
Steven Cooremanffecb7b2020-08-25 15:13:13 +02004473 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron6d051732020-10-01 14:10:20 +02004474
Gabor Mezei212eb082024-01-24 16:56:00 +01004475 LOCAL_INPUT_DECLARE(input_external, input);
4476 LOCAL_OUTPUT_DECLARE(output_external, output);
4477
Gilles Peskine449bd832023-01-11 14:50:10 +01004478 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004479 status = PSA_ERROR_BAD_STATE;
4480 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02004481 }
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004482
Gilles Peskine449bd832023-01-11 14:50:10 +01004483 if (operation->iv_required && !operation->iv_set) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004484 status = PSA_ERROR_BAD_STATE;
4485 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02004486 }
Jaeden Ameroab439972019-02-15 14:12:05 +00004487
Gabor Mezei8b8e4852024-01-31 17:45:29 +01004488 LOCAL_INPUT_ALLOC(input_external, input_length, input);
Gabor Mezei0b041162024-02-29 10:08:16 +00004489 LOCAL_OUTPUT_ALLOC(output_external, output_size, output);
Gabor Mezei8b8e4852024-01-31 17:45:29 +01004490
Gilles Peskine449bd832023-01-11 14:50:10 +01004491 status = psa_driver_wrapper_cipher_update(operation,
4492 input,
4493 input_length,
4494 output,
4495 output_size,
4496 output_length);
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004497
4498exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004499 if (status != PSA_SUCCESS) {
4500 psa_cipher_abort(operation);
4501 }
Ronald Cron6d051732020-10-01 14:10:20 +02004502
Gabor Mezei212eb082024-01-24 16:56:00 +01004503 LOCAL_INPUT_FREE(input_external, input);
4504 LOCAL_OUTPUT_FREE(output_external, output);
4505
Gilles Peskine449bd832023-01-11 14:50:10 +01004506 return status;
mohammad1603503973b2018-03-12 15:59:30 +02004507}
4508
Gilles Peskine449bd832023-01-11 14:50:10 +01004509psa_status_t psa_cipher_finish(psa_cipher_operation_t *operation,
Gabor Mezei212eb082024-01-24 16:56:00 +01004510 uint8_t *output_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004511 size_t output_size,
4512 size_t *output_length)
mohammad1603503973b2018-03-12 15:59:30 +02004513{
David Saadab4ecc272019-02-14 13:48:10 +02004514 psa_status_t status = PSA_ERROR_GENERIC_ERROR;
Ronald Cron6d051732020-10-01 14:10:20 +02004515
Gabor Mezei212eb082024-01-24 16:56:00 +01004516 LOCAL_OUTPUT_DECLARE(output_external, output);
4517
Gilles Peskine449bd832023-01-11 14:50:10 +01004518 if (operation->id == 0) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004519 status = PSA_ERROR_BAD_STATE;
4520 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02004521 }
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004522
Gilles Peskine449bd832023-01-11 14:50:10 +01004523 if (operation->iv_required && !operation->iv_set) {
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004524 status = PSA_ERROR_BAD_STATE;
4525 goto exit;
Steven Cooreman7df02922020-09-09 15:28:49 +02004526 }
Moran Pekerbed71a22018-04-22 20:19:20 +03004527
Gabor Mezei0b041162024-02-29 10:08:16 +00004528 LOCAL_OUTPUT_ALLOC(output_external, output_size, output);
Gabor Mezei8b8e4852024-01-31 17:45:29 +01004529
Gilles Peskine449bd832023-01-11 14:50:10 +01004530 status = psa_driver_wrapper_cipher_finish(operation,
4531 output,
4532 output_size,
4533 output_length);
Dave Rodgman38e62ae2021-06-23 11:38:39 +01004534
4535exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01004536 if (status == PSA_SUCCESS) {
Gabor Mezei212eb082024-01-24 16:56:00 +01004537 status = psa_cipher_abort(operation);
Gilles Peskine449bd832023-01-11 14:50:10 +01004538 } else {
Steven Cooremanef8575e2020-09-11 11:44:50 +02004539 *output_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01004540 (void) psa_cipher_abort(operation);
Steven Cooremanef8575e2020-09-11 11:44:50 +02004541 }
Gabor Mezei212eb082024-01-24 16:56:00 +01004542
4543 LOCAL_OUTPUT_FREE(output_external, output);
4544
4545 return status;
mohammad1603503973b2018-03-12 15:59:30 +02004546}
4547
Gilles Peskine449bd832023-01-11 14:50:10 +01004548psa_status_t psa_cipher_abort(psa_cipher_operation_t *operation)
Gilles Peskinee553c652018-06-04 16:22:46 +02004549{
Gilles Peskine449bd832023-01-11 14:50:10 +01004550 if (operation->id == 0) {
Steven Cooremana07b9972020-09-10 14:54:14 +02004551 /* The object has (apparently) been initialized but it is not (yet)
Gilles Peskine81736312018-06-26 15:04:31 +02004552 * in use. It's ok to call abort on such an object, and there's
4553 * nothing to do. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004554 return PSA_SUCCESS;
Gilles Peskine81736312018-06-26 15:04:31 +02004555 }
Gilles Peskine16c0f4f2018-06-20 16:05:20 +02004556
Gilles Peskine449bd832023-01-11 14:50:10 +01004557 psa_driver_wrapper_cipher_abort(operation);
Gilles Peskinee553c652018-06-04 16:22:46 +02004558
Ronald Cron49fafa92021-03-10 08:34:23 +01004559 operation->id = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03004560 operation->iv_set = 0;
Moran Pekerad9d82c2018-04-30 12:31:04 +03004561 operation->iv_required = 0;
Moran Peker41deec42018-04-04 15:43:05 +03004562
Gilles Peskine449bd832023-01-11 14:50:10 +01004563 return PSA_SUCCESS;
mohammad1603503973b2018-03-12 15:59:30 +02004564}
4565
Gilles Peskine449bd832023-01-11 14:50:10 +01004566psa_status_t psa_cipher_encrypt(mbedtls_svc_key_id_t key,
4567 psa_algorithm_t alg,
David Horstmann36df4b22023-12-13 15:55:25 +00004568 const uint8_t *input_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004569 size_t input_length,
David Horstmann36df4b22023-12-13 15:55:25 +00004570 uint8_t *output_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004571 size_t output_size,
4572 size_t *output_length)
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004573{
4574 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004575 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron23919522021-07-08 19:00:07 +02004576 psa_key_slot_t *slot = NULL;
Ronald Cronc6e6f502021-07-09 18:44:58 +02004577 uint8_t local_iv[PSA_CIPHER_IV_MAX_SIZE];
4578 size_t default_iv_length = 0;
gabor-mezei-arm6f4e5bb2021-06-25 15:21:11 +02004579
David Horstmann62a56d92023-12-14 18:12:47 +00004580 LOCAL_INPUT_DECLARE(input_external, input);
4581 LOCAL_OUTPUT_DECLARE(output_external, output);
4582
Gilles Peskine449bd832023-01-11 14:50:10 +01004583 if (!PSA_ALG_IS_CIPHER(alg)) {
Ronald Cron23919522021-07-08 19:00:07 +02004584 status = PSA_ERROR_INVALID_ARGUMENT;
4585 goto exit;
4586 }
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004587
Gilles Peskine449bd832023-01-11 14:50:10 +01004588 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
4589 PSA_KEY_USAGE_ENCRYPT,
4590 alg);
4591 if (status != PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004592 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004593 }
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004594
Gilles Peskine449bd832023-01-11 14:50:10 +01004595 default_iv_length = PSA_CIPHER_IV_LENGTH(slot->attr.type, alg);
4596 if (default_iv_length > PSA_CIPHER_IV_MAX_SIZE) {
Ronald Cronc6e6f502021-07-09 18:44:58 +02004597 status = PSA_ERROR_GENERIC_ERROR;
4598 goto exit;
4599 }
4600
Gilles Peskine449bd832023-01-11 14:50:10 +01004601 if (default_iv_length > 0) {
4602 if (output_size < default_iv_length) {
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004603 status = PSA_ERROR_BUFFER_TOO_SMALL;
4604 goto exit;
4605 }
4606
David Horstmann6e99bb22024-02-06 15:27:49 +00004607 status = psa_generate_random_internal(local_iv, default_iv_length);
Gilles Peskine449bd832023-01-11 14:50:10 +01004608 if (status != PSA_SUCCESS) {
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004609 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004610 }
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004611 }
4612
Gabor Mezei8b8e4852024-01-31 17:45:29 +01004613 LOCAL_INPUT_ALLOC(input_external, input_length, input);
4614 LOCAL_OUTPUT_ALLOC(output_external, output_size, output);
4615
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004616 status = psa_driver_wrapper_cipher_encrypt(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01004617 &slot->attr, slot->key.data, slot->key.bytes,
Ronald Cronc6e6f502021-07-09 18:44:58 +02004618 alg, local_iv, default_iv_length, input, input_length,
Ronald Cronafbc7ed2023-01-24 16:02:04 +01004619 psa_crypto_buffer_offset(output, default_iv_length),
Gilles Peskine449bd832023-01-11 14:50:10 +01004620 output_size - default_iv_length, output_length);
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004621
4622exit:
Ryan Everetta103ec92024-01-31 13:59:57 +00004623 unlock_status = psa_unregister_read_under_mutex(slot);
Gilles Peskine449bd832023-01-11 14:50:10 +01004624 if (status == PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004625 status = unlock_status;
Ronald Cronc6e6f502021-07-09 18:44:58 +02004626 }
Ronald Cron23919522021-07-08 19:00:07 +02004627
Gilles Peskine449bd832023-01-11 14:50:10 +01004628 if (status == PSA_SUCCESS) {
4629 if (default_iv_length > 0) {
4630 memcpy(output, local_iv, default_iv_length);
4631 }
4632 *output_length += default_iv_length;
4633 } else {
4634 *output_length = 0;
4635 }
4636
David Horstmann62a56d92023-12-14 18:12:47 +00004637 LOCAL_INPUT_FREE(input_external, input);
4638 LOCAL_OUTPUT_FREE(output_external, output);
David Horstmannc6977b42023-11-27 17:43:05 +00004639
Gilles Peskine449bd832023-01-11 14:50:10 +01004640 return status;
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004641}
4642
Gilles Peskine449bd832023-01-11 14:50:10 +01004643psa_status_t psa_cipher_decrypt(mbedtls_svc_key_id_t key,
4644 psa_algorithm_t alg,
Gabor Mezei212eb082024-01-24 16:56:00 +01004645 const uint8_t *input_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004646 size_t input_length,
Gabor Mezei212eb082024-01-24 16:56:00 +01004647 uint8_t *output_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004648 size_t output_size,
4649 size_t *output_length)
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004650{
4651 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004652 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron23919522021-07-08 19:00:07 +02004653 psa_key_slot_t *slot = NULL;
gabor-mezei-arm6f4e5bb2021-06-25 15:21:11 +02004654
Gabor Mezei212eb082024-01-24 16:56:00 +01004655 LOCAL_INPUT_DECLARE(input_external, input);
4656 LOCAL_OUTPUT_DECLARE(output_external, output);
4657
Gilles Peskine449bd832023-01-11 14:50:10 +01004658 if (!PSA_ALG_IS_CIPHER(alg)) {
Ronald Cron23919522021-07-08 19:00:07 +02004659 status = PSA_ERROR_INVALID_ARGUMENT;
4660 goto exit;
4661 }
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004662
Gilles Peskine449bd832023-01-11 14:50:10 +01004663 status = psa_get_and_lock_key_slot_with_policy(key, &slot,
4664 PSA_KEY_USAGE_DECRYPT,
4665 alg);
4666 if (status != PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004667 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004668 }
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004669
Gilles Peskineb47c3b32024-06-26 13:16:33 +02004670 if (input_length < PSA_CIPHER_IV_LENGTH(slot->attr.type, alg)) {
gabor-mezei-arm258ae072021-06-25 15:25:38 +02004671 status = PSA_ERROR_INVALID_ARGUMENT;
4672 goto exit;
4673 }
4674
Gabor Mezei8b8e4852024-01-31 17:45:29 +01004675 LOCAL_INPUT_ALLOC(input_external, input_length, input);
4676 LOCAL_OUTPUT_ALLOC(output_external, output_size, output);
4677
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004678 status = psa_driver_wrapper_cipher_decrypt(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01004679 &slot->attr, slot->key.data, slot->key.bytes,
gabor-mezei-arma9449a02021-03-25 11:17:10 +01004680 alg, input, input_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01004681 output, output_size, output_length);
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004682
gabor-mezei-arm258ae072021-06-25 15:25:38 +02004683exit:
Ryan Everetta103ec92024-01-31 13:59:57 +00004684 unlock_status = psa_unregister_read_under_mutex(slot);
Gilles Peskine449bd832023-01-11 14:50:10 +01004685 if (status == PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004686 status = unlock_status;
Gilles Peskine449bd832023-01-11 14:50:10 +01004687 }
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004688
Gilles Peskine449bd832023-01-11 14:50:10 +01004689 if (status != PSA_SUCCESS) {
Ronald Cron23919522021-07-08 19:00:07 +02004690 *output_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01004691 }
Ronald Cron23919522021-07-08 19:00:07 +02004692
Gabor Mezei212eb082024-01-24 16:56:00 +01004693 LOCAL_INPUT_FREE(input_external, input);
4694 LOCAL_OUTPUT_FREE(output_external, output);
4695
Gilles Peskine449bd832023-01-11 14:50:10 +01004696 return status;
gabor-mezei-armba0fa752021-03-01 15:04:24 +01004697}
4698
4699
mohammad16035955c982018-04-26 00:53:03 +03004700/****************************************************************/
4701/* AEAD */
4702/****************************************************************/
Gilles Peskine7bcfc0a2018-06-18 21:49:39 +02004703
Paul Elliottbaff51c2021-09-28 17:44:45 +01004704/* Helper function to get the base algorithm from its variants. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004705static psa_algorithm_t psa_aead_get_base_algorithm(psa_algorithm_t alg)
Paul Elliottbaff51c2021-09-28 17:44:45 +01004706{
Gilles Peskine449bd832023-01-11 14:50:10 +01004707 return PSA_ALG_AEAD_WITH_DEFAULT_LENGTH_TAG(alg);
Paul Elliottbaff51c2021-09-28 17:44:45 +01004708}
4709
4710/* Helper function to perform common nonce length checks. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004711static psa_status_t psa_aead_check_nonce_length(psa_algorithm_t alg,
4712 size_t nonce_length)
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004713{
Gilles Peskine449bd832023-01-11 14:50:10 +01004714 psa_algorithm_t base_alg = psa_aead_get_base_algorithm(alg);
Paul Elliottbaff51c2021-09-28 17:44:45 +01004715
Gilles Peskine449bd832023-01-11 14:50:10 +01004716 switch (base_alg) {
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004717#if defined(PSA_WANT_ALG_GCM)
4718 case PSA_ALG_GCM:
4719 /* Not checking max nonce size here as GCM spec allows almost
Gilles Peskine449bd832023-01-11 14:50:10 +01004720 * arbitrarily large nonces. Please note that we do not generally
4721 * recommend the usage of nonces of greater length than
4722 * PSA_AEAD_NONCE_MAX_SIZE, as large nonces are hashed to a shorter
4723 * size, which can then lead to collisions if you encrypt a very
4724 * large number of messages.*/
4725 if (nonce_length != 0) {
4726 return PSA_SUCCESS;
4727 }
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004728 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004729#endif /* PSA_WANT_ALG_GCM */
4730#if defined(PSA_WANT_ALG_CCM)
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004731 case PSA_ALG_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01004732 if (nonce_length >= 7 && nonce_length <= 13) {
4733 return PSA_SUCCESS;
4734 }
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004735 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004736#endif /* PSA_WANT_ALG_CCM */
4737#if defined(PSA_WANT_ALG_CHACHA20_POLY1305)
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004738 case PSA_ALG_CHACHA20_POLY1305:
Gilles Peskine449bd832023-01-11 14:50:10 +01004739 if (nonce_length == 12) {
4740 return PSA_SUCCESS;
4741 } else if (nonce_length == 8) {
4742 return PSA_ERROR_NOT_SUPPORTED;
4743 }
Bence Szépkúti6d48e202021-11-15 20:04:15 +01004744 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01004745#endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004746 default:
Przemek Stekiel4c499272022-09-27 13:55:37 +02004747 (void) nonce_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01004748 return PSA_ERROR_NOT_SUPPORTED;
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02004749 }
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004750
Gilles Peskine449bd832023-01-11 14:50:10 +01004751 return PSA_ERROR_INVALID_ARGUMENT;
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004752}
4753
Gilles Peskine449bd832023-01-11 14:50:10 +01004754static psa_status_t psa_aead_check_algorithm(psa_algorithm_t alg)
Bence Szépkútiaa3a6e42022-01-13 16:26:03 +01004755{
Gilles Peskine449bd832023-01-11 14:50:10 +01004756 if (!PSA_ALG_IS_AEAD(alg) || PSA_ALG_IS_WILDCARD(alg)) {
4757 return PSA_ERROR_INVALID_ARGUMENT;
4758 }
Bence Szépkúti08f34652021-12-08 21:07:13 +01004759
Gilles Peskine449bd832023-01-11 14:50:10 +01004760 return PSA_SUCCESS;
Bence Szépkúti08f34652021-12-08 21:07:13 +01004761}
4762
Gilles Peskine449bd832023-01-11 14:50:10 +01004763psa_status_t psa_aead_encrypt(mbedtls_svc_key_id_t key,
4764 psa_algorithm_t alg,
David Horstmann9d09a022023-11-28 19:25:00 +00004765 const uint8_t *nonce_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004766 size_t nonce_length,
David Horstmann9d09a022023-11-28 19:25:00 +00004767 const uint8_t *additional_data_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004768 size_t additional_data_length,
David Horstmann9d09a022023-11-28 19:25:00 +00004769 const uint8_t *plaintext_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004770 size_t plaintext_length,
David Horstmann9d09a022023-11-28 19:25:00 +00004771 uint8_t *ciphertext_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004772 size_t ciphertext_size,
4773 size_t *ciphertext_length)
mohammad16035955c982018-04-26 00:53:03 +03004774{
Ronald Cron215633c2021-03-16 17:15:37 +01004775 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4776 psa_key_slot_t *slot;
Gilles Peskine2d277862018-06-18 15:41:12 +02004777
David Horstmann9d09a022023-11-28 19:25:00 +00004778 LOCAL_INPUT_DECLARE(nonce_external, nonce);
4779 LOCAL_INPUT_DECLARE(additional_data_external, additional_data);
4780 LOCAL_INPUT_DECLARE(plaintext_external, plaintext);
4781 LOCAL_OUTPUT_DECLARE(ciphertext_external, ciphertext);
4782
mohammad1603f08a5502018-06-03 15:05:47 +03004783 *ciphertext_length = 0;
mohammad1603e58e6842018-05-09 04:58:32 -07004784
Gilles Peskine449bd832023-01-11 14:50:10 +01004785 status = psa_aead_check_algorithm(alg);
4786 if (status != PSA_SUCCESS) {
4787 return status;
4788 }
Steven Cooremanea7ab132021-03-17 16:28:00 +01004789
Ronald Cron9a986162021-03-26 12:40:07 +01004790 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01004791 key, &slot, PSA_KEY_USAGE_ENCRYPT, alg);
4792 if (status != PSA_SUCCESS) {
4793 return status;
4794 }
mohammad16035955c982018-04-26 00:53:03 +03004795
David Horstmann9d09a022023-11-28 19:25:00 +00004796 LOCAL_INPUT_ALLOC(nonce_external, nonce_length, nonce);
4797 LOCAL_INPUT_ALLOC(additional_data_external, additional_data_length, additional_data);
4798 LOCAL_INPUT_ALLOC(plaintext_external, plaintext_length, plaintext);
4799 LOCAL_OUTPUT_ALLOC(ciphertext_external, ciphertext_size, ciphertext);
4800
Gilles Peskine449bd832023-01-11 14:50:10 +01004801 status = psa_aead_check_nonce_length(alg, nonce_length);
4802 if (status != PSA_SUCCESS) {
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004803 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004804 }
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004805
Ronald Cronde822812021-03-17 16:08:20 +01004806 status = psa_driver_wrapper_aead_encrypt(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01004807 &slot->attr, slot->key.data, slot->key.bytes,
Ronald Cron215633c2021-03-16 17:15:37 +01004808 alg,
4809 nonce, nonce_length,
4810 additional_data, additional_data_length,
4811 plaintext, plaintext_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01004812 ciphertext, ciphertext_size, ciphertext_length);
Gilles Peskine2d277862018-06-18 15:41:12 +02004813
Gilles Peskine449bd832023-01-11 14:50:10 +01004814 if (status != PSA_SUCCESS && ciphertext_size != 0) {
4815 memset(ciphertext, 0, ciphertext_size);
4816 }
Gilles Peskine2d277862018-06-18 15:41:12 +02004817
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004818exit:
David Horstmann9d09a022023-11-28 19:25:00 +00004819 LOCAL_INPUT_FREE(nonce_external, nonce);
4820 LOCAL_INPUT_FREE(additional_data_external, additional_data);
4821 LOCAL_INPUT_FREE(plaintext_external, plaintext);
4822 LOCAL_OUTPUT_FREE(ciphertext_external, ciphertext);
4823
Ryan Everetta103ec92024-01-31 13:59:57 +00004824 psa_unregister_read_under_mutex(slot);
mohammad16035955c982018-04-26 00:53:03 +03004825
Gilles Peskine449bd832023-01-11 14:50:10 +01004826 return status;
Gilles Peskineee652a32018-06-01 19:23:52 +02004827}
4828
Gilles Peskine449bd832023-01-11 14:50:10 +01004829psa_status_t psa_aead_decrypt(mbedtls_svc_key_id_t key,
4830 psa_algorithm_t alg,
David Horstmann7f2e0402023-11-28 19:43:53 +00004831 const uint8_t *nonce_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004832 size_t nonce_length,
David Horstmann7f2e0402023-11-28 19:43:53 +00004833 const uint8_t *additional_data_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004834 size_t additional_data_length,
David Horstmann7f2e0402023-11-28 19:43:53 +00004835 const uint8_t *ciphertext_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004836 size_t ciphertext_length,
David Horstmann7f2e0402023-11-28 19:43:53 +00004837 uint8_t *plaintext_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01004838 size_t plaintext_size,
4839 size_t *plaintext_length)
mohammad16035955c982018-04-26 00:53:03 +03004840{
Ronald Cron215633c2021-03-16 17:15:37 +01004841 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4842 psa_key_slot_t *slot;
Gilles Peskine2d277862018-06-18 15:41:12 +02004843
David Horstmann7f2e0402023-11-28 19:43:53 +00004844 LOCAL_INPUT_DECLARE(nonce_external, nonce);
4845 LOCAL_INPUT_DECLARE(additional_data_external, additional_data);
4846 LOCAL_INPUT_DECLARE(ciphertext_external, ciphertext);
4847 LOCAL_OUTPUT_DECLARE(plaintext_external, plaintext);
4848
Gilles Peskineee652a32018-06-01 19:23:52 +02004849 *plaintext_length = 0;
mohammad16039e5a5152018-04-26 12:07:35 +03004850
Gilles Peskine449bd832023-01-11 14:50:10 +01004851 status = psa_aead_check_algorithm(alg);
4852 if (status != PSA_SUCCESS) {
4853 return status;
4854 }
Steven Cooremanea7ab132021-03-17 16:28:00 +01004855
Ronald Cron9a986162021-03-26 12:40:07 +01004856 status = psa_get_and_lock_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01004857 key, &slot, PSA_KEY_USAGE_DECRYPT, alg);
4858 if (status != PSA_SUCCESS) {
4859 return status;
4860 }
mohammad16035955c982018-04-26 00:53:03 +03004861
David Horstmann7f2e0402023-11-28 19:43:53 +00004862 LOCAL_INPUT_ALLOC(nonce_external, nonce_length, nonce);
4863 LOCAL_INPUT_ALLOC(additional_data_external, additional_data_length,
4864 additional_data);
4865 LOCAL_INPUT_ALLOC(ciphertext_external, ciphertext_length, ciphertext);
4866 LOCAL_OUTPUT_ALLOC(plaintext_external, plaintext_size, plaintext);
4867
Gilles Peskine449bd832023-01-11 14:50:10 +01004868 status = psa_aead_check_nonce_length(alg, nonce_length);
4869 if (status != PSA_SUCCESS) {
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004870 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004871 }
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004872
Ronald Cronde822812021-03-17 16:08:20 +01004873 status = psa_driver_wrapper_aead_decrypt(
Gilles Peskine7a5d9202024-02-28 01:18:23 +01004874 &slot->attr, slot->key.data, slot->key.bytes,
Ronald Cron215633c2021-03-16 17:15:37 +01004875 alg,
4876 nonce, nonce_length,
4877 additional_data, additional_data_length,
4878 ciphertext, ciphertext_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01004879 plaintext, plaintext_size, plaintext_length);
Gilles Peskinea40d7742018-06-01 16:28:30 +02004880
Gilles Peskine449bd832023-01-11 14:50:10 +01004881 if (status != PSA_SUCCESS && plaintext_size != 0) {
4882 memset(plaintext, 0, plaintext_size);
4883 }
mohammad160360a64d02018-06-03 17:20:42 +03004884
Paul Elliottbb0f9e12021-09-28 11:14:27 +01004885exit:
David Horstmann7f2e0402023-11-28 19:43:53 +00004886 LOCAL_INPUT_FREE(nonce_external, nonce);
4887 LOCAL_INPUT_FREE(additional_data_external, additional_data);
4888 LOCAL_INPUT_FREE(ciphertext_external, ciphertext);
4889 LOCAL_OUTPUT_FREE(plaintext_external, plaintext);
4890
Ryan Everetta103ec92024-01-31 13:59:57 +00004891 psa_unregister_read_under_mutex(slot);
Ronald Cron215633c2021-03-16 17:15:37 +01004892
Gilles Peskine449bd832023-01-11 14:50:10 +01004893 return status;
mohammad16035955c982018-04-26 00:53:03 +03004894}
4895
Gilles Peskine449bd832023-01-11 14:50:10 +01004896static psa_status_t psa_validate_tag_length(psa_algorithm_t alg)
4897{
4898 const uint8_t tag_len = PSA_ALG_AEAD_GET_TAG_LENGTH(alg);
Andrzej Kurekf8816012021-12-19 17:00:12 +01004899
Gilles Peskine449bd832023-01-11 14:50:10 +01004900 switch (PSA_ALG_AEAD_WITH_SHORTENED_TAG(alg, 0)) {
Przemek Stekiel86679c72022-10-06 17:06:56 +02004901#if defined(PSA_WANT_ALG_CCM)
Gilles Peskine449bd832023-01-11 14:50:10 +01004902 case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, 0):
Andrzej Kurekf8816012021-12-19 17:00:12 +01004903 /* CCM allows the following tag lengths: 4, 6, 8, 10, 12, 14, 16.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01004904 if (tag_len < 4 || tag_len > 16 || tag_len % 2) {
4905 return PSA_ERROR_INVALID_ARGUMENT;
4906 }
Andrzej Kurekf8816012021-12-19 17:00:12 +01004907 break;
Przemek Stekiel86679c72022-10-06 17:06:56 +02004908#endif /* PSA_WANT_ALG_CCM */
Andrzej Kurekf8816012021-12-19 17:00:12 +01004909
Przemek Stekiel86679c72022-10-06 17:06:56 +02004910#if defined(PSA_WANT_ALG_GCM)
Gilles Peskine449bd832023-01-11 14:50:10 +01004911 case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_GCM, 0):
Andrzej Kurekf8816012021-12-19 17:00:12 +01004912 /* GCM allows the following tag lengths: 4, 8, 12, 13, 14, 15, 16. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004913 if (tag_len != 4 && tag_len != 8 && (tag_len < 12 || tag_len > 16)) {
4914 return PSA_ERROR_INVALID_ARGUMENT;
4915 }
Andrzej Kurekf8816012021-12-19 17:00:12 +01004916 break;
Przemek Stekiel86679c72022-10-06 17:06:56 +02004917#endif /* PSA_WANT_ALG_GCM */
Andrzej Kurekf8816012021-12-19 17:00:12 +01004918
Przemek Stekiel86679c72022-10-06 17:06:56 +02004919#if defined(PSA_WANT_ALG_CHACHA20_POLY1305)
Gilles Peskine449bd832023-01-11 14:50:10 +01004920 case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CHACHA20_POLY1305, 0):
Andrzej Kurekf8816012021-12-19 17:00:12 +01004921 /* We only support the default tag length. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004922 if (tag_len != 16) {
4923 return PSA_ERROR_INVALID_ARGUMENT;
4924 }
Andrzej Kurekf8816012021-12-19 17:00:12 +01004925 break;
Przemek Stekiel86679c72022-10-06 17:06:56 +02004926#endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */
Andrzej Kurekf8816012021-12-19 17:00:12 +01004927
4928 default:
4929 (void) tag_len;
Gilles Peskine449bd832023-01-11 14:50:10 +01004930 return PSA_ERROR_NOT_SUPPORTED;
Andrzej Kurekf8816012021-12-19 17:00:12 +01004931 }
Gilles Peskine449bd832023-01-11 14:50:10 +01004932 return PSA_SUCCESS;
Andrzej Kurekf8816012021-12-19 17:00:12 +01004933}
4934
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004935/* Set the key for a multipart authenticated operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01004936static psa_status_t psa_aead_setup(psa_aead_operation_t *operation,
4937 int is_encrypt,
4938 mbedtls_svc_key_id_t key,
4939 psa_algorithm_t alg)
Paul Elliottc2b71442021-06-24 18:17:52 +01004940{
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004941 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
4942 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
4943 psa_key_slot_t *slot = NULL;
4944 psa_key_usage_t key_usage = 0;
4945
Gilles Peskine449bd832023-01-11 14:50:10 +01004946 status = psa_aead_check_algorithm(alg);
4947 if (status != PSA_SUCCESS) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004948 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004949 }
Paul Elliottc2b71442021-06-24 18:17:52 +01004950
Gilles Peskine449bd832023-01-11 14:50:10 +01004951 if (operation->id != 0) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004952 status = PSA_ERROR_BAD_STATE;
4953 goto exit;
Paul Elliottc2b71442021-06-24 18:17:52 +01004954 }
4955
Gilles Peskine449bd832023-01-11 14:50:10 +01004956 if (operation->nonce_set || operation->lengths_set ||
4957 operation->ad_started || operation->body_started) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004958 status = PSA_ERROR_BAD_STATE;
4959 goto exit;
Paul Elliottc2b71442021-06-24 18:17:52 +01004960 }
4961
Gilles Peskine449bd832023-01-11 14:50:10 +01004962 if (is_encrypt) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004963 key_usage = PSA_KEY_USAGE_ENCRYPT;
Gilles Peskine449bd832023-01-11 14:50:10 +01004964 } else {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004965 key_usage = PSA_KEY_USAGE_DECRYPT;
Gilles Peskine449bd832023-01-11 14:50:10 +01004966 }
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004967
Gilles Peskine449bd832023-01-11 14:50:10 +01004968 status = psa_get_and_lock_key_slot_with_policy(key, &slot, key_usage,
4969 alg);
4970 if (status != PSA_SUCCESS) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004971 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004972 }
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004973
Gilles Peskine449bd832023-01-11 14:50:10 +01004974 if ((status = psa_validate_tag_length(alg)) != PSA_SUCCESS) {
Przemek Stekiel6ab50762022-10-08 17:54:30 +02004975 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004976 }
Przemek Stekiel6ab50762022-10-08 17:54:30 +02004977
Gilles Peskine449bd832023-01-11 14:50:10 +01004978 if (is_encrypt) {
4979 status = psa_driver_wrapper_aead_encrypt_setup(operation,
Gilles Peskine7a5d9202024-02-28 01:18:23 +01004980 &slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01004981 slot->key.data,
4982 slot->key.bytes,
4983 alg);
4984 } else {
4985 status = psa_driver_wrapper_aead_decrypt_setup(operation,
Gilles Peskine7a5d9202024-02-28 01:18:23 +01004986 &slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01004987 slot->key.data,
4988 slot->key.bytes,
4989 alg);
4990 }
4991 if (status != PSA_SUCCESS) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004992 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01004993 }
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004994
Gilles Peskine7a5d9202024-02-28 01:18:23 +01004995 operation->key_type = psa_get_key_type(&slot->attr);
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004996
4997exit:
Ryan Everett9af70e52024-02-14 18:38:56 +00004998 unlock_status = psa_unregister_read_under_mutex(slot);
Paul Elliotte0a12bd2021-08-19 18:55:56 +01004999
Gilles Peskine449bd832023-01-11 14:50:10 +01005000 if (status == PSA_SUCCESS) {
Paul Elliotte0a12bd2021-08-19 18:55:56 +01005001 status = unlock_status;
Gilles Peskine449bd832023-01-11 14:50:10 +01005002 operation->alg = psa_aead_get_base_algorithm(alg);
Paul Elliottd9343f22021-08-23 18:59:49 +01005003 operation->is_encrypt = is_encrypt;
Gilles Peskine449bd832023-01-11 14:50:10 +01005004 } else {
5005 psa_aead_abort(operation);
Paul Elliotte0a12bd2021-08-19 18:55:56 +01005006 }
Paul Elliotte0a12bd2021-08-19 18:55:56 +01005007
Gilles Peskine449bd832023-01-11 14:50:10 +01005008 return status;
Paul Elliottc2b71442021-06-24 18:17:52 +01005009}
5010
Paul Elliott302ff6b2021-04-20 18:10:30 +01005011/* Set the key for a multipart authenticated encryption operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005012psa_status_t psa_aead_encrypt_setup(psa_aead_operation_t *operation,
5013 mbedtls_svc_key_id_t key,
5014 psa_algorithm_t alg)
Paul Elliott302ff6b2021-04-20 18:10:30 +01005015{
Gilles Peskine449bd832023-01-11 14:50:10 +01005016 return psa_aead_setup(operation, 1, key, alg);
Paul Elliott302ff6b2021-04-20 18:10:30 +01005017}
5018
5019/* Set the key for a multipart authenticated decryption operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005020psa_status_t psa_aead_decrypt_setup(psa_aead_operation_t *operation,
5021 mbedtls_svc_key_id_t key,
5022 psa_algorithm_t alg)
Paul Elliott302ff6b2021-04-20 18:10:30 +01005023{
Gilles Peskine449bd832023-01-11 14:50:10 +01005024 return psa_aead_setup(operation, 0, key, alg);
Paul Elliott302ff6b2021-04-20 18:10:30 +01005025}
5026
David Horstmannfed23772023-12-19 17:49:20 +00005027static psa_status_t psa_aead_set_nonce_internal(psa_aead_operation_t *operation,
5028 const uint8_t *nonce,
5029 size_t nonce_length)
5030{
5031 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
5032
5033 if (operation->id == 0) {
5034 status = PSA_ERROR_BAD_STATE;
5035 goto exit;
5036 }
5037
5038 if (operation->nonce_set) {
5039 status = PSA_ERROR_BAD_STATE;
5040 goto exit;
5041 }
5042
5043 status = psa_aead_check_nonce_length(operation->alg, nonce_length);
5044 if (status != PSA_SUCCESS) {
5045 status = PSA_ERROR_INVALID_ARGUMENT;
5046 goto exit;
5047 }
5048
5049 status = psa_driver_wrapper_aead_set_nonce(operation, nonce,
5050 nonce_length);
5051
5052exit:
5053 if (status == PSA_SUCCESS) {
5054 operation->nonce_set = 1;
5055 } else {
5056 psa_aead_abort(operation);
5057 }
5058
5059 return status;
5060}
5061
Paul Elliott302ff6b2021-04-20 18:10:30 +01005062/* Generate a random nonce / IV for multipart AEAD operation */
Gilles Peskine449bd832023-01-11 14:50:10 +01005063psa_status_t psa_aead_generate_nonce(psa_aead_operation_t *operation,
David Horstmannd3cad8b2023-12-11 14:46:04 +00005064 uint8_t *nonce_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01005065 size_t nonce_size,
5066 size_t *nonce_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01005067{
5068 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Croncae59092021-11-26 18:53:58 +01005069 uint8_t local_nonce[PSA_AEAD_NONCE_MAX_SIZE];
Sergeybef1f632023-03-06 15:25:06 -07005070 size_t required_nonce_size = 0;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005071
David Horstmannd3cad8b2023-12-11 14:46:04 +00005072 LOCAL_OUTPUT_DECLARE(nonce_external, nonce);
5073 LOCAL_OUTPUT_ALLOC(nonce_external, nonce_size, nonce);
5074
Paul Elliott8eb9daf2021-06-04 16:42:21 +01005075 *nonce_length = 0;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005076
Gilles Peskine449bd832023-01-11 14:50:10 +01005077 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01005078 status = PSA_ERROR_BAD_STATE;
5079 goto exit;
5080 }
5081
Gilles Peskine449bd832023-01-11 14:50:10 +01005082 if (operation->nonce_set || !operation->is_encrypt) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01005083 status = PSA_ERROR_BAD_STATE;
5084 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005085 }
5086
Paul Elliotte193ea82021-10-01 13:00:16 +01005087 /* For CCM, this size may not be correct according to the PSA
5088 * specification. The PSA Crypto 1.0.1 specification states:
5089 *
5090 * CCM encodes the plaintext length pLen in L octets, with L the smallest
5091 * integer >= 2 where pLen < 2^(8L). The nonce length is then 15 - L bytes.
5092 *
5093 * However this restriction that L has to be the smallest integer is not
5094 * applied in practice, and it is not implementable here since the
5095 * plaintext length may or may not be known at this time. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005096 required_nonce_size = PSA_AEAD_NONCE_LENGTH(operation->key_type,
5097 operation->alg);
5098 if (nonce_size < required_nonce_size) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01005099 status = PSA_ERROR_BUFFER_TOO_SMALL;
5100 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005101 }
5102
David Horstmann6e99bb22024-02-06 15:27:49 +00005103 status = psa_generate_random_internal(local_nonce, required_nonce_size);
Gilles Peskine449bd832023-01-11 14:50:10 +01005104 if (status != PSA_SUCCESS) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01005105 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005106 }
Paul Elliott302ff6b2021-04-20 18:10:30 +01005107
David Horstmannfed23772023-12-19 17:49:20 +00005108 status = psa_aead_set_nonce_internal(operation, local_nonce,
5109 required_nonce_size);
Paul Elliott302ff6b2021-04-20 18:10:30 +01005110
Paul Elliott39dc6b82021-05-11 19:16:09 +01005111exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01005112 if (status == PSA_SUCCESS) {
5113 memcpy(nonce, local_nonce, required_nonce_size);
Paul Elliott39dc6b82021-05-11 19:16:09 +01005114 *nonce_length = required_nonce_size;
Gilles Peskine449bd832023-01-11 14:50:10 +01005115 } else {
5116 psa_aead_abort(operation);
Ronald Croncae59092021-11-26 18:53:58 +01005117 }
Paul Elliott39dc6b82021-05-11 19:16:09 +01005118
David Horstmannd3cad8b2023-12-11 14:46:04 +00005119 LOCAL_OUTPUT_FREE(nonce_external, nonce);
5120
Gilles Peskine449bd832023-01-11 14:50:10 +01005121 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005122}
5123
5124/* Set the nonce for a multipart authenticated encryption or decryption
5125 operation.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01005126psa_status_t psa_aead_set_nonce(psa_aead_operation_t *operation,
David Horstmann8f0ef512023-12-11 15:17:11 +00005127 const uint8_t *nonce_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01005128 size_t nonce_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01005129{
David Horstmannfed23772023-12-19 17:49:20 +00005130 psa_status_t status;
Paul Elliottcbbde5f2021-05-10 18:19:46 +01005131
David Horstmann8f0ef512023-12-11 15:17:11 +00005132 LOCAL_INPUT_DECLARE(nonce_external, nonce);
5133 LOCAL_INPUT_ALLOC(nonce_external, nonce_length, nonce);
Paul Elliottcee785c2021-05-20 14:29:20 +01005134
David Horstmannfed23772023-12-19 17:49:20 +00005135 status = psa_aead_set_nonce_internal(operation, nonce, nonce_length);
Paul Elliott302ff6b2021-04-20 18:10:30 +01005136
David Horstmann18dc0322023-12-20 16:16:43 +00005137/* Exit label is only needed for buffer copying, prevent unused warnings. */
David Horstmann4a48bec2024-03-13 15:42:31 +00005138#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
Paul Elliott39dc6b82021-05-11 19:16:09 +01005139exit:
David Horstmann18dc0322023-12-20 16:16:43 +00005140#endif
Paul Elliottcbbde5f2021-05-10 18:19:46 +01005141
David Horstmann8f0ef512023-12-11 15:17:11 +00005142 LOCAL_INPUT_FREE(nonce_external, nonce);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01005143
Gilles Peskine449bd832023-01-11 14:50:10 +01005144 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005145}
5146
5147/* Declare the lengths of the message and additional data for multipart AEAD. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005148psa_status_t psa_aead_set_lengths(psa_aead_operation_t *operation,
5149 size_t ad_length,
5150 size_t plaintext_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01005151{
Paul Elliottcbbde5f2021-05-10 18:19:46 +01005152 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
5153
Gilles Peskine449bd832023-01-11 14:50:10 +01005154 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01005155 status = PSA_ERROR_BAD_STATE;
5156 goto exit;
5157 }
5158
Gilles Peskine449bd832023-01-11 14:50:10 +01005159 if (operation->lengths_set || operation->ad_started ||
5160 operation->body_started) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01005161 status = PSA_ERROR_BAD_STATE;
5162 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005163 }
5164
Gilles Peskine449bd832023-01-11 14:50:10 +01005165 switch (operation->alg) {
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02005166#if defined(PSA_WANT_ALG_GCM)
5167 case PSA_ALG_GCM:
5168 /* Lengths can only be too large for GCM if size_t is bigger than 32
Gilles Peskine449bd832023-01-11 14:50:10 +01005169 * bits. Without the guard this code will generate warnings on 32bit
5170 * builds. */
Paul Elliott325d3742021-09-27 17:56:28 +01005171#if SIZE_MAX > UINT32_MAX
Gilles Peskine449bd832023-01-11 14:50:10 +01005172 if (((uint64_t) ad_length) >> 61 != 0 ||
5173 ((uint64_t) plaintext_length) > 0xFFFFFFFE0ull) {
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02005174 status = PSA_ERROR_INVALID_ARGUMENT;
5175 goto exit;
5176 }
Paul Elliott325d3742021-09-27 17:56:28 +01005177#endif
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02005178 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01005179#endif /* PSA_WANT_ALG_GCM */
5180#if defined(PSA_WANT_ALG_CCM)
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02005181 case PSA_ALG_CCM:
Gilles Peskine449bd832023-01-11 14:50:10 +01005182 if (ad_length > 0xFF00) {
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02005183 status = PSA_ERROR_INVALID_ARGUMENT;
5184 goto exit;
5185 }
5186 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01005187#endif /* PSA_WANT_ALG_CCM */
5188#if defined(PSA_WANT_ALG_CHACHA20_POLY1305)
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02005189 case PSA_ALG_CHACHA20_POLY1305:
5190 /* No length restrictions for ChaChaPoly. */
5191 break;
Paul Elliotte716e6c2021-09-29 14:10:20 +01005192#endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */
Przemyslaw Stekiel4cad4fc2021-10-13 11:12:08 +02005193 default:
5194 break;
5195 }
Paul Elliott325d3742021-09-27 17:56:28 +01005196
Gilles Peskine449bd832023-01-11 14:50:10 +01005197 status = psa_driver_wrapper_aead_set_lengths(operation, ad_length,
5198 plaintext_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01005199
Paul Elliott39dc6b82021-05-11 19:16:09 +01005200exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01005201 if (status == PSA_SUCCESS) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01005202 operation->ad_remaining = ad_length;
5203 operation->body_remaining = plaintext_length;
Paul Elliott39dc6b82021-05-11 19:16:09 +01005204 operation->lengths_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01005205 } else {
5206 psa_aead_abort(operation);
Paul Elliottee4ffe02021-05-20 17:25:06 +01005207 }
Paul Elliott39dc6b82021-05-11 19:16:09 +01005208
Gilles Peskine449bd832023-01-11 14:50:10 +01005209 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005210}
Paul Elliott3d7d52c2021-09-01 10:33:14 +01005211
5212/* Pass additional data to an active multipart AEAD operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005213psa_status_t psa_aead_update_ad(psa_aead_operation_t *operation,
David Horstmann25dac6e2023-12-11 15:23:13 +00005214 const uint8_t *input_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01005215 size_t input_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01005216{
Paul Elliottcbbde5f2021-05-10 18:19:46 +01005217 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
5218
David Horstmann25dac6e2023-12-11 15:23:13 +00005219 LOCAL_INPUT_DECLARE(input_external, input);
5220 LOCAL_INPUT_ALLOC(input_external, input_length, input);
5221
Gilles Peskine449bd832023-01-11 14:50:10 +01005222 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01005223 status = PSA_ERROR_BAD_STATE;
5224 goto exit;
5225 }
5226
Gilles Peskine449bd832023-01-11 14:50:10 +01005227 if (!operation->nonce_set || operation->body_started) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01005228 status = PSA_ERROR_BAD_STATE;
5229 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005230 }
5231
Paul Elliott304766f2024-04-26 18:30:11 +01005232 /* No input to add (zero length), nothing to do. */
5233 if (input_length == 0) {
5234 status = PSA_SUCCESS;
5235 goto exit;
5236 }
5237
Gilles Peskine449bd832023-01-11 14:50:10 +01005238 if (operation->lengths_set) {
5239 if (operation->ad_remaining < input_length) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01005240 status = PSA_ERROR_INVALID_ARGUMENT;
5241 goto exit;
5242 }
5243
5244 operation->ad_remaining -= input_length;
5245 }
Paul Elliotte193ea82021-10-01 13:00:16 +01005246#if defined(PSA_WANT_ALG_CCM)
Gilles Peskine449bd832023-01-11 14:50:10 +01005247 else if (operation->alg == PSA_ALG_CCM) {
Paul Elliotte193ea82021-10-01 13:00:16 +01005248 status = PSA_ERROR_BAD_STATE;
5249 goto exit;
5250 }
5251#endif /* PSA_WANT_ALG_CCM */
Paul Elliottee4ffe02021-05-20 17:25:06 +01005252
Gilles Peskine449bd832023-01-11 14:50:10 +01005253 status = psa_driver_wrapper_aead_update_ad(operation, input,
5254 input_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01005255
Paul Elliott39dc6b82021-05-11 19:16:09 +01005256exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01005257 if (status == PSA_SUCCESS) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01005258 operation->ad_started = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01005259 } else {
5260 psa_aead_abort(operation);
5261 }
Paul Elliott39dc6b82021-05-11 19:16:09 +01005262
David Horstmann25dac6e2023-12-11 15:23:13 +00005263 LOCAL_INPUT_FREE(input_external, input);
5264
Gilles Peskine449bd832023-01-11 14:50:10 +01005265 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005266}
5267
5268/* Encrypt or decrypt a message fragment in an active multipart AEAD
5269 operation.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01005270psa_status_t psa_aead_update(psa_aead_operation_t *operation,
David Horstmann2914fac2023-12-11 15:28:37 +00005271 const uint8_t *input_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01005272 size_t input_length,
David Horstmann2914fac2023-12-11 15:28:37 +00005273 uint8_t *output_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01005274 size_t output_size,
5275 size_t *output_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01005276{
Paul Elliottcbbde5f2021-05-10 18:19:46 +01005277 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005278
David Horstmann2914fac2023-12-11 15:28:37 +00005279
5280 LOCAL_INPUT_DECLARE(input_external, input);
5281 LOCAL_OUTPUT_DECLARE(output_external, output);
5282
5283 LOCAL_INPUT_ALLOC(input_external, input_length, input);
5284 LOCAL_OUTPUT_ALLOC(output_external, output_size, output);
5285
Paul Elliott302ff6b2021-04-20 18:10:30 +01005286 *output_length = 0;
5287
Gilles Peskine449bd832023-01-11 14:50:10 +01005288 if (operation->id == 0) {
Paul Elliottcee785c2021-05-20 14:29:20 +01005289 status = PSA_ERROR_BAD_STATE;
5290 goto exit;
5291 }
5292
Gilles Peskine449bd832023-01-11 14:50:10 +01005293 if (!operation->nonce_set) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01005294 status = PSA_ERROR_BAD_STATE;
5295 goto exit;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005296 }
5297
Gilles Peskine449bd832023-01-11 14:50:10 +01005298 if (operation->lengths_set) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01005299 /* Additional data length was supplied, but not all the additional
5300 data was supplied.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01005301 if (operation->ad_remaining != 0) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01005302 status = PSA_ERROR_INVALID_ARGUMENT;
5303 goto exit;
5304 }
5305
5306 /* Too much data provided. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005307 if (operation->body_remaining < input_length) {
Paul Elliottee4ffe02021-05-20 17:25:06 +01005308 status = PSA_ERROR_INVALID_ARGUMENT;
5309 goto exit;
5310 }
5311
5312 operation->body_remaining -= input_length;
5313 }
Paul Elliotte193ea82021-10-01 13:00:16 +01005314#if defined(PSA_WANT_ALG_CCM)
Gilles Peskine449bd832023-01-11 14:50:10 +01005315 else if (operation->alg == PSA_ALG_CCM) {
Paul Elliotte193ea82021-10-01 13:00:16 +01005316 status = PSA_ERROR_BAD_STATE;
5317 goto exit;
5318 }
5319#endif /* PSA_WANT_ALG_CCM */
Paul Elliottee4ffe02021-05-20 17:25:06 +01005320
Gilles Peskine449bd832023-01-11 14:50:10 +01005321 status = psa_driver_wrapper_aead_update(operation, input, input_length,
5322 output, output_size,
5323 output_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01005324
Paul Elliott39dc6b82021-05-11 19:16:09 +01005325exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01005326 if (status == PSA_SUCCESS) {
Paul Elliott39dc6b82021-05-11 19:16:09 +01005327 operation->body_started = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01005328 } else {
5329 psa_aead_abort(operation);
5330 }
Paul Elliott39dc6b82021-05-11 19:16:09 +01005331
David Horstmann2914fac2023-12-11 15:28:37 +00005332 LOCAL_INPUT_FREE(input_external, input);
5333 LOCAL_OUTPUT_FREE(output_external, output);
5334
Gilles Peskine449bd832023-01-11 14:50:10 +01005335 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005336}
5337
Gilles Peskine449bd832023-01-11 14:50:10 +01005338static psa_status_t psa_aead_final_checks(const psa_aead_operation_t *operation)
Paul Elliottad53dcc2021-06-23 08:50:14 +01005339{
Gilles Peskine449bd832023-01-11 14:50:10 +01005340 if (operation->id == 0 || !operation->nonce_set) {
5341 return PSA_ERROR_BAD_STATE;
5342 }
Paul Elliottad53dcc2021-06-23 08:50:14 +01005343
Gilles Peskine449bd832023-01-11 14:50:10 +01005344 if (operation->lengths_set && (operation->ad_remaining != 0 ||
5345 operation->body_remaining != 0)) {
5346 return PSA_ERROR_INVALID_ARGUMENT;
5347 }
Paul Elliottad53dcc2021-06-23 08:50:14 +01005348
Gilles Peskine449bd832023-01-11 14:50:10 +01005349 return PSA_SUCCESS;
Paul Elliottad53dcc2021-06-23 08:50:14 +01005350}
5351
Paul Elliott302ff6b2021-04-20 18:10:30 +01005352/* Finish encrypting a message in a multipart AEAD operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005353psa_status_t psa_aead_finish(psa_aead_operation_t *operation,
David Horstmann6db0e732023-12-11 15:35:59 +00005354 uint8_t *ciphertext_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01005355 size_t ciphertext_size,
5356 size_t *ciphertext_length,
David Horstmann6db0e732023-12-11 15:35:59 +00005357 uint8_t *tag_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01005358 size_t tag_size,
5359 size_t *tag_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01005360{
Paul Elliott39dc6b82021-05-11 19:16:09 +01005361 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
5362
David Horstmann6db0e732023-12-11 15:35:59 +00005363 LOCAL_OUTPUT_DECLARE(ciphertext_external, ciphertext);
5364 LOCAL_OUTPUT_DECLARE(tag_external, tag);
5365
5366 LOCAL_OUTPUT_ALLOC(ciphertext_external, ciphertext_size, ciphertext);
5367 LOCAL_OUTPUT_ALLOC(tag_external, tag_size, tag);
5368
Paul Elliott302ff6b2021-04-20 18:10:30 +01005369 *ciphertext_length = 0;
Paul Elliottf88a5652021-06-22 17:53:45 +01005370 *tag_length = tag_size;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005371
Gilles Peskine449bd832023-01-11 14:50:10 +01005372 status = psa_aead_final_checks(operation);
5373 if (status != PSA_SUCCESS) {
Paul Elliottad53dcc2021-06-23 08:50:14 +01005374 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005375 }
Paul Elliottad53dcc2021-06-23 08:50:14 +01005376
Gilles Peskine449bd832023-01-11 14:50:10 +01005377 if (!operation->is_encrypt) {
Paul Elliottcee785c2021-05-20 14:29:20 +01005378 status = PSA_ERROR_BAD_STATE;
5379 goto exit;
5380 }
5381
Gilles Peskine449bd832023-01-11 14:50:10 +01005382 status = psa_driver_wrapper_aead_finish(operation, ciphertext,
5383 ciphertext_size,
5384 ciphertext_length,
5385 tag, tag_size, tag_length);
Paul Elliottcbbde5f2021-05-10 18:19:46 +01005386
Paul Elliott39dc6b82021-05-11 19:16:09 +01005387exit:
Paul Elliottdc42ca82023-02-24 18:11:59 +00005388
5389
Paul Elliottf47b0952021-05-21 18:02:33 +01005390 /* In case the operation fails and the user fails to check for failure or
Paul Elliott4c916e82021-09-19 18:34:50 +01005391 * the zero tag size, make sure the tag is set to something implausible.
5392 * Even if the operation succeeds, make sure we clear the rest of the
5393 * buffer to prevent potential leakage of anything previously placed in
5394 * the same buffer.*/
Paul Elliottdc42ca82023-02-24 18:11:59 +00005395 psa_wipe_tag_output_buffer(tag, status, tag_size, *tag_length);
Paul Elliottf47b0952021-05-21 18:02:33 +01005396
Gilles Peskine449bd832023-01-11 14:50:10 +01005397 psa_aead_abort(operation);
Paul Elliott39dc6b82021-05-11 19:16:09 +01005398
David Horstmann6db0e732023-12-11 15:35:59 +00005399 LOCAL_OUTPUT_FREE(ciphertext_external, ciphertext);
5400 LOCAL_OUTPUT_FREE(tag_external, tag);
5401
Gilles Peskine449bd832023-01-11 14:50:10 +01005402 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005403}
5404
5405/* Finish authenticating and decrypting a message in a multipart AEAD
5406 operation.*/
Gilles Peskine449bd832023-01-11 14:50:10 +01005407psa_status_t psa_aead_verify(psa_aead_operation_t *operation,
David Horstmanne000a0a2023-12-11 16:37:04 +00005408 uint8_t *plaintext_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01005409 size_t plaintext_size,
5410 size_t *plaintext_length,
David Horstmanne000a0a2023-12-11 16:37:04 +00005411 const uint8_t *tag_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01005412 size_t tag_length)
Paul Elliott302ff6b2021-04-20 18:10:30 +01005413{
Paul Elliott39dc6b82021-05-11 19:16:09 +01005414 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
5415
David Horstmanne000a0a2023-12-11 16:37:04 +00005416 LOCAL_OUTPUT_DECLARE(plaintext_external, plaintext);
5417 LOCAL_INPUT_DECLARE(tag_external, tag);
5418
5419 LOCAL_OUTPUT_ALLOC(plaintext_external, plaintext_size, plaintext);
5420 LOCAL_INPUT_ALLOC(tag_external, tag_length, tag);
5421
Paul Elliott302ff6b2021-04-20 18:10:30 +01005422 *plaintext_length = 0;
5423
Gilles Peskine449bd832023-01-11 14:50:10 +01005424 status = psa_aead_final_checks(operation);
5425 if (status != PSA_SUCCESS) {
Paul Elliottad53dcc2021-06-23 08:50:14 +01005426 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01005427 }
Paul Elliottad53dcc2021-06-23 08:50:14 +01005428
Gilles Peskine449bd832023-01-11 14:50:10 +01005429 if (operation->is_encrypt) {
Paul Elliottcee785c2021-05-20 14:29:20 +01005430 status = PSA_ERROR_BAD_STATE;
5431 goto exit;
5432 }
5433
Gilles Peskine449bd832023-01-11 14:50:10 +01005434 status = psa_driver_wrapper_aead_verify(operation, plaintext,
5435 plaintext_size,
5436 plaintext_length,
5437 tag, tag_length);
Paul Elliott39dc6b82021-05-11 19:16:09 +01005438
5439exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01005440 psa_aead_abort(operation);
Paul Elliott39dc6b82021-05-11 19:16:09 +01005441
David Horstmanne000a0a2023-12-11 16:37:04 +00005442 LOCAL_OUTPUT_FREE(plaintext_external, plaintext);
5443 LOCAL_INPUT_FREE(tag_external, tag);
5444
Gilles Peskine449bd832023-01-11 14:50:10 +01005445 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005446}
5447
5448/* Abort an AEAD operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005449psa_status_t psa_aead_abort(psa_aead_operation_t *operation)
Paul Elliott302ff6b2021-04-20 18:10:30 +01005450{
5451 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
5452
Gilles Peskine449bd832023-01-11 14:50:10 +01005453 if (operation->id == 0) {
Paul Elliott302ff6b2021-04-20 18:10:30 +01005454 /* The object has (apparently) been initialized but it is not (yet)
5455 * in use. It's ok to call abort on such an object, and there's
5456 * nothing to do. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005457 return PSA_SUCCESS;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005458 }
5459
Gilles Peskine449bd832023-01-11 14:50:10 +01005460 status = psa_driver_wrapper_aead_abort(operation);
Paul Elliott302ff6b2021-04-20 18:10:30 +01005461
Gilles Peskine449bd832023-01-11 14:50:10 +01005462 memset(operation, 0, sizeof(*operation));
Paul Elliott302ff6b2021-04-20 18:10:30 +01005463
Gilles Peskine449bd832023-01-11 14:50:10 +01005464 return status;
Paul Elliott302ff6b2021-04-20 18:10:30 +01005465}
5466
Gilles Peskinee59236f2018-01-27 23:32:46 +01005467/****************************************************************/
Gilles Peskineeab56e42018-07-12 17:12:33 +02005468/* Generators */
5469/****************************************************************/
5470
Przemek Stekiel69c46792022-06-10 12:59:51 +02005471#if defined(BUILTIN_ALG_ANY_HKDF) || \
John Durkop07cc04a2020-11-16 22:08:34 -08005472 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005473 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) || \
Kusumit Ghoderaoaf0b5342023-05-03 11:58:46 +05305474 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) || \
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05305475 defined(PSA_HAVE_SOFT_PBKDF2)
John Durkop07cc04a2020-11-16 22:08:34 -08005476#define AT_LEAST_ONE_BUILTIN_KDF
Steven Cooreman094a77e2021-05-06 17:58:36 +02005477#endif /* At least one builtin KDF */
5478
Przemek Stekiel69c46792022-06-10 12:59:51 +02005479#if defined(BUILTIN_ALG_ANY_HKDF) || \
Steven Cooreman094a77e2021-05-06 17:58:36 +02005480 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
5481 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
5482static psa_status_t psa_key_derivation_start_hmac(
5483 psa_mac_operation_t *operation,
5484 psa_algorithm_t hash_alg,
5485 const uint8_t *hmac_key,
Gilles Peskine449bd832023-01-11 14:50:10 +01005486 size_t hmac_key_length)
Steven Cooreman094a77e2021-05-06 17:58:36 +02005487{
5488 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
5489 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Gilles Peskine449bd832023-01-11 14:50:10 +01005490 psa_set_key_type(&attributes, PSA_KEY_TYPE_HMAC);
5491 psa_set_key_bits(&attributes, PSA_BYTES_TO_BITS(hmac_key_length));
5492 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_HASH);
Steven Cooreman094a77e2021-05-06 17:58:36 +02005493
Steven Cooreman72f736a2021-05-07 14:14:37 +02005494 operation->is_sign = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01005495 operation->mac_size = PSA_HASH_LENGTH(hash_alg);
Steven Cooreman72f736a2021-05-07 14:14:37 +02005496
Gilles Peskine449bd832023-01-11 14:50:10 +01005497 status = psa_driver_wrapper_mac_sign_setup(operation,
5498 &attributes,
5499 hmac_key, hmac_key_length,
5500 PSA_ALG_HMAC(hash_alg));
Steven Cooreman094a77e2021-05-06 17:58:36 +02005501
Gilles Peskine449bd832023-01-11 14:50:10 +01005502 psa_reset_key_attributes(&attributes);
5503 return status;
Steven Cooreman094a77e2021-05-06 17:58:36 +02005504}
5505#endif /* KDF algorithms reliant on HMAC */
John Durkop07cc04a2020-11-16 22:08:34 -08005506
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005507#define HKDF_STATE_INIT 0 /* no input yet */
5508#define HKDF_STATE_STARTED 1 /* got salt */
5509#define HKDF_STATE_KEYED 2 /* got key */
5510#define HKDF_STATE_OUTPUT 3 /* output started */
5511
Gilles Peskinecbe66502019-05-16 16:59:18 +02005512static psa_algorithm_t psa_key_derivation_get_kdf_alg(
Gilles Peskine449bd832023-01-11 14:50:10 +01005513 const psa_key_derivation_operation_t *operation)
Gilles Peskine969c5d62019-01-16 15:53:06 +01005514{
Gilles Peskine449bd832023-01-11 14:50:10 +01005515 if (PSA_ALG_IS_KEY_AGREEMENT(operation->alg)) {
5516 return PSA_ALG_KEY_AGREEMENT_GET_KDF(operation->alg);
5517 } else {
5518 return operation->alg;
5519 }
Gilles Peskine969c5d62019-01-16 15:53:06 +01005520}
5521
Gilles Peskine449bd832023-01-11 14:50:10 +01005522psa_status_t psa_key_derivation_abort(psa_key_derivation_operation_t *operation)
Gilles Peskineeab56e42018-07-12 17:12:33 +02005523{
5524 psa_status_t status = PSA_SUCCESS;
Gilles Peskine449bd832023-01-11 14:50:10 +01005525 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation);
5526 if (kdf_alg == 0) {
Gilles Peskineeab56e42018-07-12 17:12:33 +02005527 /* The object has (apparently) been initialized but it is not
5528 * in use. It's ok to call abort on such an object, and there's
5529 * nothing to do. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005530 } else
Przemek Stekiel69c46792022-06-10 12:59:51 +02005531#if defined(BUILTIN_ALG_ANY_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01005532 if (PSA_ALG_IS_ANY_HKDF(kdf_alg)) {
5533 mbedtls_free(operation->ctx.hkdf.info);
5534 status = psa_mac_abort(&operation->ctx.hkdf.hmac);
5535 } else
Przemek Stekiel69c46792022-06-10 12:59:51 +02005536#endif /* BUILTIN_ALG_ANY_HKDF */
John Durkop07cc04a2020-11-16 22:08:34 -08005537#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
5538 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005539 if (PSA_ALG_IS_TLS12_PRF(kdf_alg) ||
5540 /* TLS-1.2 PSK-to-MS KDF uses the same core as TLS-1.2 PRF */
5541 PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
5542 if (operation->ctx.tls12_prf.secret != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01005543 mbedtls_zeroize_and_free(operation->ctx.tls12_prf.secret,
Gilles Peskine449bd832023-01-11 14:50:10 +01005544 operation->ctx.tls12_prf.secret_length);
Steven Cooremana6df6042021-04-29 19:32:25 +02005545 }
5546
Gilles Peskine449bd832023-01-11 14:50:10 +01005547 if (operation->ctx.tls12_prf.seed != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01005548 mbedtls_zeroize_and_free(operation->ctx.tls12_prf.seed,
Gilles Peskine449bd832023-01-11 14:50:10 +01005549 operation->ctx.tls12_prf.seed_length);
Janos Follath6a1d2622019-06-11 10:37:28 +01005550 }
5551
Gilles Peskine449bd832023-01-11 14:50:10 +01005552 if (operation->ctx.tls12_prf.label != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01005553 mbedtls_zeroize_and_free(operation->ctx.tls12_prf.label,
Gilles Peskine449bd832023-01-11 14:50:10 +01005554 operation->ctx.tls12_prf.label_length);
Janos Follath6a1d2622019-06-11 10:37:28 +01005555 }
Przemek Stekiel6c764412022-11-22 14:05:12 +01005556#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005557 if (operation->ctx.tls12_prf.other_secret != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01005558 mbedtls_zeroize_and_free(operation->ctx.tls12_prf.other_secret,
Gilles Peskine449bd832023-01-11 14:50:10 +01005559 operation->ctx.tls12_prf.other_secret_length);
Przemek Stekiele3ee2212022-04-07 14:29:56 +02005560 }
Przemek Stekiel6c764412022-11-22 14:05:12 +01005561#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Steven Cooremana6df6042021-04-29 19:32:25 +02005562 status = PSA_SUCCESS;
Janos Follath6a1d2622019-06-11 10:37:28 +01005563
5564 /* We leave the fields Ai and output_block to be erased safely by the
5565 * mbedtls_platform_zeroize() in the end of this function. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005566 } else
John Durkop07cc04a2020-11-16 22:08:34 -08005567#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) ||
5568 * defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) */
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005569#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Gilles Peskine449bd832023-01-11 14:50:10 +01005570 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
5571 mbedtls_platform_zeroize(operation->ctx.tls12_ecjpake_to_pms.data,
5572 sizeof(operation->ctx.tls12_ecjpake_to_pms.data));
5573 } else
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005574#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) */
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05305575#if defined(PSA_HAVE_SOFT_PBKDF2)
Kusumit Ghoderao9ab03c32023-07-27 21:14:05 +05305576 if (PSA_ALG_IS_PBKDF2(kdf_alg)) {
Kusumit Ghoderaof5fedf12023-05-03 12:29:48 +05305577 if (operation->ctx.pbkdf2.salt != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01005578 mbedtls_zeroize_and_free(operation->ctx.pbkdf2.salt,
Kusumit Ghoderaof5fedf12023-05-03 12:29:48 +05305579 operation->ctx.pbkdf2.salt_length);
Kusumit Ghoderaof5fedf12023-05-03 12:29:48 +05305580 }
Kusumit Ghoderaof5fedf12023-05-03 12:29:48 +05305581
5582 status = PSA_SUCCESS;
5583 } else
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05305584#endif /* defined(PSA_HAVE_SOFT_PBKDF2) */
Gilles Peskineeab56e42018-07-12 17:12:33 +02005585 {
5586 status = PSA_ERROR_BAD_STATE;
5587 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005588 mbedtls_platform_zeroize(operation, sizeof(*operation));
5589 return status;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005590}
5591
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005592psa_status_t psa_key_derivation_get_capacity(const psa_key_derivation_operation_t *operation,
Gilles Peskine449bd832023-01-11 14:50:10 +01005593 size_t *capacity)
Gilles Peskineeab56e42018-07-12 17:12:33 +02005594{
Gilles Peskine449bd832023-01-11 14:50:10 +01005595 if (operation->alg == 0) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005596 /* This is a blank key derivation operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005597 return PSA_ERROR_BAD_STATE;
Jaeden Amerocf2010c2019-02-15 13:05:49 +00005598 }
5599
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005600 *capacity = operation->capacity;
Gilles Peskine449bd832023-01-11 14:50:10 +01005601 return PSA_SUCCESS;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005602}
5603
Gilles Peskine449bd832023-01-11 14:50:10 +01005604psa_status_t psa_key_derivation_set_capacity(psa_key_derivation_operation_t *operation,
5605 size_t capacity)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005606{
Gilles Peskine449bd832023-01-11 14:50:10 +01005607 if (operation->alg == 0) {
5608 return PSA_ERROR_BAD_STATE;
5609 }
5610 if (capacity > operation->capacity) {
5611 return PSA_ERROR_INVALID_ARGUMENT;
5612 }
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005613 operation->capacity = capacity;
Gilles Peskine449bd832023-01-11 14:50:10 +01005614 return PSA_SUCCESS;
Gilles Peskineeab56e42018-07-12 17:12:33 +02005615}
5616
Przemek Stekiel69c46792022-06-10 12:59:51 +02005617#if defined(BUILTIN_ALG_ANY_HKDF)
Przemek Stekiel03d948c2022-05-19 11:45:20 +02005618/* Read some bytes from an HKDF-based operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005619static psa_status_t psa_key_derivation_hkdf_read(psa_hkdf_key_derivation_t *hkdf,
5620 psa_algorithm_t kdf_alg,
5621 uint8_t *output,
5622 size_t output_length)
Gilles Peskinebef7f142018-07-12 17:22:21 +02005623{
Gilles Peskine449bd832023-01-11 14:50:10 +01005624 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(kdf_alg);
5625 uint8_t hash_length = PSA_HASH_LENGTH(hash_alg);
Steven Cooremand1ed1d92021-04-29 19:11:25 +02005626 size_t hmac_output_length;
Gilles Peskinebef7f142018-07-12 17:22:21 +02005627 psa_status_t status;
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02005628#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01005629 const uint8_t last_block = PSA_ALG_IS_HKDF_EXTRACT(kdf_alg) ? 0 : 0xff;
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02005630#else
5631 const uint8_t last_block = 0xff;
5632#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Gilles Peskinebef7f142018-07-12 17:22:21 +02005633
Gilles Peskine449bd832023-01-11 14:50:10 +01005634 if (hkdf->state < HKDF_STATE_KEYED ||
5635 (!hkdf->info_set
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02005636#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01005637 && !PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02005638#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Gilles Peskine449bd832023-01-11 14:50:10 +01005639 )) {
5640 return PSA_ERROR_BAD_STATE;
5641 }
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01005642 hkdf->state = HKDF_STATE_OUTPUT;
5643
Gilles Peskine449bd832023-01-11 14:50:10 +01005644 while (output_length != 0) {
Gilles Peskinebef7f142018-07-12 17:22:21 +02005645 /* Copy what remains of the current block */
5646 uint8_t n = hash_length - hkdf->offset_in_block;
Gilles Peskine449bd832023-01-11 14:50:10 +01005647 if (n > output_length) {
Gilles Peskinebef7f142018-07-12 17:22:21 +02005648 n = (uint8_t) output_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01005649 }
5650 memcpy(output, hkdf->output_block + hkdf->offset_in_block, n);
Gilles Peskinebef7f142018-07-12 17:22:21 +02005651 output += n;
5652 output_length -= n;
5653 hkdf->offset_in_block += n;
Gilles Peskine449bd832023-01-11 14:50:10 +01005654 if (output_length == 0) {
Gilles Peskinebef7f142018-07-12 17:22:21 +02005655 break;
Gilles Peskine449bd832023-01-11 14:50:10 +01005656 }
Przemek Stekiel03d948c2022-05-19 11:45:20 +02005657 /* We can't be wanting more output after the last block, otherwise
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02005658 * the capacity check in psa_key_derivation_output_bytes() would have
Gilles Peskine51ae0e42019-05-16 17:31:03 +02005659 * prevented this call. It could happen only if the operation
Gilles Peskined54931c2018-07-17 21:06:59 +02005660 * object was corrupted or if this function is called directly
5661 * inside the library. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005662 if (hkdf->block_number == last_block) {
5663 return PSA_ERROR_BAD_STATE;
5664 }
Gilles Peskinebef7f142018-07-12 17:22:21 +02005665
5666 /* We need a new block */
5667 ++hkdf->block_number;
5668 hkdf->offset_in_block = 0;
Steven Cooremand1ed1d92021-04-29 19:11:25 +02005669
Gilles Peskine449bd832023-01-11 14:50:10 +01005670 status = psa_key_derivation_start_hmac(&hkdf->hmac,
5671 hash_alg,
5672 hkdf->prk,
5673 hash_length);
5674 if (status != PSA_SUCCESS) {
5675 return status;
Gilles Peskinebef7f142018-07-12 17:22:21 +02005676 }
Gilles Peskine449bd832023-01-11 14:50:10 +01005677
5678 if (hkdf->block_number != 1) {
5679 status = psa_mac_update(&hkdf->hmac,
5680 hkdf->output_block,
5681 hash_length);
5682 if (status != PSA_SUCCESS) {
5683 return status;
5684 }
5685 }
5686 status = psa_mac_update(&hkdf->hmac,
5687 hkdf->info,
5688 hkdf->info_length);
5689 if (status != PSA_SUCCESS) {
5690 return status;
5691 }
5692 status = psa_mac_update(&hkdf->hmac,
5693 &hkdf->block_number, 1);
5694 if (status != PSA_SUCCESS) {
5695 return status;
5696 }
5697 status = psa_mac_sign_finish(&hkdf->hmac,
5698 hkdf->output_block,
5699 sizeof(hkdf->output_block),
5700 &hmac_output_length);
5701 if (status != PSA_SUCCESS) {
5702 return status;
5703 }
Gilles Peskinebef7f142018-07-12 17:22:21 +02005704 }
5705
Gilles Peskine449bd832023-01-11 14:50:10 +01005706 return PSA_SUCCESS;
Gilles Peskinebef7f142018-07-12 17:22:21 +02005707}
Przemek Stekiel69c46792022-06-10 12:59:51 +02005708#endif /* BUILTIN_ALG_ANY_HKDF */
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005709
John Durkop07cc04a2020-11-16 22:08:34 -08005710#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
5711 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Janos Follath7742fee2019-06-17 12:58:10 +01005712static psa_status_t psa_key_derivation_tls12_prf_generate_next_block(
5713 psa_tls12_prf_key_derivation_t *tls12_prf,
Gilles Peskine449bd832023-01-11 14:50:10 +01005714 psa_algorithm_t alg)
Janos Follath7742fee2019-06-17 12:58:10 +01005715{
Gilles Peskine449bd832023-01-11 14:50:10 +01005716 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(alg);
5717 uint8_t hash_length = PSA_HASH_LENGTH(hash_alg);
Steven Cooremana6df6042021-04-29 19:32:25 +02005718 psa_mac_operation_t hmac = PSA_MAC_OPERATION_INIT;
5719 size_t hmac_output_length;
Janos Follathea29bfb2019-06-19 12:21:20 +01005720 psa_status_t status, cleanup_status;
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005721
Janos Follath7742fee2019-06-17 12:58:10 +01005722 /* We can't be wanting more output after block 0xff, otherwise
5723 * the capacity check in psa_key_derivation_output_bytes() would have
5724 * prevented this call. It could happen only if the operation
5725 * object was corrupted or if this function is called directly
5726 * inside the library. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005727 if (tls12_prf->block_number == 0xff) {
5728 return PSA_ERROR_CORRUPTION_DETECTED;
5729 }
Janos Follath7742fee2019-06-17 12:58:10 +01005730
5731 /* We need a new block */
5732 ++tls12_prf->block_number;
Janos Follath844eb0e2019-06-19 12:10:49 +01005733 tls12_prf->left_in_block = hash_length;
Janos Follath7742fee2019-06-17 12:58:10 +01005734
5735 /* Recall the definition of the TLS-1.2-PRF from RFC 5246:
5736 *
5737 * PRF(secret, label, seed) = P_<hash>(secret, label + seed)
5738 *
5739 * P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
5740 * HMAC_hash(secret, A(2) + seed) +
5741 * HMAC_hash(secret, A(3) + seed) + ...
5742 *
5743 * A(0) = seed
Janos Follathea29bfb2019-06-19 12:21:20 +01005744 * A(i) = HMAC_hash(secret, A(i-1))
Janos Follath7742fee2019-06-17 12:58:10 +01005745 *
Janos Follathea29bfb2019-06-19 12:21:20 +01005746 * The `psa_tls12_prf_key_derivation` structure saves the block
Janos Follath7742fee2019-06-17 12:58:10 +01005747 * `HMAC_hash(secret, A(i) + seed)` from which the output
Janos Follath76c39842019-06-26 12:50:36 +01005748 * is currently extracted as `output_block` and where i is
5749 * `block_number`.
Janos Follath7742fee2019-06-17 12:58:10 +01005750 */
5751
Gilles Peskine449bd832023-01-11 14:50:10 +01005752 status = psa_key_derivation_start_hmac(&hmac,
5753 hash_alg,
5754 tls12_prf->secret,
5755 tls12_prf->secret_length);
5756 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005757 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005758 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005759
5760 /* Calculate A(i) where i = tls12_prf->block_number. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005761 if (tls12_prf->block_number == 1) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005762 /* A(1) = HMAC_hash(secret, A(0)), where A(0) = seed. (The RFC overloads
5763 * the variable seed and in this instance means it in the context of the
5764 * P_hash function, where seed = label + seed.) */
Gilles Peskine449bd832023-01-11 14:50:10 +01005765 status = psa_mac_update(&hmac,
5766 tls12_prf->label,
5767 tls12_prf->label_length);
5768 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005769 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005770 }
5771 status = psa_mac_update(&hmac,
5772 tls12_prf->seed,
5773 tls12_prf->seed_length);
5774 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005775 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005776 }
5777 } else {
Janos Follathea29bfb2019-06-19 12:21:20 +01005778 /* A(i) = HMAC_hash(secret, A(i-1)) */
Gilles Peskine449bd832023-01-11 14:50:10 +01005779 status = psa_mac_update(&hmac, tls12_prf->Ai, hash_length);
5780 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005781 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005782 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005783 }
5784
Gilles Peskine449bd832023-01-11 14:50:10 +01005785 status = psa_mac_sign_finish(&hmac,
5786 tls12_prf->Ai, hash_length,
5787 &hmac_output_length);
5788 if (hmac_output_length != hash_length) {
Steven Cooremana6df6042021-04-29 19:32:25 +02005789 status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine449bd832023-01-11 14:50:10 +01005790 }
5791 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005792 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005793 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005794
5795 /* Calculate HMAC_hash(secret, A(i) + label + seed). */
Gilles Peskine449bd832023-01-11 14:50:10 +01005796 status = psa_key_derivation_start_hmac(&hmac,
5797 hash_alg,
5798 tls12_prf->secret,
5799 tls12_prf->secret_length);
5800 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005801 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005802 }
5803 status = psa_mac_update(&hmac, tls12_prf->Ai, hash_length);
5804 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005805 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005806 }
5807 status = psa_mac_update(&hmac, tls12_prf->label, tls12_prf->label_length);
5808 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005809 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005810 }
5811 status = psa_mac_update(&hmac, tls12_prf->seed, tls12_prf->seed_length);
5812 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005813 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005814 }
5815 status = psa_mac_sign_finish(&hmac,
5816 tls12_prf->output_block, hash_length,
5817 &hmac_output_length);
5818 if (status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005819 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01005820 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005821
Janos Follath7742fee2019-06-17 12:58:10 +01005822
5823cleanup:
Gilles Peskine449bd832023-01-11 14:50:10 +01005824 cleanup_status = psa_mac_abort(&hmac);
5825 if (status == PSA_SUCCESS && cleanup_status != PSA_SUCCESS) {
Janos Follathea29bfb2019-06-19 12:21:20 +01005826 status = cleanup_status;
Gilles Peskine449bd832023-01-11 14:50:10 +01005827 }
Janos Follathea29bfb2019-06-19 12:21:20 +01005828
Gilles Peskine449bd832023-01-11 14:50:10 +01005829 return status;
Janos Follath7742fee2019-06-17 12:58:10 +01005830}
Hanno Beckerc8a41d72018-10-09 17:33:01 +01005831
Janos Follath844eb0e2019-06-19 12:10:49 +01005832static psa_status_t psa_key_derivation_tls12_prf_read(
5833 psa_tls12_prf_key_derivation_t *tls12_prf,
5834 psa_algorithm_t alg,
5835 uint8_t *output,
Gilles Peskine449bd832023-01-11 14:50:10 +01005836 size_t output_length)
Janos Follath844eb0e2019-06-19 12:10:49 +01005837{
Gilles Peskine449bd832023-01-11 14:50:10 +01005838 psa_algorithm_t hash_alg = PSA_ALG_TLS12_PRF_GET_HASH(alg);
5839 uint8_t hash_length = PSA_HASH_LENGTH(hash_alg);
Janos Follath844eb0e2019-06-19 12:10:49 +01005840 psa_status_t status;
5841 uint8_t offset, length;
5842
Gilles Peskine449bd832023-01-11 14:50:10 +01005843 switch (tls12_prf->state) {
Gilles Peskineb1edaec2021-06-11 22:41:46 +02005844 case PSA_TLS12_PRF_STATE_LABEL_SET:
5845 tls12_prf->state = PSA_TLS12_PRF_STATE_OUTPUT;
5846 break;
5847 case PSA_TLS12_PRF_STATE_OUTPUT:
5848 break;
5849 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01005850 return PSA_ERROR_BAD_STATE;
Gilles Peskineb1edaec2021-06-11 22:41:46 +02005851 }
5852
Gilles Peskine449bd832023-01-11 14:50:10 +01005853 while (output_length != 0) {
Janos Follath844eb0e2019-06-19 12:10:49 +01005854 /* Check if we have fully processed the current block. */
Gilles Peskine449bd832023-01-11 14:50:10 +01005855 if (tls12_prf->left_in_block == 0) {
5856 status = psa_key_derivation_tls12_prf_generate_next_block(tls12_prf,
5857 alg);
5858 if (status != PSA_SUCCESS) {
5859 return status;
5860 }
Janos Follath844eb0e2019-06-19 12:10:49 +01005861
5862 continue;
5863 }
5864
Gilles Peskine449bd832023-01-11 14:50:10 +01005865 if (tls12_prf->left_in_block > output_length) {
Janos Follath844eb0e2019-06-19 12:10:49 +01005866 length = (uint8_t) output_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01005867 } else {
Janos Follath844eb0e2019-06-19 12:10:49 +01005868 length = tls12_prf->left_in_block;
Gilles Peskine449bd832023-01-11 14:50:10 +01005869 }
Janos Follath844eb0e2019-06-19 12:10:49 +01005870
5871 offset = hash_length - tls12_prf->left_in_block;
Gilles Peskine449bd832023-01-11 14:50:10 +01005872 memcpy(output, tls12_prf->output_block + offset, length);
Janos Follath844eb0e2019-06-19 12:10:49 +01005873 output += length;
5874 output_length -= length;
5875 tls12_prf->left_in_block -= length;
5876 }
5877
Gilles Peskine449bd832023-01-11 14:50:10 +01005878 return PSA_SUCCESS;
Janos Follath844eb0e2019-06-19 12:10:49 +01005879}
John Durkop07cc04a2020-11-16 22:08:34 -08005880#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF ||
5881 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Gilles Peskinebef7f142018-07-12 17:22:21 +02005882
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005883#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
5884static psa_status_t psa_key_derivation_tls12_ecjpake_to_pms_read(
5885 psa_tls12_ecjpake_to_pms_t *ecjpake,
5886 uint8_t *output,
Gilles Peskine449bd832023-01-11 14:50:10 +01005887 size_t output_length)
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005888{
5889 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Andrzej Kurek5603efd2022-09-26 10:49:16 -04005890 size_t output_size = 0;
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005891
Gilles Peskine449bd832023-01-11 14:50:10 +01005892 if (output_length != 32) {
5893 return PSA_ERROR_INVALID_ARGUMENT;
5894 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005895
Gilles Peskine449bd832023-01-11 14:50:10 +01005896 status = psa_hash_compute(PSA_ALG_SHA_256, ecjpake->data,
5897 PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE, output, output_length,
5898 &output_size);
5899 if (status != PSA_SUCCESS) {
5900 return status;
5901 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005902
Gilles Peskine449bd832023-01-11 14:50:10 +01005903 if (output_size != output_length) {
5904 return PSA_ERROR_GENERIC_ERROR;
5905 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005906
Gilles Peskine449bd832023-01-11 14:50:10 +01005907 return PSA_SUCCESS;
Andrzej Kurek08d34b82022-07-29 10:00:16 -04005908}
5909#endif
5910
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05305911#if defined(PSA_HAVE_SOFT_PBKDF2)
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305912static psa_status_t psa_key_derivation_pbkdf2_generate_block(
5913 psa_pbkdf2_key_derivation_t *pbkdf2,
5914 psa_algorithm_t prf_alg,
5915 uint8_t prf_output_length,
5916 psa_key_attributes_t *attributes)
5917{
5918 psa_status_t status;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305919 psa_mac_operation_t mac_operation = PSA_MAC_OPERATION_INIT;
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305920 size_t mac_output_length;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305921 uint8_t U_i[PSA_MAC_MAX_SIZE];
Kusumit Ghoderao257ea002023-06-14 15:55:11 +05305922 uint8_t *U_accumulator = pbkdf2->output_block;
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305923 uint64_t i;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305924 uint8_t block_counter[4];
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305925
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305926 mac_operation.is_sign = 1;
5927 mac_operation.mac_size = prf_output_length;
5928 MBEDTLS_PUT_UINT32_BE(pbkdf2->block_number, block_counter, 0);
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305929
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305930 status = psa_driver_wrapper_mac_sign_setup(&mac_operation,
5931 attributes,
5932 pbkdf2->password,
5933 pbkdf2->password_length,
5934 prf_alg);
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305935 if (status != PSA_SUCCESS) {
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305936 goto cleanup;
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305937 }
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305938 status = psa_mac_update(&mac_operation, pbkdf2->salt, pbkdf2->salt_length);
5939 if (status != PSA_SUCCESS) {
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305940 goto cleanup;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305941 }
Kusumit Ghoderao257ea002023-06-14 15:55:11 +05305942 status = psa_mac_update(&mac_operation, block_counter, sizeof(block_counter));
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305943 if (status != PSA_SUCCESS) {
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305944 goto cleanup;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305945 }
5946 status = psa_mac_sign_finish(&mac_operation, U_i, sizeof(U_i),
5947 &mac_output_length);
5948 if (status != PSA_SUCCESS) {
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305949 goto cleanup;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305950 }
5951
5952 if (mac_output_length != prf_output_length) {
Kusumit Ghoderao257ea002023-06-14 15:55:11 +05305953 status = PSA_ERROR_CORRUPTION_DETECTED;
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305954 goto cleanup;
Kusumit Ghoderaob821a5f2023-06-08 16:35:55 +05305955 }
5956
Kusumit Ghoderao257ea002023-06-14 15:55:11 +05305957 memcpy(U_accumulator, U_i, prf_output_length);
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305958
5959 for (i = 1; i < pbkdf2->input_cost; i++) {
Kusumit Ghoderao4536bb62023-06-22 15:42:59 +05305960 /* We are passing prf_output_length as mac_size because the driver
5961 * function directly sets mac_output_length as mac_size upon success.
Kusumit Ghoderao5f3345a2023-07-27 21:21:38 +05305962 * See https://github.com/Mbed-TLS/mbedtls/issues/7801 */
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305963 status = psa_driver_wrapper_mac_compute(attributes,
5964 pbkdf2->password,
5965 pbkdf2->password_length,
5966 prf_alg, U_i, prf_output_length,
Kusumit Ghoderao4536bb62023-06-22 15:42:59 +05305967 U_i, prf_output_length,
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305968 &mac_output_length);
5969 if (status != PSA_SUCCESS) {
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305970 goto cleanup;
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305971 }
5972
Kusumit Ghoderao109ee3d2023-06-08 16:36:45 +05305973 mbedtls_xor(U_accumulator, U_accumulator, U_i, prf_output_length);
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305974 }
Kusumit Ghoderao246e51f2023-06-15 22:15:43 +05305975
5976cleanup:
5977 /* Zeroise buffers to clear sensitive data from memory. */
5978 mbedtls_platform_zeroize(U_i, PSA_MAC_MAX_SIZE);
5979 return status;
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05305980}
Kusumit Ghoderaof6a0d572023-06-05 14:55:56 +05305981
5982static psa_status_t psa_key_derivation_pbkdf2_read(
5983 psa_pbkdf2_key_derivation_t *pbkdf2,
5984 psa_algorithm_t kdf_alg,
5985 uint8_t *output,
5986 size_t output_length)
5987{
5988 psa_status_t status;
5989 psa_algorithm_t prf_alg;
5990 uint8_t prf_output_length;
5991 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
5992 psa_set_key_bits(&attributes, PSA_BYTES_TO_BITS(pbkdf2->password_length));
5993 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_MESSAGE);
5994
5995 if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) {
5996 prf_alg = PSA_ALG_HMAC(PSA_ALG_PBKDF2_HMAC_GET_HASH(kdf_alg));
5997 prf_output_length = PSA_HASH_LENGTH(prf_alg);
5998 psa_set_key_type(&attributes, PSA_KEY_TYPE_HMAC);
Kusumit Ghoderaoa2520a52023-06-22 15:42:19 +05305999 } else if (kdf_alg == PSA_ALG_PBKDF2_AES_CMAC_PRF_128) {
6000 prf_alg = PSA_ALG_CMAC;
Kusumit Ghoderaoa12e2d52023-07-27 21:18:30 +05306001 prf_output_length = PSA_MAC_LENGTH(PSA_KEY_TYPE_AES, 128U, PSA_ALG_CMAC);
Kusumit Ghoderaoa2520a52023-06-22 15:42:19 +05306002 psa_set_key_type(&attributes, PSA_KEY_TYPE_AES);
Kusumit Ghoderaod9ec1af2023-06-08 20:19:51 +05306003 } else {
6004 return PSA_ERROR_INVALID_ARGUMENT;
Kusumit Ghoderaof6a0d572023-06-05 14:55:56 +05306005 }
6006
6007 switch (pbkdf2->state) {
6008 case PSA_PBKDF2_STATE_PASSWORD_SET:
6009 /* Initially we need a new block so bytes_used is equal to block size*/
6010 pbkdf2->bytes_used = prf_output_length;
6011 pbkdf2->state = PSA_PBKDF2_STATE_OUTPUT;
6012 break;
6013 case PSA_PBKDF2_STATE_OUTPUT:
6014 break;
6015 default:
6016 return PSA_ERROR_BAD_STATE;
6017 }
6018
6019 while (output_length != 0) {
6020 uint8_t n = prf_output_length - pbkdf2->bytes_used;
6021 if (n > output_length) {
6022 n = (uint8_t) output_length;
6023 }
6024 memcpy(output, pbkdf2->output_block + pbkdf2->bytes_used, n);
6025 output += n;
6026 output_length -= n;
6027 pbkdf2->bytes_used += n;
6028
6029 if (output_length == 0) {
6030 break;
6031 }
6032
6033 /* We need a new block */
6034 pbkdf2->bytes_used = 0;
6035 pbkdf2->block_number++;
6036
6037 status = psa_key_derivation_pbkdf2_generate_block(pbkdf2, prf_alg,
6038 prf_output_length,
6039 &attributes);
6040 if (status != PSA_SUCCESS) {
6041 return status;
6042 }
6043 }
6044
6045 return PSA_SUCCESS;
6046}
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05306047#endif /* PSA_HAVE_SOFT_PBKDF2 */
Kusumit Ghoderaoa4346cd2023-06-05 14:50:20 +05306048
Janos Follath6c6c8fc2019-06-17 12:38:20 +01006049psa_status_t psa_key_derivation_output_bytes(
6050 psa_key_derivation_operation_t *operation,
Ryan Everettf943e222024-01-19 14:46:39 +00006051 uint8_t *output_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01006052 size_t output_length)
Gilles Peskineeab56e42018-07-12 17:12:33 +02006053{
6054 psa_status_t status;
Ryan Everettf943e222024-01-19 14:46:39 +00006055 LOCAL_OUTPUT_DECLARE(output_external, output);
6056
Gilles Peskine449bd832023-01-11 14:50:10 +01006057 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation);
Gilles Peskineeab56e42018-07-12 17:12:33 +02006058
Gilles Peskine449bd832023-01-11 14:50:10 +01006059 if (operation->alg == 0) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006060 /* This is a blank operation. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006061 return PSA_ERROR_BAD_STATE;
Jaeden Amerocf2010c2019-02-15 13:05:49 +00006062 }
6063
Gilles Peskine449bd832023-01-11 14:50:10 +01006064 if (output_length == 0 && operation->capacity == 0) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006065 /* Edge case: this is a finished operation, and 0 bytes
Jaeden Amerocf2010c2019-02-15 13:05:49 +00006066 * were requested. The right error in this case could
Gilles Peskineeab56e42018-07-12 17:12:33 +02006067 * be either INSUFFICIENT_CAPACITY or BAD_STATE. Return
6068 * INSUFFICIENT_CAPACITY, which is right for a finished
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006069 * operation, for consistency with the case when
Gilles Peskineeab56e42018-07-12 17:12:33 +02006070 * output_length > 0. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006071 return PSA_ERROR_INSUFFICIENT_DATA;
Gilles Peskineeab56e42018-07-12 17:12:33 +02006072 }
Ryan Everettf943e222024-01-19 14:46:39 +00006073
6074 LOCAL_OUTPUT_ALLOC(output_external, output_length, output);
Ryan Everettda9227d2024-01-25 11:37:22 +00006075 if (output_length > operation->capacity) {
6076 operation->capacity = 0;
6077 /* Go through the error path to wipe all confidential data now
6078 * that the operation object is useless. */
6079 status = PSA_ERROR_INSUFFICIENT_DATA;
6080 goto exit;
6081 }
6082
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006083 operation->capacity -= output_length;
Gilles Peskineeab56e42018-07-12 17:12:33 +02006084
Przemek Stekiel69c46792022-06-10 12:59:51 +02006085#if defined(BUILTIN_ALG_ANY_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006086 if (PSA_ALG_IS_ANY_HKDF(kdf_alg)) {
6087 status = psa_key_derivation_hkdf_read(&operation->ctx.hkdf, kdf_alg,
6088 output, output_length);
6089 } else
Przemek Stekiel69c46792022-06-10 12:59:51 +02006090#endif /* BUILTIN_ALG_ANY_HKDF */
John Durkop07cc04a2020-11-16 22:08:34 -08006091#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
6092 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006093 if (PSA_ALG_IS_TLS12_PRF(kdf_alg) ||
6094 PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
6095 status = psa_key_derivation_tls12_prf_read(&operation->ctx.tls12_prf,
6096 kdf_alg, output,
6097 output_length);
6098 } else
John Durkop07cc04a2020-11-16 22:08:34 -08006099#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF ||
6100 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006101#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006102 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006103 status = psa_key_derivation_tls12_ecjpake_to_pms_read(
Gilles Peskine449bd832023-01-11 14:50:10 +01006104 &operation->ctx.tls12_ecjpake_to_pms, output, output_length);
6105 } else
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006106#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05306107#if defined(PSA_HAVE_SOFT_PBKDF2)
Kusumit Ghoderao9ab03c32023-07-27 21:14:05 +05306108 if (PSA_ALG_IS_PBKDF2(kdf_alg)) {
Kusumit Ghoderaof6a0d572023-06-05 14:55:56 +05306109 status = psa_key_derivation_pbkdf2_read(&operation->ctx.pbkdf2, kdf_alg,
6110 output, output_length);
Kusumit Ghoderao056f0c52023-05-03 15:58:34 +05306111 } else
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05306112#endif /* PSA_HAVE_SOFT_PBKDF2 */
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006113
Gilles Peskineeab56e42018-07-12 17:12:33 +02006114 {
Steven Cooreman74afe472021-02-10 17:19:22 +01006115 (void) kdf_alg;
Ryan Everettf943e222024-01-19 14:46:39 +00006116 status = PSA_ERROR_BAD_STATE;
6117 LOCAL_OUTPUT_FREE(output_external, output);
6118
6119 return status;
Gilles Peskineeab56e42018-07-12 17:12:33 +02006120 }
6121
6122exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01006123 if (status != PSA_SUCCESS) {
Jaeden Amerocf2010c2019-02-15 13:05:49 +00006124 /* Preserve the algorithm upon errors, but clear all sensitive state.
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006125 * This allows us to differentiate between exhausted operations and
6126 * blank operations, so we can return PSA_ERROR_BAD_STATE on blank
6127 * operations. */
6128 psa_algorithm_t alg = operation->alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01006129 psa_key_derivation_abort(operation);
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006130 operation->alg = alg;
Ryan Everettee5920a2024-02-09 15:09:28 +00006131 if (output != NULL) {
6132 memset(output, '!', output_length);
6133 }
Gilles Peskineeab56e42018-07-12 17:12:33 +02006134 }
Ryan Everettda9227d2024-01-25 11:37:22 +00006135
6136 LOCAL_OUTPUT_FREE(output_external, output);
Gilles Peskine449bd832023-01-11 14:50:10 +01006137 return status;
Gilles Peskineeab56e42018-07-12 17:12:33 +02006138}
6139
David Brown7807bf72021-02-09 16:28:23 -07006140#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Gilles Peskine449bd832023-01-11 14:50:10 +01006141static void psa_des_set_key_parity(uint8_t *data, size_t data_size)
Gilles Peskine08542d82018-07-19 17:05:42 +02006142{
Gilles Peskine449bd832023-01-11 14:50:10 +01006143 if (data_size >= 8) {
6144 mbedtls_des_key_set_parity(data);
6145 }
6146 if (data_size >= 16) {
6147 mbedtls_des_key_set_parity(data + 8);
6148 }
6149 if (data_size >= 24) {
6150 mbedtls_des_key_set_parity(data + 16);
6151 }
Gilles Peskine08542d82018-07-19 17:05:42 +02006152}
David Brown7807bf72021-02-09 16:28:23 -07006153#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */
Gilles Peskine08542d82018-07-19 17:05:42 +02006154
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006155/*
Gilles Peskine449bd832023-01-11 14:50:10 +01006156 * ECC keys on a Weierstrass elliptic curve require the generation
6157 * of a private key which is an integer
6158 * in the range [1, N - 1], where N is the boundary of the private key domain:
6159 * N is the prime p for Diffie-Hellman, or the order of the
6160 * curve’s base point for ECC.
6161 *
6162 * Let m be the bit size of N, such that 2^m > N >= 2^(m-1).
6163 * This function generates the private key using the following process:
6164 *
6165 * 1. Draw a byte string of length ceiling(m/8) bytes.
6166 * 2. If m is not a multiple of 8, set the most significant
6167 * (8 * ceiling(m/8) - m) bits of the first byte in the string to zero.
6168 * 3. Convert the string to integer k by decoding it as a big-endian byte string.
6169 * 4. If k > N - 2, discard the result and return to step 1.
6170 * 5. Output k + 1 as the private key.
6171 *
6172 * This method allows compliance to NIST standards, specifically the methods titled
6173 * Key-Pair Generation by Testing Candidates in the following publications:
6174 * - NIST Special Publication 800-56A: Recommendation for Pair-Wise Key-Establishment
6175 * Schemes Using Discrete Logarithm Cryptography [SP800-56A] §5.6.1.1.4 for
6176 * Diffie-Hellman keys.
6177 *
6178 * - [SP800-56A] §5.6.1.2.2 or FIPS Publication 186-4: Digital Signature
6179 * Standard (DSS) [FIPS186-4] §B.4.2 for elliptic curve keys.
6180 *
6181 * Note: Function allocates memory for *data buffer, so given *data should be
6182 * always NULL.
6183 */
Valerio Setti86587ab2023-06-27 13:09:30 +02006184#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE)
6185#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE)
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01006186static psa_status_t psa_generate_derived_ecc_key_weierstrass_helper(
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006187 psa_key_slot_t *slot,
6188 size_t bits,
6189 psa_key_derivation_operation_t *operation,
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01006190 uint8_t **data
6191 )
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006192{
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01006193 unsigned key_out_of_range = 1;
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006194 mbedtls_mpi k;
6195 mbedtls_mpi diff_N_2;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006196 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Przemek Stekiela81aed22022-03-01 15:13:30 +01006197 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01006198 size_t m;
6199 size_t m_bytes;
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006200
Gilles Peskine449bd832023-01-11 14:50:10 +01006201 mbedtls_mpi_init(&k);
6202 mbedtls_mpi_init(&diff_N_2);
Przemyslaw Stekiel1dfd1222021-11-18 13:35:00 +01006203
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006204 psa_ecc_family_t curve = PSA_KEY_TYPE_ECC_GET_FAMILY(
Gilles Peskine449bd832023-01-11 14:50:10 +01006205 slot->attr.type);
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006206 mbedtls_ecp_group_id grp_id =
Valerio Settid36c3132023-12-21 14:03:51 +01006207 mbedtls_ecc_group_from_psa(curve, bits);
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006208
Gilles Peskine449bd832023-01-11 14:50:10 +01006209 if (grp_id == MBEDTLS_ECP_DP_NONE) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006210 ret = MBEDTLS_ERR_ASN1_INVALID_DATA;
Przemyslaw Stekiel871a3362021-12-02 08:46:39 +01006211 goto cleanup;
6212 }
6213
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006214 mbedtls_ecp_group ecp_group;
Gilles Peskine449bd832023-01-11 14:50:10 +01006215 mbedtls_ecp_group_init(&ecp_group);
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006216
Gilles Peskine449bd832023-01-11 14:50:10 +01006217 MBEDTLS_MPI_CHK(mbedtls_ecp_group_load(&ecp_group, grp_id));
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006218
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01006219 /* N is the boundary of the private key domain (ecp_group.N). */
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006220 /* Let m be the bit size of N. */
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01006221 m = ecp_group.nbits;
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006222
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01006223 m_bytes = PSA_BITS_TO_BYTES(m);
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01006224
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006225 /* Calculate N - 2 - it will be needed later. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006226 MBEDTLS_MPI_CHK(mbedtls_mpi_sub_int(&diff_N_2, &ecp_group.N, 2));
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006227
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01006228 /* Note: This function is always called with *data == NULL and it
6229 * allocates memory for the data buffer. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006230 *data = mbedtls_calloc(1, m_bytes);
6231 if (*data == NULL) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006232 ret = MBEDTLS_ERR_ASN1_ALLOC_FAILED;
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006233 goto cleanup;
6234 }
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006235
Gilles Peskine449bd832023-01-11 14:50:10 +01006236 while (key_out_of_range) {
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01006237 /* 1. Draw a byte string of length ceiling(m/8) bytes. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006238 if ((status = psa_key_derivation_output_bytes(operation, *data, m_bytes)) != 0) {
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01006239 goto cleanup;
Gilles Peskine449bd832023-01-11 14:50:10 +01006240 }
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01006241
6242 /* 2. If m is not a multiple of 8 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006243 if (m % 8 != 0) {
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01006244 /* Set the most significant
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006245 * (8 * ceiling(m/8) - m) bits of the first byte in
6246 * the string to zero.
6247 */
Gilles Peskine449bd832023-01-11 14:50:10 +01006248 uint8_t clear_bit_mask = (1 << (m % 8)) - 1;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006249 (*data)[0] &= clear_bit_mask;
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01006250 }
6251
6252 /* 3. Convert the string to integer k by decoding it as a
Gilles Peskine449bd832023-01-11 14:50:10 +01006253 * big-endian byte string.
6254 */
6255 MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary(&k, *data, m_bytes));
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01006256
6257 /* 4. If k > N - 2, discard the result and return to step 1.
Gilles Peskine449bd832023-01-11 14:50:10 +01006258 * Result of comparison is returned. When it indicates error
6259 * then this function is called again.
6260 */
6261 MBEDTLS_MPI_CHK(mbedtls_mpi_lt_mpi_ct(&diff_N_2, &k, &key_out_of_range));
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006262 }
6263
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006264 /* 5. Output k + 1 as the private key. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006265 MBEDTLS_MPI_CHK(mbedtls_mpi_add_int(&k, &k, 1));
6266 MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary(&k, *data, m_bytes));
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006267cleanup:
Gilles Peskine449bd832023-01-11 14:50:10 +01006268 if (ret != 0) {
6269 status = mbedtls_to_psa_error(ret);
6270 }
6271 if (status != PSA_SUCCESS) {
6272 mbedtls_free(*data);
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006273 *data = NULL;
6274 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006275 mbedtls_mpi_free(&k);
6276 mbedtls_mpi_free(&diff_N_2);
6277 return status;
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006278}
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006279
6280/* ECC keys on a Montgomery elliptic curve draws a byte string whose length
6281 * is determined by the curve, and sets the mandatory bits accordingly. That is:
6282 *
6283 * - Curve25519 (PSA_ECC_FAMILY_MONTGOMERY, 255 bits):
6284 * draw a 32-byte string and process it as specified in
6285 * Elliptic Curves for Security [RFC7748] §5.
6286 *
6287 * - Curve448 (PSA_ECC_FAMILY_MONTGOMERY, 448 bits):
6288 * draw a 56-byte string and process it as specified in [RFC7748] §5.
6289 *
6290 * Note: Function allocates memory for *data buffer, so given *data should be
6291 * always NULL.
6292 */
6293
6294static psa_status_t psa_generate_derived_ecc_key_montgomery_helper(
6295 size_t bits,
6296 psa_key_derivation_operation_t *operation,
6297 uint8_t **data
6298 )
6299{
6300 size_t output_length;
Przemek Stekiela81aed22022-03-01 15:13:30 +01006301 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006302
Gilles Peskine449bd832023-01-11 14:50:10 +01006303 switch (bits) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006304 case 255:
6305 output_length = 32;
6306 break;
6307 case 448:
6308 output_length = 56;
6309 break;
6310 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01006311 return PSA_ERROR_INVALID_ARGUMENT;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006312 break;
6313 }
6314
Gilles Peskine449bd832023-01-11 14:50:10 +01006315 *data = mbedtls_calloc(1, output_length);
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006316
Gilles Peskine449bd832023-01-11 14:50:10 +01006317 if (*data == NULL) {
6318 return PSA_ERROR_INSUFFICIENT_MEMORY;
6319 }
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006320
Gilles Peskine449bd832023-01-11 14:50:10 +01006321 status = psa_key_derivation_output_bytes(operation, *data, output_length);
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006322
Gilles Peskine449bd832023-01-11 14:50:10 +01006323 if (status != PSA_SUCCESS) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006324 return status;
Gilles Peskine449bd832023-01-11 14:50:10 +01006325 }
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006326
Gilles Peskine449bd832023-01-11 14:50:10 +01006327 switch (bits) {
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006328 case 255:
6329 (*data)[0] &= 248;
6330 (*data)[31] &= 127;
6331 (*data)[31] |= 64;
6332 break;
6333 case 448:
6334 (*data)[0] &= 252;
6335 (*data)[55] |= 128;
6336 break;
6337 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01006338 return PSA_ERROR_CORRUPTION_DETECTED;
Przemyslaw Stekielaeaa4f02022-02-21 08:17:43 +01006339 break;
6340 }
6341
6342 return status;
6343}
Valerio Setti86587ab2023-06-27 13:09:30 +02006344#else /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE */
6345static psa_status_t psa_generate_derived_ecc_key_weierstrass_helper(
6346 psa_key_slot_t *slot, size_t bits,
6347 psa_key_derivation_operation_t *operation, uint8_t **data)
6348{
6349 (void) slot;
6350 (void) bits;
6351 (void) operation;
6352 (void) data;
6353 return PSA_ERROR_NOT_SUPPORTED;
6354}
6355
6356static psa_status_t psa_generate_derived_ecc_key_montgomery_helper(
6357 size_t bits, psa_key_derivation_operation_t *operation, uint8_t **data)
6358{
6359 (void) bits;
6360 (void) operation;
6361 (void) data;
6362 return PSA_ERROR_NOT_SUPPORTED;
6363}
6364#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE */
6365#endif /* PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE */
Przemyslaw Stekield8cdcba2021-11-15 12:38:53 +01006366
Adrian L. Shaw5a5a79a2019-05-03 15:44:28 +01006367static psa_status_t psa_generate_derived_key_internal(
Gilles Peskineff5f0e72019-04-18 12:53:30 +02006368 psa_key_slot_t *slot,
6369 size_t bits,
Gilles Peskine449bd832023-01-11 14:50:10 +01006370 psa_key_derivation_operation_t *operation)
Gilles Peskineeab56e42018-07-12 17:12:33 +02006371{
6372 uint8_t *data = NULL;
Gilles Peskine449bd832023-01-11 14:50:10 +01006373 size_t bytes = PSA_BITS_TO_BYTES(bits);
Archanad8a83dc2021-06-14 10:04:16 +05306374 size_t storage_size = bytes;
Przemek Stekiela81aed22022-03-01 15:13:30 +01006375 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskineeab56e42018-07-12 17:12:33 +02006376
Gilles Peskine449bd832023-01-11 14:50:10 +01006377 if (PSA_KEY_TYPE_IS_PUBLIC_KEY(slot->attr.type)) {
6378 return PSA_ERROR_INVALID_ARGUMENT;
6379 }
Gilles Peskineeab56e42018-07-12 17:12:33 +02006380
Valerio Setti8ffdb5d2023-06-20 13:14:08 +02006381#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE) || \
Valerio Settidd24f292023-06-26 12:21:17 +02006382 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE)
Gilles Peskine449bd832023-01-11 14:50:10 +01006383 if (PSA_KEY_TYPE_IS_ECC(slot->attr.type)) {
6384 psa_ecc_family_t curve = PSA_KEY_TYPE_ECC_GET_FAMILY(slot->attr.type);
6385 if (PSA_ECC_FAMILY_IS_WEIERSTRASS(curve)) {
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01006386 /* Weierstrass elliptic curve */
Gilles Peskine449bd832023-01-11 14:50:10 +01006387 status = psa_generate_derived_ecc_key_weierstrass_helper(slot, bits, operation, &data);
6388 if (status != PSA_SUCCESS) {
Przemyslaw Stekiel6d3d18b2022-01-20 22:41:17 +01006389 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006390 }
6391 } else {
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01006392 /* Montgomery elliptic curve */
Gilles Peskine449bd832023-01-11 14:50:10 +01006393 status = psa_generate_derived_ecc_key_montgomery_helper(bits, operation, &data);
6394 if (status != PSA_SUCCESS) {
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01006395 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006396 }
Przemyslaw Stekiel58ce8d82021-11-25 13:53:28 +01006397 }
Przemyslaw Stekiel1dfd1222021-11-18 13:35:00 +01006398 } else
Valerio Setti8ffdb5d2023-06-20 13:14:08 +02006399#endif /* defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE) ||
Valerio Settidd24f292023-06-26 12:21:17 +02006400 defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE) */
Gilles Peskine449bd832023-01-11 14:50:10 +01006401 if (key_type_is_raw_bytes(slot->attr.type)) {
6402 if (bits % 8 != 0) {
6403 return PSA_ERROR_INVALID_ARGUMENT;
6404 }
6405 data = mbedtls_calloc(1, bytes);
6406 if (data == NULL) {
6407 return PSA_ERROR_INSUFFICIENT_MEMORY;
6408 }
Przemyslaw Stekiel1608e332021-11-09 10:46:40 +01006409
Gilles Peskine449bd832023-01-11 14:50:10 +01006410 status = psa_key_derivation_output_bytes(operation, data, bytes);
6411 if (status != PSA_SUCCESS) {
Przemyslaw Stekiel1608e332021-11-09 10:46:40 +01006412 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006413 }
David Brown12ca5032021-02-11 11:02:00 -07006414#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Gilles Peskine449bd832023-01-11 14:50:10 +01006415 if (slot->attr.type == PSA_KEY_TYPE_DES) {
6416 psa_des_set_key_parity(data, bytes);
6417 }
Przemek Stekielf110dc02022-03-01 14:48:05 +01006418#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES) */
Gilles Peskine449bd832023-01-11 14:50:10 +01006419 } else {
6420 return PSA_ERROR_NOT_SUPPORTED;
Przemyslaw Stekiel1608e332021-11-09 10:46:40 +01006421 }
Ronald Crondd04d422020-11-28 15:14:42 +01006422
Ronald Cronbf33c932020-11-28 18:06:53 +01006423 slot->attr.bits = (psa_key_bits_t) bits;
Ronald Cron2ebfdcc2020-11-28 15:54:54 +01006424
Gilles Peskine2f107ae2024-02-28 01:26:46 +01006425 if (psa_key_lifetime_is_external(slot->attr.lifetime)) {
Gilles Peskine7a5d9202024-02-28 01:18:23 +01006426 status = psa_driver_wrapper_get_key_buffer_size(&slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01006427 &storage_size);
6428 if (status != PSA_SUCCESS) {
Archanad8a83dc2021-06-14 10:04:16 +05306429 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006430 }
Archanad8a83dc2021-06-14 10:04:16 +05306431 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006432 status = psa_allocate_buffer_to_slot(slot, storage_size);
6433 if (status != PSA_SUCCESS) {
Archanad8a83dc2021-06-14 10:04:16 +05306434 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01006435 }
Archanad8a83dc2021-06-14 10:04:16 +05306436
Gilles Peskine7a5d9202024-02-28 01:18:23 +01006437 status = psa_driver_wrapper_import_key(&slot->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01006438 data, bytes,
6439 slot->key.data,
6440 slot->key.bytes,
6441 &slot->key.bytes, &bits);
6442 if (bits != slot->attr.bits) {
Ronald Cronbf33c932020-11-28 18:06:53 +01006443 status = PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine449bd832023-01-11 14:50:10 +01006444 }
Gilles Peskineeab56e42018-07-12 17:12:33 +02006445
6446exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01006447 mbedtls_free(data);
6448 return status;
Gilles Peskineeab56e42018-07-12 17:12:33 +02006449}
6450
Gilles Peskinef36d7852024-06-06 21:11:44 +02006451static const psa_custom_key_parameters_t default_custom_production =
Gilles Peskine4a85ff32024-07-18 18:52:59 +02006452 PSA_CUSTOM_KEY_PARAMETERS_INIT;
Gilles Peskinef0765fa2024-02-12 16:46:16 +01006453
Gilles Peskine52504f82024-06-20 17:19:58 +02006454int psa_custom_key_parameters_are_default(
Gilles Peskinef36d7852024-06-06 21:11:44 +02006455 const psa_custom_key_parameters_t *custom,
6456 size_t custom_data_length)
Gilles Peskinef0765fa2024-02-12 16:46:16 +01006457{
Gilles Peskinef36d7852024-06-06 21:11:44 +02006458 if (custom->flags != 0) {
Gilles Peskinef0765fa2024-02-12 16:46:16 +01006459 return 0;
6460 }
Gilles Peskinef36d7852024-06-06 21:11:44 +02006461 if (custom_data_length != 0) {
Gilles Peskinef0765fa2024-02-12 16:46:16 +01006462 return 0;
6463 }
6464 return 1;
6465}
6466
Gilles Peskinef36d7852024-06-06 21:11:44 +02006467psa_status_t psa_key_derivation_output_key_custom(
Gilles Peskinef0765fa2024-02-12 16:46:16 +01006468 const psa_key_attributes_t *attributes,
6469 psa_key_derivation_operation_t *operation,
Gilles Peskinef36d7852024-06-06 21:11:44 +02006470 const psa_custom_key_parameters_t *custom,
6471 const uint8_t *custom_data,
6472 size_t custom_data_length,
Gilles Peskinef0765fa2024-02-12 16:46:16 +01006473 mbedtls_svc_key_id_t *key)
Gilles Peskineff5f0e72019-04-18 12:53:30 +02006474{
6475 psa_status_t status;
6476 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02006477 psa_se_drv_table_entry_t *driver = NULL;
Gilles Peskine0f84d622019-09-12 19:03:13 +02006478
Ronald Cron81709fc2020-11-14 12:10:32 +01006479 *key = MBEDTLS_SVC_KEY_ID_INIT;
6480
Gilles Peskine0f84d622019-09-12 19:03:13 +02006481 /* Reject any attempt to create a zero-length key so that we don't
6482 * risk tripping up later, e.g. on a malloc(0) that returns NULL. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006483 if (psa_get_key_bits(attributes) == 0) {
6484 return PSA_ERROR_INVALID_ARGUMENT;
6485 }
Gilles Peskine0f84d622019-09-12 19:03:13 +02006486
Gilles Peskinef36d7852024-06-06 21:11:44 +02006487 (void) custom_data; /* We only accept 0-length data */
Gilles Peskine52504f82024-06-20 17:19:58 +02006488 if (!psa_custom_key_parameters_are_default(custom, custom_data_length)) {
Gilles Peskinef0765fa2024-02-12 16:46:16 +01006489 return PSA_ERROR_INVALID_ARGUMENT;
6490 }
6491
Gilles Peskine449bd832023-01-11 14:50:10 +01006492 if (operation->alg == PSA_ALG_NONE) {
6493 return PSA_ERROR_BAD_STATE;
6494 }
Dave Rodgmand69da6c2021-11-16 10:32:48 +00006495
Gilles Peskine449bd832023-01-11 14:50:10 +01006496 if (!operation->can_output_key) {
6497 return PSA_ERROR_NOT_PERMITTED;
6498 }
Gilles Peskine178c9aa2019-09-24 18:21:06 +02006499
Gilles Peskine449bd832023-01-11 14:50:10 +01006500 status = psa_start_key_creation(PSA_KEY_CREATION_DERIVE, attributes,
6501 &slot, &driver);
Gilles Peskinef4ee6622019-07-24 13:44:30 +02006502#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Gilles Peskine449bd832023-01-11 14:50:10 +01006503 if (driver != NULL) {
Gilles Peskinef4ee6622019-07-24 13:44:30 +02006504 /* Deriving a key in a secure element is not implemented yet. */
6505 status = PSA_ERROR_NOT_SUPPORTED;
6506 }
6507#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Gilles Peskine449bd832023-01-11 14:50:10 +01006508 if (status == PSA_SUCCESS) {
6509 status = psa_generate_derived_key_internal(slot,
Gilles Peskine2f107ae2024-02-28 01:26:46 +01006510 attributes->bits,
Gilles Peskine449bd832023-01-11 14:50:10 +01006511 operation);
Gilles Peskineff5f0e72019-04-18 12:53:30 +02006512 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006513 if (status == PSA_SUCCESS) {
6514 status = psa_finish_key_creation(slot, driver, key);
6515 }
6516 if (status != PSA_SUCCESS) {
6517 psa_fail_key_creation(slot, driver);
6518 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02006519
Gilles Peskine449bd832023-01-11 14:50:10 +01006520 return status;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02006521}
6522
Gilles Peskinef36d7852024-06-06 21:11:44 +02006523psa_status_t psa_key_derivation_output_key_ext(
6524 const psa_key_attributes_t *attributes,
6525 psa_key_derivation_operation_t *operation,
6526 const psa_key_production_parameters_t *params,
6527 size_t params_data_length,
6528 mbedtls_svc_key_id_t *key)
6529{
6530 return psa_key_derivation_output_key_custom(
6531 attributes, operation,
6532 (const psa_custom_key_parameters_t *) params,
6533 params->data, params_data_length,
6534 key);
6535}
6536
Gilles Peskinef0765fa2024-02-12 16:46:16 +01006537psa_status_t psa_key_derivation_output_key(
6538 const psa_key_attributes_t *attributes,
6539 psa_key_derivation_operation_t *operation,
6540 mbedtls_svc_key_id_t *key)
6541{
Gilles Peskinef36d7852024-06-06 21:11:44 +02006542 return psa_key_derivation_output_key_custom(attributes, operation,
6543 &default_custom_production,
6544 NULL, 0,
6545 key);
Gilles Peskinef0765fa2024-02-12 16:46:16 +01006546}
Gilles Peskineeab56e42018-07-12 17:12:33 +02006547
6548
6549/****************************************************************/
Gilles Peskineea0fb492018-07-12 17:17:20 +02006550/* Key derivation */
6551/****************************************************************/
6552
Steven Cooreman932ffb72021-02-15 12:14:32 +01006553#if defined(AT_LEAST_ONE_BUILTIN_KDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006554static int is_kdf_alg_supported(psa_algorithm_t kdf_alg)
Gilles Peskine9efde4f2021-04-29 21:10:00 +02006555{
6556#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006557 if (PSA_ALG_IS_HKDF(kdf_alg)) {
6558 return 1;
6559 }
Gilles Peskine9efde4f2021-04-29 21:10:00 +02006560#endif
Przemek Stekielb57a44b2022-06-06 08:33:45 +02006561#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01006562 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) {
6563 return 1;
6564 }
Przemek Stekielb57a44b2022-06-06 08:33:45 +02006565#endif
6566#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Gilles Peskine449bd832023-01-11 14:50:10 +01006567 if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg)) {
6568 return 1;
6569 }
Gilles Peskine9efde4f2021-04-29 21:10:00 +02006570#endif
6571#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006572 if (PSA_ALG_IS_TLS12_PRF(kdf_alg)) {
6573 return 1;
6574 }
Gilles Peskine9efde4f2021-04-29 21:10:00 +02006575#endif
6576#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006577 if (PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
6578 return 1;
6579 }
Gilles Peskine9efde4f2021-04-29 21:10:00 +02006580#endif
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006581#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006582 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
6583 return 1;
6584 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04006585#endif
Kusumit Ghoderaod132cac2023-05-03 12:00:27 +05306586#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC)
6587 if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) {
6588 return 1;
6589 }
6590#endif
Kusumit Ghoderao2cd64962023-06-22 15:38:57 +05306591#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_AES_CMAC_PRF_128)
6592 if (kdf_alg == PSA_ALG_PBKDF2_AES_CMAC_PRF_128) {
6593 return 1;
6594 }
6595#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01006596 return 0;
Gilles Peskine9efde4f2021-04-29 21:10:00 +02006597}
6598
Gilles Peskine449bd832023-01-11 14:50:10 +01006599static psa_status_t psa_hash_try_support(psa_algorithm_t alg)
Gilles Peskine0cc417d2021-04-29 21:18:14 +02006600{
6601 psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT;
Gilles Peskine449bd832023-01-11 14:50:10 +01006602 psa_status_t status = psa_hash_setup(&operation, alg);
6603 psa_hash_abort(&operation);
6604 return status;
Gilles Peskine0cc417d2021-04-29 21:18:14 +02006605}
6606
Kusumit Ghoderao86e83dd2023-12-01 16:38:26 +05306607static psa_status_t psa_key_derivation_set_maximum_capacity(
6608 psa_key_derivation_operation_t *operation,
6609 psa_algorithm_t kdf_alg)
6610{
6611#if defined(PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS)
6612 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
6613 operation->capacity = PSA_HASH_LENGTH(PSA_ALG_SHA_256);
6614 return PSA_SUCCESS;
6615 }
6616#endif
6617#if defined(PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128)
6618 if (kdf_alg == PSA_ALG_PBKDF2_AES_CMAC_PRF_128) {
6619#if (SIZE_MAX > UINT32_MAX)
Kusumit Ghoderao7d4db632023-12-07 16:17:46 +05306620 operation->capacity = UINT32_MAX * (size_t) PSA_MAC_LENGTH(
Kusumit Ghoderaod3f70d32023-12-06 16:20:04 +05306621 PSA_KEY_TYPE_AES,
6622 128U,
6623 PSA_ALG_CMAC);
Kusumit Ghoderao86e83dd2023-12-01 16:38:26 +05306624#else
6625 operation->capacity = SIZE_MAX;
6626#endif
6627 return PSA_SUCCESS;
6628 }
6629#endif /* PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128 */
6630
6631 /* After this point, if kdf_alg is not valid then value of hash_alg may be
6632 * invalid or meaningless but it does not affect this function */
6633 psa_algorithm_t hash_alg = PSA_ALG_GET_HASH(kdf_alg);
6634 size_t hash_size = PSA_HASH_LENGTH(hash_alg);
Kusumit Ghoderaod3f70d32023-12-06 16:20:04 +05306635 if (hash_size == 0) {
6636 return PSA_ERROR_NOT_SUPPORTED;
6637 }
Kusumit Ghoderao86e83dd2023-12-01 16:38:26 +05306638
6639 /* Make sure that hash_alg is a supported hash algorithm. Otherwise
6640 * we might fail later, which is somewhat unfriendly and potentially
6641 * risk-prone. */
6642 psa_status_t status = psa_hash_try_support(hash_alg);
6643 if (status != PSA_SUCCESS) {
6644 return status;
6645 }
6646
6647#if defined(PSA_WANT_ALG_HKDF)
6648 if (PSA_ALG_IS_HKDF(kdf_alg)) {
6649 operation->capacity = 255 * hash_size;
6650 } else
6651#endif
6652#if defined(PSA_WANT_ALG_HKDF_EXTRACT)
6653 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) {
6654 operation->capacity = hash_size;
6655 } else
6656#endif
6657#if defined(PSA_WANT_ALG_HKDF_EXPAND)
6658 if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg)) {
6659 operation->capacity = 255 * hash_size;
6660 } else
6661#endif
6662#if defined(PSA_WANT_ALG_TLS12_PRF)
6663 if (PSA_ALG_IS_TLS12_PRF(kdf_alg) &&
6664 (hash_alg == PSA_ALG_SHA_256 || hash_alg == PSA_ALG_SHA_384)) {
6665 operation->capacity = SIZE_MAX;
6666 } else
6667#endif
6668#if defined(PSA_WANT_ALG_TLS12_PSK_TO_MS)
6669 if (PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg) &&
6670 (hash_alg == PSA_ALG_SHA_256 || hash_alg == PSA_ALG_SHA_384)) {
6671 /* Master Secret is always 48 bytes
6672 * https://datatracker.ietf.org/doc/html/rfc5246.html#section-8.1 */
6673 operation->capacity = 48U;
6674 } else
6675#endif
6676#if defined(PSA_WANT_ALG_PBKDF2_HMAC)
6677 if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) {
6678#if (SIZE_MAX > UINT32_MAX)
6679 operation->capacity = UINT32_MAX * hash_size;
6680#else
6681 operation->capacity = SIZE_MAX;
6682#endif
6683 } else
6684#endif /* PSA_WANT_ALG_PBKDF2_HMAC */
6685 {
Kusumit Ghoderaod3f70d32023-12-06 16:20:04 +05306686 (void) hash_size;
Kusumit Ghoderao86e83dd2023-12-01 16:38:26 +05306687 status = PSA_ERROR_NOT_SUPPORTED;
6688 }
6689 return status;
6690}
6691
Gilles Peskine969c5d62019-01-16 15:53:06 +01006692static psa_status_t psa_key_derivation_setup_kdf(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006693 psa_key_derivation_operation_t *operation,
Gilles Peskine449bd832023-01-11 14:50:10 +01006694 psa_algorithm_t kdf_alg)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006695{
Janos Follath5fe19732019-06-20 15:09:30 +01006696 /* Make sure that operation->ctx is properly zero-initialised. (Macro
6697 * initialisers for this union leave some bytes unspecified.) */
Gilles Peskine449bd832023-01-11 14:50:10 +01006698 memset(&operation->ctx, 0, sizeof(operation->ctx));
Janos Follath5fe19732019-06-20 15:09:30 +01006699
Gilles Peskine969c5d62019-01-16 15:53:06 +01006700 /* Make sure that kdf_alg is a supported key derivation algorithm. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006701 if (!is_kdf_alg_supported(kdf_alg)) {
6702 return PSA_ERROR_NOT_SUPPORTED;
6703 }
John Durkop07cc04a2020-11-16 22:08:34 -08006704
Kusumit Ghoderao86e83dd2023-12-01 16:38:26 +05306705 psa_status_t status = psa_key_derivation_set_maximum_capacity(operation,
6706 kdf_alg);
Kusumit Ghoderao5f3a9382023-09-13 16:28:12 +05306707 return status;
Gilles Peskine969c5d62019-01-16 15:53:06 +01006708}
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006709
Gilles Peskine449bd832023-01-11 14:50:10 +01006710static psa_status_t psa_key_agreement_try_support(psa_algorithm_t alg)
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006711{
6712#if defined(PSA_WANT_ALG_ECDH)
Gilles Peskine449bd832023-01-11 14:50:10 +01006713 if (alg == PSA_ALG_ECDH) {
6714 return PSA_SUCCESS;
6715 }
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006716#endif
Przemek Stekielfb3dd542022-12-01 14:59:15 +01006717#if defined(PSA_WANT_ALG_FFDH)
6718 if (alg == PSA_ALG_FFDH) {
6719 return PSA_SUCCESS;
6720 }
6721#endif
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006722 (void) alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01006723 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine0c3a0712021-04-29 21:34:33 +02006724}
Gilles Peskinebb3814c2022-12-16 01:12:12 +01006725
6726static int psa_key_derivation_allows_free_form_secret_input(
6727 psa_algorithm_t kdf_alg)
6728{
6729#if defined(PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS)
6730 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
6731 return 0;
6732 }
6733#endif
6734 (void) kdf_alg;
6735 return 1;
6736}
John Durkop07cc04a2020-11-16 22:08:34 -08006737#endif /* AT_LEAST_ONE_BUILTIN_KDF */
Gilles Peskine969c5d62019-01-16 15:53:06 +01006738
Gilles Peskine449bd832023-01-11 14:50:10 +01006739psa_status_t psa_key_derivation_setup(psa_key_derivation_operation_t *operation,
6740 psa_algorithm_t alg)
Gilles Peskine969c5d62019-01-16 15:53:06 +01006741{
6742 psa_status_t status;
6743
Gilles Peskine449bd832023-01-11 14:50:10 +01006744 if (operation->alg != 0) {
6745 return PSA_ERROR_BAD_STATE;
Gilles Peskine969c5d62019-01-16 15:53:06 +01006746 }
Gilles Peskine969c5d62019-01-16 15:53:06 +01006747
Gilles Peskine449bd832023-01-11 14:50:10 +01006748 if (PSA_ALG_IS_RAW_KEY_AGREEMENT(alg)) {
6749 return PSA_ERROR_INVALID_ARGUMENT;
6750 } else if (PSA_ALG_IS_KEY_AGREEMENT(alg)) {
6751#if defined(AT_LEAST_ONE_BUILTIN_KDF)
6752 psa_algorithm_t kdf_alg = PSA_ALG_KEY_AGREEMENT_GET_KDF(alg);
6753 psa_algorithm_t ka_alg = PSA_ALG_KEY_AGREEMENT_GET_BASE(alg);
6754 status = psa_key_agreement_try_support(ka_alg);
6755 if (status != PSA_SUCCESS) {
6756 return status;
6757 }
Gilles Peskinebb3814c2022-12-16 01:12:12 +01006758 if (!psa_key_derivation_allows_free_form_secret_input(kdf_alg)) {
6759 return PSA_ERROR_INVALID_ARGUMENT;
6760 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006761 status = psa_key_derivation_setup_kdf(operation, kdf_alg);
6762#else
6763 return PSA_ERROR_NOT_SUPPORTED;
6764#endif /* AT_LEAST_ONE_BUILTIN_KDF */
6765 } else if (PSA_ALG_IS_KEY_DERIVATION(alg)) {
6766#if defined(AT_LEAST_ONE_BUILTIN_KDF)
6767 status = psa_key_derivation_setup_kdf(operation, alg);
6768#else
6769 return PSA_ERROR_NOT_SUPPORTED;
6770#endif /* AT_LEAST_ONE_BUILTIN_KDF */
6771 } else {
6772 return PSA_ERROR_INVALID_ARGUMENT;
6773 }
6774
6775 if (status == PSA_SUCCESS) {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02006776 operation->alg = alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01006777 }
6778 return status;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006779}
6780
Przemek Stekiel69c46792022-06-10 12:59:51 +02006781#if defined(BUILTIN_ALG_ANY_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01006782static psa_status_t psa_hkdf_input(psa_hkdf_key_derivation_t *hkdf,
6783 psa_algorithm_t kdf_alg,
6784 psa_key_derivation_step_t step,
6785 const uint8_t *data,
6786 size_t data_length)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006787{
Gilles Peskine449bd832023-01-11 14:50:10 +01006788 psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(kdf_alg);
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006789 psa_status_t status;
Gilles Peskine449bd832023-01-11 14:50:10 +01006790 switch (step) {
Gilles Peskine03410b52019-05-16 16:05:19 +02006791 case PSA_KEY_DERIVATION_INPUT_SALT:
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006792#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Gilles Peskine449bd832023-01-11 14:50:10 +01006793 if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg)) {
6794 return PSA_ERROR_INVALID_ARGUMENT;
6795 }
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006796#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND */
Gilles Peskine449bd832023-01-11 14:50:10 +01006797 if (hkdf->state != HKDF_STATE_INIT) {
6798 return PSA_ERROR_BAD_STATE;
6799 } else {
6800 status = psa_key_derivation_start_hmac(&hkdf->hmac,
6801 hash_alg,
6802 data, data_length);
6803 if (status != PSA_SUCCESS) {
6804 return status;
6805 }
Steven Cooremand1ed1d92021-04-29 19:11:25 +02006806 hkdf->state = HKDF_STATE_STARTED;
Gilles Peskine449bd832023-01-11 14:50:10 +01006807 return PSA_SUCCESS;
Steven Cooremand1ed1d92021-04-29 19:11:25 +02006808 }
Gilles Peskine03410b52019-05-16 16:05:19 +02006809 case PSA_KEY_DERIVATION_INPUT_SECRET:
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006810#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Gilles Peskine449bd832023-01-11 14:50:10 +01006811 if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg)) {
Przemek Stekiel2fb0dcd2022-05-19 10:34:37 +02006812 /* We shouldn't be in different state as HKDF_EXPAND only allows
6813 * two inputs: SECRET (this case) and INFO which does not modify
6814 * the state. It could happen only if the hkdf
6815 * object was corrupted. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006816 if (hkdf->state != HKDF_STATE_INIT) {
6817 return PSA_ERROR_BAD_STATE;
6818 }
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006819
Przemek Stekiel2fb0dcd2022-05-19 10:34:37 +02006820 /* Allow only input that fits expected prk size */
Gilles Peskine449bd832023-01-11 14:50:10 +01006821 if (data_length != PSA_HASH_LENGTH(hash_alg)) {
6822 return PSA_ERROR_INVALID_ARGUMENT;
6823 }
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006824
Gilles Peskine449bd832023-01-11 14:50:10 +01006825 memcpy(hkdf->prk, data, data_length);
6826 } else
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006827#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND */
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006828 {
Przemek Stekiel0586f4c2022-06-03 16:00:25 +02006829 /* HKDF: If no salt was provided, use an empty salt.
6830 * HKDF-EXTRACT: salt is mandatory. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006831 if (hkdf->state == HKDF_STATE_INIT) {
Przemek Stekiel0586f4c2022-06-03 16:00:25 +02006832#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01006833 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) {
6834 return PSA_ERROR_BAD_STATE;
6835 }
Przemek Stekiel0586f4c2022-06-03 16:00:25 +02006836#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Gilles Peskine449bd832023-01-11 14:50:10 +01006837 status = psa_key_derivation_start_hmac(&hkdf->hmac,
6838 hash_alg,
6839 NULL, 0);
6840 if (status != PSA_SUCCESS) {
6841 return status;
6842 }
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006843 hkdf->state = HKDF_STATE_STARTED;
6844 }
Gilles Peskine449bd832023-01-11 14:50:10 +01006845 if (hkdf->state != HKDF_STATE_STARTED) {
6846 return PSA_ERROR_BAD_STATE;
6847 }
6848 status = psa_mac_update(&hkdf->hmac,
6849 data, data_length);
6850 if (status != PSA_SUCCESS) {
6851 return status;
6852 }
6853 status = psa_mac_sign_finish(&hkdf->hmac,
6854 hkdf->prk,
6855 sizeof(hkdf->prk),
6856 &data_length);
6857 if (status != PSA_SUCCESS) {
6858 return status;
6859 }
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006860 }
Przemek Stekiel17520fe2022-05-10 13:53:33 +02006861
Gilles Peskine2b522db2019-04-12 15:11:49 +02006862 hkdf->state = HKDF_STATE_KEYED;
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006863 hkdf->block_number = 0;
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006864#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01006865 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) {
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006866 /* The only block of output is the PRK. */
Gilles Peskine449bd832023-01-11 14:50:10 +01006867 memcpy(hkdf->output_block, hkdf->prk, PSA_HASH_LENGTH(hash_alg));
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006868 hkdf->offset_in_block = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01006869 } else
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006870#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006871 {
6872 /* Block 0 is empty, and the next block will be
6873 * generated by psa_key_derivation_hkdf_read(). */
Gilles Peskine449bd832023-01-11 14:50:10 +01006874 hkdf->offset_in_block = PSA_HASH_LENGTH(hash_alg);
Przemek Stekiel03d948c2022-05-19 11:45:20 +02006875 }
6876
Gilles Peskine449bd832023-01-11 14:50:10 +01006877 return PSA_SUCCESS;
Gilles Peskine03410b52019-05-16 16:05:19 +02006878 case PSA_KEY_DERIVATION_INPUT_INFO:
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006879#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Gilles Peskine449bd832023-01-11 14:50:10 +01006880 if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) {
6881 return PSA_ERROR_INVALID_ARGUMENT;
6882 }
Przemek Stekiel3e8249c2022-06-03 14:05:07 +02006883#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Przemek Stekielcde3f782022-06-03 16:12:27 +02006884#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Gilles Peskine449bd832023-01-11 14:50:10 +01006885 if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg) &&
6886 hkdf->state == HKDF_STATE_INIT) {
6887 return PSA_ERROR_BAD_STATE;
6888 }
Przemek Stekielcde3f782022-06-03 16:12:27 +02006889#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Gilles Peskine449bd832023-01-11 14:50:10 +01006890 if (hkdf->state == HKDF_STATE_OUTPUT) {
6891 return PSA_ERROR_BAD_STATE;
6892 }
6893 if (hkdf->info_set) {
6894 return PSA_ERROR_BAD_STATE;
6895 }
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006896 hkdf->info_length = data_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01006897 if (data_length != 0) {
6898 hkdf->info = mbedtls_calloc(1, data_length);
6899 if (hkdf->info == NULL) {
6900 return PSA_ERROR_INSUFFICIENT_MEMORY;
6901 }
6902 memcpy(hkdf->info, data, data_length);
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006903 }
6904 hkdf->info_set = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01006905 return PSA_SUCCESS;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006906 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01006907 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01006908 }
6909}
Przemek Stekiel69c46792022-06-10 12:59:51 +02006910#endif /* BUILTIN_ALG_ANY_HKDF */
Janos Follathb03233e2019-06-11 15:30:30 +01006911
John Durkop07cc04a2020-11-16 22:08:34 -08006912#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
6913 defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01006914static psa_status_t psa_tls12_prf_set_seed(psa_tls12_prf_key_derivation_t *prf,
6915 const uint8_t *data,
6916 size_t data_length)
Janos Follathf08e2652019-06-13 09:05:41 +01006917{
Gilles Peskine449bd832023-01-11 14:50:10 +01006918 if (prf->state != PSA_TLS12_PRF_STATE_INIT) {
6919 return PSA_ERROR_BAD_STATE;
6920 }
Janos Follathf08e2652019-06-13 09:05:41 +01006921
Gilles Peskine449bd832023-01-11 14:50:10 +01006922 if (data_length != 0) {
6923 prf->seed = mbedtls_calloc(1, data_length);
6924 if (prf->seed == NULL) {
6925 return PSA_ERROR_INSUFFICIENT_MEMORY;
6926 }
Janos Follathf08e2652019-06-13 09:05:41 +01006927
Gilles Peskine449bd832023-01-11 14:50:10 +01006928 memcpy(prf->seed, data, data_length);
Janos Follathd6dce9f2019-07-04 09:11:38 +01006929 prf->seed_length = data_length;
6930 }
Janos Follathf08e2652019-06-13 09:05:41 +01006931
Gilles Peskine43f958b2020-12-13 14:55:14 +01006932 prf->state = PSA_TLS12_PRF_STATE_SEED_SET;
Janos Follathf08e2652019-06-13 09:05:41 +01006933
Gilles Peskine449bd832023-01-11 14:50:10 +01006934 return PSA_SUCCESS;
Janos Follathf08e2652019-06-13 09:05:41 +01006935}
6936
Gilles Peskine449bd832023-01-11 14:50:10 +01006937static psa_status_t psa_tls12_prf_set_key(psa_tls12_prf_key_derivation_t *prf,
6938 const uint8_t *data,
6939 size_t data_length)
Janos Follath81550542019-06-13 14:26:34 +01006940{
Gilles Peskine449bd832023-01-11 14:50:10 +01006941 if (prf->state != PSA_TLS12_PRF_STATE_SEED_SET &&
6942 prf->state != PSA_TLS12_PRF_STATE_OTHER_KEY_SET) {
6943 return PSA_ERROR_BAD_STATE;
6944 }
Janos Follath81550542019-06-13 14:26:34 +01006945
Gilles Peskine449bd832023-01-11 14:50:10 +01006946 if (data_length != 0) {
6947 prf->secret = mbedtls_calloc(1, data_length);
6948 if (prf->secret == NULL) {
6949 return PSA_ERROR_INSUFFICIENT_MEMORY;
6950 }
Steven Cooremana6df6042021-04-29 19:32:25 +02006951
Gilles Peskine449bd832023-01-11 14:50:10 +01006952 memcpy(prf->secret, data, data_length);
Steven Cooremana6df6042021-04-29 19:32:25 +02006953 prf->secret_length = data_length;
6954 }
Janos Follath81550542019-06-13 14:26:34 +01006955
Gilles Peskine43f958b2020-12-13 14:55:14 +01006956 prf->state = PSA_TLS12_PRF_STATE_KEY_SET;
Janos Follath81550542019-06-13 14:26:34 +01006957
Gilles Peskine449bd832023-01-11 14:50:10 +01006958 return PSA_SUCCESS;
Janos Follath81550542019-06-13 14:26:34 +01006959}
6960
Gilles Peskine449bd832023-01-11 14:50:10 +01006961static psa_status_t psa_tls12_prf_set_label(psa_tls12_prf_key_derivation_t *prf,
6962 const uint8_t *data,
6963 size_t data_length)
Janos Follath63028dd2019-06-13 09:15:47 +01006964{
Gilles Peskine449bd832023-01-11 14:50:10 +01006965 if (prf->state != PSA_TLS12_PRF_STATE_KEY_SET) {
6966 return PSA_ERROR_BAD_STATE;
6967 }
Janos Follath63028dd2019-06-13 09:15:47 +01006968
Gilles Peskine449bd832023-01-11 14:50:10 +01006969 if (data_length != 0) {
6970 prf->label = mbedtls_calloc(1, data_length);
6971 if (prf->label == NULL) {
6972 return PSA_ERROR_INSUFFICIENT_MEMORY;
6973 }
Janos Follath63028dd2019-06-13 09:15:47 +01006974
Gilles Peskine449bd832023-01-11 14:50:10 +01006975 memcpy(prf->label, data, data_length);
Janos Follathd6dce9f2019-07-04 09:11:38 +01006976 prf->label_length = data_length;
6977 }
Janos Follath63028dd2019-06-13 09:15:47 +01006978
Gilles Peskine43f958b2020-12-13 14:55:14 +01006979 prf->state = PSA_TLS12_PRF_STATE_LABEL_SET;
Janos Follath63028dd2019-06-13 09:15:47 +01006980
Gilles Peskine449bd832023-01-11 14:50:10 +01006981 return PSA_SUCCESS;
Janos Follath63028dd2019-06-13 09:15:47 +01006982}
6983
Gilles Peskine449bd832023-01-11 14:50:10 +01006984static psa_status_t psa_tls12_prf_input(psa_tls12_prf_key_derivation_t *prf,
6985 psa_key_derivation_step_t step,
6986 const uint8_t *data,
6987 size_t data_length)
Janos Follathb03233e2019-06-11 15:30:30 +01006988{
Gilles Peskine449bd832023-01-11 14:50:10 +01006989 switch (step) {
Janos Follathf08e2652019-06-13 09:05:41 +01006990 case PSA_KEY_DERIVATION_INPUT_SEED:
Gilles Peskine449bd832023-01-11 14:50:10 +01006991 return psa_tls12_prf_set_seed(prf, data, data_length);
Janos Follath81550542019-06-13 14:26:34 +01006992 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01006993 return psa_tls12_prf_set_key(prf, data, data_length);
Janos Follath63028dd2019-06-13 09:15:47 +01006994 case PSA_KEY_DERIVATION_INPUT_LABEL:
Gilles Peskine449bd832023-01-11 14:50:10 +01006995 return psa_tls12_prf_set_label(prf, data, data_length);
Janos Follathb03233e2019-06-11 15:30:30 +01006996 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01006997 return PSA_ERROR_INVALID_ARGUMENT;
Janos Follathb03233e2019-06-11 15:30:30 +01006998 }
6999}
John Durkop07cc04a2020-11-16 22:08:34 -08007000#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) ||
7001 * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
7002
7003#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
7004static psa_status_t psa_tls12_prf_psk_to_ms_set_key(
7005 psa_tls12_prf_key_derivation_t *prf,
John Durkop07cc04a2020-11-16 22:08:34 -08007006 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01007007 size_t data_length)
John Durkop07cc04a2020-11-16 22:08:34 -08007008{
7009 psa_status_t status;
Gilles Peskine449bd832023-01-11 14:50:10 +01007010 const size_t pms_len = (prf->state == PSA_TLS12_PRF_STATE_OTHER_KEY_SET ?
7011 4 + data_length + prf->other_secret_length :
7012 4 + 2 * data_length);
John Durkop07cc04a2020-11-16 22:08:34 -08007013
Gilles Peskine449bd832023-01-11 14:50:10 +01007014 if (data_length > PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE) {
7015 return PSA_ERROR_INVALID_ARGUMENT;
7016 }
John Durkop07cc04a2020-11-16 22:08:34 -08007017
Gilles Peskine449bd832023-01-11 14:50:10 +01007018 uint8_t *pms = mbedtls_calloc(1, pms_len);
7019 if (pms == NULL) {
7020 return PSA_ERROR_INSUFFICIENT_MEMORY;
7021 }
Przemek Stekielc8fa5a12022-04-07 14:17:13 +02007022 uint8_t *cur = pms;
7023
7024 /* pure-PSK:
7025 * Quoting RFC 4279, Section 2:
John Durkop07cc04a2020-11-16 22:08:34 -08007026 *
7027 * The premaster secret is formed as follows: if the PSK is N octets
7028 * long, concatenate a uint16 with the value N, N zero octets, a second
7029 * uint16 with the value N, and the PSK itself.
Przemek Stekielc8fa5a12022-04-07 14:17:13 +02007030 *
7031 * mixed-PSK:
7032 * In a DHE-PSK, RSA-PSK, ECDHE-PSK the premaster secret is formed as
7033 * follows: concatenate a uint16 with the length of the other secret,
7034 * the other secret itself, uint16 with the length of PSK, and the
7035 * PSK itself.
7036 * For details please check:
7037 * - RFC 4279, Section 4 for the definition of RSA-PSK,
7038 * - RFC 4279, Section 3 for the definition of DHE-PSK,
7039 * - RFC 5489 for the definition of ECDHE-PSK.
John Durkop07cc04a2020-11-16 22:08:34 -08007040 */
7041
Gilles Peskine449bd832023-01-11 14:50:10 +01007042 if (prf->state == PSA_TLS12_PRF_STATE_OTHER_KEY_SET) {
7043 *cur++ = MBEDTLS_BYTE_1(prf->other_secret_length);
7044 *cur++ = MBEDTLS_BYTE_0(prf->other_secret_length);
7045 if (prf->other_secret_length != 0) {
7046 memcpy(cur, prf->other_secret, prf->other_secret_length);
7047 mbedtls_platform_zeroize(prf->other_secret, prf->other_secret_length);
Przemek Stekiel2503f7e2022-04-12 12:08:01 +02007048 cur += prf->other_secret_length;
7049 }
Gilles Peskine449bd832023-01-11 14:50:10 +01007050 } else {
7051 *cur++ = MBEDTLS_BYTE_1(data_length);
7052 *cur++ = MBEDTLS_BYTE_0(data_length);
7053 memset(cur, 0, data_length);
Przemek Stekielc8fa5a12022-04-07 14:17:13 +02007054 cur += data_length;
7055 }
7056
Gilles Peskine449bd832023-01-11 14:50:10 +01007057 *cur++ = MBEDTLS_BYTE_1(data_length);
7058 *cur++ = MBEDTLS_BYTE_0(data_length);
7059 memcpy(cur, data, data_length);
John Durkop07cc04a2020-11-16 22:08:34 -08007060 cur += data_length;
7061
Dave Rodgmane4a6f5a2023-11-04 12:20:09 +00007062 status = psa_tls12_prf_set_key(prf, pms, (size_t) (cur - pms));
John Durkop07cc04a2020-11-16 22:08:34 -08007063
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01007064 mbedtls_zeroize_and_free(pms, pms_len);
Gilles Peskine449bd832023-01-11 14:50:10 +01007065 return status;
John Durkop07cc04a2020-11-16 22:08:34 -08007066}
Janos Follath6660f0e2019-06-17 08:44:03 +01007067
Przemek Stekiele47201b2022-04-19 13:53:28 +02007068static psa_status_t psa_tls12_prf_psk_to_ms_set_other_key(
7069 psa_tls12_prf_key_derivation_t *prf,
7070 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01007071 size_t data_length)
Przemek Stekiele47201b2022-04-19 13:53:28 +02007072{
Gilles Peskine449bd832023-01-11 14:50:10 +01007073 if (prf->state != PSA_TLS12_PRF_STATE_SEED_SET) {
7074 return PSA_ERROR_BAD_STATE;
Przemek Stekiele47201b2022-04-19 13:53:28 +02007075 }
Gilles Peskine449bd832023-01-11 14:50:10 +01007076
7077 if (data_length != 0) {
7078 prf->other_secret = mbedtls_calloc(1, data_length);
7079 if (prf->other_secret == NULL) {
7080 return PSA_ERROR_INSUFFICIENT_MEMORY;
7081 }
7082
7083 memcpy(prf->other_secret, data, data_length);
7084 prf->other_secret_length = data_length;
7085 } else {
Przemek Stekiele47201b2022-04-19 13:53:28 +02007086 prf->other_secret_length = 0;
7087 }
7088
7089 prf->state = PSA_TLS12_PRF_STATE_OTHER_KEY_SET;
7090
Gilles Peskine449bd832023-01-11 14:50:10 +01007091 return PSA_SUCCESS;
Przemek Stekiele47201b2022-04-19 13:53:28 +02007092}
7093
Janos Follath6660f0e2019-06-17 08:44:03 +01007094static psa_status_t psa_tls12_prf_psk_to_ms_input(
7095 psa_tls12_prf_key_derivation_t *prf,
Janos Follath6660f0e2019-06-17 08:44:03 +01007096 psa_key_derivation_step_t step,
7097 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01007098 size_t data_length)
Janos Follath6660f0e2019-06-17 08:44:03 +01007099{
Gilles Peskine449bd832023-01-11 14:50:10 +01007100 switch (step) {
Przemek Stekiele47201b2022-04-19 13:53:28 +02007101 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01007102 return psa_tls12_prf_psk_to_ms_set_key(prf,
7103 data, data_length);
Przemek Stekiele47201b2022-04-19 13:53:28 +02007104 break;
7105 case PSA_KEY_DERIVATION_INPUT_OTHER_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01007106 return psa_tls12_prf_psk_to_ms_set_other_key(prf,
7107 data,
7108 data_length);
Przemek Stekiele47201b2022-04-19 13:53:28 +02007109 break;
7110 default:
Gilles Peskine449bd832023-01-11 14:50:10 +01007111 return psa_tls12_prf_input(prf, step, data, data_length);
Przemek Stekiele47201b2022-04-19 13:53:28 +02007112 break;
Janos Follath6660f0e2019-06-17 08:44:03 +01007113
Przemek Stekiele47201b2022-04-19 13:53:28 +02007114 }
Janos Follath6660f0e2019-06-17 08:44:03 +01007115}
John Durkop07cc04a2020-11-16 22:08:34 -08007116#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01007117
Andrzej Kurek08d34b82022-07-29 10:00:16 -04007118#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
7119static psa_status_t psa_tls12_ecjpake_to_pms_input(
7120 psa_tls12_ecjpake_to_pms_t *ecjpake,
Andrzej Kurek702776f2022-09-16 06:22:44 -04007121 psa_key_derivation_step_t step,
Andrzej Kurek08d34b82022-07-29 10:00:16 -04007122 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01007123 size_t data_length)
Andrzej Kurek08d34b82022-07-29 10:00:16 -04007124{
Gilles Peskine449bd832023-01-11 14:50:10 +01007125 if (data_length != PSA_TLS12_ECJPAKE_TO_PMS_INPUT_SIZE ||
7126 step != PSA_KEY_DERIVATION_INPUT_SECRET) {
7127 return PSA_ERROR_INVALID_ARGUMENT;
Andrzej Kurek5603efd2022-09-26 10:49:16 -04007128 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04007129
7130 /* Check if the passed point is in an uncompressed form */
Gilles Peskine449bd832023-01-11 14:50:10 +01007131 if (data[0] != 0x04) {
7132 return PSA_ERROR_INVALID_ARGUMENT;
7133 }
Andrzej Kurek08d34b82022-07-29 10:00:16 -04007134
7135 /* Only K.X has to be extracted - bytes 1 to 32 inclusive. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007136 memcpy(ecjpake->data, data + 1, PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE);
Andrzej Kurek08d34b82022-07-29 10:00:16 -04007137
Gilles Peskine449bd832023-01-11 14:50:10 +01007138 return PSA_SUCCESS;
Andrzej Kurek08d34b82022-07-29 10:00:16 -04007139}
7140#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05307141
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05307142#if defined(PSA_HAVE_SOFT_PBKDF2)
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05307143static psa_status_t psa_pbkdf2_set_input_cost(
7144 psa_pbkdf2_key_derivation_t *pbkdf2,
7145 psa_key_derivation_step_t step,
7146 uint64_t data)
7147{
7148 if (step != PSA_KEY_DERIVATION_INPUT_COST) {
7149 return PSA_ERROR_INVALID_ARGUMENT;
7150 }
7151
7152 if (pbkdf2->state != PSA_PBKDF2_STATE_INIT) {
7153 return PSA_ERROR_BAD_STATE;
7154 }
Kusumit Ghoderao3fc4ca72023-05-08 15:57:41 +05307155
Kusumit Ghoderaoe66a8ad2023-05-24 12:30:43 +05307156 if (data > PSA_VENDOR_PBKDF2_MAX_ITERATIONS) {
Kusumit Ghoderao3fc4ca72023-05-08 15:57:41 +05307157 return PSA_ERROR_NOT_SUPPORTED;
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05307158 }
Kusumit Ghoderao3fc4ca72023-05-08 15:57:41 +05307159
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05307160 if (data == 0) {
7161 return PSA_ERROR_INVALID_ARGUMENT;
7162 }
Kusumit Ghoderaoe66a8ad2023-05-24 12:30:43 +05307163
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05307164 pbkdf2->input_cost = data;
7165 pbkdf2->state = PSA_PBKDF2_STATE_INPUT_COST_SET;
7166
7167 return PSA_SUCCESS;
7168}
Kusumit Ghoderao547a6c62023-05-03 12:18:19 +05307169
7170static psa_status_t psa_pbkdf2_set_salt(psa_pbkdf2_key_derivation_t *pbkdf2,
7171 const uint8_t *data,
7172 size_t data_length)
7173{
Gilles Peskineead17662023-08-20 22:02:51 +02007174 if (pbkdf2->state == PSA_PBKDF2_STATE_INPUT_COST_SET) {
7175 pbkdf2->state = PSA_PBKDF2_STATE_SALT_SET;
7176 } else if (pbkdf2->state == PSA_PBKDF2_STATE_SALT_SET) {
7177 /* Appending to existing salt. No state change. */
7178 } else {
Kusumit Ghoderao547a6c62023-05-03 12:18:19 +05307179 return PSA_ERROR_BAD_STATE;
7180 }
7181
Gilles Peskineca57d782023-07-20 19:08:06 +02007182 if (data_length == 0) {
Gilles Peskineead17662023-08-20 22:02:51 +02007183 /* Appending an empty string, nothing to do. */
7184 } else {
Kusumit Ghoderaod7a3f802023-05-24 22:19:47 +05307185 uint8_t *next_salt;
Kusumit Ghoderaob538bb72023-05-24 12:32:14 +05307186
Kusumit Ghoderaod7a3f802023-05-24 22:19:47 +05307187 next_salt = mbedtls_calloc(1, data_length + pbkdf2->salt_length);
7188 if (next_salt == NULL) {
Kusumit Ghoderaod0422f32023-05-08 15:56:19 +05307189 return PSA_ERROR_INSUFFICIENT_MEMORY;
7190 }
7191
Gilles Peskineead17662023-08-20 22:02:51 +02007192 if (pbkdf2->salt_length != 0) {
7193 memcpy(next_salt, pbkdf2->salt, pbkdf2->salt_length);
7194 }
Kusumit Ghoderaod7a3f802023-05-24 22:19:47 +05307195 memcpy(next_salt + pbkdf2->salt_length, data, data_length);
Kusumit Ghoderaod0422f32023-05-08 15:56:19 +05307196 pbkdf2->salt_length += data_length;
Kusumit Ghoderaod7a3f802023-05-24 22:19:47 +05307197 mbedtls_free(pbkdf2->salt);
7198 pbkdf2->salt = next_salt;
Kusumit Ghoderao547a6c62023-05-03 12:18:19 +05307199 }
Kusumit Ghoderao547a6c62023-05-03 12:18:19 +05307200 return PSA_SUCCESS;
7201}
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05307202
Kusumit Ghoderao0bca4c52023-07-27 21:20:14 +05307203#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC)
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05307204static psa_status_t psa_pbkdf2_hmac_set_password(psa_algorithm_t hash_alg,
Kusumit Ghoderaoaac9a582023-05-24 14:19:17 +05307205 const uint8_t *input,
7206 size_t input_len,
7207 uint8_t *output,
Kusumit Ghoderao91f99f52023-05-24 22:21:48 +05307208 size_t *output_len)
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05307209{
7210 psa_status_t status = PSA_SUCCESS;
7211 if (input_len > PSA_HASH_BLOCK_LENGTH(hash_alg)) {
Ryan Everett5d2e82f2024-02-07 17:24:59 +00007212 return psa_hash_compute(hash_alg, input, input_len, output,
7213 PSA_HMAC_MAX_HASH_BLOCK_SIZE, output_len);
7214 } else if (input_len > 0) {
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05307215 memcpy(output, input, input_len);
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05307216 }
Ryan Everett5d2e82f2024-02-07 17:24:59 +00007217 *output_len = PSA_HASH_BLOCK_LENGTH(hash_alg);
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05307218 return status;
7219}
Kusumit Ghoderao0bca4c52023-07-27 21:20:14 +05307220#endif /* MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC */
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05307221
Kusumit Ghoderao0bca4c52023-07-27 21:20:14 +05307222#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_AES_CMAC_PRF_128)
Kusumit Ghoderao3d5edb82023-06-22 15:41:25 +05307223static psa_status_t psa_pbkdf2_cmac_set_password(const uint8_t *input,
7224 size_t input_len,
7225 uint8_t *output,
7226 size_t *output_len)
7227{
7228 psa_status_t status = PSA_SUCCESS;
Kusumit Ghoderaoa12e2d52023-07-27 21:18:30 +05307229 if (input_len != PSA_MAC_LENGTH(PSA_KEY_TYPE_AES, 128U, PSA_ALG_CMAC)) {
Kusumit Ghoderao3d5edb82023-06-22 15:41:25 +05307230 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
Kusumit Ghoderao3fde8fe2023-06-27 10:41:43 +05307231 uint8_t zeros[16] = { 0 };
Kusumit Ghoderao3d5edb82023-06-22 15:41:25 +05307232 psa_set_key_type(&attributes, PSA_KEY_TYPE_AES);
7233 psa_set_key_bits(&attributes, PSA_BYTES_TO_BITS(sizeof(zeros)));
7234 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_MESSAGE);
Kusumit Ghoderaoa12e2d52023-07-27 21:18:30 +05307235 /* Passing PSA_MAC_LENGTH(PSA_KEY_TYPE_AES, 128U, PSA_ALG_CMAC) as
Kusumit Ghoderao5f3345a2023-07-27 21:21:38 +05307236 * mac_size as the driver function sets mac_output_length = mac_size
7237 * on success. See https://github.com/Mbed-TLS/mbedtls/issues/7801 */
Kusumit Ghoderao3d5edb82023-06-22 15:41:25 +05307238 status = psa_driver_wrapper_mac_compute(&attributes,
7239 zeros, sizeof(zeros),
7240 PSA_ALG_CMAC, input, input_len,
7241 output,
Kusumit Ghoderaoa12e2d52023-07-27 21:18:30 +05307242 PSA_MAC_LENGTH(PSA_KEY_TYPE_AES,
7243 128U,
7244 PSA_ALG_CMAC),
Kusumit Ghoderao3d5edb82023-06-22 15:41:25 +05307245 output_len);
7246 } else {
7247 memcpy(output, input, input_len);
Kusumit Ghoderaoa12e2d52023-07-27 21:18:30 +05307248 *output_len = PSA_MAC_LENGTH(PSA_KEY_TYPE_AES, 128U, PSA_ALG_CMAC);
Kusumit Ghoderao3d5edb82023-06-22 15:41:25 +05307249 }
7250 return status;
7251}
Kusumit Ghoderao0bca4c52023-07-27 21:20:14 +05307252#endif /* MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_AES_CMAC_PRF_128 */
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05307253
7254static psa_status_t psa_pbkdf2_set_password(psa_pbkdf2_key_derivation_t *pbkdf2,
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05307255 psa_algorithm_t kdf_alg,
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05307256 const uint8_t *data,
7257 size_t data_length)
7258{
Kusumit Ghoderaoaac9a582023-05-24 14:19:17 +05307259 psa_status_t status = PSA_SUCCESS;
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05307260 if (pbkdf2->state != PSA_PBKDF2_STATE_SALT_SET) {
7261 return PSA_ERROR_BAD_STATE;
7262 }
7263
Kusumit Ghoderaof3e696d2023-07-28 13:30:50 +05307264#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC)
Kusumit Ghoderao3d5edb82023-06-22 15:41:25 +05307265 if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) {
7266 psa_algorithm_t hash_alg = PSA_ALG_PBKDF2_HMAC_GET_HASH(kdf_alg);
7267 status = psa_pbkdf2_hmac_set_password(hash_alg, data, data_length,
7268 pbkdf2->password,
7269 &pbkdf2->password_length);
Kusumit Ghoderaof3e696d2023-07-28 13:30:50 +05307270 } else
7271#endif /* MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC */
7272#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_AES_CMAC_PRF_128)
7273 if (kdf_alg == PSA_ALG_PBKDF2_AES_CMAC_PRF_128) {
Kusumit Ghoderao3d5edb82023-06-22 15:41:25 +05307274 status = psa_pbkdf2_cmac_set_password(data, data_length,
7275 pbkdf2->password,
7276 &pbkdf2->password_length);
Kusumit Ghoderaof3e696d2023-07-28 13:30:50 +05307277 } else
7278#endif /* MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_AES_CMAC_PRF_128 */
7279 {
7280 return PSA_ERROR_INVALID_ARGUMENT;
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05307281 }
7282
7283 pbkdf2->state = PSA_PBKDF2_STATE_PASSWORD_SET;
7284
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05307285 return status;
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05307286}
Kusumit Ghoderao24b38952023-05-03 12:25:26 +05307287
7288static psa_status_t psa_pbkdf2_input(psa_pbkdf2_key_derivation_t *pbkdf2,
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05307289 psa_algorithm_t kdf_alg,
Kusumit Ghoderao24b38952023-05-03 12:25:26 +05307290 psa_key_derivation_step_t step,
7291 const uint8_t *data,
7292 size_t data_length)
7293{
7294 switch (step) {
7295 case PSA_KEY_DERIVATION_INPUT_SALT:
7296 return psa_pbkdf2_set_salt(pbkdf2, data, data_length);
7297 case PSA_KEY_DERIVATION_INPUT_PASSWORD:
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05307298 return psa_pbkdf2_set_password(pbkdf2, kdf_alg, data, data_length);
Kusumit Ghoderao24b38952023-05-03 12:25:26 +05307299 default:
7300 return PSA_ERROR_INVALID_ARGUMENT;
7301 }
7302}
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05307303#endif /* PSA_HAVE_SOFT_PBKDF2 */
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05307304
Gilles Peskineb8965192019-09-24 16:21:10 +02007305/** Check whether the given key type is acceptable for the given
7306 * input step of a key derivation.
7307 *
7308 * Secret inputs must have the type #PSA_KEY_TYPE_DERIVE.
7309 * Non-secret inputs must have the type #PSA_KEY_TYPE_RAW_DATA.
7310 * Both secret and non-secret inputs can alternatively have the type
7311 * #PSA_KEY_TYPE_NONE, which is never the type of a key object, meaning
7312 * that the input was passed as a buffer rather than via a key object.
7313 */
Gilles Peskine224b0d62019-09-23 18:13:17 +02007314static int psa_key_derivation_check_input_type(
7315 psa_key_derivation_step_t step,
Gilles Peskine449bd832023-01-11 14:50:10 +01007316 psa_key_type_t key_type)
Gilles Peskine224b0d62019-09-23 18:13:17 +02007317{
Gilles Peskine449bd832023-01-11 14:50:10 +01007318 switch (step) {
Gilles Peskine224b0d62019-09-23 18:13:17 +02007319 case PSA_KEY_DERIVATION_INPUT_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01007320 if (key_type == PSA_KEY_TYPE_DERIVE) {
7321 return PSA_SUCCESS;
7322 }
7323 if (key_type == PSA_KEY_TYPE_NONE) {
7324 return PSA_SUCCESS;
7325 }
Gilles Peskine224b0d62019-09-23 18:13:17 +02007326 break;
Przemek Stekiela7695a22022-04-07 15:39:01 +02007327 case PSA_KEY_DERIVATION_INPUT_OTHER_SECRET:
Gilles Peskine449bd832023-01-11 14:50:10 +01007328 if (key_type == PSA_KEY_TYPE_DERIVE) {
7329 return PSA_SUCCESS;
7330 }
7331 if (key_type == PSA_KEY_TYPE_NONE) {
7332 return PSA_SUCCESS;
7333 }
Przemek Stekiela7695a22022-04-07 15:39:01 +02007334 break;
Gilles Peskine224b0d62019-09-23 18:13:17 +02007335 case PSA_KEY_DERIVATION_INPUT_LABEL:
7336 case PSA_KEY_DERIVATION_INPUT_SALT:
7337 case PSA_KEY_DERIVATION_INPUT_INFO:
7338 case PSA_KEY_DERIVATION_INPUT_SEED:
Gilles Peskine449bd832023-01-11 14:50:10 +01007339 if (key_type == PSA_KEY_TYPE_RAW_DATA) {
7340 return PSA_SUCCESS;
7341 }
7342 if (key_type == PSA_KEY_TYPE_NONE) {
7343 return PSA_SUCCESS;
7344 }
Gilles Peskine224b0d62019-09-23 18:13:17 +02007345 break;
Kusumit Ghoderaof4fe3ee2023-05-03 12:21:07 +05307346 case PSA_KEY_DERIVATION_INPUT_PASSWORD:
7347 if (key_type == PSA_KEY_TYPE_PASSWORD) {
7348 return PSA_SUCCESS;
7349 }
7350 if (key_type == PSA_KEY_TYPE_DERIVE) {
7351 return PSA_SUCCESS;
7352 }
7353 if (key_type == PSA_KEY_TYPE_NONE) {
7354 return PSA_SUCCESS;
7355 }
7356 break;
Gilles Peskine224b0d62019-09-23 18:13:17 +02007357 }
Gilles Peskine449bd832023-01-11 14:50:10 +01007358 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine224b0d62019-09-23 18:13:17 +02007359}
7360
Janos Follathb80a94e2019-06-12 15:54:46 +01007361static psa_status_t psa_key_derivation_input_internal(
Gilles Peskine51ae0e42019-05-16 17:31:03 +02007362 psa_key_derivation_operation_t *operation,
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01007363 psa_key_derivation_step_t step,
Gilles Peskine224b0d62019-09-23 18:13:17 +02007364 psa_key_type_t key_type,
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01007365 const uint8_t *data,
Gilles Peskine449bd832023-01-11 14:50:10 +01007366 size_t data_length)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01007367{
Gilles Peskine46d7faf2019-09-23 19:22:55 +02007368 psa_status_t status;
Gilles Peskine449bd832023-01-11 14:50:10 +01007369 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation);
Gilles Peskine46d7faf2019-09-23 19:22:55 +02007370
Gilles Peskine449bd832023-01-11 14:50:10 +01007371 status = psa_key_derivation_check_input_type(step, key_type);
7372 if (status != PSA_SUCCESS) {
Gilles Peskine224b0d62019-09-23 18:13:17 +02007373 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007374 }
Gilles Peskine224b0d62019-09-23 18:13:17 +02007375
Przemek Stekiel69c46792022-06-10 12:59:51 +02007376#if defined(BUILTIN_ALG_ANY_HKDF)
Gilles Peskine449bd832023-01-11 14:50:10 +01007377 if (PSA_ALG_IS_ANY_HKDF(kdf_alg)) {
7378 status = psa_hkdf_input(&operation->ctx.hkdf, kdf_alg,
7379 step, data, data_length);
7380 } else
Przemek Stekiel69c46792022-06-10 12:59:51 +02007381#endif /* BUILTIN_ALG_ANY_HKDF */
John Durkop07cc04a2020-11-16 22:08:34 -08007382#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF)
Gilles Peskine449bd832023-01-11 14:50:10 +01007383 if (PSA_ALG_IS_TLS12_PRF(kdf_alg)) {
7384 status = psa_tls12_prf_input(&operation->ctx.tls12_prf,
7385 step, data, data_length);
7386 } else
John Durkop07cc04a2020-11-16 22:08:34 -08007387#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF */
7388#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Gilles Peskine449bd832023-01-11 14:50:10 +01007389 if (PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
7390 status = psa_tls12_prf_psk_to_ms_input(&operation->ctx.tls12_prf,
7391 step, data, data_length);
7392 } else
John Durkop07cc04a2020-11-16 22:08:34 -08007393#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Andrzej Kurek08d34b82022-07-29 10:00:16 -04007394#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Gilles Peskine449bd832023-01-11 14:50:10 +01007395 if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) {
Andrzej Kurek08d34b82022-07-29 10:00:16 -04007396 status = psa_tls12_ecjpake_to_pms_input(
Gilles Peskine449bd832023-01-11 14:50:10 +01007397 &operation->ctx.tls12_ecjpake_to_pms, step, data, data_length);
7398 } else
Andrzej Kurek08d34b82022-07-29 10:00:16 -04007399#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05307400#if defined(PSA_HAVE_SOFT_PBKDF2)
Kusumit Ghoderao9ab03c32023-07-27 21:14:05 +05307401 if (PSA_ALG_IS_PBKDF2(kdf_alg)) {
Kusumit Ghoderaobd6cefb2023-05-24 12:36:34 +05307402 status = psa_pbkdf2_input(&operation->ctx.pbkdf2, kdf_alg,
7403 step, data, data_length);
Kusumit Ghoderao24b38952023-05-03 12:25:26 +05307404 } else
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05307405#endif /* PSA_HAVE_SOFT_PBKDF2 */
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01007406 {
Gilles Peskine51ae0e42019-05-16 17:31:03 +02007407 /* This can't happen unless the operation object was not initialized */
Steven Cooreman74afe472021-02-10 17:19:22 +01007408 (void) data;
7409 (void) data_length;
7410 (void) kdf_alg;
Gilles Peskine449bd832023-01-11 14:50:10 +01007411 return PSA_ERROR_BAD_STATE;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01007412 }
7413
Gilles Peskine224b0d62019-09-23 18:13:17 +02007414exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01007415 if (status != PSA_SUCCESS) {
7416 psa_key_derivation_abort(operation);
7417 }
7418 return status;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01007419}
7420
Kusumit Ghoderao50e0e112023-04-06 17:47:25 +05307421static psa_status_t psa_key_derivation_input_integer_internal(
7422 psa_key_derivation_operation_t *operation,
7423 psa_key_derivation_step_t step,
7424 uint64_t value)
7425{
7426 psa_status_t status;
7427 psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation);
7428
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05307429#if defined(PSA_HAVE_SOFT_PBKDF2)
Kusumit Ghoderao9ab03c32023-07-27 21:14:05 +05307430 if (PSA_ALG_IS_PBKDF2(kdf_alg)) {
Kusumit Ghoderao944bba12023-05-03 12:14:03 +05307431 status = psa_pbkdf2_set_input_cost(
7432 &operation->ctx.pbkdf2, step, value);
7433 } else
Kusumit Ghoderao2addf352023-07-27 21:09:26 +05307434#endif /* PSA_HAVE_SOFT_PBKDF2 */
Kusumit Ghoderao50e0e112023-04-06 17:47:25 +05307435 {
Kusumit Ghoderao3a18dee2023-04-07 16:16:27 +05307436 (void) step;
Kusumit Ghoderao50e0e112023-04-06 17:47:25 +05307437 (void) value;
7438 (void) kdf_alg;
Kusumit Ghoderaoa14ae5a2023-04-19 14:16:26 +05307439 status = PSA_ERROR_INVALID_ARGUMENT;
Kusumit Ghoderao50e0e112023-04-06 17:47:25 +05307440 }
7441
7442 if (status != PSA_SUCCESS) {
7443 psa_key_derivation_abort(operation);
7444 }
7445 return status;
7446}
7447
Janos Follath51f4a0f2019-06-14 11:35:55 +01007448psa_status_t psa_key_derivation_input_bytes(
7449 psa_key_derivation_operation_t *operation,
7450 psa_key_derivation_step_t step,
Ryan Everettd1e398c2024-01-19 14:46:00 +00007451 const uint8_t *data_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01007452 size_t data_length)
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01007453{
Ryan Everettd1e398c2024-01-19 14:46:00 +00007454 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
7455 LOCAL_INPUT_DECLARE(data_external, data);
7456
7457 LOCAL_INPUT_ALLOC(data_external, data_length, data);
7458
7459 status = psa_key_derivation_input_internal(operation, step,
7460 PSA_KEY_TYPE_NONE,
7461 data, data_length);
David Horstmann4a48bec2024-03-13 15:42:31 +00007462#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
Ryan Everettd1e398c2024-01-19 14:46:00 +00007463exit:
Ryan Everettb41c3c92024-01-25 11:56:35 +00007464#endif
Ryan Everettd1e398c2024-01-19 14:46:00 +00007465 LOCAL_INPUT_FREE(data_external, data);
7466 return status;
Gilles Peskine6cdfdb72019-01-08 10:31:27 +01007467}
7468
Kusumit Ghoderao50e0e112023-04-06 17:47:25 +05307469psa_status_t psa_key_derivation_input_integer(
7470 psa_key_derivation_operation_t *operation,
7471 psa_key_derivation_step_t step,
7472 uint64_t value)
7473{
7474 return psa_key_derivation_input_integer_internal(operation, step, value);
7475}
7476
Janos Follath51f4a0f2019-06-14 11:35:55 +01007477psa_status_t psa_key_derivation_input_key(
7478 psa_key_derivation_operation_t *operation,
7479 psa_key_derivation_step_t step,
Gilles Peskine449bd832023-01-11 14:50:10 +01007480 mbedtls_svc_key_id_t key)
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01007481{
Ronald Cronf95a2b12020-10-22 15:24:49 +02007482 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01007483 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01007484 psa_key_slot_t *slot;
Gilles Peskine178c9aa2019-09-24 18:21:06 +02007485
Ronald Cron5c522922020-11-14 16:35:34 +01007486 status = psa_get_and_lock_transparent_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01007487 key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg);
7488 if (status != PSA_SUCCESS) {
7489 psa_key_derivation_abort(operation);
7490 return status;
Gilles Peskine593773d2019-09-23 18:17:40 +02007491 }
Gilles Peskine178c9aa2019-09-24 18:21:06 +02007492
Kusumit Ghoderao3128c5d2023-05-03 12:27:57 +05307493 /* Passing a key object as a SECRET or PASSWORD input unlocks the
7494 * permission to output to a key object. */
7495 if (step == PSA_KEY_DERIVATION_INPUT_SECRET ||
7496 step == PSA_KEY_DERIVATION_INPUT_PASSWORD) {
Gilles Peskine178c9aa2019-09-24 18:21:06 +02007497 operation->can_output_key = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01007498 }
Gilles Peskine178c9aa2019-09-24 18:21:06 +02007499
Gilles Peskine449bd832023-01-11 14:50:10 +01007500 status = psa_key_derivation_input_internal(operation,
7501 step, slot->attr.type,
7502 slot->key.data,
7503 slot->key.bytes);
Ronald Cronf95a2b12020-10-22 15:24:49 +02007504
Ryan Everett5ac6fa72024-02-14 17:11:36 +00007505 unlock_status = psa_unregister_read_under_mutex(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02007506
Gilles Peskine449bd832023-01-11 14:50:10 +01007507 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskineb70a0fd2019-01-07 22:59:38 +01007508}
Gilles Peskineea0fb492018-07-12 17:17:20 +02007509
7510
7511
7512/****************************************************************/
Gilles Peskine01d718c2018-09-18 12:01:02 +02007513/* Key agreement */
7514/****************************************************************/
7515
Gilles Peskine449bd832023-01-11 14:50:10 +01007516psa_status_t psa_key_agreement_raw_builtin(const psa_key_attributes_t *attributes,
7517 const uint8_t *key_buffer,
7518 size_t key_buffer_size,
7519 psa_algorithm_t alg,
7520 const uint8_t *peer_key,
7521 size_t peer_key_length,
7522 uint8_t *shared_secret,
7523 size_t shared_secret_size,
7524 size_t *shared_secret_length)
Gilles Peskineb7ecdf02018-09-18 12:11:27 +02007525{
Gilles Peskine449bd832023-01-11 14:50:10 +01007526 switch (alg) {
John Durkop6ba40d12020-11-10 08:50:04 -08007527#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
Gilles Peskine0216fe12019-04-11 21:23:21 +02007528 case PSA_ALG_ECDH:
Gilles Peskine449bd832023-01-11 14:50:10 +01007529 return mbedtls_psa_key_agreement_ecdh(attributes, key_buffer,
7530 key_buffer_size, alg,
7531 peer_key, peer_key_length,
7532 shared_secret,
7533 shared_secret_size,
7534 shared_secret_length);
Gilles Peskine01d718c2018-09-18 12:01:02 +02007535#endif /* MBEDTLS_PSA_BUILTIN_ALG_ECDH */
Przemek Stekielfb3dd542022-12-01 14:59:15 +01007536
7537#if defined(MBEDTLS_PSA_BUILTIN_ALG_FFDH)
7538 case PSA_ALG_FFDH:
Przemek Stekiel152bb462023-06-01 11:52:39 +02007539 return mbedtls_psa_ffdh_key_agreement(attributes,
Przemek Stekiel359f4622022-12-05 14:11:55 +01007540 peer_key,
7541 peer_key_length,
7542 key_buffer,
7543 key_buffer_size,
7544 shared_secret,
7545 shared_secret_size,
7546 shared_secret_length);
Przemek Stekielfb3dd542022-12-01 14:59:15 +01007547#endif /* MBEDTLS_PSA_BUILTIN_ALG_FFDH */
7548
Gilles Peskine01d718c2018-09-18 12:01:02 +02007549 default:
Aditya Deshpande17845b82022-10-13 17:21:01 +01007550 (void) attributes;
7551 (void) key_buffer;
7552 (void) key_buffer_size;
Gilles Peskine93f85002018-11-16 16:43:31 +01007553 (void) peer_key;
7554 (void) peer_key_length;
Gilles Peskine0216fe12019-04-11 21:23:21 +02007555 (void) shared_secret;
7556 (void) shared_secret_size;
7557 (void) shared_secret_length;
Gilles Peskine449bd832023-01-11 14:50:10 +01007558 return PSA_ERROR_NOT_SUPPORTED;
Gilles Peskine01d718c2018-09-18 12:01:02 +02007559 }
Gilles Peskine0216fe12019-04-11 21:23:21 +02007560}
Gilles Peskine01d718c2018-09-18 12:01:02 +02007561
Aditya Deshpande17845b82022-10-13 17:21:01 +01007562/** Internal function for raw key agreement
7563 * Calls the driver wrapper which will hand off key agreement task
Aditya Deshpande40c05cc2022-10-14 16:41:40 +01007564 * to the driver's implementation if a driver is present.
7565 * Fallback specified in the driver wrapper is built-in raw key agreement
Aditya Deshpande17845b82022-10-13 17:21:01 +01007566 * (psa_key_agreement_raw_builtin).
7567 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007568static psa_status_t psa_key_agreement_raw_internal(psa_algorithm_t alg,
7569 psa_key_slot_t *private_key,
7570 const uint8_t *peer_key,
7571 size_t peer_key_length,
7572 uint8_t *shared_secret,
7573 size_t shared_secret_size,
7574 size_t *shared_secret_length)
Gilles Peskine51ae0e42019-05-16 17:31:03 +02007575{
Gilles Peskine449bd832023-01-11 14:50:10 +01007576 if (!PSA_ALG_IS_RAW_KEY_AGREEMENT(alg)) {
7577 return PSA_ERROR_NOT_SUPPORTED;
7578 }
Aditya Deshpande17845b82022-10-13 17:21:01 +01007579
Gilles Peskine7a5d9202024-02-28 01:18:23 +01007580 return psa_driver_wrapper_key_agreement(&private_key->attr,
Gilles Peskine449bd832023-01-11 14:50:10 +01007581 private_key->key.data,
7582 private_key->key.bytes, alg,
7583 peer_key, peer_key_length,
7584 shared_secret,
7585 shared_secret_size,
7586 shared_secret_length);
Gilles Peskine0216fe12019-04-11 21:23:21 +02007587}
7588
Gilles Peskinea99d3fb2019-05-16 15:28:51 +02007589/* Note that if this function fails, you must call psa_key_derivation_abort()
Gilles Peskine01d718c2018-09-18 12:01:02 +02007590 * to potentially free embedded data structures and wipe confidential data.
7591 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007592static psa_status_t psa_key_agreement_internal(psa_key_derivation_operation_t *operation,
7593 psa_key_derivation_step_t step,
7594 psa_key_slot_t *private_key,
7595 const uint8_t *peer_key,
7596 size_t peer_key_length)
Gilles Peskine01d718c2018-09-18 12:01:02 +02007597{
7598 psa_status_t status;
Moritz Fischer967f8cd2024-03-02 00:55:06 +00007599 uint8_t shared_secret[PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE] = { 0 };
Gilles Peskine01d718c2018-09-18 12:01:02 +02007600 size_t shared_secret_length = 0;
Gilles Peskine449bd832023-01-11 14:50:10 +01007601 psa_algorithm_t ka_alg = PSA_ALG_KEY_AGREEMENT_GET_BASE(operation->alg);
Gilles Peskine01d718c2018-09-18 12:01:02 +02007602
7603 /* Step 1: run the secret agreement algorithm to generate the shared
7604 * secret. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007605 status = psa_key_agreement_raw_internal(ka_alg,
7606 private_key,
7607 peer_key, peer_key_length,
7608 shared_secret,
7609 sizeof(shared_secret),
7610 &shared_secret_length);
7611 if (status != PSA_SUCCESS) {
Gilles Peskine12313cd2018-06-20 00:20:32 +02007612 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007613 }
Gilles Peskine12313cd2018-06-20 00:20:32 +02007614
Gilles Peskineb0b255c2018-07-06 17:01:38 +02007615 /* Step 2: set up the key derivation to generate key material from
Gilles Peskine224b0d62019-09-23 18:13:17 +02007616 * the shared secret. A shared secret is permitted wherever a key
7617 * of type DERIVE is permitted. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007618 status = psa_key_derivation_input_internal(operation, step,
7619 PSA_KEY_TYPE_DERIVE,
7620 shared_secret,
7621 shared_secret_length);
Gilles Peskine12313cd2018-06-20 00:20:32 +02007622exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01007623 mbedtls_platform_zeroize(shared_secret, shared_secret_length);
7624 return status;
Gilles Peskine12313cd2018-06-20 00:20:32 +02007625}
7626
Gilles Peskine449bd832023-01-11 14:50:10 +01007627psa_status_t psa_key_derivation_key_agreement(psa_key_derivation_operation_t *operation,
7628 psa_key_derivation_step_t step,
7629 mbedtls_svc_key_id_t private_key,
Thomas Daubney9739ac02024-02-15 13:15:47 +00007630 const uint8_t *peer_key_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01007631 size_t peer_key_length)
Gilles Peskine12313cd2018-06-20 00:20:32 +02007632{
Ronald Cronf95a2b12020-10-22 15:24:49 +02007633 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01007634 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f060a82018-12-04 17:12:32 +01007635 psa_key_slot_t *slot;
Thomas Daubney9739ac02024-02-15 13:15:47 +00007636 LOCAL_INPUT_DECLARE(peer_key_external, peer_key);
Ronald Cronf95a2b12020-10-22 15:24:49 +02007637
Gilles Peskine449bd832023-01-11 14:50:10 +01007638 if (!PSA_ALG_IS_KEY_AGREEMENT(operation->alg)) {
7639 return PSA_ERROR_INVALID_ARGUMENT;
7640 }
Ronald Cron5c522922020-11-14 16:35:34 +01007641 status = psa_get_and_lock_transparent_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01007642 private_key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg);
7643 if (status != PSA_SUCCESS) {
7644 return status;
7645 }
Thomas Daubney9739ac02024-02-15 13:15:47 +00007646
Thomas Daubney692fb3c2024-03-12 16:20:41 +00007647 LOCAL_INPUT_ALLOC(peer_key_external, peer_key_length, peer_key);
Gilles Peskine449bd832023-01-11 14:50:10 +01007648 status = psa_key_agreement_internal(operation, step,
7649 slot,
7650 peer_key, peer_key_length);
Thomas Daubney9739ac02024-02-15 13:15:47 +00007651
David Horstmann4a48bec2024-03-13 15:42:31 +00007652#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
Thomas Daubney9739ac02024-02-15 13:15:47 +00007653exit:
Thomas Daubney50f58fc2024-02-15 14:24:03 +00007654#endif
Gilles Peskine449bd832023-01-11 14:50:10 +01007655 if (status != PSA_SUCCESS) {
7656 psa_key_derivation_abort(operation);
7657 } else {
Steven Cooremanfa5e6312020-10-15 17:07:12 +02007658 /* If a private key has been added as SECRET, we allow the derived
7659 * key material to be used as a key in PSA Crypto. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007660 if (step == PSA_KEY_DERIVATION_INPUT_SECRET) {
Steven Cooremanfa5e6312020-10-15 17:07:12 +02007661 operation->can_output_key = 1;
Gilles Peskine449bd832023-01-11 14:50:10 +01007662 }
Steven Cooremanfa5e6312020-10-15 17:07:12 +02007663 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02007664
Ryan Everett5ac6fa72024-02-14 17:11:36 +00007665 unlock_status = psa_unregister_read_under_mutex(slot);
Thomas Daubney9739ac02024-02-15 13:15:47 +00007666 LOCAL_INPUT_FREE(peer_key_external, peer_key);
Ronald Cronf95a2b12020-10-22 15:24:49 +02007667
Gilles Peskine449bd832023-01-11 14:50:10 +01007668 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskineaf3baab2018-06-27 22:55:52 +02007669}
7670
Gilles Peskine449bd832023-01-11 14:50:10 +01007671psa_status_t psa_raw_key_agreement(psa_algorithm_t alg,
7672 mbedtls_svc_key_id_t private_key,
Thomas Daubney81899ab2024-02-15 12:57:26 +00007673 const uint8_t *peer_key_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01007674 size_t peer_key_length,
Thomas Daubney81899ab2024-02-15 12:57:26 +00007675 uint8_t *output_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01007676 size_t output_size,
7677 size_t *output_length)
Gilles Peskine0216fe12019-04-11 21:23:21 +02007678{
Ronald Cronf95a2b12020-10-22 15:24:49 +02007679 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cron5c522922020-11-14 16:35:34 +01007680 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Ronald Cronf95a2b12020-10-22 15:24:49 +02007681 psa_key_slot_t *slot = NULL;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01007682 size_t expected_length;
Thomas Daubney81899ab2024-02-15 12:57:26 +00007683 LOCAL_INPUT_DECLARE(peer_key_external, peer_key);
7684 LOCAL_OUTPUT_DECLARE(output_external, output);
Thomas Daubney89d8c2a2024-02-21 11:16:16 +00007685 LOCAL_OUTPUT_ALLOC(output_external, output_size, output);
Gilles Peskine0216fe12019-04-11 21:23:21 +02007686
Gilles Peskine449bd832023-01-11 14:50:10 +01007687 if (!PSA_ALG_IS_KEY_AGREEMENT(alg)) {
Gilles Peskine0216fe12019-04-11 21:23:21 +02007688 status = PSA_ERROR_INVALID_ARGUMENT;
7689 goto exit;
7690 }
Ronald Cron5c522922020-11-14 16:35:34 +01007691 status = psa_get_and_lock_transparent_key_slot_with_policy(
Gilles Peskine449bd832023-01-11 14:50:10 +01007692 private_key, &slot, PSA_KEY_USAGE_DERIVE, alg);
7693 if (status != PSA_SUCCESS) {
Gilles Peskine0216fe12019-04-11 21:23:21 +02007694 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01007695 }
Gilles Peskine0216fe12019-04-11 21:23:21 +02007696
Gilles Peskine3e561302022-04-14 00:17:15 +02007697 /* PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE() is in general an upper bound
7698 * for the output size. The PSA specification only guarantees that this
7699 * function works if output_size >= PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE(...),
7700 * but it might be nice to allow smaller buffers if the output fits.
7701 * At the time of writing this comment, with only ECDH implemented,
7702 * PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE() is exact so the point is moot.
7703 * If FFDH is implemented, PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE() can easily
7704 * be exact for it as well. */
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01007705 expected_length =
Gilles Peskine449bd832023-01-11 14:50:10 +01007706 PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE(slot->attr.type, slot->attr.bits);
7707 if (output_size < expected_length) {
Gilles Peskine3e561302022-04-14 00:17:15 +02007708 status = PSA_ERROR_BUFFER_TOO_SMALL;
7709 goto exit;
7710 }
7711
Thomas Daubney81899ab2024-02-15 12:57:26 +00007712 LOCAL_INPUT_ALLOC(peer_key_external, peer_key_length, peer_key);
Gilles Peskine449bd832023-01-11 14:50:10 +01007713 status = psa_key_agreement_raw_internal(alg, slot,
7714 peer_key, peer_key_length,
7715 output, output_size,
7716 output_length);
Gilles Peskine0216fe12019-04-11 21:23:21 +02007717
7718exit:
Thomas Daubney5390aca2024-02-22 11:06:04 +00007719 /* Check for successful allocation of output,
7720 * with an unsuccessful status. */
Thomas Daubney0576a6a2024-02-21 15:15:00 +00007721 if (output != NULL && status != PSA_SUCCESS) {
Gilles Peskine0216fe12019-04-11 21:23:21 +02007722 /* If an error happens and is not handled properly, the output
7723 * may be used as a key to protect sensitive data. Arrange for such
7724 * a key to be random, which is likely to result in decryption or
7725 * verification errors. This is better than filling the buffer with
7726 * some constant data such as zeros, which would result in the data
7727 * being protected with a reproducible, easily knowable key.
7728 */
David Horstmann6e99bb22024-02-06 15:27:49 +00007729 psa_generate_random_internal(output, output_size);
Gilles Peskine0216fe12019-04-11 21:23:21 +02007730 *output_length = output_size;
7731 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02007732
Thomas Daubney5390aca2024-02-22 11:06:04 +00007733 if (output == NULL) {
Thomas Daubney89d8c2a2024-02-21 11:16:16 +00007734 /* output allocation failed. */
7735 *output_length = 0;
Gilles Peskine0216fe12019-04-11 21:23:21 +02007736 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02007737
Ryan Everetta103ec92024-01-31 13:59:57 +00007738 unlock_status = psa_unregister_read_under_mutex(slot);
Ronald Cronf95a2b12020-10-22 15:24:49 +02007739
Thomas Daubney81899ab2024-02-15 12:57:26 +00007740 LOCAL_INPUT_FREE(peer_key_external, peer_key);
7741 LOCAL_OUTPUT_FREE(output_external, output);
Gilles Peskine449bd832023-01-11 14:50:10 +01007742 return (status == PSA_SUCCESS) ? unlock_status : status;
Gilles Peskine0216fe12019-04-11 21:23:21 +02007743}
Gilles Peskine86a440b2018-11-12 18:39:40 +01007744
7745
7746/****************************************************************/
7747/* Random generation */
Gilles Peskine53d991e2018-07-12 01:14:59 +02007748/****************************************************************/
Gilles Peskine12313cd2018-06-20 00:20:32 +02007749
Gilles Peskine672a7712023-04-28 21:00:28 +02007750#if defined(MBEDTLS_PSA_INJECT_ENTROPY)
7751#include "entropy_poll.h"
7752#endif
7753
Gilles Peskine30524eb2020-11-13 17:02:26 +01007754/** Initialize the PSA random generator.
Paul Elliottd35dce62024-03-15 13:57:16 +00007755 *
7756 * Note: the mbedtls_threading_psa_rngdata_mutex should be held when calling
7757 * this function if mutexes are enabled.
Gilles Peskine30524eb2020-11-13 17:02:26 +01007758 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007759static void mbedtls_psa_random_init(mbedtls_psa_random_context_t *rng)
Gilles Peskine30524eb2020-11-13 17:02:26 +01007760{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007761#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
Gilles Peskine449bd832023-01-11 14:50:10 +01007762 memset(rng, 0, sizeof(*rng));
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007763#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
7764
Gilles Peskine30524eb2020-11-13 17:02:26 +01007765 /* Set default configuration if
7766 * mbedtls_psa_crypto_configure_entropy_sources() hasn't been called. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007767 if (rng->entropy_init == NULL) {
Gilles Peskine30524eb2020-11-13 17:02:26 +01007768 rng->entropy_init = mbedtls_entropy_init;
Gilles Peskine449bd832023-01-11 14:50:10 +01007769 }
7770 if (rng->entropy_free == NULL) {
Gilles Peskine30524eb2020-11-13 17:02:26 +01007771 rng->entropy_free = mbedtls_entropy_free;
Gilles Peskine449bd832023-01-11 14:50:10 +01007772 }
Gilles Peskine30524eb2020-11-13 17:02:26 +01007773
Gilles Peskine449bd832023-01-11 14:50:10 +01007774 rng->entropy_init(&rng->entropy);
Gilles Peskine30524eb2020-11-13 17:02:26 +01007775#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \
7776 defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES)
7777 /* The PSA entropy injection feature depends on using NV seed as an entropy
7778 * source. Add NV seed as an entropy source for PSA entropy injection. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007779 mbedtls_entropy_add_source(&rng->entropy,
7780 mbedtls_nv_seed_poll, NULL,
7781 MBEDTLS_ENTROPY_BLOCK_SIZE,
7782 MBEDTLS_ENTROPY_SOURCE_STRONG);
Gilles Peskine30524eb2020-11-13 17:02:26 +01007783#endif
7784
Valerio Setti061d4e42024-02-26 12:52:44 +01007785 mbedtls_psa_drbg_init(&rng->drbg);
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007786#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01007787}
7788
7789/** Deinitialize the PSA random generator.
Paul Elliottd35dce62024-03-15 13:57:16 +00007790 *
7791 * Note: the mbedtls_threading_psa_rngdata_mutex should be held when calling
7792 * this function if mutexes are enabled.
Gilles Peskine30524eb2020-11-13 17:02:26 +01007793 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007794static void mbedtls_psa_random_free(mbedtls_psa_random_context_t *rng)
Gilles Peskine30524eb2020-11-13 17:02:26 +01007795{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007796#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
Gilles Peskine449bd832023-01-11 14:50:10 +01007797 memset(rng, 0, sizeof(*rng));
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007798#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Valerio Setti061d4e42024-02-26 12:52:44 +01007799 mbedtls_psa_drbg_free(&rng->drbg);
Gilles Peskine449bd832023-01-11 14:50:10 +01007800 rng->entropy_free(&rng->entropy);
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007801#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01007802}
7803
7804/** Seed the PSA random generator.
7805 */
Gilles Peskine449bd832023-01-11 14:50:10 +01007806static psa_status_t mbedtls_psa_random_seed(mbedtls_psa_random_context_t *rng)
Gilles Peskine30524eb2020-11-13 17:02:26 +01007807{
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007808#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
7809 /* Do nothing: the external RNG seeds itself. */
7810 (void) rng;
Gilles Peskine449bd832023-01-11 14:50:10 +01007811 return PSA_SUCCESS;
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007812#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01007813 const unsigned char drbg_seed[] = "PSA";
Valerio Setti061d4e42024-02-26 12:52:44 +01007814 int ret = mbedtls_psa_drbg_seed(&rng->drbg, &rng->entropy,
Gilles Peskine449bd832023-01-11 14:50:10 +01007815 drbg_seed, sizeof(drbg_seed) - 1);
7816 return mbedtls_to_psa_error(ret);
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007817#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Gilles Peskine30524eb2020-11-13 17:02:26 +01007818}
7819
David Horstmann6e99bb22024-02-06 15:27:49 +00007820psa_status_t psa_generate_random(uint8_t *output_external,
Gilles Peskine449bd832023-01-11 14:50:10 +01007821 size_t output_size)
Gilles Peskinee59236f2018-01-27 23:32:46 +01007822{
David Horstmann6e99bb22024-02-06 15:27:49 +00007823 psa_status_t status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01007824
David Horstmann6e99bb22024-02-06 15:27:49 +00007825 LOCAL_OUTPUT_DECLARE(output_external, output);
7826 LOCAL_OUTPUT_ALLOC(output_external, output_size, output);
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007827
David Horstmann6e99bb22024-02-06 15:27:49 +00007828 status = psa_generate_random_internal(output, output_size);
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01007829
David Horstmann4a48bec2024-03-13 15:42:31 +00007830#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
David Horstmann6e99bb22024-02-06 15:27:49 +00007831exit:
David Horstmanne097bbd2024-02-28 14:17:10 +00007832#endif
David Horstmann6e99bb22024-02-06 15:27:49 +00007833 LOCAL_OUTPUT_FREE(output_external, output);
7834 return status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01007835}
7836
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01007837#if defined(MBEDTLS_PSA_INJECT_ENTROPY)
Gilles Peskine449bd832023-01-11 14:50:10 +01007838psa_status_t mbedtls_psa_inject_entropy(const uint8_t *seed,
7839 size_t seed_size)
Netanel Gonen2bcd3122018-11-19 11:53:02 +02007840{
Paul Elliott600472b2024-02-23 17:26:58 +00007841 if (psa_get_initialized()) {
Gilles Peskine449bd832023-01-11 14:50:10 +01007842 return PSA_ERROR_NOT_PERMITTED;
7843 }
Netanel Gonen21f37cb2018-11-19 11:53:55 +02007844
Gilles Peskine449bd832023-01-11 14:50:10 +01007845 if (((seed_size < MBEDTLS_ENTROPY_MIN_PLATFORM) ||
7846 (seed_size < MBEDTLS_ENTROPY_BLOCK_SIZE)) ||
7847 (seed_size > MBEDTLS_ENTROPY_MAX_SEED_SIZE)) {
7848 return PSA_ERROR_INVALID_ARGUMENT;
7849 }
Netanel Gonen21f37cb2018-11-19 11:53:55 +02007850
Gilles Peskine449bd832023-01-11 14:50:10 +01007851 return mbedtls_psa_storage_inject_entropy(seed, seed_size);
Netanel Gonen2bcd3122018-11-19 11:53:02 +02007852}
Gilles Peskinee3dbdd82019-02-25 11:04:06 +01007853#endif /* MBEDTLS_PSA_INJECT_ENTROPY */
Netanel Gonen2bcd3122018-11-19 11:53:02 +02007854
Ronald Cron3772afe2021-02-08 16:10:05 +01007855/** Validate the key type and size for key generation
Ronald Cron01b2aba2020-10-05 09:42:02 +02007856 *
Ronald Cron3772afe2021-02-08 16:10:05 +01007857 * \param type The key type
7858 * \param bits The number of bits of the key
Ronald Cron01b2aba2020-10-05 09:42:02 +02007859 *
7860 * \retval #PSA_SUCCESS
Ronald Cron3772afe2021-02-08 16:10:05 +01007861 * The key type and size are valid.
Ronald Cron01b2aba2020-10-05 09:42:02 +02007862 * \retval #PSA_ERROR_INVALID_ARGUMENT
7863 * The size in bits of the key is not valid.
7864 * \retval #PSA_ERROR_NOT_SUPPORTED
7865 * The type and/or the size in bits of the key or the combination of
7866 * the two is not supported.
7867 */
Ronald Cron3772afe2021-02-08 16:10:05 +01007868static psa_status_t psa_validate_key_type_and_size_for_key_generation(
Gilles Peskine449bd832023-01-11 14:50:10 +01007869 psa_key_type_t type, size_t bits)
Gilles Peskinee59236f2018-01-27 23:32:46 +01007870{
Ronald Cronf3bb7612020-10-02 20:11:59 +02007871 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskinee59236f2018-01-27 23:32:46 +01007872
Gilles Peskine449bd832023-01-11 14:50:10 +01007873 if (key_type_is_raw_bytes(type)) {
7874 status = psa_validate_unstructured_key_bit_size(type, bits);
7875 if (status != PSA_SUCCESS) {
7876 return status;
7877 }
7878 } else
Valerio Settif6d4dfb2023-07-10 10:55:12 +02007879#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01007880 if (PSA_KEY_TYPE_IS_RSA(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
7881 if (bits > PSA_VENDOR_RSA_MAX_KEY_BITS) {
7882 return PSA_ERROR_NOT_SUPPORTED;
7883 }
Waleed Elmelegyd7bdbbe2023-07-20 16:26:58 +00007884 if (bits < PSA_VENDOR_RSA_GENERATE_MIN_KEY_BITS) {
Waleed Elmelegyab570712023-07-05 16:40:58 +00007885 return PSA_ERROR_NOT_SUPPORTED;
7886 }
Steven Cooreman81be2fa2020-07-24 22:04:59 +02007887
Ronald Cron01b2aba2020-10-05 09:42:02 +02007888 /* Accept only byte-aligned keys, for the same reasons as
7889 * in psa_import_rsa_key(). */
Gilles Peskine449bd832023-01-11 14:50:10 +01007890 if (bits % 8 != 0) {
7891 return PSA_ERROR_NOT_SUPPORTED;
7892 }
7893 } else
Valerio Settif6d4dfb2023-07-10 10:55:12 +02007894#endif /* defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE) */
Ronald Cron01b2aba2020-10-05 09:42:02 +02007895
Valerio Setti6a9d0ee2023-06-21 10:07:21 +02007896#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01007897 if (PSA_KEY_TYPE_IS_ECC(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
Ronald Crond81ab562021-02-16 09:01:16 +01007898 /* To avoid empty block, return successfully here. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007899 return PSA_SUCCESS;
7900 } else
Valerio Setti6a9d0ee2023-06-21 10:07:21 +02007901#endif /* defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE) */
Przemek Stekielfedd1342022-12-01 15:00:02 +01007902
Valerio Settia55f0422023-07-10 15:34:41 +02007903#if defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE)
Przemek Stekielfedd1342022-12-01 15:00:02 +01007904 if (PSA_KEY_TYPE_IS_DH(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
Przemek Stekield1cf1ba2023-04-27 12:04:21 +02007905 if (psa_is_dh_key_size_valid(bits) == 0) {
Przemek Stekielfedd1342022-12-01 15:00:02 +01007906 return PSA_ERROR_NOT_SUPPORTED;
7907 }
7908 } else
Valerio Settia55f0422023-07-10 15:34:41 +02007909#endif /* defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE) */
Ronald Cron01b2aba2020-10-05 09:42:02 +02007910 {
Gilles Peskine449bd832023-01-11 14:50:10 +01007911 return PSA_ERROR_NOT_SUPPORTED;
Ronald Cron01b2aba2020-10-05 09:42:02 +02007912 }
7913
Gilles Peskine449bd832023-01-11 14:50:10 +01007914 return PSA_SUCCESS;
Ronald Cron01b2aba2020-10-05 09:42:02 +02007915}
7916
Ronald Cron55ed0592020-10-05 10:30:40 +02007917psa_status_t psa_generate_key_internal(
Ronald Cron2a38a6b2020-10-02 20:02:04 +02007918 const psa_key_attributes_t *attributes,
Gilles Peskinef36d7852024-06-06 21:11:44 +02007919 const psa_custom_key_parameters_t *custom,
7920 const uint8_t *custom_data,
7921 size_t custom_data_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01007922 uint8_t *key_buffer, size_t key_buffer_size, size_t *key_buffer_length)
Ronald Cron01b2aba2020-10-05 09:42:02 +02007923{
7924 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Gilles Peskine2f107ae2024-02-28 01:26:46 +01007925 psa_key_type_t type = attributes->type;
Ronald Cron01b2aba2020-10-05 09:42:02 +02007926
Gilles Peskine7a18f962024-02-12 16:48:11 +01007927 /* Only used for RSA */
Gilles Peskinef36d7852024-06-06 21:11:44 +02007928 (void) custom;
7929 (void) custom_data;
7930 (void) custom_data_length;
Ronald Cron01b2aba2020-10-05 09:42:02 +02007931
Gilles Peskine449bd832023-01-11 14:50:10 +01007932 if (key_type_is_raw_bytes(type)) {
David Horstmann93fa4e12024-03-12 15:02:28 +00007933 status = psa_generate_random_internal(key_buffer, key_buffer_size);
Gilles Peskine449bd832023-01-11 14:50:10 +01007934 if (status != PSA_SUCCESS) {
7935 return status;
7936 }
Steven Cooreman81be2fa2020-07-24 22:04:59 +02007937
David Brown12ca5032021-02-11 11:02:00 -07007938#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Gilles Peskine449bd832023-01-11 14:50:10 +01007939 if (type == PSA_KEY_TYPE_DES) {
7940 psa_des_set_key_parity(key_buffer, key_buffer_size);
7941 }
David Brown8107e312021-02-12 08:08:46 -07007942#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */
Gilles Peskine449bd832023-01-11 14:50:10 +01007943 } else
Gilles Peskinee59236f2018-01-27 23:32:46 +01007944
Valerio Setti76df8c12023-07-11 14:11:28 +02007945#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_GENERATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01007946 if (type == PSA_KEY_TYPE_RSA_KEY_PAIR) {
7947 return mbedtls_psa_rsa_generate_key(attributes,
Gilles Peskinef36d7852024-06-06 21:11:44 +02007948 custom_data, custom_data_length,
Gilles Peskine449bd832023-01-11 14:50:10 +01007949 key_buffer,
7950 key_buffer_size,
7951 key_buffer_length);
7952 } else
Valerio Setti76df8c12023-07-11 14:11:28 +02007953#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_GENERATE) */
Gilles Peskinee59236f2018-01-27 23:32:46 +01007954
Valerio Settibfeaf5b2023-06-20 13:27:46 +02007955#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_GENERATE)
Gilles Peskine449bd832023-01-11 14:50:10 +01007956 if (PSA_KEY_TYPE_IS_ECC(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
7957 return mbedtls_psa_ecp_generate_key(attributes,
7958 key_buffer,
7959 key_buffer_size,
7960 key_buffer_length);
7961 } else
Valerio Settibfeaf5b2023-06-20 13:27:46 +02007962#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_GENERATE) */
Przemek Stekielfedd1342022-12-01 15:00:02 +01007963
Valerio Settia55f0422023-07-10 15:34:41 +02007964#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_GENERATE)
Przemek Stekielfedd1342022-12-01 15:00:02 +01007965 if (PSA_KEY_TYPE_IS_DH(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
7966 return mbedtls_psa_ffdh_generate_key(attributes,
7967 key_buffer,
7968 key_buffer_size,
7969 key_buffer_length);
7970 } else
Valerio Settia55f0422023-07-10 15:34:41 +02007971#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_GENERATE) */
Steven Cooreman29149862020-08-05 15:43:42 +02007972 {
Gilles Peskine449bd832023-01-11 14:50:10 +01007973 (void) key_buffer_length;
7974 return PSA_ERROR_NOT_SUPPORTED;
Steven Cooreman29149862020-08-05 15:43:42 +02007975 }
Gilles Peskinee59236f2018-01-27 23:32:46 +01007976
Gilles Peskine449bd832023-01-11 14:50:10 +01007977 return PSA_SUCCESS;
Gilles Peskineff5f0e72019-04-18 12:53:30 +02007978}
Darryl Green0c6575a2018-11-07 16:05:30 +00007979
Gilles Peskinef36d7852024-06-06 21:11:44 +02007980psa_status_t psa_generate_key_custom(const psa_key_attributes_t *attributes,
7981 const psa_custom_key_parameters_t *custom,
7982 const uint8_t *custom_data,
7983 size_t custom_data_length,
7984 mbedtls_svc_key_id_t *key)
Gilles Peskineff5f0e72019-04-18 12:53:30 +02007985{
7986 psa_status_t status;
7987 psa_key_slot_t *slot = NULL;
Gilles Peskine8abe6a22019-07-12 23:40:35 +02007988 psa_se_drv_table_entry_t *driver = NULL;
Ronald Cron2b56bc82020-10-05 10:02:26 +02007989 size_t key_buffer_size;
Gilles Peskine11792082019-08-06 18:36:36 +02007990
Ronald Cron81709fc2020-11-14 12:10:32 +01007991 *key = MBEDTLS_SVC_KEY_ID_INIT;
7992
Gilles Peskine0f84d622019-09-12 19:03:13 +02007993 /* Reject any attempt to create a zero-length key so that we don't
7994 * risk tripping up later, e.g. on a malloc(0) that returns NULL. */
Gilles Peskine449bd832023-01-11 14:50:10 +01007995 if (psa_get_key_bits(attributes) == 0) {
7996 return PSA_ERROR_INVALID_ARGUMENT;
7997 }
Gilles Peskine0f84d622019-09-12 19:03:13 +02007998
Przemyslaw Stekielc0fe8202021-10-07 11:08:56 +02007999 /* Reject any attempt to create a public key. */
Gilles Peskine2f107ae2024-02-28 01:26:46 +01008000 if (PSA_KEY_TYPE_IS_PUBLIC_KEY(attributes->type)) {
Gilles Peskine449bd832023-01-11 14:50:10 +01008001 return PSA_ERROR_INVALID_ARGUMENT;
8002 }
Przemyslaw Stekielc0fe8202021-10-07 11:08:56 +02008003
Gilles Peskine7a18f962024-02-12 16:48:11 +01008004#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE)
Gilles Peskine2f107ae2024-02-28 01:26:46 +01008005 if (attributes->type == PSA_KEY_TYPE_RSA_KEY_PAIR) {
Gilles Peskinef36d7852024-06-06 21:11:44 +02008006 if (custom->flags != 0) {
Gilles Peskine7a18f962024-02-12 16:48:11 +01008007 return PSA_ERROR_INVALID_ARGUMENT;
8008 }
8009 } else
8010#endif
Gilles Peskine52504f82024-06-20 17:19:58 +02008011 if (!psa_custom_key_parameters_are_default(custom, custom_data_length)) {
Ronald Cron81709fc2020-11-14 12:10:32 +01008012 return PSA_ERROR_INVALID_ARGUMENT;
Gilles Peskine11792082019-08-06 18:36:36 +02008013 }
8014
Gilles Peskine449bd832023-01-11 14:50:10 +01008015 status = psa_start_key_creation(PSA_KEY_CREATION_GENERATE, attributes,
8016 &slot, &driver);
8017 if (status != PSA_SUCCESS) {
Gilles Peskine11792082019-08-06 18:36:36 +02008018 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01008019 }
Gilles Peskine11792082019-08-06 18:36:36 +02008020
Ronald Cron977c2472020-10-13 08:32:21 +02008021 /* In the case of a transparent key or an opaque key stored in local
Archana449608b2021-09-08 15:36:05 +05308022 * storage ( thus not in the case of generating a key in a secure element
8023 * with storage ( MBEDTLS_PSA_CRYPTO_SE_C ) ),we have to allocate a
8024 * buffer to hold the generated key material. */
Valerio Setti70fa89c2024-08-14 05:12:45 +02008025 if (slot->key.bytes == 0) {
Gilles Peskine2f107ae2024-02-28 01:26:46 +01008026 if (PSA_KEY_LIFETIME_GET_LOCATION(attributes->lifetime) ==
Gilles Peskine449bd832023-01-11 14:50:10 +01008027 PSA_KEY_LOCATION_LOCAL_STORAGE) {
Ronald Cron3772afe2021-02-08 16:10:05 +01008028 status = psa_validate_key_type_and_size_for_key_generation(
Gilles Peskine2f107ae2024-02-28 01:26:46 +01008029 attributes->type, attributes->bits);
Gilles Peskine449bd832023-01-11 14:50:10 +01008030 if (status != PSA_SUCCESS) {
Ronald Cron3772afe2021-02-08 16:10:05 +01008031 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01008032 }
Ronald Cron3772afe2021-02-08 16:10:05 +01008033
8034 key_buffer_size = PSA_EXPORT_KEY_OUTPUT_SIZE(
Gilles Peskine2f107ae2024-02-28 01:26:46 +01008035 attributes->type,
8036 attributes->bits);
Gilles Peskine449bd832023-01-11 14:50:10 +01008037 } else {
Ronald Cron977c2472020-10-13 08:32:21 +02008038 status = psa_driver_wrapper_get_key_buffer_size(
Gilles Peskine449bd832023-01-11 14:50:10 +01008039 attributes, &key_buffer_size);
8040 if (status != PSA_SUCCESS) {
Ronald Cron3772afe2021-02-08 16:10:05 +01008041 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01008042 }
Ronald Cron977c2472020-10-13 08:32:21 +02008043 }
Ronald Cron977c2472020-10-13 08:32:21 +02008044
Gilles Peskine449bd832023-01-11 14:50:10 +01008045 status = psa_allocate_buffer_to_slot(slot, key_buffer_size);
8046 if (status != PSA_SUCCESS) {
Ronald Cron977c2472020-10-13 08:32:21 +02008047 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01008048 }
Ronald Cron977c2472020-10-13 08:32:21 +02008049 }
8050
Gilles Peskine449bd832023-01-11 14:50:10 +01008051 status = psa_driver_wrapper_generate_key(attributes,
Gilles Peskinef36d7852024-06-06 21:11:44 +02008052 custom,
8053 custom_data, custom_data_length,
Gilles Peskine7a18f962024-02-12 16:48:11 +01008054 slot->key.data, slot->key.bytes,
8055 &slot->key.bytes);
Gilles Peskine449bd832023-01-11 14:50:10 +01008056 if (status != PSA_SUCCESS) {
8057 psa_remove_key_data_from_memory(slot);
8058 }
Ronald Cron2b56bc82020-10-05 10:02:26 +02008059
Gilles Peskine11792082019-08-06 18:36:36 +02008060exit:
Gilles Peskine449bd832023-01-11 14:50:10 +01008061 if (status == PSA_SUCCESS) {
8062 status = psa_finish_key_creation(slot, driver, key);
8063 }
8064 if (status != PSA_SUCCESS) {
8065 psa_fail_key_creation(slot, driver);
8066 }
Ronald Cronf95a2b12020-10-22 15:24:49 +02008067
Gilles Peskine449bd832023-01-11 14:50:10 +01008068 return status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01008069}
8070
Gilles Peskinef36d7852024-06-06 21:11:44 +02008071psa_status_t psa_generate_key_ext(const psa_key_attributes_t *attributes,
8072 const psa_key_production_parameters_t *params,
8073 size_t params_data_length,
8074 mbedtls_svc_key_id_t *key)
8075{
8076 return psa_generate_key_custom(
8077 attributes,
8078 (const psa_custom_key_parameters_t *) params,
8079 params->data, params_data_length,
8080 key);
8081}
8082
Gilles Peskinef0765fa2024-02-12 16:46:16 +01008083psa_status_t psa_generate_key(const psa_key_attributes_t *attributes,
8084 mbedtls_svc_key_id_t *key)
8085{
Gilles Peskinef36d7852024-06-06 21:11:44 +02008086 return psa_generate_key_custom(attributes,
8087 &default_custom_production,
8088 NULL, 0,
8089 key);
Gilles Peskinef0765fa2024-02-12 16:46:16 +01008090}
8091
Gilles Peskinee59236f2018-01-27 23:32:46 +01008092/****************************************************************/
8093/* Module setup */
8094/****************************************************************/
8095
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01008096#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
Gilles Peskine5e769522018-11-20 21:59:56 +01008097psa_status_t mbedtls_psa_crypto_configure_entropy_sources(
Gilles Peskine449bd832023-01-11 14:50:10 +01008098 void (* entropy_init)(mbedtls_entropy_context *ctx),
8099 void (* entropy_free)(mbedtls_entropy_context *ctx))
Gilles Peskine5e769522018-11-20 21:59:56 +01008100{
Paul Elliott8e151532024-02-23 17:35:29 +00008101 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
8102
8103#if defined(MBEDTLS_THREADING_C)
8104 mbedtls_mutex_lock(&mbedtls_threading_psa_rngdata_mutex);
8105#endif /* defined(MBEDTLS_THREADING_C) */
8106
Gilles Peskine449bd832023-01-11 14:50:10 +01008107 if (global_data.rng_state != RNG_NOT_INITIALIZED) {
Paul Elliott8e151532024-02-23 17:35:29 +00008108 status = PSA_ERROR_BAD_STATE;
8109 } else {
8110 global_data.rng.entropy_init = entropy_init;
8111 global_data.rng.entropy_free = entropy_free;
8112 status = PSA_SUCCESS;
Gilles Peskine449bd832023-01-11 14:50:10 +01008113 }
Paul Elliott8e151532024-02-23 17:35:29 +00008114
8115#if defined(MBEDTLS_THREADING_C)
8116 mbedtls_mutex_unlock(&mbedtls_threading_psa_rngdata_mutex);
8117#endif /* defined(MBEDTLS_THREADING_C) */
8118
8119 return status;
Gilles Peskine5e769522018-11-20 21:59:56 +01008120}
Gilles Peskine4fc21fd2020-11-13 18:47:18 +01008121#endif /* !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) */
Gilles Peskine5e769522018-11-20 21:59:56 +01008122
Gilles Peskine449bd832023-01-11 14:50:10 +01008123void mbedtls_psa_crypto_free(void)
Gilles Peskinee59236f2018-01-27 23:32:46 +01008124{
Paul Elliott47cee8e2024-03-08 21:38:02 +00008125
Paul Elliott600472b2024-02-23 17:26:58 +00008126#if defined(MBEDTLS_THREADING_C)
8127 mbedtls_mutex_lock(&mbedtls_threading_psa_globaldata_mutex);
8128#endif /* defined(MBEDTLS_THREADING_C) */
8129
Paul Elliott47cee8e2024-03-08 21:38:02 +00008130 /* Nothing to do to free transaction. */
8131 if (global_data.initialized & PSA_CRYPTO_SUBSYSTEM_TRANSACTION_INITIALIZED) {
8132 global_data.initialized &= ~PSA_CRYPTO_SUBSYSTEM_TRANSACTION_INITIALIZED;
Valerio Setti83e0de82023-11-24 12:13:05 +01008133 }
Paul Elliott600472b2024-02-23 17:26:58 +00008134
Paul Elliott47cee8e2024-03-08 21:38:02 +00008135 if (global_data.initialized & PSA_CRYPTO_SUBSYSTEM_KEY_SLOTS_INITIALIZED) {
8136 psa_wipe_all_key_slots();
8137 global_data.initialized &= ~PSA_CRYPTO_SUBSYSTEM_KEY_SLOTS_INITIALIZED;
8138 }
Ronald Cron9ba76912021-04-10 16:57:30 +02008139
Paul Elliott600472b2024-02-23 17:26:58 +00008140#if defined(MBEDTLS_THREADING_C)
8141 mbedtls_mutex_unlock(&mbedtls_threading_psa_globaldata_mutex);
8142#endif /* defined(MBEDTLS_THREADING_C) */
8143
Paul Elliott47cee8e2024-03-08 21:38:02 +00008144#if defined(MBEDTLS_THREADING_C)
8145 mbedtls_mutex_lock(&mbedtls_threading_psa_rngdata_mutex);
8146#endif /* defined(MBEDTLS_THREADING_C) */
8147
Gilles Peskinec6b69072018-11-20 21:42:52 +01008148 if (global_data.rng_state != RNG_NOT_INITIALIZED) {
Gilles Peskine30524eb2020-11-13 17:02:26 +01008149 mbedtls_psa_random_free(&global_data.rng);
Gilles Peskinec6b69072018-11-20 21:42:52 +01008150 }
Paul Elliott47cee8e2024-03-08 21:38:02 +00008151 global_data.rng_state = RNG_NOT_INITIALIZED;
8152 mbedtls_platform_zeroize(&global_data.rng, sizeof(global_data.rng));
8153
8154#if defined(MBEDTLS_THREADING_C)
8155 mbedtls_mutex_unlock(&mbedtls_threading_psa_rngdata_mutex);
8156#endif /* defined(MBEDTLS_THREADING_C) */
8157
8158#if defined(MBEDTLS_THREADING_C)
8159 mbedtls_mutex_lock(&mbedtls_threading_psa_globaldata_mutex);
8160#endif /* defined(MBEDTLS_THREADING_C) */
Ronald Cron9ba76912021-04-10 16:57:30 +02008161
8162 /* Terminate drivers */
Paul Elliott47cee8e2024-03-08 21:38:02 +00008163 if (global_data.initialized & PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS_INITIALIZED) {
8164 psa_driver_wrapper_free();
8165 global_data.initialized &= ~PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS_INITIALIZED;
8166 }
8167
8168#if defined(MBEDTLS_THREADING_C)
8169 mbedtls_mutex_unlock(&mbedtls_threading_psa_globaldata_mutex);
8170#endif /* defined(MBEDTLS_THREADING_C) */
8171
Gilles Peskinee59236f2018-01-27 23:32:46 +01008172}
8173
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02008174#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
8175/** Recover a transaction that was interrupted by a power failure.
8176 *
8177 * This function is called during initialization, before psa_crypto_init()
8178 * returns. If this function returns a failure status, the initialization
8179 * fails.
8180 */
8181static psa_status_t psa_crypto_recover_transaction(
Gilles Peskine449bd832023-01-11 14:50:10 +01008182 const psa_crypto_transaction_t *transaction)
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02008183{
Gilles Peskine449bd832023-01-11 14:50:10 +01008184 switch (transaction->unknown.type) {
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02008185 case PSA_CRYPTO_TRANSACTION_CREATE_KEY:
8186 case PSA_CRYPTO_TRANSACTION_DESTROY_KEY:
Gilles Peskine449bd832023-01-11 14:50:10 +01008187 /* TODO - fall through to the failure case until this
8188 * is implemented.
8189 * https://github.com/ARMmbed/mbed-crypto/issues/218
8190 */
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02008191 default:
8192 /* We found an unsupported transaction in the storage.
8193 * We don't know what state the storage is in. Give up. */
Gilles Peskine449bd832023-01-11 14:50:10 +01008194 return PSA_ERROR_DATA_INVALID;
Gilles Peskinef9bb29e2019-07-25 17:52:59 +02008195 }
8196}
8197#endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
8198
Paul Elliott47cee8e2024-03-08 21:38:02 +00008199static psa_status_t mbedtls_psa_crypto_init_subsystem(mbedtls_psa_crypto_subsystem subsystem)
8200{
8201 psa_status_t status = PSA_SUCCESS;
8202 uint8_t driver_wrappers_initialized = 0;
8203
8204 switch (subsystem) {
8205 case PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS:
8206
8207#if defined(MBEDTLS_THREADING_C)
8208 PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_lock(&mbedtls_threading_psa_globaldata_mutex));
8209#endif /* defined(MBEDTLS_THREADING_C) */
8210
8211 if (!(global_data.initialized & PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS_INITIALIZED)) {
8212 /* Init drivers */
8213 status = psa_driver_wrapper_init();
8214
8215 /* Drivers need shutdown regardless of startup errors. */
8216 global_data.initialized |= PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS_INITIALIZED;
8217
8218
8219 }
8220#if defined(MBEDTLS_THREADING_C)
8221 PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_unlock(
8222 &mbedtls_threading_psa_globaldata_mutex));
8223#endif /* defined(MBEDTLS_THREADING_C) */
8224
8225 break;
8226
8227 case PSA_CRYPTO_SUBSYSTEM_KEY_SLOTS:
8228
8229#if defined(MBEDTLS_THREADING_C)
8230 PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_lock(&mbedtls_threading_psa_globaldata_mutex));
8231#endif /* defined(MBEDTLS_THREADING_C) */
8232
8233 if (!(global_data.initialized & PSA_CRYPTO_SUBSYSTEM_KEY_SLOTS_INITIALIZED)) {
8234 status = psa_initialize_key_slots();
8235
8236 /* Need to wipe keys even if initialization fails. */
8237 global_data.initialized |= PSA_CRYPTO_SUBSYSTEM_KEY_SLOTS_INITIALIZED;
8238
8239 }
8240#if defined(MBEDTLS_THREADING_C)
8241 PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_unlock(
8242 &mbedtls_threading_psa_globaldata_mutex));
8243#endif /* defined(MBEDTLS_THREADING_C) */
8244
8245 break;
8246
8247 case PSA_CRYPTO_SUBSYSTEM_RNG:
8248
8249#if defined(MBEDTLS_THREADING_C)
8250 PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_lock(&mbedtls_threading_psa_globaldata_mutex));
8251#endif /* defined(MBEDTLS_THREADING_C) */
8252
8253 driver_wrappers_initialized =
8254 (global_data.initialized & PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS_INITIALIZED);
8255
8256#if defined(MBEDTLS_THREADING_C)
8257 PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_unlock(
8258 &mbedtls_threading_psa_globaldata_mutex));
8259#endif /* defined(MBEDTLS_THREADING_C) */
8260
8261 /* Need to use separate mutex here, as initialisation can require
8262 * testing of init flags, which requires locking the global data
8263 * mutex. */
8264#if defined(MBEDTLS_THREADING_C)
8265 PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_lock(&mbedtls_threading_psa_rngdata_mutex));
8266#endif /* defined(MBEDTLS_THREADING_C) */
8267
8268 /* Initialize and seed the random generator. */
8269 if (global_data.rng_state == RNG_NOT_INITIALIZED && driver_wrappers_initialized) {
8270 mbedtls_psa_random_init(&global_data.rng);
8271 global_data.rng_state = RNG_INITIALIZED;
8272
8273 status = mbedtls_psa_random_seed(&global_data.rng);
8274 if (status == PSA_SUCCESS) {
8275 global_data.rng_state = RNG_SEEDED;
8276 }
8277 }
8278
8279#if defined(MBEDTLS_THREADING_C)
8280 PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_unlock(
8281 &mbedtls_threading_psa_rngdata_mutex));
8282#endif /* defined(MBEDTLS_THREADING_C) */
8283
Paul Elliott47cee8e2024-03-08 21:38:02 +00008284 break;
8285
8286 case PSA_CRYPTO_SUBSYSTEM_TRANSACTION:
8287
8288#if defined(MBEDTLS_THREADING_C)
8289 PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_lock(&mbedtls_threading_psa_globaldata_mutex));
8290#endif /* defined(MBEDTLS_THREADING_C) */
8291
8292 if (!(global_data.initialized & PSA_CRYPTO_SUBSYSTEM_TRANSACTION_INITIALIZED)) {
8293#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
8294 status = psa_crypto_load_transaction();
8295 if (status == PSA_SUCCESS) {
8296 status = psa_crypto_recover_transaction(&psa_crypto_transaction);
8297 if (status == PSA_SUCCESS) {
8298 global_data.initialized |= PSA_CRYPTO_SUBSYSTEM_TRANSACTION_INITIALIZED;
8299 }
8300 status = psa_crypto_stop_transaction();
8301 } else if (status == PSA_ERROR_DOES_NOT_EXIST) {
8302 /* There's no transaction to complete. It's all good. */
8303 global_data.initialized |= PSA_CRYPTO_SUBSYSTEM_TRANSACTION_INITIALIZED;
8304 status = PSA_SUCCESS;
8305 }
8306#else /* defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS) */
8307 global_data.initialized |= PSA_CRYPTO_SUBSYSTEM_TRANSACTION_INITIALIZED;
8308 status = PSA_SUCCESS;
8309#endif /* defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS) */
8310 }
8311
8312#if defined(MBEDTLS_THREADING_C)
8313 PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_unlock(
8314 &mbedtls_threading_psa_globaldata_mutex));
8315#endif /* defined(MBEDTLS_THREADING_C) */
8316
8317 break;
8318
8319 default:
8320 status = PSA_ERROR_CORRUPTION_DETECTED;
8321 }
8322
8323 /* Exit label only required when using threading macros. */
8324#if defined(MBEDTLS_THREADING_C)
8325exit:
8326#endif /* defined(MBEDTLS_THREADING_C) */
8327
8328 return status;
8329}
8330
Gilles Peskine449bd832023-01-11 14:50:10 +01008331psa_status_t psa_crypto_init(void)
Gilles Peskinee59236f2018-01-27 23:32:46 +01008332{
Gilles Peskine66fb1262018-12-10 16:29:04 +01008333 psa_status_t status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01008334
Paul Elliott47cee8e2024-03-08 21:38:02 +00008335 /* Double initialization is explicitly allowed. Early out if everything is
8336 * done. */
8337 if (psa_get_initialized()) {
Gilles Peskine449bd832023-01-11 14:50:10 +01008338 return PSA_SUCCESS;
8339 }
Gilles Peskinee59236f2018-01-27 23:32:46 +01008340
Paul Elliott47cee8e2024-03-08 21:38:02 +00008341 status = mbedtls_psa_crypto_init_subsystem(PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS);
Valerio Setti402cfba2023-11-13 10:24:32 +01008342 if (status != PSA_SUCCESS) {
8343 goto exit;
8344 }
8345
Paul Elliott47cee8e2024-03-08 21:38:02 +00008346 status = mbedtls_psa_crypto_init_subsystem(PSA_CRYPTO_SUBSYSTEM_KEY_SLOTS);
Gilles Peskine449bd832023-01-11 14:50:10 +01008347 if (status != PSA_SUCCESS) {
Gilles Peskinee59236f2018-01-27 23:32:46 +01008348 goto exit;
Gilles Peskine449bd832023-01-11 14:50:10 +01008349 }
Gilles Peskinee59236f2018-01-27 23:32:46 +01008350
Paul Elliott47cee8e2024-03-08 21:38:02 +00008351 status = mbedtls_psa_crypto_init_subsystem(PSA_CRYPTO_SUBSYSTEM_RNG);
8352 if (status != PSA_SUCCESS) {
8353 goto exit;
Gilles Peskinefc762652019-07-22 19:30:34 +02008354 }
Gilles Peskinefc762652019-07-22 19:30:34 +02008355
Paul Elliott47cee8e2024-03-08 21:38:02 +00008356 status = mbedtls_psa_crypto_init_subsystem(PSA_CRYPTO_SUBSYSTEM_TRANSACTION);
Gilles Peskinee59236f2018-01-27 23:32:46 +01008357
8358exit:
Paul Elliott600472b2024-02-23 17:26:58 +00008359
Gilles Peskine449bd832023-01-11 14:50:10 +01008360 if (status != PSA_SUCCESS) {
8361 mbedtls_psa_crypto_free();
8362 }
Paul Elliott47cee8e2024-03-08 21:38:02 +00008363
Gilles Peskine449bd832023-01-11 14:50:10 +01008364 return status;
Gilles Peskinee59236f2018-01-27 23:32:46 +01008365}
8366
Yanray Wangffc3c482023-07-11 12:01:04 +08008367#if defined(PSA_WANT_ALG_SOME_PAKE)
Przemek Stekielca8d2b22023-01-17 16:21:33 +01008368psa_status_t psa_crypto_driver_pake_get_password_len(
8369 const psa_crypto_driver_pake_inputs_t *inputs,
8370 size_t *password_len)
8371{
8372 if (inputs->password_len == 0) {
8373 return PSA_ERROR_BAD_STATE;
8374 }
8375
8376 *password_len = inputs->password_len;
8377
8378 return PSA_SUCCESS;
8379}
8380
8381psa_status_t psa_crypto_driver_pake_get_password(
8382 const psa_crypto_driver_pake_inputs_t *inputs,
8383 uint8_t *buffer, size_t buffer_size, size_t *buffer_length)
8384{
8385 if (inputs->password_len == 0) {
8386 return PSA_ERROR_BAD_STATE;
8387 }
8388
8389 if (buffer_size < inputs->password_len) {
8390 return PSA_ERROR_BUFFER_TOO_SMALL;
8391 }
8392
8393 memcpy(buffer, inputs->password, inputs->password_len);
8394 *buffer_length = inputs->password_len;
8395
8396 return PSA_SUCCESS;
8397}
8398
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01008399psa_status_t psa_crypto_driver_pake_get_user_len(
8400 const psa_crypto_driver_pake_inputs_t *inputs,
8401 size_t *user_len)
8402{
8403 if (inputs->user_len == 0) {
8404 return PSA_ERROR_BAD_STATE;
8405 }
8406
8407 *user_len = inputs->user_len;
8408
8409 return PSA_SUCCESS;
8410}
8411
8412psa_status_t psa_crypto_driver_pake_get_user(
8413 const psa_crypto_driver_pake_inputs_t *inputs,
Przemek Stekielc0e62502023-03-14 11:49:36 +01008414 uint8_t *user_id, size_t user_id_size, size_t *user_id_len)
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01008415{
8416 if (inputs->user_len == 0) {
8417 return PSA_ERROR_BAD_STATE;
8418 }
8419
Przemek Stekielc0e62502023-03-14 11:49:36 +01008420 if (user_id_size < inputs->user_len) {
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01008421 return PSA_ERROR_BUFFER_TOO_SMALL;
8422 }
8423
Przemek Stekielc0e62502023-03-14 11:49:36 +01008424 memcpy(user_id, inputs->user, inputs->user_len);
8425 *user_id_len = inputs->user_len;
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01008426
8427 return PSA_SUCCESS;
8428}
8429
8430psa_status_t psa_crypto_driver_pake_get_peer_len(
8431 const psa_crypto_driver_pake_inputs_t *inputs,
8432 size_t *peer_len)
8433{
8434 if (inputs->peer_len == 0) {
8435 return PSA_ERROR_BAD_STATE;
8436 }
8437
8438 *peer_len = inputs->peer_len;
8439
8440 return PSA_SUCCESS;
8441}
8442
8443psa_status_t psa_crypto_driver_pake_get_peer(
8444 const psa_crypto_driver_pake_inputs_t *inputs,
Przemek Stekielc0e62502023-03-14 11:49:36 +01008445 uint8_t *peer_id, size_t peer_id_size, size_t *peer_id_length)
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01008446{
8447 if (inputs->peer_len == 0) {
8448 return PSA_ERROR_BAD_STATE;
8449 }
8450
Przemek Stekielc0e62502023-03-14 11:49:36 +01008451 if (peer_id_size < inputs->peer_len) {
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01008452 return PSA_ERROR_BUFFER_TOO_SMALL;
8453 }
8454
Przemek Stekielc0e62502023-03-14 11:49:36 +01008455 memcpy(peer_id, inputs->peer, inputs->peer_len);
8456 *peer_id_length = inputs->peer_len;
Przemek Stekiel1e7a9272023-02-28 14:38:58 +01008457
8458 return PSA_SUCCESS;
8459}
8460
Przemek Stekielca8d2b22023-01-17 16:21:33 +01008461psa_status_t psa_crypto_driver_pake_get_cipher_suite(
8462 const psa_crypto_driver_pake_inputs_t *inputs,
8463 psa_pake_cipher_suite_t *cipher_suite)
8464{
8465 if (inputs->cipher_suite.algorithm == PSA_ALG_NONE) {
8466 return PSA_ERROR_BAD_STATE;
8467 }
8468
8469 *cipher_suite = inputs->cipher_suite;
8470
8471 return PSA_SUCCESS;
8472}
8473
Neil Armstronga7d08c32022-06-01 18:21:20 +02008474psa_status_t psa_pake_setup(
8475 psa_pake_operation_t *operation,
8476 const psa_pake_cipher_suite_t *cipher_suite)
8477{
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008478 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008479
Przemek Stekiel1c3cfb42023-01-26 10:35:02 +01008480 if (operation->stage != PSA_PAKE_OPERATION_STAGE_SETUP) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008481 status = PSA_ERROR_BAD_STATE;
8482 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008483 }
8484
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01008485 if (PSA_ALG_IS_PAKE(cipher_suite->algorithm) == 0 ||
Przemek Stekiel51eac532022-12-07 11:04:51 +01008486 PSA_ALG_IS_HASH(cipher_suite->hash) == 0) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008487 status = PSA_ERROR_INVALID_ARGUMENT;
8488 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008489 }
8490
Przemek Stekiel51eac532022-12-07 11:04:51 +01008491 memset(&operation->data.inputs, 0, sizeof(operation->data.inputs));
8492
Przemek Stekiele12ed362022-12-21 12:54:46 +01008493 operation->alg = cipher_suite->algorithm;
Przemek Stekiel656b2592023-03-22 13:15:33 +01008494 operation->primitive = PSA_PAKE_PRIMITIVE(cipher_suite->type,
8495 cipher_suite->family, cipher_suite->bits);
Przemek Stekiel51eac532022-12-07 11:04:51 +01008496 operation->data.inputs.cipher_suite = *cipher_suite;
8497
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008498#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008499 if (operation->alg == PSA_ALG_JPAKE) {
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01008500 psa_jpake_computation_stage_t *computation_stage =
Przemek Stekieldde6a912023-01-26 08:46:37 +01008501 &operation->computation_stage.jpake;
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01008502
David Horstmann16f01512023-06-14 17:21:07 +01008503 memset(computation_stage, 0, sizeof(*computation_stage));
David Horstmanne7f21e62023-05-12 18:17:21 +01008504 computation_stage->step = PSA_PAKE_STEP_KEY_SHARE;
Przemek Stekiel80a88492023-02-20 13:32:22 +01008505 } else
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008506#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiel80a88492023-02-20 13:32:22 +01008507 {
8508 status = PSA_ERROR_NOT_SUPPORTED;
8509 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008510 }
8511
Przemek Stekiel1c3cfb42023-01-26 10:35:02 +01008512 operation->stage = PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS;
8513
Przemek Stekiel51eac532022-12-07 11:04:51 +01008514 return PSA_SUCCESS;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008515exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008516 psa_pake_abort(operation);
8517 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02008518}
8519
8520psa_status_t psa_pake_set_password_key(
8521 psa_pake_operation_t *operation,
8522 mbedtls_svc_key_id_t password)
8523{
Neil Armstrong5ae60962022-09-15 11:29:46 +02008524 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel6c764412022-11-22 14:05:12 +01008525 psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
8526 psa_key_slot_t *slot = NULL;
Agathiyan Bragadeesh4d47cea2023-07-17 16:57:24 +01008527 psa_key_type_t type;
Neil Armstrong5ae60962022-09-15 11:29:46 +02008528
Przemek Stekiel51eac532022-12-07 11:04:51 +01008529 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008530 status = PSA_ERROR_BAD_STATE;
8531 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008532 }
8533
Przemek Stekiel6c764412022-11-22 14:05:12 +01008534 status = psa_get_and_lock_key_slot_with_policy(password, &slot,
8535 PSA_KEY_USAGE_DERIVE,
Przemek Stekield5d28a22023-01-26 10:46:05 +01008536 operation->alg);
Neil Armstrong5ae60962022-09-15 11:29:46 +02008537 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008538 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02008539 }
8540
Gilles Peskine7a5d9202024-02-28 01:18:23 +01008541 type = psa_get_key_type(&slot->attr);
Neil Armstrong5ae60962022-09-15 11:29:46 +02008542
Przemek Stekiel51eac532022-12-07 11:04:51 +01008543 if (type != PSA_KEY_TYPE_PASSWORD &&
8544 type != PSA_KEY_TYPE_PASSWORD_HASH) {
8545 status = PSA_ERROR_INVALID_ARGUMENT;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008546 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008547 }
8548
Przemek Stekiel51eac532022-12-07 11:04:51 +01008549 operation->data.inputs.password = mbedtls_calloc(1, slot->key.bytes);
8550 if (operation->data.inputs.password == NULL) {
Przemek Stekiele12ed362022-12-21 12:54:46 +01008551 status = PSA_ERROR_INSUFFICIENT_MEMORY;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008552 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008553 }
8554
8555 memcpy(operation->data.inputs.password, slot->key.data, slot->key.bytes);
8556 operation->data.inputs.password_len = slot->key.bytes;
Gilles Peskine7fad3ef2024-02-28 01:08:27 +01008557 operation->data.inputs.attributes = slot->attr;
8558
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008559exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008560 if (status != PSA_SUCCESS) {
8561 psa_pake_abort(operation);
8562 }
Ryan Everettbbedfce2024-02-14 18:22:09 +00008563 unlock_status = psa_unregister_read_under_mutex(slot);
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008564 return (status == PSA_SUCCESS) ? unlock_status : status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02008565}
8566
8567psa_status_t psa_pake_set_user(
8568 psa_pake_operation_t *operation,
David Horstmann4f534ae2024-01-22 17:35:59 +00008569 const uint8_t *user_id_external,
Neil Armstronga7d08c32022-06-01 18:21:20 +02008570 size_t user_id_len)
8571{
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008572 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
David Horstmann4f534ae2024-01-22 17:35:59 +00008573 LOCAL_INPUT_DECLARE(user_id_external, user_id);
Przemek Stekiel51eac532022-12-07 11:04:51 +01008574
8575 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008576 status = PSA_ERROR_BAD_STATE;
8577 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02008578 }
8579
Przemek Stekiel51eac532022-12-07 11:04:51 +01008580 if (user_id_len == 0) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008581 status = PSA_ERROR_INVALID_ARGUMENT;
8582 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02008583 }
8584
Przemek Stekielf309d6b2023-03-10 09:54:45 +01008585 if (operation->data.inputs.user_len != 0) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01008586 status = PSA_ERROR_BAD_STATE;
8587 goto exit;
8588 }
8589
Przemek Stekielf309d6b2023-03-10 09:54:45 +01008590 operation->data.inputs.user = mbedtls_calloc(1, user_id_len);
8591 if (operation->data.inputs.user == NULL) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01008592 status = PSA_ERROR_INSUFFICIENT_MEMORY;
8593 goto exit;
8594 }
8595
David Horstmann4f534ae2024-01-22 17:35:59 +00008596 LOCAL_INPUT_ALLOC(user_id_external, user_id_len, user_id);
8597
Przemek Stekielf309d6b2023-03-10 09:54:45 +01008598 memcpy(operation->data.inputs.user, user_id, user_id_len);
8599 operation->data.inputs.user_len = user_id_len;
Przemek Stekiel26c909d2023-02-28 12:34:03 +01008600
David Horstmann4f534ae2024-01-22 17:35:59 +00008601 status = PSA_SUCCESS;
8602
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008603exit:
David Horstmann4f534ae2024-01-22 17:35:59 +00008604 LOCAL_INPUT_FREE(user_id_external, user_id);
8605 if (status != PSA_SUCCESS) {
8606 psa_pake_abort(operation);
8607 }
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008608 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02008609}
8610
8611psa_status_t psa_pake_set_peer(
8612 psa_pake_operation_t *operation,
David Horstmann4f534ae2024-01-22 17:35:59 +00008613 const uint8_t *peer_id_external,
Neil Armstronga7d08c32022-06-01 18:21:20 +02008614 size_t peer_id_len)
8615{
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008616 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
David Horstmann4f534ae2024-01-22 17:35:59 +00008617 LOCAL_INPUT_DECLARE(peer_id_external, peer_id);
Przemek Stekiel51eac532022-12-07 11:04:51 +01008618
8619 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008620 status = PSA_ERROR_BAD_STATE;
8621 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02008622 }
8623
Przemek Stekiel51eac532022-12-07 11:04:51 +01008624 if (peer_id_len == 0) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008625 status = PSA_ERROR_INVALID_ARGUMENT;
8626 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02008627 }
8628
Przemek Stekielf309d6b2023-03-10 09:54:45 +01008629 if (operation->data.inputs.peer_len != 0) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01008630 status = PSA_ERROR_BAD_STATE;
8631 goto exit;
8632 }
8633
Przemek Stekielf309d6b2023-03-10 09:54:45 +01008634 operation->data.inputs.peer = mbedtls_calloc(1, peer_id_len);
8635 if (operation->data.inputs.peer == NULL) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01008636 status = PSA_ERROR_INSUFFICIENT_MEMORY;
8637 goto exit;
8638 }
8639
David Horstmann4f534ae2024-01-22 17:35:59 +00008640 LOCAL_INPUT_ALLOC(peer_id_external, peer_id_len, peer_id);
8641
Przemek Stekielf309d6b2023-03-10 09:54:45 +01008642 memcpy(operation->data.inputs.peer, peer_id, peer_id_len);
8643 operation->data.inputs.peer_len = peer_id_len;
Przemek Stekiel26c909d2023-02-28 12:34:03 +01008644
David Horstmann4f534ae2024-01-22 17:35:59 +00008645 status = PSA_SUCCESS;
8646
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008647exit:
David Horstmann4f534ae2024-01-22 17:35:59 +00008648 LOCAL_INPUT_FREE(peer_id_external, peer_id);
8649 if (status != PSA_SUCCESS) {
8650 psa_pake_abort(operation);
8651 }
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008652 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02008653}
8654
8655psa_status_t psa_pake_set_role(
8656 psa_pake_operation_t *operation,
8657 psa_pake_role_t role)
8658{
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008659 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008660
Przemek Stekiel51eac532022-12-07 11:04:51 +01008661 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel26c909d2023-02-28 12:34:03 +01008662 status = PSA_ERROR_BAD_STATE;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008663 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008664 }
8665
Przemek Stekiel09104b82023-03-06 14:11:51 +01008666 switch (operation->alg) {
8667#if defined(PSA_WANT_ALG_JPAKE)
8668 case PSA_ALG_JPAKE:
8669 if (role == PSA_PAKE_ROLE_NONE) {
8670 return PSA_SUCCESS;
8671 }
8672 status = PSA_ERROR_INVALID_ARGUMENT;
8673 break;
8674#endif
8675 default:
8676 (void) role;
8677 status = PSA_ERROR_NOT_SUPPORTED;
8678 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02008679 }
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008680exit:
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008681 psa_pake_abort(operation);
8682 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02008683}
8684
David Horstmanne7f21e62023-05-12 18:17:21 +01008685/* Auxiliary function to convert core computation stage to single driver step. */
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008686#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiel251e86a2023-02-17 14:30:50 +01008687static psa_crypto_driver_pake_step_t convert_jpake_computation_stage_to_driver_step(
Przemek Stekieldde6a912023-01-26 08:46:37 +01008688 psa_jpake_computation_stage_t *stage)
Przemek Stekielb09c4872023-01-17 12:05:38 +01008689{
David Horstmann74a3d8c2023-06-14 18:28:19 +01008690 psa_crypto_driver_pake_step_t key_share_step;
David Horstmann5da95602023-06-08 15:37:12 +01008691 if (stage->round == PSA_JPAKE_FIRST) {
David Horstmanne7f21e62023-05-12 18:17:21 +01008692 int is_x1;
David Horstmann74a3d8c2023-06-14 18:28:19 +01008693
David Horstmann024e5c52023-06-14 15:48:21 +01008694 if (stage->io_mode == PSA_JPAKE_OUTPUT) {
David Horstmanne7f21e62023-05-12 18:17:21 +01008695 is_x1 = (stage->outputs < 1);
8696 } else {
8697 is_x1 = (stage->inputs < 1);
8698 }
8699
David Horstmann74a3d8c2023-06-14 18:28:19 +01008700 key_share_step = is_x1 ?
8701 PSA_JPAKE_X1_STEP_KEY_SHARE :
8702 PSA_JPAKE_X2_STEP_KEY_SHARE;
David Horstmann5da95602023-06-08 15:37:12 +01008703 } else if (stage->round == PSA_JPAKE_SECOND) {
David Horstmann74a3d8c2023-06-14 18:28:19 +01008704 key_share_step = (stage->io_mode == PSA_JPAKE_OUTPUT) ?
8705 PSA_JPAKE_X2S_STEP_KEY_SHARE :
8706 PSA_JPAKE_X4S_STEP_KEY_SHARE;
8707 } else {
8708 return PSA_JPAKE_STEP_INVALID;
Przemek Stekielb09c4872023-01-17 12:05:38 +01008709 }
Agathiyan Bragadeesh387bfa52023-07-17 17:01:33 +01008710 return (psa_crypto_driver_pake_step_t) (key_share_step + stage->step - PSA_PAKE_STEP_KEY_SHARE);
Przemek Stekielb09c4872023-01-17 12:05:38 +01008711}
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008712#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekielb09c4872023-01-17 12:05:38 +01008713
Przemek Stekiel2797d372022-12-22 11:19:22 +01008714static psa_status_t psa_pake_complete_inputs(
8715 psa_pake_operation_t *operation)
8716{
Przemek Stekiel2797d372022-12-22 11:19:22 +01008717 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel18620a32023-01-17 16:34:52 +01008718 /* Create copy of the inputs on stack as inputs share memory
8719 with the driver context which will be setup by the driver. */
8720 psa_crypto_driver_pake_inputs_t inputs = operation->data.inputs;
Przemek Stekiel2797d372022-12-22 11:19:22 +01008721
Przemek Stekielfde11282023-03-13 16:06:09 +01008722 if (inputs.password_len == 0) {
Przemek Stekiel2797d372022-12-22 11:19:22 +01008723 return PSA_ERROR_BAD_STATE;
8724 }
8725
Przemek Stekiel26c909d2023-02-28 12:34:03 +01008726 if (operation->alg == PSA_ALG_JPAKE) {
Przemek Stekielfde11282023-03-13 16:06:09 +01008727 if (inputs.user_len == 0 || inputs.peer_len == 0) {
8728 return PSA_ERROR_BAD_STATE;
8729 }
Przemek Stekieldff21d32023-02-14 20:09:10 +01008730 }
8731
Przemek Stekiel18620a32023-01-17 16:34:52 +01008732 /* Clear driver context */
8733 mbedtls_platform_zeroize(&operation->data, sizeof(operation->data));
8734
8735 status = psa_driver_wrapper_pake_setup(operation, &inputs);
Przemek Stekiel2797d372022-12-22 11:19:22 +01008736
8737 /* Driver is responsible for creating its own copy of the password. */
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01008738 mbedtls_zeroize_and_free(inputs.password, inputs.password_len);
Przemek Stekiel2797d372022-12-22 11:19:22 +01008739
Przemek Stekiel26c909d2023-02-28 12:34:03 +01008740 /* User and peer are translated to role. */
8741 mbedtls_free(inputs.user);
8742 mbedtls_free(inputs.peer);
8743
Przemek Stekiel2797d372022-12-22 11:19:22 +01008744 if (status == PSA_SUCCESS) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008745#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiel2797d372022-12-22 11:19:22 +01008746 if (operation->alg == PSA_ALG_JPAKE) {
Przemek Stekield93de322023-02-24 08:39:04 +01008747 operation->stage = PSA_PAKE_OPERATION_STAGE_COMPUTATION;
Przemek Stekiel80a88492023-02-20 13:32:22 +01008748 } else
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008749#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiel80a88492023-02-20 13:32:22 +01008750 {
8751 status = PSA_ERROR_NOT_SUPPORTED;
Przemek Stekiel2797d372022-12-22 11:19:22 +01008752 }
Przemek Stekiel2797d372022-12-22 11:19:22 +01008753 }
Przemek Stekiel2797d372022-12-22 11:19:22 +01008754 return status;
8755}
8756
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008757#if defined(PSA_WANT_ALG_JPAKE)
David Horstmanne7f21e62023-05-12 18:17:21 +01008758static psa_status_t psa_jpake_prologue(
Przemek Stekiele12ed362022-12-21 12:54:46 +01008759 psa_pake_operation_t *operation,
David Horstmanne7f21e62023-05-12 18:17:21 +01008760 psa_pake_step_t step,
David Horstmann00ad6bf2023-06-14 15:44:24 +01008761 psa_jpake_io_mode_t io_mode)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008762{
Przemek Stekiele12ed362022-12-21 12:54:46 +01008763 if (step != PSA_PAKE_STEP_KEY_SHARE &&
8764 step != PSA_PAKE_STEP_ZK_PUBLIC &&
8765 step != PSA_PAKE_STEP_ZK_PROOF) {
8766 return PSA_ERROR_INVALID_ARGUMENT;
8767 }
8768
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008769 psa_jpake_computation_stage_t *computation_stage =
8770 &operation->computation_stage.jpake;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008771
David Horstmann5da95602023-06-08 15:37:12 +01008772 if (computation_stage->round != PSA_JPAKE_FIRST &&
8773 computation_stage->round != PSA_JPAKE_SECOND) {
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008774 return PSA_ERROR_BAD_STATE;
8775 }
8776
David Horstmanne7f21e62023-05-12 18:17:21 +01008777 /* Check that the step we are given is the one we were expecting */
8778 if (step != computation_stage->step) {
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008779 return PSA_ERROR_BAD_STATE;
8780 }
8781
David Horstmanne7f21e62023-05-12 18:17:21 +01008782 if (step == PSA_PAKE_STEP_KEY_SHARE &&
8783 computation_stage->inputs == 0 &&
8784 computation_stage->outputs == 0) {
8785 /* Start of the round, so function decides whether we are inputting
8786 * or outputting */
David Horstmann024e5c52023-06-14 15:48:21 +01008787 computation_stage->io_mode = io_mode;
8788 } else if (computation_stage->io_mode != io_mode) {
David Horstmanne7f21e62023-05-12 18:17:21 +01008789 /* Middle of the round so the mode we are in must match the function
8790 * called by the user */
8791 return PSA_ERROR_BAD_STATE;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008792 }
8793
8794 return PSA_SUCCESS;
8795}
8796
David Horstmanne7f21e62023-05-12 18:17:21 +01008797static psa_status_t psa_jpake_epilogue(
8798 psa_pake_operation_t *operation,
David Horstmann00ad6bf2023-06-14 15:44:24 +01008799 psa_jpake_io_mode_t io_mode)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008800{
David Horstmanne7f21e62023-05-12 18:17:21 +01008801 psa_jpake_computation_stage_t *stage =
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008802 &operation->computation_stage.jpake;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008803
David Horstmanne7f21e62023-05-12 18:17:21 +01008804 if (stage->step == PSA_PAKE_STEP_ZK_PROOF) {
8805 /* End of an input/output */
David Horstmann00ad6bf2023-06-14 15:44:24 +01008806 if (io_mode == PSA_JPAKE_INPUT) {
David Horstmanne7f21e62023-05-12 18:17:21 +01008807 stage->inputs++;
David Horstmann246ec5a2023-06-27 10:33:06 +01008808 if (stage->inputs == PSA_JPAKE_EXPECTED_INPUTS(stage->round)) {
David Horstmann024e5c52023-06-14 15:48:21 +01008809 stage->io_mode = PSA_JPAKE_OUTPUT;
David Horstmanne7f21e62023-05-12 18:17:21 +01008810 }
8811 }
David Horstmann00ad6bf2023-06-14 15:44:24 +01008812 if (io_mode == PSA_JPAKE_OUTPUT) {
David Horstmanne7f21e62023-05-12 18:17:21 +01008813 stage->outputs++;
David Horstmann246ec5a2023-06-27 10:33:06 +01008814 if (stage->outputs == PSA_JPAKE_EXPECTED_OUTPUTS(stage->round)) {
David Horstmann024e5c52023-06-14 15:48:21 +01008815 stage->io_mode = PSA_JPAKE_INPUT;
David Horstmanne7f21e62023-05-12 18:17:21 +01008816 }
8817 }
David Horstmann246ec5a2023-06-27 10:33:06 +01008818 if (stage->inputs == PSA_JPAKE_EXPECTED_INPUTS(stage->round) &&
8819 stage->outputs == PSA_JPAKE_EXPECTED_OUTPUTS(stage->round)) {
David Horstmanne7f21e62023-05-12 18:17:21 +01008820 /* End of a round, move to the next round */
8821 stage->inputs = 0;
8822 stage->outputs = 0;
8823 stage->round++;
8824 }
8825 stage->step = PSA_PAKE_STEP_KEY_SHARE;
Przemek Stekiel5eff1032023-02-21 19:10:36 +01008826 } else {
David Horstmanne7f21e62023-05-12 18:17:21 +01008827 stage->step++;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008828 }
Przemek Stekiele12ed362022-12-21 12:54:46 +01008829 return PSA_SUCCESS;
8830}
David Horstmanne7f21e62023-05-12 18:17:21 +01008831
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008832#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008833
Neil Armstronga7d08c32022-06-01 18:21:20 +02008834psa_status_t psa_pake_output(
8835 psa_pake_operation_t *operation,
8836 psa_pake_step_t step,
David Horstmannc75639d2024-01-22 17:56:39 +00008837 uint8_t *output_external,
Neil Armstronga7d08c32022-06-01 18:21:20 +02008838 size_t output_size,
8839 size_t *output_length)
8840{
Przemek Stekiel51eac532022-12-07 11:04:51 +01008841 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008842 psa_crypto_driver_pake_step_t driver_step = PSA_JPAKE_STEP_INVALID;
David Horstmannc75639d2024-01-22 17:56:39 +00008843 LOCAL_OUTPUT_DECLARE(output_external, output);
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01008844 *output_length = 0;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008845
8846 if (operation->stage == PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel2797d372022-12-22 11:19:22 +01008847 status = psa_pake_complete_inputs(operation);
8848 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008849 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008850 }
8851 }
8852
8853 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COMPUTATION) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008854 status = PSA_ERROR_BAD_STATE;
8855 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008856 }
8857
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01008858 if (output_size == 0) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008859 status = PSA_ERROR_INVALID_ARGUMENT;
8860 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02008861 }
8862
Przemek Stekiele12ed362022-12-21 12:54:46 +01008863 switch (operation->alg) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008864#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008865 case PSA_ALG_JPAKE:
David Horstmann5da95602023-06-08 15:37:12 +01008866 status = psa_jpake_prologue(operation, step, PSA_JPAKE_OUTPUT);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008867 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008868 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008869 }
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008870 driver_step = convert_jpake_computation_stage_to_driver_step(
8871 &operation->computation_stage.jpake);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008872 break;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008873#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008874 default:
Przemek Stekiel80a88492023-02-20 13:32:22 +01008875 (void) step;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008876 status = PSA_ERROR_NOT_SUPPORTED;
8877 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008878 }
8879
David Horstmannc75639d2024-01-22 17:56:39 +00008880 LOCAL_OUTPUT_ALLOC(output_external, output_size, output);
8881
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008882 status = psa_driver_wrapper_pake_output(operation, driver_step,
8883 output, output_size, output_length);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008884
8885 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008886 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008887 }
8888
8889 switch (operation->alg) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008890#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008891 case PSA_ALG_JPAKE:
David Horstmann5da95602023-06-08 15:37:12 +01008892 status = psa_jpake_epilogue(operation, PSA_JPAKE_OUTPUT);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008893 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008894 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008895 }
8896 break;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008897#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008898 default:
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008899 status = PSA_ERROR_NOT_SUPPORTED;
8900 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008901 }
8902
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008903exit:
David Horstmannc75639d2024-01-22 17:56:39 +00008904 LOCAL_OUTPUT_FREE(output_external, output);
8905 if (status != PSA_SUCCESS) {
8906 psa_pake_abort(operation);
8907 }
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008908 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02008909}
8910
8911psa_status_t psa_pake_input(
8912 psa_pake_operation_t *operation,
8913 psa_pake_step_t step,
David Horstmannc75639d2024-01-22 17:56:39 +00008914 const uint8_t *input_external,
Neil Armstronga7d08c32022-06-01 18:21:20 +02008915 size_t input_length)
8916{
Przemek Stekiel51eac532022-12-07 11:04:51 +01008917 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008918 psa_crypto_driver_pake_step_t driver_step = PSA_JPAKE_STEP_INVALID;
Przemek Stekiel256c75d2023-03-23 14:09:34 +01008919 const size_t max_input_length = (size_t) PSA_PAKE_INPUT_SIZE(operation->alg,
8920 operation->primitive,
8921 step);
David Horstmannc75639d2024-01-22 17:56:39 +00008922 LOCAL_INPUT_DECLARE(input_external, input);
Przemek Stekiel51eac532022-12-07 11:04:51 +01008923
8924 if (operation->stage == PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
Przemek Stekiel2797d372022-12-22 11:19:22 +01008925 status = psa_pake_complete_inputs(operation);
8926 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008927 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008928 }
8929 }
8930
8931 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COMPUTATION) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008932 status = PSA_ERROR_BAD_STATE;
8933 goto exit;
Przemek Stekiel51eac532022-12-07 11:04:51 +01008934 }
8935
Przemek Stekiel256c75d2023-03-23 14:09:34 +01008936 if (input_length == 0 || input_length > max_input_length) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008937 status = PSA_ERROR_INVALID_ARGUMENT;
8938 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02008939 }
8940
Przemek Stekiele12ed362022-12-21 12:54:46 +01008941 switch (operation->alg) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008942#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008943 case PSA_ALG_JPAKE:
David Horstmann5da95602023-06-08 15:37:12 +01008944 status = psa_jpake_prologue(operation, step, PSA_JPAKE_INPUT);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008945 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008946 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008947 }
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008948 driver_step = convert_jpake_computation_stage_to_driver_step(
8949 &operation->computation_stage.jpake);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008950 break;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008951#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008952 default:
Przemek Stekiel80a88492023-02-20 13:32:22 +01008953 (void) step;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008954 status = PSA_ERROR_NOT_SUPPORTED;
8955 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008956 }
8957
David Horstmannc75639d2024-01-22 17:56:39 +00008958 LOCAL_INPUT_ALLOC(input_external, input_length, input);
Przemek Stekiel691e91a2023-03-07 16:26:37 +01008959 status = psa_driver_wrapper_pake_input(operation, driver_step,
8960 input, input_length);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008961
8962 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008963 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008964 }
8965
8966 switch (operation->alg) {
Przemek Stekiel4aa99402023-02-27 13:00:57 +01008967#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01008968 case PSA_ALG_JPAKE:
David Horstmann5da95602023-06-08 15:37:12 +01008969 status = psa_jpake_epilogue(operation, PSA_JPAKE_INPUT);
Przemek Stekiele12ed362022-12-21 12:54:46 +01008970 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008971 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008972 }
8973 break;
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008974#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiele12ed362022-12-21 12:54:46 +01008975 default:
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008976 status = PSA_ERROR_NOT_SUPPORTED;
8977 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01008978 }
8979
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008980exit:
David Horstmannc75639d2024-01-22 17:56:39 +00008981 LOCAL_INPUT_FREE(input_external, input);
8982 if (status != PSA_SUCCESS) {
8983 psa_pake_abort(operation);
8984 }
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01008985 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02008986}
8987
8988psa_status_t psa_pake_get_implicit_key(
8989 psa_pake_operation_t *operation,
8990 psa_key_derivation_operation_t *output)
8991{
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01008992 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008993 psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED;
Przemek Stekiel251e86a2023-02-17 14:30:50 +01008994 uint8_t shared_key[MBEDTLS_PSA_JPAKE_BUFFER_SIZE];
Przemek Stekiel0c781802022-11-29 14:53:13 +01008995 size_t shared_key_len = 0;
8996
Przemek Stekielf62b3bb2023-01-31 19:51:24 +01008997 if (operation->stage != PSA_PAKE_OPERATION_STAGE_COMPUTATION) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01008998 status = PSA_ERROR_BAD_STATE;
8999 goto exit;
Neil Armstrong5ae60962022-09-15 11:29:46 +02009000 }
9001
Przemek Stekiel4aa99402023-02-27 13:00:57 +01009002#if defined(PSA_WANT_ALG_JPAKE)
Przemek Stekiele12ed362022-12-21 12:54:46 +01009003 if (operation->alg == PSA_ALG_JPAKE) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01009004 psa_jpake_computation_stage_t *computation_stage =
Przemek Stekiel083745e2023-02-23 17:28:23 +01009005 &operation->computation_stage.jpake;
David Horstmann5da95602023-06-08 15:37:12 +01009006 if (computation_stage->round != PSA_JPAKE_FINISHED) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01009007 status = PSA_ERROR_BAD_STATE;
9008 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01009009 }
Przemek Stekiel80a88492023-02-20 13:32:22 +01009010 } else
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01009011#endif /* PSA_WANT_ALG_JPAKE */
Przemek Stekiel80a88492023-02-20 13:32:22 +01009012 {
9013 status = PSA_ERROR_NOT_SUPPORTED;
9014 goto exit;
Przemek Stekiele12ed362022-12-21 12:54:46 +01009015 }
9016
Przemek Stekiel0c781802022-11-29 14:53:13 +01009017 status = psa_driver_wrapper_pake_get_implicit_key(operation,
9018 shared_key,
Przemek Stekiel6b648622023-02-19 22:55:33 +01009019 sizeof(shared_key),
Przemek Stekiel0c781802022-11-29 14:53:13 +01009020 &shared_key_len);
9021
9022 if (status != PSA_SUCCESS) {
Przemek Stekiel3e784d82023-02-08 09:12:42 +01009023 goto exit;
Przemek Stekiel0c781802022-11-29 14:53:13 +01009024 }
9025
9026 status = psa_key_derivation_input_bytes(output,
9027 PSA_KEY_DERIVATION_INPUT_SECRET,
9028 shared_key,
9029 shared_key_len);
9030
Przemek Stekiele3ef3a12023-02-27 10:20:06 +01009031 mbedtls_platform_zeroize(shared_key, sizeof(shared_key));
Przemek Stekiel3e784d82023-02-08 09:12:42 +01009032exit:
9033 abort_status = psa_pake_abort(operation);
9034 return status == PSA_SUCCESS ? abort_status : status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02009035}
9036
9037psa_status_t psa_pake_abort(
9038 psa_pake_operation_t *operation)
9039{
Przemek Stekield69dca92023-01-31 19:59:20 +01009040 psa_status_t status = PSA_SUCCESS;
Przemek Stekiele12ed362022-12-21 12:54:46 +01009041
Przemek Stekield69dca92023-01-31 19:59:20 +01009042 if (operation->stage == PSA_PAKE_OPERATION_STAGE_COMPUTATION) {
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01009043 status = psa_driver_wrapper_pake_abort(operation);
Neil Armstrong5ae60962022-09-15 11:29:46 +02009044 }
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01009045
Przemek Stekiel26c909d2023-02-28 12:34:03 +01009046 if (operation->stage == PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) {
9047 if (operation->data.inputs.password != NULL) {
Tom Cosgroveca8c61b2023-07-17 15:17:40 +01009048 mbedtls_zeroize_and_free(operation->data.inputs.password,
Przemek Stekielaa183422023-03-06 14:21:44 +01009049 operation->data.inputs.password_len);
Przemek Stekiel26c909d2023-02-28 12:34:03 +01009050 }
9051 if (operation->data.inputs.user != NULL) {
9052 mbedtls_free(operation->data.inputs.user);
9053 }
9054 if (operation->data.inputs.peer != NULL) {
9055 mbedtls_free(operation->data.inputs.peer);
9056 }
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01009057 }
Przemek Stekield69dca92023-01-31 19:59:20 +01009058 memset(operation, 0, sizeof(psa_pake_operation_t));
Przemek Stekiel9a5b8122022-12-22 13:34:47 +01009059
Przemek Stekield69dca92023-01-31 19:59:20 +01009060 return status;
Neil Armstronga7d08c32022-06-01 18:21:20 +02009061}
Tom Cosgrove6d62fac2023-05-10 14:40:05 +01009062#endif /* PSA_WANT_ALG_SOME_PAKE */
Neil Armstronga7d08c32022-06-01 18:21:20 +02009063
David Horstmann00d7a042023-12-07 18:39:17 +00009064/* Memory copying test hooks. These are called before input copy, after input
9065 * copy, before output copy and after output copy, respectively.
9066 * They are used by memory-poisoning tests to temporarily unpoison buffers
9067 * while they are copied. */
David Horstmanne138dce2023-11-28 15:21:56 +00009068#if defined(MBEDTLS_TEST_HOOKS)
9069void (*psa_input_pre_copy_hook)(const uint8_t *input, size_t input_len) = NULL;
9070void (*psa_input_post_copy_hook)(const uint8_t *input, size_t input_len) = NULL;
9071void (*psa_output_pre_copy_hook)(const uint8_t *output, size_t output_len) = NULL;
9072void (*psa_output_post_copy_hook)(const uint8_t *output, size_t output_len) = NULL;
9073#endif
David Horstmannfde97392023-10-30 20:29:43 +00009074
David Horstmann1b7279a2023-11-15 15:18:30 +00009075/** Copy from an input buffer to a local copy.
9076 *
9077 * \param[in] input Pointer to input buffer.
9078 * \param[in] input_len Length of the input buffer.
9079 * \param[out] input_copy Pointer to a local copy in which to store the input data.
9080 * \param[out] input_copy_len Length of the local copy buffer.
9081 * \return #PSA_SUCCESS, if the buffer was successfully
9082 * copied.
9083 * \return #PSA_ERROR_CORRUPTION_DETECTED, if the local
9084 * copy is too small to hold contents of the
9085 * input buffer.
9086 */
9087MBEDTLS_STATIC_TESTABLE
David Horstmannfde97392023-10-30 20:29:43 +00009088psa_status_t psa_crypto_copy_input(const uint8_t *input, size_t input_len,
9089 uint8_t *input_copy, size_t input_copy_len)
9090{
9091 if (input_len > input_copy_len) {
David Horstmann49a72762023-11-03 19:51:40 +00009092 return PSA_ERROR_CORRUPTION_DETECTED;
David Horstmannfde97392023-10-30 20:29:43 +00009093 }
9094
David Horstmann372b8bb2023-11-24 16:21:04 +00009095#if defined(MBEDTLS_TEST_HOOKS)
David Horstmanne138dce2023-11-28 15:21:56 +00009096 if (psa_input_pre_copy_hook != NULL) {
9097 psa_input_pre_copy_hook(input, input_len);
9098 }
David Horstmann372b8bb2023-11-24 16:21:04 +00009099#endif
9100
David Horstmann777e7412023-11-15 17:33:47 +00009101 if (input_len > 0) {
9102 memcpy(input_copy, input, input_len);
9103 }
David Horstmannfde97392023-10-30 20:29:43 +00009104
David Horstmann372b8bb2023-11-24 16:21:04 +00009105#if defined(MBEDTLS_TEST_HOOKS)
David Horstmanne138dce2023-11-28 15:21:56 +00009106 if (psa_input_post_copy_hook != NULL) {
9107 psa_input_post_copy_hook(input, input_len);
9108 }
David Horstmann372b8bb2023-11-24 16:21:04 +00009109#endif
9110
David Horstmannfde97392023-10-30 20:29:43 +00009111 return PSA_SUCCESS;
9112}
9113
David Horstmann1b7279a2023-11-15 15:18:30 +00009114/** Copy from a local output buffer into a user-supplied one.
9115 *
9116 * \param[in] output_copy Pointer to a local buffer containing the output.
9117 * \param[in] output_copy_len Length of the local buffer.
9118 * \param[out] output Pointer to user-supplied output buffer.
9119 * \param[out] output_len Length of the user-supplied output buffer.
9120 * \return #PSA_SUCCESS, if the buffer was successfully
9121 * copied.
David Horstmann671f5f52023-11-20 12:39:38 +00009122 * \return #PSA_ERROR_BUFFER_TOO_SMALL, if the
David Horstmann1b7279a2023-11-15 15:18:30 +00009123 * user-supplied output buffer is too small to
9124 * hold the contents of the local buffer.
9125 */
9126MBEDTLS_STATIC_TESTABLE
David Horstmann8978f5c2023-10-30 20:37:12 +00009127psa_status_t psa_crypto_copy_output(const uint8_t *output_copy, size_t output_copy_len,
9128 uint8_t *output, size_t output_len)
9129{
9130 if (output_len < output_copy_len) {
David Horstmann671f5f52023-11-20 12:39:38 +00009131 return PSA_ERROR_BUFFER_TOO_SMALL;
David Horstmann8978f5c2023-10-30 20:37:12 +00009132 }
David Horstmann777e7412023-11-15 17:33:47 +00009133
David Horstmann372b8bb2023-11-24 16:21:04 +00009134#if defined(MBEDTLS_TEST_HOOKS)
David Horstmanne138dce2023-11-28 15:21:56 +00009135 if (psa_output_pre_copy_hook != NULL) {
9136 psa_output_pre_copy_hook(output, output_len);
9137 }
David Horstmann372b8bb2023-11-24 16:21:04 +00009138#endif
9139
David Horstmann777e7412023-11-15 17:33:47 +00009140 if (output_copy_len > 0) {
9141 memcpy(output, output_copy, output_copy_len);
9142 }
9143
David Horstmann372b8bb2023-11-24 16:21:04 +00009144#if defined(MBEDTLS_TEST_HOOKS)
David Horstmanne138dce2023-11-28 15:21:56 +00009145 if (psa_output_post_copy_hook != NULL) {
9146 psa_output_post_copy_hook(output, output_len);
9147 }
David Horstmann372b8bb2023-11-24 16:21:04 +00009148#endif
9149
David Horstmann8978f5c2023-10-30 20:37:12 +00009150 return PSA_SUCCESS;
9151}
9152
David Horstmannf1734052023-11-20 17:15:32 +00009153psa_status_t psa_crypto_local_input_alloc(const uint8_t *input, size_t input_len,
9154 psa_crypto_local_input_t *local_input)
David Horstmann4ac78852023-11-07 16:36:48 +00009155{
9156 psa_status_t status;
9157
David Horstmann9db14482023-11-23 15:50:37 +00009158 *local_input = PSA_CRYPTO_LOCAL_INPUT_INIT;
David Horstmann4ac78852023-11-07 16:36:48 +00009159
David Horstmannc5cc1c32023-11-15 18:11:26 +00009160 if (input_len == 0) {
David Horstmann4ac78852023-11-07 16:36:48 +00009161 return PSA_SUCCESS;
9162 }
9163
David Horstmannf1734052023-11-20 17:15:32 +00009164 local_input->buffer = mbedtls_calloc(input_len, 1);
9165 if (local_input->buffer == NULL) {
David Horstmann4ac78852023-11-07 16:36:48 +00009166 /* Since we dealt with the zero-length case above, we know that
9167 * a NULL return value means a failure of allocation. */
9168 return PSA_ERROR_INSUFFICIENT_MEMORY;
9169 }
David Horstmannf1734052023-11-20 17:15:32 +00009170 /* From now on, we must free local_input->buffer on error. */
David Horstmann4ac78852023-11-07 16:36:48 +00009171
David Horstmannf1734052023-11-20 17:15:32 +00009172 local_input->length = input_len;
David Horstmann4ac78852023-11-07 16:36:48 +00009173
9174 status = psa_crypto_copy_input(input, input_len,
David Horstmannf1734052023-11-20 17:15:32 +00009175 local_input->buffer, local_input->length);
David Horstmann4ac78852023-11-07 16:36:48 +00009176 if (status != PSA_SUCCESS) {
9177 goto error;
9178 }
9179
9180 return PSA_SUCCESS;
9181
9182error:
David Horstmannf1734052023-11-20 17:15:32 +00009183 mbedtls_free(local_input->buffer);
9184 local_input->buffer = NULL;
9185 local_input->length = 0;
David Horstmann4ac78852023-11-07 16:36:48 +00009186 return status;
9187}
9188
David Horstmannf1734052023-11-20 17:15:32 +00009189void psa_crypto_local_input_free(psa_crypto_local_input_t *local_input)
David Horstmanne6042ff2023-11-07 18:00:41 +00009190{
David Horstmannf1734052023-11-20 17:15:32 +00009191 mbedtls_free(local_input->buffer);
9192 local_input->buffer = NULL;
9193 local_input->length = 0;
David Horstmanne6042ff2023-11-07 18:00:41 +00009194}
9195
David Horstmann89875a42023-11-20 12:54:09 +00009196psa_status_t psa_crypto_local_output_alloc(uint8_t *output, size_t output_len,
9197 psa_crypto_local_output_t *local_output)
David Horstmannba3c7d62023-11-08 15:19:43 +00009198{
David Horstmann9db14482023-11-23 15:50:37 +00009199 *local_output = PSA_CRYPTO_LOCAL_OUTPUT_INIT;
David Horstmannba3c7d62023-11-08 15:19:43 +00009200
David Horstmannc5cc1c32023-11-15 18:11:26 +00009201 if (output_len == 0) {
David Horstmannba3c7d62023-11-08 15:19:43 +00009202 return PSA_SUCCESS;
9203 }
David Horstmann89875a42023-11-20 12:54:09 +00009204 local_output->buffer = mbedtls_calloc(output_len, 1);
9205 if (local_output->buffer == NULL) {
David Horstmannba3c7d62023-11-08 15:19:43 +00009206 /* Since we dealt with the zero-length case above, we know that
9207 * a NULL return value means a failure of allocation. */
9208 return PSA_ERROR_INSUFFICIENT_MEMORY;
9209 }
David Horstmann89875a42023-11-20 12:54:09 +00009210 local_output->length = output_len;
9211 local_output->original = output;
David Horstmannba3c7d62023-11-08 15:19:43 +00009212
9213 return PSA_SUCCESS;
9214}
9215
David Horstmann89875a42023-11-20 12:54:09 +00009216psa_status_t psa_crypto_local_output_free(psa_crypto_local_output_t *local_output)
David Horstmann9467ea32023-11-08 17:44:18 +00009217{
David Horstmannc335a4e2023-11-15 15:57:32 +00009218 psa_status_t status;
9219
David Horstmann89875a42023-11-20 12:54:09 +00009220 if (local_output->buffer == NULL) {
9221 local_output->length = 0;
David Horstmann9467ea32023-11-08 17:44:18 +00009222 return PSA_SUCCESS;
9223 }
David Horstmann89875a42023-11-20 12:54:09 +00009224 if (local_output->original == NULL) {
David Horstmann9467ea32023-11-08 17:44:18 +00009225 /* We have an internal copy but nothing to copy back to. */
9226 return PSA_ERROR_CORRUPTION_DETECTED;
9227 }
9228
David Horstmann89875a42023-11-20 12:54:09 +00009229 status = psa_crypto_copy_output(local_output->buffer, local_output->length,
9230 local_output->original, local_output->length);
David Horstmannc335a4e2023-11-15 15:57:32 +00009231 if (status != PSA_SUCCESS) {
9232 return status;
9233 }
David Horstmann9467ea32023-11-08 17:44:18 +00009234
David Horstmann89875a42023-11-20 12:54:09 +00009235 mbedtls_free(local_output->buffer);
9236 local_output->buffer = NULL;
9237 local_output->length = 0;
David Horstmann9467ea32023-11-08 17:44:18 +00009238
9239 return PSA_SUCCESS;
9240}
9241
Gilles Peskinee59236f2018-01-27 23:32:46 +01009242#endif /* MBEDTLS_PSA_CRYPTO_C */