blob: 0ca5583c9a99f7492620e389132cf93ad3a313d1 [file] [log] [blame]
Aditya Deshpande045b3702023-02-20 17:08:30 +00001/*
2 * Driver entry points for p256-m
3 */
4/*
5 * Copyright The Mbed TLS Contributors
6 * SPDX-License-Identifier: Apache-2.0
7 *
8 * Licensed under the Apache License, Version 2.0 (the "License"); you may
9 * not use this file except in compliance with the License.
10 * You may obtain a copy of the License at
11 *
12 * http://www.apache.org/licenses/LICENSE-2.0
13 *
14 * Unless required by applicable law or agreed to in writing, software
15 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
16 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17 * See the License for the specific language governing permissions and
18 * limitations under the License.
19 */
20
Aditya Deshpandee41f7e42023-01-12 16:29:02 +000021#include "mbedtls/platform.h"
22#include "p256-m_driver_entrypoints.h"
23#include "p256-m/p256-m.h"
24#include "psa/crypto.h"
25#include "psa_crypto_driver_wrappers.h"
Aditya Deshpande7b9934d2023-04-18 17:00:17 +010026#include <stddef.h>
Manuel Pégourié-Gonnard5424cf22023-08-07 10:56:12 +020027#include <string.h>
Aditya Deshpandee41f7e42023-01-12 16:29:02 +000028
29#if defined(MBEDTLS_P256M_EXAMPLE_DRIVER_ENABLED)
30
Aditya Deshpande641cb892023-04-19 03:31:10 +010031/* INFORMATION ON PSA KEY EXPORT FORMATS:
32 *
33 * PSA exports SECP256R1 keys in two formats:
34 * 1. Keypair format: 32 byte string which is just the private key (public key
35 * can be calculated from the private key)
36 * 2. Public Key format: A leading byte 0x04 (indicating uncompressed format),
37 * followed by the 64 byte public key. This results in a
38 * total of 65 bytes.
39 *
40 * p256-m's internal format for private keys matches PSA. Its format for public
41 * keys is only 64 bytes; the same as PSA but without the leading byte (0x04).
42 * Hence, when passing public keys from PSA to p256-m, the leading byte is
43 * removed.
Manuel Pégourié-Gonnardba63e0c2023-08-09 11:53:09 +020044 *
45 * Shared secret and signature have the same format between PSA and p256-m.
Aditya Deshpande641cb892023-04-19 03:31:10 +010046 */
Manuel Pégourié-Gonnardba63e0c2023-08-09 11:53:09 +020047#define PSA_PUBKEY_SIZE 65
48#define PSA_PUBKEY_HEADER_BYTE 0x04
49#define P256_PUBKEY_SIZE 64
50#define PRIVKEY_SIZE 32
51#define SHARED_SECRET_SIZE 32
52#define SIGNATURE_SIZE 64
53
54#define CURVE_BITS 256
Aditya Deshpande641cb892023-04-19 03:31:10 +010055
56/* Convert between p256-m and PSA error codes */
57static psa_status_t p256_to_psa_error(int ret)
Aditya Deshpandee41f7e42023-01-12 16:29:02 +000058{
Aditya Deshpandeac363d82023-03-21 18:56:31 +000059 switch (ret) {
Aditya Deshpandee41f7e42023-01-12 16:29:02 +000060 case P256_SUCCESS:
Aditya Deshpandeac363d82023-03-21 18:56:31 +000061 return PSA_SUCCESS;
Aditya Deshpandee41f7e42023-01-12 16:29:02 +000062 case P256_INVALID_PUBKEY:
63 case P256_INVALID_PRIVKEY:
Aditya Deshpandeac363d82023-03-21 18:56:31 +000064 return PSA_ERROR_INVALID_ARGUMENT;
Aditya Deshpandee41f7e42023-01-12 16:29:02 +000065 case P256_INVALID_SIGNATURE:
Aditya Deshpandeac363d82023-03-21 18:56:31 +000066 return PSA_ERROR_INVALID_SIGNATURE;
Aditya Deshpandee41f7e42023-01-12 16:29:02 +000067 case P256_RANDOM_FAILED:
68 default:
Aditya Deshpandeac363d82023-03-21 18:56:31 +000069 return PSA_ERROR_GENERIC_ERROR;
Aditya Deshpandee41f7e42023-01-12 16:29:02 +000070 }
71}
72
Manuel Pégourié-Gonnard5424cf22023-08-07 10:56:12 +020073psa_status_t p256_transparent_import_key(const psa_key_attributes_t *attributes,
74 const uint8_t *data,
75 size_t data_length,
76 uint8_t *key_buffer,
77 size_t key_buffer_size,
78 size_t *key_buffer_length,
79 size_t *bits)
80{
81 /* Check the key size */
Manuel Pégourié-Gonnardba63e0c2023-08-09 11:53:09 +020082 if (*bits != 0 && *bits != CURVE_BITS) {
Manuel Pégourié-Gonnard5424cf22023-08-07 10:56:12 +020083 return PSA_ERROR_NOT_SUPPORTED;
84 }
85
86 /* Validate the key (and its type and size) */
87 psa_key_type_t type = psa_get_key_type(attributes);
88 if (type == PSA_KEY_TYPE_ECC_PUBLIC_KEY(PSA_ECC_FAMILY_SECP_R1)) {
Manuel Pégourié-Gonnardba63e0c2023-08-09 11:53:09 +020089 if (data_length != PSA_PUBKEY_SIZE) {
Manuel Pégourié-Gonnard5424cf22023-08-07 10:56:12 +020090 return *bits == 0 ? PSA_ERROR_NOT_SUPPORTED : PSA_ERROR_INVALID_ARGUMENT;
91 }
92 if (p256_validate_pubkey(data + 1) != P256_SUCCESS) {
93 return PSA_ERROR_INVALID_ARGUMENT;
94 }
95 } else if (type == PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1)) {
Manuel Pégourié-Gonnardba63e0c2023-08-09 11:53:09 +020096 if (data_length != PRIVKEY_SIZE) {
Manuel Pégourié-Gonnard5424cf22023-08-07 10:56:12 +020097 return *bits == 0 ? PSA_ERROR_NOT_SUPPORTED : PSA_ERROR_INVALID_ARGUMENT;
98 }
99 if (p256_validate_privkey(data) != P256_SUCCESS) {
100 return PSA_ERROR_INVALID_ARGUMENT;
101 }
102 } else {
103 return PSA_ERROR_NOT_SUPPORTED;
104 }
Manuel Pégourié-Gonnardba63e0c2023-08-09 11:53:09 +0200105 *bits = CURVE_BITS;
Manuel Pégourié-Gonnard5424cf22023-08-07 10:56:12 +0200106
107 /* We only support the export format for input, so just copy. */
108 if (key_buffer_size < data_length) {
109 return PSA_ERROR_BUFFER_TOO_SMALL;
110 }
111 memcpy(key_buffer, data, data_length);
112 *key_buffer_length = data_length;
113
114 return PSA_SUCCESS;
115}
116
Manuel Pégourié-Gonnard18d71422023-08-07 11:18:05 +0200117psa_status_t p256_transparent_export_public_key(const psa_key_attributes_t *attributes,
118 const uint8_t *key_buffer,
119 size_t key_buffer_size,
120 uint8_t *data,
121 size_t data_size,
122 size_t *data_length)
123{
124 /* Is this the right curve? */
125 size_t bits = psa_get_key_bits(attributes);
126 psa_key_type_t type = psa_get_key_type(attributes);
Manuel Pégourié-Gonnardba63e0c2023-08-09 11:53:09 +0200127 if (bits != CURVE_BITS || type != PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1)) {
Manuel Pégourié-Gonnard18d71422023-08-07 11:18:05 +0200128 return PSA_ERROR_NOT_SUPPORTED;
129 }
130
Manuel Pégourié-Gonnardf0251e02023-08-08 12:23:42 +0200131 /* Validate sizes, as p256-m expects fixed-size buffers */
Manuel Pégourié-Gonnardba63e0c2023-08-09 11:53:09 +0200132 if (key_buffer_size != PRIVKEY_SIZE) {
Manuel Pégourié-Gonnardf0251e02023-08-08 12:23:42 +0200133 return PSA_ERROR_CORRUPTION_DETECTED;
Manuel Pégourié-Gonnard18d71422023-08-07 11:18:05 +0200134 }
Manuel Pégourié-Gonnardba63e0c2023-08-09 11:53:09 +0200135 if (data_size < PSA_PUBKEY_SIZE) {
Manuel Pégourié-Gonnard18d71422023-08-07 11:18:05 +0200136 return PSA_ERROR_BUFFER_TOO_SMALL;
137 }
138
139 /* Output public key in the PSA export format */
Manuel Pégourié-Gonnardba63e0c2023-08-09 11:53:09 +0200140 data[0] = PSA_PUBKEY_HEADER_BYTE;
Manuel Pégourié-Gonnard18d71422023-08-07 11:18:05 +0200141 int ret = p256_public_from_private(data + 1, key_buffer);
Manuel Pégourié-Gonnardf0251e02023-08-08 12:23:42 +0200142 if (ret == P256_SUCCESS) {
Manuel Pégourié-Gonnardba63e0c2023-08-09 11:53:09 +0200143 *data_length = PSA_PUBKEY_SIZE;
Manuel Pégourié-Gonnard18d71422023-08-07 11:18:05 +0200144 }
Manuel Pégourié-Gonnard18d71422023-08-07 11:18:05 +0200145
Manuel Pégourié-Gonnardf0251e02023-08-08 12:23:42 +0200146 return p256_to_psa_error(ret);
Manuel Pégourié-Gonnard18d71422023-08-07 11:18:05 +0200147}
148
Aditya Deshpande695e44b2023-01-23 14:59:29 +0000149psa_status_t p256_transparent_generate_key(
Aditya Deshpandee41f7e42023-01-12 16:29:02 +0000150 const psa_key_attributes_t *attributes,
151 uint8_t *key_buffer,
152 size_t key_buffer_size,
Aditya Deshpandeac363d82023-03-21 18:56:31 +0000153 size_t *key_buffer_length)
Aditya Deshpandee41f7e42023-01-12 16:29:02 +0000154{
155 /* We don't use this argument, but the specification mandates the signature
156 * of driver entry-points. (void) used to avoid compiler warning. */
157 (void) attributes;
158
Manuel Pégourié-Gonnardf0251e02023-08-08 12:23:42 +0200159 /* Validate sizes, as p256-m expects fixed-size buffers */
Manuel Pégourié-Gonnardba63e0c2023-08-09 11:53:09 +0200160 if (key_buffer_size != PRIVKEY_SIZE) {
Manuel Pégourié-Gonnardf0251e02023-08-08 12:23:42 +0200161 return PSA_ERROR_BUFFER_TOO_SMALL;
Aditya Deshpandeac363d82023-03-21 18:56:31 +0000162 }
Aditya Deshpandee41f7e42023-01-12 16:29:02 +0000163
164 /*
165 * p256-m's keypair generation function outputs both public and private
166 * keys. Allocate a buffer to which the public key will be written. The
167 * private key will be written to key_buffer, which is passed to this
168 * function as an argument. */
Manuel Pégourié-Gonnardba63e0c2023-08-09 11:53:09 +0200169 uint8_t public_key_buffer[P256_PUBKEY_SIZE];
Aditya Deshpandee41f7e42023-01-12 16:29:02 +0000170
Manuel Pégourié-Gonnardf0251e02023-08-08 12:23:42 +0200171 int ret = p256_gen_keypair(key_buffer, public_key_buffer);
172 if (ret == P256_SUCCESS) {
Manuel Pégourié-Gonnardba63e0c2023-08-09 11:53:09 +0200173 *key_buffer_length = PRIVKEY_SIZE;
Aditya Deshpandeac363d82023-03-21 18:56:31 +0000174 }
Aditya Deshpandee41f7e42023-01-12 16:29:02 +0000175
Manuel Pégourié-Gonnardf0251e02023-08-08 12:23:42 +0200176 return p256_to_psa_error(ret);
Aditya Deshpandee41f7e42023-01-12 16:29:02 +0000177}
178
Aditya Deshpande695e44b2023-01-23 14:59:29 +0000179psa_status_t p256_transparent_key_agreement(
Aditya Deshpandee41f7e42023-01-12 16:29:02 +0000180 const psa_key_attributes_t *attributes,
181 const uint8_t *key_buffer,
182 size_t key_buffer_size,
183 psa_algorithm_t alg,
184 const uint8_t *peer_key,
185 size_t peer_key_length,
186 uint8_t *shared_secret,
187 size_t shared_secret_size,
Aditya Deshpandeac363d82023-03-21 18:56:31 +0000188 size_t *shared_secret_length)
Aditya Deshpandee41f7e42023-01-12 16:29:02 +0000189{
190 /* We don't use these arguments, but the specification mandates the
191 * sginature of driver entry-points. (void) used to avoid compiler
192 * warning. */
193 (void) attributes;
194 (void) alg;
195
Manuel Pégourié-Gonnardf0251e02023-08-08 12:23:42 +0200196 /* Validate sizes, as p256-m expects fixed-size buffers */
Manuel Pégourié-Gonnardba63e0c2023-08-09 11:53:09 +0200197 if (key_buffer_size != PRIVKEY_SIZE || peer_key_length != PSA_PUBKEY_SIZE) {
Manuel Pégourié-Gonnardf0251e02023-08-08 12:23:42 +0200198 return PSA_ERROR_INVALID_ARGUMENT;
199 }
Manuel Pégourié-Gonnardba63e0c2023-08-09 11:53:09 +0200200 if (shared_secret_size < SHARED_SECRET_SIZE) {
Manuel Pégourié-Gonnardf0251e02023-08-08 12:23:42 +0200201 return PSA_ERROR_BUFFER_TOO_SMALL;
Aditya Deshpandeac363d82023-03-21 18:56:31 +0000202 }
Aditya Deshpandee41f7e42023-01-12 16:29:02 +0000203
Aditya Deshpande641cb892023-04-19 03:31:10 +0100204 /* We add 1 to peer_key pointer to omit the leading byte of the public key
205 * representation (0x04). See information about PSA key formats at the top
206 * of the file. */
Manuel Pégourié-Gonnardf0251e02023-08-08 12:23:42 +0200207 int ret = p256_ecdh_shared_secret(shared_secret, key_buffer, peer_key + 1);
208 if (ret == P256_SUCCESS) {
Manuel Pégourié-Gonnardba63e0c2023-08-09 11:53:09 +0200209 *shared_secret_length = SHARED_SECRET_SIZE;
Aditya Deshpandeac363d82023-03-21 18:56:31 +0000210 }
Aditya Deshpandee41f7e42023-01-12 16:29:02 +0000211
Manuel Pégourié-Gonnardf0251e02023-08-08 12:23:42 +0200212 return p256_to_psa_error(ret);
Aditya Deshpandee41f7e42023-01-12 16:29:02 +0000213}
214
Aditya Deshpande695e44b2023-01-23 14:59:29 +0000215psa_status_t p256_transparent_sign_hash(
Aditya Deshpandee41f7e42023-01-12 16:29:02 +0000216 const psa_key_attributes_t *attributes,
217 const uint8_t *key_buffer,
218 size_t key_buffer_size,
219 psa_algorithm_t alg,
220 const uint8_t *hash,
221 size_t hash_length,
222 uint8_t *signature,
223 size_t signature_size,
Aditya Deshpandeac363d82023-03-21 18:56:31 +0000224 size_t *signature_length)
Aditya Deshpandee41f7e42023-01-12 16:29:02 +0000225{
226 /* We don't use these arguments, but the specification mandates the
227 * sginature of driver entry-points. (void) used to avoid compiler
228 * warning. */
229 (void) attributes;
230 (void) alg;
231
Manuel Pégourié-Gonnardf0251e02023-08-08 12:23:42 +0200232 /* Validate sizes, as p256-m expects fixed-size buffers */
Manuel Pégourié-Gonnardba63e0c2023-08-09 11:53:09 +0200233 if (key_buffer_size != PRIVKEY_SIZE) {
Manuel Pégourié-Gonnardf0251e02023-08-08 12:23:42 +0200234 return PSA_ERROR_CORRUPTION_DETECTED;
235 }
Manuel Pégourié-Gonnardba63e0c2023-08-09 11:53:09 +0200236 if (signature_size < SIGNATURE_SIZE) {
Manuel Pégourié-Gonnardf0251e02023-08-08 12:23:42 +0200237 return PSA_ERROR_BUFFER_TOO_SMALL;
Aditya Deshpandeac363d82023-03-21 18:56:31 +0000238 }
Aditya Deshpandee41f7e42023-01-12 16:29:02 +0000239
Manuel Pégourié-Gonnardf0251e02023-08-08 12:23:42 +0200240 int ret = p256_ecdsa_sign(signature, key_buffer, hash, hash_length);
241 if (ret == P256_SUCCESS) {
Manuel Pégourié-Gonnardba63e0c2023-08-09 11:53:09 +0200242 *signature_length = SIGNATURE_SIZE;
Aditya Deshpandeac363d82023-03-21 18:56:31 +0000243 }
Aditya Deshpandee41f7e42023-01-12 16:29:02 +0000244
Manuel Pégourié-Gonnardf0251e02023-08-08 12:23:42 +0200245 return p256_to_psa_error(ret);
Aditya Deshpandee41f7e42023-01-12 16:29:02 +0000246}
247
Manuel Pégourié-Gonnardba63e0c2023-08-09 11:53:09 +0200248/* This function expects the key buffer to contain a PSA public key,
Aditya Deshpandee41f7e42023-01-12 16:29:02 +0000249 * as exported by psa_export_public_key() */
Aditya Deshpande695e44b2023-01-23 14:59:29 +0000250static psa_status_t p256_verify_hash_with_public_key(
Aditya Deshpandee41f7e42023-01-12 16:29:02 +0000251 const uint8_t *key_buffer,
252 size_t key_buffer_size,
253 const uint8_t *hash,
254 size_t hash_length,
255 const uint8_t *signature,
Aditya Deshpandeac363d82023-03-21 18:56:31 +0000256 size_t signature_length)
Aditya Deshpandee41f7e42023-01-12 16:29:02 +0000257{
Manuel Pégourié-Gonnardf0251e02023-08-08 12:23:42 +0200258 /* Validate sizes, as p256-m expects fixed-size buffers */
Manuel Pégourié-Gonnardba63e0c2023-08-09 11:53:09 +0200259 if (key_buffer_size != PSA_PUBKEY_SIZE || *key_buffer != PSA_PUBKEY_HEADER_BYTE) {
Manuel Pégourié-Gonnardf0251e02023-08-08 12:23:42 +0200260 return PSA_ERROR_CORRUPTION_DETECTED;
261 }
Manuel Pégourié-Gonnardba63e0c2023-08-09 11:53:09 +0200262 if (signature_length != SIGNATURE_SIZE) {
Manuel Pégourié-Gonnardf0251e02023-08-08 12:23:42 +0200263 return PSA_ERROR_INVALID_SIGNATURE;
Aditya Deshpandeac363d82023-03-21 18:56:31 +0000264 }
Aditya Deshpandee41f7e42023-01-12 16:29:02 +0000265
Aditya Deshpande641cb892023-04-19 03:31:10 +0100266 /* We add 1 to public_key_buffer pointer to omit the leading byte of the
267 * public key representation (0x04). See information about PSA key formats
268 * at the top of the file. */
Aditya Deshpandee41f7e42023-01-12 16:29:02 +0000269 const uint8_t *public_key_buffer = key_buffer + 1;
Manuel Pégourié-Gonnardf0251e02023-08-08 12:23:42 +0200270 int ret = p256_ecdsa_verify(signature, public_key_buffer, hash, hash_length);
Aditya Deshpandee41f7e42023-01-12 16:29:02 +0000271
Manuel Pégourié-Gonnardf0251e02023-08-08 12:23:42 +0200272 return p256_to_psa_error(ret);
Aditya Deshpandee41f7e42023-01-12 16:29:02 +0000273}
274
Aditya Deshpande695e44b2023-01-23 14:59:29 +0000275psa_status_t p256_transparent_verify_hash(
Aditya Deshpandee41f7e42023-01-12 16:29:02 +0000276 const psa_key_attributes_t *attributes,
277 const uint8_t *key_buffer,
278 size_t key_buffer_size,
279 psa_algorithm_t alg,
280 const uint8_t *hash,
281 size_t hash_length,
282 const uint8_t *signature,
Aditya Deshpandeac363d82023-03-21 18:56:31 +0000283 size_t signature_length)
Aditya Deshpandee41f7e42023-01-12 16:29:02 +0000284{
285 /* We don't use this argument, but the specification mandates the signature
286 * of driver entry-points. (void) used to avoid compiler warning. */
287 (void) alg;
288
289 psa_status_t status;
Manuel Pégourié-Gonnardba63e0c2023-08-09 11:53:09 +0200290 uint8_t public_key_buffer[PSA_PUBKEY_SIZE];
291 size_t public_key_buffer_size = PSA_PUBKEY_SIZE;
Aditya Deshpande7b9934d2023-04-18 17:00:17 +0100292
Manuel Pégourié-Gonnardba63e0c2023-08-09 11:53:09 +0200293 size_t public_key_length = PSA_PUBKEY_SIZE;
Aditya Deshpande7b9934d2023-04-18 17:00:17 +0100294 /* As p256-m doesn't require dynamic allocation, we want to avoid it in
295 * the entrypoint functions as well. psa_driver_wrapper_export_public_key()
296 * requires size_t*, so we use a pointer to a stack variable. */
297 size_t *public_key_length_ptr = &public_key_length;
Aditya Deshpandee41f7e42023-01-12 16:29:02 +0000298
Aditya Deshpande641cb892023-04-19 03:31:10 +0100299 /* The contents of key_buffer may either be the 32 byte private key
300 * (keypair format), or 0x04 followed by the 64 byte public key (public
301 * key format). To ensure the key is in the latter format, the public key
302 * is exported. */
Aditya Deshpandee41f7e42023-01-12 16:29:02 +0000303 status = psa_driver_wrapper_export_public_key(
Aditya Deshpandeac363d82023-03-21 18:56:31 +0000304 attributes,
305 key_buffer,
306 key_buffer_size,
307 public_key_buffer,
308 public_key_buffer_size,
Aditya Deshpande7b9934d2023-04-18 17:00:17 +0100309 public_key_length_ptr);
Aditya Deshpandeac363d82023-03-21 18:56:31 +0000310 if (status != PSA_SUCCESS) {
Aditya Deshpandee41f7e42023-01-12 16:29:02 +0000311 goto exit;
Aditya Deshpandeac363d82023-03-21 18:56:31 +0000312 }
Aditya Deshpandee41f7e42023-01-12 16:29:02 +0000313
Aditya Deshpande695e44b2023-01-23 14:59:29 +0000314 status = p256_verify_hash_with_public_key(
Aditya Deshpandeac363d82023-03-21 18:56:31 +0000315 public_key_buffer,
316 public_key_buffer_size,
317 hash,
318 hash_length,
319 signature,
320 signature_length);
Aditya Deshpandee41f7e42023-01-12 16:29:02 +0000321
322exit:
Aditya Deshpandeac363d82023-03-21 18:56:31 +0000323 return status;
Aditya Deshpandee41f7e42023-01-12 16:29:02 +0000324}
325
326#endif /* MBEDTLS_P256M_EXAMPLE_DRIVER_ENABLED */