[mbedTLS] Enable TLS 1.3 support
Move library initialization to module registration functions. Only set library debug threshold when verbose output is enabled. TLSv1.3 functions seems to be a bit more verbose then expected, and generate a lot of noise. Yet, some level of debugging without recompiling the engine would be nice. We should discuss this upstream.
This commit is contained in:
Fabio Alessandrelli
@ -59,18 +59,6 @@
|
||||
// Disable deprecated
|
||||
#define MBEDTLS_DEPRECATED_REMOVED
|
||||
|
||||
// mbedTLS 3.6 finally enabled TLSv1.3 by default, but it requires some mobule
|
||||
// changes, and to enable PSA crypto (new "standard" API specification).
|
||||
// Disable it for now.
|
||||
#undef MBEDTLS_SSL_PROTO_TLS1_3
|
||||
|
||||
// Disable PSA Crypto.
|
||||
#undef MBEDTLS_PSA_CRYPTO_CONFIG
|
||||
#undef MBEDTLS_PSA_CRYPTO_C
|
||||
#undef MBEDTLS_PSA_CRYPTO_STORAGE_C
|
||||
#undef MBEDTLS_PSA_ITS_FILE_C
|
||||
#undef MBEDTLS_LMS_C
|
||||
|
||||
#endif // GODOT_MBEDTLS_INCLUDE_H
|
||||
|
||||
#endif // GODOT_MODULE_MBEDTLS_CONFIG_H
|
||||
|
||||
9233
thirdparty/mbedtls/library/psa_crypto.c
vendored
Normal file
9233
thirdparty/mbedtls/library/psa_crypto.c
vendored
Normal file
File diff suppressed because it is too large
Load Diff
649
thirdparty/mbedtls/library/psa_crypto_aead.c
vendored
Normal file
649
thirdparty/mbedtls/library/psa_crypto_aead.c
vendored
Normal file
@ -0,0 +1,649 @@
|
||||
/*
|
||||
* PSA AEAD entry points
|
||||
*/
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
|
||||
*/
|
||||
|
||||
#include "common.h"
|
||||
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_C)
|
||||
|
||||
#include "psa_crypto_aead.h"
|
||||
#include "psa_crypto_core.h"
|
||||
#include "psa_crypto_cipher.h"
|
||||
|
||||
#include <string.h>
|
||||
#include "mbedtls/platform.h"
|
||||
|
||||
#include "mbedtls/ccm.h"
|
||||
#include "mbedtls/chachapoly.h"
|
||||
#include "mbedtls/cipher.h"
|
||||
#include "mbedtls/gcm.h"
|
||||
#include "mbedtls/error.h"
|
||||
|
||||
static psa_status_t psa_aead_setup(
|
||||
mbedtls_psa_aead_operation_t *operation,
|
||||
const psa_key_attributes_t *attributes,
|
||||
const uint8_t *key_buffer,
|
||||
size_t key_buffer_size,
|
||||
psa_algorithm_t alg)
|
||||
{
|
||||
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
mbedtls_cipher_id_t cipher_id;
|
||||
mbedtls_cipher_mode_t mode;
|
||||
size_t key_bits = attributes->bits;
|
||||
(void) key_buffer_size;
|
||||
|
||||
status = mbedtls_cipher_values_from_psa(alg, attributes->type,
|
||||
&key_bits, &mode, &cipher_id);
|
||||
if (status != PSA_SUCCESS) {
|
||||
return status;
|
||||
}
|
||||
|
||||
switch (PSA_ALG_AEAD_WITH_SHORTENED_TAG(alg, 0)) {
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM)
|
||||
case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, 0):
|
||||
operation->alg = PSA_ALG_CCM;
|
||||
/* CCM allows the following tag lengths: 4, 6, 8, 10, 12, 14, 16.
|
||||
* The call to mbedtls_ccm_encrypt_and_tag or
|
||||
* mbedtls_ccm_auth_decrypt will validate the tag length. */
|
||||
if (PSA_BLOCK_CIPHER_BLOCK_LENGTH(attributes->type) != 16) {
|
||||
return PSA_ERROR_INVALID_ARGUMENT;
|
||||
}
|
||||
|
||||
mbedtls_ccm_init(&operation->ctx.ccm);
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_ccm_setkey(&operation->ctx.ccm, cipher_id,
|
||||
key_buffer, (unsigned int) key_bits));
|
||||
if (status != PSA_SUCCESS) {
|
||||
return status;
|
||||
}
|
||||
break;
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM)
|
||||
case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_GCM, 0):
|
||||
operation->alg = PSA_ALG_GCM;
|
||||
/* GCM allows the following tag lengths: 4, 8, 12, 13, 14, 15, 16.
|
||||
* The call to mbedtls_gcm_crypt_and_tag or
|
||||
* mbedtls_gcm_auth_decrypt will validate the tag length. */
|
||||
if (PSA_BLOCK_CIPHER_BLOCK_LENGTH(attributes->type) != 16) {
|
||||
return PSA_ERROR_INVALID_ARGUMENT;
|
||||
}
|
||||
|
||||
mbedtls_gcm_init(&operation->ctx.gcm);
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_gcm_setkey(&operation->ctx.gcm, cipher_id,
|
||||
key_buffer, (unsigned int) key_bits));
|
||||
if (status != PSA_SUCCESS) {
|
||||
return status;
|
||||
}
|
||||
break;
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305)
|
||||
case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CHACHA20_POLY1305, 0):
|
||||
operation->alg = PSA_ALG_CHACHA20_POLY1305;
|
||||
/* We only support the default tag length. */
|
||||
if (alg != PSA_ALG_CHACHA20_POLY1305) {
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
|
||||
mbedtls_chachapoly_init(&operation->ctx.chachapoly);
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_chachapoly_setkey(&operation->ctx.chachapoly,
|
||||
key_buffer));
|
||||
if (status != PSA_SUCCESS) {
|
||||
return status;
|
||||
}
|
||||
break;
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */
|
||||
|
||||
default:
|
||||
(void) status;
|
||||
(void) key_buffer;
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
|
||||
operation->key_type = psa_get_key_type(attributes);
|
||||
|
||||
operation->tag_length = PSA_ALG_AEAD_GET_TAG_LENGTH(alg);
|
||||
|
||||
return PSA_SUCCESS;
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_aead_encrypt(
|
||||
const psa_key_attributes_t *attributes,
|
||||
const uint8_t *key_buffer, size_t key_buffer_size,
|
||||
psa_algorithm_t alg,
|
||||
const uint8_t *nonce, size_t nonce_length,
|
||||
const uint8_t *additional_data, size_t additional_data_length,
|
||||
const uint8_t *plaintext, size_t plaintext_length,
|
||||
uint8_t *ciphertext, size_t ciphertext_size, size_t *ciphertext_length)
|
||||
{
|
||||
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
mbedtls_psa_aead_operation_t operation = MBEDTLS_PSA_AEAD_OPERATION_INIT;
|
||||
uint8_t *tag;
|
||||
|
||||
status = psa_aead_setup(&operation, attributes, key_buffer,
|
||||
key_buffer_size, alg);
|
||||
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
/* For all currently supported modes, the tag is at the end of the
|
||||
* ciphertext. */
|
||||
if (ciphertext_size < (plaintext_length + operation.tag_length)) {
|
||||
status = PSA_ERROR_BUFFER_TOO_SMALL;
|
||||
goto exit;
|
||||
}
|
||||
tag = ciphertext + plaintext_length;
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM)
|
||||
if (operation.alg == PSA_ALG_CCM) {
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_ccm_encrypt_and_tag(&operation.ctx.ccm,
|
||||
plaintext_length,
|
||||
nonce, nonce_length,
|
||||
additional_data,
|
||||
additional_data_length,
|
||||
plaintext, ciphertext,
|
||||
tag, operation.tag_length));
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM)
|
||||
if (operation.alg == PSA_ALG_GCM) {
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_gcm_crypt_and_tag(&operation.ctx.gcm,
|
||||
MBEDTLS_GCM_ENCRYPT,
|
||||
plaintext_length,
|
||||
nonce, nonce_length,
|
||||
additional_data, additional_data_length,
|
||||
plaintext, ciphertext,
|
||||
operation.tag_length, tag));
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305)
|
||||
if (operation.alg == PSA_ALG_CHACHA20_POLY1305) {
|
||||
if (operation.tag_length != 16) {
|
||||
status = PSA_ERROR_NOT_SUPPORTED;
|
||||
goto exit;
|
||||
}
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_chachapoly_encrypt_and_tag(&operation.ctx.chachapoly,
|
||||
plaintext_length,
|
||||
nonce,
|
||||
additional_data,
|
||||
additional_data_length,
|
||||
plaintext,
|
||||
ciphertext,
|
||||
tag));
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */
|
||||
{
|
||||
(void) tag;
|
||||
(void) nonce;
|
||||
(void) nonce_length;
|
||||
(void) additional_data;
|
||||
(void) additional_data_length;
|
||||
(void) plaintext;
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
|
||||
if (status == PSA_SUCCESS) {
|
||||
*ciphertext_length = plaintext_length + operation.tag_length;
|
||||
}
|
||||
|
||||
exit:
|
||||
mbedtls_psa_aead_abort(&operation);
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
/* Locate the tag in a ciphertext buffer containing the encrypted data
|
||||
* followed by the tag. Return the length of the part preceding the tag in
|
||||
* *plaintext_length. This is the size of the plaintext in modes where
|
||||
* the encrypted data has the same size as the plaintext, such as
|
||||
* CCM and GCM. */
|
||||
static psa_status_t psa_aead_unpadded_locate_tag(size_t tag_length,
|
||||
const uint8_t *ciphertext,
|
||||
size_t ciphertext_length,
|
||||
size_t plaintext_size,
|
||||
const uint8_t **p_tag)
|
||||
{
|
||||
size_t payload_length;
|
||||
if (tag_length > ciphertext_length) {
|
||||
return PSA_ERROR_INVALID_ARGUMENT;
|
||||
}
|
||||
payload_length = ciphertext_length - tag_length;
|
||||
if (payload_length > plaintext_size) {
|
||||
return PSA_ERROR_BUFFER_TOO_SMALL;
|
||||
}
|
||||
*p_tag = ciphertext + payload_length;
|
||||
return PSA_SUCCESS;
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_aead_decrypt(
|
||||
const psa_key_attributes_t *attributes,
|
||||
const uint8_t *key_buffer, size_t key_buffer_size,
|
||||
psa_algorithm_t alg,
|
||||
const uint8_t *nonce, size_t nonce_length,
|
||||
const uint8_t *additional_data, size_t additional_data_length,
|
||||
const uint8_t *ciphertext, size_t ciphertext_length,
|
||||
uint8_t *plaintext, size_t plaintext_size, size_t *plaintext_length)
|
||||
{
|
||||
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
mbedtls_psa_aead_operation_t operation = MBEDTLS_PSA_AEAD_OPERATION_INIT;
|
||||
const uint8_t *tag = NULL;
|
||||
|
||||
status = psa_aead_setup(&operation, attributes, key_buffer,
|
||||
key_buffer_size, alg);
|
||||
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
status = psa_aead_unpadded_locate_tag(operation.tag_length,
|
||||
ciphertext, ciphertext_length,
|
||||
plaintext_size, &tag);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM)
|
||||
if (operation.alg == PSA_ALG_CCM) {
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_ccm_auth_decrypt(&operation.ctx.ccm,
|
||||
ciphertext_length - operation.tag_length,
|
||||
nonce, nonce_length,
|
||||
additional_data,
|
||||
additional_data_length,
|
||||
ciphertext, plaintext,
|
||||
tag, operation.tag_length));
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM)
|
||||
if (operation.alg == PSA_ALG_GCM) {
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_gcm_auth_decrypt(&operation.ctx.gcm,
|
||||
ciphertext_length - operation.tag_length,
|
||||
nonce, nonce_length,
|
||||
additional_data,
|
||||
additional_data_length,
|
||||
tag, operation.tag_length,
|
||||
ciphertext, plaintext));
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305)
|
||||
if (operation.alg == PSA_ALG_CHACHA20_POLY1305) {
|
||||
if (operation.tag_length != 16) {
|
||||
status = PSA_ERROR_NOT_SUPPORTED;
|
||||
goto exit;
|
||||
}
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_chachapoly_auth_decrypt(&operation.ctx.chachapoly,
|
||||
ciphertext_length - operation.tag_length,
|
||||
nonce,
|
||||
additional_data,
|
||||
additional_data_length,
|
||||
tag,
|
||||
ciphertext,
|
||||
plaintext));
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */
|
||||
{
|
||||
(void) nonce;
|
||||
(void) nonce_length;
|
||||
(void) additional_data;
|
||||
(void) additional_data_length;
|
||||
(void) plaintext;
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
|
||||
if (status == PSA_SUCCESS) {
|
||||
*plaintext_length = ciphertext_length - operation.tag_length;
|
||||
}
|
||||
|
||||
exit:
|
||||
mbedtls_psa_aead_abort(&operation);
|
||||
|
||||
if (status == PSA_SUCCESS) {
|
||||
*plaintext_length = ciphertext_length - operation.tag_length;
|
||||
}
|
||||
return status;
|
||||
}
|
||||
|
||||
/* Set the key and algorithm for a multipart authenticated encryption
|
||||
* operation. */
|
||||
psa_status_t mbedtls_psa_aead_encrypt_setup(
|
||||
mbedtls_psa_aead_operation_t *operation,
|
||||
const psa_key_attributes_t *attributes,
|
||||
const uint8_t *key_buffer,
|
||||
size_t key_buffer_size,
|
||||
psa_algorithm_t alg)
|
||||
{
|
||||
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
|
||||
status = psa_aead_setup(operation, attributes, key_buffer,
|
||||
key_buffer_size, alg);
|
||||
|
||||
if (status == PSA_SUCCESS) {
|
||||
operation->is_encrypt = 1;
|
||||
}
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
/* Set the key and algorithm for a multipart authenticated decryption
|
||||
* operation. */
|
||||
psa_status_t mbedtls_psa_aead_decrypt_setup(
|
||||
mbedtls_psa_aead_operation_t *operation,
|
||||
const psa_key_attributes_t *attributes,
|
||||
const uint8_t *key_buffer,
|
||||
size_t key_buffer_size,
|
||||
psa_algorithm_t alg)
|
||||
{
|
||||
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
|
||||
status = psa_aead_setup(operation, attributes, key_buffer,
|
||||
key_buffer_size, alg);
|
||||
|
||||
if (status == PSA_SUCCESS) {
|
||||
operation->is_encrypt = 0;
|
||||
}
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
/* Set a nonce for the multipart AEAD operation*/
|
||||
psa_status_t mbedtls_psa_aead_set_nonce(
|
||||
mbedtls_psa_aead_operation_t *operation,
|
||||
const uint8_t *nonce,
|
||||
size_t nonce_length)
|
||||
{
|
||||
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM)
|
||||
if (operation->alg == PSA_ALG_GCM) {
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_gcm_starts(&operation->ctx.gcm,
|
||||
operation->is_encrypt ?
|
||||
MBEDTLS_GCM_ENCRYPT : MBEDTLS_GCM_DECRYPT,
|
||||
nonce,
|
||||
nonce_length));
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM)
|
||||
if (operation->alg == PSA_ALG_CCM) {
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_ccm_starts(&operation->ctx.ccm,
|
||||
operation->is_encrypt ?
|
||||
MBEDTLS_CCM_ENCRYPT : MBEDTLS_CCM_DECRYPT,
|
||||
nonce,
|
||||
nonce_length));
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305)
|
||||
if (operation->alg == PSA_ALG_CHACHA20_POLY1305) {
|
||||
/* Note - ChaChaPoly allows an 8 byte nonce, but we would have to
|
||||
* allocate a buffer in the operation, copy the nonce to it and pad
|
||||
* it, so for now check the nonce is 12 bytes, as
|
||||
* mbedtls_chachapoly_starts() assumes it can read 12 bytes from the
|
||||
* passed in buffer. */
|
||||
if (nonce_length != 12) {
|
||||
return PSA_ERROR_INVALID_ARGUMENT;
|
||||
}
|
||||
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_chachapoly_starts(&operation->ctx.chachapoly,
|
||||
nonce,
|
||||
operation->is_encrypt ?
|
||||
MBEDTLS_CHACHAPOLY_ENCRYPT :
|
||||
MBEDTLS_CHACHAPOLY_DECRYPT));
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */
|
||||
{
|
||||
(void) operation;
|
||||
(void) nonce;
|
||||
(void) nonce_length;
|
||||
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
/* Declare the lengths of the message and additional data for AEAD. */
|
||||
psa_status_t mbedtls_psa_aead_set_lengths(
|
||||
mbedtls_psa_aead_operation_t *operation,
|
||||
size_t ad_length,
|
||||
size_t plaintext_length)
|
||||
{
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM)
|
||||
if (operation->alg == PSA_ALG_CCM) {
|
||||
return mbedtls_to_psa_error(
|
||||
mbedtls_ccm_set_lengths(&operation->ctx.ccm,
|
||||
ad_length,
|
||||
plaintext_length,
|
||||
operation->tag_length));
|
||||
|
||||
}
|
||||
#else /* MBEDTLS_PSA_BUILTIN_ALG_CCM */
|
||||
(void) operation;
|
||||
(void) ad_length;
|
||||
(void) plaintext_length;
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */
|
||||
|
||||
return PSA_SUCCESS;
|
||||
}
|
||||
|
||||
/* Pass additional data to an active multipart AEAD operation. */
|
||||
psa_status_t mbedtls_psa_aead_update_ad(
|
||||
mbedtls_psa_aead_operation_t *operation,
|
||||
const uint8_t *input,
|
||||
size_t input_length)
|
||||
{
|
||||
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM)
|
||||
if (operation->alg == PSA_ALG_GCM) {
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_gcm_update_ad(&operation->ctx.gcm, input, input_length));
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM)
|
||||
if (operation->alg == PSA_ALG_CCM) {
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_ccm_update_ad(&operation->ctx.ccm, input, input_length));
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305)
|
||||
if (operation->alg == PSA_ALG_CHACHA20_POLY1305) {
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_chachapoly_update_aad(&operation->ctx.chachapoly,
|
||||
input,
|
||||
input_length));
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */
|
||||
{
|
||||
(void) operation;
|
||||
(void) input;
|
||||
(void) input_length;
|
||||
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
/* Encrypt or decrypt a message fragment in an active multipart AEAD
|
||||
* operation.*/
|
||||
psa_status_t mbedtls_psa_aead_update(
|
||||
mbedtls_psa_aead_operation_t *operation,
|
||||
const uint8_t *input,
|
||||
size_t input_length,
|
||||
uint8_t *output,
|
||||
size_t output_size,
|
||||
size_t *output_length)
|
||||
{
|
||||
size_t update_output_length;
|
||||
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
|
||||
update_output_length = input_length;
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM)
|
||||
if (operation->alg == PSA_ALG_GCM) {
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_gcm_update(&operation->ctx.gcm,
|
||||
input, input_length,
|
||||
output, output_size,
|
||||
&update_output_length));
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM)
|
||||
if (operation->alg == PSA_ALG_CCM) {
|
||||
if (output_size < input_length) {
|
||||
return PSA_ERROR_BUFFER_TOO_SMALL;
|
||||
}
|
||||
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_ccm_update(&operation->ctx.ccm,
|
||||
input, input_length,
|
||||
output, output_size,
|
||||
&update_output_length));
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305)
|
||||
if (operation->alg == PSA_ALG_CHACHA20_POLY1305) {
|
||||
if (output_size < input_length) {
|
||||
return PSA_ERROR_BUFFER_TOO_SMALL;
|
||||
}
|
||||
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_chachapoly_update(&operation->ctx.chachapoly,
|
||||
input_length,
|
||||
input,
|
||||
output));
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */
|
||||
{
|
||||
(void) operation;
|
||||
(void) input;
|
||||
(void) output;
|
||||
(void) output_size;
|
||||
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
|
||||
if (status == PSA_SUCCESS) {
|
||||
*output_length = update_output_length;
|
||||
}
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
/* Finish encrypting a message in a multipart AEAD operation. */
|
||||
psa_status_t mbedtls_psa_aead_finish(
|
||||
mbedtls_psa_aead_operation_t *operation,
|
||||
uint8_t *ciphertext,
|
||||
size_t ciphertext_size,
|
||||
size_t *ciphertext_length,
|
||||
uint8_t *tag,
|
||||
size_t tag_size,
|
||||
size_t *tag_length)
|
||||
{
|
||||
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
size_t finish_output_size = 0;
|
||||
|
||||
if (tag_size < operation->tag_length) {
|
||||
return PSA_ERROR_BUFFER_TOO_SMALL;
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM)
|
||||
if (operation->alg == PSA_ALG_GCM) {
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_gcm_finish(&operation->ctx.gcm,
|
||||
ciphertext, ciphertext_size, ciphertext_length,
|
||||
tag, operation->tag_length));
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM)
|
||||
if (operation->alg == PSA_ALG_CCM) {
|
||||
/* tag must be big enough to store a tag of size passed into set
|
||||
* lengths. */
|
||||
if (tag_size < operation->tag_length) {
|
||||
return PSA_ERROR_BUFFER_TOO_SMALL;
|
||||
}
|
||||
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_ccm_finish(&operation->ctx.ccm,
|
||||
tag, operation->tag_length));
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305)
|
||||
if (operation->alg == PSA_ALG_CHACHA20_POLY1305) {
|
||||
/* Belt and braces. Although the above tag_size check should have
|
||||
* already done this, if we later start supporting smaller tag sizes
|
||||
* for chachapoly, then passing a tag buffer smaller than 16 into here
|
||||
* could cause a buffer overflow, so better safe than sorry. */
|
||||
if (tag_size < 16) {
|
||||
return PSA_ERROR_BUFFER_TOO_SMALL;
|
||||
}
|
||||
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_chachapoly_finish(&operation->ctx.chachapoly,
|
||||
tag));
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */
|
||||
{
|
||||
(void) ciphertext;
|
||||
(void) ciphertext_size;
|
||||
(void) ciphertext_length;
|
||||
(void) tag;
|
||||
(void) tag_size;
|
||||
(void) tag_length;
|
||||
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
|
||||
if (status == PSA_SUCCESS) {
|
||||
/* This will be zero for all supported algorithms currently, but left
|
||||
* here for future support. */
|
||||
*ciphertext_length = finish_output_size;
|
||||
*tag_length = operation->tag_length;
|
||||
}
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
/* Abort an AEAD operation */
|
||||
psa_status_t mbedtls_psa_aead_abort(
|
||||
mbedtls_psa_aead_operation_t *operation)
|
||||
{
|
||||
switch (operation->alg) {
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM)
|
||||
case PSA_ALG_CCM:
|
||||
mbedtls_ccm_free(&operation->ctx.ccm);
|
||||
break;
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM)
|
||||
case PSA_ALG_GCM:
|
||||
mbedtls_gcm_free(&operation->ctx.gcm);
|
||||
break;
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305)
|
||||
case PSA_ALG_CHACHA20_POLY1305:
|
||||
mbedtls_chachapoly_free(&operation->ctx.chachapoly);
|
||||
break;
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */
|
||||
}
|
||||
|
||||
operation->is_encrypt = 0;
|
||||
|
||||
return PSA_SUCCESS;
|
||||
}
|
||||
|
||||
#endif /* MBEDTLS_PSA_CRYPTO_C */
|
||||
724
thirdparty/mbedtls/library/psa_crypto_cipher.c
vendored
Normal file
724
thirdparty/mbedtls/library/psa_crypto_cipher.c
vendored
Normal file
@ -0,0 +1,724 @@
|
||||
/*
|
||||
* PSA cipher driver entry points
|
||||
*/
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
|
||||
*/
|
||||
|
||||
#include "common.h"
|
||||
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_C)
|
||||
|
||||
#include "psa_crypto_cipher.h"
|
||||
#include "psa_crypto_core.h"
|
||||
#include "psa_crypto_random_impl.h"
|
||||
|
||||
#include "mbedtls/cipher.h"
|
||||
#include "mbedtls/error.h"
|
||||
|
||||
#include <string.h>
|
||||
|
||||
/* mbedtls_cipher_values_from_psa() below only checks if the proper build symbols
|
||||
* are enabled, but it does not provide any compatibility check between them
|
||||
* (i.e. if the specified key works with the specified algorithm). This helper
|
||||
* function is meant to provide this support.
|
||||
* mbedtls_cipher_info_from_psa() might be used for the same purpose, but it
|
||||
* requires CIPHER_C to be enabled.
|
||||
*/
|
||||
static psa_status_t mbedtls_cipher_validate_values(
|
||||
psa_algorithm_t alg,
|
||||
psa_key_type_t key_type)
|
||||
{
|
||||
/* Reduce code size - hinting to the compiler about what it can assume allows the compiler to
|
||||
eliminate bits of the logic below. */
|
||||
#if !defined(PSA_WANT_KEY_TYPE_AES)
|
||||
MBEDTLS_ASSUME(key_type != PSA_KEY_TYPE_AES);
|
||||
#endif
|
||||
#if !defined(PSA_WANT_KEY_TYPE_ARIA)
|
||||
MBEDTLS_ASSUME(key_type != PSA_KEY_TYPE_ARIA);
|
||||
#endif
|
||||
#if !defined(PSA_WANT_KEY_TYPE_CAMELLIA)
|
||||
MBEDTLS_ASSUME(key_type != PSA_KEY_TYPE_CAMELLIA);
|
||||
#endif
|
||||
#if !defined(PSA_WANT_KEY_TYPE_CHACHA20)
|
||||
MBEDTLS_ASSUME(key_type != PSA_KEY_TYPE_CHACHA20);
|
||||
#endif
|
||||
#if !defined(PSA_WANT_KEY_TYPE_DES)
|
||||
MBEDTLS_ASSUME(key_type != PSA_KEY_TYPE_DES);
|
||||
#endif
|
||||
#if !defined(PSA_WANT_ALG_CCM)
|
||||
MBEDTLS_ASSUME(alg != PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, 0));
|
||||
#endif
|
||||
#if !defined(PSA_WANT_ALG_GCM)
|
||||
MBEDTLS_ASSUME(alg != PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_GCM, 0));
|
||||
#endif
|
||||
#if !defined(PSA_WANT_ALG_STREAM_CIPHER)
|
||||
MBEDTLS_ASSUME(alg != PSA_ALG_STREAM_CIPHER);
|
||||
#endif
|
||||
#if !defined(PSA_WANT_ALG_CHACHA20_POLY1305)
|
||||
MBEDTLS_ASSUME(alg != PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CHACHA20_POLY1305, 0));
|
||||
#endif
|
||||
#if !defined(PSA_WANT_ALG_CCM_STAR_NO_TAG)
|
||||
MBEDTLS_ASSUME(alg != PSA_ALG_CCM_STAR_NO_TAG);
|
||||
#endif
|
||||
#if !defined(PSA_WANT_ALG_CTR)
|
||||
MBEDTLS_ASSUME(alg != PSA_ALG_CTR);
|
||||
#endif
|
||||
#if !defined(PSA_WANT_ALG_CFB)
|
||||
MBEDTLS_ASSUME(alg != PSA_ALG_CFB);
|
||||
#endif
|
||||
#if !defined(PSA_WANT_ALG_OFB)
|
||||
MBEDTLS_ASSUME(alg != PSA_ALG_OFB);
|
||||
#endif
|
||||
#if !defined(PSA_WANT_ALG_XTS)
|
||||
MBEDTLS_ASSUME(alg != PSA_ALG_XTS);
|
||||
#endif
|
||||
#if !defined(PSA_WANT_ALG_ECB_NO_PADDING)
|
||||
MBEDTLS_ASSUME(alg != PSA_ALG_ECB_NO_PADDING);
|
||||
#endif
|
||||
#if !defined(PSA_WANT_ALG_CBC_NO_PADDING)
|
||||
MBEDTLS_ASSUME(alg != PSA_ALG_CBC_NO_PADDING);
|
||||
#endif
|
||||
#if !defined(PSA_WANT_ALG_CBC_PKCS7)
|
||||
MBEDTLS_ASSUME(alg != PSA_ALG_CBC_PKCS7);
|
||||
#endif
|
||||
#if !defined(PSA_WANT_ALG_CMAC)
|
||||
MBEDTLS_ASSUME(alg != PSA_ALG_CMAC);
|
||||
#endif
|
||||
|
||||
if (alg == PSA_ALG_STREAM_CIPHER ||
|
||||
alg == PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CHACHA20_POLY1305, 0)) {
|
||||
if (key_type == PSA_KEY_TYPE_CHACHA20) {
|
||||
return PSA_SUCCESS;
|
||||
}
|
||||
}
|
||||
|
||||
if (alg == PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, 0) ||
|
||||
alg == PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_GCM, 0) ||
|
||||
alg == PSA_ALG_CCM_STAR_NO_TAG) {
|
||||
if (key_type == PSA_KEY_TYPE_AES ||
|
||||
key_type == PSA_KEY_TYPE_ARIA ||
|
||||
key_type == PSA_KEY_TYPE_CAMELLIA) {
|
||||
return PSA_SUCCESS;
|
||||
}
|
||||
}
|
||||
|
||||
if (alg == PSA_ALG_CTR ||
|
||||
alg == PSA_ALG_CFB ||
|
||||
alg == PSA_ALG_OFB ||
|
||||
alg == PSA_ALG_XTS ||
|
||||
alg == PSA_ALG_ECB_NO_PADDING ||
|
||||
alg == PSA_ALG_CBC_NO_PADDING ||
|
||||
alg == PSA_ALG_CBC_PKCS7 ||
|
||||
alg == PSA_ALG_CMAC) {
|
||||
if (key_type == PSA_KEY_TYPE_AES ||
|
||||
key_type == PSA_KEY_TYPE_ARIA ||
|
||||
key_type == PSA_KEY_TYPE_DES ||
|
||||
key_type == PSA_KEY_TYPE_CAMELLIA) {
|
||||
return PSA_SUCCESS;
|
||||
}
|
||||
}
|
||||
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_cipher_values_from_psa(
|
||||
psa_algorithm_t alg,
|
||||
psa_key_type_t key_type,
|
||||
size_t *key_bits,
|
||||
mbedtls_cipher_mode_t *mode,
|
||||
mbedtls_cipher_id_t *cipher_id)
|
||||
{
|
||||
mbedtls_cipher_id_t cipher_id_tmp;
|
||||
/* Only DES modifies key_bits */
|
||||
#if !defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
|
||||
(void) key_bits;
|
||||
#endif
|
||||
|
||||
if (PSA_ALG_IS_AEAD(alg)) {
|
||||
alg = PSA_ALG_AEAD_WITH_SHORTENED_TAG(alg, 0);
|
||||
}
|
||||
|
||||
if (PSA_ALG_IS_CIPHER(alg) || PSA_ALG_IS_AEAD(alg)) {
|
||||
switch (alg) {
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_STREAM_CIPHER)
|
||||
case PSA_ALG_STREAM_CIPHER:
|
||||
*mode = MBEDTLS_MODE_STREAM;
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CTR)
|
||||
case PSA_ALG_CTR:
|
||||
*mode = MBEDTLS_MODE_CTR;
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CFB)
|
||||
case PSA_ALG_CFB:
|
||||
*mode = MBEDTLS_MODE_CFB;
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_OFB)
|
||||
case PSA_ALG_OFB:
|
||||
*mode = MBEDTLS_MODE_OFB;
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECB_NO_PADDING)
|
||||
case PSA_ALG_ECB_NO_PADDING:
|
||||
*mode = MBEDTLS_MODE_ECB;
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CBC_NO_PADDING)
|
||||
case PSA_ALG_CBC_NO_PADDING:
|
||||
*mode = MBEDTLS_MODE_CBC;
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CBC_PKCS7)
|
||||
case PSA_ALG_CBC_PKCS7:
|
||||
*mode = MBEDTLS_MODE_CBC;
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM_STAR_NO_TAG)
|
||||
case PSA_ALG_CCM_STAR_NO_TAG:
|
||||
*mode = MBEDTLS_MODE_CCM_STAR_NO_TAG;
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM)
|
||||
case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, 0):
|
||||
*mode = MBEDTLS_MODE_CCM;
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM)
|
||||
case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_GCM, 0):
|
||||
*mode = MBEDTLS_MODE_GCM;
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305)
|
||||
case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CHACHA20_POLY1305, 0):
|
||||
*mode = MBEDTLS_MODE_CHACHAPOLY;
|
||||
break;
|
||||
#endif
|
||||
default:
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
} else if (alg == PSA_ALG_CMAC) {
|
||||
*mode = MBEDTLS_MODE_ECB;
|
||||
} else {
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
|
||||
switch (key_type) {
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_AES)
|
||||
case PSA_KEY_TYPE_AES:
|
||||
cipher_id_tmp = MBEDTLS_CIPHER_ID_AES;
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ARIA)
|
||||
case PSA_KEY_TYPE_ARIA:
|
||||
cipher_id_tmp = MBEDTLS_CIPHER_ID_ARIA;
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
|
||||
case PSA_KEY_TYPE_DES:
|
||||
/* key_bits is 64 for Single-DES, 128 for two-key Triple-DES,
|
||||
* and 192 for three-key Triple-DES. */
|
||||
if (*key_bits == 64) {
|
||||
cipher_id_tmp = MBEDTLS_CIPHER_ID_DES;
|
||||
} else {
|
||||
cipher_id_tmp = MBEDTLS_CIPHER_ID_3DES;
|
||||
}
|
||||
/* mbedtls doesn't recognize two-key Triple-DES as an algorithm,
|
||||
* but two-key Triple-DES is functionally three-key Triple-DES
|
||||
* with K1=K3, so that's how we present it to mbedtls. */
|
||||
if (*key_bits == 128) {
|
||||
*key_bits = 192;
|
||||
}
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_CAMELLIA)
|
||||
case PSA_KEY_TYPE_CAMELLIA:
|
||||
cipher_id_tmp = MBEDTLS_CIPHER_ID_CAMELLIA;
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_CHACHA20)
|
||||
case PSA_KEY_TYPE_CHACHA20:
|
||||
cipher_id_tmp = MBEDTLS_CIPHER_ID_CHACHA20;
|
||||
break;
|
||||
#endif
|
||||
default:
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
if (cipher_id != NULL) {
|
||||
*cipher_id = cipher_id_tmp;
|
||||
}
|
||||
|
||||
return mbedtls_cipher_validate_values(alg, key_type);
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_CIPHER_C)
|
||||
const mbedtls_cipher_info_t *mbedtls_cipher_info_from_psa(
|
||||
psa_algorithm_t alg,
|
||||
psa_key_type_t key_type,
|
||||
size_t key_bits,
|
||||
mbedtls_cipher_id_t *cipher_id)
|
||||
{
|
||||
mbedtls_cipher_mode_t mode;
|
||||
psa_status_t status;
|
||||
mbedtls_cipher_id_t cipher_id_tmp = MBEDTLS_CIPHER_ID_NONE;
|
||||
|
||||
status = mbedtls_cipher_values_from_psa(alg, key_type, &key_bits, &mode, &cipher_id_tmp);
|
||||
if (status != PSA_SUCCESS) {
|
||||
return NULL;
|
||||
}
|
||||
if (cipher_id != NULL) {
|
||||
*cipher_id = cipher_id_tmp;
|
||||
}
|
||||
|
||||
return mbedtls_cipher_info_from_values(cipher_id_tmp, (int) key_bits, mode);
|
||||
}
|
||||
#endif /* MBEDTLS_CIPHER_C */
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_CIPHER)
|
||||
|
||||
static psa_status_t psa_cipher_setup(
|
||||
mbedtls_psa_cipher_operation_t *operation,
|
||||
const psa_key_attributes_t *attributes,
|
||||
const uint8_t *key_buffer, size_t key_buffer_size,
|
||||
psa_algorithm_t alg,
|
||||
mbedtls_operation_t cipher_operation)
|
||||
{
|
||||
int ret = 0;
|
||||
size_t key_bits;
|
||||
const mbedtls_cipher_info_t *cipher_info = NULL;
|
||||
psa_key_type_t key_type = attributes->type;
|
||||
|
||||
(void) key_buffer_size;
|
||||
|
||||
mbedtls_cipher_init(&operation->ctx.cipher);
|
||||
|
||||
operation->alg = alg;
|
||||
key_bits = attributes->bits;
|
||||
cipher_info = mbedtls_cipher_info_from_psa(alg, key_type,
|
||||
key_bits, NULL);
|
||||
if (cipher_info == NULL) {
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
|
||||
ret = mbedtls_cipher_setup(&operation->ctx.cipher, cipher_info);
|
||||
if (ret != 0) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
|
||||
if (key_type == PSA_KEY_TYPE_DES && key_bits == 128) {
|
||||
/* Two-key Triple-DES is 3-key Triple-DES with K1=K3 */
|
||||
uint8_t keys[24];
|
||||
memcpy(keys, key_buffer, 16);
|
||||
memcpy(keys + 16, key_buffer, 8);
|
||||
ret = mbedtls_cipher_setkey(&operation->ctx.cipher,
|
||||
keys,
|
||||
192, cipher_operation);
|
||||
} else
|
||||
#endif
|
||||
{
|
||||
ret = mbedtls_cipher_setkey(&operation->ctx.cipher, key_buffer,
|
||||
(int) key_bits, cipher_operation);
|
||||
}
|
||||
if (ret != 0) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CBC_NO_PADDING) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_CBC_PKCS7)
|
||||
switch (alg) {
|
||||
case PSA_ALG_CBC_NO_PADDING:
|
||||
ret = mbedtls_cipher_set_padding_mode(&operation->ctx.cipher,
|
||||
MBEDTLS_PADDING_NONE);
|
||||
break;
|
||||
case PSA_ALG_CBC_PKCS7:
|
||||
ret = mbedtls_cipher_set_padding_mode(&operation->ctx.cipher,
|
||||
MBEDTLS_PADDING_PKCS7);
|
||||
break;
|
||||
default:
|
||||
/* The algorithm doesn't involve padding. */
|
||||
ret = 0;
|
||||
break;
|
||||
}
|
||||
if (ret != 0) {
|
||||
goto exit;
|
||||
}
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CBC_NO_PADDING ||
|
||||
MBEDTLS_PSA_BUILTIN_ALG_CBC_PKCS7 */
|
||||
|
||||
operation->block_length = (PSA_ALG_IS_STREAM_CIPHER(alg) ? 1 :
|
||||
PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type));
|
||||
operation->iv_length = PSA_CIPHER_IV_LENGTH(key_type, alg);
|
||||
|
||||
exit:
|
||||
return mbedtls_to_psa_error(ret);
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_cipher_encrypt_setup(
|
||||
mbedtls_psa_cipher_operation_t *operation,
|
||||
const psa_key_attributes_t *attributes,
|
||||
const uint8_t *key_buffer, size_t key_buffer_size,
|
||||
psa_algorithm_t alg)
|
||||
{
|
||||
return psa_cipher_setup(operation, attributes,
|
||||
key_buffer, key_buffer_size,
|
||||
alg, MBEDTLS_ENCRYPT);
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_cipher_decrypt_setup(
|
||||
mbedtls_psa_cipher_operation_t *operation,
|
||||
const psa_key_attributes_t *attributes,
|
||||
const uint8_t *key_buffer, size_t key_buffer_size,
|
||||
psa_algorithm_t alg)
|
||||
{
|
||||
return psa_cipher_setup(operation, attributes,
|
||||
key_buffer, key_buffer_size,
|
||||
alg, MBEDTLS_DECRYPT);
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_cipher_set_iv(
|
||||
mbedtls_psa_cipher_operation_t *operation,
|
||||
const uint8_t *iv, size_t iv_length)
|
||||
{
|
||||
if (iv_length != operation->iv_length) {
|
||||
return PSA_ERROR_INVALID_ARGUMENT;
|
||||
}
|
||||
|
||||
return mbedtls_to_psa_error(
|
||||
mbedtls_cipher_set_iv(&operation->ctx.cipher,
|
||||
iv, iv_length));
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECB_NO_PADDING)
|
||||
/** Process input for which the algorithm is set to ECB mode.
|
||||
*
|
||||
* This requires manual processing, since the PSA API is defined as being
|
||||
* able to process arbitrary-length calls to psa_cipher_update() with ECB mode,
|
||||
* but the underlying mbedtls_cipher_update only takes full blocks.
|
||||
*
|
||||
* \param ctx The mbedtls cipher context to use. It must have been
|
||||
* set up for ECB.
|
||||
* \param[in] input The input plaintext or ciphertext to process.
|
||||
* \param input_length The number of bytes to process from \p input.
|
||||
* This does not need to be aligned to a block boundary.
|
||||
* If there is a partial block at the end of the input,
|
||||
* it is stored in \p ctx for future processing.
|
||||
* \param output The buffer where the output is written. It must be
|
||||
* at least `BS * floor((p + input_length) / BS)` bytes
|
||||
* long, where `p` is the number of bytes in the
|
||||
* unprocessed partial block in \p ctx (with
|
||||
* `0 <= p <= BS - 1`) and `BS` is the block size.
|
||||
* \param output_length On success, the number of bytes written to \p output.
|
||||
* \c 0 on error.
|
||||
*
|
||||
* \return #PSA_SUCCESS or an error from a hardware accelerator
|
||||
*/
|
||||
static psa_status_t psa_cipher_update_ecb(
|
||||
mbedtls_cipher_context_t *ctx,
|
||||
const uint8_t *input,
|
||||
size_t input_length,
|
||||
uint8_t *output,
|
||||
size_t *output_length)
|
||||
{
|
||||
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
size_t block_size = mbedtls_cipher_info_get_block_size(ctx->cipher_info);
|
||||
size_t internal_output_length = 0;
|
||||
*output_length = 0;
|
||||
|
||||
if (input_length == 0) {
|
||||
status = PSA_SUCCESS;
|
||||
goto exit;
|
||||
}
|
||||
|
||||
if (ctx->unprocessed_len > 0) {
|
||||
/* Fill up to block size, and run the block if there's a full one. */
|
||||
size_t bytes_to_copy = block_size - ctx->unprocessed_len;
|
||||
|
||||
if (input_length < bytes_to_copy) {
|
||||
bytes_to_copy = input_length;
|
||||
}
|
||||
|
||||
memcpy(&(ctx->unprocessed_data[ctx->unprocessed_len]),
|
||||
input, bytes_to_copy);
|
||||
input_length -= bytes_to_copy;
|
||||
input += bytes_to_copy;
|
||||
ctx->unprocessed_len += bytes_to_copy;
|
||||
|
||||
if (ctx->unprocessed_len == block_size) {
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_cipher_update(ctx,
|
||||
ctx->unprocessed_data,
|
||||
block_size,
|
||||
output, &internal_output_length));
|
||||
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
output += internal_output_length;
|
||||
*output_length += internal_output_length;
|
||||
ctx->unprocessed_len = 0;
|
||||
}
|
||||
}
|
||||
|
||||
while (input_length >= block_size) {
|
||||
/* Run all full blocks we have, one by one */
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_cipher_update(ctx, input,
|
||||
block_size,
|
||||
output, &internal_output_length));
|
||||
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
input_length -= block_size;
|
||||
input += block_size;
|
||||
|
||||
output += internal_output_length;
|
||||
*output_length += internal_output_length;
|
||||
}
|
||||
|
||||
if (input_length > 0) {
|
||||
/* Save unprocessed bytes for later processing */
|
||||
memcpy(&(ctx->unprocessed_data[ctx->unprocessed_len]),
|
||||
input, input_length);
|
||||
ctx->unprocessed_len += input_length;
|
||||
}
|
||||
|
||||
status = PSA_SUCCESS;
|
||||
|
||||
exit:
|
||||
return status;
|
||||
}
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_ECB_NO_PADDING */
|
||||
|
||||
psa_status_t mbedtls_psa_cipher_update(
|
||||
mbedtls_psa_cipher_operation_t *operation,
|
||||
const uint8_t *input, size_t input_length,
|
||||
uint8_t *output, size_t output_size, size_t *output_length)
|
||||
{
|
||||
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
size_t expected_output_size;
|
||||
|
||||
if (!PSA_ALG_IS_STREAM_CIPHER(operation->alg)) {
|
||||
/* Take the unprocessed partial block left over from previous
|
||||
* update calls, if any, plus the input to this call. Remove
|
||||
* the last partial block, if any. You get the data that will be
|
||||
* output in this call. */
|
||||
expected_output_size =
|
||||
(operation->ctx.cipher.unprocessed_len + input_length)
|
||||
/ operation->block_length * operation->block_length;
|
||||
} else {
|
||||
expected_output_size = input_length;
|
||||
}
|
||||
|
||||
if (output_size < expected_output_size) {
|
||||
return PSA_ERROR_BUFFER_TOO_SMALL;
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECB_NO_PADDING)
|
||||
if (operation->alg == PSA_ALG_ECB_NO_PADDING) {
|
||||
/* mbedtls_cipher_update has an API inconsistency: it will only
|
||||
* process a single block at a time in ECB mode. Abstract away that
|
||||
* inconsistency here to match the PSA API behaviour. */
|
||||
status = psa_cipher_update_ecb(&operation->ctx.cipher,
|
||||
input,
|
||||
input_length,
|
||||
output,
|
||||
output_length);
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_ECB_NO_PADDING */
|
||||
if (input_length == 0) {
|
||||
/* There is no input, nothing to be done */
|
||||
*output_length = 0;
|
||||
status = PSA_SUCCESS;
|
||||
} else {
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_cipher_update(&operation->ctx.cipher, input,
|
||||
input_length, output, output_length));
|
||||
|
||||
if (*output_length > output_size) {
|
||||
return PSA_ERROR_CORRUPTION_DETECTED;
|
||||
}
|
||||
}
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_cipher_finish(
|
||||
mbedtls_psa_cipher_operation_t *operation,
|
||||
uint8_t *output, size_t output_size, size_t *output_length)
|
||||
{
|
||||
psa_status_t status = PSA_ERROR_GENERIC_ERROR;
|
||||
uint8_t temp_output_buffer[MBEDTLS_MAX_BLOCK_LENGTH];
|
||||
|
||||
if (operation->ctx.cipher.unprocessed_len != 0) {
|
||||
if (operation->alg == PSA_ALG_ECB_NO_PADDING ||
|
||||
operation->alg == PSA_ALG_CBC_NO_PADDING) {
|
||||
status = PSA_ERROR_INVALID_ARGUMENT;
|
||||
goto exit;
|
||||
}
|
||||
}
|
||||
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_cipher_finish(&operation->ctx.cipher,
|
||||
temp_output_buffer,
|
||||
output_length));
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
if (*output_length == 0) {
|
||||
; /* Nothing to copy. Note that output may be NULL in this case. */
|
||||
} else if (output_size >= *output_length) {
|
||||
memcpy(output, temp_output_buffer, *output_length);
|
||||
} else {
|
||||
status = PSA_ERROR_BUFFER_TOO_SMALL;
|
||||
}
|
||||
|
||||
exit:
|
||||
mbedtls_platform_zeroize(temp_output_buffer,
|
||||
sizeof(temp_output_buffer));
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_cipher_abort(
|
||||
mbedtls_psa_cipher_operation_t *operation)
|
||||
{
|
||||
/* Sanity check (shouldn't happen: operation->alg should
|
||||
* always have been initialized to a valid value). */
|
||||
if (!PSA_ALG_IS_CIPHER(operation->alg)) {
|
||||
return PSA_ERROR_BAD_STATE;
|
||||
}
|
||||
|
||||
mbedtls_cipher_free(&operation->ctx.cipher);
|
||||
|
||||
return PSA_SUCCESS;
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_cipher_encrypt(
|
||||
const psa_key_attributes_t *attributes,
|
||||
const uint8_t *key_buffer,
|
||||
size_t key_buffer_size,
|
||||
psa_algorithm_t alg,
|
||||
const uint8_t *iv,
|
||||
size_t iv_length,
|
||||
const uint8_t *input,
|
||||
size_t input_length,
|
||||
uint8_t *output,
|
||||
size_t output_size,
|
||||
size_t *output_length)
|
||||
{
|
||||
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
mbedtls_psa_cipher_operation_t operation = MBEDTLS_PSA_CIPHER_OPERATION_INIT;
|
||||
size_t update_output_length, finish_output_length;
|
||||
|
||||
status = mbedtls_psa_cipher_encrypt_setup(&operation, attributes,
|
||||
key_buffer, key_buffer_size,
|
||||
alg);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
if (iv_length > 0) {
|
||||
status = mbedtls_psa_cipher_set_iv(&operation, iv, iv_length);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
}
|
||||
|
||||
status = mbedtls_psa_cipher_update(&operation, input, input_length,
|
||||
output, output_size,
|
||||
&update_output_length);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
status = mbedtls_psa_cipher_finish(
|
||||
&operation,
|
||||
mbedtls_buffer_offset(output, update_output_length),
|
||||
output_size - update_output_length, &finish_output_length);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
*output_length = update_output_length + finish_output_length;
|
||||
|
||||
exit:
|
||||
if (status == PSA_SUCCESS) {
|
||||
status = mbedtls_psa_cipher_abort(&operation);
|
||||
} else {
|
||||
mbedtls_psa_cipher_abort(&operation);
|
||||
}
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_cipher_decrypt(
|
||||
const psa_key_attributes_t *attributes,
|
||||
const uint8_t *key_buffer,
|
||||
size_t key_buffer_size,
|
||||
psa_algorithm_t alg,
|
||||
const uint8_t *input,
|
||||
size_t input_length,
|
||||
uint8_t *output,
|
||||
size_t output_size,
|
||||
size_t *output_length)
|
||||
{
|
||||
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
mbedtls_psa_cipher_operation_t operation = MBEDTLS_PSA_CIPHER_OPERATION_INIT;
|
||||
size_t olength, accumulated_length;
|
||||
|
||||
status = mbedtls_psa_cipher_decrypt_setup(&operation, attributes,
|
||||
key_buffer, key_buffer_size,
|
||||
alg);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
if (operation.iv_length > 0) {
|
||||
status = mbedtls_psa_cipher_set_iv(&operation,
|
||||
input, operation.iv_length);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
}
|
||||
|
||||
status = mbedtls_psa_cipher_update(
|
||||
&operation,
|
||||
mbedtls_buffer_offset_const(input, operation.iv_length),
|
||||
input_length - operation.iv_length,
|
||||
output, output_size, &olength);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
accumulated_length = olength;
|
||||
|
||||
status = mbedtls_psa_cipher_finish(
|
||||
&operation,
|
||||
mbedtls_buffer_offset(output, accumulated_length),
|
||||
output_size - accumulated_length, &olength);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
*output_length = accumulated_length + olength;
|
||||
|
||||
exit:
|
||||
if (status == PSA_SUCCESS) {
|
||||
status = mbedtls_psa_cipher_abort(&operation);
|
||||
} else {
|
||||
mbedtls_psa_cipher_abort(&operation);
|
||||
}
|
||||
|
||||
return status;
|
||||
}
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_CIPHER */
|
||||
|
||||
#endif /* MBEDTLS_PSA_CRYPTO_C */
|
||||
22
thirdparty/mbedtls/library/psa_crypto_client.c
vendored
Normal file
22
thirdparty/mbedtls/library/psa_crypto_client.c
vendored
Normal file
@ -0,0 +1,22 @@
|
||||
/*
|
||||
* PSA crypto client code
|
||||
*/
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
|
||||
*/
|
||||
|
||||
#include "common.h"
|
||||
#include "psa/crypto.h"
|
||||
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_CLIENT)
|
||||
|
||||
#include <string.h>
|
||||
#include "mbedtls/platform.h"
|
||||
|
||||
void psa_reset_key_attributes(psa_key_attributes_t *attributes)
|
||||
{
|
||||
memset(attributes, 0, sizeof(*attributes));
|
||||
}
|
||||
|
||||
#endif /* MBEDTLS_PSA_CRYPTO_CLIENT */
|
||||
256
thirdparty/mbedtls/library/psa_crypto_driver_wrappers_no_static.c
vendored
Normal file
256
thirdparty/mbedtls/library/psa_crypto_driver_wrappers_no_static.c
vendored
Normal file
@ -0,0 +1,256 @@
|
||||
/*
|
||||
* Functions to delegate cryptographic operations to an available
|
||||
* and appropriate accelerator.
|
||||
* Warning: This file is now auto-generated.
|
||||
*/
|
||||
/* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
|
||||
*/
|
||||
|
||||
|
||||
/* BEGIN-common headers */
|
||||
#include "common.h"
|
||||
#include "psa_crypto_aead.h"
|
||||
#include "psa_crypto_cipher.h"
|
||||
#include "psa_crypto_core.h"
|
||||
#include "psa_crypto_driver_wrappers_no_static.h"
|
||||
#include "psa_crypto_hash.h"
|
||||
#include "psa_crypto_mac.h"
|
||||
#include "psa_crypto_pake.h"
|
||||
#include "psa_crypto_rsa.h"
|
||||
|
||||
#include "mbedtls/platform.h"
|
||||
/* END-common headers */
|
||||
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_C)
|
||||
|
||||
/* BEGIN-driver headers */
|
||||
/* Headers for mbedtls_test opaque driver */
|
||||
#if defined(PSA_CRYPTO_DRIVER_TEST)
|
||||
#include "test/drivers/test_driver.h"
|
||||
|
||||
#endif
|
||||
/* Headers for mbedtls_test transparent driver */
|
||||
#if defined(PSA_CRYPTO_DRIVER_TEST)
|
||||
#include "test/drivers/test_driver.h"
|
||||
|
||||
#endif
|
||||
/* Headers for p256 transparent driver */
|
||||
#if defined(MBEDTLS_PSA_P256M_DRIVER_ENABLED)
|
||||
#include "../3rdparty/p256-m/p256-m_driver_entrypoints.h"
|
||||
|
||||
#endif
|
||||
|
||||
/* END-driver headers */
|
||||
|
||||
/* Auto-generated values depending on which drivers are registered.
|
||||
* ID 0 is reserved for unallocated operations.
|
||||
* ID 1 is reserved for the Mbed TLS software driver. */
|
||||
/* BEGIN-driver id definition */
|
||||
#define PSA_CRYPTO_MBED_TLS_DRIVER_ID (1)
|
||||
#define MBEDTLS_TEST_OPAQUE_DRIVER_ID (2)
|
||||
#define MBEDTLS_TEST_TRANSPARENT_DRIVER_ID (3)
|
||||
#define P256_TRANSPARENT_DRIVER_ID (4)
|
||||
|
||||
/* END-driver id */
|
||||
|
||||
/* BEGIN-Common Macro definitions */
|
||||
|
||||
/* END-Common Macro definitions */
|
||||
|
||||
/* Support the 'old' SE interface when asked to */
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
|
||||
/* PSA_CRYPTO_DRIVER_PRESENT is defined when either a new-style or old-style
|
||||
* SE driver is present, to avoid unused argument errors at compile time. */
|
||||
#ifndef PSA_CRYPTO_DRIVER_PRESENT
|
||||
#define PSA_CRYPTO_DRIVER_PRESENT
|
||||
#endif
|
||||
#include "psa_crypto_se.h"
|
||||
#endif
|
||||
|
||||
/** Get the key buffer size required to store the key material of a key
|
||||
* associated with an opaque driver.
|
||||
*
|
||||
* \param[in] attributes The key attributes.
|
||||
* \param[out] key_buffer_size Minimum buffer size to contain the key material
|
||||
*
|
||||
* \retval #PSA_SUCCESS
|
||||
* The minimum size for a buffer to contain the key material has been
|
||||
* returned successfully.
|
||||
* \retval #PSA_ERROR_NOT_SUPPORTED
|
||||
* The type and/or the size in bits of the key or the combination of
|
||||
* the two is not supported.
|
||||
* \retval #PSA_ERROR_INVALID_ARGUMENT
|
||||
* The key is declared with a lifetime not known to us.
|
||||
*/
|
||||
psa_status_t psa_driver_wrapper_get_key_buffer_size(
|
||||
const psa_key_attributes_t *attributes,
|
||||
size_t *key_buffer_size )
|
||||
{
|
||||
psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) );
|
||||
psa_key_type_t key_type = psa_get_key_type(attributes);
|
||||
size_t key_bits = psa_get_key_bits(attributes);
|
||||
|
||||
*key_buffer_size = 0;
|
||||
switch( location )
|
||||
{
|
||||
#if defined(PSA_CRYPTO_DRIVER_TEST)
|
||||
case PSA_CRYPTO_TEST_DRIVER_LOCATION:
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS)
|
||||
/* Emulate property 'builtin_key_size' */
|
||||
if( psa_key_id_is_builtin(
|
||||
MBEDTLS_SVC_KEY_ID_GET_KEY_ID(
|
||||
psa_get_key_id( attributes ) ) ) )
|
||||
{
|
||||
*key_buffer_size = sizeof( psa_drv_slot_number_t );
|
||||
return( PSA_SUCCESS );
|
||||
}
|
||||
#endif /* MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS */
|
||||
*key_buffer_size = mbedtls_test_opaque_size_function( key_type,
|
||||
key_bits );
|
||||
return( ( *key_buffer_size != 0 ) ?
|
||||
PSA_SUCCESS : PSA_ERROR_NOT_SUPPORTED );
|
||||
#endif /* PSA_CRYPTO_DRIVER_TEST */
|
||||
|
||||
default:
|
||||
(void)key_type;
|
||||
(void)key_bits;
|
||||
return( PSA_ERROR_INVALID_ARGUMENT );
|
||||
}
|
||||
}
|
||||
|
||||
psa_status_t psa_driver_wrapper_export_public_key(
|
||||
const psa_key_attributes_t *attributes,
|
||||
const uint8_t *key_buffer, size_t key_buffer_size,
|
||||
uint8_t *data, size_t data_size, size_t *data_length )
|
||||
|
||||
{
|
||||
|
||||
psa_status_t status = PSA_ERROR_INVALID_ARGUMENT;
|
||||
psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(
|
||||
psa_get_key_lifetime( attributes ) );
|
||||
|
||||
/* Try dynamically-registered SE interface first */
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
|
||||
const psa_drv_se_t *drv;
|
||||
psa_drv_se_context_t *drv_context;
|
||||
|
||||
if( psa_get_se_driver( psa_get_key_lifetime(attributes), &drv, &drv_context ) )
|
||||
{
|
||||
if( ( drv->key_management == NULL ) ||
|
||||
( drv->key_management->p_export_public == NULL ) )
|
||||
{
|
||||
return( PSA_ERROR_NOT_SUPPORTED );
|
||||
}
|
||||
|
||||
return( drv->key_management->p_export_public(
|
||||
drv_context,
|
||||
*( (psa_key_slot_number_t *)key_buffer ),
|
||||
data, data_size, data_length ) );
|
||||
}
|
||||
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
|
||||
|
||||
switch( location )
|
||||
{
|
||||
case PSA_KEY_LOCATION_LOCAL_STORAGE:
|
||||
/* Key is stored in the slot in export representation, so
|
||||
* cycle through all known transparent accelerators */
|
||||
#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
|
||||
|
||||
#if (defined(PSA_CRYPTO_DRIVER_TEST) )
|
||||
status = mbedtls_test_transparent_export_public_key
|
||||
(attributes,
|
||||
key_buffer,
|
||||
key_buffer_size,
|
||||
data,
|
||||
data_size,
|
||||
data_length
|
||||
);
|
||||
|
||||
if( status != PSA_ERROR_NOT_SUPPORTED )
|
||||
return( status );
|
||||
#endif
|
||||
|
||||
#if (defined(MBEDTLS_PSA_P256M_DRIVER_ENABLED) )
|
||||
status = p256_transparent_export_public_key
|
||||
(attributes,
|
||||
key_buffer,
|
||||
key_buffer_size,
|
||||
data,
|
||||
data_size,
|
||||
data_length
|
||||
);
|
||||
|
||||
if( status != PSA_ERROR_NOT_SUPPORTED )
|
||||
return( status );
|
||||
#endif
|
||||
|
||||
|
||||
#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
|
||||
/* Fell through, meaning no accelerator supports this operation */
|
||||
return( psa_export_public_key_internal( attributes,
|
||||
key_buffer,
|
||||
key_buffer_size,
|
||||
data,
|
||||
data_size,
|
||||
data_length ) );
|
||||
|
||||
/* Add cases for opaque driver here */
|
||||
#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
|
||||
|
||||
#if (defined(PSA_CRYPTO_DRIVER_TEST) )
|
||||
case 0x7fffff:
|
||||
return( mbedtls_test_opaque_export_public_key
|
||||
(attributes,
|
||||
key_buffer,
|
||||
key_buffer_size,
|
||||
data,
|
||||
data_size,
|
||||
data_length
|
||||
));
|
||||
#endif
|
||||
|
||||
|
||||
#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
|
||||
default:
|
||||
/* Key is declared with a lifetime not known to us */
|
||||
return( status );
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
psa_status_t psa_driver_wrapper_get_builtin_key(
|
||||
psa_drv_slot_number_t slot_number,
|
||||
psa_key_attributes_t *attributes,
|
||||
uint8_t *key_buffer, size_t key_buffer_size, size_t *key_buffer_length )
|
||||
{
|
||||
|
||||
psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) );
|
||||
switch( location )
|
||||
{
|
||||
#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
|
||||
|
||||
#if (defined(PSA_CRYPTO_DRIVER_TEST) )
|
||||
case 0x7fffff:
|
||||
return( mbedtls_test_opaque_get_builtin_key
|
||||
(slot_number,
|
||||
attributes,
|
||||
key_buffer,
|
||||
key_buffer_size,
|
||||
key_buffer_length
|
||||
));
|
||||
#endif
|
||||
|
||||
|
||||
#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
|
||||
default:
|
||||
(void) slot_number;
|
||||
(void) key_buffer;
|
||||
(void) key_buffer_size;
|
||||
(void) key_buffer_length;
|
||||
return( PSA_ERROR_DOES_NOT_EXIST );
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
#endif /* MBEDTLS_PSA_CRYPTO_C */
|
||||
596
thirdparty/mbedtls/library/psa_crypto_ecp.c
vendored
Normal file
596
thirdparty/mbedtls/library/psa_crypto_ecp.c
vendored
Normal file
@ -0,0 +1,596 @@
|
||||
/*
|
||||
* PSA ECP layer on top of Mbed TLS crypto
|
||||
*/
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
|
||||
*/
|
||||
|
||||
#include "common.h"
|
||||
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_C)
|
||||
|
||||
#include <psa/crypto.h>
|
||||
#include "psa_crypto_core.h"
|
||||
#include "psa_crypto_ecp.h"
|
||||
#include "psa_crypto_random_impl.h"
|
||||
#include "mbedtls/psa_util.h"
|
||||
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include "mbedtls/platform.h"
|
||||
|
||||
#include <mbedtls/ecdsa.h>
|
||||
#include <mbedtls/ecdh.h>
|
||||
#include <mbedtls/ecp.h>
|
||||
#include <mbedtls/error.h>
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_BASIC) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
|
||||
/* Helper function to verify if the provided EC's family and key bit size are valid.
|
||||
*
|
||||
* Note: "bits" parameter is used both as input and output and it might be updated
|
||||
* in case provided input value is not multiple of 8 ("sloppy" bits).
|
||||
*/
|
||||
static int check_ecc_parameters(psa_ecc_family_t family, size_t *bits)
|
||||
{
|
||||
switch (family) {
|
||||
case PSA_ECC_FAMILY_SECP_R1:
|
||||
switch (*bits) {
|
||||
case 192:
|
||||
case 224:
|
||||
case 256:
|
||||
case 384:
|
||||
case 521:
|
||||
return PSA_SUCCESS;
|
||||
case 528:
|
||||
*bits = 521;
|
||||
return PSA_SUCCESS;
|
||||
}
|
||||
break;
|
||||
|
||||
case PSA_ECC_FAMILY_BRAINPOOL_P_R1:
|
||||
switch (*bits) {
|
||||
case 256:
|
||||
case 384:
|
||||
case 512:
|
||||
return PSA_SUCCESS;
|
||||
}
|
||||
break;
|
||||
|
||||
case PSA_ECC_FAMILY_MONTGOMERY:
|
||||
switch (*bits) {
|
||||
case 448:
|
||||
case 255:
|
||||
return PSA_SUCCESS;
|
||||
case 256:
|
||||
*bits = 255;
|
||||
return PSA_SUCCESS;
|
||||
}
|
||||
break;
|
||||
|
||||
case PSA_ECC_FAMILY_SECP_K1:
|
||||
switch (*bits) {
|
||||
case 192:
|
||||
/* secp224k1 is not and will not be supported in PSA (#3541). */
|
||||
case 256:
|
||||
return PSA_SUCCESS;
|
||||
}
|
||||
break;
|
||||
}
|
||||
|
||||
return PSA_ERROR_INVALID_ARGUMENT;
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_ecp_load_representation(
|
||||
psa_key_type_t type, size_t curve_bits,
|
||||
const uint8_t *data, size_t data_length,
|
||||
mbedtls_ecp_keypair **p_ecp)
|
||||
{
|
||||
mbedtls_ecp_group_id grp_id = MBEDTLS_ECP_DP_NONE;
|
||||
psa_status_t status;
|
||||
mbedtls_ecp_keypair *ecp = NULL;
|
||||
size_t curve_bytes = data_length;
|
||||
int explicit_bits = (curve_bits != 0);
|
||||
|
||||
if (PSA_KEY_TYPE_IS_PUBLIC_KEY(type) &&
|
||||
PSA_KEY_TYPE_ECC_GET_FAMILY(type) != PSA_ECC_FAMILY_MONTGOMERY) {
|
||||
/* A Weierstrass public key is represented as:
|
||||
* - The byte 0x04;
|
||||
* - `x_P` as a `ceiling(m/8)`-byte string, big-endian;
|
||||
* - `y_P` as a `ceiling(m/8)`-byte string, big-endian.
|
||||
* So its data length is 2m+1 where m is the curve size in bits.
|
||||
*/
|
||||
if ((data_length & 1) == 0) {
|
||||
return PSA_ERROR_INVALID_ARGUMENT;
|
||||
}
|
||||
curve_bytes = data_length / 2;
|
||||
|
||||
/* Montgomery public keys are represented in compressed format, meaning
|
||||
* their curve_bytes is equal to the amount of input. */
|
||||
|
||||
/* Private keys are represented in uncompressed private random integer
|
||||
* format, meaning their curve_bytes is equal to the amount of input. */
|
||||
}
|
||||
|
||||
if (explicit_bits) {
|
||||
/* With an explicit bit-size, the data must have the matching length. */
|
||||
if (curve_bytes != PSA_BITS_TO_BYTES(curve_bits)) {
|
||||
return PSA_ERROR_INVALID_ARGUMENT;
|
||||
}
|
||||
} else {
|
||||
/* We need to infer the bit-size from the data. Since the only
|
||||
* information we have is the length in bytes, the value of curve_bits
|
||||
* at this stage is rounded up to the nearest multiple of 8. */
|
||||
curve_bits = PSA_BYTES_TO_BITS(curve_bytes);
|
||||
}
|
||||
|
||||
/* Allocate and initialize a key representation. */
|
||||
ecp = mbedtls_calloc(1, sizeof(mbedtls_ecp_keypair));
|
||||
if (ecp == NULL) {
|
||||
return PSA_ERROR_INSUFFICIENT_MEMORY;
|
||||
}
|
||||
mbedtls_ecp_keypair_init(ecp);
|
||||
|
||||
status = check_ecc_parameters(PSA_KEY_TYPE_ECC_GET_FAMILY(type), &curve_bits);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
/* Load the group. */
|
||||
grp_id = mbedtls_ecc_group_from_psa(PSA_KEY_TYPE_ECC_GET_FAMILY(type),
|
||||
curve_bits);
|
||||
if (grp_id == MBEDTLS_ECP_DP_NONE) {
|
||||
status = PSA_ERROR_NOT_SUPPORTED;
|
||||
goto exit;
|
||||
}
|
||||
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_ecp_group_load(&ecp->grp, grp_id));
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
/* Load the key material. */
|
||||
if (PSA_KEY_TYPE_IS_PUBLIC_KEY(type)) {
|
||||
/* Load the public value. */
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_ecp_point_read_binary(&ecp->grp, &ecp->Q,
|
||||
data,
|
||||
data_length));
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
/* Check that the point is on the curve. */
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_ecp_check_pubkey(&ecp->grp, &ecp->Q));
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
} else {
|
||||
/* Load and validate the secret value. */
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_ecp_read_key(ecp->grp.id,
|
||||
ecp,
|
||||
data,
|
||||
data_length));
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
}
|
||||
|
||||
*p_ecp = ecp;
|
||||
exit:
|
||||
if (status != PSA_SUCCESS) {
|
||||
mbedtls_ecp_keypair_free(ecp);
|
||||
mbedtls_free(ecp);
|
||||
}
|
||||
|
||||
return status;
|
||||
}
|
||||
#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_BASIC) ||
|
||||
* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT) ||
|
||||
* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT) ||
|
||||
* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) ||
|
||||
* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
|
||||
* defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) ||
|
||||
* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH) */
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)
|
||||
|
||||
psa_status_t mbedtls_psa_ecp_import_key(
|
||||
const psa_key_attributes_t *attributes,
|
||||
const uint8_t *data, size_t data_length,
|
||||
uint8_t *key_buffer, size_t key_buffer_size,
|
||||
size_t *key_buffer_length, size_t *bits)
|
||||
{
|
||||
psa_status_t status;
|
||||
mbedtls_ecp_keypair *ecp = NULL;
|
||||
|
||||
/* Parse input */
|
||||
status = mbedtls_psa_ecp_load_representation(attributes->type,
|
||||
attributes->bits,
|
||||
data,
|
||||
data_length,
|
||||
&ecp);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
if (PSA_KEY_TYPE_ECC_GET_FAMILY(attributes->type) ==
|
||||
PSA_ECC_FAMILY_MONTGOMERY) {
|
||||
*bits = ecp->grp.nbits + 1;
|
||||
} else {
|
||||
*bits = ecp->grp.nbits;
|
||||
}
|
||||
|
||||
/* Re-export the data to PSA export format. There is currently no support
|
||||
* for other input formats then the export format, so this is a 1-1
|
||||
* copy operation. */
|
||||
status = mbedtls_psa_ecp_export_key(attributes->type,
|
||||
ecp,
|
||||
key_buffer,
|
||||
key_buffer_size,
|
||||
key_buffer_length);
|
||||
exit:
|
||||
/* Always free the PK object (will also free contained ECP context) */
|
||||
mbedtls_ecp_keypair_free(ecp);
|
||||
mbedtls_free(ecp);
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_ecp_export_key(psa_key_type_t type,
|
||||
mbedtls_ecp_keypair *ecp,
|
||||
uint8_t *data,
|
||||
size_t data_size,
|
||||
size_t *data_length)
|
||||
{
|
||||
psa_status_t status;
|
||||
|
||||
if (PSA_KEY_TYPE_IS_PUBLIC_KEY(type)) {
|
||||
/* Check whether the public part is loaded */
|
||||
if (mbedtls_ecp_is_zero(&ecp->Q)) {
|
||||
/* Calculate the public key */
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_ecp_mul(&ecp->grp, &ecp->Q, &ecp->d, &ecp->grp.G,
|
||||
mbedtls_psa_get_random,
|
||||
MBEDTLS_PSA_RANDOM_STATE));
|
||||
if (status != PSA_SUCCESS) {
|
||||
return status;
|
||||
}
|
||||
}
|
||||
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_ecp_point_write_binary(&ecp->grp, &ecp->Q,
|
||||
MBEDTLS_ECP_PF_UNCOMPRESSED,
|
||||
data_length,
|
||||
data,
|
||||
data_size));
|
||||
if (status != PSA_SUCCESS) {
|
||||
memset(data, 0, data_size);
|
||||
}
|
||||
|
||||
return status;
|
||||
} else {
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_ecp_write_key_ext(ecp, data_length, data, data_size));
|
||||
return status;
|
||||
}
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_ecp_export_public_key(
|
||||
const psa_key_attributes_t *attributes,
|
||||
const uint8_t *key_buffer, size_t key_buffer_size,
|
||||
uint8_t *data, size_t data_size, size_t *data_length)
|
||||
{
|
||||
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
mbedtls_ecp_keypair *ecp = NULL;
|
||||
|
||||
status = mbedtls_psa_ecp_load_representation(
|
||||
attributes->type, attributes->bits,
|
||||
key_buffer, key_buffer_size, &ecp);
|
||||
if (status != PSA_SUCCESS) {
|
||||
return status;
|
||||
}
|
||||
|
||||
status = mbedtls_psa_ecp_export_key(
|
||||
PSA_KEY_TYPE_ECC_PUBLIC_KEY(
|
||||
PSA_KEY_TYPE_ECC_GET_FAMILY(attributes->type)),
|
||||
ecp, data, data_size, data_length);
|
||||
|
||||
mbedtls_ecp_keypair_free(ecp);
|
||||
mbedtls_free(ecp);
|
||||
|
||||
return status;
|
||||
}
|
||||
#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT) ||
|
||||
* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT) ||
|
||||
* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_GENERATE)
|
||||
psa_status_t mbedtls_psa_ecp_generate_key(
|
||||
const psa_key_attributes_t *attributes,
|
||||
uint8_t *key_buffer, size_t key_buffer_size, size_t *key_buffer_length)
|
||||
{
|
||||
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
||||
|
||||
psa_ecc_family_t curve = PSA_KEY_TYPE_ECC_GET_FAMILY(
|
||||
attributes->type);
|
||||
mbedtls_ecp_group_id grp_id =
|
||||
mbedtls_ecc_group_from_psa(curve, attributes->bits);
|
||||
|
||||
const mbedtls_ecp_curve_info *curve_info =
|
||||
mbedtls_ecp_curve_info_from_grp_id(grp_id);
|
||||
mbedtls_ecp_keypair ecp;
|
||||
|
||||
if (grp_id == MBEDTLS_ECP_DP_NONE || curve_info == NULL) {
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
|
||||
mbedtls_ecp_keypair_init(&ecp);
|
||||
ret = mbedtls_ecp_gen_key(grp_id, &ecp,
|
||||
mbedtls_psa_get_random,
|
||||
MBEDTLS_PSA_RANDOM_STATE);
|
||||
if (ret != 0) {
|
||||
mbedtls_ecp_keypair_free(&ecp);
|
||||
return mbedtls_to_psa_error(ret);
|
||||
}
|
||||
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_ecp_write_key_ext(&ecp, key_buffer_length,
|
||||
key_buffer, key_buffer_size));
|
||||
|
||||
mbedtls_ecp_keypair_free(&ecp);
|
||||
|
||||
return status;
|
||||
}
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_GENERATE */
|
||||
|
||||
/****************************************************************/
|
||||
/* ECDSA sign/verify */
|
||||
/****************************************************************/
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
|
||||
psa_status_t mbedtls_psa_ecdsa_sign_hash(
|
||||
const psa_key_attributes_t *attributes,
|
||||
const uint8_t *key_buffer, size_t key_buffer_size,
|
||||
psa_algorithm_t alg, const uint8_t *hash, size_t hash_length,
|
||||
uint8_t *signature, size_t signature_size, size_t *signature_length)
|
||||
{
|
||||
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
mbedtls_ecp_keypair *ecp = NULL;
|
||||
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
||||
size_t curve_bytes;
|
||||
mbedtls_mpi r, s;
|
||||
|
||||
status = mbedtls_psa_ecp_load_representation(attributes->type,
|
||||
attributes->bits,
|
||||
key_buffer,
|
||||
key_buffer_size,
|
||||
&ecp);
|
||||
if (status != PSA_SUCCESS) {
|
||||
return status;
|
||||
}
|
||||
|
||||
curve_bytes = PSA_BITS_TO_BYTES(ecp->grp.pbits);
|
||||
mbedtls_mpi_init(&r);
|
||||
mbedtls_mpi_init(&s);
|
||||
|
||||
if (signature_size < 2 * curve_bytes) {
|
||||
ret = MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL;
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
if (PSA_ALG_ECDSA_IS_DETERMINISTIC(alg)) {
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
|
||||
psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH(alg);
|
||||
mbedtls_md_type_t md_alg = mbedtls_md_type_from_psa_alg(hash_alg);
|
||||
MBEDTLS_MPI_CHK(mbedtls_ecdsa_sign_det_ext(
|
||||
&ecp->grp, &r, &s,
|
||||
&ecp->d, hash,
|
||||
hash_length, md_alg,
|
||||
mbedtls_psa_get_random,
|
||||
MBEDTLS_PSA_RANDOM_STATE));
|
||||
#else
|
||||
ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE;
|
||||
goto cleanup;
|
||||
#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
|
||||
} else {
|
||||
(void) alg;
|
||||
MBEDTLS_MPI_CHK(mbedtls_ecdsa_sign(&ecp->grp, &r, &s, &ecp->d,
|
||||
hash, hash_length,
|
||||
mbedtls_psa_get_random,
|
||||
MBEDTLS_PSA_RANDOM_STATE));
|
||||
}
|
||||
|
||||
MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary(&r,
|
||||
signature,
|
||||
curve_bytes));
|
||||
MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary(&s,
|
||||
signature + curve_bytes,
|
||||
curve_bytes));
|
||||
cleanup:
|
||||
mbedtls_mpi_free(&r);
|
||||
mbedtls_mpi_free(&s);
|
||||
if (ret == 0) {
|
||||
*signature_length = 2 * curve_bytes;
|
||||
}
|
||||
|
||||
mbedtls_ecp_keypair_free(ecp);
|
||||
mbedtls_free(ecp);
|
||||
|
||||
return mbedtls_to_psa_error(ret);
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_ecp_load_public_part(mbedtls_ecp_keypair *ecp)
|
||||
{
|
||||
int ret = 0;
|
||||
|
||||
/* Check whether the public part is loaded. If not, load it. */
|
||||
if (mbedtls_ecp_is_zero(&ecp->Q)) {
|
||||
ret = mbedtls_ecp_mul(&ecp->grp, &ecp->Q,
|
||||
&ecp->d, &ecp->grp.G,
|
||||
mbedtls_psa_get_random,
|
||||
MBEDTLS_PSA_RANDOM_STATE);
|
||||
}
|
||||
|
||||
return mbedtls_to_psa_error(ret);
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_ecdsa_verify_hash(
|
||||
const psa_key_attributes_t *attributes,
|
||||
const uint8_t *key_buffer, size_t key_buffer_size,
|
||||
psa_algorithm_t alg, const uint8_t *hash, size_t hash_length,
|
||||
const uint8_t *signature, size_t signature_length)
|
||||
{
|
||||
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
mbedtls_ecp_keypair *ecp = NULL;
|
||||
size_t curve_bytes;
|
||||
mbedtls_mpi r, s;
|
||||
|
||||
(void) alg;
|
||||
|
||||
status = mbedtls_psa_ecp_load_representation(attributes->type,
|
||||
attributes->bits,
|
||||
key_buffer,
|
||||
key_buffer_size,
|
||||
&ecp);
|
||||
if (status != PSA_SUCCESS) {
|
||||
return status;
|
||||
}
|
||||
|
||||
curve_bytes = PSA_BITS_TO_BYTES(ecp->grp.pbits);
|
||||
mbedtls_mpi_init(&r);
|
||||
mbedtls_mpi_init(&s);
|
||||
|
||||
if (signature_length != 2 * curve_bytes) {
|
||||
status = PSA_ERROR_INVALID_SIGNATURE;
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
status = mbedtls_to_psa_error(mbedtls_mpi_read_binary(&r,
|
||||
signature,
|
||||
curve_bytes));
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
status = mbedtls_to_psa_error(mbedtls_mpi_read_binary(&s,
|
||||
signature + curve_bytes,
|
||||
curve_bytes));
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
status = mbedtls_psa_ecp_load_public_part(ecp);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
status = mbedtls_to_psa_error(mbedtls_ecdsa_verify(&ecp->grp, hash,
|
||||
hash_length, &ecp->Q,
|
||||
&r, &s));
|
||||
cleanup:
|
||||
mbedtls_mpi_free(&r);
|
||||
mbedtls_mpi_free(&s);
|
||||
mbedtls_ecp_keypair_free(ecp);
|
||||
mbedtls_free(ecp);
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
|
||||
* defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
|
||||
|
||||
/****************************************************************/
|
||||
/* ECDH Key Agreement */
|
||||
/****************************************************************/
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
|
||||
psa_status_t mbedtls_psa_key_agreement_ecdh(
|
||||
const psa_key_attributes_t *attributes,
|
||||
const uint8_t *key_buffer, size_t key_buffer_size,
|
||||
psa_algorithm_t alg, const uint8_t *peer_key, size_t peer_key_length,
|
||||
uint8_t *shared_secret, size_t shared_secret_size,
|
||||
size_t *shared_secret_length)
|
||||
{
|
||||
psa_status_t status;
|
||||
if (!PSA_KEY_TYPE_IS_ECC_KEY_PAIR(attributes->type) ||
|
||||
!PSA_ALG_IS_ECDH(alg)) {
|
||||
return PSA_ERROR_INVALID_ARGUMENT;
|
||||
}
|
||||
mbedtls_ecp_keypair *ecp = NULL;
|
||||
status = mbedtls_psa_ecp_load_representation(
|
||||
attributes->type,
|
||||
attributes->bits,
|
||||
key_buffer,
|
||||
key_buffer_size,
|
||||
&ecp);
|
||||
if (status != PSA_SUCCESS) {
|
||||
return status;
|
||||
}
|
||||
mbedtls_ecp_keypair *their_key = NULL;
|
||||
mbedtls_ecdh_context ecdh;
|
||||
size_t bits = 0;
|
||||
psa_ecc_family_t curve = mbedtls_ecc_group_to_psa(ecp->grp.id, &bits);
|
||||
mbedtls_ecdh_init(&ecdh);
|
||||
|
||||
status = mbedtls_psa_ecp_load_representation(
|
||||
PSA_KEY_TYPE_ECC_PUBLIC_KEY(curve),
|
||||
bits,
|
||||
peer_key,
|
||||
peer_key_length,
|
||||
&their_key);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_ecdh_get_params(&ecdh, their_key, MBEDTLS_ECDH_THEIRS));
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_ecdh_get_params(&ecdh, ecp, MBEDTLS_ECDH_OURS));
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_ecdh_calc_secret(&ecdh,
|
||||
shared_secret_length,
|
||||
shared_secret, shared_secret_size,
|
||||
mbedtls_psa_get_random,
|
||||
MBEDTLS_PSA_RANDOM_STATE));
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
if (PSA_BITS_TO_BYTES(bits) != *shared_secret_length) {
|
||||
status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
}
|
||||
exit:
|
||||
if (status != PSA_SUCCESS) {
|
||||
mbedtls_platform_zeroize(shared_secret, shared_secret_size);
|
||||
}
|
||||
mbedtls_ecdh_free(&ecdh);
|
||||
mbedtls_ecp_keypair_free(their_key);
|
||||
mbedtls_free(their_key);
|
||||
mbedtls_ecp_keypair_free(ecp);
|
||||
mbedtls_free(ecp);
|
||||
return status;
|
||||
}
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_ECDH */
|
||||
|
||||
|
||||
#endif /* MBEDTLS_PSA_CRYPTO_C */
|
||||
321
thirdparty/mbedtls/library/psa_crypto_ffdh.c
vendored
Normal file
321
thirdparty/mbedtls/library/psa_crypto_ffdh.c
vendored
Normal file
@ -0,0 +1,321 @@
|
||||
/*
|
||||
* PSA FFDH layer on top of Mbed TLS crypto
|
||||
*/
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
|
||||
*/
|
||||
|
||||
#include "common.h"
|
||||
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_C)
|
||||
|
||||
/* This header is only needed because it defines
|
||||
* MBEDTLS_DHM_RFC7919_FFDHEXXXX_[P|G]_BIN symbols that are used in
|
||||
* mbedtls_psa_ffdh_set_prime_generator(). Apart from that, this module
|
||||
* only uses bignum functions for arithmetic. */
|
||||
#include <mbedtls/dhm.h>
|
||||
|
||||
#include <psa/crypto.h>
|
||||
#include "psa_crypto_core.h"
|
||||
#include "psa_crypto_ffdh.h"
|
||||
#include "psa_crypto_random_impl.h"
|
||||
#include "mbedtls/platform.h"
|
||||
#include "mbedtls/error.h"
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_EXPORT) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_GENERATE) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_FFDH)
|
||||
static psa_status_t mbedtls_psa_ffdh_set_prime_generator(size_t key_size,
|
||||
mbedtls_mpi *P,
|
||||
mbedtls_mpi *G)
|
||||
{
|
||||
const unsigned char *dhm_P = NULL;
|
||||
const unsigned char *dhm_G = NULL;
|
||||
size_t dhm_size_P = 0;
|
||||
size_t dhm_size_G = 0;
|
||||
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
||||
|
||||
if (P == NULL && G == NULL) {
|
||||
return PSA_ERROR_INVALID_ARGUMENT;
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_DH_RFC7919_2048)
|
||||
static const unsigned char dhm_P_2048[] =
|
||||
MBEDTLS_DHM_RFC7919_FFDHE2048_P_BIN;
|
||||
static const unsigned char dhm_G_2048[] =
|
||||
MBEDTLS_DHM_RFC7919_FFDHE2048_G_BIN;
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_DH_RFC7919_2048 */
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_DH_RFC7919_3072)
|
||||
static const unsigned char dhm_P_3072[] =
|
||||
MBEDTLS_DHM_RFC7919_FFDHE3072_P_BIN;
|
||||
static const unsigned char dhm_G_3072[] =
|
||||
MBEDTLS_DHM_RFC7919_FFDHE3072_G_BIN;
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_DH_RFC7919_3072 */
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_DH_RFC7919_4096)
|
||||
static const unsigned char dhm_P_4096[] =
|
||||
MBEDTLS_DHM_RFC7919_FFDHE4096_P_BIN;
|
||||
static const unsigned char dhm_G_4096[] =
|
||||
MBEDTLS_DHM_RFC7919_FFDHE4096_G_BIN;
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_DH_RFC7919_4096 */
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_DH_RFC7919_6144)
|
||||
static const unsigned char dhm_P_6144[] =
|
||||
MBEDTLS_DHM_RFC7919_FFDHE6144_P_BIN;
|
||||
static const unsigned char dhm_G_6144[] =
|
||||
MBEDTLS_DHM_RFC7919_FFDHE6144_G_BIN;
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_DH_RFC7919_6144 */
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_DH_RFC7919_8192)
|
||||
static const unsigned char dhm_P_8192[] =
|
||||
MBEDTLS_DHM_RFC7919_FFDHE8192_P_BIN;
|
||||
static const unsigned char dhm_G_8192[] =
|
||||
MBEDTLS_DHM_RFC7919_FFDHE8192_G_BIN;
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_DH_RFC7919_8192 */
|
||||
|
||||
switch (key_size) {
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_DH_RFC7919_2048)
|
||||
case sizeof(dhm_P_2048):
|
||||
dhm_P = dhm_P_2048;
|
||||
dhm_G = dhm_G_2048;
|
||||
dhm_size_P = sizeof(dhm_P_2048);
|
||||
dhm_size_G = sizeof(dhm_G_2048);
|
||||
break;
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_DH_RFC7919_2048 */
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_DH_RFC7919_3072)
|
||||
case sizeof(dhm_P_3072):
|
||||
dhm_P = dhm_P_3072;
|
||||
dhm_G = dhm_G_3072;
|
||||
dhm_size_P = sizeof(dhm_P_3072);
|
||||
dhm_size_G = sizeof(dhm_G_3072);
|
||||
break;
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_DH_RFC7919_3072 */
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_DH_RFC7919_4096)
|
||||
case sizeof(dhm_P_4096):
|
||||
dhm_P = dhm_P_4096;
|
||||
dhm_G = dhm_G_4096;
|
||||
dhm_size_P = sizeof(dhm_P_4096);
|
||||
dhm_size_G = sizeof(dhm_G_4096);
|
||||
break;
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_DH_RFC7919_4096 */
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_DH_RFC7919_6144)
|
||||
case sizeof(dhm_P_6144):
|
||||
dhm_P = dhm_P_6144;
|
||||
dhm_G = dhm_G_6144;
|
||||
dhm_size_P = sizeof(dhm_P_6144);
|
||||
dhm_size_G = sizeof(dhm_G_6144);
|
||||
break;
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_DH_RFC7919_6144 */
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_DH_RFC7919_8192)
|
||||
case sizeof(dhm_P_8192):
|
||||
dhm_P = dhm_P_8192;
|
||||
dhm_G = dhm_G_8192;
|
||||
dhm_size_P = sizeof(dhm_P_8192);
|
||||
dhm_size_G = sizeof(dhm_G_8192);
|
||||
break;
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_DH_RFC7919_8192 */
|
||||
default:
|
||||
return PSA_ERROR_INVALID_ARGUMENT;
|
||||
}
|
||||
|
||||
if (P != NULL) {
|
||||
MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary(P, dhm_P,
|
||||
dhm_size_P));
|
||||
}
|
||||
if (G != NULL) {
|
||||
MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary(G, dhm_G,
|
||||
dhm_size_G));
|
||||
}
|
||||
|
||||
cleanup:
|
||||
if (ret != 0) {
|
||||
return mbedtls_to_psa_error(ret);
|
||||
}
|
||||
|
||||
return PSA_SUCCESS;
|
||||
}
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_EXPORT ||
|
||||
MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_GENERATE ||
|
||||
MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY ||
|
||||
MBEDTLS_PSA_BUILTIN_ALG_FFDH */
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_EXPORT) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY)
|
||||
psa_status_t mbedtls_psa_ffdh_export_public_key(
|
||||
const psa_key_attributes_t *attributes,
|
||||
const uint8_t *key_buffer,
|
||||
size_t key_buffer_size,
|
||||
uint8_t *data,
|
||||
size_t data_size,
|
||||
size_t *data_length)
|
||||
{
|
||||
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
||||
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
mbedtls_mpi GX, G, X, P;
|
||||
psa_key_type_t type = attributes->type;
|
||||
|
||||
if (PSA_KEY_TYPE_IS_PUBLIC_KEY(type)) {
|
||||
if (key_buffer_size > data_size) {
|
||||
return PSA_ERROR_BUFFER_TOO_SMALL;
|
||||
}
|
||||
memcpy(data, key_buffer, key_buffer_size);
|
||||
memset(data + key_buffer_size, 0,
|
||||
data_size - key_buffer_size);
|
||||
*data_length = key_buffer_size;
|
||||
return PSA_SUCCESS;
|
||||
}
|
||||
|
||||
mbedtls_mpi_init(&GX); mbedtls_mpi_init(&G);
|
||||
mbedtls_mpi_init(&X); mbedtls_mpi_init(&P);
|
||||
|
||||
size_t key_len = PSA_BITS_TO_BYTES(attributes->bits);
|
||||
|
||||
status = mbedtls_psa_ffdh_set_prime_generator(key_len, &P, &G);
|
||||
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary(&X, key_buffer,
|
||||
key_buffer_size));
|
||||
|
||||
MBEDTLS_MPI_CHK(mbedtls_mpi_exp_mod(&GX, &G, &X, &P, NULL));
|
||||
MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary(&GX, data, key_len));
|
||||
|
||||
*data_length = key_len;
|
||||
|
||||
ret = 0;
|
||||
cleanup:
|
||||
mbedtls_mpi_free(&P); mbedtls_mpi_free(&G);
|
||||
mbedtls_mpi_free(&X); mbedtls_mpi_free(&GX);
|
||||
|
||||
if (status == PSA_SUCCESS && ret != 0) {
|
||||
status = mbedtls_to_psa_error(ret);
|
||||
}
|
||||
|
||||
return status;
|
||||
}
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_EXPORT ||
|
||||
MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY */
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_GENERATE)
|
||||
psa_status_t mbedtls_psa_ffdh_generate_key(
|
||||
const psa_key_attributes_t *attributes,
|
||||
uint8_t *key_buffer, size_t key_buffer_size, size_t *key_buffer_length)
|
||||
{
|
||||
mbedtls_mpi X, P;
|
||||
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
||||
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
mbedtls_mpi_init(&P); mbedtls_mpi_init(&X);
|
||||
(void) attributes;
|
||||
|
||||
status = mbedtls_psa_ffdh_set_prime_generator(key_buffer_size, &P, NULL);
|
||||
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
/* RFC7919: Traditional finite field Diffie-Hellman has each peer choose their
|
||||
secret exponent from the range [2, P-2].
|
||||
Select random value in range [3, P-1] and decrease it by 1. */
|
||||
MBEDTLS_MPI_CHK(mbedtls_mpi_random(&X, 3, &P, mbedtls_psa_get_random,
|
||||
MBEDTLS_PSA_RANDOM_STATE));
|
||||
MBEDTLS_MPI_CHK(mbedtls_mpi_sub_int(&X, &X, 1));
|
||||
MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary(&X, key_buffer, key_buffer_size));
|
||||
*key_buffer_length = key_buffer_size;
|
||||
|
||||
cleanup:
|
||||
mbedtls_mpi_free(&P); mbedtls_mpi_free(&X);
|
||||
if (status == PSA_SUCCESS && ret != 0) {
|
||||
return mbedtls_to_psa_error(ret);
|
||||
}
|
||||
|
||||
return status;
|
||||
}
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_GENERATE */
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT)
|
||||
psa_status_t mbedtls_psa_ffdh_import_key(
|
||||
const psa_key_attributes_t *attributes,
|
||||
const uint8_t *data, size_t data_length,
|
||||
uint8_t *key_buffer, size_t key_buffer_size,
|
||||
size_t *key_buffer_length, size_t *bits)
|
||||
{
|
||||
(void) attributes;
|
||||
|
||||
if (key_buffer_size < data_length) {
|
||||
return PSA_ERROR_BUFFER_TOO_SMALL;
|
||||
}
|
||||
memcpy(key_buffer, data, data_length);
|
||||
*key_buffer_length = data_length;
|
||||
*bits = PSA_BYTES_TO_BITS(data_length);
|
||||
|
||||
return PSA_SUCCESS;
|
||||
}
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT */
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_FFDH)
|
||||
psa_status_t mbedtls_psa_ffdh_key_agreement(
|
||||
const psa_key_attributes_t *attributes,
|
||||
const uint8_t *peer_key,
|
||||
size_t peer_key_length,
|
||||
const uint8_t *key_buffer,
|
||||
size_t key_buffer_size,
|
||||
uint8_t *shared_secret,
|
||||
size_t shared_secret_size,
|
||||
size_t *shared_secret_length)
|
||||
{
|
||||
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
||||
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
mbedtls_mpi P, G, X, GY, K;
|
||||
const size_t calculated_shared_secret_size = peer_key_length;
|
||||
|
||||
if (peer_key_length != key_buffer_size ||
|
||||
calculated_shared_secret_size > shared_secret_size) {
|
||||
return PSA_ERROR_INVALID_ARGUMENT;
|
||||
}
|
||||
|
||||
if (!PSA_KEY_TYPE_IS_DH_KEY_PAIR(psa_get_key_type(attributes))) {
|
||||
return PSA_ERROR_INVALID_ARGUMENT;
|
||||
}
|
||||
|
||||
mbedtls_mpi_init(&P); mbedtls_mpi_init(&G);
|
||||
mbedtls_mpi_init(&X); mbedtls_mpi_init(&GY);
|
||||
mbedtls_mpi_init(&K);
|
||||
|
||||
status = mbedtls_psa_ffdh_set_prime_generator(
|
||||
PSA_BITS_TO_BYTES(attributes->bits), &P, &G);
|
||||
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary(&X, key_buffer,
|
||||
key_buffer_size));
|
||||
|
||||
MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary(&GY, peer_key,
|
||||
peer_key_length));
|
||||
|
||||
/* Calculate shared secret public key: K = G^(XY) mod P = GY^X mod P */
|
||||
MBEDTLS_MPI_CHK(mbedtls_mpi_exp_mod(&K, &GY, &X, &P, NULL));
|
||||
|
||||
MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary(&K, shared_secret,
|
||||
calculated_shared_secret_size));
|
||||
|
||||
*shared_secret_length = calculated_shared_secret_size;
|
||||
|
||||
ret = 0;
|
||||
|
||||
cleanup:
|
||||
mbedtls_mpi_free(&P); mbedtls_mpi_free(&G);
|
||||
mbedtls_mpi_free(&X); mbedtls_mpi_free(&GY);
|
||||
mbedtls_mpi_free(&K);
|
||||
|
||||
if (status == PSA_SUCCESS && ret != 0) {
|
||||
status = mbedtls_to_psa_error(ret);
|
||||
}
|
||||
|
||||
return status;
|
||||
}
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_FFDH */
|
||||
|
||||
#endif /* MBEDTLS_PSA_CRYPTO_C */
|
||||
470
thirdparty/mbedtls/library/psa_crypto_hash.c
vendored
Normal file
470
thirdparty/mbedtls/library/psa_crypto_hash.c
vendored
Normal file
@ -0,0 +1,470 @@
|
||||
/*
|
||||
* PSA hashing layer on top of Mbed TLS software crypto
|
||||
*/
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
|
||||
*/
|
||||
|
||||
#include "common.h"
|
||||
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_C)
|
||||
|
||||
#include <psa/crypto.h>
|
||||
#include "psa_crypto_core.h"
|
||||
#include "psa_crypto_hash.h"
|
||||
|
||||
#include <mbedtls/error.h>
|
||||
#include <string.h>
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_HASH)
|
||||
psa_status_t mbedtls_psa_hash_abort(
|
||||
mbedtls_psa_hash_operation_t *operation)
|
||||
{
|
||||
switch (operation->alg) {
|
||||
case 0:
|
||||
/* The object has (apparently) been initialized but it is not
|
||||
* in use. It's ok to call abort on such an object, and there's
|
||||
* nothing to do. */
|
||||
break;
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD5)
|
||||
case PSA_ALG_MD5:
|
||||
mbedtls_md5_free(&operation->ctx.md5);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160)
|
||||
case PSA_ALG_RIPEMD160:
|
||||
mbedtls_ripemd160_free(&operation->ctx.ripemd160);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_1)
|
||||
case PSA_ALG_SHA_1:
|
||||
mbedtls_sha1_free(&operation->ctx.sha1);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_224)
|
||||
case PSA_ALG_SHA_224:
|
||||
mbedtls_sha256_free(&operation->ctx.sha256);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_256)
|
||||
case PSA_ALG_SHA_256:
|
||||
mbedtls_sha256_free(&operation->ctx.sha256);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_384)
|
||||
case PSA_ALG_SHA_384:
|
||||
mbedtls_sha512_free(&operation->ctx.sha512);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_512)
|
||||
case PSA_ALG_SHA_512:
|
||||
mbedtls_sha512_free(&operation->ctx.sha512);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_224)
|
||||
case PSA_ALG_SHA3_224:
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_256)
|
||||
case PSA_ALG_SHA3_256:
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_384)
|
||||
case PSA_ALG_SHA3_384:
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_512)
|
||||
case PSA_ALG_SHA3_512:
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_224) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_256) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_384) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_512)
|
||||
mbedtls_sha3_free(&operation->ctx.sha3);
|
||||
break;
|
||||
#endif
|
||||
default:
|
||||
return PSA_ERROR_BAD_STATE;
|
||||
}
|
||||
operation->alg = 0;
|
||||
return PSA_SUCCESS;
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_hash_setup(
|
||||
mbedtls_psa_hash_operation_t *operation,
|
||||
psa_algorithm_t alg)
|
||||
{
|
||||
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
||||
|
||||
/* A context must be freshly initialized before it can be set up. */
|
||||
if (operation->alg != 0) {
|
||||
return PSA_ERROR_BAD_STATE;
|
||||
}
|
||||
|
||||
switch (alg) {
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD5)
|
||||
case PSA_ALG_MD5:
|
||||
mbedtls_md5_init(&operation->ctx.md5);
|
||||
ret = mbedtls_md5_starts(&operation->ctx.md5);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160)
|
||||
case PSA_ALG_RIPEMD160:
|
||||
mbedtls_ripemd160_init(&operation->ctx.ripemd160);
|
||||
ret = mbedtls_ripemd160_starts(&operation->ctx.ripemd160);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_1)
|
||||
case PSA_ALG_SHA_1:
|
||||
mbedtls_sha1_init(&operation->ctx.sha1);
|
||||
ret = mbedtls_sha1_starts(&operation->ctx.sha1);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_224)
|
||||
case PSA_ALG_SHA_224:
|
||||
mbedtls_sha256_init(&operation->ctx.sha256);
|
||||
ret = mbedtls_sha256_starts(&operation->ctx.sha256, 1);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_256)
|
||||
case PSA_ALG_SHA_256:
|
||||
mbedtls_sha256_init(&operation->ctx.sha256);
|
||||
ret = mbedtls_sha256_starts(&operation->ctx.sha256, 0);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_384)
|
||||
case PSA_ALG_SHA_384:
|
||||
mbedtls_sha512_init(&operation->ctx.sha512);
|
||||
ret = mbedtls_sha512_starts(&operation->ctx.sha512, 1);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_512)
|
||||
case PSA_ALG_SHA_512:
|
||||
mbedtls_sha512_init(&operation->ctx.sha512);
|
||||
ret = mbedtls_sha512_starts(&operation->ctx.sha512, 0);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_224)
|
||||
case PSA_ALG_SHA3_224:
|
||||
mbedtls_sha3_init(&operation->ctx.sha3);
|
||||
ret = mbedtls_sha3_starts(&operation->ctx.sha3, MBEDTLS_SHA3_224);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_256)
|
||||
case PSA_ALG_SHA3_256:
|
||||
mbedtls_sha3_init(&operation->ctx.sha3);
|
||||
ret = mbedtls_sha3_starts(&operation->ctx.sha3, MBEDTLS_SHA3_256);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_384)
|
||||
case PSA_ALG_SHA3_384:
|
||||
mbedtls_sha3_init(&operation->ctx.sha3);
|
||||
ret = mbedtls_sha3_starts(&operation->ctx.sha3, MBEDTLS_SHA3_384);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_512)
|
||||
case PSA_ALG_SHA3_512:
|
||||
mbedtls_sha3_init(&operation->ctx.sha3);
|
||||
ret = mbedtls_sha3_starts(&operation->ctx.sha3, MBEDTLS_SHA3_512);
|
||||
break;
|
||||
#endif
|
||||
default:
|
||||
return PSA_ALG_IS_HASH(alg) ?
|
||||
PSA_ERROR_NOT_SUPPORTED :
|
||||
PSA_ERROR_INVALID_ARGUMENT;
|
||||
}
|
||||
if (ret == 0) {
|
||||
operation->alg = alg;
|
||||
} else {
|
||||
mbedtls_psa_hash_abort(operation);
|
||||
}
|
||||
return mbedtls_to_psa_error(ret);
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_hash_clone(
|
||||
const mbedtls_psa_hash_operation_t *source_operation,
|
||||
mbedtls_psa_hash_operation_t *target_operation)
|
||||
{
|
||||
switch (source_operation->alg) {
|
||||
case 0:
|
||||
return PSA_ERROR_BAD_STATE;
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD5)
|
||||
case PSA_ALG_MD5:
|
||||
mbedtls_md5_clone(&target_operation->ctx.md5,
|
||||
&source_operation->ctx.md5);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160)
|
||||
case PSA_ALG_RIPEMD160:
|
||||
mbedtls_ripemd160_clone(&target_operation->ctx.ripemd160,
|
||||
&source_operation->ctx.ripemd160);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_1)
|
||||
case PSA_ALG_SHA_1:
|
||||
mbedtls_sha1_clone(&target_operation->ctx.sha1,
|
||||
&source_operation->ctx.sha1);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_224)
|
||||
case PSA_ALG_SHA_224:
|
||||
mbedtls_sha256_clone(&target_operation->ctx.sha256,
|
||||
&source_operation->ctx.sha256);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_256)
|
||||
case PSA_ALG_SHA_256:
|
||||
mbedtls_sha256_clone(&target_operation->ctx.sha256,
|
||||
&source_operation->ctx.sha256);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_384)
|
||||
case PSA_ALG_SHA_384:
|
||||
mbedtls_sha512_clone(&target_operation->ctx.sha512,
|
||||
&source_operation->ctx.sha512);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_512)
|
||||
case PSA_ALG_SHA_512:
|
||||
mbedtls_sha512_clone(&target_operation->ctx.sha512,
|
||||
&source_operation->ctx.sha512);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_224)
|
||||
case PSA_ALG_SHA3_224:
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_256)
|
||||
case PSA_ALG_SHA3_256:
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_384)
|
||||
case PSA_ALG_SHA3_384:
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_512)
|
||||
case PSA_ALG_SHA3_512:
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_224) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_256) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_384) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_512)
|
||||
mbedtls_sha3_clone(&target_operation->ctx.sha3,
|
||||
&source_operation->ctx.sha3);
|
||||
break;
|
||||
#endif
|
||||
default:
|
||||
(void) source_operation;
|
||||
(void) target_operation;
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
|
||||
target_operation->alg = source_operation->alg;
|
||||
return PSA_SUCCESS;
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_hash_update(
|
||||
mbedtls_psa_hash_operation_t *operation,
|
||||
const uint8_t *input,
|
||||
size_t input_length)
|
||||
{
|
||||
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
||||
|
||||
switch (operation->alg) {
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD5)
|
||||
case PSA_ALG_MD5:
|
||||
ret = mbedtls_md5_update(&operation->ctx.md5,
|
||||
input, input_length);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160)
|
||||
case PSA_ALG_RIPEMD160:
|
||||
ret = mbedtls_ripemd160_update(&operation->ctx.ripemd160,
|
||||
input, input_length);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_1)
|
||||
case PSA_ALG_SHA_1:
|
||||
ret = mbedtls_sha1_update(&operation->ctx.sha1,
|
||||
input, input_length);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_224)
|
||||
case PSA_ALG_SHA_224:
|
||||
ret = mbedtls_sha256_update(&operation->ctx.sha256,
|
||||
input, input_length);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_256)
|
||||
case PSA_ALG_SHA_256:
|
||||
ret = mbedtls_sha256_update(&operation->ctx.sha256,
|
||||
input, input_length);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_384)
|
||||
case PSA_ALG_SHA_384:
|
||||
ret = mbedtls_sha512_update(&operation->ctx.sha512,
|
||||
input, input_length);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_512)
|
||||
case PSA_ALG_SHA_512:
|
||||
ret = mbedtls_sha512_update(&operation->ctx.sha512,
|
||||
input, input_length);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_224)
|
||||
case PSA_ALG_SHA3_224:
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_256)
|
||||
case PSA_ALG_SHA3_256:
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_384)
|
||||
case PSA_ALG_SHA3_384:
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_512)
|
||||
case PSA_ALG_SHA3_512:
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_224) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_256) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_384) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_512)
|
||||
ret = mbedtls_sha3_update(&operation->ctx.sha3,
|
||||
input, input_length);
|
||||
break;
|
||||
#endif
|
||||
default:
|
||||
(void) input;
|
||||
(void) input_length;
|
||||
return PSA_ERROR_BAD_STATE;
|
||||
}
|
||||
|
||||
return mbedtls_to_psa_error(ret);
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_hash_finish(
|
||||
mbedtls_psa_hash_operation_t *operation,
|
||||
uint8_t *hash,
|
||||
size_t hash_size,
|
||||
size_t *hash_length)
|
||||
{
|
||||
psa_status_t status;
|
||||
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
||||
size_t actual_hash_length = PSA_HASH_LENGTH(operation->alg);
|
||||
|
||||
/* Fill the output buffer with something that isn't a valid hash
|
||||
* (barring an attack on the hash and deliberately-crafted input),
|
||||
* in case the caller doesn't check the return status properly. */
|
||||
*hash_length = hash_size;
|
||||
/* If hash_size is 0 then hash may be NULL and then the
|
||||
* call to memset would have undefined behavior. */
|
||||
if (hash_size != 0) {
|
||||
memset(hash, '!', hash_size);
|
||||
}
|
||||
|
||||
if (hash_size < actual_hash_length) {
|
||||
status = PSA_ERROR_BUFFER_TOO_SMALL;
|
||||
goto exit;
|
||||
}
|
||||
|
||||
switch (operation->alg) {
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD5)
|
||||
case PSA_ALG_MD5:
|
||||
ret = mbedtls_md5_finish(&operation->ctx.md5, hash);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160)
|
||||
case PSA_ALG_RIPEMD160:
|
||||
ret = mbedtls_ripemd160_finish(&operation->ctx.ripemd160, hash);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_1)
|
||||
case PSA_ALG_SHA_1:
|
||||
ret = mbedtls_sha1_finish(&operation->ctx.sha1, hash);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_224)
|
||||
case PSA_ALG_SHA_224:
|
||||
ret = mbedtls_sha256_finish(&operation->ctx.sha256, hash);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_256)
|
||||
case PSA_ALG_SHA_256:
|
||||
ret = mbedtls_sha256_finish(&operation->ctx.sha256, hash);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_384)
|
||||
case PSA_ALG_SHA_384:
|
||||
ret = mbedtls_sha512_finish(&operation->ctx.sha512, hash);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_512)
|
||||
case PSA_ALG_SHA_512:
|
||||
ret = mbedtls_sha512_finish(&operation->ctx.sha512, hash);
|
||||
break;
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_224)
|
||||
case PSA_ALG_SHA3_224:
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_256)
|
||||
case PSA_ALG_SHA3_256:
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_384)
|
||||
case PSA_ALG_SHA3_384:
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_512)
|
||||
case PSA_ALG_SHA3_512:
|
||||
#endif
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_224) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_256) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_384) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_512)
|
||||
ret = mbedtls_sha3_finish(&operation->ctx.sha3, hash, hash_size);
|
||||
break;
|
||||
#endif
|
||||
default:
|
||||
(void) hash;
|
||||
return PSA_ERROR_BAD_STATE;
|
||||
}
|
||||
status = mbedtls_to_psa_error(ret);
|
||||
|
||||
exit:
|
||||
if (status == PSA_SUCCESS) {
|
||||
*hash_length = actual_hash_length;
|
||||
}
|
||||
return status;
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_hash_compute(
|
||||
psa_algorithm_t alg,
|
||||
const uint8_t *input,
|
||||
size_t input_length,
|
||||
uint8_t *hash,
|
||||
size_t hash_size,
|
||||
size_t *hash_length)
|
||||
{
|
||||
mbedtls_psa_hash_operation_t operation = MBEDTLS_PSA_HASH_OPERATION_INIT;
|
||||
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
|
||||
*hash_length = hash_size;
|
||||
status = mbedtls_psa_hash_setup(&operation, alg);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
status = mbedtls_psa_hash_update(&operation, input, input_length);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
status = mbedtls_psa_hash_finish(&operation, hash, hash_size, hash_length);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
exit:
|
||||
abort_status = mbedtls_psa_hash_abort(&operation);
|
||||
if (status == PSA_SUCCESS) {
|
||||
return abort_status;
|
||||
} else {
|
||||
return status;
|
||||
}
|
||||
|
||||
}
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_HASH */
|
||||
|
||||
#endif /* MBEDTLS_PSA_CRYPTO_C */
|
||||
496
thirdparty/mbedtls/library/psa_crypto_mac.c
vendored
Normal file
496
thirdparty/mbedtls/library/psa_crypto_mac.c
vendored
Normal file
@ -0,0 +1,496 @@
|
||||
/*
|
||||
* PSA MAC layer on top of Mbed TLS software crypto
|
||||
*/
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
|
||||
*/
|
||||
|
||||
#include "common.h"
|
||||
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_C)
|
||||
|
||||
#include <psa/crypto.h>
|
||||
#include "psa_crypto_core.h"
|
||||
#include "psa_crypto_cipher.h"
|
||||
#include "psa_crypto_mac.h"
|
||||
#include <mbedtls/md.h>
|
||||
|
||||
#include <mbedtls/error.h>
|
||||
#include "mbedtls/constant_time.h"
|
||||
#include <string.h>
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
|
||||
static psa_status_t psa_hmac_abort_internal(
|
||||
mbedtls_psa_hmac_operation_t *hmac)
|
||||
{
|
||||
mbedtls_platform_zeroize(hmac->opad, sizeof(hmac->opad));
|
||||
return psa_hash_abort(&hmac->hash_ctx);
|
||||
}
|
||||
|
||||
static psa_status_t psa_hmac_setup_internal(
|
||||
mbedtls_psa_hmac_operation_t *hmac,
|
||||
const uint8_t *key,
|
||||
size_t key_length,
|
||||
psa_algorithm_t hash_alg)
|
||||
{
|
||||
uint8_t ipad[PSA_HMAC_MAX_HASH_BLOCK_SIZE];
|
||||
size_t i;
|
||||
size_t hash_size = PSA_HASH_LENGTH(hash_alg);
|
||||
size_t block_size = PSA_HASH_BLOCK_LENGTH(hash_alg);
|
||||
psa_status_t status;
|
||||
|
||||
hmac->alg = hash_alg;
|
||||
|
||||
/* Sanity checks on block_size, to guarantee that there won't be a buffer
|
||||
* overflow below. This should never trigger if the hash algorithm
|
||||
* is implemented correctly. */
|
||||
/* The size checks against the ipad and opad buffers cannot be written
|
||||
* `block_size > sizeof( ipad ) || block_size > sizeof( hmac->opad )`
|
||||
* because that triggers -Wlogical-op on GCC 7.3. */
|
||||
if (block_size > sizeof(ipad)) {
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
if (block_size > sizeof(hmac->opad)) {
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
if (block_size < hash_size) {
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
|
||||
if (key_length > block_size) {
|
||||
status = psa_hash_compute(hash_alg, key, key_length,
|
||||
ipad, sizeof(ipad), &key_length);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto cleanup;
|
||||
}
|
||||
}
|
||||
/* A 0-length key is not commonly used in HMAC when used as a MAC,
|
||||
* but it is permitted. It is common when HMAC is used in HKDF, for
|
||||
* example. Don't call `memcpy` in the 0-length because `key` could be
|
||||
* an invalid pointer which would make the behavior undefined. */
|
||||
else if (key_length != 0) {
|
||||
memcpy(ipad, key, key_length);
|
||||
}
|
||||
|
||||
/* ipad contains the key followed by garbage. Xor and fill with 0x36
|
||||
* to create the ipad value. */
|
||||
for (i = 0; i < key_length; i++) {
|
||||
ipad[i] ^= 0x36;
|
||||
}
|
||||
memset(ipad + key_length, 0x36, block_size - key_length);
|
||||
|
||||
/* Copy the key material from ipad to opad, flipping the requisite bits,
|
||||
* and filling the rest of opad with the requisite constant. */
|
||||
for (i = 0; i < key_length; i++) {
|
||||
hmac->opad[i] = ipad[i] ^ 0x36 ^ 0x5C;
|
||||
}
|
||||
memset(hmac->opad + key_length, 0x5C, block_size - key_length);
|
||||
|
||||
status = psa_hash_setup(&hmac->hash_ctx, hash_alg);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
status = psa_hash_update(&hmac->hash_ctx, ipad, block_size);
|
||||
|
||||
cleanup:
|
||||
mbedtls_platform_zeroize(ipad, sizeof(ipad));
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
static psa_status_t psa_hmac_update_internal(
|
||||
mbedtls_psa_hmac_operation_t *hmac,
|
||||
const uint8_t *data,
|
||||
size_t data_length)
|
||||
{
|
||||
return psa_hash_update(&hmac->hash_ctx, data, data_length);
|
||||
}
|
||||
|
||||
static psa_status_t psa_hmac_finish_internal(
|
||||
mbedtls_psa_hmac_operation_t *hmac,
|
||||
uint8_t *mac,
|
||||
size_t mac_size)
|
||||
{
|
||||
uint8_t tmp[PSA_HASH_MAX_SIZE];
|
||||
psa_algorithm_t hash_alg = hmac->alg;
|
||||
size_t hash_size = 0;
|
||||
size_t block_size = PSA_HASH_BLOCK_LENGTH(hash_alg);
|
||||
psa_status_t status;
|
||||
|
||||
status = psa_hash_finish(&hmac->hash_ctx, tmp, sizeof(tmp), &hash_size);
|
||||
if (status != PSA_SUCCESS) {
|
||||
return status;
|
||||
}
|
||||
/* From here on, tmp needs to be wiped. */
|
||||
|
||||
status = psa_hash_setup(&hmac->hash_ctx, hash_alg);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
status = psa_hash_update(&hmac->hash_ctx, hmac->opad, block_size);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
status = psa_hash_update(&hmac->hash_ctx, tmp, hash_size);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
status = psa_hash_finish(&hmac->hash_ctx, tmp, sizeof(tmp), &hash_size);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
memcpy(mac, tmp, mac_size);
|
||||
|
||||
exit:
|
||||
mbedtls_platform_zeroize(tmp, hash_size);
|
||||
return status;
|
||||
}
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC)
|
||||
static psa_status_t cmac_setup(mbedtls_psa_mac_operation_t *operation,
|
||||
const psa_key_attributes_t *attributes,
|
||||
const uint8_t *key_buffer)
|
||||
{
|
||||
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
||||
|
||||
#if defined(PSA_WANT_KEY_TYPE_DES)
|
||||
/* Mbed TLS CMAC does not accept 3DES with only two keys, nor does it accept
|
||||
* to do CMAC with pure DES, so return NOT_SUPPORTED here. */
|
||||
if (psa_get_key_type(attributes) == PSA_KEY_TYPE_DES &&
|
||||
(psa_get_key_bits(attributes) == 64 ||
|
||||
psa_get_key_bits(attributes) == 128)) {
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
#endif
|
||||
|
||||
const mbedtls_cipher_info_t *cipher_info =
|
||||
mbedtls_cipher_info_from_psa(
|
||||
PSA_ALG_CMAC,
|
||||
psa_get_key_type(attributes),
|
||||
psa_get_key_bits(attributes),
|
||||
NULL);
|
||||
|
||||
if (cipher_info == NULL) {
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
|
||||
ret = mbedtls_cipher_setup(&operation->ctx.cmac, cipher_info);
|
||||
if (ret != 0) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
ret = mbedtls_cipher_cmac_starts(&operation->ctx.cmac,
|
||||
key_buffer,
|
||||
psa_get_key_bits(attributes));
|
||||
exit:
|
||||
return mbedtls_to_psa_error(ret);
|
||||
}
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC)
|
||||
|
||||
/* Initialize this driver's MAC operation structure. Once this function has been
|
||||
* called, mbedtls_psa_mac_abort can run and will do the right thing. */
|
||||
static psa_status_t mac_init(
|
||||
mbedtls_psa_mac_operation_t *operation,
|
||||
psa_algorithm_t alg)
|
||||
{
|
||||
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
|
||||
operation->alg = alg;
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC)
|
||||
if (PSA_ALG_FULL_LENGTH_MAC(operation->alg) == PSA_ALG_CMAC) {
|
||||
mbedtls_cipher_init(&operation->ctx.cmac);
|
||||
status = PSA_SUCCESS;
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
|
||||
if (PSA_ALG_IS_HMAC(operation->alg)) {
|
||||
/* We'll set up the hash operation later in psa_hmac_setup_internal. */
|
||||
operation->ctx.hmac.alg = 0;
|
||||
status = PSA_SUCCESS;
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
|
||||
{
|
||||
(void) operation;
|
||||
status = PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
|
||||
if (status != PSA_SUCCESS) {
|
||||
memset(operation, 0, sizeof(*operation));
|
||||
}
|
||||
return status;
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_mac_abort(mbedtls_psa_mac_operation_t *operation)
|
||||
{
|
||||
if (operation->alg == 0) {
|
||||
/* The object has (apparently) been initialized but it is not
|
||||
* in use. It's ok to call abort on such an object, and there's
|
||||
* nothing to do. */
|
||||
return PSA_SUCCESS;
|
||||
} else
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC)
|
||||
if (PSA_ALG_FULL_LENGTH_MAC(operation->alg) == PSA_ALG_CMAC) {
|
||||
mbedtls_cipher_free(&operation->ctx.cmac);
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
|
||||
if (PSA_ALG_IS_HMAC(operation->alg)) {
|
||||
psa_hmac_abort_internal(&operation->ctx.hmac);
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
|
||||
{
|
||||
/* Sanity check (shouldn't happen: operation->alg should
|
||||
* always have been initialized to a valid value). */
|
||||
goto bad_state;
|
||||
}
|
||||
|
||||
operation->alg = 0;
|
||||
|
||||
return PSA_SUCCESS;
|
||||
|
||||
bad_state:
|
||||
/* If abort is called on an uninitialized object, we can't trust
|
||||
* anything. Wipe the object in case it contains confidential data.
|
||||
* This may result in a memory leak if a pointer gets overwritten,
|
||||
* but it's too late to do anything about this. */
|
||||
memset(operation, 0, sizeof(*operation));
|
||||
return PSA_ERROR_BAD_STATE;
|
||||
}
|
||||
|
||||
static psa_status_t psa_mac_setup(mbedtls_psa_mac_operation_t *operation,
|
||||
const psa_key_attributes_t *attributes,
|
||||
const uint8_t *key_buffer,
|
||||
size_t key_buffer_size,
|
||||
psa_algorithm_t alg)
|
||||
{
|
||||
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
|
||||
/* A context must be freshly initialized before it can be set up. */
|
||||
if (operation->alg != 0) {
|
||||
return PSA_ERROR_BAD_STATE;
|
||||
}
|
||||
|
||||
status = mac_init(operation, alg);
|
||||
if (status != PSA_SUCCESS) {
|
||||
return status;
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC)
|
||||
if (PSA_ALG_FULL_LENGTH_MAC(alg) == PSA_ALG_CMAC) {
|
||||
/* Key buffer size for CMAC is dictated by the key bits set on the
|
||||
* attributes, and previously validated by the core on key import. */
|
||||
(void) key_buffer_size;
|
||||
status = cmac_setup(operation, attributes, key_buffer);
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
|
||||
if (PSA_ALG_IS_HMAC(alg)) {
|
||||
status = psa_hmac_setup_internal(&operation->ctx.hmac,
|
||||
key_buffer,
|
||||
key_buffer_size,
|
||||
PSA_ALG_HMAC_GET_HASH(alg));
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
|
||||
{
|
||||
(void) attributes;
|
||||
(void) key_buffer;
|
||||
(void) key_buffer_size;
|
||||
status = PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
|
||||
if (status != PSA_SUCCESS) {
|
||||
mbedtls_psa_mac_abort(operation);
|
||||
}
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_mac_sign_setup(
|
||||
mbedtls_psa_mac_operation_t *operation,
|
||||
const psa_key_attributes_t *attributes,
|
||||
const uint8_t *key_buffer,
|
||||
size_t key_buffer_size,
|
||||
psa_algorithm_t alg)
|
||||
{
|
||||
return psa_mac_setup(operation, attributes,
|
||||
key_buffer, key_buffer_size, alg);
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_mac_verify_setup(
|
||||
mbedtls_psa_mac_operation_t *operation,
|
||||
const psa_key_attributes_t *attributes,
|
||||
const uint8_t *key_buffer,
|
||||
size_t key_buffer_size,
|
||||
psa_algorithm_t alg)
|
||||
{
|
||||
return psa_mac_setup(operation, attributes,
|
||||
key_buffer, key_buffer_size, alg);
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_mac_update(
|
||||
mbedtls_psa_mac_operation_t *operation,
|
||||
const uint8_t *input,
|
||||
size_t input_length)
|
||||
{
|
||||
if (operation->alg == 0) {
|
||||
return PSA_ERROR_BAD_STATE;
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC)
|
||||
if (PSA_ALG_FULL_LENGTH_MAC(operation->alg) == PSA_ALG_CMAC) {
|
||||
return mbedtls_to_psa_error(
|
||||
mbedtls_cipher_cmac_update(&operation->ctx.cmac,
|
||||
input, input_length));
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
|
||||
if (PSA_ALG_IS_HMAC(operation->alg)) {
|
||||
return psa_hmac_update_internal(&operation->ctx.hmac,
|
||||
input, input_length);
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
|
||||
{
|
||||
/* This shouldn't happen if `operation` was initialized by
|
||||
* a setup function. */
|
||||
(void) input;
|
||||
(void) input_length;
|
||||
return PSA_ERROR_BAD_STATE;
|
||||
}
|
||||
}
|
||||
|
||||
static psa_status_t psa_mac_finish_internal(
|
||||
mbedtls_psa_mac_operation_t *operation,
|
||||
uint8_t *mac, size_t mac_size)
|
||||
{
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC)
|
||||
if (PSA_ALG_FULL_LENGTH_MAC(operation->alg) == PSA_ALG_CMAC) {
|
||||
uint8_t tmp[PSA_BLOCK_CIPHER_BLOCK_MAX_SIZE];
|
||||
int ret = mbedtls_cipher_cmac_finish(&operation->ctx.cmac, tmp);
|
||||
if (ret == 0) {
|
||||
memcpy(mac, tmp, mac_size);
|
||||
}
|
||||
mbedtls_platform_zeroize(tmp, sizeof(tmp));
|
||||
return mbedtls_to_psa_error(ret);
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
|
||||
if (PSA_ALG_IS_HMAC(operation->alg)) {
|
||||
return psa_hmac_finish_internal(&operation->ctx.hmac,
|
||||
mac, mac_size);
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
|
||||
{
|
||||
/* This shouldn't happen if `operation` was initialized by
|
||||
* a setup function. */
|
||||
(void) operation;
|
||||
(void) mac;
|
||||
(void) mac_size;
|
||||
return PSA_ERROR_BAD_STATE;
|
||||
}
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_mac_sign_finish(
|
||||
mbedtls_psa_mac_operation_t *operation,
|
||||
uint8_t *mac,
|
||||
size_t mac_size,
|
||||
size_t *mac_length)
|
||||
{
|
||||
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
|
||||
if (operation->alg == 0) {
|
||||
return PSA_ERROR_BAD_STATE;
|
||||
}
|
||||
|
||||
status = psa_mac_finish_internal(operation, mac, mac_size);
|
||||
if (status == PSA_SUCCESS) {
|
||||
*mac_length = mac_size;
|
||||
}
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_mac_verify_finish(
|
||||
mbedtls_psa_mac_operation_t *operation,
|
||||
const uint8_t *mac,
|
||||
size_t mac_length)
|
||||
{
|
||||
uint8_t actual_mac[PSA_MAC_MAX_SIZE];
|
||||
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
|
||||
if (operation->alg == 0) {
|
||||
return PSA_ERROR_BAD_STATE;
|
||||
}
|
||||
|
||||
/* Consistency check: requested MAC length fits our local buffer */
|
||||
if (mac_length > sizeof(actual_mac)) {
|
||||
return PSA_ERROR_INVALID_ARGUMENT;
|
||||
}
|
||||
|
||||
status = psa_mac_finish_internal(operation, actual_mac, mac_length);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto cleanup;
|
||||
}
|
||||
|
||||
if (mbedtls_ct_memcmp(mac, actual_mac, mac_length) != 0) {
|
||||
status = PSA_ERROR_INVALID_SIGNATURE;
|
||||
}
|
||||
|
||||
cleanup:
|
||||
mbedtls_platform_zeroize(actual_mac, sizeof(actual_mac));
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_mac_compute(
|
||||
const psa_key_attributes_t *attributes,
|
||||
const uint8_t *key_buffer,
|
||||
size_t key_buffer_size,
|
||||
psa_algorithm_t alg,
|
||||
const uint8_t *input,
|
||||
size_t input_length,
|
||||
uint8_t *mac,
|
||||
size_t mac_size,
|
||||
size_t *mac_length)
|
||||
{
|
||||
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
mbedtls_psa_mac_operation_t operation = MBEDTLS_PSA_MAC_OPERATION_INIT;
|
||||
|
||||
status = psa_mac_setup(&operation,
|
||||
attributes, key_buffer, key_buffer_size,
|
||||
alg);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
if (input_length > 0) {
|
||||
status = mbedtls_psa_mac_update(&operation, input, input_length);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
}
|
||||
|
||||
status = psa_mac_finish_internal(&operation, mac, mac_size);
|
||||
if (status == PSA_SUCCESS) {
|
||||
*mac_length = mac_size;
|
||||
}
|
||||
|
||||
exit:
|
||||
mbedtls_psa_mac_abort(&operation);
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC || MBEDTLS_PSA_BUILTIN_ALG_CMAC */
|
||||
|
||||
#endif /* MBEDTLS_PSA_CRYPTO_C */
|
||||
571
thirdparty/mbedtls/library/psa_crypto_pake.c
vendored
Normal file
571
thirdparty/mbedtls/library/psa_crypto_pake.c
vendored
Normal file
@ -0,0 +1,571 @@
|
||||
/*
|
||||
* PSA PAKE layer on top of Mbed TLS software crypto
|
||||
*/
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
|
||||
*/
|
||||
|
||||
#include "common.h"
|
||||
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_C)
|
||||
|
||||
#include <psa/crypto.h>
|
||||
#include "psa_crypto_core.h"
|
||||
#include "psa_crypto_pake.h"
|
||||
#include "psa_crypto_slot_management.h"
|
||||
|
||||
#include <mbedtls/ecjpake.h>
|
||||
#include "psa_util_internal.h"
|
||||
|
||||
#include <mbedtls/platform.h>
|
||||
#include <mbedtls/error.h>
|
||||
#include <string.h>
|
||||
|
||||
/*
|
||||
* State sequence:
|
||||
*
|
||||
* psa_pake_setup()
|
||||
* |
|
||||
* |-- In any order:
|
||||
* | | psa_pake_set_password_key()
|
||||
* | | psa_pake_set_user()
|
||||
* | | psa_pake_set_peer()
|
||||
* | | psa_pake_set_role()
|
||||
* |
|
||||
* |--- In any order: (First round input before or after first round output)
|
||||
* | |
|
||||
* | |------ In Order
|
||||
* | | | psa_pake_output(PSA_PAKE_STEP_KEY_SHARE)
|
||||
* | | | psa_pake_output(PSA_PAKE_STEP_ZK_PUBLIC)
|
||||
* | | | psa_pake_output(PSA_PAKE_STEP_ZK_PROOF)
|
||||
* | | | psa_pake_output(PSA_PAKE_STEP_KEY_SHARE)
|
||||
* | | | psa_pake_output(PSA_PAKE_STEP_ZK_PUBLIC)
|
||||
* | | | psa_pake_output(PSA_PAKE_STEP_ZK_PROOF)
|
||||
* | |
|
||||
* | |------ In Order:
|
||||
* | | psa_pake_input(PSA_PAKE_STEP_KEY_SHARE)
|
||||
* | | psa_pake_input(PSA_PAKE_STEP_ZK_PUBLIC)
|
||||
* | | psa_pake_input(PSA_PAKE_STEP_ZK_PROOF)
|
||||
* | | psa_pake_input(PSA_PAKE_STEP_KEY_SHARE)
|
||||
* | | psa_pake_input(PSA_PAKE_STEP_ZK_PUBLIC)
|
||||
* | | psa_pake_input(PSA_PAKE_STEP_ZK_PROOF)
|
||||
* |
|
||||
* |--- In any order: (Second round input before or after second round output)
|
||||
* | |
|
||||
* | |------ In Order
|
||||
* | | | psa_pake_output(PSA_PAKE_STEP_KEY_SHARE)
|
||||
* | | | psa_pake_output(PSA_PAKE_STEP_ZK_PUBLIC)
|
||||
* | | | psa_pake_output(PSA_PAKE_STEP_ZK_PROOF)
|
||||
* | |
|
||||
* | |------ In Order:
|
||||
* | | psa_pake_input(PSA_PAKE_STEP_KEY_SHARE)
|
||||
* | | psa_pake_input(PSA_PAKE_STEP_ZK_PUBLIC)
|
||||
* | | psa_pake_input(PSA_PAKE_STEP_ZK_PROOF)
|
||||
* |
|
||||
* psa_pake_get_implicit_key()
|
||||
* psa_pake_abort()
|
||||
*/
|
||||
|
||||
/*
|
||||
* Possible sequence of calls to implementation:
|
||||
*
|
||||
* |--- In any order:
|
||||
* | |
|
||||
* | |------ In Order
|
||||
* | | | mbedtls_psa_pake_output(PSA_JPAKE_X1_STEP_KEY_SHARE)
|
||||
* | | | mbedtls_psa_pake_output(PSA_JPAKE_X1_STEP_ZK_PUBLIC)
|
||||
* | | | mbedtls_psa_pake_output(PSA_JPAKE_X1_STEP_ZK_PROOF)
|
||||
* | | | mbedtls_psa_pake_output(PSA_JPAKE_X2_STEP_KEY_SHARE)
|
||||
* | | | mbedtls_psa_pake_output(PSA_JPAKE_X2_STEP_ZK_PUBLIC)
|
||||
* | | | mbedtls_psa_pake_output(PSA_JPAKE_X2_STEP_ZK_PROOF)
|
||||
* | |
|
||||
* | |------ In Order:
|
||||
* | | mbedtls_psa_pake_input(PSA_JPAKE_X1_STEP_KEY_SHARE)
|
||||
* | | mbedtls_psa_pake_input(PSA_JPAKE_X1_STEP_ZK_PUBLIC)
|
||||
* | | mbedtls_psa_pake_input(PSA_JPAKE_X1_STEP_ZK_PROOF)
|
||||
* | | mbedtls_psa_pake_input(PSA_JPAKE_X2_STEP_KEY_SHARE)
|
||||
* | | mbedtls_psa_pake_input(PSA_JPAKE_X2_STEP_ZK_PUBLIC)
|
||||
* | | mbedtls_psa_pake_input(PSA_JPAKE_X2_STEP_ZK_PROOF)
|
||||
* |
|
||||
* |--- In any order:
|
||||
* | |
|
||||
* | |------ In Order
|
||||
* | | | mbedtls_psa_pake_output(PSA_JPAKE_X2S_STEP_KEY_SHARE)
|
||||
* | | | mbedtls_psa_pake_output(PSA_JPAKE_X2S_STEP_ZK_PUBLIC)
|
||||
* | | | mbedtls_psa_pake_output(PSA_JPAKE_X2S_STEP_ZK_PROOF)
|
||||
* | |
|
||||
* | |------ In Order:
|
||||
* | | mbedtls_psa_pake_input(PSA_JPAKE_X4S_STEP_KEY_SHARE)
|
||||
* | | mbedtls_psa_pake_input(PSA_JPAKE_X4S_STEP_ZK_PUBLIC)
|
||||
* | | mbedtls_psa_pake_input(PSA_JPAKE_X4S_STEP_ZK_PROOF)
|
||||
*/
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_JPAKE)
|
||||
static psa_status_t mbedtls_ecjpake_to_psa_error(int ret)
|
||||
{
|
||||
switch (ret) {
|
||||
case MBEDTLS_ERR_MPI_BAD_INPUT_DATA:
|
||||
case MBEDTLS_ERR_ECP_BAD_INPUT_DATA:
|
||||
case MBEDTLS_ERR_ECP_INVALID_KEY:
|
||||
case MBEDTLS_ERR_ECP_VERIFY_FAILED:
|
||||
return PSA_ERROR_DATA_INVALID;
|
||||
case MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL:
|
||||
case MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL:
|
||||
return PSA_ERROR_BUFFER_TOO_SMALL;
|
||||
case MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE:
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
case MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED:
|
||||
return PSA_ERROR_CORRUPTION_DETECTED;
|
||||
default:
|
||||
return PSA_ERROR_GENERIC_ERROR;
|
||||
}
|
||||
}
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_PAKE)
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_JPAKE)
|
||||
static psa_status_t psa_pake_ecjpake_setup(mbedtls_psa_pake_operation_t *operation)
|
||||
{
|
||||
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
||||
|
||||
mbedtls_ecjpake_init(&operation->ctx.jpake);
|
||||
|
||||
ret = mbedtls_ecjpake_setup(&operation->ctx.jpake,
|
||||
operation->role,
|
||||
MBEDTLS_MD_SHA256,
|
||||
MBEDTLS_ECP_DP_SECP256R1,
|
||||
operation->password,
|
||||
operation->password_len);
|
||||
|
||||
mbedtls_platform_zeroize(operation->password, operation->password_len);
|
||||
|
||||
if (ret != 0) {
|
||||
return mbedtls_ecjpake_to_psa_error(ret);
|
||||
}
|
||||
|
||||
return PSA_SUCCESS;
|
||||
}
|
||||
#endif
|
||||
|
||||
/* The only two JPAKE user/peer identifiers supported in built-in implementation. */
|
||||
static const uint8_t jpake_server_id[] = { 's', 'e', 'r', 'v', 'e', 'r' };
|
||||
static const uint8_t jpake_client_id[] = { 'c', 'l', 'i', 'e', 'n', 't' };
|
||||
|
||||
psa_status_t mbedtls_psa_pake_setup(mbedtls_psa_pake_operation_t *operation,
|
||||
const psa_crypto_driver_pake_inputs_t *inputs)
|
||||
{
|
||||
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
size_t user_len = 0, peer_len = 0, password_len = 0;
|
||||
uint8_t *peer = NULL, *user = NULL;
|
||||
size_t actual_user_len = 0, actual_peer_len = 0, actual_password_len = 0;
|
||||
psa_pake_cipher_suite_t cipher_suite = psa_pake_cipher_suite_init();
|
||||
|
||||
status = psa_crypto_driver_pake_get_password_len(inputs, &password_len);
|
||||
if (status != PSA_SUCCESS) {
|
||||
return status;
|
||||
}
|
||||
|
||||
status = psa_crypto_driver_pake_get_user_len(inputs, &user_len);
|
||||
if (status != PSA_SUCCESS) {
|
||||
return status;
|
||||
}
|
||||
|
||||
status = psa_crypto_driver_pake_get_peer_len(inputs, &peer_len);
|
||||
if (status != PSA_SUCCESS) {
|
||||
return status;
|
||||
}
|
||||
|
||||
status = psa_crypto_driver_pake_get_cipher_suite(inputs, &cipher_suite);
|
||||
if (status != PSA_SUCCESS) {
|
||||
return status;
|
||||
}
|
||||
|
||||
operation->password = mbedtls_calloc(1, password_len);
|
||||
if (operation->password == NULL) {
|
||||
status = PSA_ERROR_INSUFFICIENT_MEMORY;
|
||||
goto error;
|
||||
}
|
||||
|
||||
user = mbedtls_calloc(1, user_len);
|
||||
if (user == NULL) {
|
||||
status = PSA_ERROR_INSUFFICIENT_MEMORY;
|
||||
goto error;
|
||||
}
|
||||
|
||||
peer = mbedtls_calloc(1, peer_len);
|
||||
if (peer == NULL) {
|
||||
status = PSA_ERROR_INSUFFICIENT_MEMORY;
|
||||
goto error;
|
||||
}
|
||||
|
||||
status = psa_crypto_driver_pake_get_password(inputs, operation->password,
|
||||
password_len, &actual_password_len);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto error;
|
||||
}
|
||||
|
||||
status = psa_crypto_driver_pake_get_user(inputs, user,
|
||||
user_len, &actual_user_len);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto error;
|
||||
}
|
||||
|
||||
status = psa_crypto_driver_pake_get_peer(inputs, peer,
|
||||
peer_len, &actual_peer_len);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto error;
|
||||
}
|
||||
|
||||
operation->password_len = actual_password_len;
|
||||
operation->alg = cipher_suite.algorithm;
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_JPAKE)
|
||||
if (cipher_suite.algorithm == PSA_ALG_JPAKE) {
|
||||
if (cipher_suite.type != PSA_PAKE_PRIMITIVE_TYPE_ECC ||
|
||||
cipher_suite.family != PSA_ECC_FAMILY_SECP_R1 ||
|
||||
cipher_suite.bits != 256 ||
|
||||
cipher_suite.hash != PSA_ALG_SHA_256) {
|
||||
status = PSA_ERROR_NOT_SUPPORTED;
|
||||
goto error;
|
||||
}
|
||||
|
||||
const size_t user_peer_len = sizeof(jpake_client_id); // client and server have the same length
|
||||
if (actual_user_len != user_peer_len ||
|
||||
actual_peer_len != user_peer_len) {
|
||||
status = PSA_ERROR_NOT_SUPPORTED;
|
||||
goto error;
|
||||
}
|
||||
|
||||
if (memcmp(user, jpake_client_id, actual_user_len) == 0 &&
|
||||
memcmp(peer, jpake_server_id, actual_peer_len) == 0) {
|
||||
operation->role = MBEDTLS_ECJPAKE_CLIENT;
|
||||
} else
|
||||
if (memcmp(user, jpake_server_id, actual_user_len) == 0 &&
|
||||
memcmp(peer, jpake_client_id, actual_peer_len) == 0) {
|
||||
operation->role = MBEDTLS_ECJPAKE_SERVER;
|
||||
} else {
|
||||
status = PSA_ERROR_NOT_SUPPORTED;
|
||||
goto error;
|
||||
}
|
||||
|
||||
operation->buffer_length = 0;
|
||||
operation->buffer_offset = 0;
|
||||
|
||||
status = psa_pake_ecjpake_setup(operation);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto error;
|
||||
}
|
||||
|
||||
/* Role has been set, release user/peer buffers. */
|
||||
mbedtls_free(user); mbedtls_free(peer);
|
||||
|
||||
return PSA_SUCCESS;
|
||||
} else
|
||||
#else
|
||||
(void) operation;
|
||||
(void) inputs;
|
||||
#endif
|
||||
{ status = PSA_ERROR_NOT_SUPPORTED; }
|
||||
|
||||
error:
|
||||
mbedtls_free(user); mbedtls_free(peer);
|
||||
/* In case of failure of the setup of a multipart operation, the PSA driver interface
|
||||
* specifies that the core does not call any other driver entry point thus does not
|
||||
* call mbedtls_psa_pake_abort(). Therefore call it here to do the needed clean
|
||||
* up like freeing the memory that may have been allocated to store the password.
|
||||
*/
|
||||
mbedtls_psa_pake_abort(operation);
|
||||
return status;
|
||||
}
|
||||
|
||||
static psa_status_t mbedtls_psa_pake_output_internal(
|
||||
mbedtls_psa_pake_operation_t *operation,
|
||||
psa_crypto_driver_pake_step_t step,
|
||||
uint8_t *output,
|
||||
size_t output_size,
|
||||
size_t *output_length)
|
||||
{
|
||||
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
||||
size_t length;
|
||||
(void) step; // Unused parameter
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_JPAKE)
|
||||
/*
|
||||
* The PSA CRYPTO PAKE and Mbed TLS JPAKE API have a different
|
||||
* handling of output sequencing.
|
||||
*
|
||||
* The Mbed TLS JPAKE API outputs the whole X1+X2 and X2S steps data
|
||||
* at once, on the other side the PSA CRYPTO PAKE api requires
|
||||
* the KEY_SHARE/ZP_PUBLIC/ZK_PROOF parts of X1, X2 & X2S to be
|
||||
* retrieved in sequence.
|
||||
*
|
||||
* In order to achieve API compatibility, the whole X1+X2 or X2S steps
|
||||
* data is stored in an intermediate buffer at first step output call,
|
||||
* and data is sliced down by parsing the ECPoint records in order
|
||||
* to return the right parts on each step.
|
||||
*/
|
||||
if (operation->alg == PSA_ALG_JPAKE) {
|
||||
/* Initialize & write round on KEY_SHARE sequences */
|
||||
if (step == PSA_JPAKE_X1_STEP_KEY_SHARE) {
|
||||
ret = mbedtls_ecjpake_write_round_one(&operation->ctx.jpake,
|
||||
operation->buffer,
|
||||
sizeof(operation->buffer),
|
||||
&operation->buffer_length,
|
||||
mbedtls_psa_get_random,
|
||||
MBEDTLS_PSA_RANDOM_STATE);
|
||||
if (ret != 0) {
|
||||
return mbedtls_ecjpake_to_psa_error(ret);
|
||||
}
|
||||
|
||||
operation->buffer_offset = 0;
|
||||
} else if (step == PSA_JPAKE_X2S_STEP_KEY_SHARE) {
|
||||
ret = mbedtls_ecjpake_write_round_two(&operation->ctx.jpake,
|
||||
operation->buffer,
|
||||
sizeof(operation->buffer),
|
||||
&operation->buffer_length,
|
||||
mbedtls_psa_get_random,
|
||||
MBEDTLS_PSA_RANDOM_STATE);
|
||||
if (ret != 0) {
|
||||
return mbedtls_ecjpake_to_psa_error(ret);
|
||||
}
|
||||
|
||||
operation->buffer_offset = 0;
|
||||
}
|
||||
|
||||
/*
|
||||
* mbedtls_ecjpake_write_round_xxx() outputs thing in the format
|
||||
* defined by draft-cragie-tls-ecjpake-01 section 7. The summary is
|
||||
* that the data for each step is prepended with a length byte, and
|
||||
* then they're concatenated. Additionally, the server's second round
|
||||
* output is prepended with a 3-bytes ECParameters structure.
|
||||
*
|
||||
* In PSA, we output each step separately, and don't prepend the
|
||||
* output with a length byte, even less a curve identifier, as that
|
||||
* information is already available.
|
||||
*/
|
||||
if (step == PSA_JPAKE_X2S_STEP_KEY_SHARE &&
|
||||
operation->role == MBEDTLS_ECJPAKE_SERVER) {
|
||||
/* Skip ECParameters, with is 3 bytes (RFC 8422) */
|
||||
operation->buffer_offset += 3;
|
||||
}
|
||||
|
||||
/* Read the length byte then move past it to the data */
|
||||
length = operation->buffer[operation->buffer_offset];
|
||||
operation->buffer_offset += 1;
|
||||
|
||||
if (operation->buffer_offset + length > operation->buffer_length) {
|
||||
return PSA_ERROR_DATA_CORRUPT;
|
||||
}
|
||||
|
||||
if (output_size < length) {
|
||||
return PSA_ERROR_BUFFER_TOO_SMALL;
|
||||
}
|
||||
|
||||
memcpy(output,
|
||||
operation->buffer + operation->buffer_offset,
|
||||
length);
|
||||
*output_length = length;
|
||||
|
||||
operation->buffer_offset += length;
|
||||
|
||||
/* Reset buffer after ZK_PROOF sequence */
|
||||
if ((step == PSA_JPAKE_X2_STEP_ZK_PROOF) ||
|
||||
(step == PSA_JPAKE_X2S_STEP_ZK_PROOF)) {
|
||||
mbedtls_platform_zeroize(operation->buffer, sizeof(operation->buffer));
|
||||
operation->buffer_length = 0;
|
||||
operation->buffer_offset = 0;
|
||||
}
|
||||
|
||||
return PSA_SUCCESS;
|
||||
} else
|
||||
#else
|
||||
(void) step;
|
||||
(void) output;
|
||||
(void) output_size;
|
||||
(void) output_length;
|
||||
#endif
|
||||
{ return PSA_ERROR_NOT_SUPPORTED; }
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_pake_output(mbedtls_psa_pake_operation_t *operation,
|
||||
psa_crypto_driver_pake_step_t step,
|
||||
uint8_t *output,
|
||||
size_t output_size,
|
||||
size_t *output_length)
|
||||
{
|
||||
psa_status_t status = mbedtls_psa_pake_output_internal(
|
||||
operation, step, output, output_size, output_length);
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
static psa_status_t mbedtls_psa_pake_input_internal(
|
||||
mbedtls_psa_pake_operation_t *operation,
|
||||
psa_crypto_driver_pake_step_t step,
|
||||
const uint8_t *input,
|
||||
size_t input_length)
|
||||
{
|
||||
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
||||
(void) step; // Unused parameter
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_JPAKE)
|
||||
/*
|
||||
* The PSA CRYPTO PAKE and Mbed TLS JPAKE API have a different
|
||||
* handling of input sequencing.
|
||||
*
|
||||
* The Mbed TLS JPAKE API takes the whole X1+X2 or X4S steps data
|
||||
* at once as input, on the other side the PSA CRYPTO PAKE api requires
|
||||
* the KEY_SHARE/ZP_PUBLIC/ZK_PROOF parts of X1, X2 & X4S to be
|
||||
* given in sequence.
|
||||
*
|
||||
* In order to achieve API compatibility, each X1+X2 or X4S step data
|
||||
* is stored sequentially in an intermediate buffer and given to the
|
||||
* Mbed TLS JPAKE API on the last step.
|
||||
*
|
||||
* This causes any input error to be only detected on the last step.
|
||||
*/
|
||||
if (operation->alg == PSA_ALG_JPAKE) {
|
||||
/*
|
||||
* Copy input to local buffer and format it as the Mbed TLS API
|
||||
* expects, i.e. as defined by draft-cragie-tls-ecjpake-01 section 7.
|
||||
* The summary is that the data for each step is prepended with a
|
||||
* length byte, and then they're concatenated. Additionally, the
|
||||
* server's second round output is prepended with a 3-bytes
|
||||
* ECParameters structure - which means we have to prepend that when
|
||||
* we're a client.
|
||||
*/
|
||||
if (step == PSA_JPAKE_X4S_STEP_KEY_SHARE &&
|
||||
operation->role == MBEDTLS_ECJPAKE_CLIENT) {
|
||||
/* We only support secp256r1. */
|
||||
/* This is the ECParameters structure defined by RFC 8422. */
|
||||
unsigned char ecparameters[3] = {
|
||||
3, /* named_curve */
|
||||
0, 23 /* secp256r1 */
|
||||
};
|
||||
|
||||
if (operation->buffer_length + sizeof(ecparameters) >
|
||||
sizeof(operation->buffer)) {
|
||||
return PSA_ERROR_BUFFER_TOO_SMALL;
|
||||
}
|
||||
|
||||
memcpy(operation->buffer + operation->buffer_length,
|
||||
ecparameters, sizeof(ecparameters));
|
||||
operation->buffer_length += sizeof(ecparameters);
|
||||
}
|
||||
|
||||
/*
|
||||
* The core checks that input_length is smaller than
|
||||
* PSA_PAKE_INPUT_MAX_SIZE.
|
||||
* Thus no risk of integer overflow here.
|
||||
*/
|
||||
if (operation->buffer_length + input_length + 1 > sizeof(operation->buffer)) {
|
||||
return PSA_ERROR_BUFFER_TOO_SMALL;
|
||||
}
|
||||
|
||||
/* Write the length byte */
|
||||
operation->buffer[operation->buffer_length] = (uint8_t) input_length;
|
||||
operation->buffer_length += 1;
|
||||
|
||||
/* Finally copy the data */
|
||||
memcpy(operation->buffer + operation->buffer_length,
|
||||
input, input_length);
|
||||
operation->buffer_length += input_length;
|
||||
|
||||
/* Load buffer at each last round ZK_PROOF */
|
||||
if (step == PSA_JPAKE_X2_STEP_ZK_PROOF) {
|
||||
ret = mbedtls_ecjpake_read_round_one(&operation->ctx.jpake,
|
||||
operation->buffer,
|
||||
operation->buffer_length);
|
||||
|
||||
mbedtls_platform_zeroize(operation->buffer, sizeof(operation->buffer));
|
||||
operation->buffer_length = 0;
|
||||
|
||||
if (ret != 0) {
|
||||
return mbedtls_ecjpake_to_psa_error(ret);
|
||||
}
|
||||
} else if (step == PSA_JPAKE_X4S_STEP_ZK_PROOF) {
|
||||
ret = mbedtls_ecjpake_read_round_two(&operation->ctx.jpake,
|
||||
operation->buffer,
|
||||
operation->buffer_length);
|
||||
|
||||
mbedtls_platform_zeroize(operation->buffer, sizeof(operation->buffer));
|
||||
operation->buffer_length = 0;
|
||||
|
||||
if (ret != 0) {
|
||||
return mbedtls_ecjpake_to_psa_error(ret);
|
||||
}
|
||||
}
|
||||
|
||||
return PSA_SUCCESS;
|
||||
} else
|
||||
#else
|
||||
(void) step;
|
||||
(void) input;
|
||||
(void) input_length;
|
||||
#endif
|
||||
{ return PSA_ERROR_NOT_SUPPORTED; }
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_pake_input(mbedtls_psa_pake_operation_t *operation,
|
||||
psa_crypto_driver_pake_step_t step,
|
||||
const uint8_t *input,
|
||||
size_t input_length)
|
||||
{
|
||||
psa_status_t status = mbedtls_psa_pake_input_internal(
|
||||
operation, step, input, input_length);
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_pake_get_implicit_key(
|
||||
mbedtls_psa_pake_operation_t *operation,
|
||||
uint8_t *output, size_t output_size,
|
||||
size_t *output_length)
|
||||
{
|
||||
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_JPAKE)
|
||||
if (operation->alg == PSA_ALG_JPAKE) {
|
||||
ret = mbedtls_ecjpake_write_shared_key(&operation->ctx.jpake,
|
||||
output,
|
||||
output_size,
|
||||
output_length,
|
||||
mbedtls_psa_get_random,
|
||||
MBEDTLS_PSA_RANDOM_STATE);
|
||||
if (ret != 0) {
|
||||
return mbedtls_ecjpake_to_psa_error(ret);
|
||||
}
|
||||
|
||||
return PSA_SUCCESS;
|
||||
} else
|
||||
#else
|
||||
(void) output;
|
||||
#endif
|
||||
{ return PSA_ERROR_NOT_SUPPORTED; }
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_pake_abort(mbedtls_psa_pake_operation_t *operation)
|
||||
{
|
||||
mbedtls_zeroize_and_free(operation->password, operation->password_len);
|
||||
operation->password = NULL;
|
||||
operation->password_len = 0;
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_JPAKE)
|
||||
if (operation->alg == PSA_ALG_JPAKE) {
|
||||
operation->role = MBEDTLS_ECJPAKE_NONE;
|
||||
mbedtls_platform_zeroize(operation->buffer, sizeof(operation->buffer));
|
||||
operation->buffer_length = 0;
|
||||
operation->buffer_offset = 0;
|
||||
mbedtls_ecjpake_free(&operation->ctx.jpake);
|
||||
}
|
||||
#endif
|
||||
|
||||
operation->alg = PSA_ALG_NONE;
|
||||
|
||||
return PSA_SUCCESS;
|
||||
}
|
||||
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_PAKE */
|
||||
|
||||
#endif /* MBEDTLS_PSA_CRYPTO_C */
|
||||
705
thirdparty/mbedtls/library/psa_crypto_rsa.c
vendored
Normal file
705
thirdparty/mbedtls/library/psa_crypto_rsa.c
vendored
Normal file
@ -0,0 +1,705 @@
|
||||
/*
|
||||
* PSA RSA layer on top of Mbed TLS crypto
|
||||
*/
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
|
||||
*/
|
||||
|
||||
#include "common.h"
|
||||
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_C)
|
||||
|
||||
#include <psa/crypto.h>
|
||||
#include "psa/crypto_values.h"
|
||||
#include "psa_crypto_core.h"
|
||||
#include "psa_crypto_random_impl.h"
|
||||
#include "psa_crypto_rsa.h"
|
||||
#include "psa_crypto_hash.h"
|
||||
#include "mbedtls/psa_util.h"
|
||||
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
#include "mbedtls/platform.h"
|
||||
|
||||
#include <mbedtls/rsa.h>
|
||||
#include <mbedtls/error.h>
|
||||
#include "rsa_internal.h"
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
|
||||
|
||||
/* Mbed TLS doesn't support non-byte-aligned key sizes (i.e. key sizes
|
||||
* that are not a multiple of 8) well. For example, there is only
|
||||
* mbedtls_rsa_get_len(), which returns a number of bytes, and no
|
||||
* way to return the exact bit size of a key.
|
||||
* To keep things simple, reject non-byte-aligned key sizes. */
|
||||
static psa_status_t psa_check_rsa_key_byte_aligned(
|
||||
const mbedtls_rsa_context *rsa)
|
||||
{
|
||||
mbedtls_mpi n;
|
||||
psa_status_t status;
|
||||
mbedtls_mpi_init(&n);
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_rsa_export(rsa, &n, NULL, NULL, NULL, NULL));
|
||||
if (status == PSA_SUCCESS) {
|
||||
if (mbedtls_mpi_bitlen(&n) % 8 != 0) {
|
||||
status = PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
}
|
||||
mbedtls_mpi_free(&n);
|
||||
return status;
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_rsa_load_representation(
|
||||
psa_key_type_t type, const uint8_t *data, size_t data_length,
|
||||
mbedtls_rsa_context **p_rsa)
|
||||
{
|
||||
psa_status_t status;
|
||||
size_t bits;
|
||||
|
||||
*p_rsa = mbedtls_calloc(1, sizeof(mbedtls_rsa_context));
|
||||
if (*p_rsa == NULL) {
|
||||
return PSA_ERROR_INSUFFICIENT_MEMORY;
|
||||
}
|
||||
mbedtls_rsa_init(*p_rsa);
|
||||
|
||||
/* Parse the data. */
|
||||
if (PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
|
||||
status = mbedtls_to_psa_error(mbedtls_rsa_parse_key(*p_rsa, data, data_length));
|
||||
} else {
|
||||
status = mbedtls_to_psa_error(mbedtls_rsa_parse_pubkey(*p_rsa, data, data_length));
|
||||
}
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
/* The size of an RSA key doesn't have to be a multiple of 8. Mbed TLS
|
||||
* supports non-byte-aligned key sizes, but not well. For example,
|
||||
* mbedtls_rsa_get_len() returns the key size in bytes, not in bits. */
|
||||
bits = PSA_BYTES_TO_BITS(mbedtls_rsa_get_len(*p_rsa));
|
||||
if (bits > PSA_VENDOR_RSA_MAX_KEY_BITS) {
|
||||
status = PSA_ERROR_NOT_SUPPORTED;
|
||||
goto exit;
|
||||
}
|
||||
status = psa_check_rsa_key_byte_aligned(*p_rsa);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
exit:
|
||||
return status;
|
||||
}
|
||||
#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) ||
|
||||
* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) ||
|
||||
* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
|
||||
* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) ||
|
||||
* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT) ||
|
||||
* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT) ||
|
||||
* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
|
||||
|
||||
#if (defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT) && \
|
||||
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT)) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
|
||||
psa_status_t mbedtls_psa_rsa_import_key(
|
||||
const psa_key_attributes_t *attributes,
|
||||
const uint8_t *data, size_t data_length,
|
||||
uint8_t *key_buffer, size_t key_buffer_size,
|
||||
size_t *key_buffer_length, size_t *bits)
|
||||
{
|
||||
psa_status_t status;
|
||||
mbedtls_rsa_context *rsa = NULL;
|
||||
|
||||
/* Parse input */
|
||||
status = mbedtls_psa_rsa_load_representation(attributes->type,
|
||||
data,
|
||||
data_length,
|
||||
&rsa);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
*bits = (psa_key_bits_t) PSA_BYTES_TO_BITS(mbedtls_rsa_get_len(rsa));
|
||||
|
||||
/* Re-export the data to PSA export format, such that we can store export
|
||||
* representation in the key slot. Export representation in case of RSA is
|
||||
* the smallest representation that's allowed as input, so a straight-up
|
||||
* allocation of the same size as the input buffer will be large enough. */
|
||||
status = mbedtls_psa_rsa_export_key(attributes->type,
|
||||
rsa,
|
||||
key_buffer,
|
||||
key_buffer_size,
|
||||
key_buffer_length);
|
||||
exit:
|
||||
/* Always free the RSA object */
|
||||
mbedtls_rsa_free(rsa);
|
||||
mbedtls_free(rsa);
|
||||
|
||||
return status;
|
||||
}
|
||||
#endif /* (defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT) &&
|
||||
* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT)) ||
|
||||
* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
|
||||
psa_status_t mbedtls_psa_rsa_export_key(psa_key_type_t type,
|
||||
mbedtls_rsa_context *rsa,
|
||||
uint8_t *data,
|
||||
size_t data_size,
|
||||
size_t *data_length)
|
||||
{
|
||||
int ret;
|
||||
uint8_t *end = data + data_size;
|
||||
|
||||
/* PSA Crypto API defines the format of an RSA key as a DER-encoded
|
||||
* representation of the non-encrypted PKCS#1 RSAPrivateKey for a
|
||||
* private key and of the RFC3279 RSAPublicKey for a public key. */
|
||||
if (PSA_KEY_TYPE_IS_KEY_PAIR(type)) {
|
||||
ret = mbedtls_rsa_write_key(rsa, data, &end);
|
||||
} else {
|
||||
ret = mbedtls_rsa_write_pubkey(rsa, data, &end);
|
||||
}
|
||||
|
||||
if (ret < 0) {
|
||||
/* Clean up in case pk_write failed halfway through. */
|
||||
memset(data, 0, data_size);
|
||||
return mbedtls_to_psa_error(ret);
|
||||
}
|
||||
|
||||
/* The mbedtls_pk_xxx functions write to the end of the buffer.
|
||||
* Move the data to the beginning and erase remaining data
|
||||
* at the original location. */
|
||||
if (2 * (size_t) ret <= data_size) {
|
||||
memcpy(data, data + data_size - ret, ret);
|
||||
memset(data + data_size - ret, 0, ret);
|
||||
} else if ((size_t) ret < data_size) {
|
||||
memmove(data, data + data_size - ret, ret);
|
||||
memset(data + ret, 0, data_size - ret);
|
||||
}
|
||||
|
||||
*data_length = ret;
|
||||
return PSA_SUCCESS;
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_rsa_export_public_key(
|
||||
const psa_key_attributes_t *attributes,
|
||||
const uint8_t *key_buffer, size_t key_buffer_size,
|
||||
uint8_t *data, size_t data_size, size_t *data_length)
|
||||
{
|
||||
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
mbedtls_rsa_context *rsa = NULL;
|
||||
|
||||
status = mbedtls_psa_rsa_load_representation(
|
||||
attributes->type, key_buffer, key_buffer_size, &rsa);
|
||||
if (status == PSA_SUCCESS) {
|
||||
status = mbedtls_psa_rsa_export_key(PSA_KEY_TYPE_RSA_PUBLIC_KEY,
|
||||
rsa,
|
||||
data,
|
||||
data_size,
|
||||
data_length);
|
||||
}
|
||||
|
||||
mbedtls_rsa_free(rsa);
|
||||
mbedtls_free(rsa);
|
||||
|
||||
return status;
|
||||
}
|
||||
#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT) ||
|
||||
* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_GENERATE)
|
||||
static psa_status_t psa_rsa_read_exponent(const uint8_t *e_bytes,
|
||||
size_t e_length,
|
||||
int *exponent)
|
||||
{
|
||||
size_t i;
|
||||
uint32_t acc = 0;
|
||||
|
||||
/* Mbed TLS encodes the public exponent as an int. For simplicity, only
|
||||
* support values that fit in a 32-bit integer, which is larger than
|
||||
* int on just about every platform anyway. */
|
||||
if (e_length > sizeof(acc)) {
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
for (i = 0; i < e_length; i++) {
|
||||
acc = (acc << 8) | e_bytes[i];
|
||||
}
|
||||
if (acc > INT_MAX) {
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
*exponent = acc;
|
||||
return PSA_SUCCESS;
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_rsa_generate_key(
|
||||
const psa_key_attributes_t *attributes,
|
||||
const uint8_t *custom_data, size_t custom_data_length,
|
||||
uint8_t *key_buffer, size_t key_buffer_size, size_t *key_buffer_length)
|
||||
{
|
||||
psa_status_t status;
|
||||
mbedtls_rsa_context rsa;
|
||||
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
||||
int exponent = 65537;
|
||||
|
||||
if (custom_data_length != 0) {
|
||||
status = psa_rsa_read_exponent(custom_data, custom_data_length,
|
||||
&exponent);
|
||||
if (status != PSA_SUCCESS) {
|
||||
return status;
|
||||
}
|
||||
}
|
||||
|
||||
mbedtls_rsa_init(&rsa);
|
||||
ret = mbedtls_rsa_gen_key(&rsa,
|
||||
mbedtls_psa_get_random,
|
||||
MBEDTLS_PSA_RANDOM_STATE,
|
||||
(unsigned int) attributes->bits,
|
||||
exponent);
|
||||
if (ret != 0) {
|
||||
mbedtls_rsa_free(&rsa);
|
||||
return mbedtls_to_psa_error(ret);
|
||||
}
|
||||
|
||||
status = mbedtls_psa_rsa_export_key(attributes->type,
|
||||
&rsa, key_buffer, key_buffer_size,
|
||||
key_buffer_length);
|
||||
mbedtls_rsa_free(&rsa);
|
||||
|
||||
return status;
|
||||
}
|
||||
#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_GENERATE) */
|
||||
|
||||
/****************************************************************/
|
||||
/* Sign/verify hashes */
|
||||
/****************************************************************/
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
|
||||
|
||||
/* Decode the hash algorithm from alg and store the mbedtls encoding in
|
||||
* md_alg. Verify that the hash length is acceptable. */
|
||||
static psa_status_t psa_rsa_decode_md_type(psa_algorithm_t alg,
|
||||
size_t hash_length,
|
||||
mbedtls_md_type_t *md_alg)
|
||||
{
|
||||
psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH(alg);
|
||||
*md_alg = mbedtls_md_type_from_psa_alg(hash_alg);
|
||||
|
||||
/* The Mbed TLS RSA module uses an unsigned int for hash length
|
||||
* parameters. Validate that it fits so that we don't risk an
|
||||
* overflow later. */
|
||||
#if SIZE_MAX > UINT_MAX
|
||||
if (hash_length > UINT_MAX) {
|
||||
return PSA_ERROR_INVALID_ARGUMENT;
|
||||
}
|
||||
#endif
|
||||
|
||||
/* For signatures using a hash, the hash length must be correct. */
|
||||
if (alg != PSA_ALG_RSA_PKCS1V15_SIGN_RAW) {
|
||||
if (*md_alg == MBEDTLS_MD_NONE) {
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
if (mbedtls_md_get_size_from_type(*md_alg) != hash_length) {
|
||||
return PSA_ERROR_INVALID_ARGUMENT;
|
||||
}
|
||||
}
|
||||
|
||||
return PSA_SUCCESS;
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_rsa_sign_hash(
|
||||
const psa_key_attributes_t *attributes,
|
||||
const uint8_t *key_buffer, size_t key_buffer_size,
|
||||
psa_algorithm_t alg, const uint8_t *hash, size_t hash_length,
|
||||
uint8_t *signature, size_t signature_size, size_t *signature_length)
|
||||
{
|
||||
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
mbedtls_rsa_context *rsa = NULL;
|
||||
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
||||
mbedtls_md_type_t md_alg;
|
||||
|
||||
status = mbedtls_psa_rsa_load_representation(attributes->type,
|
||||
key_buffer,
|
||||
key_buffer_size,
|
||||
&rsa);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
status = psa_rsa_decode_md_type(alg, hash_length, &md_alg);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
if (signature_size < mbedtls_rsa_get_len(rsa)) {
|
||||
status = PSA_ERROR_BUFFER_TOO_SMALL;
|
||||
goto exit;
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN)
|
||||
if (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg)) {
|
||||
ret = mbedtls_rsa_set_padding(rsa, MBEDTLS_RSA_PKCS_V15,
|
||||
MBEDTLS_MD_NONE);
|
||||
if (ret == 0) {
|
||||
ret = mbedtls_rsa_pkcs1_sign(rsa,
|
||||
mbedtls_psa_get_random,
|
||||
MBEDTLS_PSA_RANDOM_STATE,
|
||||
md_alg,
|
||||
(unsigned int) hash_length,
|
||||
hash,
|
||||
signature);
|
||||
}
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN */
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
|
||||
if (PSA_ALG_IS_RSA_PSS(alg)) {
|
||||
ret = mbedtls_rsa_set_padding(rsa, MBEDTLS_RSA_PKCS_V21, md_alg);
|
||||
|
||||
if (ret == 0) {
|
||||
ret = mbedtls_rsa_rsassa_pss_sign(rsa,
|
||||
mbedtls_psa_get_random,
|
||||
MBEDTLS_PSA_RANDOM_STATE,
|
||||
MBEDTLS_MD_NONE,
|
||||
(unsigned int) hash_length,
|
||||
hash,
|
||||
signature);
|
||||
}
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS */
|
||||
{
|
||||
status = PSA_ERROR_INVALID_ARGUMENT;
|
||||
goto exit;
|
||||
}
|
||||
|
||||
if (ret == 0) {
|
||||
*signature_length = mbedtls_rsa_get_len(rsa);
|
||||
}
|
||||
status = mbedtls_to_psa_error(ret);
|
||||
|
||||
exit:
|
||||
mbedtls_rsa_free(rsa);
|
||||
mbedtls_free(rsa);
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
|
||||
static int rsa_pss_expected_salt_len(psa_algorithm_t alg,
|
||||
const mbedtls_rsa_context *rsa,
|
||||
size_t hash_length)
|
||||
{
|
||||
if (PSA_ALG_IS_RSA_PSS_ANY_SALT(alg)) {
|
||||
return MBEDTLS_RSA_SALT_LEN_ANY;
|
||||
}
|
||||
/* Otherwise: standard salt length, i.e. largest possible salt length
|
||||
* up to the hash length. */
|
||||
int klen = (int) mbedtls_rsa_get_len(rsa); // known to fit
|
||||
int hlen = (int) hash_length; // known to fit
|
||||
int room = klen - 2 - hlen;
|
||||
if (room < 0) {
|
||||
return 0; // there is no valid signature in this case anyway
|
||||
} else if (room > hlen) {
|
||||
return hlen;
|
||||
} else {
|
||||
return room;
|
||||
}
|
||||
}
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS */
|
||||
|
||||
psa_status_t mbedtls_psa_rsa_verify_hash(
|
||||
const psa_key_attributes_t *attributes,
|
||||
const uint8_t *key_buffer, size_t key_buffer_size,
|
||||
psa_algorithm_t alg, const uint8_t *hash, size_t hash_length,
|
||||
const uint8_t *signature, size_t signature_length)
|
||||
{
|
||||
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
mbedtls_rsa_context *rsa = NULL;
|
||||
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
||||
mbedtls_md_type_t md_alg;
|
||||
|
||||
status = mbedtls_psa_rsa_load_representation(attributes->type,
|
||||
key_buffer,
|
||||
key_buffer_size,
|
||||
&rsa);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
status = psa_rsa_decode_md_type(alg, hash_length, &md_alg);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
if (signature_length != mbedtls_rsa_get_len(rsa)) {
|
||||
status = PSA_ERROR_INVALID_SIGNATURE;
|
||||
goto exit;
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN)
|
||||
if (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg)) {
|
||||
ret = mbedtls_rsa_set_padding(rsa, MBEDTLS_RSA_PKCS_V15,
|
||||
MBEDTLS_MD_NONE);
|
||||
if (ret == 0) {
|
||||
ret = mbedtls_rsa_pkcs1_verify(rsa,
|
||||
md_alg,
|
||||
(unsigned int) hash_length,
|
||||
hash,
|
||||
signature);
|
||||
}
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN */
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
|
||||
if (PSA_ALG_IS_RSA_PSS(alg)) {
|
||||
ret = mbedtls_rsa_set_padding(rsa, MBEDTLS_RSA_PKCS_V21, md_alg);
|
||||
if (ret == 0) {
|
||||
int slen = rsa_pss_expected_salt_len(alg, rsa, hash_length);
|
||||
ret = mbedtls_rsa_rsassa_pss_verify_ext(rsa,
|
||||
md_alg,
|
||||
(unsigned) hash_length,
|
||||
hash,
|
||||
md_alg,
|
||||
slen,
|
||||
signature);
|
||||
}
|
||||
} else
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS */
|
||||
{
|
||||
status = PSA_ERROR_INVALID_ARGUMENT;
|
||||
goto exit;
|
||||
}
|
||||
|
||||
/* Mbed TLS distinguishes "invalid padding" from "valid padding but
|
||||
* the rest of the signature is invalid". This has little use in
|
||||
* practice and PSA doesn't report this distinction. */
|
||||
status = (ret == MBEDTLS_ERR_RSA_INVALID_PADDING) ?
|
||||
PSA_ERROR_INVALID_SIGNATURE :
|
||||
mbedtls_to_psa_error(ret);
|
||||
|
||||
exit:
|
||||
mbedtls_rsa_free(rsa);
|
||||
mbedtls_free(rsa);
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
|
||||
* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
|
||||
|
||||
/****************************************************************/
|
||||
/* Asymmetric cryptography */
|
||||
/****************************************************************/
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
|
||||
static int psa_rsa_oaep_set_padding_mode(psa_algorithm_t alg,
|
||||
mbedtls_rsa_context *rsa)
|
||||
{
|
||||
psa_algorithm_t hash_alg = PSA_ALG_RSA_OAEP_GET_HASH(alg);
|
||||
mbedtls_md_type_t md_alg = mbedtls_md_type_from_psa_alg(hash_alg);
|
||||
|
||||
/* Just to get the error status right, as rsa_set_padding() doesn't
|
||||
* distinguish between "bad RSA algorithm" and "unknown hash". */
|
||||
if (mbedtls_md_info_from_type(md_alg) == NULL) {
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
|
||||
return mbedtls_rsa_set_padding(rsa, MBEDTLS_RSA_PKCS_V21, md_alg);
|
||||
}
|
||||
#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */
|
||||
|
||||
psa_status_t mbedtls_psa_asymmetric_encrypt(const psa_key_attributes_t *attributes,
|
||||
const uint8_t *key_buffer,
|
||||
size_t key_buffer_size,
|
||||
psa_algorithm_t alg,
|
||||
const uint8_t *input,
|
||||
size_t input_length,
|
||||
const uint8_t *salt,
|
||||
size_t salt_length,
|
||||
uint8_t *output,
|
||||
size_t output_size,
|
||||
size_t *output_length)
|
||||
{
|
||||
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
(void) key_buffer;
|
||||
(void) key_buffer_size;
|
||||
(void) input;
|
||||
(void) input_length;
|
||||
(void) salt;
|
||||
(void) salt_length;
|
||||
(void) output;
|
||||
(void) output_size;
|
||||
(void) output_length;
|
||||
|
||||
if (PSA_KEY_TYPE_IS_RSA(attributes->type)) {
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
|
||||
mbedtls_rsa_context *rsa = NULL;
|
||||
status = mbedtls_psa_rsa_load_representation(attributes->type,
|
||||
key_buffer,
|
||||
key_buffer_size,
|
||||
&rsa);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto rsa_exit;
|
||||
}
|
||||
|
||||
if (output_size < mbedtls_rsa_get_len(rsa)) {
|
||||
status = PSA_ERROR_BUFFER_TOO_SMALL;
|
||||
goto rsa_exit;
|
||||
}
|
||||
#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) ||
|
||||
* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */
|
||||
if (alg == PSA_ALG_RSA_PKCS1V15_CRYPT) {
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT)
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_rsa_pkcs1_encrypt(rsa,
|
||||
mbedtls_psa_get_random,
|
||||
MBEDTLS_PSA_RANDOM_STATE,
|
||||
input_length,
|
||||
input,
|
||||
output));
|
||||
#else
|
||||
status = PSA_ERROR_NOT_SUPPORTED;
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT */
|
||||
} else
|
||||
if (PSA_ALG_IS_RSA_OAEP(alg)) {
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
|
||||
status = mbedtls_to_psa_error(
|
||||
psa_rsa_oaep_set_padding_mode(alg, rsa));
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto rsa_exit;
|
||||
}
|
||||
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_rsa_rsaes_oaep_encrypt(rsa,
|
||||
mbedtls_psa_get_random,
|
||||
MBEDTLS_PSA_RANDOM_STATE,
|
||||
salt, salt_length,
|
||||
input_length,
|
||||
input,
|
||||
output));
|
||||
#else
|
||||
status = PSA_ERROR_NOT_SUPPORTED;
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP */
|
||||
} else {
|
||||
status = PSA_ERROR_INVALID_ARGUMENT;
|
||||
}
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
|
||||
rsa_exit:
|
||||
if (status == PSA_SUCCESS) {
|
||||
*output_length = mbedtls_rsa_get_len(rsa);
|
||||
}
|
||||
|
||||
mbedtls_rsa_free(rsa);
|
||||
mbedtls_free(rsa);
|
||||
#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) ||
|
||||
* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */
|
||||
} else {
|
||||
status = PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
psa_status_t mbedtls_psa_asymmetric_decrypt(const psa_key_attributes_t *attributes,
|
||||
const uint8_t *key_buffer,
|
||||
size_t key_buffer_size,
|
||||
psa_algorithm_t alg,
|
||||
const uint8_t *input,
|
||||
size_t input_length,
|
||||
const uint8_t *salt,
|
||||
size_t salt_length,
|
||||
uint8_t *output,
|
||||
size_t output_size,
|
||||
size_t *output_length)
|
||||
{
|
||||
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
|
||||
(void) key_buffer;
|
||||
(void) key_buffer_size;
|
||||
(void) input;
|
||||
(void) input_length;
|
||||
(void) salt;
|
||||
(void) salt_length;
|
||||
(void) output;
|
||||
(void) output_size;
|
||||
(void) output_length;
|
||||
|
||||
*output_length = 0;
|
||||
|
||||
if (attributes->type == PSA_KEY_TYPE_RSA_KEY_PAIR) {
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
|
||||
mbedtls_rsa_context *rsa = NULL;
|
||||
status = mbedtls_psa_rsa_load_representation(attributes->type,
|
||||
key_buffer,
|
||||
key_buffer_size,
|
||||
&rsa);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto rsa_exit;
|
||||
}
|
||||
|
||||
if (input_length != mbedtls_rsa_get_len(rsa)) {
|
||||
status = PSA_ERROR_INVALID_ARGUMENT;
|
||||
goto rsa_exit;
|
||||
}
|
||||
#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) ||
|
||||
* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */
|
||||
|
||||
if (alg == PSA_ALG_RSA_PKCS1V15_CRYPT) {
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT)
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_rsa_pkcs1_decrypt(rsa,
|
||||
mbedtls_psa_get_random,
|
||||
MBEDTLS_PSA_RANDOM_STATE,
|
||||
output_length,
|
||||
input,
|
||||
output,
|
||||
output_size));
|
||||
#else
|
||||
status = PSA_ERROR_NOT_SUPPORTED;
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT */
|
||||
} else
|
||||
if (PSA_ALG_IS_RSA_OAEP(alg)) {
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
|
||||
status = mbedtls_to_psa_error(
|
||||
psa_rsa_oaep_set_padding_mode(alg, rsa));
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto rsa_exit;
|
||||
}
|
||||
|
||||
status = mbedtls_to_psa_error(
|
||||
mbedtls_rsa_rsaes_oaep_decrypt(rsa,
|
||||
mbedtls_psa_get_random,
|
||||
MBEDTLS_PSA_RANDOM_STATE,
|
||||
salt, salt_length,
|
||||
output_length,
|
||||
input,
|
||||
output,
|
||||
output_size));
|
||||
#else
|
||||
status = PSA_ERROR_NOT_SUPPORTED;
|
||||
#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP */
|
||||
} else {
|
||||
status = PSA_ERROR_INVALID_ARGUMENT;
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \
|
||||
defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
|
||||
rsa_exit:
|
||||
mbedtls_rsa_free(rsa);
|
||||
mbedtls_free(rsa);
|
||||
#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) ||
|
||||
* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */
|
||||
} else {
|
||||
status = PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
#endif /* MBEDTLS_PSA_CRYPTO_C */
|
||||
373
thirdparty/mbedtls/library/psa_crypto_se.c
vendored
Normal file
373
thirdparty/mbedtls/library/psa_crypto_se.c
vendored
Normal file
@ -0,0 +1,373 @@
|
||||
/*
|
||||
* PSA crypto support for secure element drivers
|
||||
*/
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
|
||||
*/
|
||||
|
||||
#include "common.h"
|
||||
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
|
||||
|
||||
#include <stdint.h>
|
||||
#include <string.h>
|
||||
|
||||
#include "psa/crypto_se_driver.h"
|
||||
|
||||
#include "psa_crypto_se.h"
|
||||
|
||||
#if defined(MBEDTLS_PSA_ITS_FILE_C)
|
||||
#include "psa_crypto_its.h"
|
||||
#else /* Native ITS implementation */
|
||||
#include "psa/error.h"
|
||||
#include "psa/internal_trusted_storage.h"
|
||||
#endif
|
||||
|
||||
#include "mbedtls/platform.h"
|
||||
|
||||
|
||||
|
||||
/****************************************************************/
|
||||
/* Driver lookup */
|
||||
/****************************************************************/
|
||||
|
||||
/* This structure is identical to psa_drv_se_context_t declared in
|
||||
* `crypto_se_driver.h`, except that some parts are writable here
|
||||
* (non-const, or pointer to non-const). */
|
||||
typedef struct {
|
||||
void *persistent_data;
|
||||
size_t persistent_data_size;
|
||||
uintptr_t transient_data;
|
||||
} psa_drv_se_internal_context_t;
|
||||
|
||||
struct psa_se_drv_table_entry_s {
|
||||
psa_key_location_t location;
|
||||
const psa_drv_se_t *methods;
|
||||
union {
|
||||
psa_drv_se_internal_context_t internal;
|
||||
psa_drv_se_context_t context;
|
||||
} u;
|
||||
};
|
||||
|
||||
static psa_se_drv_table_entry_t driver_table[PSA_MAX_SE_DRIVERS];
|
||||
|
||||
psa_se_drv_table_entry_t *psa_get_se_driver_entry(
|
||||
psa_key_lifetime_t lifetime)
|
||||
{
|
||||
size_t i;
|
||||
psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(lifetime);
|
||||
/* In the driver table, location=0 means an entry that isn't used.
|
||||
* No driver has a location of 0 because it's a reserved value
|
||||
* (which designates transparent keys). Make sure we never return
|
||||
* a driver entry for location 0. */
|
||||
if (location == 0) {
|
||||
return NULL;
|
||||
}
|
||||
for (i = 0; i < PSA_MAX_SE_DRIVERS; i++) {
|
||||
if (driver_table[i].location == location) {
|
||||
return &driver_table[i];
|
||||
}
|
||||
}
|
||||
return NULL;
|
||||
}
|
||||
|
||||
const psa_drv_se_t *psa_get_se_driver_methods(
|
||||
const psa_se_drv_table_entry_t *driver)
|
||||
{
|
||||
return driver->methods;
|
||||
}
|
||||
|
||||
psa_drv_se_context_t *psa_get_se_driver_context(
|
||||
psa_se_drv_table_entry_t *driver)
|
||||
{
|
||||
return &driver->u.context;
|
||||
}
|
||||
|
||||
int psa_get_se_driver(psa_key_lifetime_t lifetime,
|
||||
const psa_drv_se_t **p_methods,
|
||||
psa_drv_se_context_t **p_drv_context)
|
||||
{
|
||||
psa_se_drv_table_entry_t *driver = psa_get_se_driver_entry(lifetime);
|
||||
if (p_methods != NULL) {
|
||||
*p_methods = (driver ? driver->methods : NULL);
|
||||
}
|
||||
if (p_drv_context != NULL) {
|
||||
*p_drv_context = (driver ? &driver->u.context : NULL);
|
||||
}
|
||||
return driver != NULL;
|
||||
}
|
||||
|
||||
|
||||
|
||||
/****************************************************************/
|
||||
/* Persistent data management */
|
||||
/****************************************************************/
|
||||
|
||||
static psa_status_t psa_get_se_driver_its_file_uid(
|
||||
const psa_se_drv_table_entry_t *driver,
|
||||
psa_storage_uid_t *uid)
|
||||
{
|
||||
if (driver->location > PSA_MAX_SE_LOCATION) {
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
|
||||
/* ITS file sizes are limited to 32 bits. */
|
||||
if (driver->u.internal.persistent_data_size > UINT32_MAX) {
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
|
||||
/* See the documentation of PSA_CRYPTO_SE_DRIVER_ITS_UID_BASE. */
|
||||
*uid = PSA_CRYPTO_SE_DRIVER_ITS_UID_BASE + driver->location;
|
||||
return PSA_SUCCESS;
|
||||
}
|
||||
|
||||
psa_status_t psa_load_se_persistent_data(
|
||||
const psa_se_drv_table_entry_t *driver)
|
||||
{
|
||||
psa_status_t status;
|
||||
psa_storage_uid_t uid;
|
||||
size_t length;
|
||||
|
||||
status = psa_get_se_driver_its_file_uid(driver, &uid);
|
||||
if (status != PSA_SUCCESS) {
|
||||
return status;
|
||||
}
|
||||
|
||||
/* Read the amount of persistent data that the driver requests.
|
||||
* If the data in storage is larger, it is truncated. If the data
|
||||
* in storage is smaller, silently keep what is already at the end
|
||||
* of the output buffer. */
|
||||
/* psa_get_se_driver_its_file_uid ensures that the size_t
|
||||
* persistent_data_size is in range, but compilers don't know that,
|
||||
* so cast to reassure them. */
|
||||
return psa_its_get(uid, 0,
|
||||
(uint32_t) driver->u.internal.persistent_data_size,
|
||||
driver->u.internal.persistent_data,
|
||||
&length);
|
||||
}
|
||||
|
||||
psa_status_t psa_save_se_persistent_data(
|
||||
const psa_se_drv_table_entry_t *driver)
|
||||
{
|
||||
psa_status_t status;
|
||||
psa_storage_uid_t uid;
|
||||
|
||||
status = psa_get_se_driver_its_file_uid(driver, &uid);
|
||||
if (status != PSA_SUCCESS) {
|
||||
return status;
|
||||
}
|
||||
|
||||
/* psa_get_se_driver_its_file_uid ensures that the size_t
|
||||
* persistent_data_size is in range, but compilers don't know that,
|
||||
* so cast to reassure them. */
|
||||
return psa_its_set(uid,
|
||||
(uint32_t) driver->u.internal.persistent_data_size,
|
||||
driver->u.internal.persistent_data,
|
||||
0);
|
||||
}
|
||||
|
||||
psa_status_t psa_destroy_se_persistent_data(psa_key_location_t location)
|
||||
{
|
||||
psa_storage_uid_t uid;
|
||||
if (location > PSA_MAX_SE_LOCATION) {
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
uid = PSA_CRYPTO_SE_DRIVER_ITS_UID_BASE + location;
|
||||
return psa_its_remove(uid);
|
||||
}
|
||||
|
||||
psa_status_t psa_find_se_slot_for_key(
|
||||
const psa_key_attributes_t *attributes,
|
||||
psa_key_creation_method_t method,
|
||||
psa_se_drv_table_entry_t *driver,
|
||||
psa_key_slot_number_t *slot_number)
|
||||
{
|
||||
psa_status_t status;
|
||||
psa_key_location_t key_location =
|
||||
PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes));
|
||||
|
||||
/* If the location is wrong, it's a bug in the library. */
|
||||
if (driver->location != key_location) {
|
||||
return PSA_ERROR_CORRUPTION_DETECTED;
|
||||
}
|
||||
|
||||
/* If the driver doesn't support key creation in any way, give up now. */
|
||||
if (driver->methods->key_management == NULL) {
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
|
||||
if (psa_get_key_slot_number(attributes, slot_number) == PSA_SUCCESS) {
|
||||
/* The application wants to use a specific slot. Allow it if
|
||||
* the driver supports it. On a system with isolation,
|
||||
* the crypto service must check that the application is
|
||||
* permitted to request this slot. */
|
||||
psa_drv_se_validate_slot_number_t p_validate_slot_number =
|
||||
driver->methods->key_management->p_validate_slot_number;
|
||||
if (p_validate_slot_number == NULL) {
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
status = p_validate_slot_number(&driver->u.context,
|
||||
driver->u.internal.persistent_data,
|
||||
attributes, method,
|
||||
*slot_number);
|
||||
} else if (method == PSA_KEY_CREATION_REGISTER) {
|
||||
/* The application didn't specify a slot number. This doesn't
|
||||
* make sense when registering a slot. */
|
||||
return PSA_ERROR_INVALID_ARGUMENT;
|
||||
} else {
|
||||
/* The application didn't tell us which slot to use. Let the driver
|
||||
* choose. This is the normal case. */
|
||||
psa_drv_se_allocate_key_t p_allocate =
|
||||
driver->methods->key_management->p_allocate;
|
||||
if (p_allocate == NULL) {
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
status = p_allocate(&driver->u.context,
|
||||
driver->u.internal.persistent_data,
|
||||
attributes, method,
|
||||
slot_number);
|
||||
}
|
||||
return status;
|
||||
}
|
||||
|
||||
psa_status_t psa_destroy_se_key(psa_se_drv_table_entry_t *driver,
|
||||
psa_key_slot_number_t slot_number)
|
||||
{
|
||||
psa_status_t status;
|
||||
psa_status_t storage_status;
|
||||
/* Normally a missing method would mean that the action is not
|
||||
* supported. But psa_destroy_key() is not supposed to return
|
||||
* PSA_ERROR_NOT_SUPPORTED: if you can create a key, you should
|
||||
* be able to destroy it. The only use case for a driver that
|
||||
* does not have a way to destroy keys at all is if the keys are
|
||||
* locked in a read-only state: we can use the keys but not
|
||||
* destroy them. Hence, if the driver doesn't support destroying
|
||||
* keys, it's really a lack of permission. */
|
||||
if (driver->methods->key_management == NULL ||
|
||||
driver->methods->key_management->p_destroy == NULL) {
|
||||
return PSA_ERROR_NOT_PERMITTED;
|
||||
}
|
||||
status = driver->methods->key_management->p_destroy(
|
||||
&driver->u.context,
|
||||
driver->u.internal.persistent_data,
|
||||
slot_number);
|
||||
storage_status = psa_save_se_persistent_data(driver);
|
||||
return status == PSA_SUCCESS ? storage_status : status;
|
||||
}
|
||||
|
||||
psa_status_t psa_init_all_se_drivers(void)
|
||||
{
|
||||
size_t i;
|
||||
for (i = 0; i < PSA_MAX_SE_DRIVERS; i++) {
|
||||
psa_se_drv_table_entry_t *driver = &driver_table[i];
|
||||
if (driver->location == 0) {
|
||||
continue; /* skipping unused entry */
|
||||
}
|
||||
const psa_drv_se_t *methods = psa_get_se_driver_methods(driver);
|
||||
if (methods->p_init != NULL) {
|
||||
psa_status_t status = methods->p_init(
|
||||
&driver->u.context,
|
||||
driver->u.internal.persistent_data,
|
||||
driver->location);
|
||||
if (status != PSA_SUCCESS) {
|
||||
return status;
|
||||
}
|
||||
status = psa_save_se_persistent_data(driver);
|
||||
if (status != PSA_SUCCESS) {
|
||||
return status;
|
||||
}
|
||||
}
|
||||
}
|
||||
return PSA_SUCCESS;
|
||||
}
|
||||
|
||||
|
||||
|
||||
/****************************************************************/
|
||||
/* Driver registration */
|
||||
/****************************************************************/
|
||||
|
||||
psa_status_t psa_register_se_driver(
|
||||
psa_key_location_t location,
|
||||
const psa_drv_se_t *methods)
|
||||
{
|
||||
size_t i;
|
||||
psa_status_t status;
|
||||
|
||||
if (methods->hal_version != PSA_DRV_SE_HAL_VERSION) {
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
/* Driver table entries are 0-initialized. 0 is not a valid driver
|
||||
* location because it means a transparent key. */
|
||||
MBEDTLS_STATIC_ASSERT(PSA_KEY_LOCATION_LOCAL_STORAGE == 0,
|
||||
"Secure element support requires 0 to mean a local key");
|
||||
|
||||
if (location == PSA_KEY_LOCATION_LOCAL_STORAGE) {
|
||||
return PSA_ERROR_INVALID_ARGUMENT;
|
||||
}
|
||||
if (location > PSA_MAX_SE_LOCATION) {
|
||||
return PSA_ERROR_NOT_SUPPORTED;
|
||||
}
|
||||
|
||||
for (i = 0; i < PSA_MAX_SE_DRIVERS; i++) {
|
||||
if (driver_table[i].location == 0) {
|
||||
break;
|
||||
}
|
||||
/* Check that location isn't already in use up to the first free
|
||||
* entry. Since entries are created in order and never deleted,
|
||||
* there can't be a used entry after the first free entry. */
|
||||
if (driver_table[i].location == location) {
|
||||
return PSA_ERROR_ALREADY_EXISTS;
|
||||
}
|
||||
}
|
||||
if (i == PSA_MAX_SE_DRIVERS) {
|
||||
return PSA_ERROR_INSUFFICIENT_MEMORY;
|
||||
}
|
||||
|
||||
driver_table[i].location = location;
|
||||
driver_table[i].methods = methods;
|
||||
driver_table[i].u.internal.persistent_data_size =
|
||||
methods->persistent_data_size;
|
||||
|
||||
if (methods->persistent_data_size != 0) {
|
||||
driver_table[i].u.internal.persistent_data =
|
||||
mbedtls_calloc(1, methods->persistent_data_size);
|
||||
if (driver_table[i].u.internal.persistent_data == NULL) {
|
||||
status = PSA_ERROR_INSUFFICIENT_MEMORY;
|
||||
goto error;
|
||||
}
|
||||
/* Load the driver's persistent data. On first use, the persistent
|
||||
* data does not exist in storage, and is initialized to
|
||||
* all-bits-zero by the calloc call just above. */
|
||||
status = psa_load_se_persistent_data(&driver_table[i]);
|
||||
if (status != PSA_SUCCESS && status != PSA_ERROR_DOES_NOT_EXIST) {
|
||||
goto error;
|
||||
}
|
||||
}
|
||||
|
||||
return PSA_SUCCESS;
|
||||
|
||||
error:
|
||||
memset(&driver_table[i], 0, sizeof(driver_table[i]));
|
||||
return status;
|
||||
}
|
||||
|
||||
void psa_unregister_all_se_drivers(void)
|
||||
{
|
||||
size_t i;
|
||||
for (i = 0; i < PSA_MAX_SE_DRIVERS; i++) {
|
||||
if (driver_table[i].u.internal.persistent_data != NULL) {
|
||||
mbedtls_free(driver_table[i].u.internal.persistent_data);
|
||||
}
|
||||
}
|
||||
memset(driver_table, 0, sizeof(driver_table));
|
||||
}
|
||||
|
||||
|
||||
|
||||
/****************************************************************/
|
||||
/* The end */
|
||||
/****************************************************************/
|
||||
|
||||
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
|
||||
1131
thirdparty/mbedtls/library/psa_crypto_slot_management.c
vendored
Normal file
1131
thirdparty/mbedtls/library/psa_crypto_slot_management.c
vendored
Normal file
File diff suppressed because it is too large
Load Diff
481
thirdparty/mbedtls/library/psa_crypto_storage.c
vendored
Normal file
481
thirdparty/mbedtls/library/psa_crypto_storage.c
vendored
Normal file
@ -0,0 +1,481 @@
|
||||
/*
|
||||
* PSA persistent key storage
|
||||
*/
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
|
||||
*/
|
||||
|
||||
#include "common.h"
|
||||
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
|
||||
|
||||
#include <stdlib.h>
|
||||
#include <string.h>
|
||||
|
||||
#include "psa/crypto.h"
|
||||
#include "psa_crypto_storage.h"
|
||||
#include "mbedtls/platform_util.h"
|
||||
|
||||
#if defined(MBEDTLS_PSA_ITS_FILE_C)
|
||||
#include "psa_crypto_its.h"
|
||||
#else /* Native ITS implementation */
|
||||
#include "psa/error.h"
|
||||
#include "psa/internal_trusted_storage.h"
|
||||
#endif
|
||||
|
||||
#include "mbedtls/platform.h"
|
||||
|
||||
|
||||
|
||||
/****************************************************************/
|
||||
/* Key storage */
|
||||
/****************************************************************/
|
||||
|
||||
/* Determine a file name (ITS file identifier) for the given key identifier.
|
||||
* The file name must be distinct from any file that is used for a purpose
|
||||
* other than storing a key. Currently, the only such file is the random seed
|
||||
* file whose name is PSA_CRYPTO_ITS_RANDOM_SEED_UID and whose value is
|
||||
* 0xFFFFFF52. */
|
||||
static psa_storage_uid_t psa_its_identifier_of_slot(mbedtls_svc_key_id_t key)
|
||||
{
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER)
|
||||
/* Encode the owner in the upper 32 bits. This means that if
|
||||
* owner values are nonzero (as they are on a PSA platform),
|
||||
* no key file will ever have a value less than 0x100000000, so
|
||||
* the whole range 0..0xffffffff is available for non-key files. */
|
||||
uint32_t unsigned_owner_id = MBEDTLS_SVC_KEY_ID_GET_OWNER_ID(key);
|
||||
return ((uint64_t) unsigned_owner_id << 32) |
|
||||
MBEDTLS_SVC_KEY_ID_GET_KEY_ID(key);
|
||||
#else
|
||||
/* Use the key id directly as a file name.
|
||||
* psa_is_key_id_valid() in psa_crypto_slot_management.c
|
||||
* is responsible for ensuring that key identifiers do not have a
|
||||
* value that is reserved for non-key files. */
|
||||
return key;
|
||||
#endif
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief Load persistent data for the given key slot number.
|
||||
*
|
||||
* This function reads data from a storage backend and returns the data in a
|
||||
* buffer.
|
||||
*
|
||||
* \param key Persistent identifier of the key to be loaded. This
|
||||
* should be an occupied storage location.
|
||||
* \param[out] data Buffer where the data is to be written.
|
||||
* \param data_size Size of the \c data buffer in bytes.
|
||||
*
|
||||
* \retval #PSA_SUCCESS \emptydescription
|
||||
* \retval #PSA_ERROR_DATA_INVALID \emptydescription
|
||||
* \retval #PSA_ERROR_DATA_CORRUPT \emptydescription
|
||||
* \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription
|
||||
* \retval #PSA_ERROR_DOES_NOT_EXIST \emptydescription
|
||||
*/
|
||||
static psa_status_t psa_crypto_storage_load(
|
||||
const mbedtls_svc_key_id_t key, uint8_t *data, size_t data_size)
|
||||
{
|
||||
psa_status_t status;
|
||||
psa_storage_uid_t data_identifier = psa_its_identifier_of_slot(key);
|
||||
struct psa_storage_info_t data_identifier_info;
|
||||
size_t data_length = 0;
|
||||
|
||||
status = psa_its_get_info(data_identifier, &data_identifier_info);
|
||||
if (status != PSA_SUCCESS) {
|
||||
return status;
|
||||
}
|
||||
|
||||
status = psa_its_get(data_identifier, 0, (uint32_t) data_size, data, &data_length);
|
||||
if (data_size != data_length) {
|
||||
return PSA_ERROR_DATA_INVALID;
|
||||
}
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
int psa_is_key_present_in_storage(const mbedtls_svc_key_id_t key)
|
||||
{
|
||||
psa_status_t ret;
|
||||
psa_storage_uid_t data_identifier = psa_its_identifier_of_slot(key);
|
||||
struct psa_storage_info_t data_identifier_info;
|
||||
|
||||
ret = psa_its_get_info(data_identifier, &data_identifier_info);
|
||||
|
||||
if (ret == PSA_ERROR_DOES_NOT_EXIST) {
|
||||
return 0;
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief Store persistent data for the given key slot number.
|
||||
*
|
||||
* This function stores the given data buffer to a persistent storage.
|
||||
*
|
||||
* \param key Persistent identifier of the key to be stored. This
|
||||
* should be an unoccupied storage location.
|
||||
* \param[in] data Buffer containing the data to be stored.
|
||||
* \param data_length The number of bytes
|
||||
* that make up the data.
|
||||
*
|
||||
* \retval #PSA_SUCCESS \emptydescription
|
||||
* \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription
|
||||
* \retval #PSA_ERROR_ALREADY_EXISTS \emptydescription
|
||||
* \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription
|
||||
* \retval #PSA_ERROR_DATA_INVALID \emptydescription
|
||||
*/
|
||||
static psa_status_t psa_crypto_storage_store(const mbedtls_svc_key_id_t key,
|
||||
const uint8_t *data,
|
||||
size_t data_length)
|
||||
{
|
||||
psa_status_t status;
|
||||
psa_storage_uid_t data_identifier = psa_its_identifier_of_slot(key);
|
||||
struct psa_storage_info_t data_identifier_info;
|
||||
|
||||
if (psa_is_key_present_in_storage(key) == 1) {
|
||||
return PSA_ERROR_ALREADY_EXISTS;
|
||||
}
|
||||
|
||||
status = psa_its_set(data_identifier, (uint32_t) data_length, data, 0);
|
||||
if (status != PSA_SUCCESS) {
|
||||
return PSA_ERROR_DATA_INVALID;
|
||||
}
|
||||
|
||||
status = psa_its_get_info(data_identifier, &data_identifier_info);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
if (data_identifier_info.size != data_length) {
|
||||
status = PSA_ERROR_DATA_INVALID;
|
||||
goto exit;
|
||||
}
|
||||
|
||||
exit:
|
||||
if (status != PSA_SUCCESS) {
|
||||
/* Remove the file in case we managed to create it but something
|
||||
* went wrong. It's ok if the file doesn't exist. If the file exists
|
||||
* but the removal fails, we're already reporting an error so there's
|
||||
* nothing else we can do. */
|
||||
(void) psa_its_remove(data_identifier);
|
||||
}
|
||||
return status;
|
||||
}
|
||||
|
||||
psa_status_t psa_destroy_persistent_key(const mbedtls_svc_key_id_t key)
|
||||
{
|
||||
psa_status_t ret;
|
||||
psa_storage_uid_t data_identifier = psa_its_identifier_of_slot(key);
|
||||
struct psa_storage_info_t data_identifier_info;
|
||||
|
||||
ret = psa_its_get_info(data_identifier, &data_identifier_info);
|
||||
if (ret == PSA_ERROR_DOES_NOT_EXIST) {
|
||||
return PSA_SUCCESS;
|
||||
}
|
||||
|
||||
if (psa_its_remove(data_identifier) != PSA_SUCCESS) {
|
||||
return PSA_ERROR_DATA_INVALID;
|
||||
}
|
||||
|
||||
ret = psa_its_get_info(data_identifier, &data_identifier_info);
|
||||
if (ret != PSA_ERROR_DOES_NOT_EXIST) {
|
||||
return PSA_ERROR_DATA_INVALID;
|
||||
}
|
||||
|
||||
return PSA_SUCCESS;
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief Get data length for given key slot number.
|
||||
*
|
||||
* \param key Persistent identifier whose stored data length
|
||||
* is to be obtained.
|
||||
* \param[out] data_length The number of bytes that make up the data.
|
||||
*
|
||||
* \retval #PSA_SUCCESS \emptydescription
|
||||
* \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription
|
||||
* \retval #PSA_ERROR_DOES_NOT_EXIST \emptydescription
|
||||
* \retval #PSA_ERROR_DATA_CORRUPT \emptydescription
|
||||
*/
|
||||
static psa_status_t psa_crypto_storage_get_data_length(
|
||||
const mbedtls_svc_key_id_t key,
|
||||
size_t *data_length)
|
||||
{
|
||||
psa_status_t status;
|
||||
psa_storage_uid_t data_identifier = psa_its_identifier_of_slot(key);
|
||||
struct psa_storage_info_t data_identifier_info;
|
||||
|
||||
status = psa_its_get_info(data_identifier, &data_identifier_info);
|
||||
if (status != PSA_SUCCESS) {
|
||||
return status;
|
||||
}
|
||||
|
||||
*data_length = (size_t) data_identifier_info.size;
|
||||
|
||||
return PSA_SUCCESS;
|
||||
}
|
||||
|
||||
/**
|
||||
* Persistent key storage magic header.
|
||||
*/
|
||||
#define PSA_KEY_STORAGE_MAGIC_HEADER "PSA\0KEY"
|
||||
#define PSA_KEY_STORAGE_MAGIC_HEADER_LENGTH (sizeof(PSA_KEY_STORAGE_MAGIC_HEADER))
|
||||
|
||||
typedef struct {
|
||||
uint8_t magic[PSA_KEY_STORAGE_MAGIC_HEADER_LENGTH];
|
||||
uint8_t version[4];
|
||||
uint8_t lifetime[sizeof(psa_key_lifetime_t)];
|
||||
uint8_t type[2];
|
||||
uint8_t bits[2];
|
||||
uint8_t policy[sizeof(psa_key_policy_t)];
|
||||
uint8_t data_len[4];
|
||||
uint8_t key_data[];
|
||||
} psa_persistent_key_storage_format;
|
||||
|
||||
void psa_format_key_data_for_storage(const uint8_t *data,
|
||||
const size_t data_length,
|
||||
const psa_key_attributes_t *attr,
|
||||
uint8_t *storage_data)
|
||||
{
|
||||
psa_persistent_key_storage_format *storage_format =
|
||||
(psa_persistent_key_storage_format *) storage_data;
|
||||
|
||||
memcpy(storage_format->magic, PSA_KEY_STORAGE_MAGIC_HEADER,
|
||||
PSA_KEY_STORAGE_MAGIC_HEADER_LENGTH);
|
||||
MBEDTLS_PUT_UINT32_LE(0, storage_format->version, 0);
|
||||
MBEDTLS_PUT_UINT32_LE(attr->lifetime, storage_format->lifetime, 0);
|
||||
MBEDTLS_PUT_UINT16_LE((uint16_t) attr->type, storage_format->type, 0);
|
||||
MBEDTLS_PUT_UINT16_LE((uint16_t) attr->bits, storage_format->bits, 0);
|
||||
MBEDTLS_PUT_UINT32_LE(attr->policy.usage, storage_format->policy, 0);
|
||||
MBEDTLS_PUT_UINT32_LE(attr->policy.alg, storage_format->policy, sizeof(uint32_t));
|
||||
MBEDTLS_PUT_UINT32_LE(attr->policy.alg2, storage_format->policy, 2 * sizeof(uint32_t));
|
||||
MBEDTLS_PUT_UINT32_LE(data_length, storage_format->data_len, 0);
|
||||
memcpy(storage_format->key_data, data, data_length);
|
||||
}
|
||||
|
||||
static psa_status_t check_magic_header(const uint8_t *data)
|
||||
{
|
||||
if (memcmp(data, PSA_KEY_STORAGE_MAGIC_HEADER,
|
||||
PSA_KEY_STORAGE_MAGIC_HEADER_LENGTH) != 0) {
|
||||
return PSA_ERROR_DATA_INVALID;
|
||||
}
|
||||
return PSA_SUCCESS;
|
||||
}
|
||||
|
||||
psa_status_t psa_parse_key_data_from_storage(const uint8_t *storage_data,
|
||||
size_t storage_data_length,
|
||||
uint8_t **key_data,
|
||||
size_t *key_data_length,
|
||||
psa_key_attributes_t *attr)
|
||||
{
|
||||
psa_status_t status;
|
||||
const psa_persistent_key_storage_format *storage_format =
|
||||
(const psa_persistent_key_storage_format *) storage_data;
|
||||
uint32_t version;
|
||||
|
||||
if (storage_data_length < sizeof(*storage_format)) {
|
||||
return PSA_ERROR_DATA_INVALID;
|
||||
}
|
||||
|
||||
status = check_magic_header(storage_data);
|
||||
if (status != PSA_SUCCESS) {
|
||||
return status;
|
||||
}
|
||||
|
||||
version = MBEDTLS_GET_UINT32_LE(storage_format->version, 0);
|
||||
if (version != 0) {
|
||||
return PSA_ERROR_DATA_INVALID;
|
||||
}
|
||||
|
||||
*key_data_length = MBEDTLS_GET_UINT32_LE(storage_format->data_len, 0);
|
||||
if (*key_data_length > (storage_data_length - sizeof(*storage_format)) ||
|
||||
*key_data_length > PSA_CRYPTO_MAX_STORAGE_SIZE) {
|
||||
return PSA_ERROR_DATA_INVALID;
|
||||
}
|
||||
|
||||
if (*key_data_length == 0) {
|
||||
*key_data = NULL;
|
||||
} else {
|
||||
*key_data = mbedtls_calloc(1, *key_data_length);
|
||||
if (*key_data == NULL) {
|
||||
return PSA_ERROR_INSUFFICIENT_MEMORY;
|
||||
}
|
||||
memcpy(*key_data, storage_format->key_data, *key_data_length);
|
||||
}
|
||||
|
||||
attr->lifetime = MBEDTLS_GET_UINT32_LE(storage_format->lifetime, 0);
|
||||
attr->type = MBEDTLS_GET_UINT16_LE(storage_format->type, 0);
|
||||
attr->bits = MBEDTLS_GET_UINT16_LE(storage_format->bits, 0);
|
||||
attr->policy.usage = MBEDTLS_GET_UINT32_LE(storage_format->policy, 0);
|
||||
attr->policy.alg = MBEDTLS_GET_UINT32_LE(storage_format->policy, sizeof(uint32_t));
|
||||
attr->policy.alg2 = MBEDTLS_GET_UINT32_LE(storage_format->policy, 2 * sizeof(uint32_t));
|
||||
|
||||
return PSA_SUCCESS;
|
||||
}
|
||||
|
||||
psa_status_t psa_save_persistent_key(const psa_key_attributes_t *attr,
|
||||
const uint8_t *data,
|
||||
const size_t data_length)
|
||||
{
|
||||
size_t storage_data_length;
|
||||
uint8_t *storage_data;
|
||||
psa_status_t status;
|
||||
|
||||
/* All keys saved to persistent storage always have a key context */
|
||||
if (data == NULL || data_length == 0) {
|
||||
return PSA_ERROR_INVALID_ARGUMENT;
|
||||
}
|
||||
|
||||
if (data_length > PSA_CRYPTO_MAX_STORAGE_SIZE) {
|
||||
return PSA_ERROR_INSUFFICIENT_STORAGE;
|
||||
}
|
||||
storage_data_length = data_length + sizeof(psa_persistent_key_storage_format);
|
||||
|
||||
storage_data = mbedtls_calloc(1, storage_data_length);
|
||||
if (storage_data == NULL) {
|
||||
return PSA_ERROR_INSUFFICIENT_MEMORY;
|
||||
}
|
||||
|
||||
psa_format_key_data_for_storage(data, data_length, attr, storage_data);
|
||||
|
||||
status = psa_crypto_storage_store(attr->id,
|
||||
storage_data, storage_data_length);
|
||||
|
||||
mbedtls_zeroize_and_free(storage_data, storage_data_length);
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
void psa_free_persistent_key_data(uint8_t *key_data, size_t key_data_length)
|
||||
{
|
||||
mbedtls_zeroize_and_free(key_data, key_data_length);
|
||||
}
|
||||
|
||||
psa_status_t psa_load_persistent_key(psa_key_attributes_t *attr,
|
||||
uint8_t **data,
|
||||
size_t *data_length)
|
||||
{
|
||||
psa_status_t status = PSA_SUCCESS;
|
||||
uint8_t *loaded_data;
|
||||
size_t storage_data_length = 0;
|
||||
mbedtls_svc_key_id_t key = attr->id;
|
||||
|
||||
status = psa_crypto_storage_get_data_length(key, &storage_data_length);
|
||||
if (status != PSA_SUCCESS) {
|
||||
return status;
|
||||
}
|
||||
|
||||
loaded_data = mbedtls_calloc(1, storage_data_length);
|
||||
|
||||
if (loaded_data == NULL) {
|
||||
return PSA_ERROR_INSUFFICIENT_MEMORY;
|
||||
}
|
||||
|
||||
status = psa_crypto_storage_load(key, loaded_data, storage_data_length);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
status = psa_parse_key_data_from_storage(loaded_data, storage_data_length,
|
||||
data, data_length, attr);
|
||||
|
||||
/* All keys saved to persistent storage always have a key context */
|
||||
if (status == PSA_SUCCESS &&
|
||||
(*data == NULL || *data_length == 0)) {
|
||||
status = PSA_ERROR_STORAGE_FAILURE;
|
||||
}
|
||||
|
||||
exit:
|
||||
mbedtls_zeroize_and_free(loaded_data, storage_data_length);
|
||||
return status;
|
||||
}
|
||||
|
||||
|
||||
|
||||
/****************************************************************/
|
||||
/* Transactions */
|
||||
/****************************************************************/
|
||||
|
||||
#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
|
||||
|
||||
psa_crypto_transaction_t psa_crypto_transaction;
|
||||
|
||||
psa_status_t psa_crypto_save_transaction(void)
|
||||
{
|
||||
struct psa_storage_info_t p_info;
|
||||
psa_status_t status;
|
||||
status = psa_its_get_info(PSA_CRYPTO_ITS_TRANSACTION_UID, &p_info);
|
||||
if (status == PSA_SUCCESS) {
|
||||
/* This shouldn't happen: we're trying to start a transaction while
|
||||
* there is still a transaction that hasn't been replayed. */
|
||||
return PSA_ERROR_CORRUPTION_DETECTED;
|
||||
} else if (status != PSA_ERROR_DOES_NOT_EXIST) {
|
||||
return status;
|
||||
}
|
||||
return psa_its_set(PSA_CRYPTO_ITS_TRANSACTION_UID,
|
||||
sizeof(psa_crypto_transaction),
|
||||
&psa_crypto_transaction,
|
||||
0);
|
||||
}
|
||||
|
||||
psa_status_t psa_crypto_load_transaction(void)
|
||||
{
|
||||
psa_status_t status;
|
||||
size_t length;
|
||||
status = psa_its_get(PSA_CRYPTO_ITS_TRANSACTION_UID, 0,
|
||||
sizeof(psa_crypto_transaction),
|
||||
&psa_crypto_transaction, &length);
|
||||
if (status != PSA_SUCCESS) {
|
||||
return status;
|
||||
}
|
||||
if (length != sizeof(psa_crypto_transaction)) {
|
||||
return PSA_ERROR_DATA_INVALID;
|
||||
}
|
||||
return PSA_SUCCESS;
|
||||
}
|
||||
|
||||
psa_status_t psa_crypto_stop_transaction(void)
|
||||
{
|
||||
psa_status_t status = psa_its_remove(PSA_CRYPTO_ITS_TRANSACTION_UID);
|
||||
/* Whether or not updating the storage succeeded, the transaction is
|
||||
* finished now. It's too late to go back, so zero out the in-memory
|
||||
* data. */
|
||||
memset(&psa_crypto_transaction, 0, sizeof(psa_crypto_transaction));
|
||||
return status;
|
||||
}
|
||||
|
||||
#endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
|
||||
|
||||
|
||||
|
||||
/****************************************************************/
|
||||
/* Random generator state */
|
||||
/****************************************************************/
|
||||
|
||||
#if defined(MBEDTLS_PSA_INJECT_ENTROPY)
|
||||
psa_status_t mbedtls_psa_storage_inject_entropy(const unsigned char *seed,
|
||||
size_t seed_size)
|
||||
{
|
||||
psa_status_t status;
|
||||
struct psa_storage_info_t p_info;
|
||||
|
||||
status = psa_its_get_info(PSA_CRYPTO_ITS_RANDOM_SEED_UID, &p_info);
|
||||
|
||||
if (PSA_ERROR_DOES_NOT_EXIST == status) { /* No seed exists */
|
||||
status = psa_its_set(PSA_CRYPTO_ITS_RANDOM_SEED_UID, seed_size, seed, 0);
|
||||
} else if (PSA_SUCCESS == status) {
|
||||
/* You should not be here. Seed needs to be injected only once */
|
||||
status = PSA_ERROR_NOT_PERMITTED;
|
||||
}
|
||||
return status;
|
||||
}
|
||||
#endif /* MBEDTLS_PSA_INJECT_ENTROPY */
|
||||
|
||||
|
||||
|
||||
/****************************************************************/
|
||||
/* The end */
|
||||
/****************************************************************/
|
||||
|
||||
#endif /* MBEDTLS_PSA_CRYPTO_STORAGE_C */
|
||||
254
thirdparty/mbedtls/library/psa_its_file.c
vendored
Normal file
254
thirdparty/mbedtls/library/psa_its_file.c
vendored
Normal file
@ -0,0 +1,254 @@
|
||||
/*
|
||||
* PSA ITS simulator over stdio files.
|
||||
*/
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
|
||||
*/
|
||||
|
||||
#include "common.h"
|
||||
|
||||
#if defined(MBEDTLS_PSA_ITS_FILE_C)
|
||||
|
||||
#include "mbedtls/platform.h"
|
||||
|
||||
#if defined(_WIN32)
|
||||
#include <windows.h>
|
||||
#endif
|
||||
|
||||
#include "psa_crypto_its.h"
|
||||
|
||||
#include <limits.h>
|
||||
#include <stdint.h>
|
||||
#include <stdio.h>
|
||||
#include <string.h>
|
||||
|
||||
#if !defined(PSA_ITS_STORAGE_PREFIX)
|
||||
#define PSA_ITS_STORAGE_PREFIX ""
|
||||
#endif
|
||||
|
||||
#define PSA_ITS_STORAGE_FILENAME_PATTERN "%08x%08x"
|
||||
#define PSA_ITS_STORAGE_SUFFIX ".psa_its"
|
||||
#define PSA_ITS_STORAGE_FILENAME_LENGTH \
|
||||
(sizeof(PSA_ITS_STORAGE_PREFIX) - 1 + /*prefix without terminating 0*/ \
|
||||
16 + /*UID (64-bit number in hex)*/ \
|
||||
sizeof(PSA_ITS_STORAGE_SUFFIX) - 1 + /*suffix without terminating 0*/ \
|
||||
1 /*terminating null byte*/)
|
||||
#define PSA_ITS_STORAGE_TEMP \
|
||||
PSA_ITS_STORAGE_PREFIX "tempfile" PSA_ITS_STORAGE_SUFFIX
|
||||
|
||||
/* The maximum value of psa_storage_info_t.size */
|
||||
#define PSA_ITS_MAX_SIZE 0xffffffff
|
||||
|
||||
#define PSA_ITS_MAGIC_STRING "PSA\0ITS\0"
|
||||
#define PSA_ITS_MAGIC_LENGTH 8
|
||||
|
||||
/* As rename fails on Windows if the new filepath already exists,
|
||||
* use MoveFileExA with the MOVEFILE_REPLACE_EXISTING flag instead.
|
||||
* Returns 0 on success, nonzero on failure. */
|
||||
#if defined(_WIN32)
|
||||
#define rename_replace_existing(oldpath, newpath) \
|
||||
(!MoveFileExA(oldpath, newpath, MOVEFILE_REPLACE_EXISTING))
|
||||
#else
|
||||
#define rename_replace_existing(oldpath, newpath) rename(oldpath, newpath)
|
||||
#endif
|
||||
|
||||
typedef struct {
|
||||
uint8_t magic[PSA_ITS_MAGIC_LENGTH];
|
||||
uint8_t size[sizeof(uint32_t)];
|
||||
uint8_t flags[sizeof(psa_storage_create_flags_t)];
|
||||
} psa_its_file_header_t;
|
||||
|
||||
static void psa_its_fill_filename(psa_storage_uid_t uid, char *filename)
|
||||
{
|
||||
/* Break up the UID into two 32-bit pieces so as not to rely on
|
||||
* long long support in snprintf. */
|
||||
mbedtls_snprintf(filename, PSA_ITS_STORAGE_FILENAME_LENGTH,
|
||||
"%s" PSA_ITS_STORAGE_FILENAME_PATTERN "%s",
|
||||
PSA_ITS_STORAGE_PREFIX,
|
||||
(unsigned) (uid >> 32),
|
||||
(unsigned) (uid & 0xffffffff),
|
||||
PSA_ITS_STORAGE_SUFFIX);
|
||||
}
|
||||
|
||||
static psa_status_t psa_its_read_file(psa_storage_uid_t uid,
|
||||
struct psa_storage_info_t *p_info,
|
||||
FILE **p_stream)
|
||||
{
|
||||
char filename[PSA_ITS_STORAGE_FILENAME_LENGTH];
|
||||
psa_its_file_header_t header;
|
||||
size_t n;
|
||||
|
||||
*p_stream = NULL;
|
||||
psa_its_fill_filename(uid, filename);
|
||||
*p_stream = fopen(filename, "rb");
|
||||
if (*p_stream == NULL) {
|
||||
return PSA_ERROR_DOES_NOT_EXIST;
|
||||
}
|
||||
|
||||
/* Ensure no stdio buffering of secrets, as such buffers cannot be wiped. */
|
||||
mbedtls_setbuf(*p_stream, NULL);
|
||||
|
||||
n = fread(&header, 1, sizeof(header), *p_stream);
|
||||
if (n != sizeof(header)) {
|
||||
return PSA_ERROR_DATA_CORRUPT;
|
||||
}
|
||||
if (memcmp(header.magic, PSA_ITS_MAGIC_STRING,
|
||||
PSA_ITS_MAGIC_LENGTH) != 0) {
|
||||
return PSA_ERROR_DATA_CORRUPT;
|
||||
}
|
||||
|
||||
p_info->size = MBEDTLS_GET_UINT32_LE(header.size, 0);
|
||||
p_info->flags = MBEDTLS_GET_UINT32_LE(header.flags, 0);
|
||||
|
||||
return PSA_SUCCESS;
|
||||
}
|
||||
|
||||
psa_status_t psa_its_get_info(psa_storage_uid_t uid,
|
||||
struct psa_storage_info_t *p_info)
|
||||
{
|
||||
psa_status_t status;
|
||||
FILE *stream = NULL;
|
||||
status = psa_its_read_file(uid, p_info, &stream);
|
||||
if (stream != NULL) {
|
||||
fclose(stream);
|
||||
}
|
||||
return status;
|
||||
}
|
||||
|
||||
psa_status_t psa_its_get(psa_storage_uid_t uid,
|
||||
uint32_t data_offset,
|
||||
uint32_t data_length,
|
||||
void *p_data,
|
||||
size_t *p_data_length)
|
||||
{
|
||||
psa_status_t status;
|
||||
FILE *stream = NULL;
|
||||
size_t n;
|
||||
struct psa_storage_info_t info;
|
||||
|
||||
status = psa_its_read_file(uid, &info, &stream);
|
||||
if (status != PSA_SUCCESS) {
|
||||
goto exit;
|
||||
}
|
||||
status = PSA_ERROR_INVALID_ARGUMENT;
|
||||
if (data_offset + data_length < data_offset) {
|
||||
goto exit;
|
||||
}
|
||||
#if SIZE_MAX < 0xffffffff
|
||||
if (data_offset + data_length > SIZE_MAX) {
|
||||
goto exit;
|
||||
}
|
||||
#endif
|
||||
if (data_offset + data_length > info.size) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
status = PSA_ERROR_STORAGE_FAILURE;
|
||||
#if LONG_MAX < 0xffffffff
|
||||
while (data_offset > LONG_MAX) {
|
||||
if (fseek(stream, LONG_MAX, SEEK_CUR) != 0) {
|
||||
goto exit;
|
||||
}
|
||||
data_offset -= LONG_MAX;
|
||||
}
|
||||
#endif
|
||||
if (fseek(stream, data_offset, SEEK_CUR) != 0) {
|
||||
goto exit;
|
||||
}
|
||||
n = fread(p_data, 1, data_length, stream);
|
||||
if (n != data_length) {
|
||||
goto exit;
|
||||
}
|
||||
status = PSA_SUCCESS;
|
||||
if (p_data_length != NULL) {
|
||||
*p_data_length = n;
|
||||
}
|
||||
|
||||
exit:
|
||||
if (stream != NULL) {
|
||||
fclose(stream);
|
||||
}
|
||||
return status;
|
||||
}
|
||||
|
||||
psa_status_t psa_its_set(psa_storage_uid_t uid,
|
||||
uint32_t data_length,
|
||||
const void *p_data,
|
||||
psa_storage_create_flags_t create_flags)
|
||||
{
|
||||
if (uid == 0) {
|
||||
return PSA_ERROR_INVALID_HANDLE;
|
||||
}
|
||||
|
||||
psa_status_t status = PSA_ERROR_STORAGE_FAILURE;
|
||||
char filename[PSA_ITS_STORAGE_FILENAME_LENGTH];
|
||||
FILE *stream = NULL;
|
||||
psa_its_file_header_t header;
|
||||
size_t n;
|
||||
|
||||
memcpy(header.magic, PSA_ITS_MAGIC_STRING, PSA_ITS_MAGIC_LENGTH);
|
||||
MBEDTLS_PUT_UINT32_LE(data_length, header.size, 0);
|
||||
MBEDTLS_PUT_UINT32_LE(create_flags, header.flags, 0);
|
||||
|
||||
psa_its_fill_filename(uid, filename);
|
||||
stream = fopen(PSA_ITS_STORAGE_TEMP, "wb");
|
||||
|
||||
if (stream == NULL) {
|
||||
goto exit;
|
||||
}
|
||||
|
||||
/* Ensure no stdio buffering of secrets, as such buffers cannot be wiped. */
|
||||
mbedtls_setbuf(stream, NULL);
|
||||
|
||||
status = PSA_ERROR_INSUFFICIENT_STORAGE;
|
||||
n = fwrite(&header, 1, sizeof(header), stream);
|
||||
if (n != sizeof(header)) {
|
||||
goto exit;
|
||||
}
|
||||
if (data_length != 0) {
|
||||
n = fwrite(p_data, 1, data_length, stream);
|
||||
if (n != data_length) {
|
||||
goto exit;
|
||||
}
|
||||
}
|
||||
status = PSA_SUCCESS;
|
||||
|
||||
exit:
|
||||
if (stream != NULL) {
|
||||
int ret = fclose(stream);
|
||||
if (status == PSA_SUCCESS && ret != 0) {
|
||||
status = PSA_ERROR_INSUFFICIENT_STORAGE;
|
||||
}
|
||||
}
|
||||
if (status == PSA_SUCCESS) {
|
||||
if (rename_replace_existing(PSA_ITS_STORAGE_TEMP, filename) != 0) {
|
||||
status = PSA_ERROR_STORAGE_FAILURE;
|
||||
}
|
||||
}
|
||||
/* The temporary file may still exist, but only in failure cases where
|
||||
* we're already reporting an error. So there's nothing we can do on
|
||||
* failure. If the function succeeded, and in some error cases, the
|
||||
* temporary file doesn't exist and so remove() is expected to fail.
|
||||
* Thus we just ignore the return status of remove(). */
|
||||
(void) remove(PSA_ITS_STORAGE_TEMP);
|
||||
return status;
|
||||
}
|
||||
|
||||
psa_status_t psa_its_remove(psa_storage_uid_t uid)
|
||||
{
|
||||
char filename[PSA_ITS_STORAGE_FILENAME_LENGTH];
|
||||
FILE *stream;
|
||||
psa_its_fill_filename(uid, filename);
|
||||
stream = fopen(filename, "rb");
|
||||
if (stream == NULL) {
|
||||
return PSA_ERROR_DOES_NOT_EXIST;
|
||||
}
|
||||
fclose(stream);
|
||||
if (remove(filename) != 0) {
|
||||
return PSA_ERROR_STORAGE_FAILURE;
|
||||
}
|
||||
return PSA_SUCCESS;
|
||||
}
|
||||
|
||||
#endif /* MBEDTLS_PSA_ITS_FILE_C */
|
||||
608
thirdparty/mbedtls/library/psa_util.c
vendored
Normal file
608
thirdparty/mbedtls/library/psa_util.c
vendored
Normal file
@ -0,0 +1,608 @@
|
||||
/*
|
||||
* PSA hashing layer on top of Mbed TLS software crypto
|
||||
*/
|
||||
/*
|
||||
* Copyright The Mbed TLS Contributors
|
||||
* SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
|
||||
*/
|
||||
|
||||
#include "common.h"
|
||||
|
||||
/* This is needed for MBEDTLS_ERR_XXX macros */
|
||||
#include <mbedtls/error.h>
|
||||
|
||||
#if defined(MBEDTLS_ASN1_WRITE_C)
|
||||
#include <mbedtls/asn1write.h>
|
||||
#include <psa/crypto_sizes.h>
|
||||
#endif
|
||||
|
||||
#include "psa_util_internal.h"
|
||||
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_CLIENT)
|
||||
|
||||
#include <psa/crypto.h>
|
||||
|
||||
#if defined(MBEDTLS_MD_LIGHT)
|
||||
#include <mbedtls/md.h>
|
||||
#endif
|
||||
#if defined(MBEDTLS_LMS_C)
|
||||
#include <mbedtls/lms.h>
|
||||
#endif
|
||||
#if defined(MBEDTLS_SSL_TLS_C) && \
|
||||
(defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3))
|
||||
#include <mbedtls/ssl.h>
|
||||
#endif
|
||||
#if defined(PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY) || \
|
||||
defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC)
|
||||
#include <mbedtls/rsa.h>
|
||||
#endif
|
||||
#if defined(MBEDTLS_USE_PSA_CRYPTO) && \
|
||||
defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY)
|
||||
#include <mbedtls/ecp.h>
|
||||
#endif
|
||||
#if defined(MBEDTLS_PK_C)
|
||||
#include <mbedtls/pk.h>
|
||||
#endif
|
||||
#if defined(MBEDTLS_BLOCK_CIPHER_SOME_PSA)
|
||||
#include <mbedtls/cipher.h>
|
||||
#endif
|
||||
#include <mbedtls/entropy.h>
|
||||
|
||||
/* PSA_SUCCESS is kept at the top of each error table since
|
||||
* it's the most common status when everything functions properly. */
|
||||
#if defined(MBEDTLS_MD_LIGHT)
|
||||
const mbedtls_error_pair_t psa_to_md_errors[] =
|
||||
{
|
||||
{ PSA_SUCCESS, 0 },
|
||||
{ PSA_ERROR_NOT_SUPPORTED, MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE },
|
||||
{ PSA_ERROR_INVALID_ARGUMENT, MBEDTLS_ERR_MD_BAD_INPUT_DATA },
|
||||
{ PSA_ERROR_INSUFFICIENT_MEMORY, MBEDTLS_ERR_MD_ALLOC_FAILED }
|
||||
};
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_BLOCK_CIPHER_SOME_PSA)
|
||||
const mbedtls_error_pair_t psa_to_cipher_errors[] =
|
||||
{
|
||||
{ PSA_SUCCESS, 0 },
|
||||
{ PSA_ERROR_NOT_SUPPORTED, MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE },
|
||||
{ PSA_ERROR_INVALID_ARGUMENT, MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA },
|
||||
{ PSA_ERROR_INSUFFICIENT_MEMORY, MBEDTLS_ERR_CIPHER_ALLOC_FAILED }
|
||||
};
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_LMS_C)
|
||||
const mbedtls_error_pair_t psa_to_lms_errors[] =
|
||||
{
|
||||
{ PSA_SUCCESS, 0 },
|
||||
{ PSA_ERROR_BUFFER_TOO_SMALL, MBEDTLS_ERR_LMS_BUFFER_TOO_SMALL },
|
||||
{ PSA_ERROR_INVALID_ARGUMENT, MBEDTLS_ERR_LMS_BAD_INPUT_DATA }
|
||||
};
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_SSL_TLS_C) && \
|
||||
(defined(MBEDTLS_USE_PSA_CRYPTO) || defined(MBEDTLS_SSL_PROTO_TLS1_3))
|
||||
const mbedtls_error_pair_t psa_to_ssl_errors[] =
|
||||
{
|
||||
{ PSA_SUCCESS, 0 },
|
||||
{ PSA_ERROR_INSUFFICIENT_MEMORY, MBEDTLS_ERR_SSL_ALLOC_FAILED },
|
||||
{ PSA_ERROR_NOT_SUPPORTED, MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE },
|
||||
{ PSA_ERROR_INVALID_SIGNATURE, MBEDTLS_ERR_SSL_INVALID_MAC },
|
||||
{ PSA_ERROR_INVALID_ARGUMENT, MBEDTLS_ERR_SSL_BAD_INPUT_DATA },
|
||||
{ PSA_ERROR_BAD_STATE, MBEDTLS_ERR_SSL_INTERNAL_ERROR },
|
||||
{ PSA_ERROR_BUFFER_TOO_SMALL, MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL }
|
||||
};
|
||||
#endif
|
||||
|
||||
#if defined(PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY) || \
|
||||
defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC)
|
||||
const mbedtls_error_pair_t psa_to_pk_rsa_errors[] =
|
||||
{
|
||||
{ PSA_SUCCESS, 0 },
|
||||
{ PSA_ERROR_NOT_PERMITTED, MBEDTLS_ERR_RSA_BAD_INPUT_DATA },
|
||||
{ PSA_ERROR_INVALID_ARGUMENT, MBEDTLS_ERR_RSA_BAD_INPUT_DATA },
|
||||
{ PSA_ERROR_INVALID_HANDLE, MBEDTLS_ERR_RSA_BAD_INPUT_DATA },
|
||||
{ PSA_ERROR_BUFFER_TOO_SMALL, MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE },
|
||||
{ PSA_ERROR_INSUFFICIENT_ENTROPY, MBEDTLS_ERR_RSA_RNG_FAILED },
|
||||
{ PSA_ERROR_INVALID_SIGNATURE, MBEDTLS_ERR_RSA_VERIFY_FAILED },
|
||||
{ PSA_ERROR_INVALID_PADDING, MBEDTLS_ERR_RSA_INVALID_PADDING }
|
||||
};
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_USE_PSA_CRYPTO) && \
|
||||
defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY)
|
||||
const mbedtls_error_pair_t psa_to_pk_ecdsa_errors[] =
|
||||
{
|
||||
{ PSA_SUCCESS, 0 },
|
||||
{ PSA_ERROR_NOT_PERMITTED, MBEDTLS_ERR_ECP_BAD_INPUT_DATA },
|
||||
{ PSA_ERROR_INVALID_ARGUMENT, MBEDTLS_ERR_ECP_BAD_INPUT_DATA },
|
||||
{ PSA_ERROR_INVALID_HANDLE, MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE },
|
||||
{ PSA_ERROR_BUFFER_TOO_SMALL, MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL },
|
||||
{ PSA_ERROR_INSUFFICIENT_ENTROPY, MBEDTLS_ERR_ECP_RANDOM_FAILED },
|
||||
{ PSA_ERROR_INVALID_SIGNATURE, MBEDTLS_ERR_ECP_VERIFY_FAILED }
|
||||
};
|
||||
#endif
|
||||
|
||||
int psa_generic_status_to_mbedtls(psa_status_t status)
|
||||
{
|
||||
switch (status) {
|
||||
case PSA_SUCCESS:
|
||||
return 0;
|
||||
case PSA_ERROR_NOT_SUPPORTED:
|
||||
return MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED;
|
||||
case PSA_ERROR_CORRUPTION_DETECTED:
|
||||
return MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
||||
case PSA_ERROR_COMMUNICATION_FAILURE:
|
||||
case PSA_ERROR_HARDWARE_FAILURE:
|
||||
return MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED;
|
||||
case PSA_ERROR_NOT_PERMITTED:
|
||||
default:
|
||||
return MBEDTLS_ERR_ERROR_GENERIC_ERROR;
|
||||
}
|
||||
}
|
||||
|
||||
int psa_status_to_mbedtls(psa_status_t status,
|
||||
const mbedtls_error_pair_t *local_translations,
|
||||
size_t local_errors_num,
|
||||
int (*fallback_f)(psa_status_t))
|
||||
{
|
||||
for (size_t i = 0; i < local_errors_num; i++) {
|
||||
if (status == local_translations[i].psa_status) {
|
||||
return local_translations[i].mbedtls_error;
|
||||
}
|
||||
}
|
||||
return fallback_f(status);
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_PK_C)
|
||||
int psa_pk_status_to_mbedtls(psa_status_t status)
|
||||
{
|
||||
switch (status) {
|
||||
case PSA_ERROR_INVALID_HANDLE:
|
||||
return MBEDTLS_ERR_PK_KEY_INVALID_FORMAT;
|
||||
case PSA_ERROR_BUFFER_TOO_SMALL:
|
||||
return MBEDTLS_ERR_PK_BUFFER_TOO_SMALL;
|
||||
case PSA_ERROR_NOT_SUPPORTED:
|
||||
return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE;
|
||||
case PSA_ERROR_INVALID_ARGUMENT:
|
||||
return MBEDTLS_ERR_PK_INVALID_ALG;
|
||||
case PSA_ERROR_NOT_PERMITTED:
|
||||
return MBEDTLS_ERR_PK_TYPE_MISMATCH;
|
||||
case PSA_ERROR_INSUFFICIENT_MEMORY:
|
||||
return MBEDTLS_ERR_PK_ALLOC_FAILED;
|
||||
case PSA_ERROR_BAD_STATE:
|
||||
return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
|
||||
case PSA_ERROR_DATA_CORRUPT:
|
||||
case PSA_ERROR_DATA_INVALID:
|
||||
case PSA_ERROR_STORAGE_FAILURE:
|
||||
return MBEDTLS_ERR_PK_FILE_IO_ERROR;
|
||||
default:
|
||||
return psa_generic_status_to_mbedtls(status);
|
||||
}
|
||||
}
|
||||
#endif /* MBEDTLS_PK_C */
|
||||
|
||||
/****************************************************************/
|
||||
/* Key management */
|
||||
/****************************************************************/
|
||||
|
||||
#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY)
|
||||
psa_ecc_family_t mbedtls_ecc_group_to_psa(mbedtls_ecp_group_id grpid,
|
||||
size_t *bits)
|
||||
{
|
||||
switch (grpid) {
|
||||
#if defined(MBEDTLS_ECP_HAVE_SECP192R1)
|
||||
case MBEDTLS_ECP_DP_SECP192R1:
|
||||
*bits = 192;
|
||||
return PSA_ECC_FAMILY_SECP_R1;
|
||||
#endif
|
||||
#if defined(MBEDTLS_ECP_HAVE_SECP224R1)
|
||||
case MBEDTLS_ECP_DP_SECP224R1:
|
||||
*bits = 224;
|
||||
return PSA_ECC_FAMILY_SECP_R1;
|
||||
#endif
|
||||
#if defined(MBEDTLS_ECP_HAVE_SECP256R1)
|
||||
case MBEDTLS_ECP_DP_SECP256R1:
|
||||
*bits = 256;
|
||||
return PSA_ECC_FAMILY_SECP_R1;
|
||||
#endif
|
||||
#if defined(MBEDTLS_ECP_HAVE_SECP384R1)
|
||||
case MBEDTLS_ECP_DP_SECP384R1:
|
||||
*bits = 384;
|
||||
return PSA_ECC_FAMILY_SECP_R1;
|
||||
#endif
|
||||
#if defined(MBEDTLS_ECP_HAVE_SECP521R1)
|
||||
case MBEDTLS_ECP_DP_SECP521R1:
|
||||
*bits = 521;
|
||||
return PSA_ECC_FAMILY_SECP_R1;
|
||||
#endif
|
||||
#if defined(MBEDTLS_ECP_HAVE_BP256R1)
|
||||
case MBEDTLS_ECP_DP_BP256R1:
|
||||
*bits = 256;
|
||||
return PSA_ECC_FAMILY_BRAINPOOL_P_R1;
|
||||
#endif
|
||||
#if defined(MBEDTLS_ECP_HAVE_BP384R1)
|
||||
case MBEDTLS_ECP_DP_BP384R1:
|
||||
*bits = 384;
|
||||
return PSA_ECC_FAMILY_BRAINPOOL_P_R1;
|
||||
#endif
|
||||
#if defined(MBEDTLS_ECP_HAVE_BP512R1)
|
||||
case MBEDTLS_ECP_DP_BP512R1:
|
||||
*bits = 512;
|
||||
return PSA_ECC_FAMILY_BRAINPOOL_P_R1;
|
||||
#endif
|
||||
#if defined(MBEDTLS_ECP_HAVE_CURVE25519)
|
||||
case MBEDTLS_ECP_DP_CURVE25519:
|
||||
*bits = 255;
|
||||
return PSA_ECC_FAMILY_MONTGOMERY;
|
||||
#endif
|
||||
#if defined(MBEDTLS_ECP_HAVE_SECP192K1)
|
||||
case MBEDTLS_ECP_DP_SECP192K1:
|
||||
*bits = 192;
|
||||
return PSA_ECC_FAMILY_SECP_K1;
|
||||
#endif
|
||||
#if defined(MBEDTLS_ECP_HAVE_SECP224K1)
|
||||
/* secp224k1 is not and will not be supported in PSA (#3541). */
|
||||
#endif
|
||||
#if defined(MBEDTLS_ECP_HAVE_SECP256K1)
|
||||
case MBEDTLS_ECP_DP_SECP256K1:
|
||||
*bits = 256;
|
||||
return PSA_ECC_FAMILY_SECP_K1;
|
||||
#endif
|
||||
#if defined(MBEDTLS_ECP_HAVE_CURVE448)
|
||||
case MBEDTLS_ECP_DP_CURVE448:
|
||||
*bits = 448;
|
||||
return PSA_ECC_FAMILY_MONTGOMERY;
|
||||
#endif
|
||||
default:
|
||||
*bits = 0;
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
|
||||
mbedtls_ecp_group_id mbedtls_ecc_group_from_psa(psa_ecc_family_t family,
|
||||
size_t bits)
|
||||
{
|
||||
switch (family) {
|
||||
case PSA_ECC_FAMILY_SECP_R1:
|
||||
switch (bits) {
|
||||
#if defined(PSA_WANT_ECC_SECP_R1_192)
|
||||
case 192:
|
||||
return MBEDTLS_ECP_DP_SECP192R1;
|
||||
#endif
|
||||
#if defined(PSA_WANT_ECC_SECP_R1_224)
|
||||
case 224:
|
||||
return MBEDTLS_ECP_DP_SECP224R1;
|
||||
#endif
|
||||
#if defined(PSA_WANT_ECC_SECP_R1_256)
|
||||
case 256:
|
||||
return MBEDTLS_ECP_DP_SECP256R1;
|
||||
#endif
|
||||
#if defined(PSA_WANT_ECC_SECP_R1_384)
|
||||
case 384:
|
||||
return MBEDTLS_ECP_DP_SECP384R1;
|
||||
#endif
|
||||
#if defined(PSA_WANT_ECC_SECP_R1_521)
|
||||
case 521:
|
||||
return MBEDTLS_ECP_DP_SECP521R1;
|
||||
#endif
|
||||
}
|
||||
break;
|
||||
|
||||
case PSA_ECC_FAMILY_BRAINPOOL_P_R1:
|
||||
switch (bits) {
|
||||
#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_256)
|
||||
case 256:
|
||||
return MBEDTLS_ECP_DP_BP256R1;
|
||||
#endif
|
||||
#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_384)
|
||||
case 384:
|
||||
return MBEDTLS_ECP_DP_BP384R1;
|
||||
#endif
|
||||
#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_512)
|
||||
case 512:
|
||||
return MBEDTLS_ECP_DP_BP512R1;
|
||||
#endif
|
||||
}
|
||||
break;
|
||||
|
||||
case PSA_ECC_FAMILY_MONTGOMERY:
|
||||
switch (bits) {
|
||||
#if defined(PSA_WANT_ECC_MONTGOMERY_255)
|
||||
case 255:
|
||||
return MBEDTLS_ECP_DP_CURVE25519;
|
||||
#endif
|
||||
#if defined(PSA_WANT_ECC_MONTGOMERY_448)
|
||||
case 448:
|
||||
return MBEDTLS_ECP_DP_CURVE448;
|
||||
#endif
|
||||
}
|
||||
break;
|
||||
|
||||
case PSA_ECC_FAMILY_SECP_K1:
|
||||
switch (bits) {
|
||||
#if defined(PSA_WANT_ECC_SECP_K1_192)
|
||||
case 192:
|
||||
return MBEDTLS_ECP_DP_SECP192K1;
|
||||
#endif
|
||||
#if defined(PSA_WANT_ECC_SECP_K1_224)
|
||||
/* secp224k1 is not and will not be supported in PSA (#3541). */
|
||||
#endif
|
||||
#if defined(PSA_WANT_ECC_SECP_K1_256)
|
||||
case 256:
|
||||
return MBEDTLS_ECP_DP_SECP256K1;
|
||||
#endif
|
||||
}
|
||||
break;
|
||||
}
|
||||
|
||||
return MBEDTLS_ECP_DP_NONE;
|
||||
}
|
||||
#endif /* PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY */
|
||||
|
||||
/* Wrapper function allowing the classic API to use the PSA RNG.
|
||||
*
|
||||
* `mbedtls_psa_get_random(MBEDTLS_PSA_RANDOM_STATE, ...)` calls
|
||||
* `psa_generate_random(...)`. The state parameter is ignored since the
|
||||
* PSA API doesn't support passing an explicit state.
|
||||
*/
|
||||
int mbedtls_psa_get_random(void *p_rng,
|
||||
unsigned char *output,
|
||||
size_t output_size)
|
||||
{
|
||||
/* This function takes a pointer to the RNG state because that's what
|
||||
* classic mbedtls functions using an RNG expect. The PSA RNG manages
|
||||
* its own state internally and doesn't let the caller access that state.
|
||||
* So we just ignore the state parameter, and in practice we'll pass
|
||||
* NULL. */
|
||||
(void) p_rng;
|
||||
psa_status_t status = psa_generate_random(output, output_size);
|
||||
if (status == PSA_SUCCESS) {
|
||||
return 0;
|
||||
} else {
|
||||
return MBEDTLS_ERR_ENTROPY_SOURCE_FAILED;
|
||||
}
|
||||
}
|
||||
|
||||
#endif /* MBEDTLS_PSA_CRYPTO_CLIENT */
|
||||
|
||||
#if defined(MBEDTLS_PSA_UTIL_HAVE_ECDSA)
|
||||
|
||||
/**
|
||||
* \brief Convert a single raw coordinate to DER ASN.1 format. The output der
|
||||
* buffer is filled backward (i.e. starting from its end).
|
||||
*
|
||||
* \param raw_buf Buffer containing the raw coordinate to be
|
||||
* converted.
|
||||
* \param raw_len Length of raw_buf in bytes. This must be > 0.
|
||||
* \param der_buf_start Pointer to the beginning of the buffer which
|
||||
* will be filled with the DER converted data.
|
||||
* \param der_buf_end End of the buffer used to store the DER output.
|
||||
*
|
||||
* \return On success, the amount of data (in bytes) written to
|
||||
* the DER buffer.
|
||||
* \return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL if the provided der
|
||||
* buffer is too small to contain all the converted data.
|
||||
* \return MBEDTLS_ERR_ASN1_INVALID_DATA if the input raw
|
||||
* coordinate is null (i.e. all zeros).
|
||||
*
|
||||
* \warning Raw and der buffer must not be overlapping.
|
||||
*/
|
||||
static int convert_raw_to_der_single_int(const unsigned char *raw_buf, size_t raw_len,
|
||||
unsigned char *der_buf_start,
|
||||
unsigned char *der_buf_end)
|
||||
{
|
||||
unsigned char *p = der_buf_end;
|
||||
int len;
|
||||
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
||||
|
||||
/* ASN.1 DER encoding requires minimal length, so skip leading 0s.
|
||||
* Provided input MPIs should not be 0, but as a failsafe measure, still
|
||||
* detect that and return error in case. */
|
||||
while (*raw_buf == 0x00) {
|
||||
++raw_buf;
|
||||
--raw_len;
|
||||
if (raw_len == 0) {
|
||||
return MBEDTLS_ERR_ASN1_INVALID_DATA;
|
||||
}
|
||||
}
|
||||
len = (int) raw_len;
|
||||
|
||||
/* Copy the raw coordinate to the end of der_buf. */
|
||||
if ((p - der_buf_start) < len) {
|
||||
return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL;
|
||||
}
|
||||
p -= len;
|
||||
memcpy(p, raw_buf, len);
|
||||
|
||||
/* If MSb is 1, ASN.1 requires that we prepend a 0. */
|
||||
if (*p & 0x80) {
|
||||
if ((p - der_buf_start) < 1) {
|
||||
return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL;
|
||||
}
|
||||
--p;
|
||||
*p = 0x00;
|
||||
++len;
|
||||
}
|
||||
|
||||
MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_len(&p, der_buf_start, len));
|
||||
MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_tag(&p, der_buf_start, MBEDTLS_ASN1_INTEGER));
|
||||
|
||||
return len;
|
||||
}
|
||||
|
||||
int mbedtls_ecdsa_raw_to_der(size_t bits, const unsigned char *raw, size_t raw_len,
|
||||
unsigned char *der, size_t der_size, size_t *der_len)
|
||||
{
|
||||
unsigned char r[PSA_BITS_TO_BYTES(PSA_VENDOR_ECC_MAX_CURVE_BITS)];
|
||||
unsigned char s[PSA_BITS_TO_BYTES(PSA_VENDOR_ECC_MAX_CURVE_BITS)];
|
||||
const size_t coordinate_len = PSA_BITS_TO_BYTES(bits);
|
||||
size_t len = 0;
|
||||
unsigned char *p = der + der_size;
|
||||
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
||||
|
||||
if (raw_len != (2 * coordinate_len)) {
|
||||
return MBEDTLS_ERR_ASN1_INVALID_DATA;
|
||||
}
|
||||
if (coordinate_len > sizeof(r)) {
|
||||
return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL;
|
||||
}
|
||||
|
||||
/* Since raw and der buffers might overlap, dump r and s before starting
|
||||
* the conversion. */
|
||||
memcpy(r, raw, coordinate_len);
|
||||
memcpy(s, raw + coordinate_len, coordinate_len);
|
||||
|
||||
/* der buffer will initially be written starting from its end so we pick s
|
||||
* first and then r. */
|
||||
ret = convert_raw_to_der_single_int(s, coordinate_len, der, p);
|
||||
if (ret < 0) {
|
||||
return ret;
|
||||
}
|
||||
p -= ret;
|
||||
len += ret;
|
||||
|
||||
ret = convert_raw_to_der_single_int(r, coordinate_len, der, p);
|
||||
if (ret < 0) {
|
||||
return ret;
|
||||
}
|
||||
p -= ret;
|
||||
len += ret;
|
||||
|
||||
/* Add ASN.1 header (len + tag). */
|
||||
MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_len(&p, der, len));
|
||||
MBEDTLS_ASN1_CHK_ADD(len, mbedtls_asn1_write_tag(&p, der,
|
||||
MBEDTLS_ASN1_CONSTRUCTED |
|
||||
MBEDTLS_ASN1_SEQUENCE));
|
||||
|
||||
/* memmove the content of der buffer to its beginnig. */
|
||||
memmove(der, p, len);
|
||||
*der_len = len;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/**
|
||||
* \brief Convert a single integer from ASN.1 DER format to raw.
|
||||
*
|
||||
* \param der Buffer containing the DER integer value to be
|
||||
* converted.
|
||||
* \param der_len Length of the der buffer in bytes.
|
||||
* \param raw Output buffer that will be filled with the
|
||||
* converted data. This should be at least
|
||||
* coordinate_size bytes and it must be zeroed before
|
||||
* calling this function.
|
||||
* \param coordinate_size Size (in bytes) of a single coordinate in raw
|
||||
* format.
|
||||
*
|
||||
* \return On success, the amount of DER data parsed from the
|
||||
* provided der buffer.
|
||||
* \return MBEDTLS_ERR_ASN1_UNEXPECTED_TAG if the integer tag
|
||||
* is missing in the der buffer.
|
||||
* \return MBEDTLS_ERR_ASN1_LENGTH_MISMATCH if the integer
|
||||
* is null (i.e. all zeros) or if the output raw buffer
|
||||
* is too small to contain the converted raw value.
|
||||
*
|
||||
* \warning Der and raw buffers must not be overlapping.
|
||||
*/
|
||||
static int convert_der_to_raw_single_int(unsigned char *der, size_t der_len,
|
||||
unsigned char *raw, size_t coordinate_size)
|
||||
{
|
||||
unsigned char *p = der;
|
||||
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
|
||||
size_t unpadded_len, padding_len = 0;
|
||||
|
||||
/* Get the length of ASN.1 element (i.e. the integer we need to parse). */
|
||||
ret = mbedtls_asn1_get_tag(&p, p + der_len, &unpadded_len,
|
||||
MBEDTLS_ASN1_INTEGER);
|
||||
if (ret != 0) {
|
||||
return ret;
|
||||
}
|
||||
|
||||
/* It's invalid to have:
|
||||
* - unpadded_len == 0.
|
||||
* - MSb set without a leading 0x00 (leading 0x00 is checked below). */
|
||||
if (((unpadded_len == 0) || (*p & 0x80) != 0)) {
|
||||
return MBEDTLS_ERR_ASN1_INVALID_DATA;
|
||||
}
|
||||
|
||||
/* Skip possible leading zero */
|
||||
if (*p == 0x00) {
|
||||
p++;
|
||||
unpadded_len--;
|
||||
/* It is not allowed to have more than 1 leading zero.
|
||||
* Ignore the case in which unpadded_len = 0 because that's a 0 encoded
|
||||
* in ASN.1 format (i.e. 020100). */
|
||||
if ((unpadded_len > 0) && (*p == 0x00)) {
|
||||
return MBEDTLS_ERR_ASN1_INVALID_DATA;
|
||||
}
|
||||
}
|
||||
|
||||
if (unpadded_len > coordinate_size) {
|
||||
/* Parsed number is longer than the maximum expected value. */
|
||||
return MBEDTLS_ERR_ASN1_INVALID_DATA;
|
||||
}
|
||||
padding_len = coordinate_size - unpadded_len;
|
||||
/* raw buffer was already zeroed by the calling function so zero-padding
|
||||
* operation is skipped here. */
|
||||
memcpy(raw + padding_len, p, unpadded_len);
|
||||
p += unpadded_len;
|
||||
|
||||
return (int) (p - der);
|
||||
}
|
||||
|
||||
int mbedtls_ecdsa_der_to_raw(size_t bits, const unsigned char *der, size_t der_len,
|
||||
unsigned char *raw, size_t raw_size, size_t *raw_len)
|
||||
{
|
||||
unsigned char raw_tmp[PSA_VENDOR_ECDSA_SIGNATURE_MAX_SIZE];
|
||||
unsigned char *p = (unsigned char *) der;
|
||||
size_t data_len;
|
||||
size_t coordinate_size = PSA_BITS_TO_BYTES(bits);
|
||||
int ret;
|
||||
|
||||
/* The output raw buffer should be at least twice the size of a raw
|
||||
* coordinate in order to store r and s. */
|
||||
if (raw_size < coordinate_size * 2) {
|
||||
return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL;
|
||||
}
|
||||
if (2 * coordinate_size > sizeof(raw_tmp)) {
|
||||
return MBEDTLS_ERR_ASN1_BUF_TOO_SMALL;
|
||||
}
|
||||
|
||||
/* Check that the provided input DER buffer has the right header. */
|
||||
ret = mbedtls_asn1_get_tag(&p, der + der_len, &data_len,
|
||||
MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE);
|
||||
if (ret != 0) {
|
||||
return ret;
|
||||
}
|
||||
|
||||
memset(raw_tmp, 0, 2 * coordinate_size);
|
||||
|
||||
/* Extract r */
|
||||
ret = convert_der_to_raw_single_int(p, data_len, raw_tmp, coordinate_size);
|
||||
if (ret < 0) {
|
||||
return ret;
|
||||
}
|
||||
p += ret;
|
||||
data_len -= ret;
|
||||
|
||||
/* Extract s */
|
||||
ret = convert_der_to_raw_single_int(p, data_len, raw_tmp + coordinate_size,
|
||||
coordinate_size);
|
||||
if (ret < 0) {
|
||||
return ret;
|
||||
}
|
||||
p += ret;
|
||||
data_len -= ret;
|
||||
|
||||
/* Check that we consumed all the input der data. */
|
||||
if ((size_t) (p - der) != der_len) {
|
||||
return MBEDTLS_ERR_ASN1_LENGTH_MISMATCH;
|
||||
}
|
||||
|
||||
memcpy(raw, raw_tmp, 2 * coordinate_size);
|
||||
*raw_len = 2 * coordinate_size;
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
#endif /* MBEDTLS_PSA_UTIL_HAVE_ECDSA */
|
||||
Reference in New Issue
Block a user