yuzu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2024-12-23 18:25:35 +00:00
Code Issues Packages Projects Releases Wiki Activity
mbedtls/library/psa_crypto.c

6247 lines
219 KiB
C
Raw Normal View History

Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
/*
* PSA crypto layer on top of Mbed TLS crypto
*/
Add Apache-2.0 headers to all source files Also normalize the first line of the copyright headers. This commit was generated using the following script: # ======================== #!/bin/sh # Find scripts find -path './.git' -prune -o '(' -name '*.c' -o -name '*.cpp' -o -name '*.fmt' -o -name '*.h' ')' -print | xargs sed -i ' # Normalize the first line of the copyright headers (no text on the first line of a block comment) /^\/\*.*Copyright.*Arm/I { i\ /* s/^\// / } /Copyright.*Arm/I { # Print copyright declaration p # Read the two lines immediately following the copyright declaration N N # Insert Apache header if it is missing /SPDX/! i\ * SPDX-License-Identifier: Apache-2.0\ *\ * Licensed under the Apache License, Version 2.0 (the "License"); you may\ * not use this file except in compliance with the License.\ * You may obtain a copy of the License at\ *\ * http://www.apache.org/licenses/LICENSE-2.0\ *\ * Unless required by applicable law or agreed to in writing, software\ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT\ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\ * See the License for the specific language governing permissions and\ * limitations under the License. # Clear copyright declaration from buffer D } ' # ======================== Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2020-06-15 09:59:37 +00:00
/*
Update copyright notices to use Linux Foundation guidance As a result, the copyright of contributors other than Arm is now acknowledged, and the years of publishing are no longer tracked in the source files. Also remove the now-redundant lines declaring that the files are part of MbedTLS. This commit was generated using the following script: # ======================== #!/bin/sh # Find files find '(' -path './.git' -o -path './3rdparty' ')' -prune -o -type f -print | xargs sed -bi ' # Replace copyright attribution line s/Copyright.*Arm.*/Copyright The Mbed TLS Contributors/I # Remove redundant declaration and the preceding line $!N /This file is part of Mbed TLS/Id P D ' # ======================== Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2020-08-07 11:07:28 +00:00
* Copyright The Mbed TLS Contributors
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
* SPDX-License-Identifier: Apache-2.0
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may
* not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
Include common.h instead of config.h in library source files In library source files, include "common.h", which takes care of including "mbedtls/config.h" (or the alternative MBEDTLS_CONFIG_FILE) and other things that are used throughout the library. FROM=$'#if !defined(MBEDTLS_CONFIG_FILE)\n#include "mbedtls/config.h"\n#else\n#include MBEDTLS_CONFIG_FILE\n#endif' perl -i -0777 -pe 's~\Q$ENV{FROM}~#include "common.h"~' library/*.c 3rdparty/*/library/*.c scripts/data_files/error.fmt scripts/data_files/version_features.fmt Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-06-02 23:43:33 +00:00
#include "common.h"
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_C)
Modifications for psa-crypto in order to integrate with SPM Add required includes in tests and psa_crypto.c file in order to be able to compilef for the SPM solution. Some functions needed to be deprecated from psa_crypto.c since they already implemented in the SPM.
2018-07-03 10:16:15 +00:00
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_CONFIG)
#include "check_crypto_config.h"
#endif
Add common header for crypto service integration
2019-02-14 08:28:02 +00:00
#include "psa_crypto_service_integration.h"
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
#include "psa/crypto.h"
Expose the PSA key slot structure to internal modules Move psa_key_slot_t to a new header psa_crypto_core.h, to prepare for moving the responsibility for some fields to psa_crypto_slot_management.c.
2018-12-07 17:24:41 +00:00
#include "psa_crypto_core.h"
Add a facility to configure entropy sources Add a function to configure entropy sources. For testing only. Use it to test that the library initialization fails properly if there is no entropy source.
2018-11-20 20:59:56 +00:00
#include "psa_crypto_invasive.h"
Add a handcrafted first version of the driver wrapper code Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-16 18:28:36 +00:00
#include "psa_crypto_driver_wrappers.h"
psa: Move xxx_load_representation functions to RSA/ECP specific modules Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 14:25:26 +00:00
#include "psa_crypto_ecp.h"
#include "psa_crypto_rsa.h"
Move ECP key generation code to the PSA ECP specific C file Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-20 17:17:42 +00:00
#include "psa_crypto_ecp.h"
Gate secure element support by a separate config option Secure element support has its own source file, and in addition requires many hooks in other files. This is a nontrivial amount of code, so make it optional (but default on).
2019-06-26 09:24:49 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Unregister drivers on library deinitialization
2019-06-24 12:34:43 +00:00
#include "psa_crypto_se.h"
Gate secure element support by a separate config option Secure element support has its own source file, and in addition requires many hooks in other files. This is a nontrivial amount of code, so make it optional (but default on).
2019-06-26 09:24:49 +00:00
#endif
Implement slot allocation Implement psa_allocate_key, psa_open_key, psa_create_key, psa_close_key. Add support for keys designated to handles to psa_get_key_slot, and thereby to the whole API. Allocated and non-allocated keys can coexist. This is a temporary stage in order to transition from the use of direct slot numbers to allocated handles only. Once all the tests and sample programs have been migrated to use handles, the implementation will be simplified and made more robust with support for handles only.
2018-11-30 17:54:54 +00:00
#include "psa_crypto_slot_management.h"
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 16:27:26 +00:00
/* Include internal declarations that are useful for implementing persistently
* stored keys. */
#include "psa_crypto_storage.h"
Rename psa_crypto_random.h to psa_crypto_random_impl.h Make it clear that this is an abstraction of the random generator abstraction, and not an abstraction of the PSA random generator. mbedtls_psa_get_random and MBEDTLS_PSA_RANDOM_STATE are public-facing definitions and will be moved in a subsequent commit. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-14 15:43:58 +00:00
#include "psa_crypto_random_impl.h"
Create a header file for PSA crypto random generator abstraction Subsequent commits will move declarations and definitions there. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 14:39:19 +00:00
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 19:32:04 +00:00
#include <assert.h>
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
#include <stdlib.h>
#include <string.h>
#include "mbedtls/platform.h"
Always include platform.h for MBEDTLS_ERR_PLATFORM_xxx Recognize MBEDTLS_ERR_PLATFORM_xxx in mbedtls_to_psa_error().
2019-05-06 13:26:23 +00:00
#if !defined(MBEDTLS_PLATFORM_C)
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
#define mbedtls_calloc calloc
#define mbedtls_free free
#endif
Include headers in psa_crypto.h for mbedtls_to_psa_error psa_crypto must be able to convert error codes even from modules that it doesn't call directly. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 17:46:25 +00:00
#include "mbedtls/aes.h"
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
#include "mbedtls/arc4.h"
Convert ERR_ASN1 error codes to PSA This fixes the error code when psa_export_key on an asymmetric key reports that the output buffer is too small.
2018-06-21 07:35:35 +00:00
#include "mbedtls/asn1.h"
psa: Simplify RSA public key format Remove pkcs-1 and rsaEncryption front matter from RSA public keys. Move code that was shared between RSA and other key types (like EC keys) to be used only with non-RSA keys.
2019-01-10 10:23:21 +00:00
#include "mbedtls/asn1write.h"
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
#include "mbedtls/bignum.h"
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
#include "mbedtls/blowfish.h"
#include "mbedtls/camellia.h"
Implement ChaCha20 and ChaCha20-Poly1305 Smoke tests: test data for ChaCha20 calculated with PyCryptodome; test vector from RFC 7539 for ChaCha20-Poly1305.
2019-05-06 13:25:00 +00:00
#include "mbedtls/chacha20.h"
#include "mbedtls/chachapoly.h"
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
#include "mbedtls/cipher.h"
#include "mbedtls/ccm.h"
#include "mbedtls/cmac.h"
#include "mbedtls/des.h"
Implement ECDH
2018-09-18 10:11:27 +00:00
#include "mbedtls/ecdh.h"
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 17:16:59 +00:00
#include "mbedtls/ecp.h"
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
#include "mbedtls/entropy.h"
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
#include "mbedtls/error.h"
#include "mbedtls/gcm.h"
#include "mbedtls/md2.h"
#include "mbedtls/md4.h"
#include "mbedtls/md5.h"
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
#include "mbedtls/md.h"
#include "mbedtls/md_internal.h"
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
#include "mbedtls/pk.h"
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 17:16:59 +00:00
#include "mbedtls/pk_internal.h"
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 17:14:53 +00:00
#include "mbedtls/platform_util.h"
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
#include "mbedtls/error.h"
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
#include "mbedtls/ripemd160.h"
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 17:16:59 +00:00
#include "mbedtls/rsa.h"
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
#include "mbedtls/sha1.h"
#include "mbedtls/sha256.h"
#include "mbedtls/sha512.h"
#include "mbedtls/xtea.h"
Fix buffer overflow in the slot array Slots are numbered from 1, but the slot array is a C array so it's numbered from 0. Add a non-regression test.
2018-08-01 13:45:45 +00:00
#define ARRAY_LENGTH( array ) ( sizeof( array ) / sizeof( *( array ) ) )
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
/* constant-time buffer comparison */
static inline int safer_memcmp( const uint8_t *a, const uint8_t *b, size_t n )
{
size_t i;
unsigned char diff = 0;
for( i = 0; i < n; i++ )
diff |= a[i] ^ b[i];
return( diff );
}
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
/****************************************************************/
/* Global data, support functions and library management */
/****************************************************************/
Remove PSA_KEY_TYPE_IS_RAW_BYTES from crypto.h It isn't used to define other macros and it doesn't seem that useful for users. Remove it, we can reintroduce it if needed. Define a similar function key_type_is_raw_bytes in the implementation with a clear semantics: it's a key that's represented as a struct raw_data.
2018-06-21 12:15:31 +00:00
static int key_type_is_raw_bytes( psa_key_type_t type )
{
Change the bitwise encoding of key type categories There were only 5 categories (now 4). Reduce the category mask from 7 bits to 3. Combine unformatted, not-necessarily-uniform keys (HMAC, derivation) with raw data. Reintroduce a KEY_TYPE_IS_UNSTRUCTURED macro (which used to exist under the name KEY_TYPE_IS_RAW_DATA macro) for key types that don't have any structure, including both should-be-uniform keys (such as block cipher and stream cipher keys) and not-necessarily-uniform keys (such as HMAC keys and secrets for key derivation).
2018-08-10 14:03:41 +00:00
return( PSA_KEY_TYPE_IS_UNSTRUCTURED( type ) );
Remove PSA_KEY_TYPE_IS_RAW_BYTES from crypto.h It isn't used to define other macros and it doesn't seem that useful for users. Remove it, we can reintroduce it if needed. Define a similar function key_type_is_raw_bytes in the implementation with a clear semantics: it's a key that's represented as a struct raw_data.
2018-06-21 12:15:31 +00:00
}
Don't use an enum in a bit-field This isn't standard C. GCC and Clang accept it but not every compiler (e.g. Armcc 5).
2018-12-04 11:27:09 +00:00
/* Values for psa_global_data_t::rng_state */
#define RNG_NOT_INITIALIZED 0
#define RNG_INITIALIZED 1
#define RNG_SEEDED 2
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 20:42:52 +00:00
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 13:41:12 +00:00
typedef struct
{
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 16:02:26 +00:00
mbedtls_psa_random_context_t rng;
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 20:42:52 +00:00
unsigned initialized : 1;
Don't use an enum in a bit-field This isn't standard C. GCC and Clang accept it but not every compiler (e.g. Armcc 5).
2018-12-04 11:27:09 +00:00
unsigned rng_state : 2;
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
} psa_global_data_t;
static psa_global_data_t global_data;
Replace mbedtls_psa_random_state( ... ) by MBEDTLS_PSA_RANDOM_STATE Hide the obtention of the pointer to the RNG state behind a macro. To make it possible to use this macro in a module other than psa_crypto.c, which will happen in the future, make sure that the definition of the macro does not reference internal variables of psa_crypto.c. For this purpose, in the internal-DRBG case, export a symbol containing the address of the DRBG state. When the RNG state is a pointer a DRBG state, just keep this pointer in a variable: there's no need to store a pointer to a larger structure. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-14 13:54:06 +00:00
#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
mbedtls_psa_drbg_context_t *const mbedtls_psa_random_state =
&global_data.rng.drbg;
#endif
Ensure the module is initialized in psa_generate_random
2018-09-06 13:24:41 +00:00
#define GUARD_MODULE_INITIALIZED \
if( global_data.initialized == 0 ) \
return( PSA_ERROR_BAD_STATE );
Expose mbedtls_error_to_psa_status for use in test drivers Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-20 13:31:37 +00:00
psa_status_t mbedtls_to_psa_error( int ret )
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
{
mbedtls_to_psa_error: prefer dispatching on the low-level error When an Mbed TLS error code combines a low-level error and a high-level error, the low-level error is usually closer to the root cause (for example HW_ACCEL_FAILED or ENTROPY_SOURCE_FAILED is more informative than RSA_PRIVATE_FAILED). So prioritize the low-level code when converting to a PSA error code, rather than the high-level code as was (rather arbitrarily) done before. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-06 19:04:23 +00:00
/* Mbed TLS error codes can combine a high-level error code and a
* low-level error code. The low-level error usually reflects the
* root cause better, so dispatch on that preferably. */
int low_level_ret = - ( -ret & 0x007f );
switch( low_level_ret != 0 ? low_level_ret : ret )
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
{
case 0:
return( PSA_SUCCESS );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
case MBEDTLS_ERR_AES_INVALID_KEY_LENGTH:
case MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH:
case MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_AES_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_ARC4_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
Convert ERR_ASN1 error codes to PSA This fixes the error code when psa_export_key on an asymmetric key reports that the output buffer is too small.
2018-06-21 07:35:35 +00:00
case MBEDTLS_ERR_ASN1_OUT_OF_DATA:
case MBEDTLS_ERR_ASN1_UNEXPECTED_TAG:
case MBEDTLS_ERR_ASN1_INVALID_LENGTH:
case MBEDTLS_ERR_ASN1_LENGTH_MISMATCH:
case MBEDTLS_ERR_ASN1_INVALID_DATA:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_ASN1_ALLOC_FAILED:
return( PSA_ERROR_INSUFFICIENT_MEMORY );
case MBEDTLS_ERR_ASN1_BUF_TOO_SMALL:
return( PSA_ERROR_BUFFER_TOO_SMALL );
psa: Be compatible with deprecated constants In case the new constants aren't available yet in Mbed TLS, continue to use the deprecated constants if they are available.
2019-02-20 13:57:28 +00:00
#if defined(MBEDTLS_ERR_BLOWFISH_BAD_INPUT_DATA)
psa: Use new generic error codes Mbed TLS has deprecated a few module specific error codes in favor of more general-purpose or cross-module error codes. Use these new error codes instead of the deprecated error codes.
2019-02-11 12:21:12 +00:00
case MBEDTLS_ERR_BLOWFISH_BAD_INPUT_DATA:
psa: Be compatible with deprecated constants In case the new constants aren't available yet in Mbed TLS, continue to use the deprecated constants if they are available.
2019-02-20 13:57:28 +00:00
#elif defined(MBEDTLS_ERR_BLOWFISH_INVALID_KEY_LENGTH)
case MBEDTLS_ERR_BLOWFISH_INVALID_KEY_LENGTH:
#endif
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
case MBEDTLS_ERR_BLOWFISH_INVALID_INPUT_LENGTH:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_BLOWFISH_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
psa: Be compatible with deprecated constants In case the new constants aren't available yet in Mbed TLS, continue to use the deprecated constants if they are available.
2019-02-20 13:57:28 +00:00
#if defined(MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA)
psa: Use new generic error codes Mbed TLS has deprecated a few module specific error codes in favor of more general-purpose or cross-module error codes. Use these new error codes instead of the deprecated error codes.
2019-02-11 12:21:12 +00:00
case MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA:
psa: Be compatible with deprecated constants In case the new constants aren't available yet in Mbed TLS, continue to use the deprecated constants if they are available.
2019-02-20 13:57:28 +00:00
#elif defined(MBEDTLS_ERR_CAMELLIA_INVALID_KEY_LENGTH)
case MBEDTLS_ERR_CAMELLIA_INVALID_KEY_LENGTH:
#endif
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
case MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_CAMELLIA_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_CCM_BAD_INPUT:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_CCM_AUTH_FAILED:
return( PSA_ERROR_INVALID_SIGNATURE );
case MBEDTLS_ERR_CCM_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
Implement ChaCha20 and ChaCha20-Poly1305 Smoke tests: test data for ChaCha20 calculated with PyCryptodome; test vector from RFC 7539 for ChaCha20-Poly1305.
2019-05-06 13:25:00 +00:00
case MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_CHACHAPOLY_BAD_STATE:
return( PSA_ERROR_BAD_STATE );
case MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED:
return( PSA_ERROR_INVALID_SIGNATURE );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
case MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_CIPHER_ALLOC_FAILED:
return( PSA_ERROR_INSUFFICIENT_MEMORY );
case MBEDTLS_ERR_CIPHER_INVALID_PADDING:
return( PSA_ERROR_INVALID_PADDING );
case MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED:
Use PSA_ERROR_INVALID_ARGUMENT for invalid cipher input sizes ... as opposed to PSA_ERROR_BAD_STATE. The spec on psa_cipher_finish() states that PSA_ERROR_INVALID_ARGUMENT should be returned when: "The total input size passed to this operation is not valid for this particular algorithm. For example, the algorithm is a based on block cipher and requires a whole number of blocks, but the total input size is not a multiple of the block size." Currently, there is a distinction between encryption and decryption on whether INVALID_ARGUMENT or BAD_STATE is returned, but this is not a part of the spec. This fix ensures that PSA_ERROR_INVALID_ARGUMENT is returned consistently on invalid cipher input sizes. Signed-off-by: Fredrik Strupe <fredrik.strupe@silabs.com>
2020-09-28 14:11:33 +00:00
return( PSA_ERROR_INVALID_ARGUMENT );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
case MBEDTLS_ERR_CIPHER_AUTH_FAILED:
return( PSA_ERROR_INVALID_SIGNATURE );
case MBEDTLS_ERR_CIPHER_INVALID_CONTEXT:
Rename PSA_ERROR_TAMPERING_DETECTED to ..._CORRUPTION_DETECTED “Tampering detected” was misleading because in the real world it can also arise due to a software bug. “Corruption detected” is neutral and more precisely reflects what can trigger the error. perl -i -pe 's/PSA_ERROR_TAMPERING_DETECTED/PSA_ERROR_CORRUPTION_DETECTED/gi' $(git ls-files)
2019-05-16 19:35:18 +00:00
return( PSA_ERROR_CORRUPTION_DETECTED );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
case MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_CMAC_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
PSA: support HMAC_DRBG Support using HMAC_DRBG instead of CTR_DRBG in the PSA subsystem. Use HMAC_DRBG if CTR_DRBG is available. Choose between SHA-256 and SHA-512 based on availability. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 20:31:17 +00:00
#if !( defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) || \
defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE) )
Explain the conditions for checking DRBG error codes Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-23 20:00:09 +00:00
/* Only check CTR_DRBG error codes if underlying mbedtls_xxx
* functions are passed a CTR_DRBG instance. */
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
case MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED:
return( PSA_ERROR_INSUFFICIENT_ENTROPY );
case MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG:
case MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR:
return( PSA_ERROR_INSUFFICIENT_ENTROPY );
PSA: support HMAC_DRBG Support using HMAC_DRBG instead of CTR_DRBG in the PSA subsystem. Use HMAC_DRBG if CTR_DRBG is available. Choose between SHA-256 and SHA-512 based on availability. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 20:31:17 +00:00
#endif
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
case MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_DES_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
case MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED:
case MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE:
case MBEDTLS_ERR_ENTROPY_SOURCE_FAILED:
return( PSA_ERROR_INSUFFICIENT_ENTROPY );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
case MBEDTLS_ERR_GCM_AUTH_FAILED:
return( PSA_ERROR_INVALID_SIGNATURE );
case MBEDTLS_ERR_GCM_BAD_INPUT:
Translate GCM_BAD_INPUT to INVALID_ARGUMENT, not NOT_SUPPORTED
2018-08-21 13:07:38 +00:00
return( PSA_ERROR_INVALID_ARGUMENT );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
case MBEDTLS_ERR_GCM_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
PSA: support HMAC_DRBG Support using HMAC_DRBG instead of CTR_DRBG in the PSA subsystem. Use HMAC_DRBG if CTR_DRBG is available. Choose between SHA-256 and SHA-512 based on availability. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 20:31:17 +00:00
#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) && \
defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE)
Explain the conditions for checking DRBG error codes Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-23 20:00:09 +00:00
/* Only check HMAC_DRBG error codes if underlying mbedtls_xxx
* functions are passed a HMAC_DRBG instance. */
PSA: support HMAC_DRBG Support using HMAC_DRBG instead of CTR_DRBG in the PSA subsystem. Use HMAC_DRBG if CTR_DRBG is available. Choose between SHA-256 and SHA-512 based on availability. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 20:31:17 +00:00
case MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED:
return( PSA_ERROR_INSUFFICIENT_ENTROPY );
case MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG:
case MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR:
return( PSA_ERROR_INSUFFICIENT_ENTROPY );
#endif
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
case MBEDTLS_ERR_MD2_HW_ACCEL_FAILED:
case MBEDTLS_ERR_MD4_HW_ACCEL_FAILED:
case MBEDTLS_ERR_MD5_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_MD_BAD_INPUT_DATA:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_MD_ALLOC_FAILED:
return( PSA_ERROR_INSUFFICIENT_MEMORY );
case MBEDTLS_ERR_MD_FILE_IO_ERROR:
return( PSA_ERROR_STORAGE_FAILURE );
case MBEDTLS_ERR_MD_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
Private EC key format: change to raw secret value (doc, import) Change the import/export format of private elliptic curve keys from RFC 5915 to the raw secret value. This commit updates the format specification and the import code, but not the export code.
2018-10-29 18:24:33 +00:00
case MBEDTLS_ERR_MPI_FILE_IO_ERROR:
return( PSA_ERROR_STORAGE_FAILURE );
case MBEDTLS_ERR_MPI_BAD_INPUT_DATA:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_MPI_INVALID_CHARACTER:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL:
return( PSA_ERROR_BUFFER_TOO_SMALL );
case MBEDTLS_ERR_MPI_NEGATIVE_VALUE:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_MPI_DIVISION_BY_ZERO:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_MPI_NOT_ACCEPTABLE:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_MPI_ALLOC_FAILED:
return( PSA_ERROR_INSUFFICIENT_MEMORY );
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
case MBEDTLS_ERR_PK_ALLOC_FAILED:
return( PSA_ERROR_INSUFFICIENT_MEMORY );
case MBEDTLS_ERR_PK_TYPE_MISMATCH:
case MBEDTLS_ERR_PK_BAD_INPUT_DATA:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_PK_FILE_IO_ERROR:
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
return( PSA_ERROR_STORAGE_FAILURE );
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
case MBEDTLS_ERR_PK_KEY_INVALID_VERSION:
case MBEDTLS_ERR_PK_KEY_INVALID_FORMAT:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_PK_UNKNOWN_PK_ALG:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_PK_PASSWORD_REQUIRED:
case MBEDTLS_ERR_PK_PASSWORD_MISMATCH:
return( PSA_ERROR_NOT_PERMITTED );
case MBEDTLS_ERR_PK_INVALID_PUBKEY:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_PK_INVALID_ALG:
case MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE:
case MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_PK_SIG_LEN_MISMATCH:
return( PSA_ERROR_INVALID_SIGNATURE );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
case MBEDTLS_ERR_PK_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
Always include platform.h for MBEDTLS_ERR_PLATFORM_xxx Recognize MBEDTLS_ERR_PLATFORM_xxx in mbedtls_to_psa_error().
2019-05-06 13:26:23 +00:00
case MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
return( PSA_ERROR_NOT_SUPPORTED );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
case MBEDTLS_ERR_RIPEMD160_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_RSA_BAD_INPUT_DATA:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_RSA_INVALID_PADDING:
return( PSA_ERROR_INVALID_PADDING );
case MBEDTLS_ERR_RSA_KEY_GEN_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_RSA_KEY_CHECK_FAILED:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_RSA_PUBLIC_FAILED:
case MBEDTLS_ERR_RSA_PRIVATE_FAILED:
Rename PSA_ERROR_TAMPERING_DETECTED to ..._CORRUPTION_DETECTED “Tampering detected” was misleading because in the real world it can also arise due to a software bug. “Corruption detected” is neutral and more precisely reflects what can trigger the error. perl -i -pe 's/PSA_ERROR_TAMPERING_DETECTED/PSA_ERROR_CORRUPTION_DETECTED/gi' $(git ls-files)
2019-05-16 19:35:18 +00:00
return( PSA_ERROR_CORRUPTION_DETECTED );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
case MBEDTLS_ERR_RSA_VERIFY_FAILED:
return( PSA_ERROR_INVALID_SIGNATURE );
case MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE:
return( PSA_ERROR_BUFFER_TOO_SMALL );
case MBEDTLS_ERR_RSA_RNG_FAILED:
mbedtls_to_psa_error: fix a copypasta and a missing translation Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-24 23:09:47 +00:00
return( PSA_ERROR_INSUFFICIENT_ENTROPY );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
case MBEDTLS_ERR_RSA_UNSUPPORTED_OPERATION:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_RSA_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_SHA1_HW_ACCEL_FAILED:
case MBEDTLS_ERR_SHA256_HW_ACCEL_FAILED:
case MBEDTLS_ERR_SHA512_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_XTEA_INVALID_INPUT_LENGTH:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_XTEA_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 08:18:38 +00:00
case MBEDTLS_ERR_ECP_BAD_INPUT_DATA:
Added handling for MBEDTLS_ERR_ECP_XXX error codes Added handling for MBEDTLS_ERR_ECP_XXX error codes
2018-05-09 13:07:36 +00:00
case MBEDTLS_ERR_ECP_INVALID_KEY:
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 08:18:38 +00:00
return( PSA_ERROR_INVALID_ARGUMENT );
Added handling for MBEDTLS_ERR_ECP_XXX error codes Added handling for MBEDTLS_ERR_ECP_XXX error codes
2018-05-09 13:07:36 +00:00
case MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL:
return( PSA_ERROR_BUFFER_TOO_SMALL );
case MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH:
case MBEDTLS_ERR_ECP_VERIFY_FAILED:
return( PSA_ERROR_INVALID_SIGNATURE );
case MBEDTLS_ERR_ECP_ALLOC_FAILED:
return( PSA_ERROR_INSUFFICIENT_MEMORY );
mbedtls_to_psa_error: fix a copypasta and a missing translation Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-24 23:09:47 +00:00
case MBEDTLS_ERR_ECP_RANDOM_FAILED:
return( PSA_ERROR_INSUFFICIENT_ENTROPY );
Added handling for MBEDTLS_ERR_ECP_XXX error codes Added handling for MBEDTLS_ERR_ECP_XXX error codes
2018-05-09 13:07:36 +00:00
case MBEDTLS_ERR_ECP_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
mbedtls_to_psa_error: fix a copypasta and a missing translation Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-24 23:09:47 +00:00
Map the new Mbed TLS error value in PSA
2019-11-22 12:48:59 +00:00
case MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED:
return( PSA_ERROR_CORRUPTION_DETECTED );
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 08:18:38 +00:00
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
default:
Replace PSA error code definitions with the ones defined in PSA spec
2019-02-14 11:48:10 +00:00
return( PSA_ERROR_GENERIC_ERROR );
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
}
}
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 15:01:38 +00:00
Be more consistent about blank lines
2018-06-18 19:49:39 +00:00
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
/****************************************************************/
/* Key management */
/****************************************************************/
SE keys: store the slot number in the memory slot
2019-07-12 21:44:37 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
static inline int psa_key_slot_is_external( const psa_key_slot_t *slot )
{
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
return( psa_key_lifetime_is_external( slot->attr.lifetime ) );
SE keys: store the slot number in the memory slot
2019-07-12 21:44:37 +00:00
}
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
/* For now the MBEDTLS_PSA_ACCEL_ guards are also used here since the
* current test driver in key_management.c is using this function
* when accelerators are used for ECC key pair and public key.
* Once that dependency is resolved these guards can be removed.
*/
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 20:28:15 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 16:50:04 +00:00
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) || \
defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR) || \
defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY)
Rename ECC Family Macros According to PSA Spec Rename PSA_ECC_CURVE_xxx to PSA_ECC_FAMILY_xxx, also rename PSA_KEY_TYPE_GET_CURVE to PSA_KEY_TYPE_ECC_GET_FAMILY and rename psa_ecc_curve_t to psa_ecc_family_t. Old defines are provided in include/crypto_compat.h for backward compatibility. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2020-06-02 16:19:28 +00:00
mbedtls_ecp_group_id mbedtls_ecc_group_of_psa( psa_ecc_family_t curve,
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 14:44:45 +00:00
size_t bits,
int bits_is_sloppy )
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-19 22:20:32 +00:00
{
switch( curve )
{
Rename ECC Family Macros According to PSA Spec Rename PSA_ECC_CURVE_xxx to PSA_ECC_FAMILY_xxx, also rename PSA_KEY_TYPE_GET_CURVE to PSA_KEY_TYPE_ECC_GET_FAMILY and rename psa_ecc_curve_t to psa_ecc_family_t. Old defines are provided in include/crypto_compat.h for backward compatibility. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2020-06-02 16:19:28 +00:00
case PSA_ECC_FAMILY_SECP_R1:
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 14:44:45 +00:00
switch( bits )
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 16:24:19 +00:00
{
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 14:44:45 +00:00
case 192:
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 16:24:19 +00:00
return( MBEDTLS_ECP_DP_SECP192R1 );
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 14:44:45 +00:00
case 224:
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 16:24:19 +00:00
return( MBEDTLS_ECP_DP_SECP224R1 );
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 14:44:45 +00:00
case 256:
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 16:24:19 +00:00
return( MBEDTLS_ECP_DP_SECP256R1 );
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 14:44:45 +00:00
case 384:
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 16:24:19 +00:00
return( MBEDTLS_ECP_DP_SECP384R1 );
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 14:44:45 +00:00
case 521:
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 16:24:19 +00:00
return( MBEDTLS_ECP_DP_SECP521R1 );
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 14:44:45 +00:00
case 528:
if( bits_is_sloppy )
return( MBEDTLS_ECP_DP_SECP521R1 );
break;
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 16:24:19 +00:00
}
break;
Rename ECC Family Macros According to PSA Spec Rename PSA_ECC_CURVE_xxx to PSA_ECC_FAMILY_xxx, also rename PSA_KEY_TYPE_GET_CURVE to PSA_KEY_TYPE_ECC_GET_FAMILY and rename psa_ecc_curve_t to psa_ecc_family_t. Old defines are provided in include/crypto_compat.h for backward compatibility. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2020-06-02 16:19:28 +00:00
case PSA_ECC_FAMILY_BRAINPOOL_P_R1:
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 14:44:45 +00:00
switch( bits )
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 16:24:19 +00:00
{
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 14:44:45 +00:00
case 256:
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 16:24:19 +00:00
return( MBEDTLS_ECP_DP_BP256R1 );
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 14:44:45 +00:00
case 384:
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 16:24:19 +00:00
return( MBEDTLS_ECP_DP_BP384R1 );
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 14:44:45 +00:00
case 512:
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 16:24:19 +00:00
return( MBEDTLS_ECP_DP_BP512R1 );
}
break;
Rename ECC Family Macros According to PSA Spec Rename PSA_ECC_CURVE_xxx to PSA_ECC_FAMILY_xxx, also rename PSA_KEY_TYPE_GET_CURVE to PSA_KEY_TYPE_ECC_GET_FAMILY and rename psa_ecc_curve_t to psa_ecc_family_t. Old defines are provided in include/crypto_compat.h for backward compatibility. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2020-06-02 16:19:28 +00:00
case PSA_ECC_FAMILY_MONTGOMERY:
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 14:44:45 +00:00
switch( bits )
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 16:24:19 +00:00
{
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 14:44:45 +00:00
case 255:
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 16:24:19 +00:00
return( MBEDTLS_ECP_DP_CURVE25519 );
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 14:44:45 +00:00
case 256:
if( bits_is_sloppy )
return( MBEDTLS_ECP_DP_CURVE25519 );
break;
case 448:
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 16:24:19 +00:00
return( MBEDTLS_ECP_DP_CURVE448 );
}
break;
Rename ECC Family Macros According to PSA Spec Rename PSA_ECC_CURVE_xxx to PSA_ECC_FAMILY_xxx, also rename PSA_KEY_TYPE_GET_CURVE to PSA_KEY_TYPE_ECC_GET_FAMILY and rename psa_ecc_curve_t to psa_ecc_family_t. Old defines are provided in include/crypto_compat.h for backward compatibility. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2020-06-02 16:19:28 +00:00
case PSA_ECC_FAMILY_SECP_K1:
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 14:44:45 +00:00
switch( bits )
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 16:24:19 +00:00
{
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 14:44:45 +00:00
case 192:
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 16:24:19 +00:00
return( MBEDTLS_ECP_DP_SECP192K1 );
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 14:44:45 +00:00
case 224:
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 16:24:19 +00:00
return( MBEDTLS_ECP_DP_SECP224K1 );
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 14:44:45 +00:00
case 256:
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 16:24:19 +00:00
return( MBEDTLS_ECP_DP_SECP256K1 );
}
break;
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-19 22:20:32 +00:00
}
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 14:44:45 +00:00
return( MBEDTLS_ECP_DP_NONE );
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-19 22:20:32 +00:00
}
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 20:28:15 +00:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 16:50:04 +00:00
* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) ||
* defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR) ||
* defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY) */
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-19 22:20:32 +00:00
Pull apart slot memory allocation from key validation. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 20:04:59 +00:00
static psa_status_t validate_unstructured_key_bit_size( psa_key_type_t type,
size_t bits )
psa_import_key: validate symmetric key size When importing a symmetric key, validate that the key size is valid for the given key type. Non-supported key types may no longer be imported.
2018-06-19 19:31:50 +00:00
{
/* Check that the bit size is acceptable for the key type */
switch( type )
{
case PSA_KEY_TYPE_RAW_DATA:
case PSA_KEY_TYPE_HMAC:
Add framework for simple key derivation New key type PSA_KEY_TYPE_DERIVE. New usage flag PSA_KEY_USAGE_DERIVE. New function psa_key_derivation. No key derivation algorithm is implemented yet. The code may not compile with -Wunused. Write some unit test code for psa_key_derivation. Most of it cannot be used yet due to the lack of a key derivation algorithm.
2018-07-12 15:17:20 +00:00
case PSA_KEY_TYPE_DERIVE:
break;
Use PSA definitions in PSA file This file will always be used with the PSA configurations, so use the MBEDTLS_PSA_BUILTIN... definitions for the symmetric cyphers. Signed-off-by: David Brown <david.brown@linaro.org>
2021-01-26 18:39:16 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_AES)
psa_import_key: validate symmetric key size When importing a symmetric key, validate that the key size is valid for the given key type. Non-supported key types may no longer be imported.
2018-06-19 19:31:50 +00:00
case PSA_KEY_TYPE_AES:
if( bits != 128 && bits != 192 && bits != 256 )
return( PSA_ERROR_INVALID_ARGUMENT );
break;
#endif
Use PSA definitions in PSA file This file will always be used with the PSA configurations, so use the MBEDTLS_PSA_BUILTIN... definitions for the symmetric cyphers. Signed-off-by: David Brown <david.brown@linaro.org>
2021-01-26 18:39:16 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_CAMELLIA)
psa_import_key: validate symmetric key size When importing a symmetric key, validate that the key size is valid for the given key type. Non-supported key types may no longer be imported.
2018-06-19 19:31:50 +00:00
case PSA_KEY_TYPE_CAMELLIA:
if( bits != 128 && bits != 192 && bits != 256 )
return( PSA_ERROR_INVALID_ARGUMENT );
break;
#endif
Use PSA definitions in PSA file This file will always be used with the PSA configurations, so use the MBEDTLS_PSA_BUILTIN... definitions for the symmetric cyphers. Signed-off-by: David Brown <david.brown@linaro.org>
2021-01-26 18:39:16 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
psa_import_key: validate symmetric key size When importing a symmetric key, validate that the key size is valid for the given key type. Non-supported key types may no longer be imported.
2018-06-19 19:31:50 +00:00
case PSA_KEY_TYPE_DES:
if( bits != 64 && bits != 128 && bits != 192 )
return( PSA_ERROR_INVALID_ARGUMENT );
break;
#endif
Use PSA definitions in PSA file This file will always be used with the PSA configurations, so use the MBEDTLS_PSA_BUILTIN... definitions for the symmetric cyphers. Signed-off-by: David Brown <david.brown@linaro.org>
2021-01-26 18:39:16 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ARC4)
psa_import_key: validate symmetric key size When importing a symmetric key, validate that the key size is valid for the given key type. Non-supported key types may no longer be imported.
2018-06-19 19:31:50 +00:00
case PSA_KEY_TYPE_ARC4:
if( bits < 8 || bits > 2048 )
return( PSA_ERROR_INVALID_ARGUMENT );
break;
Implement ChaCha20 and ChaCha20-Poly1305 Smoke tests: test data for ChaCha20 calculated with PyCryptodome; test vector from RFC 7539 for ChaCha20-Poly1305.
2019-05-06 13:25:00 +00:00
#endif
Use new PSA builtin defines for CHACHA20 Change the psa_crypto use of the CHACHA20 cipher to also use the new MBEDTLS_PSA_BUILTIN_KE_TYPE_CHACHA20. Signed-off-by: David Brown <david.brown@linaro.org>
2021-02-16 19:54:35 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_CHACHA20)
Implement ChaCha20 and ChaCha20-Poly1305 Smoke tests: test data for ChaCha20 calculated with PyCryptodome; test vector from RFC 7539 for ChaCha20-Poly1305.
2019-05-06 13:25:00 +00:00
case PSA_KEY_TYPE_CHACHA20:
if( bits != 256 )
return( PSA_ERROR_INVALID_ARGUMENT );
break;
psa_import_key: validate symmetric key size When importing a symmetric key, validate that the key size is valid for the given key type. Non-supported key types may no longer be imported.
2018-06-19 19:31:50 +00:00
#endif
default:
return( PSA_ERROR_NOT_SUPPORTED );
}
Refuse non-byte-sized raw data keys Since the key size is stored in bytes, we can't have a key whose size isn't a whole number of bytes.
2018-06-21 07:32:47 +00:00
if( bits % 8 != 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
psa_import_key: validate symmetric key size When importing a symmetric key, validate that the key size is valid for the given key type. Non-supported key types may no longer be imported.
2018-06-19 19:31:50 +00:00
return( PSA_SUCCESS );
}
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 19:32:04 +00:00
/** Return the size of the key in the given slot, in bits.
*
* \param[in] slot A key slot.
*
* \return The key size in bits, read from the metadata in the slot.
*/
static inline size_t psa_get_key_slot_bits( const psa_key_slot_t *slot )
{
return( slot->attr.bits );
}
Update after feedback on #3492 * Updated wording * Split out buffer allocation to a convenience function * Moved variable declarations to beginning of their code block Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:13 +00:00
/** Try to allocate a buffer to an empty key slot.
*
* \param[in,out] slot Key slot to attach buffer to.
* \param[in] buffer_length Requested size of the buffer.
*
* \retval #PSA_SUCCESS
* The buffer has been successfully allocated.
* \retval #PSA_ERROR_INSUFFICIENT_MEMORY
* Not enough memory was available for allocation.
* \retval #PSA_ERROR_ALREADY_EXISTS
* Trying to allocate a buffer to a non-empty key slot.
*/
static psa_status_t psa_allocate_buffer_to_slot( psa_key_slot_t *slot,
size_t buffer_length )
{
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:52:23 +00:00
if( slot->key.data != NULL )
Style fixes * return is treated as a function call * space between opening and closing parentheses * remove whiteline between assignment and checking of same variable Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-05 13:43:42 +00:00
return( PSA_ERROR_ALREADY_EXISTS );
Update after feedback on #3492 * Updated wording * Split out buffer allocation to a convenience function * Moved variable declarations to beginning of their code block Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:13 +00:00
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:52:23 +00:00
slot->key.data = mbedtls_calloc( 1, buffer_length );
if( slot->key.data == NULL )
Style fixes * return is treated as a function call * space between opening and closing parentheses * remove whiteline between assignment and checking of same variable Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-05 13:43:42 +00:00
return( PSA_ERROR_INSUFFICIENT_MEMORY );
Update after feedback on #3492 * Updated wording * Split out buffer allocation to a convenience function * Moved variable declarations to beginning of their code block Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:13 +00:00
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:52:23 +00:00
slot->key.bytes = buffer_length;
Style fixes * return is treated as a function call * space between opening and closing parentheses * remove whiteline between assignment and checking of same variable Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-05 13:43:42 +00:00
return( PSA_SUCCESS );
Update after feedback on #3492 * Updated wording * Split out buffer allocation to a convenience function * Moved variable declarations to beginning of their code block Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:13 +00:00
}
Add internal helper function to load prevalidated key material Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-13 18:27:40 +00:00
psa_status_t psa_copy_key_material_into_slot( psa_key_slot_t *slot,
const uint8_t* data,
size_t data_length )
{
psa_status_t status = psa_allocate_buffer_to_slot( slot,
data_length );
if( status != PSA_SUCCESS )
return( status );
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:52:23 +00:00
memcpy( slot->key.data, data, data_length );
Add internal helper function to load prevalidated key material Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-13 18:27:40 +00:00
return( PSA_SUCCESS );
}
psa: Export internally psa_import_key_into_slot() Export psa_import_key_into_slot from psa_crypto.c to make it available to the driver wrapper. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-29 10:14:53 +00:00
psa_status_t psa_import_key_into_slot(
psa: Change psa_import_key_into_slot() signature Change psa_import_key_into_slot() signature to the signature of an import_key driver entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 14:54:54 +00:00
const psa_key_attributes_t *attributes,
const uint8_t *data, size_t data_length,
uint8_t *key_buffer, size_t key_buffer_size,
size_t *key_buffer_length, size_t *bits )
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
{
psa: Change psa_import_key_into_slot() signature Change psa_import_key_into_slot() signature to the signature of an import_key driver entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 14:54:54 +00:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa_key_type_t type = attributes->core.type;
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
Pull apart slot memory allocation from key validation. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 20:04:59 +00:00
/* zero-length keys are never supported. */
if( data_length == 0 )
return( PSA_ERROR_NOT_SUPPORTED );
psa: Change psa_import_key_into_slot() signature Change psa_import_key_into_slot() signature to the signature of an import_key driver entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 14:54:54 +00:00
if( key_type_is_raw_bytes( type ) )
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
{
psa: Change psa_import_key_into_slot() signature Change psa_import_key_into_slot() signature to the signature of an import_key driver entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 14:54:54 +00:00
*bits = PSA_BYTES_TO_BITS( data_length );
Pull apart slot memory allocation from key validation. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 20:04:59 +00:00
Update after feedback on #3492 * Updated wording * Split out buffer allocation to a convenience function * Moved variable declarations to beginning of their code block Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:13 +00:00
/* Ensure that the bytes-to-bits conversion hasn't overflown. */
if( data_length > SIZE_MAX / 8 )
return( PSA_ERROR_NOT_SUPPORTED );
Correct some comments
2019-08-07 08:59:45 +00:00
/* Enforce a size limit, and in particular ensure that the bit
* size fits in its representation type. */
psa: Change psa_import_key_into_slot() signature Change psa_import_key_into_slot() signature to the signature of an import_key driver entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 14:54:54 +00:00
if( ( *bits ) > PSA_MAX_KEY_BITS )
Limit keys to 65528 bits 65528 bits is more than any reasonable key until we start supporting post-quantum cryptography. This limit is chosen to allow bit-sizes to be stored in 16 bits, with 65535 left to indicate an invalid value. It's a whole number of bytes, which facilitates some calculations, in particular allowing a key of exactly PSA_CRYPTO_MAX_STORAGE_SIZE to be created but not one bit more. As a resource usage limit, this is arguably too large, but that's out of scope of the current commit. Test that key import, generation and derivation reject overly large sizes.
2019-07-30 15:26:54 +00:00
return( PSA_ERROR_NOT_SUPPORTED );
Pull apart slot memory allocation from key validation. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 20:04:59 +00:00
psa: Change psa_import_key_into_slot() signature Change psa_import_key_into_slot() signature to the signature of an import_key driver entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 14:54:54 +00:00
status = validate_unstructured_key_bit_size( type, *bits );
psa_import_key: validate symmetric key size When importing a symmetric key, validate that the key size is valid for the given key type. Non-supported key types may no longer be imported.
2018-06-19 19:31:50 +00:00
if( status != PSA_SUCCESS )
Style fixes * return is treated as a function call * space between opening and closing parentheses * remove whiteline between assignment and checking of same variable Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-05 13:43:42 +00:00
return( status );
Pull apart slot memory allocation from key validation. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 20:04:59 +00:00
psa: import: Move key buffer allocation Move key buffer allocation from psa_import_key_into_slot() function up to the two functions calling it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 14:14:42 +00:00
/* Copy the key material. */
memcpy( key_buffer, data, data_length );
*key_buffer_length = data_length;
(void)key_buffer_size;
Pull apart slot memory allocation from key validation. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 20:04:59 +00:00
Address review comments * zero key buffer on failure * readability improvements * psa_finish_key_creation adjustment after removing import_key_into_slot Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-29 10:42:22 +00:00
return( PSA_SUCCESS );
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
}
psa: Change psa_import_key_into_slot() signature Change psa_import_key_into_slot() signature to the signature of an import_key driver entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 14:54:54 +00:00
else if( PSA_KEY_TYPE_IS_ASYMMETRIC( type ) )
psa: Simplify EC public key format Remove front matter from our EC key format, to make it just the contents of an ECPoint as defined by SEC1 section 2.3.3. As a consequence of the simplification, remove the restriction on not being able to use an ECDH key with ECDSA. There is no longer any OID specified when importing a key, so we can't reject importing of an ECDH key for the purpose of ECDSA based on the OID.
2019-01-10 11:42:27 +00:00
{
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 20:28:15 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)
psa: Change psa_import_key_into_slot() signature Change psa_import_key_into_slot() signature to the signature of an import_key driver entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 14:54:54 +00:00
if( PSA_KEY_TYPE_IS_ECC( type ) )
Separate 'import' from 'load into slot' Now that there's a validate_key entry point for drivers, it becomes much more important to separate the import action (where a key needs to be validated) from the load action (where a key has been previously validated, and thus re-validating it would be a waste of time). This also exposes why not storing the 'bits' attribute persistently was a bad idea. The only reason there's a rather large function to detect bit size is because loading from persistent storage requires it. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-23 09:37:05 +00:00
{
psa: Change psa_import_key_into_slot() signature Change psa_import_key_into_slot() signature to the signature of an import_key driver entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 14:54:54 +00:00
return( mbedtls_psa_ecp_import_key( attributes,
data, data_length,
key_buffer, key_buffer_size,
key_buffer_length,
bits ) );
Separate 'import' from 'load into slot' Now that there's a validate_key entry point for drivers, it becomes much more important to separate the import action (where a key needs to be validated) from the load action (where a key has been previously validated, and thus re-validating it would be a waste of time). This also exposes why not storing the 'bits' attribute persistently was a bad idea. The only reason there's a rather large function to detect bit size is because loading from persistent storage requires it. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-23 09:37:05 +00:00
}
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 20:28:15 +00:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
Add feature support for RSA for PSA crypto config In the original attempt to add RSA support to PSA crypto config was too generic. This set of changes adds support for the following RSA features: PSA_WANT_ALG_RSA_PKCS1V15_CRYPT, PSA_WANT_ALG_RSA_PKCS1V15_SIGN, PSA_WANT_ALG_RSA_OAEP, PSA_WANT_ALG_RSA_PSS, PSA_WANT_KEY_TYPE_RSA_KEY_PAIR, and PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY. There were also some updates to ensure the proper inclusion of PSA crypto library code when certain features are enabled. These updates were made to address warnings and errors in builds from the new tests for these features being added for PSA crypto configuration. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-01 05:06:54 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
psa: Change psa_import_key_into_slot() signature Change psa_import_key_into_slot() signature to the signature of an import_key driver entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 14:54:54 +00:00
if( PSA_KEY_TYPE_IS_RSA( type ) )
Separate 'import' from 'load into slot' Now that there's a validate_key entry point for drivers, it becomes much more important to separate the import action (where a key needs to be validated) from the load action (where a key has been previously validated, and thus re-validating it would be a waste of time). This also exposes why not storing the 'bits' attribute persistently was a bad idea. The only reason there's a rather large function to detect bit size is because loading from persistent storage requires it. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-23 09:37:05 +00:00
{
psa: Change psa_import_key_into_slot() signature Change psa_import_key_into_slot() signature to the signature of an import_key driver entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 14:54:54 +00:00
return( mbedtls_psa_rsa_import_key( attributes,
data, data_length,
key_buffer, key_buffer_size,
key_buffer_length,
bits ) );
Separate 'import' from 'load into slot' Now that there's a validate_key entry point for drivers, it becomes much more important to separate the import action (where a key needs to be validated) from the load action (where a key has been previously validated, and thus re-validating it would be a waste of time). This also exposes why not storing the 'bits' attribute persistently was a bad idea. The only reason there's a rather large function to detect bit size is because loading from persistent storage requires it. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-23 09:37:05 +00:00
}
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 20:28:15 +00:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
}
psa: Change psa_import_key_into_slot() signature Change psa_import_key_into_slot() signature to the signature of an import_key driver entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 14:54:54 +00:00
return( PSA_ERROR_NOT_SUPPORTED );
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 10:21:11 +00:00
}
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
/** Calculate the intersection of two algorithm usage policies.
*
* Return 0 (which allows no operation) on incompatibility.
*/
static psa_algorithm_t psa_key_policy_algorithm_intersection(
psa_algorithm_t alg1,
psa_algorithm_t alg2 )
{
Minor documentation improvements
2019-05-22 09:45:59 +00:00
/* Common case: both sides actually specify the same policy. */
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
if( alg1 == alg2 )
return( alg1 );
/* If the policies are from the same hash-and-sign family, check
* if one is a wildcard. If so the other has the specific algorithm. */
if( PSA_ALG_IS_HASH_AND_SIGN( alg1 ) &&
PSA_ALG_IS_HASH_AND_SIGN( alg2 ) &&
( alg1 & ~PSA_ALG_HASH_MASK ) == ( alg2 & ~PSA_ALG_HASH_MASK ) )
{
if( PSA_ALG_SIGN_GET_HASH( alg1 ) == PSA_ALG_ANY_HASH )
return( alg2 );
if( PSA_ALG_SIGN_GET_HASH( alg2 ) == PSA_ALG_ANY_HASH )
return( alg1 );
}
/* If the policies are incompatible, allow nothing. */
return( 0 );
}
Keys may allow a second algorithm Add a second permitted algorithm to key policies. This commit includes smoke tests that do not cover psa_copy_key.
2019-05-10 17:33:38 +00:00
static int psa_key_algorithm_permits( psa_algorithm_t policy_alg,
psa_algorithm_t requested_alg )
Add a hash wildcard value for hash-and-sign algorithm You can use PSA_ALG_ANY_HASH to build the algorithm value for a hash-and-sign algorithm in a policy. Then the policy allows usage with this hash-and-sign family with any hash. Test that PSA_ALG_ANY_HASH-based policies allow a specific hash, but not a different hash-and-sign family. Test that PSA_ALG_ANY_HASH is not valid for operations, only in policies.
2019-01-14 15:06:39 +00:00
{
Minor documentation improvements
2019-05-22 09:45:59 +00:00
/* Common case: the policy only allows requested_alg. */
Keys may allow a second algorithm Add a second permitted algorithm to key policies. This commit includes smoke tests that do not cover psa_copy_key.
2019-05-10 17:33:38 +00:00
if( requested_alg == policy_alg )
Add a hash wildcard value for hash-and-sign algorithm You can use PSA_ALG_ANY_HASH to build the algorithm value for a hash-and-sign algorithm in a policy. Then the policy allows usage with this hash-and-sign family with any hash. Test that PSA_ALG_ANY_HASH-based policies allow a specific hash, but not a different hash-and-sign family. Test that PSA_ALG_ANY_HASH is not valid for operations, only in policies.
2019-01-14 15:06:39 +00:00
return( 1 );
Keys may allow a second algorithm Add a second permitted algorithm to key policies. This commit includes smoke tests that do not cover psa_copy_key.
2019-05-10 17:33:38 +00:00
/* If policy_alg is a hash-and-sign with a wildcard for the hash,
Minor documentation improvements
2019-05-22 09:45:59 +00:00
* and requested_alg is the same hash-and-sign family with any hash,
* then requested_alg is compliant with policy_alg. */
Keys may allow a second algorithm Add a second permitted algorithm to key policies. This commit includes smoke tests that do not cover psa_copy_key.
2019-05-10 17:33:38 +00:00
if( PSA_ALG_IS_HASH_AND_SIGN( requested_alg ) &&
PSA_ALG_SIGN_GET_HASH( policy_alg ) == PSA_ALG_ANY_HASH )
Add a hash wildcard value for hash-and-sign algorithm You can use PSA_ALG_ANY_HASH to build the algorithm value for a hash-and-sign algorithm in a policy. Then the policy allows usage with this hash-and-sign family with any hash. Test that PSA_ALG_ANY_HASH-based policies allow a specific hash, but not a different hash-and-sign family. Test that PSA_ALG_ANY_HASH is not valid for operations, only in policies.
2019-01-14 15:06:39 +00:00
{
Keys may allow a second algorithm Add a second permitted algorithm to key policies. This commit includes smoke tests that do not cover psa_copy_key.
2019-05-10 17:33:38 +00:00
return( ( policy_alg & ~PSA_ALG_HASH_MASK ) ==
( requested_alg & ~PSA_ALG_HASH_MASK ) );
Add a hash wildcard value for hash-and-sign algorithm You can use PSA_ALG_ANY_HASH to build the algorithm value for a hash-and-sign algorithm in a policy. Then the policy allows usage with this hash-and-sign family with any hash. Test that PSA_ALG_ANY_HASH-based policies allow a specific hash, but not a different hash-and-sign family. Test that PSA_ALG_ANY_HASH is not valid for operations, only in policies.
2019-01-14 15:06:39 +00:00
}
Fix PSA crypto inconsistencies in agreement+derivation * #3741 Allow key agreement inside derivation with a key that's allowed for the relevant agreement. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-05 14:02:45 +00:00
/* If policy_alg is a generic key agreement operation, then using it for
Apply review feedback Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-15 15:07:12 +00:00
* a key derivation with that key agreement should also be allowed. This
* behaviour is expected to be defined in a future specification version. */
Fix PSA crypto inconsistencies in agreement+derivation * #3741 Allow key agreement inside derivation with a key that's allowed for the relevant agreement. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-05 14:02:45 +00:00
if( PSA_ALG_IS_RAW_KEY_AGREEMENT( policy_alg ) &&
PSA_ALG_IS_KEY_AGREEMENT( requested_alg ) )
{
return( PSA_ALG_KEY_AGREEMENT_GET_BASE( requested_alg ) ==
policy_alg );
}
Add a hash wildcard value for hash-and-sign algorithm You can use PSA_ALG_ANY_HASH to build the algorithm value for a hash-and-sign algorithm in a policy. Then the policy allows usage with this hash-and-sign family with any hash. Test that PSA_ALG_ANY_HASH-based policies allow a specific hash, but not a different hash-and-sign family. Test that PSA_ALG_ANY_HASH is not valid for operations, only in policies.
2019-01-14 15:06:39 +00:00
/* If it isn't permitted, it's forbidden. */
return( 0 );
}
Keys may allow a second algorithm Add a second permitted algorithm to key policies. This commit includes smoke tests that do not cover psa_copy_key.
2019-05-10 17:33:38 +00:00
/** Test whether a policy permits an algorithm.
*
* The caller must test usage flags separately.
*/
static int psa_key_policy_permits( const psa_key_policy_t *policy,
psa_algorithm_t alg )
{
return( psa_key_algorithm_permits( policy->alg, alg ) ||
psa_key_algorithm_permits( policy->alg2, alg ) );
}
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
/** Restrict a key policy based on a constraint.
*
* \param[in,out] policy The policy to restrict.
* \param[in] constraint The policy constraint to apply.
*
* \retval #PSA_SUCCESS
* \c *policy contains the intersection of the original value of
* \c *policy and \c *constraint.
* \retval #PSA_ERROR_INVALID_ARGUMENT
* \c *policy and \c *constraint are incompatible.
* \c *policy is unchanged.
*/
static psa_status_t psa_restrict_key_policy(
psa_key_policy_t *policy,
const psa_key_policy_t *constraint )
{
psa_algorithm_t intersection_alg =
psa_key_policy_algorithm_intersection( policy->alg, constraint->alg );
Keys may allow a second algorithm Add a second permitted algorithm to key policies. This commit includes smoke tests that do not cover psa_copy_key.
2019-05-10 17:33:38 +00:00
psa_algorithm_t intersection_alg2 =
psa_key_policy_algorithm_intersection( policy->alg2, constraint->alg2 );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
if( intersection_alg == 0 && policy->alg != 0 && constraint->alg != 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
Keys may allow a second algorithm Add a second permitted algorithm to key policies. This commit includes smoke tests that do not cover psa_copy_key.
2019-05-10 17:33:38 +00:00
if( intersection_alg2 == 0 && policy->alg2 != 0 && constraint->alg2 != 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
policy->usage &= constraint->usage;
policy->alg = intersection_alg;
Keys may allow a second algorithm Add a second permitted algorithm to key policies. This commit includes smoke tests that do not cover psa_copy_key.
2019-05-10 17:33:38 +00:00
policy->alg2 = intersection_alg2;
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
return( PSA_SUCCESS );
}
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
/** Get the description of a key given its identifier and policy constraints
* and lock it.
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
*
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
* The key must have allow all the usage flags set in \p usage. If \p alg is
* nonzero, the key must allow operations with this algorithm.
Miscellaneous documentation improvements Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-11 14:04:25 +00:00
*
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
* In case of a persistent key, the function loads the description of the key
* into a key slot if not already done.
*
* On success, the returned key slot is locked. It is the responsibility of
* the caller to unlock the key slot when it does not access it anymore.
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
*/
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
static psa_status_t psa_get_and_lock_key_slot_with_policy(
mbedtls_svc_key_id_t key,
psa_key_slot_t **p_slot,
psa_key_usage_t usage,
psa_algorithm_t alg )
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 10:21:11 +00:00
{
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa_key_slot_t *slot;
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 10:21:11 +00:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
status = psa_get_and_lock_key_slot( key, p_slot );
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 10:21:11 +00:00
if( status != PSA_SUCCESS )
return( status );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
slot = *p_slot;
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 10:21:11 +00:00
/* Enforce that usage policy for the key slot contains all the flags
* required by the usage parameter. There is one exception: public
* keys can always be exported, so we treat public key objects as
* if they had the export flag. */
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->attr.type ) )
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 10:21:11 +00:00
usage &= ~PSA_KEY_USAGE_EXPORT;
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
status = PSA_ERROR_NOT_PERMITTED;
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( ( slot->attr.policy.usage & usage ) != usage )
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
goto error;
Add a hash wildcard value for hash-and-sign algorithm You can use PSA_ALG_ANY_HASH to build the algorithm value for a hash-and-sign algorithm in a policy. Then the policy allows usage with this hash-and-sign family with any hash. Test that PSA_ALG_ANY_HASH-based policies allow a specific hash, but not a different hash-and-sign family. Test that PSA_ALG_ANY_HASH is not valid for operations, only in policies.
2019-01-14 15:06:39 +00:00
/* Enforce that the usage policy permits the requested algortihm. */
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( alg != 0 && ! psa_key_policy_permits( &slot->attr.policy, alg ) )
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
goto error;
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 10:21:11 +00:00
return( PSA_SUCCESS );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
error:
*p_slot = NULL;
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
psa_unlock_key_slot( slot );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
return( status );
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 10:21:11 +00:00
}
psa: Refactor psa_import_key() Create a new function psa_import_key_into_slot() from psa_import_key(). This is common functionality that will be used both when importing a key and loading a key from persistent storage.
2018-07-13 12:18:51 +00:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
/** Get a key slot containing a transparent key and lock it.
SE keys: ensure that functions that lack support properly error out Introduce a new function psa_get_transparent_key which returns NOT_SUPPORTED if the key is in a secure element. Use this function in functions that don't support keys in a secure element. After this commit, all functions that access a key slot directly via psa_get_key_slot or psa_get_key_from_slot rather than via psa_get_transparent_key have at least enough support for secure elements not to crash or otherwise cause undefined behavior. Lesser bad behavior such as wrong results or resource leakage is still possible in error cases.
2019-07-24 11:30:31 +00:00
*
* A transparent key is a key for which the key material is directly
* available, as opposed to a key in a secure element.
*
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
* This is a temporary function to use instead of
* psa_get_and_lock_key_slot_with_policy() until secure element support is
* fully implemented.
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
*
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
* On success, the returned key slot is locked. It is the responsibility of the
* caller to unlock the key slot when it does not access it anymore.
SE keys: ensure that functions that lack support properly error out Introduce a new function psa_get_transparent_key which returns NOT_SUPPORTED if the key is in a secure element. Use this function in functions that don't support keys in a secure element. After this commit, all functions that access a key slot directly via psa_get_key_slot or psa_get_key_from_slot rather than via psa_get_transparent_key have at least enough support for secure elements not to crash or otherwise cause undefined behavior. Lesser bad behavior such as wrong results or resource leakage is still possible in error cases.
2019-07-24 11:30:31 +00:00
*/
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
static psa_status_t psa_get_and_lock_transparent_key_slot_with_policy(
mbedtls_svc_key_id_t key,
psa_key_slot_t **p_slot,
psa_key_usage_t usage,
psa_algorithm_t alg )
SE keys: ensure that functions that lack support properly error out Introduce a new function psa_get_transparent_key which returns NOT_SUPPORTED if the key is in a secure element. Use this function in functions that don't support keys in a secure element. After this commit, all functions that access a key slot directly via psa_get_key_slot or psa_get_key_from_slot rather than via psa_get_transparent_key have at least enough support for secure elements not to crash or otherwise cause undefined behavior. Lesser bad behavior such as wrong results or resource leakage is still possible in error cases.
2019-07-24 11:30:31 +00:00
{
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
psa_status_t status = psa_get_and_lock_key_slot_with_policy( key, p_slot,
usage, alg );
SE keys: ensure that functions that lack support properly error out Introduce a new function psa_get_transparent_key which returns NOT_SUPPORTED if the key is in a secure element. Use this function in functions that don't support keys in a secure element. After this commit, all functions that access a key slot directly via psa_get_key_slot or psa_get_key_from_slot rather than via psa_get_transparent_key have at least enough support for secure elements not to crash or otherwise cause undefined behavior. Lesser bad behavior such as wrong results or resource leakage is still possible in error cases.
2019-07-24 11:30:31 +00:00
if( status != PSA_SUCCESS )
return( status );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa_key_slot_is_external exists. Use it.
2019-07-25 09:31:23 +00:00
if( psa_key_slot_is_external( *p_slot ) )
SE keys: ensure that functions that lack support properly error out Introduce a new function psa_get_transparent_key which returns NOT_SUPPORTED if the key is in a secure element. Use this function in functions that don't support keys in a secure element. After this commit, all functions that access a key slot directly via psa_get_key_slot or psa_get_key_from_slot rather than via psa_get_transparent_key have at least enough support for secure elements not to crash or otherwise cause undefined behavior. Lesser bad behavior such as wrong results or resource leakage is still possible in error cases.
2019-07-24 11:30:31 +00:00
{
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
psa_unlock_key_slot( *p_slot );
SE keys: ensure that functions that lack support properly error out Introduce a new function psa_get_transparent_key which returns NOT_SUPPORTED if the key is in a secure element. Use this function in functions that don't support keys in a secure element. After this commit, all functions that access a key slot directly via psa_get_key_slot or psa_get_key_from_slot rather than via psa_get_transparent_key have at least enough support for secure elements not to crash or otherwise cause undefined behavior. Lesser bad behavior such as wrong results or resource leakage is still possible in error cases.
2019-07-24 11:30:31 +00:00
*p_slot = NULL;
return( PSA_ERROR_NOT_SUPPORTED );
}
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
SE keys: ensure that functions that lack support properly error out Introduce a new function psa_get_transparent_key which returns NOT_SUPPORTED if the key is in a secure element. Use this function in functions that don't support keys in a secure element. After this commit, all functions that access a key slot directly via psa_get_key_slot or psa_get_key_from_slot rather than via psa_get_transparent_key have at least enough support for secure elements not to crash or otherwise cause undefined behavior. Lesser bad behavior such as wrong results or resource leakage is still possible in error cases.
2019-07-24 11:30:31 +00:00
return( PSA_SUCCESS );
}
#else /* MBEDTLS_PSA_CRYPTO_SE_C */
/* With no secure element support, all keys are transparent. */
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
#define psa_get_and_lock_transparent_key_slot_with_policy( key, p_slot, usage, alg ) \
psa_get_and_lock_key_slot_with_policy( key, p_slot, usage, alg )
SE keys: ensure that functions that lack support properly error out Introduce a new function psa_get_transparent_key which returns NOT_SUPPORTED if the key is in a secure element. Use this function in functions that don't support keys in a secure element. After this commit, all functions that access a key slot directly via psa_get_key_slot or psa_get_key_from_slot rather than via psa_get_transparent_key have at least enough support for secure elements not to crash or otherwise cause undefined behavior. Lesser bad behavior such as wrong results or resource leakage is still possible in error cases.
2019-07-24 11:30:31 +00:00
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Factor the common idiom psa_wipe_key_slot into a function Many places in the code called psa_remove_key_data_from_memory (which preserves metadata for the sake of failues in psa_import_key) followed by clearing the slot data. Use an auxiliary function for this.
2018-12-03 10:58:46 +00:00
/** Wipe key data from a slot. Preserve metadata such as the policy. */
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 16:12:32 +00:00
static psa_status_t psa_remove_key_data_from_memory( psa_key_slot_t *slot )
psa: Refactor psa_import_key() Create a new function psa_import_key_into_slot() from psa_import_key(). This is common functionality that will be used both when importing a key and loading a key from persistent storage.
2018-07-13 12:18:51 +00:00
{
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:52:23 +00:00
/* Data pointer will always be either a valid pointer or NULL in an
* initialized slot, so we can just free it. */
if( slot->key.data != NULL )
mbedtls_platform_zeroize( slot->key.data, slot->key.bytes);
mbedtls_free( slot->key.data );
slot->key.data = NULL;
slot->key.bytes = 0;
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
return( PSA_SUCCESS );
}
Factor the common idiom psa_wipe_key_slot into a function Many places in the code called psa_remove_key_data_from_memory (which preserves metadata for the sake of failues in psa_import_key) followed by clearing the slot data. Use an auxiliary function for this.
2018-12-03 10:58:46 +00:00
/** Completely wipe a slot in memory, including its policy.
* Persistent storage is not affected. */
Move the key slot array to the slot management module Move the key slot array and its initialization and wiping to the slot management module. Also move the lowest-level key slot access function psa_get_key_slot and the auxiliary function for slot allocation psa_internal_allocate_key_slot to the slot management module.
2018-12-10 15:29:04 +00:00
psa_status_t psa_wipe_key_slot( psa_key_slot_t *slot )
Factor the common idiom psa_wipe_key_slot into a function Many places in the code called psa_remove_key_data_from_memory (which preserves metadata for the sake of failues in psa_import_key) followed by clearing the slot data. Use an auxiliary function for this.
2018-12-03 10:58:46 +00:00
{
psa_status_t status = psa_remove_key_data_from_memory( slot );
psa: Add access counter check in slot wipe Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-30 13:07:07 +00:00
/*
* As the return error code may not be handled in case of multiple errors,
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
* do our best to report an unexpected lock counter: if available
psa: Add access counter check in slot wipe Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-30 13:07:07 +00:00
* call MBEDTLS_PARAM_FAILED that may terminate execution (if called as
* part of the execution of a test suite this will stop the test suite
psa: Remove error message output Remove error message output in case of unexpected access counter as Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-13 09:11:01 +00:00
* execution).
psa: Add access counter check in slot wipe Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-30 13:07:07 +00:00
*/
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
if( slot->lock_count != 1 )
psa: Add access counter check in slot wipe Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-30 13:07:07 +00:00
{
#ifdef MBEDTLS_CHECK_PARAMS
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
MBEDTLS_PARAM_FAILED( slot->lock_count == 1 );
psa: Add access counter check in slot wipe Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-30 13:07:07 +00:00
#endif
status = PSA_ERROR_CORRUPTION_DETECTED;
}
Document better what wiping a key slot does not do When a key slot is wiped, a copy of the key material may remain in operations. This is undesirable, but does not violate the safety of the code. Tracked in https://github.com/ARMmbed/mbed-crypto/issues/86
2019-08-13 13:01:08 +00:00
/* Multipart operations may still be using the key. This is safe
* because all multipart operation objects are independent from
* the key slot: if they need to access the key after the setup
* phase, they have a copy of the key. Note that this means that
* key material can linger until all operations are completed. */
Factor the common idiom psa_wipe_key_slot into a function Many places in the code called psa_remove_key_data_from_memory (which preserves metadata for the sake of failues in psa_import_key) followed by clearing the slot data. Use an auxiliary function for this.
2018-12-03 10:58:46 +00:00
/* At this point, key material and other type-specific content has
* been wiped. Clear remaining metadata. We can call memset and not
* zeroize because the metadata is not particularly sensitive. */
memset( slot, 0, sizeof( *slot ) );
return( status );
}
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
psa_status_t psa_destroy_key( mbedtls_svc_key_id_t key )
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 14:48:15 +00:00
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 16:12:32 +00:00
psa_key_slot_t *slot;
Clean up status code handling inside psa_destroy_key Adopt a simple method for tracking whether there was a failure: each fallible operation sets overall_status, unless overall_status is already non-successful. Thus in case of multiple failures, the function always reports whatever failed first. This may not always be the right thing, but it's simple. This revealed a bug whereby if the only failure was the call to psa_destroy_se_key(), i.e. if the driver reported a failure or if the driver lacked support for destroying keys, psa_destroy_key() would ignore that failure. For a key in a secure element, if creating a transaction file fails, don't touch storage, but close the key in memory. This may not be right, but it's no wronger than it was before. Tracked in https://github.com/ARMmbed/mbed-crypto/issues/215
2019-08-13 13:58:36 +00:00
psa_status_t status; /* status of the last operation */
psa_status_t overall_status = PSA_SUCCESS;
SE keys: support destroy When destroying a key in a secure element, call the driver's destroy method and update the driver's persistent data in storage.
2019-07-12 21:46:38 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
psa_se_drv_table_entry_t *driver;
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 14:48:15 +00:00
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
if( mbedtls_svc_key_id_is_null( key ) )
Make psa_close_key(0) and psa_destroy_key(0) succeed
2019-10-08 13:48:25 +00:00
return( PSA_SUCCESS );
psa: Do not reset a key slot under access When psa_close/destroy/purge_key is called, do not reset a key slot containing the description of a persistent key if it is currently accessed. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-29 16:51:10 +00:00
/*
Prefer persistent over permanent For consistency across the code base, prefer persistent over permanent to qualify a key stored in persistent storage. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-10 17:08:03 +00:00
* Get the description of the key in a key slot. In case of a persistent
psa: Do not reset a key slot under access When psa_close/destroy/purge_key is called, do not reset a key slot containing the description of a persistent key if it is currently accessed. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-29 16:51:10 +00:00
* key, this will load the key description from persistent memory if not
* done yet. We cannot avoid this loading as without it we don't know if
* the key is operated by an SE or not and this information is needed by
* the current implementation.
*/
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
status = psa_get_and_lock_key_slot( key, &slot );
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 14:48:15 +00:00
if( status != PSA_SUCCESS )
return( status );
psa: Do not reset a key slot under access When psa_close/destroy/purge_key is called, do not reset a key slot containing the description of a persistent key if it is currently accessed. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-29 16:51:10 +00:00
/*
* If the key slot containing the key description is under access by the
* library (apart from the present access), the key cannot be destroyed
* yet. For the time being, just return in error. Eventually (to be
* implemented), the key should be destroyed when all accesses have
* stopped.
*/
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
if( slot->lock_count > 1 )
psa: Do not reset a key slot under access When psa_close/destroy/purge_key is called, do not reset a key slot containing the description of a persistent key if it is currently accessed. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-29 16:51:10 +00:00
{
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
psa_unlock_key_slot( slot );
psa: Do not reset a key slot under access When psa_close/destroy/purge_key is called, do not reset a key slot containing the description of a persistent key if it is currently accessed. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-29 16:51:10 +00:00
return( PSA_ERROR_GENERIC_ERROR );
}
SE keys: support destroy When destroying a key in a secure element, call the driver's destroy method and update the driver's persistent data in storage.
2019-07-12 21:46:38 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
driver = psa_get_se_driver_entry( slot->attr.lifetime );
SE keys: support destroy When destroying a key in a secure element, call the driver's destroy method and update the driver's persistent data in storage.
2019-07-12 21:46:38 +00:00
if( driver != NULL )
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 17:30:34 +00:00
{
Improve comments
2019-07-25 09:32:45 +00:00
/* For a key in a secure element, we need to do three things:
* remove the key file in internal storage, destroy the
* key inside the secure element, and update the driver's
* persistent data. Start a transaction that will encompass these
* three actions. */
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 17:30:34 +00:00
psa_crypto_prepare_transaction( PSA_CRYPTO_TRANSACTION_DESTROY_KEY );
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:52:23 +00:00
psa_crypto_transaction.key.slot = psa_key_slot_get_slot_number( slot );
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
psa_crypto_transaction.key.id = slot->attr.id;
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 17:30:34 +00:00
status = psa_crypto_save_transaction( );
if( status != PSA_SUCCESS )
{
If starting a transaction fails, wipe the transaction data Nothing has been saved to disk yet, but there is stale data in psa_crypto_transaction. This stale data should not be reused, but do wipe it to reduce the risk of it mattering somehow in the future.
2019-07-25 16:02:52 +00:00
(void) psa_crypto_stop_transaction( );
Clean up status code handling inside psa_destroy_key Adopt a simple method for tracking whether there was a failure: each fallible operation sets overall_status, unless overall_status is already non-successful. Thus in case of multiple failures, the function always reports whatever failed first. This may not always be the right thing, but it's simple. This revealed a bug whereby if the only failure was the call to psa_destroy_se_key(), i.e. if the driver reported a failure or if the driver lacked support for destroying keys, psa_destroy_key() would ignore that failure. For a key in a secure element, if creating a transaction file fails, don't touch storage, but close the key in memory. This may not be right, but it's no wronger than it was before. Tracked in https://github.com/ARMmbed/mbed-crypto/issues/215
2019-08-13 13:58:36 +00:00
/* We should still try to destroy the key in the secure
* element and the key metadata in storage. This is especially
* important if the error is that the storage is full.
* But how to do it exactly without risking an inconsistent
* state after a reset?
* https://github.com/ARMmbed/mbed-crypto/issues/215
*/
overall_status = status;
goto exit;
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 17:30:34 +00:00
}
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:52:23 +00:00
status = psa_destroy_se_key( driver,
psa_key_slot_get_slot_number( slot ) );
Clean up status code handling inside psa_destroy_key Adopt a simple method for tracking whether there was a failure: each fallible operation sets overall_status, unless overall_status is already non-successful. Thus in case of multiple failures, the function always reports whatever failed first. This may not always be the right thing, but it's simple. This revealed a bug whereby if the only failure was the call to psa_destroy_se_key(), i.e. if the driver reported a failure or if the driver lacked support for destroying keys, psa_destroy_key() would ignore that failure. For a key in a secure element, if creating a transaction file fails, don't touch storage, but close the key in memory. This may not be right, but it's no wronger than it was before. Tracked in https://github.com/ARMmbed/mbed-crypto/issues/215
2019-08-13 13:58:36 +00:00
if( overall_status == PSA_SUCCESS )
overall_status = status;
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 17:30:34 +00:00
}
SE keys: support destroy When destroying a key in a secure element, call the driver's destroy method and update the driver's persistent data in storage.
2019-07-12 21:46:38 +00:00
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 14:48:15 +00:00
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 16:27:26 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
psa: Fix tests/handling of lifetime incompatible with location The lifetime of key attributes now encodes whether a key is volatile/persistent or not AND its location. Fix PSA code where the fact that the lifetime encodes the key location was not taken into account properly. Fix the impacted tests and add two non regression tests. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-23 16:00:55 +00:00
if( ! PSA_KEY_LIFETIME_IS_VOLATILE( slot->attr.lifetime ) )
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 14:48:15 +00:00
{
Clean up status code handling inside psa_destroy_key Adopt a simple method for tracking whether there was a failure: each fallible operation sets overall_status, unless overall_status is already non-successful. Thus in case of multiple failures, the function always reports whatever failed first. This may not always be the right thing, but it's simple. This revealed a bug whereby if the only failure was the call to psa_destroy_se_key(), i.e. if the driver reported a failure or if the driver lacked support for destroying keys, psa_destroy_key() would ignore that failure. For a key in a secure element, if creating a transaction file fails, don't touch storage, but close the key in memory. This may not be right, but it's no wronger than it was before. Tracked in https://github.com/ARMmbed/mbed-crypto/issues/215
2019-08-13 13:58:36 +00:00
status = psa_destroy_persistent_key( slot->attr.id );
if( overall_status == PSA_SUCCESS )
overall_status = status;
Note about destroying a key with other open handles https://github.com/ARMmbed/mbed-crypto/issues/214
2019-08-13 13:14:20 +00:00
/* TODO: other slots may have a copy of the same key. We should
* invalidate them.
* https://github.com/ARMmbed/mbed-crypto/issues/214
*/
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 14:48:15 +00:00
}
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 16:27:26 +00:00
#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 14:48:15 +00:00
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 17:30:34 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
if( driver != NULL )
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 16:27:26 +00:00
{
Bug fix: save the driver's persistent data in destroy_key
2019-07-25 09:31:48 +00:00
status = psa_save_se_persistent_data( driver );
Clean up status code handling inside psa_destroy_key Adopt a simple method for tracking whether there was a failure: each fallible operation sets overall_status, unless overall_status is already non-successful. Thus in case of multiple failures, the function always reports whatever failed first. This may not always be the right thing, but it's simple. This revealed a bug whereby if the only failure was the call to psa_destroy_se_key(), i.e. if the driver reported a failure or if the driver lacked support for destroying keys, psa_destroy_key() would ignore that failure. For a key in a secure element, if creating a transaction file fails, don't touch storage, but close the key in memory. This may not be right, but it's no wronger than it was before. Tracked in https://github.com/ARMmbed/mbed-crypto/issues/215
2019-08-13 13:58:36 +00:00
if( overall_status == PSA_SUCCESS )
overall_status = status;
status = psa_crypto_stop_transaction( );
if( overall_status == PSA_SUCCESS )
overall_status = status;
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 16:27:26 +00:00
}
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 17:30:34 +00:00
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 16:27:26 +00:00
Clean up status code handling inside psa_destroy_key Adopt a simple method for tracking whether there was a failure: each fallible operation sets overall_status, unless overall_status is already non-successful. Thus in case of multiple failures, the function always reports whatever failed first. This may not always be the right thing, but it's simple. This revealed a bug whereby if the only failure was the call to psa_destroy_se_key(), i.e. if the driver reported a failure or if the driver lacked support for destroying keys, psa_destroy_key() would ignore that failure. For a key in a secure element, if creating a transaction file fails, don't touch storage, but close the key in memory. This may not be right, but it's no wronger than it was before. Tracked in https://github.com/ARMmbed/mbed-crypto/issues/215
2019-08-13 13:58:36 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
exit:
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Factor the common idiom psa_wipe_key_slot into a function Many places in the code called psa_remove_key_data_from_memory (which preserves metadata for the sake of failues in psa_import_key) followed by clearing the slot data. Use an auxiliary function for this.
2018-12-03 10:58:46 +00:00
status = psa_wipe_key_slot( slot );
Clean up status code handling inside psa_destroy_key Adopt a simple method for tracking whether there was a failure: each fallible operation sets overall_status, unless overall_status is already non-successful. Thus in case of multiple failures, the function always reports whatever failed first. This may not always be the right thing, but it's simple. This revealed a bug whereby if the only failure was the call to psa_destroy_se_key(), i.e. if the driver reported a failure or if the driver lacked support for destroying keys, psa_destroy_key() would ignore that failure. For a key in a secure element, if creating a transaction file fails, don't touch storage, but close the key in memory. This may not be right, but it's no wronger than it was before. Tracked in https://github.com/ARMmbed/mbed-crypto/issues/215
2019-08-13 13:58:36 +00:00
/* Prioritize CORRUPTION_DETECTED from wiping over a storage error */
if( overall_status == PSA_SUCCESS )
overall_status = status;
return( overall_status );
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 14:48:15 +00:00
}
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
Add feature support for RSA for PSA crypto config In the original attempt to add RSA support to PSA crypto config was too generic. This set of changes adds support for the following RSA features: PSA_WANT_ALG_RSA_PKCS1V15_CRYPT, PSA_WANT_ALG_RSA_PKCS1V15_SIGN, PSA_WANT_ALG_RSA_OAEP, PSA_WANT_ALG_RSA_PSS, PSA_WANT_KEY_TYPE_RSA_KEY_PAIR, and PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY. There were also some updates to ensure the proper inclusion of PSA crypto library code when certain features are enabled. These updates were made to address warnings and errors in builds from the new tests for these features being added for PSA crypto configuration. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-01 05:06:54 +00:00
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Switch psa_{get,set}_domain_parameters to attributes Change psa_get_domain_parameters() and psa_set_domain_parameters() to access a psa_key_attributes_t structure rather than a key handle. In psa_get_key_attributes(), treat the RSA public exponent as a domain parameter and read it out. This is in preparation for removing the `extra` parameter of psa_generate_key() and setting the RSA public exponent for key generation via domain parameters. In this commit, the default public exponent 65537 is not treated specially, which allows us to verify that test code that should be calling psa_reset_key_attributes() after retrieving the attributes of an RSA key is doing so properly (if it wasn't, there would be a memory leak), even if the test data happens to use an RSA key with the default public exponent.
2019-04-26 14:06:02 +00:00
static psa_status_t psa_get_rsa_public_exponent(
const mbedtls_rsa_context *rsa,
psa_key_attributes_t *attributes )
{
mbedtls_mpi mpi;
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Switch psa_{get,set}_domain_parameters to attributes Change psa_get_domain_parameters() and psa_set_domain_parameters() to access a psa_key_attributes_t structure rather than a key handle. In psa_get_key_attributes(), treat the RSA public exponent as a domain parameter and read it out. This is in preparation for removing the `extra` parameter of psa_generate_key() and setting the RSA public exponent for key generation via domain parameters. In this commit, the default public exponent 65537 is not treated specially, which allows us to verify that test code that should be calling psa_reset_key_attributes() after retrieving the attributes of an RSA key is doing so properly (if it wasn't, there would be a memory leak), even if the test data happens to use an RSA key with the default public exponent.
2019-04-26 14:06:02 +00:00
uint8_t *buffer = NULL;
size_t buflen;
mbedtls_mpi_init( &mpi );
ret = mbedtls_rsa_export( rsa, NULL, NULL, NULL, NULL, &mpi );
if( ret != 0 )
goto exit;
psa_get_domain_parameters: for RSA, if e=65537, output an empty string
2019-04-26 15:37:21 +00:00
if( mbedtls_mpi_cmp_int( &mpi, 65537 ) == 0 )
{
/* It's the default value, which is reported as an empty string,
* so there's nothing to do. */
goto exit;
}
Switch psa_{get,set}_domain_parameters to attributes Change psa_get_domain_parameters() and psa_set_domain_parameters() to access a psa_key_attributes_t structure rather than a key handle. In psa_get_key_attributes(), treat the RSA public exponent as a domain parameter and read it out. This is in preparation for removing the `extra` parameter of psa_generate_key() and setting the RSA public exponent for key generation via domain parameters. In this commit, the default public exponent 65537 is not treated specially, which allows us to verify that test code that should be calling psa_reset_key_attributes() after retrieving the attributes of an RSA key is doing so properly (if it wasn't, there would be a memory leak), even if the test data happens to use an RSA key with the default public exponent.
2019-04-26 14:06:02 +00:00
buflen = mbedtls_mpi_size( &mpi );
buffer = mbedtls_calloc( 1, buflen );
if( buffer == NULL )
{
ret = MBEDTLS_ERR_MPI_ALLOC_FAILED;
goto exit;
}
ret = mbedtls_mpi_write_binary( &mpi, buffer, buflen );
if( ret != 0 )
goto exit;
attributes->domain_parameters = buffer;
attributes->domain_parameters_size = buflen;
exit:
mbedtls_mpi_free( &mpi );
if( ret != 0 )
mbedtls_free( buffer );
return( mbedtls_to_psa_error( ret ) );
New internal function psa_get_key_bits Isolate the code of psa_get_key_information that calculates the bit size of a key into its own function which can be called by functions that have a key slot pointer.
2018-07-06 14:02:09 +00:00
}
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 20:28:15 +00:00
* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
New internal function psa_get_key_bits Isolate the code of psa_get_key_information that calculates the bit size of a key into its own function which can be called by functions that have a key slot pointer.
2018-07-06 14:02:09 +00:00
Use a key attribute structure in the internal storage interface Pass information via a key attribute structure rather than as separate parameters to psa_crypto_storage functions. This makes it easier to maintain the code when the metadata of a key evolves. This has negligible impact on code size (+4B with "gcc -Os" on x86_64).
2019-07-23 09:58:03 +00:00
/** Retrieve all the publicly-accessible attributes of a key.
*/
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
psa_status_t psa_get_key_attributes( mbedtls_svc_key_id_t key,
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 19:44:46 +00:00
psa_key_attributes_t *attributes )
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
{
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 16:12:32 +00:00
psa_key_slot_t *slot;
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 19:44:46 +00:00
psa_reset_key_attributes( attributes );
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
status = psa_get_and_lock_key_slot_with_policy( key, &slot, 0, 0 );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 15:01:38 +00:00
if( status != PSA_SUCCESS )
return( status );
New internal function psa_get_key_bits Isolate the code of psa_get_key_information that calculates the bit size of a key into its own function which can be called by functions that have a key slot pointer.
2018-07-06 14:02:09 +00:00
Take advantage of psa_core_key_attributes_t internally #2 Key creation and psa_get_key_attributes
2019-07-31 12:15:34 +00:00
attributes->core = slot->attr;
Add slot_number attribute Add a slot_number field to psa_key_attributes_t and getter/setter functions. Since slot numbers can have the value 0, indicate the presence of the field via a separate flag. In psa_get_key_attributes(), report the slot number if the key is in a secure element. When creating a key, for now, applications cannot choose a slot number. A subsequent commit will add this capability in the secure element HAL.
2019-08-02 18:15:51 +00:00
attributes->core.flags &= ( MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY |
MBEDTLS_PSA_KA_MASK_DUAL_USE );
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
if( psa_key_slot_is_external( slot ) )
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:52:23 +00:00
psa_set_key_slot_number( attributes,
psa_key_slot_get_slot_number( slot ) );
Add slot_number attribute Add a slot_number field to psa_key_attributes_t and getter/setter functions. Since slot numbers can have the value 0, indicate the presence of the field via a separate flag. In psa_get_key_attributes(), report the slot number if the key is in a secure element. When creating a key, for now, applications cannot choose a slot number. A subsequent commit will add this capability in the secure element HAL.
2019-08-02 18:15:51 +00:00
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Switch psa_{get,set}_domain_parameters to attributes Change psa_get_domain_parameters() and psa_set_domain_parameters() to access a psa_key_attributes_t structure rather than a key handle. In psa_get_key_attributes(), treat the RSA public exponent as a domain parameter and read it out. This is in preparation for removing the `extra` parameter of psa_generate_key() and setting the RSA public exponent for key generation via domain parameters. In this commit, the default public exponent 65537 is not treated specially, which allows us to verify that test code that should be calling psa_reset_key_attributes() after retrieving the attributes of an RSA key is doing so properly (if it wasn't, there would be a memory leak), even if the test data happens to use an RSA key with the default public exponent.
2019-04-26 14:06:02 +00:00
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
switch( slot->attr.type )
Switch psa_{get,set}_domain_parameters to attributes Change psa_get_domain_parameters() and psa_set_domain_parameters() to access a psa_key_attributes_t structure rather than a key handle. In psa_get_key_attributes(), treat the RSA public exponent as a domain parameter and read it out. This is in preparation for removing the `extra` parameter of psa_generate_key() and setting the RSA public exponent for key generation via domain parameters. In this commit, the default public exponent 65537 is not treated specially, which allows us to verify that test code that should be calling psa_reset_key_attributes() after retrieving the attributes of an RSA key is doing so properly (if it wasn't, there would be a memory leak), even if the test data happens to use an RSA key with the default public exponent.
2019-04-26 14:06:02 +00:00
{
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
Add feature support for RSA for PSA crypto config In the original attempt to add RSA support to PSA crypto config was too generic. This set of changes adds support for the following RSA features: PSA_WANT_ALG_RSA_PKCS1V15_CRYPT, PSA_WANT_ALG_RSA_PKCS1V15_SIGN, PSA_WANT_ALG_RSA_OAEP, PSA_WANT_ALG_RSA_PSS, PSA_WANT_KEY_TYPE_RSA_KEY_PAIR, and PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY. There were also some updates to ensure the proper inclusion of PSA crypto library code when certain features are enabled. These updates were made to address warnings and errors in builds from the new tests for these features being added for PSA crypto configuration. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-01 05:06:54 +00:00
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Rename *KEYPAIR* to *KEY_PAIR* Be consistent with PUBLIC_KEY. perl -i -pe 's/KEYPAIR/KEY_PAIR/g' $(git ls-files)
2019-05-16 17:39:54 +00:00
case PSA_KEY_TYPE_RSA_KEY_PAIR:
Switch psa_{get,set}_domain_parameters to attributes Change psa_get_domain_parameters() and psa_set_domain_parameters() to access a psa_key_attributes_t structure rather than a key handle. In psa_get_key_attributes(), treat the RSA public exponent as a domain parameter and read it out. This is in preparation for removing the `extra` parameter of psa_generate_key() and setting the RSA public exponent for key generation via domain parameters. In this commit, the default public exponent 65537 is not treated specially, which allows us to verify that test code that should be calling psa_reset_key_attributes() after retrieving the attributes of an RSA key is doing so properly (if it wasn't, there would be a memory leak), even if the test data happens to use an RSA key with the default public exponent.
2019-04-26 14:06:02 +00:00
case PSA_KEY_TYPE_RSA_PUBLIC_KEY:
SE keys: implement and test psa_get_key_attributes
2019-07-24 17:09:30 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Make TODO comments consistent
2019-08-13 11:15:34 +00:00
/* TODO: reporting the public exponent for opaque keys
Add issue numbers for some missing parts of secure element support
2019-08-13 14:17:16 +00:00
* is not yet implemented.
* https://github.com/ARMmbed/mbed-crypto/issues/216
*/
Add slot_number attribute Add a slot_number field to psa_key_attributes_t and getter/setter functions. Since slot numbers can have the value 0, indicate the presence of the field via a separate flag. In psa_get_key_attributes(), report the slot number if the key is in a secure element. When creating a key, for now, applications cannot choose a slot number. A subsequent commit will add this capability in the secure element HAL.
2019-08-02 18:15:51 +00:00
if( psa_key_slot_is_external( slot ) )
SE keys: implement and test psa_get_key_attributes
2019-07-24 17:09:30 +00:00
break;
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 20:48:15 +00:00
{
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:39 +00:00
mbedtls_rsa_context *rsa = NULL;
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 20:48:15 +00:00
psa: Rename psa_load_rsa/ecp_representation Rename psa_load_rsa/ecp_representation to mbedtls_psa_rsa/ecp_load_representation before to move them in their RSA/ECP specific PSA crypto C modules. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 13:58:33 +00:00
status = mbedtls_psa_rsa_load_representation(
slot->attr.type,
slot->key.data,
slot->key.bytes,
&rsa );
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 20:48:15 +00:00
if( status != PSA_SUCCESS )
break;
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:39 +00:00
status = psa_get_rsa_public_exponent( rsa,
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 20:48:15 +00:00
attributes );
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:39 +00:00
mbedtls_rsa_free( rsa );
mbedtls_free( rsa );
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 20:48:15 +00:00
}
Switch psa_{get,set}_domain_parameters to attributes Change psa_get_domain_parameters() and psa_set_domain_parameters() to access a psa_key_attributes_t structure rather than a key handle. In psa_get_key_attributes(), treat the RSA public exponent as a domain parameter and read it out. This is in preparation for removing the `extra` parameter of psa_generate_key() and setting the RSA public exponent for key generation via domain parameters. In this commit, the default public exponent 65537 is not treated specially, which allows us to verify that test code that should be calling psa_reset_key_attributes() after retrieving the attributes of an RSA key is doing so properly (if it wasn't, there would be a memory leak), even if the test data happens to use an RSA key with the default public exponent.
2019-04-26 14:06:02 +00:00
break;
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 20:28:15 +00:00
* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Switch psa_{get,set}_domain_parameters to attributes Change psa_get_domain_parameters() and psa_set_domain_parameters() to access a psa_key_attributes_t structure rather than a key handle. In psa_get_key_attributes(), treat the RSA public exponent as a domain parameter and read it out. This is in preparation for removing the `extra` parameter of psa_generate_key() and setting the RSA public exponent for key generation via domain parameters. In this commit, the default public exponent 65537 is not treated specially, which allows us to verify that test code that should be calling psa_reset_key_attributes() after retrieving the attributes of an RSA key is doing so properly (if it wasn't, there would be a memory leak), even if the test data happens to use an RSA key with the default public exponent.
2019-04-26 14:06:02 +00:00
default:
/* Nothing else to do. */
break;
}
if( status != PSA_SUCCESS )
psa_reset_key_attributes( attributes );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
unlock_status = psa_unlock_key_slot( slot );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
}
Add slot_number attribute Add a slot_number field to psa_key_attributes_t and getter/setter functions. Since slot numbers can have the value 0, indicate the presence of the field via a separate flag. In psa_get_key_attributes(), report the slot number if the key is in a secure element. When creating a key, for now, applications cannot choose a slot number. A subsequent commit will add this capability in the secure element HAL.
2019-08-02 18:15:51 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
psa_status_t psa_get_key_slot_number(
const psa_key_attributes_t *attributes,
psa_key_slot_number_t *slot_number )
{
if( attributes->core.flags & MBEDTLS_PSA_KA_FLAG_HAS_SLOT_NUMBER )
{
*slot_number = attributes->slot_number;
return( PSA_SUCCESS );
}
else
return( PSA_ERROR_INVALID_ARGUMENT );
}
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
psa: Change psa_export_(public_)key_internal signature Change psa_export_(public_)key_internal signature to the signature of an export_(public_)key driver entry point. This is a preparatory commit to be able to call the software implementations as a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 15:46:05 +00:00
static psa_status_t psa_export_key_buffer_internal( const uint8_t *key_buffer,
size_t key_buffer_size,
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 20:48:15 +00:00
uint8_t *data,
size_t data_size,
size_t *data_length )
{
psa: Change psa_export_(public_)key_internal signature Change psa_export_(public_)key_internal signature to the signature of an export_(public_)key driver entry point. This is a preparatory commit to be able to call the software implementations as a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 15:46:05 +00:00
if( key_buffer_size > data_size )
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 20:48:15 +00:00
return( PSA_ERROR_BUFFER_TOO_SMALL );
psa: Change psa_export_(public_)key_internal signature Change psa_export_(public_)key_internal signature to the signature of an export_(public_)key driver entry point. This is a preparatory commit to be able to call the software implementations as a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 15:46:05 +00:00
memcpy( data, key_buffer, key_buffer_size );
memset( data + key_buffer_size, 0,
data_size - key_buffer_size );
*data_length = key_buffer_size;
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 20:48:15 +00:00
return( PSA_SUCCESS );
}
psa: Export internally psa_export_(public_)key_internal Export psa_export_(public_)key_internal from psa_crypto.c to make it available to the driver wrapper. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-26 13:46:37 +00:00
psa_status_t psa_export_key_internal(
psa: Change psa_export_(public_)key_internal signature Change psa_export_(public_)key_internal signature to the signature of an export_(public_)key driver entry point. This is a preparatory commit to be able to call the software implementations as a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 15:46:05 +00:00
const psa_key_attributes_t *attributes,
const uint8_t *key_buffer, size_t key_buffer_size,
uint8_t *data, size_t data_size, size_t *data_length )
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
{
psa: Change psa_export_(public_)key_internal signature Change psa_export_(public_)key_internal signature to the signature of an export_(public_)key driver entry point. This is a preparatory commit to be able to call the software implementations as a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 15:46:05 +00:00
psa_key_type_t type = attributes->core.type;
if( key_type_is_raw_bytes( type ) ||
PSA_KEY_TYPE_IS_RSA( type ) ||
PSA_KEY_TYPE_IS_ECC( type ) )
psa: Disentangle public export and export code Disentangle public export and export code to be able to move the call to export and public export operations to the driver wrapper. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-26 12:36:23 +00:00
{
return( psa_export_key_buffer_internal(
psa: Change psa_export_(public_)key_internal signature Change psa_export_(public_)key_internal signature to the signature of an export_(public_)key driver entry point. This is a preparatory commit to be able to call the software implementations as a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 15:46:05 +00:00
key_buffer, key_buffer_size,
data, data_size, data_length ) );
psa: Disentangle public export and export code Disentangle public export and export code to be able to move the call to export and public export operations to the driver wrapper. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-26 12:36:23 +00:00
}
else
{
/* This shouldn't happen in the reference implementation, but
it is valid for a special-purpose implementation to omit
support for exporting certain key types. */
return( PSA_ERROR_NOT_SUPPORTED );
}
}
psa_status_t psa_export_key( mbedtls_svc_key_id_t key,
uint8_t *data,
size_t data_size,
size_t *data_length )
{
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
psa_key_slot_t *slot;
psa: export: Check output buffer size earlier Check output buffer size before doing anything that requires a clean-up if a failure happens. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-01-18 12:22:38 +00:00
/* Reject a zero-length output buffer now, since this can never be a
* valid key representation. This way we know that data must be a valid
* pointer and we can do things like memset(data, ..., data_size). */
if( data_size == 0 )
return( PSA_ERROR_BUFFER_TOO_SMALL );
psa: Disentangle public export and export code Disentangle public export and export code to be able to move the call to export and public export operations to the driver wrapper. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-26 12:36:23 +00:00
/* Set the key to empty now, so that even when there are errors, we always
* set data_length to a value between 0 and data_size. On error, setting
* the key to empty is a good choice because an empty key representation is
* unlikely to be accepted anywhere. */
psa_export_key: Always set a valid data length Make psa_export_key() always set a valid data_length when exporting, even when there are errors. This makes the API easier to use for buggy programs (like our test code). Our test code previously used exported_length uninitialized when checking to see that the buffer returned was all zero in import_export() in the case where an error was returned from psa_export_key(). Initialize exported_length to an invalid length, and check that it gets set properly by psa_export_key(), to avoid this using export_length uninitialized. Note that the mem_is_zero() check is still valid when psa_export_key() returns an error, e.g. where exported_length is 0, as we want to check that nothing was written to the buffer on error. Out test code also previous passed NULL for the data_length parameter of psa_export_key() when it expected a failure (in key_policy_fail()). However, data_length is not allowed to be NULL, especially now that we write to data_length from psa_export_key() even when there are errors. Update the test code to not pass in a NULL data_length.
2018-06-27 16:20:43 +00:00
*data_length = 0;
psa: Disentangle public export and export code Disentangle public export and export code to be able to move the call to export and public export operations to the driver wrapper. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-26 12:36:23 +00:00
/* Export requires the EXPORT flag. There is an exception for public keys,
* which don't require any flag, but
* psa_get_and_lock_key_slot_with_policy() takes care of this.
*/
status = psa_get_and_lock_key_slot_with_policy( key, &slot,
PSA_KEY_USAGE_EXPORT, 0 );
if( status != PSA_SUCCESS )
return( status );
integrate policy key usage in export and asymmetric sign functions
2018-03-28 10:17:44 +00:00
psa: Change psa_export_(public_)key_internal signature Change psa_export_(public_)key_internal signature to the signature of an export_(public_)key driver entry point. This is a preparatory commit to be able to call the software implementations as a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 15:46:05 +00:00
psa_key_attributes_t attributes = {
.core = slot->attr
};
psa: Call export software implementation as a driver Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-26 14:16:05 +00:00
status = psa_driver_wrapper_export_key( &attributes,
psa: Change psa_export_(public_)key_internal signature Change psa_export_(public_)key_internal signature to the signature of an export_(public_)key driver entry point. This is a preparatory commit to be able to call the software implementations as a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 15:46:05 +00:00
slot->key.data, slot->key.bytes,
data, data_size, data_length );
psa: Disentangle public export and export code Disentangle public export and export code to be able to move the call to export and public export operations to the driver wrapper. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-26 12:36:23 +00:00
unlock_status = psa_unlock_key_slot( slot );
return( ( status == PSA_SUCCESS ) ? unlock_status : status );
}
psa: Export internally psa_export_(public_)key_internal Export psa_export_(public_)key_internal from psa_crypto.c to make it available to the driver wrapper. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-26 13:46:37 +00:00
psa_status_t psa_export_public_key_internal(
psa: Change psa_export_(public_)key_internal signature Change psa_export_(public_)key_internal signature to the signature of an export_(public_)key driver entry point. This is a preparatory commit to be able to call the software implementations as a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 15:46:05 +00:00
const psa_key_attributes_t *attributes,
const uint8_t *key_buffer,
size_t key_buffer_size,
uint8_t *data,
size_t data_size,
size_t *data_length )
psa: Disentangle public export and export code Disentangle public export and export code to be able to move the call to export and public export operations to the driver wrapper. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-26 12:36:23 +00:00
{
psa: Change psa_export_(public_)key_internal signature Change psa_export_(public_)key_internal signature to the signature of an export_(public_)key driver entry point. This is a preparatory commit to be able to call the software implementations as a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 15:46:05 +00:00
psa_key_type_t type = attributes->core.type;
if( PSA_KEY_TYPE_IS_RSA( type ) || PSA_KEY_TYPE_IS_ECC( type ) )
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
{
psa: Change psa_export_(public_)key_internal signature Change psa_export_(public_)key_internal signature to the signature of an export_(public_)key driver entry point. This is a preparatory commit to be able to call the software implementations as a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 15:46:05 +00:00
if( PSA_KEY_TYPE_IS_PUBLIC_KEY( type ) )
Unify key handling logic Now that both ECP and RSA keys are represented in export representation, they can be treated more uniformly. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 21:20:24 +00:00
{
/* Exporting public -> public */
psa: Disentangle public export and export code Disentangle public export and export code to be able to move the call to export and public export operations to the driver wrapper. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-26 12:36:23 +00:00
return( psa_export_key_buffer_internal(
psa: Change psa_export_(public_)key_internal signature Change psa_export_(public_)key_internal signature to the signature of an export_(public_)key driver entry point. This is a preparatory commit to be able to call the software implementations as a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 15:46:05 +00:00
key_buffer, key_buffer_size,
data, data_size, data_length ) );
Unify key handling logic Now that both ECP and RSA keys are represented in export representation, they can be treated more uniformly. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 21:20:24 +00:00
}
Plug in the entry point for public key export through driver Including test. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-14 12:39:20 +00:00
psa: Change psa_export_(public_)key_internal signature Change psa_export_(public_)key_internal signature to the signature of an export_(public_)key driver entry point. This is a preparatory commit to be able to call the software implementations as a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 15:46:05 +00:00
if( PSA_KEY_TYPE_IS_RSA( type ) )
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 17:16:59 +00:00
{
Add feature support for RSA for PSA crypto config In the original attempt to add RSA support to PSA crypto config was too generic. This set of changes adds support for the following RSA features: PSA_WANT_ALG_RSA_PKCS1V15_CRYPT, PSA_WANT_ALG_RSA_PKCS1V15_SIGN, PSA_WANT_ALG_RSA_OAEP, PSA_WANT_ALG_RSA_PSS, PSA_WANT_KEY_TYPE_RSA_KEY_PAIR, and PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY. There were also some updates to ensure the proper inclusion of PSA crypto library code when certain features are enabled. These updates were made to address warnings and errors in builds from the new tests for these features being added for PSA crypto configuration. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-01 05:06:54 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
psa: Move RSA/ECP export code to RSA/ECP specific C file Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-26 15:36:16 +00:00
return( mbedtls_psa_rsa_export_public_key( attributes,
key_buffer,
key_buffer_size,
data,
data_size,
data_length ) );
Add ifdefs for psa_internal_export_key function MBEDTLS_PK_WRITE_C only requires either MBEDTLS_RSA_C or MBEDTLS_ECP_C to be defined. Added wrappers to handle the cases where only one has been defined. Moved mbedtls_pk_init to be within the ifdefs, so it's only called if appropriate.
2018-07-24 15:33:30 +00:00
#else
Unify key handling logic Now that both ECP and RSA keys are represented in export representation, they can be treated more uniformly. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 21:20:24 +00:00
/* We don't know how to convert a private RSA key to public. */
return( PSA_ERROR_NOT_SUPPORTED );
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 20:28:15 +00:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Unify key handling logic Now that both ECP and RSA keys are represented in export representation, they can be treated more uniformly. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 21:20:24 +00:00
}
else
{
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 16:50:04 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)
psa: Move RSA/ECP export code to RSA/ECP specific C file Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-26 15:36:16 +00:00
return( mbedtls_psa_ecp_export_public_key( attributes,
key_buffer,
key_buffer_size,
data,
data_size,
data_length ) );
Add ifdefs for psa_internal_export_key function MBEDTLS_PK_WRITE_C only requires either MBEDTLS_RSA_C or MBEDTLS_ECP_C to be defined. Added wrappers to handle the cases where only one has been defined. Moved mbedtls_pk_init to be within the ifdefs, so it's only called if appropriate.
2018-07-24 15:33:30 +00:00
#else
Unify key handling logic Now that both ECP and RSA keys are represented in export representation, they can be treated more uniformly. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 21:20:24 +00:00
/* We don't know how to convert a private ECC key to public */
psa_internal_export_key function for common code. create psa_internal_export_key function for common code in psa_export_key and psa_export_public_key.
2018-04-16 15:16:20 +00:00
return( PSA_ERROR_NOT_SUPPORTED );
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 20:28:15 +00:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 17:16:59 +00:00
}
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
}
Unify key handling logic Now that both ECP and RSA keys are represented in export representation, they can be treated more uniformly. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 21:20:24 +00:00
else
{
/* This shouldn't happen in the reference implementation, but
it is valid for a special-purpose implementation to omit
support for exporting certain key types. */
return( PSA_ERROR_NOT_SUPPORTED );
}
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
}
psa: Change psa_export_(public_)key_internal signature Change psa_export_(public_)key_internal signature to the signature of an export_(public_)key driver entry point. This is a preparatory commit to be able to call the software implementations as a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 15:46:05 +00:00
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
psa_status_t psa_export_public_key( mbedtls_svc_key_id_t key,
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 13:41:12 +00:00
uint8_t *data,
size_t data_size,
size_t *data_length )
export public key
2018-04-03 12:30:03 +00:00
{
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 16:12:32 +00:00
psa_key_slot_t *slot;
psa: Refactor psa_internal_export_key to use slot, rather than key When generating keys that have persistent lifetime, we will need the keys to be in the exported format to save to persistent storage. This refactoring to separate checking the slots usage from the exporting of the key data will be necessary for using psa_internal_export_key in psa_generate_key.
2018-11-07 16:00:44 +00:00
psa: export: Check output buffer size earlier Check output buffer size before doing anything that requires a clean-up if a failure happens. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-01-18 12:22:38 +00:00
/* Reject a zero-length output buffer now, since this can never be a
* valid key representation. This way we know that data must be a valid
* pointer and we can do things like memset(data, ..., data_size). */
if( data_size == 0 )
return( PSA_ERROR_BUFFER_TOO_SMALL );
psa: Refactor psa_internal_export_key to use slot, rather than key When generating keys that have persistent lifetime, we will need the keys to be in the exported format to save to persistent storage. This refactoring to separate checking the slots usage from the exporting of the key data will be necessary for using psa_internal_export_key in psa_generate_key.
2018-11-07 16:00:44 +00:00
/* Set the key to empty now, so that even when there are errors, we always
* set data_length to a value between 0 and data_size. On error, setting
* the key to empty is a good choice because an empty key representation is
* unlikely to be accepted anywhere. */
*data_length = 0;
/* Exporting a public key doesn't require a usage flag. */
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
status = psa_get_and_lock_key_slot_with_policy( key, &slot, 0, 0 );
psa: Refactor psa_internal_export_key to use slot, rather than key When generating keys that have persistent lifetime, we will need the keys to be in the exported format to save to persistent storage. This refactoring to separate checking the slots usage from the exporting of the key data will be necessary for using psa_internal_export_key in psa_generate_key.
2018-11-07 16:00:44 +00:00
if( status != PSA_SUCCESS )
return( status );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa: Disentangle public export and export code Disentangle public export and export code to be able to move the call to export and public export operations to the driver wrapper. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-26 12:36:23 +00:00
if( ! PSA_KEY_TYPE_IS_ASYMMETRIC( slot->attr.type ) )
{
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
}
psa: Change psa_export_(public_)key_internal signature Change psa_export_(public_)key_internal signature to the signature of an export_(public_)key driver entry point. This is a preparatory commit to be able to call the software implementations as a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 15:46:05 +00:00
psa_key_attributes_t attributes = {
.core = slot->attr
};
psa: Call export software implementation as a driver Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-26 14:16:05 +00:00
status = psa_driver_wrapper_export_public_key(
psa: Change psa_export_(public_)key_internal signature Change psa_export_(public_)key_internal signature to the signature of an export_(public_)key driver entry point. This is a preparatory commit to be able to call the software implementations as a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 15:46:05 +00:00
&attributes, slot->key.data, slot->key.bytes,
data, data_size, data_length );
psa: Disentangle public export and export code Disentangle public export and export code to be able to move the call to export and public export operations to the driver wrapper. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-26 12:36:23 +00:00
exit:
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
unlock_status = psa_unlock_key_slot( slot );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
return( ( status == PSA_SUCCESS ) ? unlock_status : status );
export public key
2018-04-03 12:30:03 +00:00
}
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
Add infrastructure for key attribute flags Add infrastructure for internal, external and dual-use flags, with a compile-time check (if static_assert is available) to ensure that the same numerical value doesn't get declared for two different purposes in crypto_struct.h (external or dual-use) and psa_crypto_core.h (internal).
2019-08-02 17:19:39 +00:00
#if defined(static_assert)
static_assert( ( MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE ) == 0,
"One or more key attribute flag is listed as both external-only and dual-use" );
Rename internal macro to pass check-names.sh check-names.sh rejects MBEDTLS_XXX identifiers that are not defined in a public header.
2019-08-05 15:32:13 +00:00
static_assert( ( PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE ) == 0,
Fix copypasta
2019-08-07 16:19:46 +00:00
"One or more key attribute flag is listed as both internal-only and dual-use" );
Rename internal macro to pass check-names.sh check-names.sh rejects MBEDTLS_XXX identifiers that are not defined in a public header.
2019-08-05 15:32:13 +00:00
static_assert( ( PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY ) == 0,
Add infrastructure for key attribute flags Add infrastructure for internal, external and dual-use flags, with a compile-time check (if static_assert is available) to ensure that the same numerical value doesn't get declared for two different purposes in crypto_struct.h (external or dual-use) and psa_crypto_core.h (internal).
2019-08-02 17:19:39 +00:00
"One or more key attribute flag is listed as both internal-only and external-only" );
#endif
More refactoring: consolidate attribute validation Consolidate attribute validation at the beginning of key creation into a single function. Improve comments.
2019-07-31 15:21:46 +00:00
/** Validate that a key policy is internally well-formed.
*
* This function only rejects invalid policies. It does not validate the
* consistency of the policy with respect to other attributes of the key
* such as the key type.
*/
static psa_status_t psa_validate_key_policy( const psa_key_policy_t *policy )
psa: Extend psa_generate_key to support persistent lifetimes
2018-11-07 16:05:30 +00:00
{
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
if( ( policy->usage & ~( PSA_KEY_USAGE_EXPORT |
New usage flag PSA_KEY_USAGE_COPY Document the new flag and allow its use.
2019-05-14 12:24:28 +00:00
PSA_KEY_USAGE_COPY |
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
PSA_KEY_USAGE_ENCRYPT |
PSA_KEY_USAGE_DECRYPT |
Rename some signature-related identifiers Rename some macros and functions related to signature which are changing as part of the addition of psa_sign_message and psa_verify_message. perl -i -pe '%t = ( PSA_KEY_USAGE_SIGN => PSA_KEY_USAGE_SIGN_HASH, PSA_KEY_USAGE_VERIFY => PSA_KEY_USAGE_VERIFY_HASH, PSA_ASYMMETRIC_SIGNATURE_MAX_SIZE => PSA_SIGNATURE_MAX_SIZE, PSA_ASYMMETRIC_SIGN_OUTPUT_SIZE => PSA_SIGN_OUTPUT_SIZE, psa_asymmetric_sign => psa_sign_hash, psa_asymmetric_verify => psa_verify_hash, ); s/\b(@{[join("|", keys %t)]})\b/$t{$1}/ge' $(git ls-files . ':!:**/crypto_compat.h')
2019-11-26 16:01:59 +00:00
PSA_KEY_USAGE_SIGN_HASH |
PSA_KEY_USAGE_VERIFY_HASH |
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
PSA_KEY_USAGE_DERIVE ) ) != 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
return( PSA_SUCCESS );
psa: Extend psa_generate_key to support persistent lifetimes
2018-11-07 16:05:30 +00:00
}
More refactoring: consolidate attribute validation Consolidate attribute validation at the beginning of key creation into a single function. Improve comments.
2019-07-31 15:21:46 +00:00
/** Validate the internal consistency of key attributes.
*
* This function only rejects invalid attribute values. If does not
* validate the consistency of the attributes with any key data that may
* be involved in the creation of the key.
*
* Call this function early in the key creation process.
*
* \param[in] attributes Key attributes for the new key.
* \param[out] p_drv On any return, the driver for the key, if any.
* NULL for a transparent key.
*
*/
static psa_status_t psa_validate_key_attributes(
const psa_key_attributes_t *attributes,
psa_se_drv_table_entry_t **p_drv )
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
{
Split 'validate persistent key parameters' into independent validation Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-06-08 16:37:19 +00:00
psa_status_t status = PSA_ERROR_INVALID_ARGUMENT;
Split persistence and key id validation With key usage based on key identifiers and not key handles (openless APIs), volatile keys will also have a key identifier. Thus, isolate key identifier validation from key persistence validation to clarify that key identifiers are not specific to persistent keys. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-07-17 14:11:30 +00:00
psa_key_lifetime_t lifetime = psa_get_key_lifetime( attributes );
Add key id check when creating a volatile key Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-23 15:11:13 +00:00
mbedtls_svc_key_id_t key = psa_get_key_id( attributes );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
psa: Forbid creation/registration of keys in vendor range The identifier of keys created/registred should be in the application range. This is by spec for key creation. This may change for registered key. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-29 14:26:43 +00:00
status = psa_validate_key_location( lifetime, p_drv );
Split 'validate persistent key parameters' into independent validation Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-06-08 16:37:19 +00:00
if( status != PSA_SUCCESS )
return( status );
Split persistence and key id validation With key usage based on key identifiers and not key handles (openless APIs), volatile keys will also have a key identifier. Thus, isolate key identifier validation from key persistence validation to clarify that key identifiers are not specific to persistent keys. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-07-17 14:11:30 +00:00
status = psa_validate_key_persistence( lifetime );
Split 'validate persistent key parameters' into independent validation Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-06-08 16:37:19 +00:00
if( status != PSA_SUCCESS )
return( status );
More refactoring: consolidate attribute validation Consolidate attribute validation at the beginning of key creation into a single function. Improve comments.
2019-07-31 15:21:46 +00:00
Add key id check when creating a volatile key Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-23 15:11:13 +00:00
if ( PSA_KEY_LIFETIME_IS_VOLATILE( lifetime ) )
{
if( MBEDTLS_SVC_KEY_ID_GET_KEY_ID( key ) != 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
}
else
Split persistence and key id validation With key usage based on key identifiers and not key handles (openless APIs), volatile keys will also have a key identifier. Thus, isolate key identifier validation from key persistence validation to clarify that key identifiers are not specific to persistent keys. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-07-17 14:11:30 +00:00
{
psa: slot mgmt: Simplify psa_validate_key_id Special handling of volatile key identifiers is not needed eventually, they can be handled just as key identifier in the vendor range. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-11 13:57:44 +00:00
status = psa_validate_key_id( psa_get_key_id( attributes ), 0 );
Split persistence and key id validation With key usage based on key identifiers and not key handles (openless APIs), volatile keys will also have a key identifier. Thus, isolate key identifier validation from key persistence validation to clarify that key identifiers are not specific to persistent keys. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-07-17 14:11:30 +00:00
if( status != PSA_SUCCESS )
return( status );
}
More refactoring: consolidate attribute validation Consolidate attribute validation at the beginning of key creation into a single function. Improve comments.
2019-07-31 15:21:46 +00:00
status = psa_validate_key_policy( &attributes->core.policy );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
if( status != PSA_SUCCESS )
More refactoring: consolidate attribute validation Consolidate attribute validation at the beginning of key creation into a single function. Improve comments.
2019-07-31 15:21:46 +00:00
return( status );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
More refactoring: consolidate attribute validation Consolidate attribute validation at the beginning of key creation into a single function. Improve comments.
2019-07-31 15:21:46 +00:00
/* Refuse to create overly large keys.
* Note that this doesn't trigger on import if the attributes don't
* explicitly specify a size (so psa_get_key_bits returns 0), so
* psa_import_key() needs its own checks. */
if( psa_get_key_bits( attributes ) > PSA_MAX_KEY_BITS )
return( PSA_ERROR_NOT_SUPPORTED );
Add infrastructure for key attribute flags Add infrastructure for internal, external and dual-use flags, with a compile-time check (if static_assert is available) to ensure that the same numerical value doesn't get declared for two different purposes in crypto_struct.h (external or dual-use) and psa_crypto_core.h (internal).
2019-08-02 17:19:39 +00:00
/* Reject invalid flags. These should not be reachable through the API. */
if( attributes->core.flags & ~ ( MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY |
MBEDTLS_PSA_KA_MASK_DUAL_USE ) )
return( PSA_ERROR_INVALID_ARGUMENT );
More refactoring: consolidate attribute validation Consolidate attribute validation at the beginning of key creation into a single function. Improve comments.
2019-07-31 15:21:46 +00:00
return( PSA_SUCCESS );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
}
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
/** Prepare a key slot to receive key material.
*
* This function allocates a key slot and sets its metadata.
*
* If this function fails, call psa_fail_key_creation().
*
Document the key creation flow (start, variable, finish, and fail)
2019-04-28 09:37:03 +00:00
* This function is intended to be used as follows:
* -# Call psa_start_key_creation() to allocate a key slot, prepare
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
* it with the specified attributes, and in case of a volatile key assign it
* a volatile key identifier.
Document the key creation flow (start, variable, finish, and fail)
2019-04-28 09:37:03 +00:00
* -# Populate the slot with the key material.
* -# Call psa_finish_key_creation() to finalize the creation of the slot.
* In case of failure at any step, stop the sequence and call
* psa_fail_key_creation().
*
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
* On success, the key slot is locked. It is the responsibility of the caller
* to unlock the key slot when it does not access it anymore.
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
*
psa_start_key_creation: take the method as a parameter Let psa_start_key_creation know what type of key creation this is. This will be used at least for key registration in a secure element, which is a peculiar kind of creation since it uses existing key material.
2019-07-15 20:02:14 +00:00
* \param method An identification of the calling function.
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
* \param[in] attributes Key attributes for the new key.
* \param[out] p_slot On success, a pointer to the prepared slot.
* \param[out] p_drv On any return, the driver for the key, if any.
* NULL for a transparent key.
Document the key creation flow (start, variable, finish, and fail)
2019-04-28 09:37:03 +00:00
*
* \retval #PSA_SUCCESS
* The key slot is ready to receive key material.
* \return If this function fails, the key slot is an invalid state.
* You must call psa_fail_key_creation() to wipe and free the slot.
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
*/
static psa_status_t psa_start_key_creation(
psa_start_key_creation: take the method as a parameter Let psa_start_key_creation know what type of key creation this is. This will be used at least for key registration in a secure element, which is a peculiar kind of creation since it uses existing key material.
2019-07-15 20:02:14 +00:00
psa_key_creation_method_t method,
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
const psa_key_attributes_t *attributes,
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
psa_key_slot_t **p_slot,
Driver table entries are now mutable Since driver table entries contain the driver context, which is mutable, they can't be const anymore.
2019-07-12 21:40:35 +00:00
psa_se_drv_table_entry_t **p_drv )
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
{
psa_status_t status;
Add volatile key identifiers Volatile key identifiers are introduced in PSA Crypto API v1.0.0. They are returned by the APIs when importing or generating or deriving a volatile key. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-07-17 12:13:26 +00:00
psa_key_id_t volatile_key_id;
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
psa_key_slot_t *slot;
psa_start_key_creation: take the method as a parameter Let psa_start_key_creation know what type of key creation this is. This will be used at least for key registration in a secure element, which is a peculiar kind of creation since it uses existing key material.
2019-07-15 20:02:14 +00:00
(void) method;
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
*p_drv = NULL;
More refactoring: consolidate attribute validation Consolidate attribute validation at the beginning of key creation into a single function. Improve comments.
2019-07-31 15:21:46 +00:00
status = psa_validate_key_attributes( attributes, p_drv );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
if( status != PSA_SUCCESS )
return( status );
Define handles as key identifiers Define psa_key_handle_t to be equal to mbedtls_svc_key_id_t. Make the handle of a persistent key be equal to its key identifier. For volatile keys, make the key handle equal to the volatile key identifier of the created volatile key. The unit tests are modified just to make them compile not to make them run successfully. They are fixed in the subsequent commits. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-07-31 09:26:37 +00:00
status = psa_get_empty_key_slot( &volatile_key_id, p_slot );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
if( status != PSA_SUCCESS )
return( status );
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
slot = *p_slot;
Take advantage of psa_core_key_attributes_t internally #2 Key creation and psa_get_key_attributes
2019-07-31 12:15:34 +00:00
/* We're storing the declared bit-size of the key. It's up to each
* creation mechanism to verify that this information is correct.
* It's automatically correct for mechanisms that use the bit-size as
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 19:32:04 +00:00
* an input (generate, device) but not for those where the bit-size
Define handles as key identifiers Define psa_key_handle_t to be equal to mbedtls_svc_key_id_t. Make the handle of a persistent key be equal to its key identifier. For volatile keys, make the key handle equal to the volatile key identifier of the created volatile key. The unit tests are modified just to make them compile not to make them run successfully. They are fixed in the subsequent commits. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-07-31 09:26:37 +00:00
* is optional (import, copy). In case of a volatile key, assign it the
* volatile key identifier associated to the slot returned to contain its
* definition. */
Take advantage of psa_core_key_attributes_t internally #2 Key creation and psa_get_key_attributes
2019-07-31 12:15:34 +00:00
slot->attr = attributes->core;
Define handles as key identifiers Define psa_key_handle_t to be equal to mbedtls_svc_key_id_t. Make the handle of a persistent key be equal to its key identifier. For volatile keys, make the key handle equal to the volatile key identifier of the created volatile key. The unit tests are modified just to make them compile not to make them run successfully. They are fixed in the subsequent commits. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-07-31 09:26:37 +00:00
if( PSA_KEY_LIFETIME_IS_VOLATILE( slot->attr.lifetime ) )
{
#if !defined(MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER)
slot->attr.id = volatile_key_id;
#else
slot->attr.id.key_id = volatile_key_id;
#endif
}
Limit keys to 65528 bits 65528 bits is more than any reasonable key until we start supporting post-quantum cryptography. This limit is chosen to allow bit-sizes to be stored in 16 bits, with 65535 left to indicate an invalid value. It's a whole number of bytes, which facilitates some calculations, in particular allowing a key of exactly PSA_CRYPTO_MAX_STORAGE_SIZE to be created but not one bit more. As a resource usage limit, this is arguably too large, but that's out of scope of the current commit. Test that key import, generation and derivation reject overly large sizes.
2019-07-30 15:26:54 +00:00
Add infrastructure for key attribute flags Add infrastructure for internal, external and dual-use flags, with a compile-time check (if static_assert is available) to ensure that the same numerical value doesn't get declared for two different purposes in crypto_struct.h (external or dual-use) and psa_crypto_core.h (internal).
2019-08-02 17:19:39 +00:00
/* Erase external-only flags from the internal copy. To access
Fix erasure of external flags This didn't break anything now, but would have broken things once we start to add internal flags.
2019-08-07 13:42:14 +00:00
* external-only flags, query `attributes`. Thanks to the check
* in psa_validate_key_attributes(), this leaves the dual-use
Rename psa_internal_allocate_key_slot to psa_get_empty_key_slot This function no longer modifies anything, so it doesn't actually allocate the slot. Now, it just returns the empty key slot, and it's up to the caller to cause the slot to be in use (or not).
2019-08-07 16:19:59 +00:00
* flags and any internal flag that psa_get_empty_key_slot()
Fix erasure of external flags This didn't break anything now, but would have broken things once we start to add internal flags.
2019-08-07 13:42:14 +00:00
* may have set. */
slot->attr.flags &= ~MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY;
Add infrastructure for key attribute flags Add infrastructure for internal, external and dual-use flags, with a compile-time check (if static_assert is available) to ensure that the same numerical value doesn't get declared for two different purposes in crypto_struct.h (external or dual-use) and psa_crypto_core.h (internal).
2019-08-02 17:19:39 +00:00
SE keys: allocate a slot before creating the key
2019-07-12 21:46:04 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
New function mbedtls_psa_register_se_key Register an existing key in a secure element. Minimal implementation that doesn't call any driver method and just lets the application declare whatever it wants.
2019-08-05 13:55:54 +00:00
/* For a key in a secure element, we need to do three things
Do not persist transactions on volatile external keys Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-06-08 16:29:44 +00:00
* when creating or registering a persistent key:
Improve comments
2019-07-25 09:32:45 +00:00
* create the key file in internal storage, create the
* key inside the secure element, and update the driver's
Do not persist transactions on volatile external keys Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-06-08 16:29:44 +00:00
* persistent data. This is done by starting a transaction that will
* encompass these three actions.
* For registering a volatile key, we just need to find an appropriate
* slot number inside the SE. Since the key is designated volatile, creating
* a transaction is not required. */
Improve comments
2019-07-25 09:32:45 +00:00
/* The first thing to do is to find a slot number for the new key.
* We save the slot number in persistent storage as part of the
* transaction data. It will be needed to recover if the power
* fails during the key creation process, to clean up on the secure
* element side after restarting. Obtaining a slot number from the
* secure element driver updates its persistent state, but we do not yet
* save the driver's persistent state, so that if the power fails,
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 17:30:34 +00:00
* we can roll back to a state where the key doesn't exist. */
SE support: Use a transaction when registering a key When registering a key in a secure element, go through the transaction mechanism. This makes the code simpler, at the expense of a few extra storage operations. Given that registering a key is typically very rare over the lifetime of a device, this is an acceptable loss. Drivers must now have a p_validate_slot_number method, otherwise registering a key is not possible. This reduces the risk that due to a mistake during the integration of a device, an application might claim a slot in a way that is not supported by the driver.
2019-10-01 12:18:35 +00:00
if( *p_drv != NULL )
SE keys: allocate a slot before creating the key
2019-07-12 21:46:04 +00:00
{
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:52:23 +00:00
psa_key_slot_number_t slot_number;
Pass the key creation method to drivers Pass the key creation method (import/generate/derive/copy) to the driver methods to allocate or validate a slot number. This allows drivers to enforce policies such as "this key slot can only be used for keys generated inside the secure element".
2019-08-05 14:44:14 +00:00
status = psa_find_se_slot_for_key( attributes, method, *p_drv,
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:52:23 +00:00
&slot_number );
SE keys: allocate a slot before creating the key
2019-07-12 21:46:04 +00:00
if( status != PSA_SUCCESS )
return( status );
Do not persist transactions on volatile external keys Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-06-08 16:29:44 +00:00
if( ! PSA_KEY_LIFETIME_IS_VOLATILE( attributes->core.lifetime ) )
If starting a transaction fails, wipe the transaction data Nothing has been saved to disk yet, but there is stale data in psa_crypto_transaction. This stale data should not be reused, but do wipe it to reduce the risk of it mattering somehow in the future.
2019-07-25 16:02:52 +00:00
{
Do not persist transactions on volatile external keys Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-06-08 16:29:44 +00:00
psa_crypto_prepare_transaction( PSA_CRYPTO_TRANSACTION_CREATE_KEY );
psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:52:23 +00:00
psa_crypto_transaction.key.slot = slot_number;
Do not persist transactions on volatile external keys Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-06-08 16:29:44 +00:00
psa_crypto_transaction.key.id = slot->attr.id;
status = psa_crypto_save_transaction( );
if( status != PSA_SUCCESS )
{
(void) psa_crypto_stop_transaction( );
return( status );
}
If starting a transaction fails, wipe the transaction data Nothing has been saved to disk yet, but there is stale data in psa_crypto_transaction. This stale data should not be reused, but do wipe it to reduce the risk of it mattering somehow in the future.
2019-07-25 16:02:52 +00:00
}
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:52:23 +00:00
status = psa_copy_key_material_into_slot(
slot, (uint8_t *)( &slot_number ), sizeof( slot_number ) );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
}
SE support: Use a transaction when registering a key When registering a key in a secure element, go through the transaction mechanism. This makes the code simpler, at the expense of a few extra storage operations. Given that registering a key is typically very rare over the lifetime of a device, this is an acceptable loss. Drivers must now have a p_validate_slot_number method, otherwise registering a key is not possible. This reduces the risk that due to a mistake during the integration of a device, an application might claim a slot in a way that is not supported by the driver.
2019-10-01 12:18:35 +00:00
if( *p_drv == NULL && method == PSA_KEY_CREATION_REGISTER )
{
/* Key registration only makes sense with a secure element. */
return( PSA_ERROR_INVALID_ARGUMENT );
}
SE keys: allocate a slot before creating the key
2019-07-12 21:46:04 +00:00
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
Define handles as key identifiers Define psa_key_handle_t to be equal to mbedtls_svc_key_id_t. Make the handle of a persistent key be equal to its key identifier. For volatile keys, make the key handle equal to the volatile key identifier of the created volatile key. The unit tests are modified just to make them compile not to make them run successfully. They are fixed in the subsequent commits. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-07-31 09:26:37 +00:00
return( PSA_SUCCESS );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
}
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
/** Finalize the creation of a key once its key material has been set.
*
* This entails writing the key to persistent storage.
*
* If this function fails, call psa_fail_key_creation().
Document the key creation flow (start, variable, finish, and fail)
2019-04-28 09:37:03 +00:00
* See the documentation of psa_start_key_creation() for the intended use
* of this function.
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
*
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
* If the finalization succeeds, the function unlocks the key slot (it was
* locked by psa_start_key_creation()) and the key slot cannot be accessed
* anymore as part of the key creation process.
psa: Decrement slot access count when finalizing key creation Decrement the slot access count in psa_finish_key_creation() when the finalization succeeds instead of in functions calling psa_finish_key_creation(). That way the decrementation cannot be forgotten and it reduces the code size. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 10:28:25 +00:00
*
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
* \param[in,out] slot Pointer to the slot with key material.
* \param[in] driver The secure element driver for the key,
* or NULL for a transparent key.
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 11:10:32 +00:00
* \param[out] key On success, identifier of the key. Note that the
* key identifier is also stored in the key slot.
Document the key creation flow (start, variable, finish, and fail)
2019-04-28 09:37:03 +00:00
*
* \retval #PSA_SUCCESS
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
* The key was successfully created.
Update documentation The return values of the functions are updated in the documetation. All possible return values are added including nested functions' return values. The values which cannot be returned are removed. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-11-09 16:42:55 +00:00
* \retval #PSA_ERROR_INSUFFICIENT_MEMORY
* \retval #PSA_ERROR_INSUFFICIENT_STORAGE
* \retval #PSA_ERROR_ALREADY_EXISTS
* \retval #PSA_ERROR_DATA_INVALID
* \retval #PSA_ERROR_DATA_CORRUPT
Fix possible error codes in the documentation Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-11-30 15:50:34 +00:00
* \retval #PSA_ERROR_STORAGE_FAILURE
Update documentation The return values of the functions are updated in the documetation. All possible return values are added including nested functions' return values. The values which cannot be returned are removed. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-11-09 16:42:55 +00:00
*
Document the key creation flow (start, variable, finish, and fail)
2019-04-28 09:37:03 +00:00
* \return If this function fails, the key slot is an invalid state.
* You must call psa_fail_key_creation() to wipe and free the slot.
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
*/
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
static psa_status_t psa_finish_key_creation(
psa_key_slot_t *slot,
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 11:10:32 +00:00
psa_se_drv_table_entry_t *driver,
mbedtls_svc_key_id_t *key)
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
{
psa_status_t status = PSA_SUCCESS;
Fix build errors with MBEDTLS_PSA_CRYPTO_STORAGE_C disabled
2019-04-25 11:47:40 +00:00
(void) slot;
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
(void) driver;
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Refactor lifetime checking to reflect split in location and persistence Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-06-08 16:28:25 +00:00
if( ! PSA_KEY_LIFETIME_IS_VOLATILE( slot->attr.lifetime ) )
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
{
SE keys: implement persistent storage For a key in a secure element, persist the key slot. This is implemented in the nominal case. Failures may not be handled properly.
2019-07-23 14:13:14 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
if( driver != NULL )
{
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 19:32:04 +00:00
psa_se_key_data_storage_t data;
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:52:23 +00:00
psa_key_slot_number_t slot_number =
psa_key_slot_get_slot_number( slot ) ;
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 19:32:04 +00:00
#if defined(static_assert)
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:52:23 +00:00
static_assert( sizeof( slot_number ) ==
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 19:32:04 +00:00
sizeof( data.slot_number ),
"Slot number size does not match psa_se_key_data_storage_t" );
#endif
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:52:23 +00:00
memcpy( &data.slot_number, &slot_number, sizeof( slot_number ) );
Take advantage of psa_core_key_attributes_t internally #2 Key creation and psa_get_key_attributes
2019-07-31 12:15:34 +00:00
status = psa_save_persistent_key( &slot->attr,
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 19:32:04 +00:00
(uint8_t*) &data,
sizeof( data ) );
SE keys: implement persistent storage For a key in a secure element, persist the key slot. This is implemented in the nominal case. Failures may not be handled properly.
2019-07-23 14:13:14 +00:00
}
else
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
{
Address review comments * zero key buffer on failure * readability improvements * psa_finish_key_creation adjustment after removing import_key_into_slot Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-29 10:42:22 +00:00
/* Key material is saved in export representation in the slot, so
* just pass the slot buffer for storage. */
status = psa_save_persistent_key( &slot->attr,
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:52:23 +00:00
slot->key.data,
slot->key.bytes );
SE keys: implement persistent storage For a key in a secure element, persist the key slot. This is implemented in the nominal case. Failures may not be handled properly.
2019-07-23 14:13:14 +00:00
}
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
}
#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
SE keys: allocate a slot before creating the key
2019-07-12 21:46:04 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
New function mbedtls_psa_register_se_key Register an existing key in a secure element. Minimal implementation that doesn't call any driver method and just lets the application declare whatever it wants.
2019-08-05 13:55:54 +00:00
/* Finish the transaction for a key creation. This does not
* happen when registering an existing key. Detect this case
* by checking whether a transaction is in progress (actual
Do not persist transactions on volatile external keys Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-06-08 16:29:44 +00:00
* creation of a persistent key in a secure element requires a transaction,
* but registration or volatile key creation doesn't use one). */
New function mbedtls_psa_register_se_key Register an existing key in a secure element. Minimal implementation that doesn't call any driver method and just lets the application declare whatever it wants.
2019-08-05 13:55:54 +00:00
if( driver != NULL &&
psa_crypto_transaction.unknown.type == PSA_CRYPTO_TRANSACTION_CREATE_KEY )
SE keys: allocate a slot before creating the key
2019-07-12 21:46:04 +00:00
{
status = psa_save_se_persistent_data( driver );
if( status != PSA_SUCCESS )
{
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
psa_destroy_persistent_key( slot->attr.id );
SE keys: allocate a slot before creating the key
2019-07-12 21:46:04 +00:00
return( status );
}
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 17:30:34 +00:00
status = psa_crypto_stop_transaction( );
SE keys: allocate a slot before creating the key
2019-07-12 21:46:04 +00:00
}
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
psa: Decrement slot access count when finalizing key creation Decrement the slot access count in psa_finish_key_creation() when the finalization succeeds instead of in functions calling psa_finish_key_creation(). That way the decrementation cannot be forgotten and it reduces the code size. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 10:28:25 +00:00
if( status == PSA_SUCCESS )
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 11:10:32 +00:00
{
*key = slot->attr.id;
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
status = psa_unlock_key_slot( slot );
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 11:10:32 +00:00
if( status != PSA_SUCCESS )
*key = MBEDTLS_SVC_KEY_ID_INIT;
}
psa: Decrement slot access count when finalizing key creation Decrement the slot access count in psa_finish_key_creation() when the finalization succeeds instead of in functions calling psa_finish_key_creation(). That way the decrementation cannot be forgotten and it reduces the code size. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 10:28:25 +00:00
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
return( status );
}
/** Abort the creation of a key.
*
* You may call this function after calling psa_start_key_creation(),
* or after psa_finish_key_creation() fails. In other circumstances, this
* function may not clean up persistent storage.
Document the key creation flow (start, variable, finish, and fail)
2019-04-28 09:37:03 +00:00
* See the documentation of psa_start_key_creation() for the intended use
* of this function.
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
*
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
* \param[in,out] slot Pointer to the slot with key material.
* \param[in] driver The secure element driver for the key,
* or NULL for a transparent key.
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
*/
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
static void psa_fail_key_creation( psa_key_slot_t *slot,
Driver table entries are now mutable Since driver table entries contain the driver context, which is mutable, they can't be const anymore.
2019-07-12 21:40:35 +00:00
psa_se_drv_table_entry_t *driver )
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
{
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
(void) driver;
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
if( slot == NULL )
return;
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Make TODO comments consistent
2019-08-13 11:15:34 +00:00
/* TODO: If the key has already been created in the secure
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
* element, and the failure happened later (when saving metadata
* to internal storage), we need to destroy the key in the secure
Add issue numbers for some missing parts of secure element support
2019-08-13 14:17:16 +00:00
* element.
* https://github.com/ARMmbed/mbed-crypto/issues/217
*/
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 17:30:34 +00:00
New function mbedtls_psa_register_se_key Register an existing key in a secure element. Minimal implementation that doesn't call any driver method and just lets the application declare whatever it wants.
2019-08-05 13:55:54 +00:00
/* Abort the ongoing transaction if any (there may not be one if
* the creation process failed before starting one, or if the
* key creation is a registration of a key in a secure element).
* Earlier functions must already have done what it takes to undo any
* partial creation. All that's left is to update the transaction data
* itself. */
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 17:30:34 +00:00
(void) psa_crypto_stop_transaction( );
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
psa_wipe_key_slot( slot );
}
More refactoring: consolidate attribute validation Consolidate attribute validation at the beginning of key creation into a single function. Improve comments.
2019-07-31 15:21:46 +00:00
/** Validate optional attributes during key creation.
*
* Some key attributes are optional during key creation. If they are
* specified in the attributes structure, check that they are consistent
* with the data in the slot.
*
* This function should be called near the end of key creation, after
* the slot in memory is fully populated but before saving persistent data.
*/
static psa_status_t psa_validate_optional_attributes(
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 14:57:15 +00:00
const psa_key_slot_t *slot,
const psa_key_attributes_t *attributes )
{
Move attribute fields to a substructure Move the "core attributes" to a substructure of psa_key_attribute_t. The motivation is to be able to use the new structure psa_core_key_attributes_t internally.
2019-07-30 11:48:52 +00:00
if( attributes->core.type != 0 )
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 14:57:15 +00:00
{
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( attributes->core.type != slot->attr.type )
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 14:57:15 +00:00
return( PSA_ERROR_INVALID_ARGUMENT );
}
if( attributes->domain_parameters_size != 0 )
{
Add feature support for RSA for PSA crypto config In the original attempt to add RSA support to PSA crypto config was too generic. This set of changes adds support for the following RSA features: PSA_WANT_ALG_RSA_PKCS1V15_CRYPT, PSA_WANT_ALG_RSA_PKCS1V15_SIGN, PSA_WANT_ALG_RSA_OAEP, PSA_WANT_ALG_RSA_PSS, PSA_WANT_KEY_TYPE_RSA_KEY_PAIR, and PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY. There were also some updates to ensure the proper inclusion of PSA crypto library code when certain features are enabled. These updates were made to address warnings and errors in builds from the new tests for these features being added for PSA crypto configuration. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-01 05:06:54 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 14:57:15 +00:00
{
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:39 +00:00
mbedtls_rsa_context *rsa = NULL;
Update after feedback on #3492 * Updated wording * Split out buffer allocation to a convenience function * Moved variable declarations to beginning of their code block Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:13 +00:00
mbedtls_mpi actual, required;
Cleanup * No null-check before calling free * Close memory leak * No need for double check of privkey validity Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-30 09:36:45 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 20:48:15 +00:00
psa: Rename psa_load_rsa/ecp_representation Rename psa_load_rsa/ecp_representation to mbedtls_psa_rsa/ecp_load_representation before to move them in their RSA/ECP specific PSA crypto C modules. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 13:58:33 +00:00
psa_status_t status = mbedtls_psa_rsa_load_representation(
slot->attr.type,
slot->key.data,
slot->key.bytes,
&rsa );
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 20:48:15 +00:00
if( status != PSA_SUCCESS )
Style fixes * return is treated as a function call * space between opening and closing parentheses * remove whiteline between assignment and checking of same variable Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-05 13:43:42 +00:00
return( status );
Update after feedback on #3492 * Updated wording * Split out buffer allocation to a convenience function * Moved variable declarations to beginning of their code block Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:13 +00:00
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 14:57:15 +00:00
mbedtls_mpi_init( &actual );
mbedtls_mpi_init( &required );
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:39 +00:00
ret = mbedtls_rsa_export( rsa,
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 14:57:15 +00:00
NULL, NULL, NULL, NULL, &actual );
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:39 +00:00
mbedtls_rsa_free( rsa );
mbedtls_free( rsa );
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 14:57:15 +00:00
if( ret != 0 )
goto rsa_exit;
ret = mbedtls_mpi_read_binary( &required,
attributes->domain_parameters,
attributes->domain_parameters_size );
if( ret != 0 )
goto rsa_exit;
if( mbedtls_mpi_cmp_mpi( &actual, &required ) != 0 )
ret = MBEDTLS_ERR_RSA_BAD_INPUT_DATA;
rsa_exit:
mbedtls_mpi_free( &actual );
mbedtls_mpi_free( &required );
if( ret != 0)
return( mbedtls_to_psa_error( ret ) );
}
else
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 20:28:15 +00:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 14:57:15 +00:00
{
return( PSA_ERROR_INVALID_ARGUMENT );
}
}
Move attribute fields to a substructure Move the "core attributes" to a substructure of psa_key_attribute_t. The motivation is to be able to use the new structure psa_core_key_attributes_t internally.
2019-07-30 11:48:52 +00:00
if( attributes->core.bits != 0 )
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 14:57:15 +00:00
{
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 19:32:04 +00:00
if( attributes->core.bits != slot->attr.bits )
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 14:57:15 +00:00
return( PSA_ERROR_INVALID_ARGUMENT );
}
return( PSA_SUCCESS );
}
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
psa_status_t psa_import_key( const psa_key_attributes_t *attributes,
const uint8_t *data,
Put handle parameter last: psa_import_key In psa_import_key, change the order of parameters to pass the pointer where the newly created handle will be stored last. This is consistent with most other library functions that put inputs before outputs.
2019-05-15 18:15:10 +00:00
size_t data_length,
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
mbedtls_svc_key_id_t *key )
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
{
psa_status_t status;
psa_key_slot_t *slot = NULL;
Driver table entries are now mutable Since driver table entries contain the driver context, which is mutable, they can't be const anymore.
2019-07-12 21:40:35 +00:00
psa_se_drv_table_entry_t *driver = NULL;
psa: import: Move registered SE support to the driver wrapper Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-30 11:11:01 +00:00
size_t bits;
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 14:57:15 +00:00
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 11:10:32 +00:00
*key = MBEDTLS_SVC_KEY_ID_INIT;
Reject keys of size 0 Implement the prohibition on keys of size 0.
2019-09-12 17:03:13 +00:00
/* Reject zero-length symmetric keys (including raw data key objects).
* This also rejects any key which might be encoded as an empty string,
* which is never valid. */
if( data_length == 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
psa_start_key_creation: take the method as a parameter Let psa_start_key_creation know what type of key creation this is. This will be used at least for key registration in a secure element, which is a peculiar kind of creation since it uses existing key material.
2019-07-15 20:02:14 +00:00
status = psa_start_key_creation( PSA_KEY_CREATION_IMPORT, attributes,
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 11:10:32 +00:00
&slot, &driver );
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 14:57:15 +00:00
if( status != PSA_SUCCESS )
goto exit;
psa: import: Move registered SE support to the driver wrapper Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-30 11:11:01 +00:00
/* In the case of a transparent key or an opaque key stored in local
* storage (thus not in the case of generating a key in a secure element
* or cryptoprocessor with storage), we have to allocate a buffer to
* hold the generated key material. */
if( slot->key.data == NULL )
SE keys: support import and export
2019-07-12 21:47:28 +00:00
{
psa: import: Move registered SE support to the driver wrapper Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-30 11:11:01 +00:00
status = psa_allocate_buffer_to_slot( slot, data_length );
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 19:32:04 +00:00
if( status != PSA_SUCCESS )
goto exit;
SE keys: support import and export
2019-07-12 21:47:28 +00:00
}
psa: import: Move registered SE support to the driver wrapper Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-30 11:11:01 +00:00
bits = slot->attr.bits;
status = psa_driver_wrapper_import_key( attributes,
data, data_length,
slot->key.data,
slot->key.bytes,
&slot->key.bytes, &bits );
if( status != PSA_SUCCESS )
goto exit;
if( slot->attr.bits == 0 )
slot->attr.bits = (psa_key_bits_t) bits;
else if( bits != slot->attr.bits )
Apply review feedback Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-01-15 16:36:02 +00:00
{
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
SE keys: support import and export
2019-07-12 21:47:28 +00:00
}
psa: Change psa_import_key_into_slot() signature Change psa_import_key_into_slot() signature to the signature of an import_key driver entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 14:54:54 +00:00
More refactoring: consolidate attribute validation Consolidate attribute validation at the beginning of key creation into a single function. Improve comments.
2019-07-31 15:21:46 +00:00
status = psa_validate_optional_attributes( slot, attributes );
SE driver: report the bit size on key import Add a parameter to the key import method of a secure element driver to make it report the key size in bits. This is necessary (otherwise the core has no idea what the bit-size is), and making import report it is easier than adding a separate method (for other key creation methods, this information is an input, not an output).
2019-07-24 18:25:59 +00:00
if( status != PSA_SUCCESS )
goto exit;
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 14:57:15 +00:00
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 11:10:32 +00:00
status = psa_finish_key_creation( slot, driver, key );
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 14:57:15 +00:00
exit:
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
if( status != PSA_SUCCESS )
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
psa_fail_key_creation( slot, driver );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
return( status );
}
New function mbedtls_psa_register_se_key Register an existing key in a secure element. Minimal implementation that doesn't call any driver method and just lets the application declare whatever it wants.
2019-08-05 13:55:54 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
psa_status_t mbedtls_psa_register_se_key(
const psa_key_attributes_t *attributes )
{
psa_status_t status;
psa_key_slot_t *slot = NULL;
psa_se_drv_table_entry_t *driver = NULL;
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT;
New function mbedtls_psa_register_se_key Register an existing key in a secure element. Minimal implementation that doesn't call any driver method and just lets the application declare whatever it wants.
2019-08-05 13:55:54 +00:00
/* Leaving attributes unspecified is not currently supported.
* It could make sense to query the key type and size from the
* secure element, but not all secure elements support this
* and the driver HAL doesn't currently support it. */
if( psa_get_key_type( attributes ) == PSA_KEY_TYPE_NONE )
return( PSA_ERROR_NOT_SUPPORTED );
if( psa_get_key_bits( attributes ) == 0 )
return( PSA_ERROR_NOT_SUPPORTED );
status = psa_start_key_creation( PSA_KEY_CREATION_REGISTER, attributes,
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 11:10:32 +00:00
&slot, &driver );
New function mbedtls_psa_register_se_key Register an existing key in a secure element. Minimal implementation that doesn't call any driver method and just lets the application declare whatever it wants.
2019-08-05 13:55:54 +00:00
if( status != PSA_SUCCESS )
goto exit;
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 11:10:32 +00:00
status = psa_finish_key_creation( slot, driver, &key );
New function mbedtls_psa_register_se_key Register an existing key in a secure element. Minimal implementation that doesn't call any driver method and just lets the application declare whatever it wants.
2019-08-05 13:55:54 +00:00
exit:
if( status != PSA_SUCCESS )
psa_fail_key_creation( slot, driver );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
New function mbedtls_psa_register_se_key Register an existing key in a secure element. Minimal implementation that doesn't call any driver method and just lets the application declare whatever it wants.
2019-08-05 13:55:54 +00:00
/* Registration doesn't keep the key in RAM. */
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
psa_close_key( key );
New function mbedtls_psa_register_se_key Register an existing key in a secure element. Minimal implementation that doesn't call any driver method and just lets the application declare whatever it wants.
2019-08-05 13:55:54 +00:00
return( status );
}
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
static psa_status_t psa_copy_key_material( const psa_key_slot_t *source,
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 19:44:46 +00:00
psa_key_slot_t *target )
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
{
Add internal helper function to load prevalidated key material Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-13 18:27:40 +00:00
psa_status_t status = psa_copy_key_material_into_slot( target,
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:52:23 +00:00
source->key.data,
source->key.bytes );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
if( status != PSA_SUCCESS )
Rework psa_copy_key_material There's no need for calling export-and-import when the key is guaranteed to have been stored in export representation. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-13 12:35:45 +00:00
return( status );
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
target->attr.type = source->attr.type;
Rework psa_copy_key_material There's no need for calling export-and-import when the key is guaranteed to have been stored in export representation. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-13 12:35:45 +00:00
target->attr.bits = source->attr.bits;
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
Rework psa_copy_key_material There's no need for calling export-and-import when the key is guaranteed to have been stored in export representation. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-13 12:35:45 +00:00
return( PSA_SUCCESS );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
}
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
psa_status_t psa_copy_key( mbedtls_svc_key_id_t source_key,
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 19:44:46 +00:00
const psa_key_attributes_t *specified_attributes,
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
mbedtls_svc_key_id_t *target_key )
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 19:44:46 +00:00
{
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 19:44:46 +00:00
psa_key_slot_t *source_slot = NULL;
psa_key_slot_t *target_slot = NULL;
psa_key_attributes_t actual_attributes = *specified_attributes;
Driver table entries are now mutable Since driver table entries contain the driver context, which is mutable, they can't be const anymore.
2019-07-12 21:40:35 +00:00
psa_se_drv_table_entry_t *driver = NULL;
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 19:44:46 +00:00
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 11:10:32 +00:00
*target_key = MBEDTLS_SVC_KEY_ID_INIT;
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
status = psa_get_and_lock_transparent_key_slot_with_policy(
source_key, &source_slot, PSA_KEY_USAGE_COPY, 0 );
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 19:44:46 +00:00
if( status != PSA_SUCCESS )
goto exit;
More refactoring: consolidate attribute validation Consolidate attribute validation at the beginning of key creation into a single function. Improve comments.
2019-07-31 15:21:46 +00:00
status = psa_validate_optional_attributes( source_slot,
specified_attributes );
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 14:57:15 +00:00
if( status != PSA_SUCCESS )
goto exit;
Move attribute fields to a substructure Move the "core attributes" to a substructure of psa_key_attribute_t. The motivation is to be able to use the new structure psa_core_key_attributes_t internally.
2019-07-30 11:48:52 +00:00
status = psa_restrict_key_policy( &actual_attributes.core.policy,
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
&source_slot->attr.policy );
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 19:44:46 +00:00
if( status != PSA_SUCCESS )
goto exit;
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 11:10:32 +00:00
status = psa_start_key_creation( PSA_KEY_CREATION_COPY, &actual_attributes,
&target_slot, &driver );
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 19:44:46 +00:00
if( status != PSA_SUCCESS )
goto exit;
SE keys: error out in key creation function that lack support
2019-07-24 11:44:30 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
if( driver != NULL )
{
/* Copying to a secure element is not implemented yet. */
status = PSA_ERROR_NOT_SUPPORTED;
goto exit;
}
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 19:44:46 +00:00
status = psa_copy_key_material( source_slot, target_slot );
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 14:57:15 +00:00
if( status != PSA_SUCCESS )
goto exit;
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 19:44:46 +00:00
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 11:10:32 +00:00
status = psa_finish_key_creation( target_slot, driver, target_key );
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 19:44:46 +00:00
exit:
if( status != PSA_SUCCESS )
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
psa_fail_key_creation( target_slot, driver );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
unlock_status = psa_unlock_key_slot( source_slot );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 19:44:46 +00:00
}
Be more consistent about blank lines
2018-06-18 19:49:39 +00:00
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
/****************************************************************/
/* Message digests */
/****************************************************************/
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
Add feature support for RSA for PSA crypto config In the original attempt to add RSA support to PSA crypto config was too generic. This set of changes adds support for the following RSA features: PSA_WANT_ALG_RSA_PKCS1V15_CRYPT, PSA_WANT_ALG_RSA_PKCS1V15_SIGN, PSA_WANT_ALG_RSA_OAEP, PSA_WANT_ALG_RSA_PSS, PSA_WANT_KEY_TYPE_RSA_KEY_PAIR, and PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY. There were also some updates to ensure the proper inclusion of PSA crypto library code when certain features are enabled. These updates were made to address warnings and errors in builds from the new tests for these features being added for PSA crypto configuration. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-01 05:06:54 +00:00
defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) || \
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 20:28:15 +00:00
defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
Rename xxx_of_psa functions to xxx_from_psa Be consistent with how similar functions are named in Mbed TLS.
2018-03-07 15:42:59 +00:00
static const mbedtls_md_info_t *mbedtls_md_info_from_psa( psa_algorithm_t alg )
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
{
switch( alg )
{
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD2)
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
case PSA_ALG_MD2:
return( &mbedtls_md2_info );
#endif
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD4)
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
case PSA_ALG_MD4:
return( &mbedtls_md4_info );
#endif
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD5)
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
case PSA_ALG_MD5:
return( &mbedtls_md5_info );
#endif
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160)
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
case PSA_ALG_RIPEMD160:
return( &mbedtls_ripemd160_info );
#endif
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_1)
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
case PSA_ALG_SHA_1:
return( &mbedtls_sha1_info );
#endif
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_224)
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
case PSA_ALG_SHA_224:
return( &mbedtls_sha224_info );
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#endif
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_256)
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
case PSA_ALG_SHA_256:
return( &mbedtls_sha256_info );
#endif
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_384)
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
case PSA_ALG_SHA_384:
return( &mbedtls_sha384_info );
Implement NO_SHA384 in MD layer and PSA
2019-07-17 14:28:21 +00:00
#endif
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_512)
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
case PSA_ALG_SHA_512:
return( &mbedtls_sha512_info );
#endif
default:
return( NULL );
}
}
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 20:28:15 +00:00
* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) ||
* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) ||
* defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
psa_status_t psa_hash_abort( psa_hash_operation_t *operation )
{
switch( operation->alg )
{
psa_hash_abort: return PSA_SUCCESS if alg=0 Make psa_hash_abort consistent with psa_mac_abort and psa_cipher_abort. Add a comment explaining the reasoning.
2018-06-26 13:04:31 +00:00
case 0:
/* The object has (apparently) been initialized but it is not
* in use. It's ok to call abort on such an object, and there's
* nothing to do. */
break;
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD2)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_MD2:
mbedtls_md2_free( &operation->ctx.md2 );
break;
#endif
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD4)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_MD4:
mbedtls_md4_free( &operation->ctx.md4 );
break;
#endif
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD5)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_MD5:
mbedtls_md5_free( &operation->ctx.md5 );
break;
#endif
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_RIPEMD160:
mbedtls_ripemd160_free( &operation->ctx.ripemd160 );
break;
#endif
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_1)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_SHA_1:
mbedtls_sha1_free( &operation->ctx.sha1 );
break;
#endif
Update guards for ALG_SHA_224 and ALG_SHA_384 in crypto library The previous revision of guards around SHA_224 and SHA_384 were not correct. This set of changes ensures the proper code is available when SHA_224 and SHA_384 are enabled for use. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-12-03 14:01:32 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_224)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_SHA_224:
Update guards for ALG_SHA_224 and ALG_SHA_384 in crypto library The previous revision of guards around SHA_224 and SHA_384 were not correct. This set of changes ensures the proper code is available when SHA_224 and SHA_384 are enabled for use. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-12-03 14:01:32 +00:00
mbedtls_sha256_free( &operation->ctx.sha256 );
break;
#endif
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_256)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_SHA_256:
mbedtls_sha256_free( &operation->ctx.sha256 );
break;
#endif
Update guards for ALG_SHA_224 and ALG_SHA_384 in crypto library The previous revision of guards around SHA_224 and SHA_384 were not correct. This set of changes ensures the proper code is available when SHA_224 and SHA_384 are enabled for use. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-12-03 14:01:32 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_384)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_SHA_384:
Update guards for ALG_SHA_224 and ALG_SHA_384 in crypto library The previous revision of guards around SHA_224 and SHA_384 were not correct. This set of changes ensures the proper code is available when SHA_224 and SHA_384 are enabled for use. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-12-03 14:01:32 +00:00
mbedtls_sha512_free( &operation->ctx.sha512 );
break;
#endif
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_512)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_SHA_512:
mbedtls_sha512_free( &operation->ctx.sha512 );
break;
#endif
default:
In abort functions, return BAD_STATE on obviously bad input psa_hash_abort, psa_mac_abort and psa_cipher_abort now return PSA_ERROR_BAD_STATE if operation->alg is obviously not valid, which can only happen due to a programming error in the caller or in the library. We can't detect all cases of calling abort on uninitialized memory but this is dirt cheap and better than nothing.
2018-06-21 14:57:07 +00:00
return( PSA_ERROR_BAD_STATE );
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
}
operation->alg = 0;
return( PSA_SUCCESS );
}
Rename psa_hash_start -> psa_hash_setup Make function names for multipart operations more consistent (hash edition).
2018-07-08 17:46:38 +00:00
psa_status_t psa_hash_setup( psa_hash_operation_t *operation,
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
psa_algorithm_t alg )
{
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
psa: Disallow repeated setup Calling psa_*_setup() twice on a MAC, cipher, or hash context should result in a PSA_ERROR_BAD_STATE error because the operation has already been set up. Fixes #10
2019-02-19 09:25:10 +00:00
/* A context must be freshly initialized before it can be set up. */
if( operation->alg != 0 )
{
return( PSA_ERROR_BAD_STATE );
}
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
switch( alg )
{
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD2)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_MD2:
mbedtls_md2_init( &operation->ctx.md2 );
ret = mbedtls_md2_starts_ret( &operation->ctx.md2 );
break;
#endif
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD4)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_MD4:
mbedtls_md4_init( &operation->ctx.md4 );
ret = mbedtls_md4_starts_ret( &operation->ctx.md4 );
break;
#endif
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD5)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_MD5:
mbedtls_md5_init( &operation->ctx.md5 );
ret = mbedtls_md5_starts_ret( &operation->ctx.md5 );
break;
#endif
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_RIPEMD160:
mbedtls_ripemd160_init( &operation->ctx.ripemd160 );
ret = mbedtls_ripemd160_starts_ret( &operation->ctx.ripemd160 );
break;
#endif
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_1)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_SHA_1:
mbedtls_sha1_init( &operation->ctx.sha1 );
ret = mbedtls_sha1_starts_ret( &operation->ctx.sha1 );
break;
#endif
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_224)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_SHA_224:
mbedtls_sha256_init( &operation->ctx.sha256 );
ret = mbedtls_sha256_starts_ret( &operation->ctx.sha256, 1 );
break;
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#endif
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_256)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_SHA_256:
mbedtls_sha256_init( &operation->ctx.sha256 );
ret = mbedtls_sha256_starts_ret( &operation->ctx.sha256, 0 );
break;
#endif
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_384)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_SHA_384:
mbedtls_sha512_init( &operation->ctx.sha512 );
ret = mbedtls_sha512_starts_ret( &operation->ctx.sha512, 1 );
break;
Make more code paths conditional in psa_crypto.c
2020-01-07 09:13:18 +00:00
#endif
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_512)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_SHA_512:
mbedtls_sha512_init( &operation->ctx.sha512 );
ret = mbedtls_sha512_starts_ret( &operation->ctx.sha512, 0 );
break;
#endif
default:
Favor INVALID_ARGUMENT over NOT_SUPPORTED for bad algorithm types In psa_hash_start, psa_mac_start and psa_cipher_setup, return PSA_ERROR_INVALID_ARGUMENT rather than PSA_ERROR_NOT_SUPPORTED when the algorithm parameter is not the right category.
2018-06-20 14:21:04 +00:00
return( PSA_ALG_IS_HASH( alg ) ?
PSA_ERROR_NOT_SUPPORTED :
PSA_ERROR_INVALID_ARGUMENT );
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
}
if( ret == 0 )
operation->alg = alg;
else
psa_hash_abort( operation );
return( mbedtls_to_psa_error( ret ) );
}
psa_status_t psa_hash_update( psa_hash_operation_t *operation,
const uint8_t *input,
size_t input_length )
{
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
psa_hash_update: robustify the case length=0 Don't require hash implementations to behave correctly on a zero-length input, which may have an invalid pointer.
2018-07-12 14:58:43 +00:00
/* Don't require hash implementations to behave correctly on a
* zero-length input, which may have an invalid pointer. */
if( input_length == 0 )
return( PSA_SUCCESS );
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
switch( operation->alg )
{
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD2)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_MD2:
ret = mbedtls_md2_update_ret( &operation->ctx.md2,
input, input_length );
break;
#endif
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD4)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_MD4:
ret = mbedtls_md4_update_ret( &operation->ctx.md4,
input, input_length );
break;
#endif
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD5)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_MD5:
ret = mbedtls_md5_update_ret( &operation->ctx.md5,
input, input_length );
break;
#endif
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_RIPEMD160:
ret = mbedtls_ripemd160_update_ret( &operation->ctx.ripemd160,
input, input_length );
break;
#endif
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_1)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_SHA_1:
ret = mbedtls_sha1_update_ret( &operation->ctx.sha1,
input, input_length );
break;
#endif
Update guards for ALG_SHA_224 and ALG_SHA_384 in crypto library The previous revision of guards around SHA_224 and SHA_384 were not correct. This set of changes ensures the proper code is available when SHA_224 and SHA_384 are enabled for use. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-12-03 14:01:32 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_224)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_SHA_224:
Update guards for ALG_SHA_224 and ALG_SHA_384 in crypto library The previous revision of guards around SHA_224 and SHA_384 were not correct. This set of changes ensures the proper code is available when SHA_224 and SHA_384 are enabled for use. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-12-03 14:01:32 +00:00
ret = mbedtls_sha256_update_ret( &operation->ctx.sha256,
input, input_length );
break;
#endif
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_256)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_SHA_256:
ret = mbedtls_sha256_update_ret( &operation->ctx.sha256,
input, input_length );
break;
#endif
Update guards for ALG_SHA_224 and ALG_SHA_384 in crypto library The previous revision of guards around SHA_224 and SHA_384 were not correct. This set of changes ensures the proper code is available when SHA_224 and SHA_384 are enabled for use. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-12-03 14:01:32 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_384)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_SHA_384:
Update guards for ALG_SHA_224 and ALG_SHA_384 in crypto library The previous revision of guards around SHA_224 and SHA_384 were not correct. This set of changes ensures the proper code is available when SHA_224 and SHA_384 are enabled for use. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-12-03 14:01:32 +00:00
ret = mbedtls_sha512_update_ret( &operation->ctx.sha512,
input, input_length );
break;
#endif
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_512)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_SHA_512:
ret = mbedtls_sha512_update_ret( &operation->ctx.sha512,
input, input_length );
break;
#endif
default:
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
(void)input;
psa: Disallow use of invalid hash contexts If a hash context has not been set up, fail with PSA_ERROR_BAD_STATE as documented in crypto.h and the PSA Crypto specification.
2019-02-15 13:52:25 +00:00
return( PSA_ERROR_BAD_STATE );
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
}
psa_hash_update: robustify the case length=0 Don't require hash implementations to behave correctly on a zero-length input, which may have an invalid pointer.
2018-07-12 14:58:43 +00:00
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
if( ret != 0 )
psa_hash_abort( operation );
return( mbedtls_to_psa_error( ret ) );
}
psa_status_t psa_hash_finish( psa_hash_operation_t *operation,
uint8_t *hash,
size_t hash_size,
size_t *hash_length )
{
Add missing calls to psa_hash_abort in hash functions
2018-08-02 10:14:17 +00:00
psa_status_t status;
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Rename output buffer size macros Rename existing support macros for output buffer sizes for PSA Crypto API 1.0.0 Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-12-18 13:23:51 +00:00
size_t actual_hash_length = PSA_HASH_LENGTH( operation->alg );
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
/* Fill the output buffer with something that isn't a valid hash
* (barring an attack on the hash and deliberately-crafted input),
* in case the caller doesn't check the return status properly. */
Fix safe output length in hash and mac finish In psa_hash_finish and psa_mac_finish_internal, set the fallback output length (which is reported on error) to the output buffer size, not to the _expected_ buffer size which could be larger.
2018-07-02 10:15:28 +00:00
*hash_length = hash_size;
Handle null pointers safely when used as buffers of size 0 When the size of a buffer is 0, the corresponding pointer argument may be null. In such cases, library functions must not perform arithmetic on the pointer or call standard library functions such as memset and memcpy, since that would be undefined behavior in C. Protect such cases. Refactor the storage of a 0-sized raw data object to make it store a null pointer, rather than depending on the behavior of calloc(1,0).
2018-06-28 17:31:31 +00:00
/* If hash_size is 0 then hash may be NULL and then the
* call to memset would have undefined behavior. */
if( hash_size != 0 )
memset( hash, '!', hash_size );
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
if( hash_size < actual_hash_length )
Add missing calls to psa_hash_abort in hash functions
2018-08-02 10:14:17 +00:00
{
status = PSA_ERROR_BUFFER_TOO_SMALL;
goto exit;
}
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
switch( operation->alg )
{
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD2)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_MD2:
ret = mbedtls_md2_finish_ret( &operation->ctx.md2, hash );
break;
#endif
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD4)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_MD4:
ret = mbedtls_md4_finish_ret( &operation->ctx.md4, hash );
break;
#endif
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD5)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_MD5:
ret = mbedtls_md5_finish_ret( &operation->ctx.md5, hash );
break;
#endif
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_RIPEMD160:
ret = mbedtls_ripemd160_finish_ret( &operation->ctx.ripemd160, hash );
break;
#endif
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_1)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_SHA_1:
ret = mbedtls_sha1_finish_ret( &operation->ctx.sha1, hash );
break;
#endif
Update guards for ALG_SHA_224 and ALG_SHA_384 in crypto library The previous revision of guards around SHA_224 and SHA_384 were not correct. This set of changes ensures the proper code is available when SHA_224 and SHA_384 are enabled for use. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-12-03 14:01:32 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_224)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_SHA_224:
Update guards for ALG_SHA_224 and ALG_SHA_384 in crypto library The previous revision of guards around SHA_224 and SHA_384 were not correct. This set of changes ensures the proper code is available when SHA_224 and SHA_384 are enabled for use. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-12-03 14:01:32 +00:00
ret = mbedtls_sha256_finish_ret( &operation->ctx.sha256, hash );
break;
#endif
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_256)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_SHA_256:
ret = mbedtls_sha256_finish_ret( &operation->ctx.sha256, hash );
break;
#endif
Update guards for ALG_SHA_224 and ALG_SHA_384 in crypto library The previous revision of guards around SHA_224 and SHA_384 were not correct. This set of changes ensures the proper code is available when SHA_224 and SHA_384 are enabled for use. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-12-03 14:01:32 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_384)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_SHA_384:
Update guards for ALG_SHA_224 and ALG_SHA_384 in crypto library The previous revision of guards around SHA_224 and SHA_384 were not correct. This set of changes ensures the proper code is available when SHA_224 and SHA_384 are enabled for use. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-12-03 14:01:32 +00:00
ret = mbedtls_sha512_finish_ret( &operation->ctx.sha512, hash );
break;
#endif
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_512)
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
case PSA_ALG_SHA_512:
ret = mbedtls_sha512_finish_ret( &operation->ctx.sha512, hash );
break;
#endif
default:
psa: Disallow use of invalid hash contexts If a hash context has not been set up, fail with PSA_ERROR_BAD_STATE as documented in crypto.h and the PSA Crypto specification.
2019-02-15 13:52:25 +00:00
return( PSA_ERROR_BAD_STATE );
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
}
Add missing calls to psa_hash_abort in hash functions
2018-08-02 10:14:17 +00:00
status = mbedtls_to_psa_error( ret );
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
Add missing calls to psa_hash_abort in hash functions
2018-08-02 10:14:17 +00:00
exit:
if( status == PSA_SUCCESS )
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
{
Fix safe output length in hash and mac finish In psa_hash_finish and psa_mac_finish_internal, set the fallback output length (which is reported on error) to the output buffer size, not to the _expected_ buffer size which could be larger.
2018-07-02 10:15:28 +00:00
*hash_length = actual_hash_length;
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
return( psa_hash_abort( operation ) );
}
else
{
psa_hash_abort( operation );
Add missing calls to psa_hash_abort in hash functions
2018-08-02 10:14:17 +00:00
return( status );
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
}
}
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 13:41:12 +00:00
psa_status_t psa_hash_verify( psa_hash_operation_t *operation,
const uint8_t *hash,
size_t hash_length )
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
{
uint8_t actual_hash[MBEDTLS_MD_MAX_SIZE];
size_t actual_hash_length;
psa_status_t status = psa_hash_finish( operation,
actual_hash, sizeof( actual_hash ),
&actual_hash_length );
if( status != PSA_SUCCESS )
return( status );
if( actual_hash_length != hash_length )
return( PSA_ERROR_INVALID_SIGNATURE );
if( safer_memcmp( hash, actual_hash, actual_hash_length ) != 0 )
return( PSA_ERROR_INVALID_SIGNATURE );
return( PSA_SUCCESS );
}
Implement and test psa_hash_compute, psa_hash_compare
2019-11-28 18:33:58 +00:00
psa_status_t psa_hash_compute( psa_algorithm_t alg,
const uint8_t *input, size_t input_length,
uint8_t *hash, size_t hash_size,
size_t *hash_length )
{
psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT;
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
*hash_length = hash_size;
status = psa_hash_setup( &operation, alg );
if( status != PSA_SUCCESS )
goto exit;
status = psa_hash_update( &operation, input, input_length );
if( status != PSA_SUCCESS )
goto exit;
status = psa_hash_finish( &operation, hash, hash_size, hash_length );
if( status != PSA_SUCCESS )
goto exit;
exit:
if( status == PSA_SUCCESS )
status = psa_hash_abort( &operation );
else
psa_hash_abort( &operation );
return( status );
}
psa_status_t psa_hash_compare( psa_algorithm_t alg,
const uint8_t *input, size_t input_length,
const uint8_t *hash, size_t hash_length )
{
psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT;
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
status = psa_hash_setup( &operation, alg );
if( status != PSA_SUCCESS )
goto exit;
status = psa_hash_update( &operation, input, input_length );
if( status != PSA_SUCCESS )
goto exit;
status = psa_hash_verify( &operation, hash, hash_length );
if( status != PSA_SUCCESS )
goto exit;
exit:
if( status == PSA_SUCCESS )
status = psa_hash_abort( &operation );
else
psa_hash_abort( &operation );
return( status );
}
Style fix
2019-01-22 16:56:16 +00:00
psa_status_t psa_hash_clone( const psa_hash_operation_t *source_operation,
psa_hash_operation_t *target_operation )
New function psa_hash_clone Clone a hash operation. Test good cases as part as multipart tests. Add new test functions for the state machine.
2019-01-19 11:03:41 +00:00
{
if( target_operation->alg != 0 )
return( PSA_ERROR_BAD_STATE );
switch( source_operation->alg )
{
case 0:
return( PSA_ERROR_BAD_STATE );
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD2)
New function psa_hash_clone Clone a hash operation. Test good cases as part as multipart tests. Add new test functions for the state machine.
2019-01-19 11:03:41 +00:00
case PSA_ALG_MD2:
mbedtls_md2_clone( &target_operation->ctx.md2,
&source_operation->ctx.md2 );
break;
#endif
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD4)
New function psa_hash_clone Clone a hash operation. Test good cases as part as multipart tests. Add new test functions for the state machine.
2019-01-19 11:03:41 +00:00
case PSA_ALG_MD4:
mbedtls_md4_clone( &target_operation->ctx.md4,
&source_operation->ctx.md4 );
break;
#endif
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD5)
New function psa_hash_clone Clone a hash operation. Test good cases as part as multipart tests. Add new test functions for the state machine.
2019-01-19 11:03:41 +00:00
case PSA_ALG_MD5:
mbedtls_md5_clone( &target_operation->ctx.md5,
&source_operation->ctx.md5 );
break;
#endif
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160)
New function psa_hash_clone Clone a hash operation. Test good cases as part as multipart tests. Add new test functions for the state machine.
2019-01-19 11:03:41 +00:00
case PSA_ALG_RIPEMD160:
mbedtls_ripemd160_clone( &target_operation->ctx.ripemd160,
&source_operation->ctx.ripemd160 );
break;
#endif
Use new MBEDTLS_PSA_BUILTIN_ macros for hashes in crypto library This set of changes converts all the previous MBEDTLS_*_C guards in the crypto library to use the new MBEDTLS_PSA_BUILTIN_ guards for hash algorithms. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-27 16:48:46 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_1)
New function psa_hash_clone Clone a hash operation. Test good cases as part as multipart tests. Add new test functions for the state machine.
2019-01-19 11:03:41 +00:00
case PSA_ALG_SHA_1:
mbedtls_sha1_clone( &target_operation->ctx.sha1,
&source_operation->ctx.sha1 );
break;
#endif
Update guards for ALG_SHA_224 and ALG_SHA_384 in crypto library The previous revision of guards around SHA_224 and SHA_384 were not correct. This set of changes ensures the proper code is available when SHA_224 and SHA_384 are enabled for use. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-12-03 14:01:32 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_224)
New function psa_hash_clone Clone a hash operation. Test good cases as part as multipart tests. Add new test functions for the state machine.
2019-01-19 11:03:41 +00:00
case PSA_ALG_SHA_224:
Update guards for ALG_SHA_224 and ALG_SHA_384 in crypto library The previous revision of guards around SHA_224 and SHA_384 were not correct. This set of changes ensures the proper code is available when SHA_224 and SHA_384 are enabled for use. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-12-03 14:01:32 +00:00
mbedtls_sha256_clone( &target_operation->ctx.sha256,
&source_operation->ctx.sha256 );
break;
#endif
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_256)
New function psa_hash_clone Clone a hash operation. Test good cases as part as multipart tests. Add new test functions for the state machine.
2019-01-19 11:03:41 +00:00
case PSA_ALG_SHA_256:
mbedtls_sha256_clone( &target_operation->ctx.sha256,
&source_operation->ctx.sha256 );
break;
#endif
Update guards for ALG_SHA_224 and ALG_SHA_384 in crypto library The previous revision of guards around SHA_224 and SHA_384 were not correct. This set of changes ensures the proper code is available when SHA_224 and SHA_384 are enabled for use. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-12-03 14:01:32 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_384)
New function psa_hash_clone Clone a hash operation. Test good cases as part as multipart tests. Add new test functions for the state machine.
2019-01-19 11:03:41 +00:00
case PSA_ALG_SHA_384:
Update guards for ALG_SHA_224 and ALG_SHA_384 in crypto library The previous revision of guards around SHA_224 and SHA_384 were not correct. This set of changes ensures the proper code is available when SHA_224 and SHA_384 are enabled for use. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-12-03 14:01:32 +00:00
mbedtls_sha512_clone( &target_operation->ctx.sha512,
&source_operation->ctx.sha512 );
break;
#endif
#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_512)
New function psa_hash_clone Clone a hash operation. Test good cases as part as multipart tests. Add new test functions for the state machine.
2019-01-19 11:03:41 +00:00
case PSA_ALG_SHA_512:
mbedtls_sha512_clone( &target_operation->ctx.sha512,
&source_operation->ctx.sha512 );
break;
#endif
default:
return( PSA_ERROR_NOT_SUPPORTED );
}
target_operation->alg = source_operation->alg;
return( PSA_SUCCESS );
}
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
/****************************************************************/
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
/* MAC */
/****************************************************************/
Rename xxx_of_psa functions to xxx_from_psa Be consistent with how similar functions are named in Mbed TLS.
2018-03-07 15:42:59 +00:00
static const mbedtls_cipher_info_t *mbedtls_cipher_info_from_psa(
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
psa_algorithm_t alg,
psa_key_type_t key_type,
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 13:41:12 +00:00
size_t key_bits,
change mbedtls_cipher_info_from_psa to provide cipher_id also
2018-06-03 12:04:51 +00:00
mbedtls_cipher_id_t* cipher_id )
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
{
mbedtls_cipher_mode_t mode;
change mbedtls_cipher_info_from_psa to provide cipher_id also
2018-06-03 12:04:51 +00:00
mbedtls_cipher_id_t cipher_id_tmp;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
Add support for non-default-tag-size AEAD (CCM and GCM)
2018-08-17 17:47:52 +00:00
if( PSA_ALG_IS_AEAD( alg ) )
Rename AEAD tag length macros This brings them in line with PSA Crypto API 1.0.0 PSA_ALG_AEAD_WITH_DEFAULT_TAG_LENGTH -> PSA_ALG_AEAD_WITH_DEFAULT_LENGTH_TAG PSA_ALG_AEAD_WITH_TAG_LENGTH -> PSA_ALG_AEAD_WITH_SHORTENED_TAG Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2020-12-16 10:36:46 +00:00
alg = PSA_ALG_AEAD_WITH_SHORTENED_TAG( alg, 0 );
Add support for non-default-tag-size AEAD (CCM and GCM)
2018-08-17 17:47:52 +00:00
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
if( PSA_ALG_IS_CIPHER( alg ) || PSA_ALG_IS_AEAD( alg ) )
{
space and style fixes
2018-06-17 11:41:30 +00:00
switch( alg )
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
{
Introduce PSA_ALG_STREAM_CIPHER This algorithm replaces the pre-existing stream cipher algorithms. The underlying stream cipher is determined by the key type. Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2020-12-07 17:20:28 +00:00
case PSA_ALG_STREAM_CIPHER:
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
mode = MBEDTLS_MODE_STREAM;
break;
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 12:02:45 +00:00
case PSA_ALG_CTR:
mode = MBEDTLS_MODE_CTR;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
break;
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 12:02:45 +00:00
case PSA_ALG_CFB:
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
mode = MBEDTLS_MODE_CFB;
break;
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 12:02:45 +00:00
case PSA_ALG_OFB:
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
mode = MBEDTLS_MODE_OFB;
break;
Added support for AES-ECB to the PSA Crypto implementation PSA_ALG_ECB_NO_PADDING came in to the PSA Crypto API spec v1.0.0, but was not implemented yet in the mbed TLS implementation. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-06 12:08:59 +00:00
case PSA_ALG_ECB_NO_PADDING:
mode = MBEDTLS_MODE_ECB;
break;
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 12:02:45 +00:00
case PSA_ALG_CBC_NO_PADDING:
mode = MBEDTLS_MODE_CBC;
break;
case PSA_ALG_CBC_PKCS7:
mode = MBEDTLS_MODE_CBC;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
break;
Rename AEAD tag length macros This brings them in line with PSA Crypto API 1.0.0 PSA_ALG_AEAD_WITH_DEFAULT_TAG_LENGTH -> PSA_ALG_AEAD_WITH_DEFAULT_LENGTH_TAG PSA_ALG_AEAD_WITH_TAG_LENGTH -> PSA_ALG_AEAD_WITH_SHORTENED_TAG Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2020-12-16 10:36:46 +00:00
case PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, 0 ):
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
mode = MBEDTLS_MODE_CCM;
break;
Rename AEAD tag length macros This brings them in line with PSA Crypto API 1.0.0 PSA_ALG_AEAD_WITH_DEFAULT_TAG_LENGTH -> PSA_ALG_AEAD_WITH_DEFAULT_LENGTH_TAG PSA_ALG_AEAD_WITH_TAG_LENGTH -> PSA_ALG_AEAD_WITH_SHORTENED_TAG Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2020-12-16 10:36:46 +00:00
case PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_GCM, 0 ):
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
mode = MBEDTLS_MODE_GCM;
break;
Rename AEAD tag length macros This brings them in line with PSA Crypto API 1.0.0 PSA_ALG_AEAD_WITH_DEFAULT_TAG_LENGTH -> PSA_ALG_AEAD_WITH_DEFAULT_LENGTH_TAG PSA_ALG_AEAD_WITH_TAG_LENGTH -> PSA_ALG_AEAD_WITH_SHORTENED_TAG Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2020-12-16 10:36:46 +00:00
case PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CHACHA20_POLY1305, 0 ):
Implement ChaCha20 and ChaCha20-Poly1305 Smoke tests: test data for ChaCha20 calculated with PyCryptodome; test vector from RFC 7539 for ChaCha20-Poly1305.
2019-05-06 13:25:00 +00:00
mode = MBEDTLS_MODE_CHACHAPOLY;
break;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
default:
return( NULL );
}
}
else if( alg == PSA_ALG_CMAC )
mode = MBEDTLS_MODE_ECB;
else
return( NULL );
switch( key_type )
{
case PSA_KEY_TYPE_AES:
change mbedtls_cipher_info_from_psa to provide cipher_id also
2018-06-03 12:04:51 +00:00
cipher_id_tmp = MBEDTLS_CIPHER_ID_AES;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
break;
case PSA_KEY_TYPE_DES:
Add what little was missing to fully support DES Also add what was missing in the test suite to support block ciphers with a block size that isn't 16. Fix some buggy test data that passed only due to problems with DES support in the product.
2018-06-21 07:40:04 +00:00
/* key_bits is 64 for Single-DES, 128 for two-key Triple-DES,
* and 192 for three-key Triple-DES. */
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
if( key_bits == 64 )
change mbedtls_cipher_info_from_psa to provide cipher_id also
2018-06-03 12:04:51 +00:00
cipher_id_tmp = MBEDTLS_CIPHER_ID_DES;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
else
change mbedtls_cipher_info_from_psa to provide cipher_id also
2018-06-03 12:04:51 +00:00
cipher_id_tmp = MBEDTLS_CIPHER_ID_3DES;
Add what little was missing to fully support DES Also add what was missing in the test suite to support block ciphers with a block size that isn't 16. Fix some buggy test data that passed only due to problems with DES support in the product.
2018-06-21 07:40:04 +00:00
/* mbedtls doesn't recognize two-key Triple-DES as an algorithm,
* but two-key Triple-DES is functionally three-key Triple-DES
* with K1=K3, so that's how we present it to mbedtls. */
if( key_bits == 128 )
key_bits = 192;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
break;
case PSA_KEY_TYPE_CAMELLIA:
change mbedtls_cipher_info_from_psa to provide cipher_id also
2018-06-03 12:04:51 +00:00
cipher_id_tmp = MBEDTLS_CIPHER_ID_CAMELLIA;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
break;
case PSA_KEY_TYPE_ARC4:
change mbedtls_cipher_info_from_psa to provide cipher_id also
2018-06-03 12:04:51 +00:00
cipher_id_tmp = MBEDTLS_CIPHER_ID_ARC4;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
break;
Implement ChaCha20 and ChaCha20-Poly1305 Smoke tests: test data for ChaCha20 calculated with PyCryptodome; test vector from RFC 7539 for ChaCha20-Poly1305.
2019-05-06 13:25:00 +00:00
case PSA_KEY_TYPE_CHACHA20:
cipher_id_tmp = MBEDTLS_CIPHER_ID_CHACHA20;
break;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
default:
return( NULL );
}
change mbedtls_cipher_info_from_psa to provide cipher_id also
2018-06-03 12:04:51 +00:00
if( cipher_id != NULL )
remove unnecessary argument to the psa_aead_unpadded_locate_tag function
2018-06-03 14:20:42 +00:00
*cipher_id = cipher_id_tmp;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
psa: Pass the number of bits with explicit types The GCM, CCM, RSA, and cipher modules inconsistently use int or unsigned int for a count of bits. The PSA Crypto API uses size_t for counting things. This causes issues on LLP64 systems where a size_t can hold more than an unsigned int. Add casts for where key_bits and bits are passed to mbedtls_* APIs.
2018-06-26 13:16:54 +00:00
return( mbedtls_cipher_info_from_values( cipher_id_tmp,
(int) key_bits, mode ) );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
}
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 16:50:04 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
fix spaces and add braces
2018-06-18 09:24:33 +00:00
static size_t psa_get_hash_block_size( psa_algorithm_t alg )
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 11:41:10 +00:00
{
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 13:41:12 +00:00
switch( alg )
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 11:41:10 +00:00
{
case PSA_ALG_MD2:
fix spaces and add braces
2018-06-18 09:24:33 +00:00
return( 16 );
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 11:41:10 +00:00
case PSA_ALG_MD4:
fix spaces and add braces
2018-06-18 09:24:33 +00:00
return( 64 );
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 11:41:10 +00:00
case PSA_ALG_MD5:
fix spaces and add braces
2018-06-18 09:24:33 +00:00
return( 64 );
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 11:41:10 +00:00
case PSA_ALG_RIPEMD160:
fix spaces and add braces
2018-06-18 09:24:33 +00:00
return( 64 );
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 11:41:10 +00:00
case PSA_ALG_SHA_1:
fix spaces and add braces
2018-06-18 09:24:33 +00:00
return( 64 );
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 11:41:10 +00:00
case PSA_ALG_SHA_224:
fix spaces and add braces
2018-06-18 09:24:33 +00:00
return( 64 );
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 11:41:10 +00:00
case PSA_ALG_SHA_256:
fix spaces and add braces
2018-06-18 09:24:33 +00:00
return( 64 );
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 11:41:10 +00:00
case PSA_ALG_SHA_384:
fix spaces and add braces
2018-06-18 09:24:33 +00:00
return( 128 );
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 11:41:10 +00:00
case PSA_ALG_SHA_512:
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 13:41:12 +00:00
return( 128 );
default:
return( 0 );
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 11:41:10 +00:00
}
}
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC) */
remove reliance on md_info context for hash information 1. remove reliance on md_info context for hash information by decoding locally 2. remove block_size field in context as this is dynamically computed
2018-06-07 10:27:47 +00:00
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 14:05:20 +00:00
/* Initialize the MAC operation structure. Once this function has been
* called, psa_mac_abort can run and will do the right thing. */
static psa_status_t psa_mac_init( psa_mac_operation_t *operation,
psa_algorithm_t alg )
{
psa_status_t status = PSA_ERROR_NOT_SUPPORTED;
operation->alg = alg;
operation->key_set = 0;
operation->iv_set = 0;
operation->iv_required = 0;
operation->has_input = 0;
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 18:12:23 +00:00
operation->is_sign = 0;
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 14:05:20 +00:00
#if defined(MBEDTLS_CMAC_C)
if( alg == PSA_ALG_CMAC )
{
operation->iv_required = 0;
mbedtls_cipher_init( &operation->ctx.cmac );
status = PSA_SUCCESS;
}
else
#endif /* MBEDTLS_CMAC_C */
Phase 2 support for MBEDTLS_PSA_CRYPTO_CONFIG This phase adds in support for the following features being added to the list of features that can be configured in the include/psa/crypto_config.h header file using the PSA_WANT_ALG_xxx macros: ECDH, HMAC, HKDF, and RSA. These changes include changes to the PSA crypto library to use the appropriate new guards that will allow the feature to be compiled in or out either using new PSA_WANT_ALG_xxx or the previous MBEDTLS_xxx macros. For HKDF and HMAC, most of the PSA library code did not have a specific matching MBEDTLS_xxx macro for that feature, but was instead using the generic dependent MBEDTLS_MD_C macro. The ECDH and RSA features more closely aligned with a direct replacement with a similar macro. The new tests for RSA, HMAC, and HKDF would normally unset additional dependent macros, but when attempting to implement that level of testing it required removal of too many core features like MD_C, PK_C, ECP_C and other low level features. This may point to additional phases of work to complete the transition of these features to the new model. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-30 04:37:36 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 14:05:20 +00:00
if( PSA_ALG_IS_HMAC( operation->alg ) )
{
Make psa_hmac_setup_internal more standalone Call psa_hash_setup in psa_hmac_setup_internal rather than psa_mac_init. This makes it easier to use psa_hmac_setup_internal on its own (for the sake of using HMAC internally inside the library).
2018-07-12 15:07:52 +00:00
/* We'll set up the hash operation later in psa_hmac_setup_internal. */
operation->ctx.hmac.hash_ctx.alg = 0;
status = PSA_SUCCESS;
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 14:05:20 +00:00
}
else
Phase 2 support for MBEDTLS_PSA_CRYPTO_CONFIG This phase adds in support for the following features being added to the list of features that can be configured in the include/psa/crypto_config.h header file using the PSA_WANT_ALG_xxx macros: ECDH, HMAC, HKDF, and RSA. These changes include changes to the PSA crypto library to use the appropriate new guards that will allow the feature to be compiled in or out either using new PSA_WANT_ALG_xxx or the previous MBEDTLS_xxx macros. For HKDF and HMAC, most of the PSA library code did not have a specific matching MBEDTLS_xxx macro for that feature, but was instead using the generic dependent MBEDTLS_MD_C macro. The ECDH and RSA features more closely aligned with a direct replacement with a similar macro. The new tests for RSA, HMAC, and HKDF would normally unset additional dependent macros, but when attempting to implement that level of testing it required removal of too many core features like MD_C, PK_C, ECP_C and other low level features. This may point to additional phases of work to complete the transition of these features to the new model. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-30 04:37:36 +00:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 14:05:20 +00:00
{
Favor INVALID_ARGUMENT over NOT_SUPPORTED for bad algorithm types In psa_hash_start, psa_mac_start and psa_cipher_setup, return PSA_ERROR_INVALID_ARGUMENT rather than PSA_ERROR_NOT_SUPPORTED when the algorithm parameter is not the right category.
2018-06-20 14:21:04 +00:00
if( ! PSA_ALG_IS_MAC( alg ) )
status = PSA_ERROR_INVALID_ARGUMENT;
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 14:05:20 +00:00
}
if( status != PSA_SUCCESS )
memset( operation, 0, sizeof( *operation ) );
return( status );
}
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 16:50:04 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
static psa_status_t psa_hmac_abort_internal( psa_hmac_internal_data *hmac )
{
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 17:14:53 +00:00
mbedtls_platform_zeroize( hmac->opad, sizeof( hmac->opad ) );
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
return( psa_hash_abort( &hmac->hash_ctx ) );
}
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 16:50:04 +00:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
psa_status_t psa_mac_abort( psa_mac_operation_t *operation )
{
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
if( operation->alg == 0 )
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
{
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
/* The object has (apparently) been initialized but it is not
* in use. It's ok to call abort on such an object, and there's
* nothing to do. */
return( PSA_SUCCESS );
}
else
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
#if defined(MBEDTLS_CMAC_C)
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
if( operation->alg == PSA_ALG_CMAC )
{
mbedtls_cipher_free( &operation->ctx.cmac );
}
else
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
#endif /* MBEDTLS_CMAC_C */
Phase 2 support for MBEDTLS_PSA_CRYPTO_CONFIG This phase adds in support for the following features being added to the list of features that can be configured in the include/psa/crypto_config.h header file using the PSA_WANT_ALG_xxx macros: ECDH, HMAC, HKDF, and RSA. These changes include changes to the PSA crypto library to use the appropriate new guards that will allow the feature to be compiled in or out either using new PSA_WANT_ALG_xxx or the previous MBEDTLS_xxx macros. For HKDF and HMAC, most of the PSA library code did not have a specific matching MBEDTLS_xxx macro for that feature, but was instead using the generic dependent MBEDTLS_MD_C macro. The ECDH and RSA features more closely aligned with a direct replacement with a similar macro. The new tests for RSA, HMAC, and HKDF would normally unset additional dependent macros, but when attempting to implement that level of testing it required removal of too many core features like MD_C, PK_C, ECP_C and other low level features. This may point to additional phases of work to complete the transition of these features to the new model. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-30 04:37:36 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
if( PSA_ALG_IS_HMAC( operation->alg ) )
{
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
psa_hmac_abort_internal( &operation->ctx.hmac );
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
}
else
Phase 2 support for MBEDTLS_PSA_CRYPTO_CONFIG This phase adds in support for the following features being added to the list of features that can be configured in the include/psa/crypto_config.h header file using the PSA_WANT_ALG_xxx macros: ECDH, HMAC, HKDF, and RSA. These changes include changes to the PSA crypto library to use the appropriate new guards that will allow the feature to be compiled in or out either using new PSA_WANT_ALG_xxx or the previous MBEDTLS_xxx macros. For HKDF and HMAC, most of the PSA library code did not have a specific matching MBEDTLS_xxx macro for that feature, but was instead using the generic dependent MBEDTLS_MD_C macro. The ECDH and RSA features more closely aligned with a direct replacement with a similar macro. The new tests for RSA, HMAC, and HKDF would normally unset additional dependent macros, but when attempting to implement that level of testing it required removal of too many core features like MD_C, PK_C, ECP_C and other low level features. This may point to additional phases of work to complete the transition of these features to the new model. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-30 04:37:36 +00:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
{
/* Sanity check (shouldn't happen: operation->alg should
* always have been initialized to a valid value). */
goto bad_state;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
}
partly pr fix
2018-04-04 12:43:05 +00:00
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
operation->alg = 0;
operation->key_set = 0;
operation->iv_set = 0;
operation->iv_required = 0;
operation->has_input = 0;
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 18:12:23 +00:00
operation->is_sign = 0;
partly pr fix
2018-04-04 12:43:05 +00:00
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
return( PSA_SUCCESS );
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
bad_state:
/* If abort is called on an uninitialized object, we can't trust
* anything. Wipe the object in case it contains confidential data.
* This may result in a memory leak if a pointer gets overwritten,
* but it's too late to do anything about this. */
memset( operation, 0, sizeof( *operation ) );
return( PSA_ERROR_BAD_STATE );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
}
Fix build without CMAC Add missing guard for MBEDTLS_CMAC_C.
2018-06-19 09:57:35 +00:00
#if defined(MBEDTLS_CMAC_C)
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 18:12:23 +00:00
static int psa_cmac_setup( psa_mac_operation_t *operation,
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
size_t key_bits,
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 16:12:32 +00:00
psa_key_slot_t *slot,
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
const mbedtls_cipher_info_t *cipher_info )
{
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
operation->mac_size = cipher_info->block_size;
ret = mbedtls_cipher_setup( &operation->ctx.cmac, cipher_info );
if( ret != 0 )
return( ret );
ret = mbedtls_cipher_cmac_starts( &operation->ctx.cmac,
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:52:23 +00:00
slot->key.data,
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
key_bits );
return( ret );
}
Fix build without CMAC Add missing guard for MBEDTLS_CMAC_C.
2018-06-19 09:57:35 +00:00
#endif /* MBEDTLS_CMAC_C */
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 16:50:04 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
static psa_status_t psa_hmac_setup_internal( psa_hmac_internal_data *hmac,
const uint8_t *key,
size_t key_length,
psa_algorithm_t hash_alg )
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
{
Favor stdint.h types in internal types Use uint8_t for PSA buffers. Keep unsigned char for generic libc buffers and for mbedtls buffers.
2019-07-15 09:06:38 +00:00
uint8_t ipad[PSA_HMAC_MAX_HASH_BLOCK_SIZE];
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
size_t i;
Rename output buffer size macros Rename existing support macros for output buffer sizes for PSA Crypto API 1.0.0 Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-12-18 13:23:51 +00:00
size_t hash_size = PSA_HASH_LENGTH( hash_alg );
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
size_t block_size = psa_get_hash_block_size( hash_alg );
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
psa_status_t status;
HMAC: improve robustness checks on hash/block size In psa_mac_setup and psa_hmac_setup_internal, perform a sanity check on the hash size and the hash block size respectively. These sanity checks should only trigger on an incompletely or incorrectly implemented hash function. Remove the check on the block size in psa_hmac_finish_internal because at this point it has already been checked and used.
2018-07-15 22:36:29 +00:00
/* Sanity checks on block_size, to guarantee that there won't be a buffer
* overflow below. This should never trigger if the hash algorithm
* is implemented correctly. */
/* The size checks against the ipad and opad buffers cannot be written
* `block_size > sizeof( ipad ) || block_size > sizeof( hmac->opad )`
* because that triggers -Wlogical-op on GCC 7.3. */
if( block_size > sizeof( ipad ) )
return( PSA_ERROR_NOT_SUPPORTED );
if( block_size > sizeof( hmac->opad ) )
return( PSA_ERROR_NOT_SUPPORTED );
if( block_size < hash_size )
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
return( PSA_ERROR_NOT_SUPPORTED );
psa_hmac_start: reduce stack usage Store the temporary key in the long-key case (where the key is first hashed) directly into ipad. This reduces the stack usage a little, at a slight cost in complexity.
2018-06-11 16:12:58 +00:00
if( key_length > block_size )
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
{
Use psa_hash_compute in psa_hmac_setup_internal
2019-11-28 19:07:20 +00:00
status = psa_hash_compute( hash_alg, key, key_length,
ipad, sizeof( ipad ), &key_length );
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
if( status != PSA_SUCCESS )
psa_hmac_setup_internal: add some missing cleanup on failure Clean ipad if hashing the key failed.
2018-07-17 14:24:34 +00:00
goto cleanup;
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
}
MAC setup: support 0-length HMAC key Avoid undefined behavior when using a 0-length HMAC key (Asan complained).
2018-07-12 15:07:03 +00:00
/* A 0-length key is not commonly used in HMAC when used as a MAC,
* but it is permitted. It is common when HMAC is used in HKDF, for
* example. Don't call `memcpy` in the 0-length because `key` could be
* an invalid pointer which would make the behavior undefined. */
else if( key_length != 0 )
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
memcpy( ipad, key, key_length );
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
psa_hmac_start: reduce stack usage Store the temporary key in the long-key case (where the key is first hashed) directly into ipad. This reduces the stack usage a little, at a slight cost in complexity.
2018-06-11 16:12:58 +00:00
/* ipad contains the key followed by garbage. Xor and fill with 0x36
* to create the ipad value. */
for( i = 0; i < key_length; i++ )
ipad[i] ^= 0x36;
memset( ipad + key_length, 0x36, block_size - key_length );
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
psa_hmac_start: reduce stack usage Store the temporary key in the long-key case (where the key is first hashed) directly into ipad. This reduces the stack usage a little, at a slight cost in complexity.
2018-06-11 16:12:58 +00:00
/* Copy the key material from ipad to opad, flipping the requisite bits,
* and filling the rest of opad with the requisite constant. */
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
for( i = 0; i < key_length; i++ )
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
hmac->opad[i] = ipad[i] ^ 0x36 ^ 0x5C;
memset( hmac->opad + key_length, 0x5C, block_size - key_length );
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
status = psa_hash_setup( &hmac->hash_ctx, hash_alg );
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
if( status != PSA_SUCCESS )
HMAC: clean up local variables containing key material In psa_mac_start, the hash of the key and ipad contain material that can be used to make HMAC calculations with the key, therefore they must be wiped. In psa_mac_finish_internal, tmp contains an intermediate value which could reveal the HMAC. This is definitely sensitive in the verify case, and marginally sensitive in the finish case (it isn't if the hash function is ideal, but it could make things worse if the hash function is partially broken).
2018-06-11 15:42:48 +00:00
goto cleanup;
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
status = psa_hash_update( &hmac->hash_ctx, ipad, block_size );
HMAC: clean up local variables containing key material In psa_mac_start, the hash of the key and ipad contain material that can be used to make HMAC calculations with the key, therefore they must be wiped. In psa_mac_finish_internal, tmp contains an intermediate value which could reveal the HMAC. This is definitely sensitive in the verify case, and marginally sensitive in the finish case (it isn't if the hash function is ideal, but it could make things worse if the hash function is partially broken).
2018-06-11 15:42:48 +00:00
cleanup:
Style fixes * return is treated as a function call * space between opening and closing parentheses * remove whiteline between assignment and checking of same variable Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-05 13:43:42 +00:00
mbedtls_platform_zeroize( ipad, sizeof( ipad ) );
HMAC: clean up local variables containing key material In psa_mac_start, the hash of the key and ipad contain material that can be used to make HMAC calculations with the key, therefore they must be wiped. In psa_mac_finish_internal, tmp contains an intermediate value which could reveal the HMAC. This is definitely sensitive in the verify case, and marginally sensitive in the finish case (it isn't if the hash function is ideal, but it could make things worse if the hash function is partially broken).
2018-06-11 15:42:48 +00:00
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
return( status );
}
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 16:50:04 +00:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 18:12:23 +00:00
static psa_status_t psa_mac_setup( psa_mac_operation_t *operation,
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
mbedtls_svc_key_id_t key,
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 18:12:23 +00:00
psa_algorithm_t alg,
int is_sign )
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
{
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 16:12:32 +00:00
psa_key_slot_t *slot;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
size_t key_bits;
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 18:12:23 +00:00
psa_key_usage_t usage =
Rename some signature-related identifiers Rename some macros and functions related to signature which are changing as part of the addition of psa_sign_message and psa_verify_message. perl -i -pe '%t = ( PSA_KEY_USAGE_SIGN => PSA_KEY_USAGE_SIGN_HASH, PSA_KEY_USAGE_VERIFY => PSA_KEY_USAGE_VERIFY_HASH, PSA_ASYMMETRIC_SIGNATURE_MAX_SIZE => PSA_SIGNATURE_MAX_SIZE, PSA_ASYMMETRIC_SIGN_OUTPUT_SIZE => PSA_SIGN_OUTPUT_SIZE, psa_asymmetric_sign => psa_sign_hash, psa_asymmetric_verify => psa_verify_hash, ); s/\b(@{[join("|", keys %t)]})\b/$t{$1}/ge' $(git ls-files . ':!:**/crypto_compat.h')
2019-11-26 16:01:59 +00:00
is_sign ? PSA_KEY_USAGE_SIGN_HASH : PSA_KEY_USAGE_VERIFY_HASH;
Favor stdint.h types in internal types Use uint8_t for PSA buffers. Keep unsigned char for generic libc buffers and for mbedtls buffers.
2019-07-15 09:06:38 +00:00
uint8_t truncated = PSA_MAC_TRUNCATED_LENGTH( alg );
New macro PSA_ALG_FULL_LENGTH_MAC Provide a documented way of constructing the full-length MAC algorithm from a truncated version.
2018-10-17 16:28:05 +00:00
psa_algorithm_t full_length_alg = PSA_ALG_FULL_LENGTH_MAC( alg );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
psa: Disallow repeated setup Calling psa_*_setup() twice on a MAC, cipher, or hash context should result in a PSA_ERROR_BAD_STATE error because the operation has already been set up. Fixes #10
2019-02-19 09:25:10 +00:00
/* A context must be freshly initialized before it can be set up. */
if( operation->alg != 0 )
{
return( PSA_ERROR_BAD_STATE );
}
Add support for truncated MAC algorithms
2018-08-14 13:18:45 +00:00
status = psa_mac_init( operation, full_length_alg );
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 14:05:20 +00:00
if( status != PSA_SUCCESS )
return( status );
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 18:12:23 +00:00
if( is_sign )
operation->is_sign = 1;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
status = psa_get_and_lock_transparent_key_slot_with_policy(
key, &slot, usage, alg );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 15:01:38 +00:00
if( status != PSA_SUCCESS )
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
goto exit;
Implement missing attributes setters and getters
2019-04-18 10:53:01 +00:00
key_bits = psa_get_key_slot_bits( slot );
Don't call psa_get_key_information internally When you have a key slot pointer, read the key type directly, and call psa_get_key_bits to get the bit size.
2018-07-06 14:07:47 +00:00
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
#if defined(MBEDTLS_CMAC_C)
Add support for truncated MAC algorithms
2018-08-14 13:18:45 +00:00
if( full_length_alg == PSA_ALG_CMAC )
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
{
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
const mbedtls_cipher_info_t *cipher_info =
Add support for truncated MAC algorithms
2018-08-14 13:18:45 +00:00
mbedtls_cipher_info_from_psa( full_length_alg,
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
slot->attr.type, key_bits, NULL );
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
if( cipher_info == NULL )
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
{
status = PSA_ERROR_NOT_SUPPORTED;
goto exit;
}
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
operation->mac_size = cipher_info->block_size;
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
ret = psa_cmac_setup( operation, key_bits, slot, cipher_info );
status = mbedtls_to_psa_error( ret );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
}
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
else
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
#endif /* MBEDTLS_CMAC_C */
Phase 2 support for MBEDTLS_PSA_CRYPTO_CONFIG This phase adds in support for the following features being added to the list of features that can be configured in the include/psa/crypto_config.h header file using the PSA_WANT_ALG_xxx macros: ECDH, HMAC, HKDF, and RSA. These changes include changes to the PSA crypto library to use the appropriate new guards that will allow the feature to be compiled in or out either using new PSA_WANT_ALG_xxx or the previous MBEDTLS_xxx macros. For HKDF and HMAC, most of the PSA library code did not have a specific matching MBEDTLS_xxx macro for that feature, but was instead using the generic dependent MBEDTLS_MD_C macro. The ECDH and RSA features more closely aligned with a direct replacement with a similar macro. The new tests for RSA, HMAC, and HKDF would normally unset additional dependent macros, but when attempting to implement that level of testing it required removal of too many core features like MD_C, PK_C, ECP_C and other low level features. This may point to additional phases of work to complete the transition of these features to the new model. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-30 04:37:36 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Add support for truncated MAC algorithms
2018-08-14 13:18:45 +00:00
if( PSA_ALG_IS_HMAC( full_length_alg ) )
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
{
Rename PSA_ALG_HMAC_HASH to PSA_ALG_HMAC_GET_HASH Be consistent with other GET_HASH macros.
2018-08-22 16:25:41 +00:00
psa_algorithm_t hash_alg = PSA_ALG_HMAC_GET_HASH( alg );
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
if( hash_alg == 0 )
{
status = PSA_ERROR_NOT_SUPPORTED;
goto exit;
}
HMAC: improve robustness checks on hash/block size In psa_mac_setup and psa_hmac_setup_internal, perform a sanity check on the hash size and the hash block size respectively. These sanity checks should only trigger on an incompletely or incorrectly implemented hash function. Remove the check on the block size in psa_hmac_finish_internal because at this point it has already been checked and used.
2018-07-15 22:36:29 +00:00
Rename output buffer size macros Rename existing support macros for output buffer sizes for PSA Crypto API 1.0.0 Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-12-18 13:23:51 +00:00
operation->mac_size = PSA_HASH_LENGTH( hash_alg );
HMAC: improve robustness checks on hash/block size In psa_mac_setup and psa_hmac_setup_internal, perform a sanity check on the hash size and the hash block size respectively. These sanity checks should only trigger on an incompletely or incorrectly implemented hash function. Remove the check on the block size in psa_hmac_finish_internal because at this point it has already been checked and used.
2018-07-15 22:36:29 +00:00
/* Sanity check. This shouldn't fail on a valid configuration. */
if( operation->mac_size == 0 ||
operation->mac_size > sizeof( operation->ctx.hmac.opad ) )
{
status = PSA_ERROR_NOT_SUPPORTED;
goto exit;
}
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( slot->attr.type != PSA_KEY_TYPE_HMAC )
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
{
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
}
HMAC: improve robustness checks on hash/block size In psa_mac_setup and psa_hmac_setup_internal, perform a sanity check on the hash size and the hash block size respectively. These sanity checks should only trigger on an incompletely or incorrectly implemented hash function. Remove the check on the block size in psa_hmac_finish_internal because at this point it has already been checked and used.
2018-07-15 22:36:29 +00:00
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
status = psa_hmac_setup_internal( &operation->ctx.hmac,
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:52:23 +00:00
slot->key.data,
slot->key.bytes,
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
hash_alg );
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
}
else
Phase 2 support for MBEDTLS_PSA_CRYPTO_CONFIG This phase adds in support for the following features being added to the list of features that can be configured in the include/psa/crypto_config.h header file using the PSA_WANT_ALG_xxx macros: ECDH, HMAC, HKDF, and RSA. These changes include changes to the PSA crypto library to use the appropriate new guards that will allow the feature to be compiled in or out either using new PSA_WANT_ALG_xxx or the previous MBEDTLS_xxx macros. For HKDF and HMAC, most of the PSA library code did not have a specific matching MBEDTLS_xxx macro for that feature, but was instead using the generic dependent MBEDTLS_MD_C macro. The ECDH and RSA features more closely aligned with a direct replacement with a similar macro. The new tests for RSA, HMAC, and HKDF would normally unset additional dependent macros, but when attempting to implement that level of testing it required removal of too many core features like MD_C, PK_C, ECP_C and other low level features. This may point to additional phases of work to complete the transition of these features to the new model. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-30 04:37:36 +00:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
{
psa: Unused key_bits is OK When MD or CMAC are disabled, let the compiler know that it is OK that `key_bits` is set but not used by casting `key_bits` to `(void)`.
2018-11-23 15:11:20 +00:00
(void) key_bits;
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
status = PSA_ERROR_NOT_SUPPORTED;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
}
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
Add support for truncated MAC algorithms
2018-08-14 13:18:45 +00:00
if( truncated == 0 )
{
/* The "normal" case: untruncated algorithm. Nothing to do. */
}
else if( truncated < 4 )
{
Document that the minimum truncated MAC length is implementation-defined
2018-08-21 12:55:08 +00:00
/* A very short MAC is too short for security since it can be
* brute-forced. Ancient protocols with 32-bit MACs do exist,
* so we make this our minimum, even though 32 bits is still
* too small for security. */
Add support for truncated MAC algorithms
2018-08-14 13:18:45 +00:00
status = PSA_ERROR_NOT_SUPPORTED;
}
else if( truncated > operation->mac_size )
{
/* It's impossible to "truncate" to a larger length. */
status = PSA_ERROR_INVALID_ARGUMENT;
}
else
operation->mac_size = truncated;
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
exit:
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
if( status != PSA_SUCCESS )
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
{
HMAC: clean up local variables containing key material In psa_mac_start, the hash of the key and ipad contain material that can be used to make HMAC calculations with the key, therefore they must be wiped. In psa_mac_finish_internal, tmp contains an intermediate value which could reveal the HMAC. This is definitely sensitive in the verify case, and marginally sensitive in the finish case (it isn't if the hash function is ideal, but it could make things worse if the hash function is partially broken).
2018-06-11 15:42:48 +00:00
psa_mac_abort( operation );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
}
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
else
{
operation->key_set = 1;
}
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
unlock_status = psa_unlock_key_slot( slot );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
return( ( status == PSA_SUCCESS ) ? unlock_status : status );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
}
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 18:12:23 +00:00
psa_status_t psa_mac_sign_setup( psa_mac_operation_t *operation,
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
mbedtls_svc_key_id_t key,
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 18:12:23 +00:00
psa_algorithm_t alg )
{
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
return( psa_mac_setup( operation, key, alg, 1 ) );
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 18:12:23 +00:00
}
psa_status_t psa_mac_verify_setup( psa_mac_operation_t *operation,
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
mbedtls_svc_key_id_t key,
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 18:12:23 +00:00
psa_algorithm_t alg )
{
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
return( psa_mac_setup( operation, key, alg, 0 ) );
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 18:12:23 +00:00
}
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
psa_status_t psa_mac_update( psa_mac_operation_t *operation,
const uint8_t *input,
size_t input_length )
{
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
psa_status_t status = PSA_ERROR_BAD_STATE;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
if( ! operation->key_set )
psa: Don't abort when operations are invalid In places where we detect a context is in a bad state and there is no sensitive data to clear, simply return PSA_ERROR_BAD_STATE and don't abort on behalf of the application. The application will choose what to do when it gets a bad state error. The motivation for this change is that an application should decide what to do when it misuses the API and encounters a PSA_ERROR_BAD_STATE error. The library should not attempt to abort on behalf of the application, as that may not be the correct thing to do in all circumstances.
2019-02-20 15:37:15 +00:00
return( PSA_ERROR_BAD_STATE );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
if( operation->iv_required && ! operation->iv_set )
psa: Don't abort when operations are invalid In places where we detect a context is in a bad state and there is no sensitive data to clear, simply return PSA_ERROR_BAD_STATE and don't abort on behalf of the application. The application will choose what to do when it gets a bad state error. The motivation for this change is that an application should decide what to do when it misuses the API and encounters a PSA_ERROR_BAD_STATE error. The library should not attempt to abort on behalf of the application, as that may not be the correct thing to do in all circumstances.
2019-02-20 15:37:15 +00:00
return( PSA_ERROR_BAD_STATE );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
operation->has_input = 1;
#if defined(MBEDTLS_CMAC_C)
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
if( operation->alg == PSA_ALG_CMAC )
{
int ret = mbedtls_cipher_cmac_update( &operation->ctx.cmac,
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
input, input_length );
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
status = mbedtls_to_psa_error( ret );
}
else
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
#endif /* MBEDTLS_CMAC_C */
Phase 2 support for MBEDTLS_PSA_CRYPTO_CONFIG This phase adds in support for the following features being added to the list of features that can be configured in the include/psa/crypto_config.h header file using the PSA_WANT_ALG_xxx macros: ECDH, HMAC, HKDF, and RSA. These changes include changes to the PSA crypto library to use the appropriate new guards that will allow the feature to be compiled in or out either using new PSA_WANT_ALG_xxx or the previous MBEDTLS_xxx macros. For HKDF and HMAC, most of the PSA library code did not have a specific matching MBEDTLS_xxx macro for that feature, but was instead using the generic dependent MBEDTLS_MD_C macro. The ECDH and RSA features more closely aligned with a direct replacement with a similar macro. The new tests for RSA, HMAC, and HKDF would normally unset additional dependent macros, but when attempting to implement that level of testing it required removal of too many core features like MD_C, PK_C, ECP_C and other low level features. This may point to additional phases of work to complete the transition of these features to the new model. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-30 04:37:36 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
if( PSA_ALG_IS_HMAC( operation->alg ) )
{
status = psa_hash_update( &operation->ctx.hmac.hash_ctx, input,
input_length );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
}
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
else
Phase 2 support for MBEDTLS_PSA_CRYPTO_CONFIG This phase adds in support for the following features being added to the list of features that can be configured in the include/psa/crypto_config.h header file using the PSA_WANT_ALG_xxx macros: ECDH, HMAC, HKDF, and RSA. These changes include changes to the PSA crypto library to use the appropriate new guards that will allow the feature to be compiled in or out either using new PSA_WANT_ALG_xxx or the previous MBEDTLS_xxx macros. For HKDF and HMAC, most of the PSA library code did not have a specific matching MBEDTLS_xxx macro for that feature, but was instead using the generic dependent MBEDTLS_MD_C macro. The ECDH and RSA features more closely aligned with a direct replacement with a similar macro. The new tests for RSA, HMAC, and HKDF would normally unset additional dependent macros, but when attempting to implement that level of testing it required removal of too many core features like MD_C, PK_C, ECP_C and other low level features. This may point to additional phases of work to complete the transition of these features to the new model. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-30 04:37:36 +00:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
Commit changes to hmac to not use MD abstraction this PR is part of efforts to use "lower level" mbedTLS APIs vs "higher level" abstract APIs.
2018-06-04 13:03:32 +00:00
{
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
/* This shouldn't happen if `operation` was initialized by
* a setup function. */
psa: Don't abort when operations are invalid In places where we detect a context is in a bad state and there is no sensitive data to clear, simply return PSA_ERROR_BAD_STATE and don't abort on behalf of the application. The application will choose what to do when it gets a bad state error. The motivation for this change is that an application should decide what to do when it misuses the API and encounters a PSA_ERROR_BAD_STATE error. The library should not attempt to abort on behalf of the application, as that may not be the correct thing to do in all circumstances.
2019-02-20 15:37:15 +00:00
return( PSA_ERROR_BAD_STATE );
Commit changes to hmac to not use MD abstraction this PR is part of efforts to use "lower level" mbedTLS APIs vs "higher level" abstract APIs.
2018-06-04 13:03:32 +00:00
}
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
if( status != PSA_SUCCESS )
psa_mac_abort( operation );
Formatting improvements Avoid lines longer than 80 columns. Remove some redundant parentheses, e.g. change if( ( a == b ) && ( c == d ) ) to if( a == b && c == d ) which makes lines less long and makes the remaining parentheses more relevant. Add missing parentheses around return statements. There should be no semantic change in this commit.
2018-06-18 14:04:39 +00:00
return( status );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
}
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 16:50:04 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
static psa_status_t psa_hmac_finish_internal( psa_hmac_internal_data *hmac,
uint8_t *mac,
size_t mac_size )
{
Favor stdint.h types in internal types Use uint8_t for PSA buffers. Keep unsigned char for generic libc buffers and for mbedtls buffers.
2019-07-15 09:06:38 +00:00
uint8_t tmp[MBEDTLS_MD_MAX_SIZE];
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
psa_algorithm_t hash_alg = hmac->hash_ctx.alg;
size_t hash_size = 0;
size_t block_size = psa_get_hash_block_size( hash_alg );
psa_status_t status;
status = psa_hash_finish( &hmac->hash_ctx, tmp, sizeof( tmp ), &hash_size );
if( status != PSA_SUCCESS )
return( status );
/* From here on, tmp needs to be wiped. */
status = psa_hash_setup( &hmac->hash_ctx, hash_alg );
if( status != PSA_SUCCESS )
goto exit;
status = psa_hash_update( &hmac->hash_ctx, hmac->opad, block_size );
if( status != PSA_SUCCESS )
goto exit;
status = psa_hash_update( &hmac->hash_ctx, tmp, hash_size );
if( status != PSA_SUCCESS )
goto exit;
Add support for truncated MAC algorithms
2018-08-14 13:18:45 +00:00
status = psa_hash_finish( &hmac->hash_ctx, tmp, sizeof( tmp ), &hash_size );
if( status != PSA_SUCCESS )
goto exit;
memcpy( mac, tmp, mac_size );
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
exit:
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 17:14:53 +00:00
mbedtls_platform_zeroize( tmp, hash_size );
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
return( status );
}
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 16:50:04 +00:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
Add static internal MAC finish function add new psa_mac_finish_internal() to be called by psa_mac_finish() and psa_mac_verify() in order to be able to check key usage separatly.
2018-04-02 15:34:15 +00:00
static psa_status_t psa_mac_finish_internal( psa_mac_operation_t *operation,
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 13:41:12 +00:00
uint8_t *mac,
Streamline cleanup logic in MAC finish Reorganize error handling code in psa_mac_finish_internal, psa_mac_sign_finish and psa_mac_verify finish to ensure that: * psa_mac_abort() is always called, on all success and error paths. * psa_mac_finish places a safe value in the output parameters on all error paths, even if abort fails.
2018-07-08 18:35:02 +00:00
size_t mac_size )
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
{
In psa_mac_finish, write a safe output even in the BAD_STATE case
2018-07-02 10:15:39 +00:00
if( ! operation->key_set )
return( PSA_ERROR_BAD_STATE );
if( operation->iv_required && ! operation->iv_set )
return( PSA_ERROR_BAD_STATE );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
if( mac_size < operation->mac_size )
return( PSA_ERROR_BUFFER_TOO_SMALL );
#if defined(MBEDTLS_CMAC_C)
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
if( operation->alg == PSA_ALG_CMAC )
{
Rename output buffer size macros Rename existing support macros for output buffer sizes for PSA Crypto API 1.0.0 Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-12-18 13:23:51 +00:00
uint8_t tmp[PSA_BLOCK_CIPHER_BLOCK_MAX_SIZE];
Add support for truncated MAC algorithms
2018-08-14 13:18:45 +00:00
int ret = mbedtls_cipher_cmac_finish( &operation->ctx.cmac, tmp );
if( ret == 0 )
Fix possible buffer overread in psa_mac_finish_internal (CMAC)
2018-08-21 12:55:49 +00:00
memcpy( mac, tmp, operation->mac_size );
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 17:14:53 +00:00
mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
return( mbedtls_to_psa_error( ret ) );
}
else
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
#endif /* MBEDTLS_CMAC_C */
Phase 2 support for MBEDTLS_PSA_CRYPTO_CONFIG This phase adds in support for the following features being added to the list of features that can be configured in the include/psa/crypto_config.h header file using the PSA_WANT_ALG_xxx macros: ECDH, HMAC, HKDF, and RSA. These changes include changes to the PSA crypto library to use the appropriate new guards that will allow the feature to be compiled in or out either using new PSA_WANT_ALG_xxx or the previous MBEDTLS_xxx macros. For HKDF and HMAC, most of the PSA library code did not have a specific matching MBEDTLS_xxx macro for that feature, but was instead using the generic dependent MBEDTLS_MD_C macro. The ECDH and RSA features more closely aligned with a direct replacement with a similar macro. The new tests for RSA, HMAC, and HKDF would normally unset additional dependent macros, but when attempting to implement that level of testing it required removal of too many core features like MD_C, PK_C, ECP_C and other low level features. This may point to additional phases of work to complete the transition of these features to the new model. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-30 04:37:36 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
if( PSA_ALG_IS_HMAC( operation->alg ) )
{
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
return( psa_hmac_finish_internal( &operation->ctx.hmac,
Add support for truncated MAC algorithms
2018-08-14 13:18:45 +00:00
mac, operation->mac_size ) );
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
}
else
Phase 2 support for MBEDTLS_PSA_CRYPTO_CONFIG This phase adds in support for the following features being added to the list of features that can be configured in the include/psa/crypto_config.h header file using the PSA_WANT_ALG_xxx macros: ECDH, HMAC, HKDF, and RSA. These changes include changes to the PSA crypto library to use the appropriate new guards that will allow the feature to be compiled in or out either using new PSA_WANT_ALG_xxx or the previous MBEDTLS_xxx macros. For HKDF and HMAC, most of the PSA library code did not have a specific matching MBEDTLS_xxx macro for that feature, but was instead using the generic dependent MBEDTLS_MD_C macro. The ECDH and RSA features more closely aligned with a direct replacement with a similar macro. The new tests for RSA, HMAC, and HKDF would normally unset additional dependent macros, but when attempting to implement that level of testing it required removal of too many core features like MD_C, PK_C, ECP_C and other low level features. This may point to additional phases of work to complete the transition of these features to the new model. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-30 04:37:36 +00:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
{
/* This shouldn't happen if `operation` was initialized by
* a setup function. */
return( PSA_ERROR_BAD_STATE );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
}
}
Rename psa_mac_{finish,verify} -> psa_mac_{sign,verify}_finish Make function names for multipart operations more consistent (MAC finish edition).
2018-07-08 17:56:25 +00:00
psa_status_t psa_mac_sign_finish( psa_mac_operation_t *operation,
uint8_t *mac,
size_t mac_size,
size_t *mac_length )
Add static internal MAC finish function add new psa_mac_finish_internal() to be called by psa_mac_finish() and psa_mac_verify() in order to be able to check key usage separatly.
2018-04-02 15:34:15 +00:00
{
Streamline cleanup logic in MAC finish Reorganize error handling code in psa_mac_finish_internal, psa_mac_sign_finish and psa_mac_verify finish to ensure that: * psa_mac_abort() is always called, on all success and error paths. * psa_mac_finish places a safe value in the output parameters on all error paths, even if abort fails.
2018-07-08 18:35:02 +00:00
psa_status_t status;
psa: Disallow use of invalid MAC contexts Ensure that when doing MAC operations out of order, PSA_ERROR_BAD_STATE is returned as documented in crypto.h and the PSA Crypto specification.
2019-02-15 14:05:35 +00:00
if( operation->alg == 0 )
{
return( PSA_ERROR_BAD_STATE );
}
Streamline cleanup logic in MAC finish Reorganize error handling code in psa_mac_finish_internal, psa_mac_sign_finish and psa_mac_verify finish to ensure that: * psa_mac_abort() is always called, on all success and error paths. * psa_mac_finish places a safe value in the output parameters on all error paths, even if abort fails.
2018-07-08 18:35:02 +00:00
/* Fill the output buffer with something that isn't a valid mac
* (barring an attack on the mac and deliberately-crafted input),
* in case the caller doesn't check the return status properly. */
*mac_length = mac_size;
/* If mac_size is 0 then mac may be NULL and then the
* call to memset would have undefined behavior. */
if( mac_size != 0 )
memset( mac, '!', mac_size );
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 18:12:23 +00:00
if( ! operation->is_sign )
{
psa: Don't abort when operations are invalid In places where we detect a context is in a bad state and there is no sensitive data to clear, simply return PSA_ERROR_BAD_STATE and don't abort on behalf of the application. The application will choose what to do when it gets a bad state error. The motivation for this change is that an application should decide what to do when it misuses the API and encounters a PSA_ERROR_BAD_STATE error. The library should not attempt to abort on behalf of the application, as that may not be the correct thing to do in all circumstances.
2019-02-20 15:37:15 +00:00
return( PSA_ERROR_BAD_STATE );
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 18:12:23 +00:00
}
Add static internal MAC finish function add new psa_mac_finish_internal() to be called by psa_mac_finish() and psa_mac_verify() in order to be able to check key usage separatly.
2018-04-02 15:34:15 +00:00
Streamline cleanup logic in MAC finish Reorganize error handling code in psa_mac_finish_internal, psa_mac_sign_finish and psa_mac_verify finish to ensure that: * psa_mac_abort() is always called, on all success and error paths. * psa_mac_finish places a safe value in the output parameters on all error paths, even if abort fails.
2018-07-08 18:35:02 +00:00
status = psa_mac_finish_internal( operation, mac, mac_size );
if( status == PSA_SUCCESS )
{
status = psa_mac_abort( operation );
if( status == PSA_SUCCESS )
*mac_length = operation->mac_size;
else
memset( mac, '!', mac_size );
}
else
psa_mac_abort( operation );
return( status );
Add static internal MAC finish function add new psa_mac_finish_internal() to be called by psa_mac_finish() and psa_mac_verify() in order to be able to check key usage separatly.
2018-04-02 15:34:15 +00:00
}
Rename psa_mac_{finish,verify} -> psa_mac_{sign,verify}_finish Make function names for multipart operations more consistent (MAC finish edition).
2018-07-08 17:56:25 +00:00
psa_status_t psa_mac_verify_finish( psa_mac_operation_t *operation,
const uint8_t *mac,
size_t mac_length )
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
{
Rename MBEDTLS_xxx macros in psa_crypto.c to placate check-names.sh
2018-06-18 21:25:51 +00:00
uint8_t actual_mac[PSA_MAC_MAX_SIZE];
Add static internal MAC finish function add new psa_mac_finish_internal() to be called by psa_mac_finish() and psa_mac_verify() in order to be able to check key usage separatly.
2018-04-02 15:34:15 +00:00
psa_status_t status;
psa: Disallow use of invalid MAC contexts Ensure that when doing MAC operations out of order, PSA_ERROR_BAD_STATE is returned as documented in crypto.h and the PSA Crypto specification.
2019-02-15 14:05:35 +00:00
if( operation->alg == 0 )
{
return( PSA_ERROR_BAD_STATE );
}
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 18:12:23 +00:00
if( operation->is_sign )
{
psa: Don't abort when operations are invalid In places where we detect a context is in a bad state and there is no sensitive data to clear, simply return PSA_ERROR_BAD_STATE and don't abort on behalf of the application. The application will choose what to do when it gets a bad state error. The motivation for this change is that an application should decide what to do when it misuses the API and encounters a PSA_ERROR_BAD_STATE error. The library should not attempt to abort on behalf of the application, as that may not be the correct thing to do in all circumstances.
2019-02-20 15:37:15 +00:00
return( PSA_ERROR_BAD_STATE );
Streamline cleanup logic in MAC finish Reorganize error handling code in psa_mac_finish_internal, psa_mac_sign_finish and psa_mac_verify finish to ensure that: * psa_mac_abort() is always called, on all success and error paths. * psa_mac_finish places a safe value in the output parameters on all error paths, even if abort fails.
2018-07-08 18:35:02 +00:00
}
if( operation->mac_size != mac_length )
{
status = PSA_ERROR_INVALID_SIGNATURE;
goto cleanup;
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 18:12:23 +00:00
}
Add static internal MAC finish function add new psa_mac_finish_internal() to be called by psa_mac_finish() and psa_mac_verify() in order to be able to check key usage separatly.
2018-04-02 15:34:15 +00:00
status = psa_mac_finish_internal( operation,
Streamline cleanup logic in MAC finish Reorganize error handling code in psa_mac_finish_internal, psa_mac_sign_finish and psa_mac_verify finish to ensure that: * psa_mac_abort() is always called, on all success and error paths. * psa_mac_finish places a safe value in the output parameters on all error paths, even if abort fails.
2018-07-08 18:35:02 +00:00
actual_mac, sizeof( actual_mac ) );
Fix possible error code mangling in psa_mac_verify_finish If psa_mac_finish_internal fails (which can only happen due to bad parameters or hardware problem), the error code was converted to PSA_ERROR_INVALID_SIGNATURE if the uninitialized stack variable actual_mac happened to contain the expected MAC. This is a minor bug but it may be possible to leverage it as part of a longer attack path in some scenarios. Reported externally. Found by static analysis.
2020-01-20 15:31:06 +00:00
if( status != PSA_SUCCESS )
goto cleanup;
Streamline cleanup logic in MAC finish Reorganize error handling code in psa_mac_finish_internal, psa_mac_sign_finish and psa_mac_verify finish to ensure that: * psa_mac_abort() is always called, on all success and error paths. * psa_mac_finish places a safe value in the output parameters on all error paths, even if abort fails.
2018-07-08 18:35:02 +00:00
if( safer_memcmp( mac, actual_mac, mac_length ) != 0 )
status = PSA_ERROR_INVALID_SIGNATURE;
cleanup:
if( status == PSA_SUCCESS )
status = psa_mac_abort( operation );
else
psa_mac_abort( operation );
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 17:14:53 +00:00
mbedtls_platform_zeroize( actual_mac, sizeof( actual_mac ) );
Add support for truncated MAC algorithms
2018-08-14 13:18:45 +00:00
Streamline cleanup logic in MAC finish Reorganize error handling code in psa_mac_finish_internal, psa_mac_sign_finish and psa_mac_verify finish to ensure that: * psa_mac_abort() is always called, on all success and error paths. * psa_mac_finish places a safe value in the output parameters on all error paths, even if abort fails.
2018-07-08 18:35:02 +00:00
return( status );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
}
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
/****************************************************************/
/* Asymmetric cryptography */
/****************************************************************/
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 16:50:04 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
Rename verify_RSA_hash_input_and_get_md_type Give it a shorter name that's more in line with our naming conventions.
2018-06-08 14:34:46 +00:00
/* Decode the hash algorithm from alg and store the mbedtls encoding in
Allow RSA PSS with any input size Although RSASSA-PSS defines its input as a message to be hashed, we implement a sign-the-hash function. This function can take an input which isn't a hash, so don't restrict the size of the input, any more than Mbed TLS does. Remove a redundant check that hash_length fits in unsigned int for the sake of Mbed TLS RSA functions. Test that PSS accepts inputs of various lengths. For PKCS#1 v1.5 signature in raw mode, test the maximum input length.
2018-06-29 21:36:35 +00:00
* md_alg. Verify that the hash length is acceptable. */
Rename verify_RSA_hash_input_and_get_md_type Give it a shorter name that's more in line with our naming conventions.
2018-06-08 14:34:46 +00:00
static psa_status_t psa_rsa_decode_md_type( psa_algorithm_t alg,
size_t hash_length,
mbedtls_md_type_t *md_alg )
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
{
Rename PSA_ALG_RSA_GET_HASH to PSA_ALG_SIGN_GET_HASH And don't use it for HMAC when there's a perfectly serviceable PSA_ALG_HMAC_HASH. HMAC isn't hash-and-sign.
2018-06-26 13:50:08 +00:00
psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH( alg );
Normalize whitespace to Mbed TLS standards Only whitespace changes in this commit.
2018-06-08 14:09:36 +00:00
const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa( hash_alg );
Allow RSA PSS with any input size Although RSASSA-PSS defines its input as a message to be hashed, we implement a sign-the-hash function. This function can take an input which isn't a hash, so don't restrict the size of the input, any more than Mbed TLS does. Remove a redundant check that hash_length fits in unsigned int for the sake of Mbed TLS RSA functions. Test that PSS accepts inputs of various lengths. For PKCS#1 v1.5 signature in raw mode, test the maximum input length.
2018-06-29 21:36:35 +00:00
*md_alg = mbedtls_md_get_type( md_info );
/* The Mbed TLS RSA module uses an unsigned int for hash length
* parameters. Validate that it fits so that we don't risk an
* overflow later. */
Extract common code Make code easier to maintain.
2018-06-04 13:40:31 +00:00
#if SIZE_MAX > UINT_MAX
Allow RSA PSS with any input size Although RSASSA-PSS defines its input as a message to be hashed, we implement a sign-the-hash function. This function can take an input which isn't a hash, so don't restrict the size of the input, any more than Mbed TLS does. Remove a redundant check that hash_length fits in unsigned int for the sake of Mbed TLS RSA functions. Test that PSS accepts inputs of various lengths. For PKCS#1 v1.5 signature in raw mode, test the maximum input length.
2018-06-29 21:36:35 +00:00
if( hash_length > UINT_MAX )
return( PSA_ERROR_INVALID_ARGUMENT );
Extract common code Make code easier to maintain.
2018-06-04 13:40:31 +00:00
#endif
Allow RSA PSS with any input size Although RSASSA-PSS defines its input as a message to be hashed, we implement a sign-the-hash function. This function can take an input which isn't a hash, so don't restrict the size of the input, any more than Mbed TLS does. Remove a redundant check that hash_length fits in unsigned int for the sake of Mbed TLS RSA functions. Test that PSS accepts inputs of various lengths. For PKCS#1 v1.5 signature in raw mode, test the maximum input length.
2018-06-29 21:36:35 +00:00
Add feature support for RSA for PSA crypto config In the original attempt to add RSA support to PSA crypto config was too generic. This set of changes adds support for the following RSA features: PSA_WANT_ALG_RSA_PKCS1V15_CRYPT, PSA_WANT_ALG_RSA_PKCS1V15_SIGN, PSA_WANT_ALG_RSA_OAEP, PSA_WANT_ALG_RSA_PSS, PSA_WANT_KEY_TYPE_RSA_KEY_PAIR, and PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY. There were also some updates to ensure the proper inclusion of PSA crypto library code when certain features are enabled. These updates were made to address warnings and errors in builds from the new tests for these features being added for PSA crypto configuration. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-01 05:06:54 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN)
Allow RSA PSS with any input size Although RSASSA-PSS defines its input as a message to be hashed, we implement a sign-the-hash function. This function can take an input which isn't a hash, so don't restrict the size of the input, any more than Mbed TLS does. Remove a redundant check that hash_length fits in unsigned int for the sake of Mbed TLS RSA functions. Test that PSS accepts inputs of various lengths. For PKCS#1 v1.5 signature in raw mode, test the maximum input length.
2018-06-29 21:36:35 +00:00
/* For PKCS#1 v1.5 signature, if using a hash, the hash length
* must be correct. */
if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) &&
alg != PSA_ALG_RSA_PKCS1V15_SIGN_RAW )
Extract common code Make code easier to maintain.
2018-06-04 13:40:31 +00:00
{
Allow RSA PSS with any input size Although RSASSA-PSS defines its input as a message to be hashed, we implement a sign-the-hash function. This function can take an input which isn't a hash, so don't restrict the size of the input, any more than Mbed TLS does. Remove a redundant check that hash_length fits in unsigned int for the sake of Mbed TLS RSA functions. Test that PSS accepts inputs of various lengths. For PKCS#1 v1.5 signature in raw mode, test the maximum input length.
2018-06-29 21:36:35 +00:00
if( md_info == NULL )
return( PSA_ERROR_NOT_SUPPORTED );
Normalize whitespace to Mbed TLS standards Only whitespace changes in this commit.
2018-06-08 14:09:36 +00:00
if( mbedtls_md_get_size( md_info ) != hash_length )
return( PSA_ERROR_INVALID_ARGUMENT );
Allow RSA PSS with any input size Although RSASSA-PSS defines its input as a message to be hashed, we implement a sign-the-hash function. This function can take an input which isn't a hash, so don't restrict the size of the input, any more than Mbed TLS does. Remove a redundant check that hash_length fits in unsigned int for the sake of Mbed TLS RSA functions. Test that PSS accepts inputs of various lengths. For PKCS#1 v1.5 signature in raw mode, test the maximum input length.
2018-06-29 21:36:35 +00:00
}
Add feature support for RSA for PSA crypto config In the original attempt to add RSA support to PSA crypto config was too generic. This set of changes adds support for the following RSA features: PSA_WANT_ALG_RSA_PKCS1V15_CRYPT, PSA_WANT_ALG_RSA_PKCS1V15_SIGN, PSA_WANT_ALG_RSA_OAEP, PSA_WANT_ALG_RSA_PSS, PSA_WANT_KEY_TYPE_RSA_KEY_PAIR, and PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY. There were also some updates to ensure the proper inclusion of PSA crypto library code when certain features are enabled. These updates were made to address warnings and errors in builds from the new tests for these features being added for PSA crypto configuration. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-01 05:06:54 +00:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN */
Allow RSA PSS with any input size Although RSASSA-PSS defines its input as a message to be hashed, we implement a sign-the-hash function. This function can take an input which isn't a hash, so don't restrict the size of the input, any more than Mbed TLS does. Remove a redundant check that hash_length fits in unsigned int for the sake of Mbed TLS RSA functions. Test that PSS accepts inputs of various lengths. For PKCS#1 v1.5 signature in raw mode, test the maximum input length.
2018-06-29 21:36:35 +00:00
Add feature support for RSA for PSA crypto config In the original attempt to add RSA support to PSA crypto config was too generic. This set of changes adds support for the following RSA features: PSA_WANT_ALG_RSA_PKCS1V15_CRYPT, PSA_WANT_ALG_RSA_PKCS1V15_SIGN, PSA_WANT_ALG_RSA_OAEP, PSA_WANT_ALG_RSA_PSS, PSA_WANT_KEY_TYPE_RSA_KEY_PAIR, and PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY. There were also some updates to ensure the proper inclusion of PSA crypto library code when certain features are enabled. These updates were made to address warnings and errors in builds from the new tests for these features being added for PSA crypto configuration. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-01 05:06:54 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
Allow RSA PSS with any input size Although RSASSA-PSS defines its input as a message to be hashed, we implement a sign-the-hash function. This function can take an input which isn't a hash, so don't restrict the size of the input, any more than Mbed TLS does. Remove a redundant check that hash_length fits in unsigned int for the sake of Mbed TLS RSA functions. Test that PSS accepts inputs of various lengths. For PKCS#1 v1.5 signature in raw mode, test the maximum input length.
2018-06-29 21:36:35 +00:00
/* PSS requires a hash internally. */
if( PSA_ALG_IS_RSA_PSS( alg ) )
{
Normalize whitespace to Mbed TLS standards Only whitespace changes in this commit.
2018-06-08 14:09:36 +00:00
if( md_info == NULL )
return( PSA_ERROR_NOT_SUPPORTED );
Extract common code Make code easier to maintain.
2018-06-04 13:40:31 +00:00
}
Add feature support for RSA for PSA crypto config In the original attempt to add RSA support to PSA crypto config was too generic. This set of changes adds support for the following RSA features: PSA_WANT_ALG_RSA_PKCS1V15_CRYPT, PSA_WANT_ALG_RSA_PKCS1V15_SIGN, PSA_WANT_ALG_RSA_OAEP, PSA_WANT_ALG_RSA_PSS, PSA_WANT_KEY_TYPE_RSA_KEY_PAIR, and PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY. There were also some updates to ensure the proper inclusion of PSA crypto library code when certain features are enabled. These updates were made to address warnings and errors in builds from the new tests for these features being added for PSA crypto configuration. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-01 05:06:54 +00:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS */
Allow RSA PSS with any input size Although RSASSA-PSS defines its input as a message to be hashed, we implement a sign-the-hash function. This function can take an input which isn't a hash, so don't restrict the size of the input, any more than Mbed TLS does. Remove a redundant check that hash_length fits in unsigned int for the sake of Mbed TLS RSA functions. Test that PSS accepts inputs of various lengths. For PKCS#1 v1.5 signature in raw mode, test the maximum input length.
2018-06-29 21:36:35 +00:00
Normalize whitespace to Mbed TLS standards Only whitespace changes in this commit.
2018-06-08 14:09:36 +00:00
return( PSA_SUCCESS );
Extract common code Make code easier to maintain.
2018-06-04 13:40:31 +00:00
}
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
static psa_status_t psa_rsa_sign( mbedtls_rsa_context *rsa,
psa_algorithm_t alg,
const uint8_t *hash,
size_t hash_length,
uint8_t *signature,
size_t signature_size,
size_t *signature_length )
{
psa_status_t status;
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
mbedtls_md_type_t md_alg;
status = psa_rsa_decode_md_type( alg, hash_length, &md_alg );
if( status != PSA_SUCCESS )
return( status );
Don't break the rsa context abstraction This would fail on alternative implementation.
2018-06-29 15:49:35 +00:00
if( signature_size < mbedtls_rsa_get_len( rsa ) )
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
return( PSA_ERROR_BUFFER_TOO_SMALL );
Add feature support for RSA for PSA crypto config In the original attempt to add RSA support to PSA crypto config was too generic. This set of changes adds support for the following RSA features: PSA_WANT_ALG_RSA_PKCS1V15_CRYPT, PSA_WANT_ALG_RSA_PKCS1V15_SIGN, PSA_WANT_ALG_RSA_OAEP, PSA_WANT_ALG_RSA_PSS, PSA_WANT_KEY_TYPE_RSA_KEY_PAIR, and PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY. There were also some updates to ensure the proper inclusion of PSA crypto library code when certain features are enabled. These updates were made to address warnings and errors in builds from the new tests for these features being added for PSA crypto configuration. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-01 05:06:54 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN)
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) )
{
mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V15,
MBEDTLS_MD_NONE );
ret = mbedtls_rsa_pkcs1_sign( rsa,
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 16:02:26 +00:00
mbedtls_psa_get_random,
Replace mbedtls_psa_random_state( ... ) by MBEDTLS_PSA_RANDOM_STATE Hide the obtention of the pointer to the RNG state behind a macro. To make it possible to use this macro in a module other than psa_crypto.c, which will happen in the future, make sure that the definition of the macro does not reference internal variables of psa_crypto.c. For this purpose, in the internal-DRBG case, export a symbol containing the address of the DRBG state. When the RNG state is a pointer a DRBG state, just keep this pointer in a variable: there's no need to store a pointer to a larger structure. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-14 13:54:06 +00:00
MBEDTLS_PSA_RANDOM_STATE,
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
MBEDTLS_RSA_PRIVATE,
psa: Pass hash_length with explicit types The RSA module uses unsigned int for hash_length. The PSA Crypto API uses size_t for hash_length. Cast hash_length to unsigned int when passed to the hash module.
2018-06-26 13:20:51 +00:00
md_alg,
(unsigned int) hash_length,
hash,
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
signature );
}
else
Add feature support for RSA for PSA crypto config In the original attempt to add RSA support to PSA crypto config was too generic. This set of changes adds support for the following RSA features: PSA_WANT_ALG_RSA_PKCS1V15_CRYPT, PSA_WANT_ALG_RSA_PKCS1V15_SIGN, PSA_WANT_ALG_RSA_OAEP, PSA_WANT_ALG_RSA_PSS, PSA_WANT_KEY_TYPE_RSA_KEY_PAIR, and PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY. There were also some updates to ensure the proper inclusion of PSA crypto library code when certain features are enabled. These updates were made to address warnings and errors in builds from the new tests for these features being added for PSA crypto configuration. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-01 05:06:54 +00:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN */
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
if( PSA_ALG_IS_RSA_PSS( alg ) )
{
mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg );
ret = mbedtls_rsa_rsassa_pss_sign( rsa,
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 16:02:26 +00:00
mbedtls_psa_get_random,
Replace mbedtls_psa_random_state( ... ) by MBEDTLS_PSA_RANDOM_STATE Hide the obtention of the pointer to the RNG state behind a macro. To make it possible to use this macro in a module other than psa_crypto.c, which will happen in the future, make sure that the definition of the macro does not reference internal variables of psa_crypto.c. For this purpose, in the internal-DRBG case, export a symbol containing the address of the DRBG state. When the RNG state is a pointer a DRBG state, just keep this pointer in a variable: there's no need to store a pointer to a larger structure. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-14 13:54:06 +00:00
MBEDTLS_PSA_RANDOM_STATE,
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
MBEDTLS_RSA_PRIVATE,
Allow RSA PSS with any input size Although RSASSA-PSS defines its input as a message to be hashed, we implement a sign-the-hash function. This function can take an input which isn't a hash, so don't restrict the size of the input, any more than Mbed TLS does. Remove a redundant check that hash_length fits in unsigned int for the sake of Mbed TLS RSA functions. Test that PSS accepts inputs of various lengths. For PKCS#1 v1.5 signature in raw mode, test the maximum input length.
2018-06-29 21:36:35 +00:00
MBEDTLS_MD_NONE,
psa: Pass hash_length with explicit types The RSA module uses unsigned int for hash_length. The PSA Crypto API uses size_t for hash_length. Cast hash_length to unsigned int when passed to the hash module.
2018-06-26 13:20:51 +00:00
(unsigned int) hash_length,
hash,
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
signature );
}
else
Add feature support for RSA for PSA crypto config In the original attempt to add RSA support to PSA crypto config was too generic. This set of changes adds support for the following RSA features: PSA_WANT_ALG_RSA_PKCS1V15_CRYPT, PSA_WANT_ALG_RSA_PKCS1V15_SIGN, PSA_WANT_ALG_RSA_OAEP, PSA_WANT_ALG_RSA_PSS, PSA_WANT_KEY_TYPE_RSA_KEY_PAIR, and PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY. There were also some updates to ensure the proper inclusion of PSA crypto library code when certain features are enabled. These updates were made to address warnings and errors in builds from the new tests for these features being added for PSA crypto configuration. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-01 05:06:54 +00:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS */
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
{
return( PSA_ERROR_INVALID_ARGUMENT );
}
if( ret == 0 )
Don't break the rsa context abstraction This would fail on alternative implementation.
2018-06-29 15:49:35 +00:00
*signature_length = mbedtls_rsa_get_len( rsa );
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
return( mbedtls_to_psa_error( ret ) );
}
static psa_status_t psa_rsa_verify( mbedtls_rsa_context *rsa,
psa_algorithm_t alg,
const uint8_t *hash,
size_t hash_length,
const uint8_t *signature,
size_t signature_length )
{
psa_status_t status;
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
mbedtls_md_type_t md_alg;
status = psa_rsa_decode_md_type( alg, hash_length, &md_alg );
if( status != PSA_SUCCESS )
return( status );
Fix signature size checks in psa_asymmetric_verify for RSA The signature must have exactly the same length as the key, it can't be longer. Fix #258 If the signature doesn't have the correct size, that's an invalid signature, not a problem with an output buffer size. Fix the error code. Add test cases.
2019-09-12 20:08:23 +00:00
if( signature_length != mbedtls_rsa_get_len( rsa ) )
return( PSA_ERROR_INVALID_SIGNATURE );
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
Add feature support for RSA for PSA crypto config In the original attempt to add RSA support to PSA crypto config was too generic. This set of changes adds support for the following RSA features: PSA_WANT_ALG_RSA_PKCS1V15_CRYPT, PSA_WANT_ALG_RSA_PKCS1V15_SIGN, PSA_WANT_ALG_RSA_OAEP, PSA_WANT_ALG_RSA_PSS, PSA_WANT_KEY_TYPE_RSA_KEY_PAIR, and PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY. There were also some updates to ensure the proper inclusion of PSA crypto library code when certain features are enabled. These updates were made to address warnings and errors in builds from the new tests for these features being added for PSA crypto configuration. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-01 05:06:54 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN)
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) )
{
mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V15,
MBEDTLS_MD_NONE );
ret = mbedtls_rsa_pkcs1_verify( rsa,
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 16:02:26 +00:00
mbedtls_psa_get_random,
Replace mbedtls_psa_random_state( ... ) by MBEDTLS_PSA_RANDOM_STATE Hide the obtention of the pointer to the RNG state behind a macro. To make it possible to use this macro in a module other than psa_crypto.c, which will happen in the future, make sure that the definition of the macro does not reference internal variables of psa_crypto.c. For this purpose, in the internal-DRBG case, export a symbol containing the address of the DRBG state. When the RNG state is a pointer a DRBG state, just keep this pointer in a variable: there's no need to store a pointer to a larger structure. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-14 13:54:06 +00:00
MBEDTLS_PSA_RANDOM_STATE,
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
MBEDTLS_RSA_PUBLIC,
md_alg,
psa: Pass hash_length with explicit types The RSA module uses unsigned int for hash_length. The PSA Crypto API uses size_t for hash_length. Cast hash_length to unsigned int when passed to the hash module.
2018-06-26 13:20:51 +00:00
(unsigned int) hash_length,
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
hash,
signature );
}
else
Add feature support for RSA for PSA crypto config In the original attempt to add RSA support to PSA crypto config was too generic. This set of changes adds support for the following RSA features: PSA_WANT_ALG_RSA_PKCS1V15_CRYPT, PSA_WANT_ALG_RSA_PKCS1V15_SIGN, PSA_WANT_ALG_RSA_OAEP, PSA_WANT_ALG_RSA_PSS, PSA_WANT_KEY_TYPE_RSA_KEY_PAIR, and PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY. There were also some updates to ensure the proper inclusion of PSA crypto library code when certain features are enabled. These updates were made to address warnings and errors in builds from the new tests for these features being added for PSA crypto configuration. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-01 05:06:54 +00:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN */
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
if( PSA_ALG_IS_RSA_PSS( alg ) )
{
mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg );
ret = mbedtls_rsa_rsassa_pss_verify( rsa,
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 16:02:26 +00:00
mbedtls_psa_get_random,
Replace mbedtls_psa_random_state( ... ) by MBEDTLS_PSA_RANDOM_STATE Hide the obtention of the pointer to the RNG state behind a macro. To make it possible to use this macro in a module other than psa_crypto.c, which will happen in the future, make sure that the definition of the macro does not reference internal variables of psa_crypto.c. For this purpose, in the internal-DRBG case, export a symbol containing the address of the DRBG state. When the RNG state is a pointer a DRBG state, just keep this pointer in a variable: there's no need to store a pointer to a larger structure. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-14 13:54:06 +00:00
MBEDTLS_PSA_RANDOM_STATE,
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
MBEDTLS_RSA_PUBLIC,
Allow RSA PSS with any input size Although RSASSA-PSS defines its input as a message to be hashed, we implement a sign-the-hash function. This function can take an input which isn't a hash, so don't restrict the size of the input, any more than Mbed TLS does. Remove a redundant check that hash_length fits in unsigned int for the sake of Mbed TLS RSA functions. Test that PSS accepts inputs of various lengths. For PKCS#1 v1.5 signature in raw mode, test the maximum input length.
2018-06-29 21:36:35 +00:00
MBEDTLS_MD_NONE,
psa: Pass hash_length with explicit types The RSA module uses unsigned int for hash_length. The PSA Crypto API uses size_t for hash_length. Cast hash_length to unsigned int when passed to the hash module.
2018-06-26 13:20:51 +00:00
(unsigned int) hash_length,
hash,
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
signature );
}
else
Add feature support for RSA for PSA crypto config In the original attempt to add RSA support to PSA crypto config was too generic. This set of changes adds support for the following RSA features: PSA_WANT_ALG_RSA_PKCS1V15_CRYPT, PSA_WANT_ALG_RSA_PKCS1V15_SIGN, PSA_WANT_ALG_RSA_OAEP, PSA_WANT_ALG_RSA_PSS, PSA_WANT_KEY_TYPE_RSA_KEY_PAIR, and PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY. There were also some updates to ensure the proper inclusion of PSA crypto library code when certain features are enabled. These updates were made to address warnings and errors in builds from the new tests for these features being added for PSA crypto configuration. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-01 05:06:54 +00:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS */
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
{
return( PSA_ERROR_INVALID_ARGUMENT );
}
RSA verification: don't report an invalid padding error Mbed TLS distinguishes "invalid padding" from "valid padding but the rest of the signature is invalid". This has little use in practice and PSA doesn't report this distinction. We just report "invalid signature".
2018-09-13 18:37:48 +00:00
/* Mbed TLS distinguishes "invalid padding" from "valid padding but
* the rest of the signature is invalid". This has little use in
* practice and PSA doesn't report this distinction. */
if( ret == MBEDTLS_ERR_RSA_INVALID_PADDING )
return( PSA_ERROR_INVALID_SIGNATURE );
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
return( mbedtls_to_psa_error( ret ) );
}
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 16:50:04 +00:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 20:28:15 +00:00
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 16:50:04 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
/* `ecp` cannot be const because `ecp->grp` needs to be non-const
* for mbedtls_ecdsa_sign() and mbedtls_ecdsa_sign_det()
* (even though these functions don't modify it). */
static psa_status_t psa_ecdsa_sign( mbedtls_ecp_keypair *ecp,
psa_algorithm_t alg,
const uint8_t *hash,
size_t hash_length,
uint8_t *signature,
size_t signature_size,
size_t *signature_length )
{
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
mbedtls_mpi r, s;
Change ECDSA signature representation to r||s Change the representation of an ECDSA signature from the ASN.1 DER encoding used in TLS and X.509, to the concatenation of r and s in big-endian order with a fixed size. A fixed size helps memory and buffer management and this representation is generally easier to use for anything that doesn't require the ASN.1 representation. This is the same representation as PKCS#11 (Cryptoki) except that PKCS#11 allows r and s to be truncated (both to the same length), which complicates the implementation and negates the advantage of a fixed-size representation.
2018-06-28 11:56:01 +00:00
size_t curve_bytes = PSA_BITS_TO_BYTES( ecp->grp.pbits );
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
mbedtls_mpi_init( &r );
mbedtls_mpi_init( &s );
Change ECDSA signature representation to r||s Change the representation of an ECDSA signature from the ASN.1 DER encoding used in TLS and X.509, to the concatenation of r and s in big-endian order with a fixed size. A fixed size helps memory and buffer management and this representation is generally easier to use for anything that doesn't require the ASN.1 representation. This is the same representation as PKCS#11 (Cryptoki) except that PKCS#11 allows r and s to be truncated (both to the same length), which complicates the implementation and negates the advantage of a fixed-size representation.
2018-06-28 11:56:01 +00:00
if( signature_size < 2 * curve_bytes )
{
ret = MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL;
goto cleanup;
}
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
Correct use of MBEDTLS_PSA_BUILTIN_ALG_xxx in crypto library The psa crypto library was generically using PSA_WANT_ALG_xxx, but should have been using the correct MBEDTLS_PSA_BUILTIN_ALG_xxx definition since that code is the builtin version. There were also a couple of spots that needed to ensure the code block was enabled for either ECDSA or DETERMINISTIC_ECDSA, not just one of them. Fixed all the new ALG_ECDSA_DETERMINISTIC names to be ALG_DETERMINISTIC_ECDSA instead. Fixed test to use correct definitions. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-14 02:58:20 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
if( PSA_ALG_DSA_IS_DETERMINISTIC( alg ) )
{
psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH( alg );
const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa( hash_alg );
mbedtls_md_type_t md_alg = mbedtls_md_get_type( md_info );
Use safer deterministic function in psa_ecdsa_sign
2019-09-05 13:06:34 +00:00
MBEDTLS_MPI_CHK( mbedtls_ecdsa_sign_det_ext( &ecp->grp, &r, &s,
&ecp->d, hash,
hash_length, md_alg,
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 16:02:26 +00:00
mbedtls_psa_get_random,
Replace mbedtls_psa_random_state( ... ) by MBEDTLS_PSA_RANDOM_STATE Hide the obtention of the pointer to the RNG state behind a macro. To make it possible to use this macro in a module other than psa_crypto.c, which will happen in the future, make sure that the definition of the macro does not reference internal variables of psa_crypto.c. For this purpose, in the internal-DRBG case, export a symbol containing the address of the DRBG state. When the RNG state is a pointer a DRBG state, just keep this pointer in a variable: there's no need to store a pointer to a larger structure. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-14 13:54:06 +00:00
MBEDTLS_PSA_RANDOM_STATE ) );
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
}
else
Correct use of MBEDTLS_PSA_BUILTIN_ALG_xxx in crypto library The psa crypto library was generically using PSA_WANT_ALG_xxx, but should have been using the correct MBEDTLS_PSA_BUILTIN_ALG_xxx definition since that code is the builtin version. There were also a couple of spots that needed to ensure the code block was enabled for either ECDSA or DETERMINISTIC_ECDSA, not just one of them. Fixed all the new ALG_ECDSA_DETERMINISTIC names to be ALG_DETERMINISTIC_ECDSA instead. Fixed test to use correct definitions. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-14 02:58:20 +00:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
{
Add some missing compilation guards Add missing checks for defined(MBEDTLS_MD_C) around types and functions that require it (HMAC, HKDF, TLS12_PRF). Add missing checks for defined(MBEDTLS_ECDSA_DETERMINISTIC) around code that calls mbedtls_ecdsa_sign_det(). Add missing checks for defined(MBEDTLS_ECDH_C) around ECDH-specific functions.
2018-11-16 15:02:56 +00:00
(void) alg;
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
MBEDTLS_MPI_CHK( mbedtls_ecdsa_sign( &ecp->grp, &r, &s, &ecp->d,
hash, hash_length,
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 16:02:26 +00:00
mbedtls_psa_get_random,
Replace mbedtls_psa_random_state( ... ) by MBEDTLS_PSA_RANDOM_STATE Hide the obtention of the pointer to the RNG state behind a macro. To make it possible to use this macro in a module other than psa_crypto.c, which will happen in the future, make sure that the definition of the macro does not reference internal variables of psa_crypto.c. For this purpose, in the internal-DRBG case, export a symbol containing the address of the DRBG state. When the RNG state is a pointer a DRBG state, just keep this pointer in a variable: there's no need to store a pointer to a larger structure. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-14 13:54:06 +00:00
MBEDTLS_PSA_RANDOM_STATE ) );
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
}
Change ECDSA signature representation to r||s Change the representation of an ECDSA signature from the ASN.1 DER encoding used in TLS and X.509, to the concatenation of r and s in big-endian order with a fixed size. A fixed size helps memory and buffer management and this representation is generally easier to use for anything that doesn't require the ASN.1 representation. This is the same representation as PKCS#11 (Cryptoki) except that PKCS#11 allows r and s to be truncated (both to the same length), which complicates the implementation and negates the advantage of a fixed-size representation.
2018-06-28 11:56:01 +00:00
MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &r,
signature,
curve_bytes ) );
MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &s,
signature + curve_bytes,
curve_bytes ) );
cleanup:
mbedtls_mpi_free( &r );
mbedtls_mpi_free( &s );
if( ret == 0 )
*signature_length = 2 * curve_bytes;
return( mbedtls_to_psa_error( ret ) );
}
static psa_status_t psa_ecdsa_verify( mbedtls_ecp_keypair *ecp,
const uint8_t *hash,
size_t hash_length,
const uint8_t *signature,
size_t signature_length )
{
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Change ECDSA signature representation to r||s Change the representation of an ECDSA signature from the ASN.1 DER encoding used in TLS and X.509, to the concatenation of r and s in big-endian order with a fixed size. A fixed size helps memory and buffer management and this representation is generally easier to use for anything that doesn't require the ASN.1 representation. This is the same representation as PKCS#11 (Cryptoki) except that PKCS#11 allows r and s to be truncated (both to the same length), which complicates the implementation and negates the advantage of a fixed-size representation.
2018-06-28 11:56:01 +00:00
mbedtls_mpi r, s;
size_t curve_bytes = PSA_BITS_TO_BYTES( ecp->grp.pbits );
mbedtls_mpi_init( &r );
mbedtls_mpi_init( &s );
if( signature_length != 2 * curve_bytes )
return( PSA_ERROR_INVALID_SIGNATURE );
MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &r,
signature,
curve_bytes ) );
MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &s,
signature + curve_bytes,
curve_bytes ) );
Remove ECP internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 21:09:52 +00:00
/* Check whether the public part is loaded. If not, load it. */
if( mbedtls_ecp_is_zero( &ecp->Q ) )
{
MBEDTLS_MPI_CHK(
mbedtls_ecp_mul( &ecp->grp, &ecp->Q, &ecp->d, &ecp->grp.G,
Replace mbedtls_psa_random_state( ... ) by MBEDTLS_PSA_RANDOM_STATE Hide the obtention of the pointer to the RNG state behind a macro. To make it possible to use this macro in a module other than psa_crypto.c, which will happen in the future, make sure that the definition of the macro does not reference internal variables of psa_crypto.c. For this purpose, in the internal-DRBG case, export a symbol containing the address of the DRBG state. When the RNG state is a pointer a DRBG state, just keep this pointer in a variable: there's no need to store a pointer to a larger structure. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-14 13:54:06 +00:00
mbedtls_psa_get_random, MBEDTLS_PSA_RANDOM_STATE ) );
Remove ECP internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 21:09:52 +00:00
}
Change ECDSA signature representation to r||s Change the representation of an ECDSA signature from the ASN.1 DER encoding used in TLS and X.509, to the concatenation of r and s in big-endian order with a fixed size. A fixed size helps memory and buffer management and this representation is generally easier to use for anything that doesn't require the ASN.1 representation. This is the same representation as PKCS#11 (Cryptoki) except that PKCS#11 allows r and s to be truncated (both to the same length), which complicates the implementation and negates the advantage of a fixed-size representation.
2018-06-28 11:56:01 +00:00
ret = mbedtls_ecdsa_verify( &ecp->grp, hash, hash_length,
&ecp->Q, &r, &s );
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
cleanup:
mbedtls_mpi_free( &r );
mbedtls_mpi_free( &s );
return( mbedtls_to_psa_error( ret ) );
}
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 16:50:04 +00:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
* defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
psa_status_t psa_sign_hash( mbedtls_svc_key_id_t key,
Rename some signature-related identifiers Rename some macros and functions related to signature which are changing as part of the addition of psa_sign_message and psa_verify_message. perl -i -pe '%t = ( PSA_KEY_USAGE_SIGN => PSA_KEY_USAGE_SIGN_HASH, PSA_KEY_USAGE_VERIFY => PSA_KEY_USAGE_VERIFY_HASH, PSA_ASYMMETRIC_SIGNATURE_MAX_SIZE => PSA_SIGNATURE_MAX_SIZE, PSA_ASYMMETRIC_SIGN_OUTPUT_SIZE => PSA_SIGN_OUTPUT_SIZE, psa_asymmetric_sign => psa_sign_hash, psa_asymmetric_verify => psa_verify_hash, ); s/\b(@{[join("|", keys %t)]})\b/$t{$1}/ge' $(git ls-files . ':!:**/crypto_compat.h')
2019-11-26 16:01:59 +00:00
psa_algorithm_t alg,
const uint8_t *hash,
size_t hash_length,
uint8_t *signature,
size_t signature_size,
size_t *signature_length )
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
{
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 16:12:32 +00:00
psa_key_slot_t *slot;
psa_asymmetric_sign: consistently fill unused output with '!' Fill the unused part of the output buffer with '!', for consistency with hash and mac. On error, set the output length to the output buffer size and fill the output buffer with '!', again for consistency with hash and mac. This way an invalid output is more visible in a memory dump. Restructure the error paths so that there is a single place where the unused part of the output buffer is filled. Also remove a redundant initialization of *signature_length to 0.
2018-06-28 10:21:19 +00:00
*signature_length = signature_size;
Immediately reject 0-size signature buffer when signing In psa_asymmetric_sign, immediately reject an empty signature buffer. This can never be right. Add test cases (one RSA and one ECDSA). Change the SE HAL mock tests not to use an empty signature buffer.
2019-09-12 20:05:59 +00:00
/* Immediately reject a zero-length signature buffer. This guarantees
* that signature must be a valid pointer. (On the other hand, the hash
* buffer can in principle be empty since it doesn't actually have
* to be a hash.) */
if( signature_size == 0 )
return( PSA_ERROR_BUFFER_TOO_SMALL );
psa_asymmetric_sign: consistently fill unused output with '!' Fill the unused part of the output buffer with '!', for consistency with hash and mac. On error, set the output length to the output buffer size and fill the output buffer with '!', again for consistency with hash and mac. This way an invalid output is more visible in a memory dump. Restructure the error paths so that there is a single place where the unused part of the output buffer is filled. Also remove a redundant initialization of *signature_length to 0.
2018-06-28 10:21:19 +00:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
status = psa_get_and_lock_key_slot_with_policy( key, &slot,
PSA_KEY_USAGE_SIGN_HASH,
alg );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 15:01:38 +00:00
if( status != PSA_SUCCESS )
psa_asymmetric_sign: consistently fill unused output with '!' Fill the unused part of the output buffer with '!', for consistency with hash and mac. On error, set the output length to the output buffer size and fill the output buffer with '!', again for consistency with hash and mac. This way an invalid output is more visible in a memory dump. Restructure the error paths so that there is a single place where the unused part of the output buffer is filled. Also remove a redundant initialization of *signature_length to 0.
2018-06-28 10:21:19 +00:00
goto exit;
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( ! PSA_KEY_TYPE_IS_KEY_PAIR( slot->attr.type ) )
psa_asymmetric_sign: consistently fill unused output with '!' Fill the unused part of the output buffer with '!', for consistency with hash and mac. On error, set the output length to the output buffer size and fill the output buffer with '!', again for consistency with hash and mac. This way an invalid output is more visible in a memory dump. Restructure the error paths so that there is a single place where the unused part of the output buffer is filled. Also remove a redundant initialization of *signature_length to 0.
2018-06-28 10:21:19 +00:00
{
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
}
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
Add a handcrafted first version of the driver wrapper code Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-16 18:28:36 +00:00
/* Try any of the available accelerators first */
status = psa_driver_wrapper_sign_hash( slot,
alg,
hash,
hash_length,
signature,
signature_size,
signature_length );
Make sure software fallback isn't tried on opaque keys Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-04 11:06:39 +00:00
if( status != PSA_ERROR_NOT_SUPPORTED ||
psa_key_lifetime_is_external( slot->attr.lifetime ) )
Add a handcrafted first version of the driver wrapper code Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-16 18:28:36 +00:00
goto exit;
Move handling of 'SE' drivers into driver wrappers This is a more natural place for handling the drivers belonging to the 'previous' SE driver spec. It makes for a cleaner psa_crypto.c, and potentially an easier overview of how to migrate from the old SE driver interface to the 'opaque accelerator' interface. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-17 14:43:05 +00:00
/* If the operation was not supported by any accelerator, try fallback. */
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 16:50:04 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( slot->attr.type == PSA_KEY_TYPE_RSA_KEY_PAIR )
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
{
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:39 +00:00
mbedtls_rsa_context *rsa = NULL;
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 20:48:15 +00:00
psa: Rename psa_load_rsa/ecp_representation Rename psa_load_rsa/ecp_representation to mbedtls_psa_rsa/ecp_load_representation before to move them in their RSA/ECP specific PSA crypto C modules. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 13:58:33 +00:00
status = mbedtls_psa_rsa_load_representation( slot->attr.type,
slot->key.data,
slot->key.bytes,
&rsa );
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 20:48:15 +00:00
if( status != PSA_SUCCESS )
goto exit;
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:39 +00:00
status = psa_rsa_sign( rsa,
psa_asymmetric_sign: consistently fill unused output with '!' Fill the unused part of the output buffer with '!', for consistency with hash and mac. On error, set the output length to the output buffer size and fill the output buffer with '!', again for consistency with hash and mac. This way an invalid output is more visible in a memory dump. Restructure the error paths so that there is a single place where the unused part of the output buffer is filled. Also remove a redundant initialization of *signature_length to 0.
2018-06-28 10:21:19 +00:00
alg,
hash, hash_length,
signature, signature_size,
signature_length );
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 20:48:15 +00:00
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:39 +00:00
mbedtls_rsa_free( rsa );
mbedtls_free( rsa );
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
}
else
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 16:50:04 +00:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( PSA_KEY_TYPE_IS_ECC( slot->attr.type ) )
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
{
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 20:28:15 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
Add some missing compilation guards Add missing checks for defined(MBEDTLS_MD_C) around types and functions that require it (HMAC, HKDF, TLS12_PRF). Add missing checks for defined(MBEDTLS_ECDSA_DETERMINISTIC) around code that calls mbedtls_ecdsa_sign_det(). Add missing checks for defined(MBEDTLS_ECDH_C) around ECDH-specific functions.
2018-11-16 15:02:56 +00:00
if(
Correct use of MBEDTLS_PSA_BUILTIN_ALG_xxx in crypto library The psa crypto library was generically using PSA_WANT_ALG_xxx, but should have been using the correct MBEDTLS_PSA_BUILTIN_ALG_xxx definition since that code is the builtin version. There were also a couple of spots that needed to ensure the code block was enabled for either ECDSA or DETERMINISTIC_ECDSA, not just one of them. Fixed all the new ALG_ECDSA_DETERMINISTIC names to be ALG_DETERMINISTIC_ECDSA instead. Fixed test to use correct definitions. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-14 02:58:20 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
Add some missing compilation guards Add missing checks for defined(MBEDTLS_MD_C) around types and functions that require it (HMAC, HKDF, TLS12_PRF). Add missing checks for defined(MBEDTLS_ECDSA_DETERMINISTIC) around code that calls mbedtls_ecdsa_sign_det(). Add missing checks for defined(MBEDTLS_ECDH_C) around ECDH-specific functions.
2018-11-16 15:02:56 +00:00
PSA_ALG_IS_ECDSA( alg )
#else
PSA_ALG_IS_RANDOMIZED_ECDSA( alg )
#endif
)
Remove ECP internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 21:09:52 +00:00
{
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:39 +00:00
mbedtls_ecp_keypair *ecp = NULL;
psa: Rename psa_load_rsa/ecp_representation Rename psa_load_rsa/ecp_representation to mbedtls_psa_rsa/ecp_load_representation before to move them in their RSA/ECP specific PSA crypto C modules. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 13:58:33 +00:00
status = mbedtls_psa_ecp_load_representation( slot->attr.type,
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 14:44:45 +00:00
slot->attr.bits,
psa: Rename psa_load_rsa/ecp_representation Rename psa_load_rsa/ecp_representation to mbedtls_psa_rsa/ecp_load_representation before to move them in their RSA/ECP specific PSA crypto C modules. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 13:58:33 +00:00
slot->key.data,
slot->key.bytes,
&ecp );
Remove ECP internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 21:09:52 +00:00
if( status != PSA_SUCCESS )
goto exit;
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:39 +00:00
status = psa_ecdsa_sign( ecp,
psa_asymmetric_sign: consistently fill unused output with '!' Fill the unused part of the output buffer with '!', for consistency with hash and mac. On error, set the output length to the output buffer size and fill the output buffer with '!', again for consistency with hash and mac. This way an invalid output is more visible in a memory dump. Restructure the error paths so that there is a single place where the unused part of the output buffer is filled. Also remove a redundant initialization of *signature_length to 0.
2018-06-28 10:21:19 +00:00
alg,
hash, hash_length,
signature, signature_size,
signature_length );
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:39 +00:00
mbedtls_ecp_keypair_free( ecp );
mbedtls_free( ecp );
Remove ECP internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 21:09:52 +00:00
}
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
else
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 20:28:15 +00:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
* defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
{
psa_asymmetric_sign: consistently fill unused output with '!' Fill the unused part of the output buffer with '!', for consistency with hash and mac. On error, set the output length to the output buffer size and fill the output buffer with '!', again for consistency with hash and mac. This way an invalid output is more visible in a memory dump. Restructure the error paths so that there is a single place where the unused part of the output buffer is filled. Also remove a redundant initialization of *signature_length to 0.
2018-06-28 10:21:19 +00:00
status = PSA_ERROR_INVALID_ARGUMENT;
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
}
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 08:18:38 +00:00
}
else
{
psa_asymmetric_sign: consistently fill unused output with '!' Fill the unused part of the output buffer with '!', for consistency with hash and mac. On error, set the output length to the output buffer size and fill the output buffer with '!', again for consistency with hash and mac. This way an invalid output is more visible in a memory dump. Restructure the error paths so that there is a single place where the unused part of the output buffer is filled. Also remove a redundant initialization of *signature_length to 0.
2018-06-28 10:21:19 +00:00
status = PSA_ERROR_NOT_SUPPORTED;
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
}
psa_asymmetric_sign: consistently fill unused output with '!' Fill the unused part of the output buffer with '!', for consistency with hash and mac. On error, set the output length to the output buffer size and fill the output buffer with '!', again for consistency with hash and mac. This way an invalid output is more visible in a memory dump. Restructure the error paths so that there is a single place where the unused part of the output buffer is filled. Also remove a redundant initialization of *signature_length to 0.
2018-06-28 10:21:19 +00:00
exit:
/* Fill the unused part of the output buffer (the whole buffer on error,
* the trailing part on success) with something that isn't a valid mac
* (barring an attack on the mac and deliberately-crafted input),
* in case the caller doesn't check the return status properly. */
if( status == PSA_SUCCESS )
memset( signature + *signature_length, '!',
signature_size - *signature_length );
Immediately reject 0-size signature buffer when signing In psa_asymmetric_sign, immediately reject an empty signature buffer. This can never be right. Add test cases (one RSA and one ECDSA). Change the SE HAL mock tests not to use an empty signature buffer.
2019-09-12 20:05:59 +00:00
else
psa_asymmetric_sign: consistently fill unused output with '!' Fill the unused part of the output buffer with '!', for consistency with hash and mac. On error, set the output length to the output buffer size and fill the output buffer with '!', again for consistency with hash and mac. This way an invalid output is more visible in a memory dump. Restructure the error paths so that there is a single place where the unused part of the output buffer is filled. Also remove a redundant initialization of *signature_length to 0.
2018-06-28 10:21:19 +00:00
memset( signature, '!', signature_size );
Handle null pointers safely when used as buffers of size 0 When the size of a buffer is 0, the corresponding pointer argument may be null. In such cases, library functions must not perform arithmetic on the pointer or call standard library functions such as memset and memcpy, since that would be undefined behavior in C. Protect such cases. Refactor the storage of a 0-sized raw data object to make it store a null pointer, rather than depending on the behavior of calloc(1,0).
2018-06-28 17:31:31 +00:00
/* If signature_size is 0 then we have nothing to do. We must not call
* memset because signature may be NULL in this case. */
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
unlock_status = psa_unlock_key_slot( slot );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
return( ( status == PSA_SUCCESS ) ? unlock_status : status );
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 08:18:38 +00:00
}
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
psa_status_t psa_verify_hash( mbedtls_svc_key_id_t key,
Rename some signature-related identifiers Rename some macros and functions related to signature which are changing as part of the addition of psa_sign_message and psa_verify_message. perl -i -pe '%t = ( PSA_KEY_USAGE_SIGN => PSA_KEY_USAGE_SIGN_HASH, PSA_KEY_USAGE_VERIFY => PSA_KEY_USAGE_VERIFY_HASH, PSA_ASYMMETRIC_SIGNATURE_MAX_SIZE => PSA_SIGNATURE_MAX_SIZE, PSA_ASYMMETRIC_SIGN_OUTPUT_SIZE => PSA_SIGN_OUTPUT_SIZE, psa_asymmetric_sign => psa_sign_hash, psa_asymmetric_verify => psa_verify_hash, ); s/\b(@{[join("|", keys %t)]})\b/$t{$1}/ge' $(git ls-files . ':!:**/crypto_compat.h')
2019-11-26 16:01:59 +00:00
psa_algorithm_t alg,
const uint8_t *hash,
size_t hash_length,
const uint8_t *signature,
size_t signature_length )
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 08:18:38 +00:00
{
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 16:12:32 +00:00
psa_key_slot_t *slot;
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
status = psa_get_and_lock_key_slot_with_policy( key, &slot,
PSA_KEY_USAGE_VERIFY_HASH,
alg );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 15:01:38 +00:00
if( status != PSA_SUCCESS )
return( status );
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 08:18:38 +00:00
Add and splice in signature verification through driver Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-17 17:46:15 +00:00
/* Try any of the available accelerators first */
status = psa_driver_wrapper_verify_hash( slot,
alg,
hash,
hash_length,
signature,
signature_length );
Make sure software fallback isn't tried on opaque keys Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-04 11:06:39 +00:00
if( status != PSA_ERROR_NOT_SUPPORTED ||
psa_key_lifetime_is_external( slot->attr.lifetime ) )
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
goto exit;
Add and splice in signature verification through driver Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-17 17:46:15 +00:00
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 16:50:04 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
{
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:39 +00:00
mbedtls_rsa_context *rsa = NULL;
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 20:48:15 +00:00
psa: Rename psa_load_rsa/ecp_representation Rename psa_load_rsa/ecp_representation to mbedtls_psa_rsa/ecp_load_representation before to move them in their RSA/ECP specific PSA crypto C modules. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 13:58:33 +00:00
status = mbedtls_psa_rsa_load_representation( slot->attr.type,
slot->key.data,
slot->key.bytes,
&rsa );
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 20:48:15 +00:00
if( status != PSA_SUCCESS )
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
goto exit;
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 20:48:15 +00:00
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:39 +00:00
status = psa_rsa_verify( rsa,
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 20:48:15 +00:00
alg,
hash, hash_length,
signature, signature_length );
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:39 +00:00
mbedtls_rsa_free( rsa );
mbedtls_free( rsa );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
goto exit;
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
}
else
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 16:50:04 +00:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( PSA_KEY_TYPE_IS_ECC( slot->attr.type ) )
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 08:18:38 +00:00
{
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 20:28:15 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
if( PSA_ALG_IS_ECDSA( alg ) )
Remove ECP internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 21:09:52 +00:00
{
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:39 +00:00
mbedtls_ecp_keypair *ecp = NULL;
psa: Rename psa_load_rsa/ecp_representation Rename psa_load_rsa/ecp_representation to mbedtls_psa_rsa/ecp_load_representation before to move them in their RSA/ECP specific PSA crypto C modules. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 13:58:33 +00:00
status = mbedtls_psa_ecp_load_representation( slot->attr.type,
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 14:44:45 +00:00
slot->attr.bits,
psa: Rename psa_load_rsa/ecp_representation Rename psa_load_rsa/ecp_representation to mbedtls_psa_rsa/ecp_load_representation before to move them in their RSA/ECP specific PSA crypto C modules. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 13:58:33 +00:00
slot->key.data,
slot->key.bytes,
&ecp );
Remove ECP internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 21:09:52 +00:00
if( status != PSA_SUCCESS )
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
goto exit;
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:39 +00:00
status = psa_ecdsa_verify( ecp,
Remove ECP internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 21:09:52 +00:00
hash, hash_length,
signature, signature_length );
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:39 +00:00
mbedtls_ecp_keypair_free( ecp );
mbedtls_free( ecp );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
goto exit;
Remove ECP internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 21:09:52 +00:00
}
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
else
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 20:28:15 +00:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
* defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
{
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
}
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 08:18:38 +00:00
}
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
else
{
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
status = PSA_ERROR_NOT_SUPPORTED;
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
}
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
exit:
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
unlock_status = psa_unlock_key_slot( slot );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
return( ( status == PSA_SUCCESS ) ? unlock_status : status );
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
}
Add feature support for RSA for PSA crypto config In the original attempt to add RSA support to PSA crypto config was too generic. This set of changes adds support for the following RSA features: PSA_WANT_ALG_RSA_PKCS1V15_CRYPT, PSA_WANT_ALG_RSA_PKCS1V15_SIGN, PSA_WANT_ALG_RSA_OAEP, PSA_WANT_ALG_RSA_PSS, PSA_WANT_KEY_TYPE_RSA_KEY_PAIR, and PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY. There were also some updates to ensure the proper inclusion of PSA crypto library code when certain features are enabled. These updates were made to address warnings and errors in builds from the new tests for these features being added for PSA crypto configuration. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-01 05:06:54 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
Implement OAEP Implement RSAES-OAEP encryption and decryption. Test it to the same level as PKCS#1 v1.5.
2018-06-29 22:21:29 +00:00
static void psa_rsa_oaep_set_padding_mode( psa_algorithm_t alg,
mbedtls_rsa_context *rsa )
{
psa_algorithm_t hash_alg = PSA_ALG_RSA_OAEP_GET_HASH( alg );
const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa( hash_alg );
mbedtls_md_type_t md_alg = mbedtls_md_get_type( md_info );
mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg );
}
Add feature support for RSA for PSA crypto config In the original attempt to add RSA support to PSA crypto config was too generic. This set of changes adds support for the following RSA features: PSA_WANT_ALG_RSA_PKCS1V15_CRYPT, PSA_WANT_ALG_RSA_PKCS1V15_SIGN, PSA_WANT_ALG_RSA_OAEP, PSA_WANT_ALG_RSA_PSS, PSA_WANT_KEY_TYPE_RSA_KEY_PAIR, and PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY. There were also some updates to ensure the proper inclusion of PSA crypto library code when certain features are enabled. These updates were made to address warnings and errors in builds from the new tests for these features being added for PSA crypto configuration. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-01 05:06:54 +00:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */
Implement OAEP Implement RSAES-OAEP encryption and decryption. Test it to the same level as PKCS#1 v1.5.
2018-06-29 22:21:29 +00:00
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
psa_status_t psa_asymmetric_encrypt( mbedtls_svc_key_id_t key,
Normalize whitespace to Mbed TLS standards Only whitespace changes in this commit.
2018-06-08 14:09:36 +00:00
psa_algorithm_t alg,
const uint8_t *input,
size_t input_length,
const uint8_t *salt,
size_t salt_length,
uint8_t *output,
size_t output_size,
size_t *output_length )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
{
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 16:12:32 +00:00
psa_key_slot_t *slot;
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 15:01:38 +00:00
Add handling for (sometimes) unused parameters
2018-07-24 14:34:10 +00:00
(void) input;
(void) input_length;
(void) salt;
(void) output;
(void) output_size;
Set output length to safe value
2018-06-04 13:43:12 +00:00
*output_length = 0;
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
psa_asymmetric_{encrypt,decrypt}: reject salt when not allowed In psa_asymmetric_encrypt and psa_asymmetric_decrypt, if the algorithm does not use a salt, require the salt to be empty.
2018-06-30 17:04:35 +00:00
if( ! PSA_ALG_IS_RSA_OAEP( alg ) && salt_length != 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
status = psa_get_and_lock_transparent_key_slot_with_policy(
key, &slot, PSA_KEY_USAGE_ENCRYPT, alg );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 15:01:38 +00:00
if( status != PSA_SUCCESS )
return( status );
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( ! ( PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->attr.type ) ||
PSA_KEY_TYPE_IS_KEY_PAIR( slot->attr.type ) ) )
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
{
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
}
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 16:50:04 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
{
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:39 +00:00
mbedtls_rsa_context *rsa = NULL;
psa: Rename psa_load_rsa/ecp_representation Rename psa_load_rsa/ecp_representation to mbedtls_psa_rsa/ecp_load_representation before to move them in their RSA/ECP specific PSA crypto C modules. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 13:58:33 +00:00
status = mbedtls_psa_rsa_load_representation( slot->attr.type,
slot->key.data,
slot->key.bytes,
&rsa );
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 20:48:15 +00:00
if( status != PSA_SUCCESS )
Apply review feedback * No need to check for NULL before free'ing * No need to reset variables that weren't touched * Set output buffer to zero if key output fails * Document internal functions and rearrange order of input arguments to better match other functions. * Clean up Montgomery fix to be less verbose code Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-03 12:46:03 +00:00
goto rsa_exit;
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:39 +00:00
if( output_size < mbedtls_rsa_get_len( rsa ) )
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 20:48:15 +00:00
{
Apply review feedback * No need to check for NULL before free'ing * No need to reset variables that weren't touched * Set output buffer to zero if key output fails * Document internal functions and rearrange order of input arguments to better match other functions. * Clean up Montgomery fix to be less verbose code Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-03 12:46:03 +00:00
status = PSA_ERROR_BUFFER_TOO_SMALL;
goto rsa_exit;
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 20:48:15 +00:00
}
Add feature support for RSA for PSA crypto config In the original attempt to add RSA support to PSA crypto config was too generic. This set of changes adds support for the following RSA features: PSA_WANT_ALG_RSA_PKCS1V15_CRYPT, PSA_WANT_ALG_RSA_PKCS1V15_SIGN, PSA_WANT_ALG_RSA_OAEP, PSA_WANT_ALG_RSA_PSS, PSA_WANT_KEY_TYPE_RSA_KEY_PAIR, and PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY. There were also some updates to ensure the proper inclusion of PSA crypto library code when certain features are enabled. These updates were made to address warnings and errors in builds from the new tests for these features being added for PSA crypto configuration. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-01 05:06:54 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT)
Finish renaming around PSA_ALG_IS_RSA_PKCS1V15 Now the code compiles. Some OAEP and PSS macros may still need to be fixed.
2018-05-31 11:16:08 +00:00
if( alg == PSA_ALG_RSA_PKCS1V15_CRYPT )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
{
Apply review feedback * No need to check for NULL before free'ing * No need to reset variables that weren't touched * Set output buffer to zero if key output fails * Document internal functions and rearrange order of input arguments to better match other functions. * Clean up Montgomery fix to be less verbose code Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-03 12:46:03 +00:00
status = mbedtls_to_psa_error(
mbedtls_rsa_pkcs1_encrypt( rsa,
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 16:02:26 +00:00
mbedtls_psa_get_random,
Replace mbedtls_psa_random_state( ... ) by MBEDTLS_PSA_RANDOM_STATE Hide the obtention of the pointer to the RNG state behind a macro. To make it possible to use this macro in a module other than psa_crypto.c, which will happen in the future, make sure that the definition of the macro does not reference internal variables of psa_crypto.c. For this purpose, in the internal-DRBG case, export a symbol containing the address of the DRBG state. When the RNG state is a pointer a DRBG state, just keep this pointer in a variable: there's no need to store a pointer to a larger structure. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-14 13:54:06 +00:00
MBEDTLS_PSA_RANDOM_STATE,
Apply review feedback * No need to check for NULL before free'ing * No need to reset variables that weren't touched * Set output buffer to zero if key output fails * Document internal functions and rearrange order of input arguments to better match other functions. * Clean up Montgomery fix to be less verbose code Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-03 12:46:03 +00:00
MBEDTLS_RSA_PUBLIC,
input_length,
input,
output ) );
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
}
else
Add feature support for RSA for PSA crypto config In the original attempt to add RSA support to PSA crypto config was too generic. This set of changes adds support for the following RSA features: PSA_WANT_ALG_RSA_PKCS1V15_CRYPT, PSA_WANT_ALG_RSA_PKCS1V15_SIGN, PSA_WANT_ALG_RSA_OAEP, PSA_WANT_ALG_RSA_PSS, PSA_WANT_KEY_TYPE_RSA_KEY_PAIR, and PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY. There were also some updates to ensure the proper inclusion of PSA crypto library code when certain features are enabled. These updates were made to address warnings and errors in builds from the new tests for these features being added for PSA crypto configuration. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-01 05:06:54 +00:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT */
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
Sort out RSA mechanisms * PSS needs to be parametrized by a hash. * Don't use `_MGF1` in the names of macros for OAEP and PSS. No one ever uses anything else. * Add brief documentation for the RSA signature mechanisms.
2018-06-26 13:53:48 +00:00
if( PSA_ALG_IS_RSA_OAEP( alg ) )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
{
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:39 +00:00
psa_rsa_oaep_set_padding_mode( alg, rsa );
Apply review feedback * No need to check for NULL before free'ing * No need to reset variables that weren't touched * Set output buffer to zero if key output fails * Document internal functions and rearrange order of input arguments to better match other functions. * Clean up Montgomery fix to be less verbose code Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-03 12:46:03 +00:00
status = mbedtls_to_psa_error(
mbedtls_rsa_rsaes_oaep_encrypt( rsa,
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 16:02:26 +00:00
mbedtls_psa_get_random,
Replace mbedtls_psa_random_state( ... ) by MBEDTLS_PSA_RANDOM_STATE Hide the obtention of the pointer to the RNG state behind a macro. To make it possible to use this macro in a module other than psa_crypto.c, which will happen in the future, make sure that the definition of the macro does not reference internal variables of psa_crypto.c. For this purpose, in the internal-DRBG case, export a symbol containing the address of the DRBG state. When the RNG state is a pointer a DRBG state, just keep this pointer in a variable: there's no need to store a pointer to a larger structure. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-14 13:54:06 +00:00
MBEDTLS_PSA_RANDOM_STATE,
Apply review feedback * No need to check for NULL before free'ing * No need to reset variables that weren't touched * Set output buffer to zero if key output fails * Document internal functions and rearrange order of input arguments to better match other functions. * Clean up Montgomery fix to be less verbose code Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-03 12:46:03 +00:00
MBEDTLS_RSA_PUBLIC,
salt, salt_length,
input_length,
input,
output ) );
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
}
else
Add feature support for RSA for PSA crypto config In the original attempt to add RSA support to PSA crypto config was too generic. This set of changes adds support for the following RSA features: PSA_WANT_ALG_RSA_PKCS1V15_CRYPT, PSA_WANT_ALG_RSA_PKCS1V15_SIGN, PSA_WANT_ALG_RSA_OAEP, PSA_WANT_ALG_RSA_PSS, PSA_WANT_KEY_TYPE_RSA_KEY_PAIR, and PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY. There were also some updates to ensure the proper inclusion of PSA crypto library code when certain features are enabled. These updates were made to address warnings and errors in builds from the new tests for these features being added for PSA crypto configuration. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-01 05:06:54 +00:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP */
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
{
Apply review feedback * No need to check for NULL before free'ing * No need to reset variables that weren't touched * Set output buffer to zero if key output fails * Document internal functions and rearrange order of input arguments to better match other functions. * Clean up Montgomery fix to be less verbose code Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-03 12:46:03 +00:00
status = PSA_ERROR_INVALID_ARGUMENT;
goto rsa_exit;
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
}
Apply review feedback * No need to check for NULL before free'ing * No need to reset variables that weren't touched * Set output buffer to zero if key output fails * Document internal functions and rearrange order of input arguments to better match other functions. * Clean up Montgomery fix to be less verbose code Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-03 12:46:03 +00:00
rsa_exit:
if( status == PSA_SUCCESS )
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:39 +00:00
*output_length = mbedtls_rsa_get_len( rsa );
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 20:48:15 +00:00
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:39 +00:00
mbedtls_rsa_free( rsa );
mbedtls_free( rsa );
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
}
else
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 20:28:15 +00:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) ||
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 16:50:04 +00:00
* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
{
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
status = PSA_ERROR_NOT_SUPPORTED;
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
}
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
exit:
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
unlock_status = psa_unlock_key_slot( slot );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Remove trailing whitespace Only horizontal whitespace changes in this commit.
2018-05-31 11:25:48 +00:00
}
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
psa_status_t psa_asymmetric_decrypt( mbedtls_svc_key_id_t key,
Normalize whitespace to Mbed TLS standards Only whitespace changes in this commit.
2018-06-08 14:09:36 +00:00
psa_algorithm_t alg,
const uint8_t *input,
size_t input_length,
const uint8_t *salt,
size_t salt_length,
uint8_t *output,
size_t output_size,
size_t *output_length )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
{
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 16:12:32 +00:00
psa_key_slot_t *slot;
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 15:01:38 +00:00
Add handling for (sometimes) unused parameters
2018-07-24 14:34:10 +00:00
(void) input;
(void) input_length;
(void) salt;
(void) output;
(void) output_size;
Set output length to safe value
2018-06-04 13:43:12 +00:00
*output_length = 0;
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
psa_asymmetric_{encrypt,decrypt}: reject salt when not allowed In psa_asymmetric_encrypt and psa_asymmetric_decrypt, if the algorithm does not use a salt, require the salt to be empty.
2018-06-30 17:04:35 +00:00
if( ! PSA_ALG_IS_RSA_OAEP( alg ) && salt_length != 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
status = psa_get_and_lock_transparent_key_slot_with_policy(
key, &slot, PSA_KEY_USAGE_DECRYPT, alg );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 15:01:38 +00:00
if( status != PSA_SUCCESS )
return( status );
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( ! PSA_KEY_TYPE_IS_KEY_PAIR( slot->attr.type ) )
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
{
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
}
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 16:50:04 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( slot->attr.type == PSA_KEY_TYPE_RSA_KEY_PAIR )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
{
Apply review feedback * No need to check for NULL before free'ing * No need to reset variables that weren't touched * Set output buffer to zero if key output fails * Document internal functions and rearrange order of input arguments to better match other functions. * Clean up Montgomery fix to be less verbose code Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-03 12:46:03 +00:00
mbedtls_rsa_context *rsa = NULL;
psa: Rename psa_load_rsa/ecp_representation Rename psa_load_rsa/ecp_representation to mbedtls_psa_rsa/ecp_load_representation before to move them in their RSA/ECP specific PSA crypto C modules. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 13:58:33 +00:00
status = mbedtls_psa_rsa_load_representation( slot->attr.type,
slot->key.data,
slot->key.bytes,
&rsa );
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 20:48:15 +00:00
if( status != PSA_SUCCESS )
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
goto exit;
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:39 +00:00
if( input_length != mbedtls_rsa_get_len( rsa ) )
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 20:48:15 +00:00
{
Apply review feedback * No need to check for NULL before free'ing * No need to reset variables that weren't touched * Set output buffer to zero if key output fails * Document internal functions and rearrange order of input arguments to better match other functions. * Clean up Montgomery fix to be less verbose code Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-03 12:46:03 +00:00
status = PSA_ERROR_INVALID_ARGUMENT;
goto rsa_exit;
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 20:48:15 +00:00
}
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
Add feature support for RSA for PSA crypto config In the original attempt to add RSA support to PSA crypto config was too generic. This set of changes adds support for the following RSA features: PSA_WANT_ALG_RSA_PKCS1V15_CRYPT, PSA_WANT_ALG_RSA_PKCS1V15_SIGN, PSA_WANT_ALG_RSA_OAEP, PSA_WANT_ALG_RSA_PSS, PSA_WANT_KEY_TYPE_RSA_KEY_PAIR, and PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY. There were also some updates to ensure the proper inclusion of PSA crypto library code when certain features are enabled. These updates were made to address warnings and errors in builds from the new tests for these features being added for PSA crypto configuration. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-01 05:06:54 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT)
Finish renaming around PSA_ALG_IS_RSA_PKCS1V15 Now the code compiles. Some OAEP and PSS macros may still need to be fixed.
2018-05-31 11:16:08 +00:00
if( alg == PSA_ALG_RSA_PKCS1V15_CRYPT )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
{
Apply review feedback * No need to check for NULL before free'ing * No need to reset variables that weren't touched * Set output buffer to zero if key output fails * Document internal functions and rearrange order of input arguments to better match other functions. * Clean up Montgomery fix to be less verbose code Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-03 12:46:03 +00:00
status = mbedtls_to_psa_error(
mbedtls_rsa_pkcs1_decrypt( rsa,
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 16:02:26 +00:00
mbedtls_psa_get_random,
Replace mbedtls_psa_random_state( ... ) by MBEDTLS_PSA_RANDOM_STATE Hide the obtention of the pointer to the RNG state behind a macro. To make it possible to use this macro in a module other than psa_crypto.c, which will happen in the future, make sure that the definition of the macro does not reference internal variables of psa_crypto.c. For this purpose, in the internal-DRBG case, export a symbol containing the address of the DRBG state. When the RNG state is a pointer a DRBG state, just keep this pointer in a variable: there's no need to store a pointer to a larger structure. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-14 13:54:06 +00:00
MBEDTLS_PSA_RANDOM_STATE,
Apply review feedback * No need to check for NULL before free'ing * No need to reset variables that weren't touched * Set output buffer to zero if key output fails * Document internal functions and rearrange order of input arguments to better match other functions. * Clean up Montgomery fix to be less verbose code Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-03 12:46:03 +00:00
MBEDTLS_RSA_PRIVATE,
output_length,
input,
output,
output_size ) );
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
}
else
Add feature support for RSA for PSA crypto config In the original attempt to add RSA support to PSA crypto config was too generic. This set of changes adds support for the following RSA features: PSA_WANT_ALG_RSA_PKCS1V15_CRYPT, PSA_WANT_ALG_RSA_PKCS1V15_SIGN, PSA_WANT_ALG_RSA_OAEP, PSA_WANT_ALG_RSA_PSS, PSA_WANT_KEY_TYPE_RSA_KEY_PAIR, and PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY. There were also some updates to ensure the proper inclusion of PSA crypto library code when certain features are enabled. These updates were made to address warnings and errors in builds from the new tests for these features being added for PSA crypto configuration. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-01 05:06:54 +00:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT */
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
Sort out RSA mechanisms * PSS needs to be parametrized by a hash. * Don't use `_MGF1` in the names of macros for OAEP and PSS. No one ever uses anything else. * Add brief documentation for the RSA signature mechanisms.
2018-06-26 13:53:48 +00:00
if( PSA_ALG_IS_RSA_OAEP( alg ) )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
{
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:39 +00:00
psa_rsa_oaep_set_padding_mode( alg, rsa );
Apply review feedback * No need to check for NULL before free'ing * No need to reset variables that weren't touched * Set output buffer to zero if key output fails * Document internal functions and rearrange order of input arguments to better match other functions. * Clean up Montgomery fix to be less verbose code Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-03 12:46:03 +00:00
status = mbedtls_to_psa_error(
mbedtls_rsa_rsaes_oaep_decrypt( rsa,
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 16:02:26 +00:00
mbedtls_psa_get_random,
Replace mbedtls_psa_random_state( ... ) by MBEDTLS_PSA_RANDOM_STATE Hide the obtention of the pointer to the RNG state behind a macro. To make it possible to use this macro in a module other than psa_crypto.c, which will happen in the future, make sure that the definition of the macro does not reference internal variables of psa_crypto.c. For this purpose, in the internal-DRBG case, export a symbol containing the address of the DRBG state. When the RNG state is a pointer a DRBG state, just keep this pointer in a variable: there's no need to store a pointer to a larger structure. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-14 13:54:06 +00:00
MBEDTLS_PSA_RANDOM_STATE,
Apply review feedback * No need to check for NULL before free'ing * No need to reset variables that weren't touched * Set output buffer to zero if key output fails * Document internal functions and rearrange order of input arguments to better match other functions. * Clean up Montgomery fix to be less verbose code Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-03 12:46:03 +00:00
MBEDTLS_RSA_PRIVATE,
salt, salt_length,
output_length,
input,
output,
output_size ) );
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
}
else
Add feature support for RSA for PSA crypto config In the original attempt to add RSA support to PSA crypto config was too generic. This set of changes adds support for the following RSA features: PSA_WANT_ALG_RSA_PKCS1V15_CRYPT, PSA_WANT_ALG_RSA_PKCS1V15_SIGN, PSA_WANT_ALG_RSA_OAEP, PSA_WANT_ALG_RSA_PSS, PSA_WANT_KEY_TYPE_RSA_KEY_PAIR, and PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY. There were also some updates to ensure the proper inclusion of PSA crypto library code when certain features are enabled. These updates were made to address warnings and errors in builds from the new tests for these features being added for PSA crypto configuration. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-01 05:06:54 +00:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP */
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
{
Apply review feedback * No need to check for NULL before free'ing * No need to reset variables that weren't touched * Set output buffer to zero if key output fails * Document internal functions and rearrange order of input arguments to better match other functions. * Clean up Montgomery fix to be less verbose code Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-03 12:46:03 +00:00
status = PSA_ERROR_INVALID_ARGUMENT;
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
}
Remove duplicate / unneeded code 1. remove duplicate function introduced by re-base 2. remove unneeded code
2018-06-04 13:36:15 +00:00
Apply review feedback * No need to check for NULL before free'ing * No need to reset variables that weren't touched * Set output buffer to zero if key output fails * Document internal functions and rearrange order of input arguments to better match other functions. * Clean up Montgomery fix to be less verbose code Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-03 12:46:03 +00:00
rsa_exit:
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:39 +00:00
mbedtls_rsa_free( rsa );
mbedtls_free( rsa );
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
}
else
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 16:50:04 +00:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) ||
* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
{
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
status = PSA_ERROR_NOT_SUPPORTED;
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
}
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
exit:
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
unlock_status = psa_unlock_key_slot( slot );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Remove trailing whitespace Only horizontal whitespace changes in this commit.
2018-05-31 11:25:48 +00:00
}
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
Be more consistent about blank lines
2018-06-18 19:49:39 +00:00
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
/****************************************************************/
/* Symmetric cryptography */
/****************************************************************/
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 14:22:46 +00:00
static psa_status_t psa_cipher_setup( psa_cipher_operation_t *operation,
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
mbedtls_svc_key_id_t key,
Wrap lines to 80 columns
2018-06-04 14:23:10 +00:00
psa_algorithm_t alg,
mbedtls_operation_t cipher_operation )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
{
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Fix cleanup in psa_cipher_setup In some error cases, psa_cipher_setup was leaving a partly-initialized operation context.
2019-02-25 16:43:14 +00:00
int ret = 0;
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 16:12:32 +00:00
psa_key_slot_t *slot;
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
size_t key_bits;
const mbedtls_cipher_info_t *cipher_info = NULL;
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 15:01:38 +00:00
psa_key_usage_t usage = ( cipher_operation == MBEDTLS_ENCRYPT ?
PSA_KEY_USAGE_ENCRYPT :
PSA_KEY_USAGE_DECRYPT );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
Restructure cipher context object to contain driver switch Once an operation has been 'accepted' by a driver, the remainder is bound to the same driver, since driver-specific context structs cannot be shared. This provides a pretty good gate mechanism for the fallback logic, too. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-01 13:56:14 +00:00
/* A context must be freshly initialized before it can be set up. */
if( operation->alg != 0 )
return( PSA_ERROR_BAD_STATE );
Update semantics around driver context use in psa_cipher_setup Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-10 12:54:14 +00:00
/* The requested algorithm must be one that can be processed by cipher. */
if( ! PSA_ALG_IS_CIPHER( alg ) )
return( PSA_ERROR_INVALID_ARGUMENT );
Apply review feedback * Reworked the cipher context once again to be more robustly defined * Removed redundant memset * Unified behaviour on failure between driver and software in cipher_finish * Cipher test driver setup function now also returns early when its status is overridden, like the other test driver functions * Removed redundant test cases * Added bad-order checking to verify the driver doesn't get called where the spec says it won't. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-11 09:44:50 +00:00
/* Fetch key material from key storage. */
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
status = psa_get_and_lock_key_slot_with_policy( key, &slot, usage, alg );
Apply review feedback * Reworked the cipher context once again to be more robustly defined * Removed redundant memset * Unified behaviour on failure between driver and software in cipher_finish * Cipher test driver setup function now also returns early when its status is overridden, like the other test driver functions * Removed redundant test cases * Added bad-order checking to verify the driver doesn't get called where the spec says it won't. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-11 09:44:50 +00:00
if( status != PSA_SUCCESS )
goto exit;
/* Initialize the operation struct members, except for alg. The alg member
* is used to indicate to psa_cipher_abort that there are resources to free,
* so we only set it after resources have been allocated/initialized. */
Update semantics around driver context use in psa_cipher_setup Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-10 12:54:14 +00:00
operation->key_set = 0;
operation->iv_set = 0;
Apply review feedback * Reworked the cipher context once again to be more robustly defined * Removed redundant memset * Unified behaviour on failure between driver and software in cipher_finish * Cipher test driver setup function now also returns early when its status is overridden, like the other test driver functions * Removed redundant test cases * Added bad-order checking to verify the driver doesn't get called where the spec says it won't. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-11 09:44:50 +00:00
operation->mbedtls_in_use = 0;
Update semantics around driver context use in psa_cipher_setup Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-10 12:54:14 +00:00
operation->iv_size = 0;
operation->block_size = 0;
if( alg == PSA_ALG_ECB_NO_PADDING )
operation->iv_required = 0;
else
operation->iv_required = 1;
/* Try doing the operation through a driver before using software fallback. */
Add initial pass on a multi-part test driver Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 16:49:51 +00:00
if( cipher_operation == MBEDTLS_ENCRYPT )
Only pass the driver-relevant portion of the context struct Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-09 10:01:43 +00:00
status = psa_driver_wrapper_cipher_encrypt_setup( &operation->ctx.driver,
Add initial pass on a multi-part test driver Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 16:49:51 +00:00
slot,
alg );
else
Only pass the driver-relevant portion of the context struct Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-09 10:01:43 +00:00
status = psa_driver_wrapper_cipher_decrypt_setup( &operation->ctx.driver,
Add initial pass on a multi-part test driver Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 16:49:51 +00:00
slot,
alg );
Apply review feedback * Reworked the cipher context once again to be more robustly defined * Removed redundant memset * Unified behaviour on failure between driver and software in cipher_finish * Cipher test driver setup function now also returns early when its status is overridden, like the other test driver functions * Removed redundant test cases * Added bad-order checking to verify the driver doesn't get called where the spec says it won't. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-11 09:44:50 +00:00
if( status == PSA_SUCCESS )
Final feedback from @ronald-cron-arm Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-14 11:14:31 +00:00
{
Apply review feedback * Reworked the cipher context once again to be more robustly defined * Removed redundant memset * Unified behaviour on failure between driver and software in cipher_finish * Cipher test driver setup function now also returns early when its status is overridden, like the other test driver functions * Removed redundant test cases * Added bad-order checking to verify the driver doesn't get called where the spec says it won't. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-11 09:44:50 +00:00
/* Once the driver context is initialised, it needs to be freed using
* psa_cipher_abort. Indicate this through setting alg. */
operation->alg = alg;
Final feedback from @ronald-cron-arm Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-14 11:14:31 +00:00
}
Apply review feedback * Reworked the cipher context once again to be more robustly defined * Removed redundant memset * Unified behaviour on failure between driver and software in cipher_finish * Cipher test driver setup function now also returns early when its status is overridden, like the other test driver functions * Removed redundant test cases * Added bad-order checking to verify the driver doesn't get called where the spec says it won't. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-11 09:44:50 +00:00
Restructure cipher context object to contain driver switch Once an operation has been 'accepted' by a driver, the remainder is bound to the same driver, since driver-specific context structs cannot be shared. This provides a pretty good gate mechanism for the fallback logic, too. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-01 13:56:14 +00:00
if( status != PSA_ERROR_NOT_SUPPORTED ||
psa_key_lifetime_is_external( slot->attr.lifetime ) )
goto exit;
Update semantics around driver context use in psa_cipher_setup Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-10 12:54:14 +00:00
/* Proceed with initializing an mbed TLS cipher context if no driver is
Restructure cipher context object to contain driver switch Once an operation has been 'accepted' by a driver, the remainder is bound to the same driver, since driver-specific context structs cannot be shared. This provides a pretty good gate mechanism for the fallback logic, too. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-01 13:56:14 +00:00
* available for the given algorithm & key. */
mbedtls_cipher_init( &operation->ctx.cipher );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
Update semantics around driver context use in psa_cipher_setup Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-10 12:54:14 +00:00
/* Once the cipher context is initialised, it needs to be freed using
Apply review feedback * Reworked the cipher context once again to be more robustly defined * Removed redundant memset * Unified behaviour on failure between driver and software in cipher_finish * Cipher test driver setup function now also returns early when its status is overridden, like the other test driver functions * Removed redundant test cases * Added bad-order checking to verify the driver doesn't get called where the spec says it won't. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-11 09:44:50 +00:00
* psa_cipher_abort. Indicate there is something to be freed through setting
* alg, and indicate the operation is being done using mbedtls crypto through
* setting mbedtls_in_use. */
Update semantics around driver context use in psa_cipher_setup Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-10 12:54:14 +00:00
operation->alg = alg;
Apply review feedback * Reworked the cipher context once again to be more robustly defined * Removed redundant memset * Unified behaviour on failure between driver and software in cipher_finish * Cipher test driver setup function now also returns early when its status is overridden, like the other test driver functions * Removed redundant test cases * Added bad-order checking to verify the driver doesn't get called where the spec says it won't. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-11 09:44:50 +00:00
operation->mbedtls_in_use = 1;
Update semantics around driver context use in psa_cipher_setup Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-10 12:54:14 +00:00
Implement missing attributes setters and getters
2019-04-18 10:53:01 +00:00
key_bits = psa_get_key_slot_bits( slot );
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
cipher_info = mbedtls_cipher_info_from_psa( alg, slot->attr.type, key_bits, NULL );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
if( cipher_info == NULL )
Fix cleanup in psa_cipher_setup In some error cases, psa_cipher_setup was leaving a partly-initialized operation context.
2019-02-25 16:43:14 +00:00
{
status = PSA_ERROR_NOT_SUPPORTED;
goto exit;
}
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
ret = mbedtls_cipher_setup( &operation->ctx.cipher, cipher_info );
partly pr fix
2018-04-04 12:43:05 +00:00
if( ret != 0 )
Fix cleanup in psa_cipher_setup In some error cases, psa_cipher_setup was leaving a partly-initialized operation context.
2019-02-25 16:43:14 +00:00
goto exit;
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
Change some conditionals of PSA to use BUILTIN Change a few conditionals in the psa library to be based on the MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES instead of the WANT macros. Future additions of HW acceleration will need to be mindful of these definitions if any of this code is needed in those instances. Signed-off-by: David Brown <david.brown@linaro.org>
2021-02-11 18:02:00 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( slot->attr.type == PSA_KEY_TYPE_DES && key_bits == 128 )
Add what little was missing to fully support DES Also add what was missing in the test suite to support block ciphers with a block size that isn't 16. Fix some buggy test data that passed only due to problems with DES support in the product.
2018-06-21 07:40:04 +00:00
{
/* Two-key Triple-DES is 3-key Triple-DES with K1=K3 */
Favor stdint.h types in internal types Use uint8_t for PSA buffers. Keep unsigned char for generic libc buffers and for mbedtls buffers.
2019-07-15 09:06:38 +00:00
uint8_t keys[24];
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:52:23 +00:00
memcpy( keys, slot->key.data, 16 );
memcpy( keys + 16, slot->key.data, 8 );
Add what little was missing to fully support DES Also add what was missing in the test suite to support block ciphers with a block size that isn't 16. Fix some buggy test data that passed only due to problems with DES support in the product.
2018-06-21 07:40:04 +00:00
ret = mbedtls_cipher_setkey( &operation->ctx.cipher,
keys,
192, cipher_operation );
}
else
#endif
{
ret = mbedtls_cipher_setkey( &operation->ctx.cipher,
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:52:23 +00:00
slot->key.data,
psa: Pass the number of bits with explicit types The GCM, CCM, RSA, and cipher modules inconsistently use int or unsigned int for a count of bits. The PSA Crypto API uses size_t for counting things. This causes issues on LLP64 systems where a size_t can hold more than an unsigned int. Add casts for where key_bits and bits are passed to mbedtls_* APIs.
2018-06-26 13:16:54 +00:00
(int) key_bits, cipher_operation );
Add what little was missing to fully support DES Also add what was missing in the test suite to support block ciphers with a block size that isn't 16. Fix some buggy test data that passed only due to problems with DES support in the product.
2018-06-21 07:40:04 +00:00
}
partly pr fix
2018-04-04 12:43:05 +00:00
if( ret != 0 )
Fix cleanup in psa_cipher_setup In some error cases, psa_cipher_setup was leaving a partly-initialized operation context.
2019-02-25 16:43:14 +00:00
goto exit;
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
Change psa_crypto.c ifdefs for cipher modes Change to use the MBEDTLS_PSA_BUILTIN... macros defined by the cipher modes. Signed-off-by: David Brown <david.brown@linaro.org>
2021-01-26 18:51:12 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CBC_NO_PADDING) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_CBC_PKCS7)
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 12:02:45 +00:00
switch( alg )
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 11:57:31 +00:00
{
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 12:02:45 +00:00
case PSA_ALG_CBC_NO_PADDING:
ret = mbedtls_cipher_set_padding_mode( &operation->ctx.cipher,
MBEDTLS_PADDING_NONE );
break;
case PSA_ALG_CBC_PKCS7:
ret = mbedtls_cipher_set_padding_mode( &operation->ctx.cipher,
MBEDTLS_PADDING_PKCS7 );
break;
default:
/* The algorithm doesn't involve padding. */
ret = 0;
break;
}
if( ret != 0 )
Fix cleanup in psa_cipher_setup In some error cases, psa_cipher_setup was leaving a partly-initialized operation context.
2019-02-25 16:43:14 +00:00
goto exit;
Fix mistyped endif comment Correct the endif comment to match the condition used in the ifdef. Signed-off-by: David Brown <david.brown@linaro.org>
2021-02-09 23:27:55 +00:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CBC_NO_PADDING || MBEDTLS_PSA_BUILTIN_ALG_CBC_PKCS7 */
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 11:57:31 +00:00
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 12:02:45 +00:00
operation->block_size = ( PSA_ALG_IS_STREAM_CIPHER( alg ) ? 1 :
Rename output buffer size macros Rename existing support macros for output buffer sizes for PSA Crypto API 1.0.0 Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-12-18 13:23:51 +00:00
PSA_BLOCK_CIPHER_BLOCK_LENGTH( slot->attr.type ) );
Style and language fixes Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-25 09:47:50 +00:00
if( ( alg & PSA_ALG_CIPHER_FROM_BLOCK_FLAG ) != 0 &&
alg != PSA_ALG_ECB_NO_PADDING )
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 11:57:31 +00:00
{
Rename output buffer size macros Rename existing support macros for output buffer sizes for PSA Crypto API 1.0.0 Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-12-18 13:23:51 +00:00
operation->iv_size = PSA_BLOCK_CIPHER_BLOCK_LENGTH( slot->attr.type );
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 11:57:31 +00:00
}
Use new PSA builtin defines for CHACHA20 Change the psa_crypto use of the CHACHA20 cipher to also use the new MBEDTLS_PSA_BUILTIN_KE_TYPE_CHACHA20. Signed-off-by: David Brown <david.brown@linaro.org>
2021-02-16 19:54:35 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_CHACHA20)
Implement ChaCha20 and ChaCha20-Poly1305 Smoke tests: test data for ChaCha20 calculated with PyCryptodome; test vector from RFC 7539 for ChaCha20-Poly1305.
2019-05-06 13:25:00 +00:00
else
Substitute PSA_ALG_STREAM_CIPHER into all files Deprecate PSA_ALG_ARC4 and PSA_ALG_CHACHA20. Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2020-12-07 23:01:31 +00:00
if( alg == PSA_ALG_STREAM_CIPHER && slot->attr.type == PSA_KEY_TYPE_CHACHA20 )
Implement ChaCha20 and ChaCha20-Poly1305 Smoke tests: test data for ChaCha20 calculated with PyCryptodome; test vector from RFC 7539 for ChaCha20-Poly1305.
2019-05-06 13:25:00 +00:00
operation->iv_size = 12;
#endif
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
Check & set operation flags for both driver and software in the core Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-09 13:28:49 +00:00
status = PSA_SUCCESS;
Fix cleanup in psa_cipher_setup In some error cases, psa_cipher_setup was leaving a partly-initialized operation context.
2019-02-25 16:43:14 +00:00
exit:
Check & set operation flags for both driver and software in the core Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-09 13:28:49 +00:00
if( ret != 0 )
Fix cleanup in psa_cipher_setup In some error cases, psa_cipher_setup was leaving a partly-initialized operation context.
2019-02-25 16:43:14 +00:00
status = mbedtls_to_psa_error( ret );
Check & set operation flags for both driver and software in the core Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-09 13:28:49 +00:00
if( status == PSA_SUCCESS )
{
/* Update operation flags for both driver and software implementations */
operation->key_set = 1;
}
else
Fix cleanup in psa_cipher_setup In some error cases, psa_cipher_setup was leaving a partly-initialized operation context.
2019-02-25 16:43:14 +00:00
psa_cipher_abort( operation );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
unlock_status = psa_unlock_key_slot( slot );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
return( ( status == PSA_SUCCESS ) ? unlock_status : status );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
}
Rename psa cipher functions to psa_cipher_xxx Make function names for multipart operations more consistent (cipher edition). Rename symmetric cipher multipart operation functions so that they all start with psa_cipher_: * psa_encrypt_setup -> psa_cipher_encrypt_setup * psa_decrypt_setup -> psa_cipher_decrypt_setup * psa_encrypt_set_iv -> psa_cipher_set_iv * psa_encrypt_generate_iv -> psa_cipher_generate_iv
2018-07-08 19:39:34 +00:00
psa_status_t psa_cipher_encrypt_setup( psa_cipher_operation_t *operation,
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
mbedtls_svc_key_id_t key,
Rename psa cipher functions to psa_cipher_xxx Make function names for multipart operations more consistent (cipher edition). Rename symmetric cipher multipart operation functions so that they all start with psa_cipher_: * psa_encrypt_setup -> psa_cipher_encrypt_setup * psa_decrypt_setup -> psa_cipher_decrypt_setup * psa_encrypt_set_iv -> psa_cipher_set_iv * psa_encrypt_generate_iv -> psa_cipher_generate_iv
2018-07-08 19:39:34 +00:00
psa_algorithm_t alg )
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 11:57:31 +00:00
{
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
return( psa_cipher_setup( operation, key, alg, MBEDTLS_ENCRYPT ) );
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 11:57:31 +00:00
}
Rename psa cipher functions to psa_cipher_xxx Make function names for multipart operations more consistent (cipher edition). Rename symmetric cipher multipart operation functions so that they all start with psa_cipher_: * psa_encrypt_setup -> psa_cipher_encrypt_setup * psa_decrypt_setup -> psa_cipher_decrypt_setup * psa_encrypt_set_iv -> psa_cipher_set_iv * psa_encrypt_generate_iv -> psa_cipher_generate_iv
2018-07-08 19:39:34 +00:00
psa_status_t psa_cipher_decrypt_setup( psa_cipher_operation_t *operation,
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
mbedtls_svc_key_id_t key,
Rename psa cipher functions to psa_cipher_xxx Make function names for multipart operations more consistent (cipher edition). Rename symmetric cipher multipart operation functions so that they all start with psa_cipher_: * psa_encrypt_setup -> psa_cipher_encrypt_setup * psa_decrypt_setup -> psa_cipher_decrypt_setup * psa_encrypt_set_iv -> psa_cipher_set_iv * psa_encrypt_generate_iv -> psa_cipher_generate_iv
2018-07-08 19:39:34 +00:00
psa_algorithm_t alg )
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 11:57:31 +00:00
{
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
return( psa_cipher_setup( operation, key, alg, MBEDTLS_DECRYPT ) );
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 11:57:31 +00:00
}
Rename psa cipher functions to psa_cipher_xxx Make function names for multipart operations more consistent (cipher edition). Rename symmetric cipher multipart operation functions so that they all start with psa_cipher_: * psa_encrypt_setup -> psa_cipher_encrypt_setup * psa_decrypt_setup -> psa_cipher_decrypt_setup * psa_encrypt_set_iv -> psa_cipher_set_iv * psa_encrypt_generate_iv -> psa_cipher_generate_iv
2018-07-08 19:39:34 +00:00
psa_status_t psa_cipher_generate_iv( psa_cipher_operation_t *operation,
Apply same changes to implementation source code
2019-05-15 11:33:23 +00:00
uint8_t *iv,
Rename psa cipher functions to psa_cipher_xxx Make function names for multipart operations more consistent (cipher edition). Rename symmetric cipher multipart operation functions so that they all start with psa_cipher_: * psa_encrypt_setup -> psa_cipher_encrypt_setup * psa_decrypt_setup -> psa_cipher_decrypt_setup * psa_encrypt_set_iv -> psa_cipher_set_iv * psa_encrypt_generate_iv -> psa_cipher_generate_iv
2018-07-08 19:39:34 +00:00
size_t iv_size,
size_t *iv_length )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
{
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 10:56:32 +00:00
psa_status_t status;
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Check & set operation flags for both driver and software in the core Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-09 13:28:49 +00:00
if( operation->iv_set || ! operation->iv_required )
{
return( PSA_ERROR_BAD_STATE );
}
Restructure cipher context object to contain driver switch Once an operation has been 'accepted' by a driver, the remainder is bound to the same driver, since driver-specific context structs cannot be shared. This provides a pretty good gate mechanism for the fallback logic, too. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-01 13:56:14 +00:00
Apply review feedback * Reworked the cipher context once again to be more robustly defined * Removed redundant memset * Unified behaviour on failure between driver and software in cipher_finish * Cipher test driver setup function now also returns early when its status is overridden, like the other test driver functions * Removed redundant test cases * Added bad-order checking to verify the driver doesn't get called where the spec says it won't. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-11 09:44:50 +00:00
if( operation->mbedtls_in_use == 0 )
Add a working implementation of a multipart AES-CTR test driver Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-03 13:30:32 +00:00
{
Only pass the driver-relevant portion of the context struct Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-09 10:01:43 +00:00
status = psa_driver_wrapper_cipher_generate_iv( &operation->ctx.driver,
Add a working implementation of a multipart AES-CTR test driver Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-03 13:30:32 +00:00
iv,
iv_size,
iv_length );
goto exit;
}
Restructure cipher context object to contain driver switch Once an operation has been 'accepted' by a driver, the remainder is bound to the same driver, since driver-specific context structs cannot be shared. This provides a pretty good gate mechanism for the fallback logic, too. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-01 13:56:14 +00:00
partly pr fix
2018-04-04 12:43:05 +00:00
if( iv_size < operation->iv_size )
{
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 10:56:32 +00:00
status = PSA_ERROR_BUFFER_TOO_SMALL;
partly pr fix
2018-04-04 12:43:05 +00:00
goto exit;
}
Replace mbedtls_psa_random_state( ... ) by MBEDTLS_PSA_RANDOM_STATE Hide the obtention of the pointer to the RNG state behind a macro. To make it possible to use this macro in a module other than psa_crypto.c, which will happen in the future, make sure that the definition of the macro does not reference internal variables of psa_crypto.c. For this purpose, in the internal-DRBG case, export a symbol containing the address of the DRBG state. When the RNG state is a pointer a DRBG state, just keep this pointer in a variable: there's no need to store a pointer to a larger structure. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-14 13:54:06 +00:00
ret = mbedtls_psa_get_random( MBEDTLS_PSA_RANDOM_STATE,
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 16:02:26 +00:00
iv, operation->iv_size );
partly pr fix
2018-04-04 12:43:05 +00:00
if( ret != 0 )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
{
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 10:56:32 +00:00
status = mbedtls_to_psa_error( ret );
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 14:22:46 +00:00
goto exit;
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
}
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 14:22:46 +00:00
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 11:57:31 +00:00
*iv_length = operation->iv_size;
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 10:56:32 +00:00
status = psa_cipher_set_iv( operation, iv, *iv_length );
partly pr fix
2018-04-04 12:43:05 +00:00
adjust indentation per Mbed TLS standards
2018-05-31 11:07:14 +00:00
exit:
Check & set operation flags for both driver and software in the core Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-09 13:28:49 +00:00
if( status == PSA_SUCCESS )
operation->iv_set = 1;
else
adjust indentation per Mbed TLS standards
2018-05-31 11:07:14 +00:00
psa_cipher_abort( operation );
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 10:56:32 +00:00
return( status );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
}
Rename psa cipher functions to psa_cipher_xxx Make function names for multipart operations more consistent (cipher edition). Rename symmetric cipher multipart operation functions so that they all start with psa_cipher_: * psa_encrypt_setup -> psa_cipher_encrypt_setup * psa_decrypt_setup -> psa_cipher_decrypt_setup * psa_encrypt_set_iv -> psa_cipher_set_iv * psa_encrypt_generate_iv -> psa_cipher_generate_iv
2018-07-08 19:39:34 +00:00
psa_status_t psa_cipher_set_iv( psa_cipher_operation_t *operation,
Apply same changes to implementation source code
2019-05-15 11:33:23 +00:00
const uint8_t *iv,
Rename psa cipher functions to psa_cipher_xxx Make function names for multipart operations more consistent (cipher edition). Rename symmetric cipher multipart operation functions so that they all start with psa_cipher_: * psa_encrypt_setup -> psa_cipher_encrypt_setup * psa_decrypt_setup -> psa_cipher_decrypt_setup * psa_encrypt_set_iv -> psa_cipher_set_iv * psa_encrypt_generate_iv -> psa_cipher_generate_iv
2018-07-08 19:39:34 +00:00
size_t iv_length )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
{
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 10:56:32 +00:00
psa_status_t status;
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Check & set operation flags for both driver and software in the core Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-09 13:28:49 +00:00
if( operation->iv_set || ! operation->iv_required )
{
return( PSA_ERROR_BAD_STATE );
}
Restructure cipher context object to contain driver switch Once an operation has been 'accepted' by a driver, the remainder is bound to the same driver, since driver-specific context structs cannot be shared. This provides a pretty good gate mechanism for the fallback logic, too. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-01 13:56:14 +00:00
Apply review feedback * Reworked the cipher context once again to be more robustly defined * Removed redundant memset * Unified behaviour on failure between driver and software in cipher_finish * Cipher test driver setup function now also returns early when its status is overridden, like the other test driver functions * Removed redundant test cases * Added bad-order checking to verify the driver doesn't get called where the spec says it won't. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-11 09:44:50 +00:00
if( operation->mbedtls_in_use == 0 )
Add a working implementation of a multipart AES-CTR test driver Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-03 13:30:32 +00:00
{
Only pass the driver-relevant portion of the context struct Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-09 10:01:43 +00:00
status = psa_driver_wrapper_cipher_set_iv( &operation->ctx.driver,
Add a working implementation of a multipart AES-CTR test driver Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-03 13:30:32 +00:00
iv,
iv_length );
goto exit;
}
Restructure cipher context object to contain driver switch Once an operation has been 'accepted' by a driver, the remainder is bound to the same driver, since driver-specific context structs cannot be shared. This provides a pretty good gate mechanism for the fallback logic, too. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-01 13:56:14 +00:00
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 10:56:32 +00:00
if( iv_length != operation->iv_size )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
{
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 10:56:32 +00:00
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
}
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 10:56:32 +00:00
ret = mbedtls_cipher_set_iv( &operation->ctx.cipher, iv, iv_length );
status = mbedtls_to_psa_error( ret );
exit:
if( status == PSA_SUCCESS )
operation->iv_set = 1;
else
psa_cipher_abort( operation );
return( status );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
}
Fix style and pull out ECB processing in separate function Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-07 15:14:14 +00:00
/* Process input for which the algorithm is set to ECB mode. This requires
* manual processing, since the PSA API is defined as being able to process
* arbitrary-length calls to psa_cipher_update() with ECB mode, but the
* underlying mbedtls_cipher_update only takes full blocks. */
static psa_status_t psa_cipher_update_ecb_internal(
mbedtls_cipher_context_t *ctx,
const uint8_t *input,
size_t input_length,
uint8_t *output,
size_t output_size,
size_t *output_length )
{
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
size_t block_size = ctx->cipher_info->block_size;
size_t internal_output_length = 0;
*output_length = 0;
if( input_length == 0 )
{
status = PSA_SUCCESS;
goto exit;
}
if( ctx->unprocessed_len > 0 )
{
/* Fill up to block size, and run the block if there's a full one. */
size_t bytes_to_copy = block_size - ctx->unprocessed_len;
if( input_length < bytes_to_copy )
bytes_to_copy = input_length;
memcpy( &( ctx->unprocessed_data[ctx->unprocessed_len] ),
input, bytes_to_copy );
input_length -= bytes_to_copy;
input += bytes_to_copy;
ctx->unprocessed_len += bytes_to_copy;
if( ctx->unprocessed_len == block_size )
{
status = mbedtls_to_psa_error(
mbedtls_cipher_update( ctx,
ctx->unprocessed_data,
block_size,
output, &internal_output_length ) );
if( status != PSA_SUCCESS )
goto exit;
output += internal_output_length;
output_size -= internal_output_length;
*output_length += internal_output_length;
ctx->unprocessed_len = 0;
}
}
while( input_length >= block_size )
{
/* Run all full blocks we have, one by one */
status = mbedtls_to_psa_error(
mbedtls_cipher_update( ctx, input,
block_size,
output, &internal_output_length ) );
if( status != PSA_SUCCESS )
goto exit;
input_length -= block_size;
input += block_size;
output += internal_output_length;
output_size -= internal_output_length;
*output_length += internal_output_length;
}
if( input_length > 0 )
{
/* Save unprocessed bytes for later processing */
memcpy( &( ctx->unprocessed_data[ctx->unprocessed_len] ),
input, input_length );
ctx->unprocessed_len += input_length;
}
status = PSA_SUCCESS;
exit:
return( status );
}
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 14:22:46 +00:00
psa_status_t psa_cipher_update( psa_cipher_operation_t *operation,
const uint8_t *input,
size_t input_length,
Apply same changes to implementation source code
2019-05-15 11:33:23 +00:00
uint8_t *output,
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 14:22:46 +00:00
size_t output_size,
size_t *output_length )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
{
Implement support for multipart ECB and add tests Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-25 13:13:13 +00:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Refactor some argument checks for readability No intended behavior change.
2018-06-04 15:17:16 +00:00
size_t expected_output_size;
Check & set operation flags for both driver and software in the core Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-09 13:28:49 +00:00
if( operation->alg == 0 )
{
return( PSA_ERROR_BAD_STATE );
}
if( operation->iv_required && ! operation->iv_set )
{
return( PSA_ERROR_BAD_STATE );
}
psa: Disallow use of invalid cipher contexts Ensure that when doing cipher operations out of order, PSA_ERROR_BAD_STATE is returned as documented in crypto.h and the PSA Crypto specification.
2019-02-15 14:12:05 +00:00
Apply review feedback * Reworked the cipher context once again to be more robustly defined * Removed redundant memset * Unified behaviour on failure between driver and software in cipher_finish * Cipher test driver setup function now also returns early when its status is overridden, like the other test driver functions * Removed redundant test cases * Added bad-order checking to verify the driver doesn't get called where the spec says it won't. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-11 09:44:50 +00:00
if( operation->mbedtls_in_use == 0 )
Add a working implementation of a multipart AES-CTR test driver Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-03 13:30:32 +00:00
{
Only pass the driver-relevant portion of the context struct Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-09 10:01:43 +00:00
status = psa_driver_wrapper_cipher_update( &operation->ctx.driver,
Add a working implementation of a multipart AES-CTR test driver Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-03 13:30:32 +00:00
input,
input_length,
output,
output_size,
output_length );
goto exit;
}
Restructure cipher context object to contain driver switch Once an operation has been 'accepted' by a driver, the remainder is bound to the same driver, since driver-specific context structs cannot be shared. This provides a pretty good gate mechanism for the fallback logic, too. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-01 13:56:14 +00:00
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 12:02:45 +00:00
if( ! PSA_ALG_IS_STREAM_CIPHER( operation->alg ) )
Refactor some argument checks for readability No intended behavior change.
2018-06-04 15:17:16 +00:00
{
/* Take the unprocessed partial block left over from previous
* update calls, if any, plus the input to this call. Remove
* the last partial block, if any. You get the data that will be
* output in this call. */
expected_output_size =
( operation->ctx.cipher.unprocessed_len + input_length )
/ operation->block_size * operation->block_size;
}
else
{
expected_output_size = input_length;
}
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 10:56:32 +00:00
Refactor some argument checks for readability No intended behavior change.
2018-06-04 15:17:16 +00:00
if( output_size < expected_output_size )
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 10:56:32 +00:00
{
status = PSA_ERROR_BUFFER_TOO_SMALL;
goto exit;
}
warnings fixes
2018-03-12 16:16:40 +00:00
Implement support for multipart ECB and add tests Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-25 13:13:13 +00:00
if( operation->alg == PSA_ALG_ECB_NO_PADDING )
{
/* mbedtls_cipher_update has an API inconsistency: it will only
* process a single block at a time in ECB mode. Abstract away that
* inconsistency here to match the PSA API behaviour. */
Fix style and pull out ECB processing in separate function Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-07 15:14:14 +00:00
status = psa_cipher_update_ecb_internal( &operation->ctx.cipher,
input,
input_length,
output,
output_size,
output_length );
Implement support for multipart ECB and add tests Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-25 13:13:13 +00:00
}
else
{
status = mbedtls_to_psa_error(
mbedtls_cipher_update( &operation->ctx.cipher, input,
input_length, output, output_length ) );
}
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 10:56:32 +00:00
exit:
if( status != PSA_SUCCESS )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
psa_cipher_abort( operation );
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 10:56:32 +00:00
return( status );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
}
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 14:22:46 +00:00
psa_status_t psa_cipher_finish( psa_cipher_operation_t *operation,
uint8_t *output,
size_t output_size,
size_t *output_length )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
{
Replace PSA error code definitions with the ones defined in PSA spec
2019-02-14 11:48:10 +00:00
psa_status_t status = PSA_ERROR_GENERIC_ERROR;
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 14:22:46 +00:00
uint8_t temp_output_buffer[MBEDTLS_MAX_BLOCK_LENGTH];
Check & set operation flags for both driver and software in the core Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-09 13:28:49 +00:00
if( operation->alg == 0 )
{
return( PSA_ERROR_BAD_STATE );
}
if( operation->iv_required && ! operation->iv_set )
{
return( PSA_ERROR_BAD_STATE );
}
fix missing check on output_size in psa_cipher_finish func
2018-04-22 17:19:20 +00:00
Apply review feedback * Reworked the cipher context once again to be more robustly defined * Removed redundant memset * Unified behaviour on failure between driver and software in cipher_finish * Cipher test driver setup function now also returns early when its status is overridden, like the other test driver functions * Removed redundant test cases * Added bad-order checking to verify the driver doesn't get called where the spec says it won't. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-11 09:44:50 +00:00
if( operation->mbedtls_in_use == 0 )
Add a working implementation of a multipart AES-CTR test driver Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-03 13:30:32 +00:00
{
Only pass the driver-relevant portion of the context struct Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-09 10:01:43 +00:00
status = psa_driver_wrapper_cipher_finish( &operation->ctx.driver,
Add a working implementation of a multipart AES-CTR test driver Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-03 13:30:32 +00:00
output,
output_size,
output_length );
Apply review feedback * Reworked the cipher context once again to be more robustly defined * Removed redundant memset * Unified behaviour on failure between driver and software in cipher_finish * Cipher test driver setup function now also returns early when its status is overridden, like the other test driver functions * Removed redundant test cases * Added bad-order checking to verify the driver doesn't get called where the spec says it won't. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-11 09:44:50 +00:00
goto exit;
Add a working implementation of a multipart AES-CTR test driver Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-03 13:30:32 +00:00
}
Restructure cipher context object to contain driver switch Once an operation has been 'accepted' by a driver, the remainder is bound to the same driver, since driver-specific context structs cannot be shared. This provides a pretty good gate mechanism for the fallback logic, too. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-01 13:56:14 +00:00
Added support for AES-ECB to the PSA Crypto implementation PSA_ALG_ECB_NO_PADDING came in to the PSA Crypto API spec v1.0.0, but was not implemented yet in the mbed TLS implementation. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-06 12:08:59 +00:00
if( operation->ctx.cipher.unprocessed_len != 0 )
fix missing check on output_size in psa_cipher_finish func
2018-04-22 17:19:20 +00:00
{
Added support for AES-ECB to the PSA Crypto implementation PSA_ALG_ECB_NO_PADDING came in to the PSA Crypto API spec v1.0.0, but was not implemented yet in the mbed TLS implementation. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-06 12:08:59 +00:00
if( operation->alg == PSA_ALG_ECB_NO_PADDING ||
Use PSA_ERROR_INVALID_ARGUMENT for invalid cipher input sizes ... as opposed to PSA_ERROR_BAD_STATE. The spec on psa_cipher_finish() states that PSA_ERROR_INVALID_ARGUMENT should be returned when: "The total input size passed to this operation is not valid for this particular algorithm. For example, the algorithm is a based on block cipher and requires a whole number of blocks, but the total input size is not a multiple of the block size." Currently, there is a distinction between encryption and decryption on whether INVALID_ARGUMENT or BAD_STATE is returned, but this is not a part of the spec. This fix ensures that PSA_ERROR_INVALID_ARGUMENT is returned consistently on invalid cipher input sizes. Signed-off-by: Fredrik Strupe <fredrik.strupe@silabs.com>
2020-09-28 14:11:33 +00:00
operation->alg == PSA_ALG_CBC_NO_PADDING )
Style and language fixes Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-25 09:47:50 +00:00
{
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 12:02:45 +00:00
status = PSA_ERROR_INVALID_ARGUMENT;
Apply review feedback * Reworked the cipher context once again to be more robustly defined * Removed redundant memset * Unified behaviour on failure between driver and software in cipher_finish * Cipher test driver setup function now also returns early when its status is overridden, like the other test driver functions * Removed redundant test cases * Added bad-order checking to verify the driver doesn't get called where the spec says it won't. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-11 09:44:50 +00:00
goto exit;
Added support for AES-ECB to the PSA Crypto implementation PSA_ALG_ECB_NO_PADDING came in to the PSA Crypto API spec v1.0.0, but was not implemented yet in the mbed TLS implementation. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-06 12:08:59 +00:00
}
delete decrypt checks + fix memcpy& return value
2018-04-30 12:45:34 +00:00
}
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
Apply review feedback * Reworked the cipher context once again to be more robustly defined * Removed redundant memset * Unified behaviour on failure between driver and software in cipher_finish * Cipher test driver setup function now also returns early when its status is overridden, like the other test driver functions * Removed redundant test cases * Added bad-order checking to verify the driver doesn't get called where the spec says it won't. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-11 09:44:50 +00:00
status = mbedtls_to_psa_error(
mbedtls_cipher_finish( &operation->ctx.cipher,
temp_output_buffer,
output_length ) );
if( status != PSA_SUCCESS )
goto exit;
Fix memory leak in psa_cipher_finish()
2018-07-09 15:04:51 +00:00
Handle null pointers safely when used as buffers of size 0 When the size of a buffer is 0, the corresponding pointer argument may be null. In such cases, library functions must not perform arithmetic on the pointer or call standard library functions such as memset and memcpy, since that would be undefined behavior in C. Protect such cases. Refactor the storage of a 0-sized raw data object to make it store a null pointer, rather than depending on the behavior of calloc(1,0).
2018-06-28 17:31:31 +00:00
if( *output_length == 0 )
Fix memory leak in psa_cipher_finish()
2018-07-09 15:04:51 +00:00
; /* Nothing to copy. Note that output may be NULL in this case. */
Handle null pointers safely when used as buffers of size 0 When the size of a buffer is 0, the corresponding pointer argument may be null. In such cases, library functions must not perform arithmetic on the pointer or call standard library functions such as memset and memcpy, since that would be undefined behavior in C. Protect such cases. Refactor the storage of a 0-sized raw data object to make it store a null pointer, rather than depending on the behavior of calloc(1,0).
2018-06-28 17:31:31 +00:00
else if( output_size >= *output_length )
delete decrypt checks + fix memcpy& return value
2018-04-30 12:45:34 +00:00
memcpy( output, temp_output_buffer, *output_length );
else
Fix memory leak in psa_cipher_finish()
2018-07-09 15:04:51 +00:00
status = PSA_ERROR_BUFFER_TOO_SMALL;
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
Apply review feedback * Reworked the cipher context once again to be more robustly defined * Removed redundant memset * Unified behaviour on failure between driver and software in cipher_finish * Cipher test driver setup function now also returns early when its status is overridden, like the other test driver functions * Removed redundant test cases * Added bad-order checking to verify the driver doesn't get called where the spec says it won't. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-11 09:44:50 +00:00
exit:
if( operation->mbedtls_in_use == 1 )
mbedtls_platform_zeroize( temp_output_buffer, sizeof( temp_output_buffer ) );
Fix memory leak in psa_cipher_finish()
2018-07-09 15:04:51 +00:00
Apply review feedback * Reworked the cipher context once again to be more robustly defined * Removed redundant memset * Unified behaviour on failure between driver and software in cipher_finish * Cipher test driver setup function now also returns early when its status is overridden, like the other test driver functions * Removed redundant test cases * Added bad-order checking to verify the driver doesn't get called where the spec says it won't. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-11 09:44:50 +00:00
if( status == PSA_SUCCESS )
return( psa_cipher_abort( operation ) );
else
{
*output_length = 0;
(void) psa_cipher_abort( operation );
Fix memory leak in psa_cipher_finish()
2018-07-09 15:04:51 +00:00
Apply review feedback * Reworked the cipher context once again to be more robustly defined * Removed redundant memset * Unified behaviour on failure between driver and software in cipher_finish * Cipher test driver setup function now also returns early when its status is overridden, like the other test driver functions * Removed redundant test cases * Added bad-order checking to verify the driver doesn't get called where the spec says it won't. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-11 09:44:50 +00:00
return( status );
}
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
}
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 14:22:46 +00:00
psa_status_t psa_cipher_abort( psa_cipher_operation_t *operation )
{
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 14:05:20 +00:00
if( operation->alg == 0 )
psa_hash_abort: return PSA_SUCCESS if alg=0 Make psa_hash_abort consistent with psa_mac_abort and psa_cipher_abort. Add a comment explaining the reasoning.
2018-06-26 13:04:31 +00:00
{
Update semantics around driver context use in psa_cipher_setup Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-10 12:54:14 +00:00
/* The object has (apparently) been initialized but it is not (yet)
psa_hash_abort: return PSA_SUCCESS if alg=0 Make psa_hash_abort consistent with psa_mac_abort and psa_cipher_abort. Add a comment explaining the reasoning.
2018-06-26 13:04:31 +00:00
* in use. It's ok to call abort on such an object, and there's
* nothing to do. */
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 14:05:20 +00:00
return( PSA_SUCCESS );
psa_hash_abort: return PSA_SUCCESS if alg=0 Make psa_hash_abort consistent with psa_mac_abort and psa_cipher_abort. Add a comment explaining the reasoning.
2018-06-26 13:04:31 +00:00
}
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 14:05:20 +00:00
In abort functions, return BAD_STATE on obviously bad input psa_hash_abort, psa_mac_abort and psa_cipher_abort now return PSA_ERROR_BAD_STATE if operation->alg is obviously not valid, which can only happen due to a programming error in the caller or in the library. We can't detect all cases of calling abort on uninitialized memory but this is dirt cheap and better than nothing.
2018-06-21 14:57:07 +00:00
/* Sanity check (shouldn't happen: operation->alg should
* always have been initialized to a valid value). */
if( ! PSA_ALG_IS_CIPHER( operation->alg ) )
return( PSA_ERROR_BAD_STATE );
Apply review feedback * Reworked the cipher context once again to be more robustly defined * Removed redundant memset * Unified behaviour on failure between driver and software in cipher_finish * Cipher test driver setup function now also returns early when its status is overridden, like the other test driver functions * Removed redundant test cases * Added bad-order checking to verify the driver doesn't get called where the spec says it won't. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-11 09:44:50 +00:00
if( operation->mbedtls_in_use == 0 )
Only pass the driver-relevant portion of the context struct Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-09 10:01:43 +00:00
psa_driver_wrapper_cipher_abort( &operation->ctx.driver );
Restructure cipher context object to contain driver switch Once an operation has been 'accepted' by a driver, the remainder is bound to the same driver, since driver-specific context structs cannot be shared. This provides a pretty good gate mechanism for the fallback logic, too. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-01 13:56:14 +00:00
else
mbedtls_cipher_free( &operation->ctx.cipher );
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 14:22:46 +00:00
partly pr fix
2018-04-04 12:43:05 +00:00
operation->alg = 0;
add iv_required field to psa_cipher_operation_s and fix relevant functions
2018-04-30 09:31:04 +00:00
operation->key_set = 0;
operation->iv_set = 0;
Apply review feedback * Reworked the cipher context once again to be more robustly defined * Removed redundant memset * Unified behaviour on failure between driver and software in cipher_finish * Cipher test driver setup function now also returns early when its status is overridden, like the other test driver functions * Removed redundant test cases * Added bad-order checking to verify the driver doesn't get called where the spec says it won't. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-11 09:44:50 +00:00
operation->mbedtls_in_use = 0;
add iv_required field to psa_cipher_operation_s and fix relevant functions
2018-04-30 09:31:04 +00:00
operation->iv_size = 0;
partly pr fix
2018-04-04 12:43:05 +00:00
operation->block_size = 0;
add iv_required field to psa_cipher_operation_s and fix relevant functions
2018-04-30 09:31:04 +00:00
operation->iv_required = 0;
partly pr fix
2018-04-04 12:43:05 +00:00
adjust indentation per Mbed TLS standards
2018-05-31 11:07:14 +00:00
return( PSA_SUCCESS );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
}
Merge remote-tracking branch 'psa/pr/13' into feature-psa Conflicts: library/psa_crypto.c tests/suites/test_suite_psa_crypto.data tests/suites/test_suite_psa_crypto.function All the conflicts are concurrent additions where the order doesn't matter. I put the code from feature-psa (key policy) before the code from PR #13 (key lifetime).
2018-04-30 15:06:50 +00:00
Be more consistent about blank lines
2018-06-18 19:49:39 +00:00
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 21:53:03 +00:00
/****************************************************************/
/* AEAD */
/****************************************************************/
Be more consistent about blank lines
2018-06-18 19:49:39 +00:00
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
typedef struct
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 16:12:32 +00:00
psa_key_slot_t *slot;
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
const mbedtls_cipher_info_t *cipher_info;
union
{
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
unsigned dummy; /* Make the union non-empty even with no supported algorithms. */
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
#if defined(MBEDTLS_CCM_C)
mbedtls_ccm_context ccm;
#endif /* MBEDTLS_CCM_C */
#if defined(MBEDTLS_GCM_C)
mbedtls_gcm_context gcm;
#endif /* MBEDTLS_GCM_C */
Implement ChaCha20 and ChaCha20-Poly1305 Smoke tests: test data for ChaCha20 calculated with PyCryptodome; test vector from RFC 7539 for ChaCha20-Poly1305.
2019-05-06 13:25:00 +00:00
#if defined(MBEDTLS_CHACHAPOLY_C)
mbedtls_chachapoly_context chachapoly;
#endif /* MBEDTLS_CHACHAPOLY_C */
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
} ctx;
Add support for non-default-tag-size AEAD (CCM and GCM)
2018-08-17 17:47:52 +00:00
psa_algorithm_t core_alg;
uint8_t full_tag_length;
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
uint8_t tag_length;
} aead_operation_t;
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
#define AEAD_OPERATION_INIT {0, 0, {0}, 0, 0, 0}
Declare multipart AEAD functions Declare and document multipart AEAD functions. This commit does not contain any implementation or tests.
2019-01-14 17:36:12 +00:00
static void psa_aead_abort_internal( aead_operation_t *operation )
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
{
Fix memory leak with AEAD with non-default tag lengths When freeing the key context, choose the context format based on the base algorithm value stored in the operation object.
2018-08-21 14:38:05 +00:00
switch( operation->core_alg )
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
{
#if defined(MBEDTLS_CCM_C)
case PSA_ALG_CCM:
mbedtls_ccm_free( &operation->ctx.ccm );
break;
#endif /* MBEDTLS_CCM_C */
Add missing compilation guards for GCM and CCM Add missing compilation guards that broke the build if either GCM or CCM was not defined. Add missing guards on test cases that require GCM or CBC. The build and tests now pass for any subset of {MBEDTLS_CCM_C, MBEDTLS_GCM_C}. There are still unused variables warnings if neither is defined.
2018-11-28 16:30:58 +00:00
#if defined(MBEDTLS_GCM_C)
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
case PSA_ALG_GCM:
mbedtls_gcm_free( &operation->ctx.gcm );
break;
#endif /* MBEDTLS_GCM_C */
}
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
psa_unlock_key_slot( operation->slot );
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
}
static psa_status_t psa_aead_setup( aead_operation_t *operation,
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
mbedtls_svc_key_id_t key,
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
psa_key_usage_t usage,
psa_algorithm_t alg )
{
psa_status_t status;
size_t key_bits;
mbedtls_cipher_id_t cipher_id;
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
status = psa_get_and_lock_transparent_key_slot_with_policy(
key, &operation->slot, usage, alg );
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
if( status != PSA_SUCCESS )
return( status );
Implement missing attributes setters and getters
2019-04-18 10:53:01 +00:00
key_bits = psa_get_key_slot_bits( operation->slot );
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
operation->cipher_info =
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
mbedtls_cipher_info_from_psa( alg, operation->slot->attr.type, key_bits,
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
&cipher_id );
if( operation->cipher_info == NULL )
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
{
status = PSA_ERROR_NOT_SUPPORTED;
goto cleanup;
}
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
Rename AEAD tag length macros This brings them in line with PSA Crypto API 1.0.0 PSA_ALG_AEAD_WITH_DEFAULT_TAG_LENGTH -> PSA_ALG_AEAD_WITH_DEFAULT_LENGTH_TAG PSA_ALG_AEAD_WITH_TAG_LENGTH -> PSA_ALG_AEAD_WITH_SHORTENED_TAG Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2020-12-16 10:36:46 +00:00
switch( PSA_ALG_AEAD_WITH_SHORTENED_TAG( alg, 0 ) )
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
{
#if defined(MBEDTLS_CCM_C)
Rename AEAD tag length macros This brings them in line with PSA Crypto API 1.0.0 PSA_ALG_AEAD_WITH_DEFAULT_TAG_LENGTH -> PSA_ALG_AEAD_WITH_DEFAULT_LENGTH_TAG PSA_ALG_AEAD_WITH_TAG_LENGTH -> PSA_ALG_AEAD_WITH_SHORTENED_TAG Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2020-12-16 10:36:46 +00:00
case PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, 0 ):
Add support for non-default-tag-size AEAD (CCM and GCM)
2018-08-17 17:47:52 +00:00
operation->core_alg = PSA_ALG_CCM;
operation->full_tag_length = 16;
Minor refactoring in AEAD code Make it a little easier to add ChaCha20-Poly1305. This also fixes the error code in case mbedtls_gcm_setkey() fails with a status that doesn't map to INVALID_ARGUMENT.
2019-05-06 13:27:16 +00:00
/* CCM allows the following tag lengths: 4, 6, 8, 10, 12, 14, 16.
* The call to mbedtls_ccm_encrypt_and_tag or
* mbedtls_ccm_auth_decrypt will validate the tag length. */
Rename output buffer size macros Rename existing support macros for output buffer sizes for PSA Crypto API 1.0.0 Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-12-18 13:23:51 +00:00
if( PSA_BLOCK_CIPHER_BLOCK_LENGTH( operation->slot->attr.type ) != 16 )
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
{
status = PSA_ERROR_INVALID_ARGUMENT;
goto cleanup;
}
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
mbedtls_ccm_init( &operation->ctx.ccm );
status = mbedtls_to_psa_error(
mbedtls_ccm_setkey( &operation->ctx.ccm, cipher_id,
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:52:23 +00:00
operation->slot->key.data,
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
(unsigned int) key_bits ) );
if( status != 0 )
goto cleanup;
break;
#endif /* MBEDTLS_CCM_C */
#if defined(MBEDTLS_GCM_C)
Rename AEAD tag length macros This brings them in line with PSA Crypto API 1.0.0 PSA_ALG_AEAD_WITH_DEFAULT_TAG_LENGTH -> PSA_ALG_AEAD_WITH_DEFAULT_LENGTH_TAG PSA_ALG_AEAD_WITH_TAG_LENGTH -> PSA_ALG_AEAD_WITH_SHORTENED_TAG Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2020-12-16 10:36:46 +00:00
case PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_GCM, 0 ):
Add support for non-default-tag-size AEAD (CCM and GCM)
2018-08-17 17:47:52 +00:00
operation->core_alg = PSA_ALG_GCM;
operation->full_tag_length = 16;
Minor refactoring in AEAD code Make it a little easier to add ChaCha20-Poly1305. This also fixes the error code in case mbedtls_gcm_setkey() fails with a status that doesn't map to INVALID_ARGUMENT.
2019-05-06 13:27:16 +00:00
/* GCM allows the following tag lengths: 4, 8, 12, 13, 14, 15, 16.
* The call to mbedtls_gcm_crypt_and_tag or
* mbedtls_gcm_auth_decrypt will validate the tag length. */
Rename output buffer size macros Rename existing support macros for output buffer sizes for PSA Crypto API 1.0.0 Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-12-18 13:23:51 +00:00
if( PSA_BLOCK_CIPHER_BLOCK_LENGTH( operation->slot->attr.type ) != 16 )
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
{
status = PSA_ERROR_INVALID_ARGUMENT;
goto cleanup;
}
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
mbedtls_gcm_init( &operation->ctx.gcm );
status = mbedtls_to_psa_error(
mbedtls_gcm_setkey( &operation->ctx.gcm, cipher_id,
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:52:23 +00:00
operation->slot->key.data,
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
(unsigned int) key_bits ) );
Minor refactoring in AEAD code Make it a little easier to add ChaCha20-Poly1305. This also fixes the error code in case mbedtls_gcm_setkey() fails with a status that doesn't map to INVALID_ARGUMENT.
2019-05-06 13:27:16 +00:00
if( status != 0 )
goto cleanup;
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
break;
#endif /* MBEDTLS_GCM_C */
Implement ChaCha20 and ChaCha20-Poly1305 Smoke tests: test data for ChaCha20 calculated with PyCryptodome; test vector from RFC 7539 for ChaCha20-Poly1305.
2019-05-06 13:25:00 +00:00
#if defined(MBEDTLS_CHACHAPOLY_C)
Rename AEAD tag length macros This brings them in line with PSA Crypto API 1.0.0 PSA_ALG_AEAD_WITH_DEFAULT_TAG_LENGTH -> PSA_ALG_AEAD_WITH_DEFAULT_LENGTH_TAG PSA_ALG_AEAD_WITH_TAG_LENGTH -> PSA_ALG_AEAD_WITH_SHORTENED_TAG Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2020-12-16 10:36:46 +00:00
case PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CHACHA20_POLY1305, 0 ):
Implement ChaCha20 and ChaCha20-Poly1305 Smoke tests: test data for ChaCha20 calculated with PyCryptodome; test vector from RFC 7539 for ChaCha20-Poly1305.
2019-05-06 13:25:00 +00:00
operation->core_alg = PSA_ALG_CHACHA20_POLY1305;
operation->full_tag_length = 16;
/* We only support the default tag length. */
if( alg != PSA_ALG_CHACHA20_POLY1305 )
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
{
status = PSA_ERROR_NOT_SUPPORTED;
goto cleanup;
}
Implement ChaCha20 and ChaCha20-Poly1305 Smoke tests: test data for ChaCha20 calculated with PyCryptodome; test vector from RFC 7539 for ChaCha20-Poly1305.
2019-05-06 13:25:00 +00:00
mbedtls_chachapoly_init( &operation->ctx.chachapoly );
status = mbedtls_to_psa_error(
mbedtls_chachapoly_setkey( &operation->ctx.chachapoly,
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:52:23 +00:00
operation->slot->key.data ) );
Implement ChaCha20 and ChaCha20-Poly1305 Smoke tests: test data for ChaCha20 calculated with PyCryptodome; test vector from RFC 7539 for ChaCha20-Poly1305.
2019-05-06 13:25:00 +00:00
if( status != 0 )
goto cleanup;
break;
#endif /* MBEDTLS_CHACHAPOLY_C */
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
default:
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
status = PSA_ERROR_NOT_SUPPORTED;
goto cleanup;
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
}
Add support for non-default-tag-size AEAD (CCM and GCM)
2018-08-17 17:47:52 +00:00
if( PSA_AEAD_TAG_LENGTH( alg ) > operation->full_tag_length )
{
status = PSA_ERROR_INVALID_ARGUMENT;
goto cleanup;
}
operation->tag_length = PSA_AEAD_TAG_LENGTH( alg );
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
return( PSA_SUCCESS );
cleanup:
Declare multipart AEAD functions Declare and document multipart AEAD functions. This commit does not contain any implementation or tests.
2019-01-14 17:36:12 +00:00
psa_aead_abort_internal( operation );
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
return( status );
}
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
psa_status_t psa_aead_encrypt( mbedtls_svc_key_id_t key,
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 21:53:03 +00:00
psa_algorithm_t alg,
const uint8_t *nonce,
size_t nonce_length,
const uint8_t *additional_data,
size_t additional_data_length,
const uint8_t *plaintext,
size_t plaintext_length,
uint8_t *ciphertext,
size_t ciphertext_size,
size_t *ciphertext_length )
{
psa_status_t status;
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
aead_operation_t operation = AEAD_OPERATION_INIT;
write the tag directly on the ciphertext buffer.
2018-06-03 14:19:55 +00:00
uint8_t *tag;
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 13:41:12 +00:00
set output length to zero to cover output length in error case
2018-06-03 12:05:47 +00:00
*ciphertext_length = 0;
fix condition over key type
2018-05-09 11:58:32 +00:00
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
status = psa_aead_setup( &operation, key, PSA_KEY_USAGE_ENCRYPT, alg );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 15:01:38 +00:00
if( status != PSA_SUCCESS )
return( status );
add Key and Algorithm validation
2018-05-09 09:24:42 +00:00
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
/* For all currently supported modes, the tag is at the end of the
* ciphertext. */
if( ciphertext_size < ( plaintext_length + operation.tag_length ) )
{
status = PSA_ERROR_BUFFER_TOO_SMALL;
goto exit;
}
tag = ciphertext + plaintext_length;
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 21:53:03 +00:00
Add missing compilation guards for GCM and CCM Add missing compilation guards that broke the build if either GCM or CCM was not defined. Add missing guards on test cases that require GCM or CBC. The build and tests now pass for any subset of {MBEDTLS_CCM_C, MBEDTLS_GCM_C}. There are still unused variables warnings if neither is defined.
2018-11-28 16:30:58 +00:00
#if defined(MBEDTLS_GCM_C)
Add support for non-default-tag-size AEAD (CCM and GCM)
2018-08-17 17:47:52 +00:00
if( operation.core_alg == PSA_ALG_GCM )
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 21:53:03 +00:00
{
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
status = mbedtls_to_psa_error(
mbedtls_gcm_crypt_and_tag( &operation.ctx.gcm,
MBEDTLS_GCM_ENCRYPT,
plaintext_length,
nonce, nonce_length,
additional_data, additional_data_length,
plaintext, ciphertext,
operation.tag_length, tag ) );
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 21:53:03 +00:00
}
Add missing compilation guards for GCM and CCM Add missing compilation guards that broke the build if either GCM or CCM was not defined. Add missing guards on test cases that require GCM or CBC. The build and tests now pass for any subset of {MBEDTLS_CCM_C, MBEDTLS_GCM_C}. There are still unused variables warnings if neither is defined.
2018-11-28 16:30:58 +00:00
else
#endif /* MBEDTLS_GCM_C */
#if defined(MBEDTLS_CCM_C)
if( operation.core_alg == PSA_ALG_CCM )
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 21:53:03 +00:00
{
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
status = mbedtls_to_psa_error(
mbedtls_ccm_encrypt_and_tag( &operation.ctx.ccm,
plaintext_length,
nonce, nonce_length,
additional_data,
additional_data_length,
plaintext, ciphertext,
tag, operation.tag_length ) );
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 21:53:03 +00:00
}
return invalid argument for unsupported algorithms
2018-05-09 12:40:09 +00:00
else
Add missing compilation guards for GCM and CCM Add missing compilation guards that broke the build if either GCM or CCM was not defined. Add missing guards on test cases that require GCM or CBC. The build and tests now pass for any subset of {MBEDTLS_CCM_C, MBEDTLS_GCM_C}. There are still unused variables warnings if neither is defined.
2018-11-28 16:30:58 +00:00
#endif /* MBEDTLS_CCM_C */
Implement ChaCha20 and ChaCha20-Poly1305 Smoke tests: test data for ChaCha20 calculated with PyCryptodome; test vector from RFC 7539 for ChaCha20-Poly1305.
2019-05-06 13:25:00 +00:00
#if defined(MBEDTLS_CHACHAPOLY_C)
if( operation.core_alg == PSA_ALG_CHACHA20_POLY1305 )
return invalid argument for unsupported algorithms
2018-05-09 12:40:09 +00:00
{
Implement ChaCha20 and ChaCha20-Poly1305 Smoke tests: test data for ChaCha20 calculated with PyCryptodome; test vector from RFC 7539 for ChaCha20-Poly1305.
2019-05-06 13:25:00 +00:00
if( nonce_length != 12 || operation.tag_length != 16 )
{
status = PSA_ERROR_NOT_SUPPORTED;
goto exit;
}
status = mbedtls_to_psa_error(
mbedtls_chachapoly_encrypt_and_tag( &operation.ctx.chachapoly,
plaintext_length,
nonce,
additional_data,
additional_data_length,
plaintext,
ciphertext,
tag ) );
}
else
#endif /* MBEDTLS_CHACHAPOLY_C */
return invalid argument for unsupported algorithms
2018-05-09 12:40:09 +00:00
{
Fix unused variable in PSA core when no AEAD algorithm is present Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-10 16:13:28 +00:00
(void) tag;
return NOT_SUPPORTED instead of INVLID_ARGUMENT
2018-06-03 12:07:38 +00:00
return( PSA_ERROR_NOT_SUPPORTED );
return invalid argument for unsupported algorithms
2018-05-09 12:40:09 +00:00
}
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 13:41:12 +00:00
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
if( status != PSA_SUCCESS && ciphertext_size != 0 )
memset( ciphertext, 0, ciphertext_size );
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 13:41:12 +00:00
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
exit:
Declare multipart AEAD functions Declare and document multipart AEAD functions. This commit does not contain any implementation or tests.
2019-01-14 17:36:12 +00:00
psa_aead_abort_internal( &operation );
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
if( status == PSA_SUCCESS )
*ciphertext_length = plaintext_length + operation.tag_length;
return( status );
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 21:53:03 +00:00
}
Fix psa_aead_decrypt to read the tag at the end of the ciphertext
2018-06-01 17:23:52 +00:00
/* Locate the tag in a ciphertext buffer containing the encrypted data
* followed by the tag. Return the length of the part preceding the tag in
* *plaintext_length. This is the size of the plaintext in modes where
* the encrypted data has the same size as the plaintext, such as
* CCM and GCM. */
static psa_status_t psa_aead_unpadded_locate_tag( size_t tag_length,
const uint8_t *ciphertext,
size_t ciphertext_length,
size_t plaintext_size,
const uint8_t **p_tag )
{
size_t payload_length;
if( tag_length > ciphertext_length )
return( PSA_ERROR_INVALID_ARGUMENT );
payload_length = ciphertext_length - tag_length;
if( payload_length > plaintext_size )
return( PSA_ERROR_BUFFER_TOO_SMALL );
*p_tag = ciphertext + payload_length;
return( PSA_SUCCESS );
}
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
psa_status_t psa_aead_decrypt( mbedtls_svc_key_id_t key,
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 21:53:03 +00:00
psa_algorithm_t alg,
const uint8_t *nonce,
size_t nonce_length,
const uint8_t *additional_data,
size_t additional_data_length,
const uint8_t *ciphertext,
size_t ciphertext_length,
uint8_t *plaintext,
size_t plaintext_size,
size_t *plaintext_length )
{
psa_status_t status;
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
aead_operation_t operation = AEAD_OPERATION_INIT;
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
const uint8_t *tag = NULL;
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 13:41:12 +00:00
Fix psa_aead_decrypt to read the tag at the end of the ciphertext
2018-06-01 17:23:52 +00:00
*plaintext_length = 0;
Fix parameter validation
2018-04-26 09:07:35 +00:00
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
status = psa_aead_setup( &operation, key, PSA_KEY_USAGE_DECRYPT, alg );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 15:01:38 +00:00
if( status != PSA_SUCCESS )
return( status );
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 21:53:03 +00:00
Minor refactoring in AEAD code Make it a little easier to add ChaCha20-Poly1305. This also fixes the error code in case mbedtls_gcm_setkey() fails with a status that doesn't map to INVALID_ARGUMENT.
2019-05-06 13:27:16 +00:00
status = psa_aead_unpadded_locate_tag( operation.tag_length,
ciphertext, ciphertext_length,
plaintext_size, &tag );
if( status != PSA_SUCCESS )
goto exit;
Add missing compilation guards for GCM and CCM Add missing compilation guards that broke the build if either GCM or CCM was not defined. Add missing guards on test cases that require GCM or CBC. The build and tests now pass for any subset of {MBEDTLS_CCM_C, MBEDTLS_GCM_C}. There are still unused variables warnings if neither is defined.
2018-11-28 16:30:58 +00:00
#if defined(MBEDTLS_GCM_C)
Add support for non-default-tag-size AEAD (CCM and GCM)
2018-08-17 17:47:52 +00:00
if( operation.core_alg == PSA_ALG_GCM )
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 21:53:03 +00:00
{
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
status = mbedtls_to_psa_error(
mbedtls_gcm_auth_decrypt( &operation.ctx.gcm,
ciphertext_length - operation.tag_length,
nonce, nonce_length,
additional_data,
additional_data_length,
tag, operation.tag_length,
ciphertext, plaintext ) );
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 21:53:03 +00:00
}
Add missing compilation guards for GCM and CCM Add missing compilation guards that broke the build if either GCM or CCM was not defined. Add missing guards on test cases that require GCM or CBC. The build and tests now pass for any subset of {MBEDTLS_CCM_C, MBEDTLS_GCM_C}. There are still unused variables warnings if neither is defined.
2018-11-28 16:30:58 +00:00
else
#endif /* MBEDTLS_GCM_C */
#if defined(MBEDTLS_CCM_C)
if( operation.core_alg == PSA_ALG_CCM )
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 21:53:03 +00:00
{
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
status = mbedtls_to_psa_error(
mbedtls_ccm_auth_decrypt( &operation.ctx.ccm,
ciphertext_length - operation.tag_length,
nonce, nonce_length,
additional_data,
additional_data_length,
ciphertext, plaintext,
tag, operation.tag_length ) );
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 21:53:03 +00:00
}
add else for not supported algorithm
2018-06-01 11:39:53 +00:00
else
Add missing compilation guards for GCM and CCM Add missing compilation guards that broke the build if either GCM or CCM was not defined. Add missing guards on test cases that require GCM or CBC. The build and tests now pass for any subset of {MBEDTLS_CCM_C, MBEDTLS_GCM_C}. There are still unused variables warnings if neither is defined.
2018-11-28 16:30:58 +00:00
#endif /* MBEDTLS_CCM_C */
Implement ChaCha20 and ChaCha20-Poly1305 Smoke tests: test data for ChaCha20 calculated with PyCryptodome; test vector from RFC 7539 for ChaCha20-Poly1305.
2019-05-06 13:25:00 +00:00
#if defined(MBEDTLS_CHACHAPOLY_C)
if( operation.core_alg == PSA_ALG_CHACHA20_POLY1305 )
{
if( nonce_length != 12 || operation.tag_length != 16 )
{
status = PSA_ERROR_NOT_SUPPORTED;
goto exit;
}
status = mbedtls_to_psa_error(
mbedtls_chachapoly_auth_decrypt( &operation.ctx.chachapoly,
ciphertext_length - operation.tag_length,
nonce,
additional_data,
additional_data_length,
tag,
ciphertext,
plaintext ) );
}
else
#endif /* MBEDTLS_CHACHAPOLY_C */
add else for not supported algorithm
2018-06-01 11:39:53 +00:00
{
return NOT_SUPPORTED instead of INVLID_ARGUMENT
2018-06-03 12:07:38 +00:00
return( PSA_ERROR_NOT_SUPPORTED );
add else for not supported algorithm
2018-06-01 11:39:53 +00:00
}
Whitespace fixes Changed indentation to match Mbed TLS style. Wrapped some lines to 80 columns.
2018-06-01 14:28:30 +00:00
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
if( status != PSA_SUCCESS && plaintext_size != 0 )
memset( plaintext, 0, plaintext_size );
remove unnecessary argument to the psa_aead_unpadded_locate_tag function
2018-06-03 14:20:42 +00:00
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
exit:
Declare multipart AEAD functions Declare and document multipart AEAD functions. This commit does not contain any implementation or tests.
2019-01-14 17:36:12 +00:00
psa_aead_abort_internal( &operation );
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
if( status == PSA_SUCCESS )
*plaintext_length = ciphertext_length - operation.tag_length;
return( status );
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 21:53:03 +00:00
}
Merge remote-tracking branch 'psa/pr/13' into feature-psa Conflicts: library/psa_crypto.c tests/suites/test_suite_psa_crypto.data tests/suites/test_suite_psa_crypto.function All the conflicts are concurrent additions where the order doesn't matter. I put the code from feature-psa (key policy) before the code from PR #13 (key lifetime).
2018-04-30 15:06:50 +00:00
Be more consistent about blank lines
2018-06-18 19:49:39 +00:00
Implement psa_generate_random
2018-06-19 20:00:52 +00:00
/****************************************************************/
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
/* Generators */
/****************************************************************/
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
#define AT_LEAST_ONE_BUILTIN_KDF
#endif
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
#define HKDF_STATE_INIT 0 /* no input yet */
#define HKDF_STATE_STARTED 1 /* got salt */
#define HKDF_STATE_KEYED 2 /* got key */
#define HKDF_STATE_OUTPUT 3 /* output started */
Rename generator-related internal identifiers perl -pe 's/crypto_generator/key_derivation/gi' $(git ls-files) perl -pe 's/_generator/_key_derivation/gi' $(git ls-files)
2019-05-16 14:59:18 +00:00
static psa_algorithm_t psa_key_derivation_get_kdf_alg(
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
const psa_key_derivation_operation_t *operation )
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
if ( PSA_ALG_IS_KEY_AGREEMENT( operation->alg ) )
return( PSA_ALG_KEY_AGREEMENT_GET_KDF( operation->alg ) );
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
else
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
return( operation->alg );
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
}
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
psa_status_t psa_key_derivation_abort( psa_key_derivation_operation_t *operation )
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
{
psa_status_t status = PSA_SUCCESS;
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg( operation );
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
if( kdf_alg == 0 )
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
{
/* The object has (apparently) been initialized but it is not
* in use. It's ok to call abort on such an object, and there's
* nothing to do. */
}
else
Phase 2 support for MBEDTLS_PSA_CRYPTO_CONFIG This phase adds in support for the following features being added to the list of features that can be configured in the include/psa/crypto_config.h header file using the PSA_WANT_ALG_xxx macros: ECDH, HMAC, HKDF, and RSA. These changes include changes to the PSA crypto library to use the appropriate new guards that will allow the feature to be compiled in or out either using new PSA_WANT_ALG_xxx or the previous MBEDTLS_xxx macros. For HKDF and HMAC, most of the PSA library code did not have a specific matching MBEDTLS_xxx macro for that feature, but was instead using the generic dependent MBEDTLS_MD_C macro. The ECDH and RSA features more closely aligned with a direct replacement with a similar macro. The new tests for RSA, HMAC, and HKDF would normally unset additional dependent macros, but when attempting to implement that level of testing it required removal of too many core features like MD_C, PK_C, ECP_C and other low level features. This may point to additional phases of work to complete the transition of these features to the new model. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-30 04:37:36 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
if( PSA_ALG_IS_HKDF( kdf_alg ) )
Implement HKDF
2018-07-12 15:22:21 +00:00
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
mbedtls_free( operation->ctx.hkdf.info );
status = psa_hmac_abort_internal( &operation->ctx.hkdf.hmac );
Implement HKDF
2018-07-12 15:22:21 +00:00
}
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
else
#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF */
#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
/* TLS-1.2 PSK-to-MS KDF uses the same core as TLS-1.2 PRF */
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
Add implementation of TLS-1.2 PRF
2018-10-09 16:33:01 +00:00
{
Adapt psa_key_derivation_abort to the new context
2019-06-11 09:37:28 +00:00
if( operation->ctx.tls12_prf.seed != NULL )
Add implementation of TLS-1.2 PRF
2018-10-09 16:33:01 +00:00
{
Adapt psa_key_derivation_abort to the new context
2019-06-11 09:37:28 +00:00
mbedtls_platform_zeroize( operation->ctx.tls12_prf.seed,
operation->ctx.tls12_prf.seed_length );
mbedtls_free( operation->ctx.tls12_prf.seed );
Add implementation of TLS-1.2 PRF
2018-10-09 16:33:01 +00:00
}
Dynamically allocate `A(i) + seed` buffer for TLS-1.2 PRF
2018-11-13 20:50:45 +00:00
Adapt psa_key_derivation_abort to the new context
2019-06-11 09:37:28 +00:00
if( operation->ctx.tls12_prf.label != NULL )
Dynamically allocate `A(i) + seed` buffer for TLS-1.2 PRF
2018-11-13 20:50:45 +00:00
{
Adapt psa_key_derivation_abort to the new context
2019-06-11 09:37:28 +00:00
mbedtls_platform_zeroize( operation->ctx.tls12_prf.label,
operation->ctx.tls12_prf.label_length );
mbedtls_free( operation->ctx.tls12_prf.label );
Dynamically allocate `A(i) + seed` buffer for TLS-1.2 PRF
2018-11-13 20:50:45 +00:00
}
Adapt psa_key_derivation_abort to the new context
2019-06-11 09:37:28 +00:00
status = psa_hmac_abort_internal( &operation->ctx.tls12_prf.hmac );
/* We leave the fields Ai and output_block to be erased safely by the
* mbedtls_platform_zeroize() in the end of this function. */
Add implementation of TLS-1.2 PRF
2018-10-09 16:33:01 +00:00
}
Implement HKDF
2018-07-12 15:22:21 +00:00
else
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) ||
* defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) */
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
{
status = PSA_ERROR_BAD_STATE;
}
Safely erase key material upon abort Some key derivation operation contexts (like psa_tls12_prf_key_derivation_t) directly contain buffers with parts of the derived key. Erase them safely as part of the abort.
2019-06-11 09:22:26 +00:00
mbedtls_platform_zeroize( operation, sizeof( *operation ) );
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
return( status );
}
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
psa_status_t psa_key_derivation_get_capacity(const psa_key_derivation_operation_t *operation,
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
size_t *capacity)
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
if( operation->alg == 0 )
psa: Check generator validity before read Check generator validity (i.e. that alg has been initialized) before allowing reads from the generator or allowing reads of the generator's capacity. This aligns our implementation with the documented error code behavior in our crypto.h and the PSA Crypto API.
2019-02-15 13:05:49 +00:00
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
/* This is a blank key derivation operation. */
Style fixes * return is treated as a function call * space between opening and closing parentheses * remove whiteline between assignment and checking of same variable Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-05 13:43:42 +00:00
return( PSA_ERROR_BAD_STATE );
psa: Check generator validity before read Check generator validity (i.e. that alg has been initialized) before allowing reads from the generator or allowing reads of the generator's capacity. This aligns our implementation with the documented error code behavior in our crypto.h and the PSA Crypto API.
2019-02-15 13:05:49 +00:00
}
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
*capacity = operation->capacity;
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
return( PSA_SUCCESS );
}
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
psa_status_t psa_key_derivation_set_capacity( psa_key_derivation_operation_t *operation,
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
size_t capacity )
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
if( operation->alg == 0 )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
return( PSA_ERROR_BAD_STATE );
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
if( capacity > operation->capacity )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
return( PSA_ERROR_INVALID_ARGUMENT );
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
operation->capacity = capacity;
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
return( PSA_SUCCESS );
}
Phase 2 support for MBEDTLS_PSA_CRYPTO_CONFIG This phase adds in support for the following features being added to the list of features that can be configured in the include/psa/crypto_config.h header file using the PSA_WANT_ALG_xxx macros: ECDH, HMAC, HKDF, and RSA. These changes include changes to the PSA crypto library to use the appropriate new guards that will allow the feature to be compiled in or out either using new PSA_WANT_ALG_xxx or the previous MBEDTLS_xxx macros. For HKDF and HMAC, most of the PSA library code did not have a specific matching MBEDTLS_xxx macro for that feature, but was instead using the generic dependent MBEDTLS_MD_C macro. The ECDH and RSA features more closely aligned with a direct replacement with a similar macro. The new tests for RSA, HMAC, and HKDF would normally unset additional dependent macros, but when attempting to implement that level of testing it required removal of too many core features like MD_C, PK_C, ECP_C and other low level features. This may point to additional phases of work to complete the transition of these features to the new model. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-30 04:37:36 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
/* Read some bytes from an HKDF-based operation. This performs a chunk
Implement HKDF
2018-07-12 15:22:21 +00:00
* of the expand phase of the HKDF algorithm. */
Rename generator-related internal identifiers perl -pe 's/crypto_generator/key_derivation/gi' $(git ls-files) perl -pe 's/_generator/_key_derivation/gi' $(git ls-files)
2019-05-16 14:59:18 +00:00
static psa_status_t psa_key_derivation_hkdf_read( psa_hkdf_key_derivation_t *hkdf,
Implement HKDF
2018-07-12 15:22:21 +00:00
psa_algorithm_t hash_alg,
uint8_t *output,
size_t output_length )
{
Rename output buffer size macros Rename existing support macros for output buffer sizes for PSA Crypto API 1.0.0 Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-12-18 13:23:51 +00:00
uint8_t hash_length = PSA_HASH_LENGTH( hash_alg );
Implement HKDF
2018-07-12 15:22:21 +00:00
psa_status_t status;
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
if( hkdf->state < HKDF_STATE_KEYED || ! hkdf->info_set )
return( PSA_ERROR_BAD_STATE );
hkdf->state = HKDF_STATE_OUTPUT;
Implement HKDF
2018-07-12 15:22:21 +00:00
while( output_length != 0 )
{
/* Copy what remains of the current block */
uint8_t n = hash_length - hkdf->offset_in_block;
if( n > output_length )
n = (uint8_t) output_length;
memcpy( output, hkdf->output_block + hkdf->offset_in_block, n );
output += n;
output_length -= n;
hkdf->offset_in_block += n;
HKDF: be more robust if we reach the maximum ouptut length In psa_generator_hkdf_read, return BAD_STATE if we're trying to construct more output than the algorithm allows. This can't happen through the API due to the capacity limit, but it could potentially happen in an internal call. Also add a test case that verifies that we can set up HKDF with its maximum capacity and read up to the maximum capacity.
2018-07-17 19:06:59 +00:00
if( output_length == 0 )
Implement HKDF
2018-07-12 15:22:21 +00:00
break;
HKDF: be more robust if we reach the maximum ouptut length In psa_generator_hkdf_read, return BAD_STATE if we're trying to construct more output than the algorithm allows. This can't happen through the API due to the capacity limit, but it could potentially happen in an internal call. Also add a test case that verifies that we can set up HKDF with its maximum capacity and read up to the maximum capacity.
2018-07-17 19:06:59 +00:00
/* We can't be wanting more output after block 0xff, otherwise
Rename generator functions to psa_key_derivation_xxx Generators are mostly about key derivation (currently: only about key derivation). "Generator" is not a commonly used term in cryptography. So favor "derivation" as terminology. Call a generator a key derivation operation structure, since it behaves like other multipart operation structures. Furthermore, the function names are not fully consistent. In this commit, I rename the functions to consistently have the prefix "psa_key_derivation_". I used the following command: perl -i -pe '%t = ( psa_crypto_generator_t => "psa_key_derivation_operation_t", psa_crypto_generator_init => "psa_key_derivation_init", psa_key_derivation_setup => "psa_key_derivation_setup", psa_key_derivation_input_key => "psa_key_derivation_input_key", psa_key_derivation_input_bytes => "psa_key_derivation_input_bytes", psa_key_agreement => "psa_key_derivation_key_agreement", psa_set_generator_capacity => "psa_key_derivation_set_capacity", psa_get_generator_capacity => "psa_key_derivation_get_capacity", psa_generator_read => "psa_key_derivation_output_bytes", psa_generate_derived_key => "psa_key_derivation_output_key", psa_generator_abort => "psa_key_derivation_abort", PSA_CRYPTO_GENERATOR_INIT => "PSA_KEY_DERIVATION_OPERATION_INIT", PSA_GENERATOR_UNBRIDLED_CAPACITY => "PSA_KEY_DERIVATION_UNLIMITED_CAPACITY", ); s/\b(@{[join("|", keys %t)]})\b/$t{$1}/ge' $(git ls-files)
2019-05-16 13:28:51 +00:00
* the capacity check in psa_key_derivation_output_bytes() would have
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
* prevented this call. It could happen only if the operation
HKDF: be more robust if we reach the maximum ouptut length In psa_generator_hkdf_read, return BAD_STATE if we're trying to construct more output than the algorithm allows. This can't happen through the API due to the capacity limit, but it could potentially happen in an internal call. Also add a test case that verifies that we can set up HKDF with its maximum capacity and read up to the maximum capacity.
2018-07-17 19:06:59 +00:00
* object was corrupted or if this function is called directly
* inside the library. */
if( hkdf->block_number == 0xff )
return( PSA_ERROR_BAD_STATE );
Implement HKDF
2018-07-12 15:22:21 +00:00
/* We need a new block */
++hkdf->block_number;
hkdf->offset_in_block = 0;
status = psa_hmac_setup_internal( &hkdf->hmac,
hkdf->prk, hash_length,
hash_alg );
if( status != PSA_SUCCESS )
return( status );
if( hkdf->block_number != 1 )
{
status = psa_hash_update( &hkdf->hmac.hash_ctx,
hkdf->output_block,
hash_length );
if( status != PSA_SUCCESS )
return( status );
}
status = psa_hash_update( &hkdf->hmac.hash_ctx,
hkdf->info,
hkdf->info_length );
if( status != PSA_SUCCESS )
return( status );
status = psa_hash_update( &hkdf->hmac.hash_ctx,
&hkdf->block_number, 1 );
if( status != PSA_SUCCESS )
return( status );
status = psa_hmac_finish_internal( &hkdf->hmac,
hkdf->output_block,
sizeof( hkdf->output_block ) );
if( status != PSA_SUCCESS )
return( status );
}
return( PSA_SUCCESS );
}
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF */
Add implementation of TLS-1.2 PRF
2018-10-09 16:33:01 +00:00
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Add stub for new tls12_prf_generate_next_block
2019-06-17 11:58:10 +00:00
static psa_status_t psa_key_derivation_tls12_prf_generate_next_block(
psa_tls12_prf_key_derivation_t *tls12_prf,
psa_algorithm_t alg )
{
psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( alg );
Rename output buffer size macros Rename existing support macros for output buffer sizes for PSA Crypto API 1.0.0 Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-12-18 13:23:51 +00:00
uint8_t hash_length = PSA_HASH_LENGTH( hash_alg );
Add tls12_prf key derivation to the new API The TLS 1.2 pseudorandom function does a lot of distinct HMAC operations with the same key. To save the battery and CPU cycles spent on calculating the paddings and hashing the inner padding, we keep the hash context in the status right after the inner padding having been hashed and clone it as needed.
2019-06-19 11:21:20 +00:00
psa_hash_operation_t backup = PSA_HASH_OPERATION_INIT;
psa_status_t status, cleanup_status;
Add implementation of TLS-1.2 PRF
2018-10-09 16:33:01 +00:00
Add stub for new tls12_prf_generate_next_block
2019-06-17 11:58:10 +00:00
/* We can't be wanting more output after block 0xff, otherwise
* the capacity check in psa_key_derivation_output_bytes() would have
* prevented this call. It could happen only if the operation
* object was corrupted or if this function is called directly
* inside the library. */
if( tls12_prf->block_number == 0xff )
Fix error code PSA_ERROR_BAD_STATE means that the function was called on a context in a bad state. This error is something that can't happen while only using the PSA API and therefore a PSA_ERROR_CORRUPTION_DETECTED is a more appropriate error code.
2019-06-25 09:15:04 +00:00
return( PSA_ERROR_CORRUPTION_DETECTED );
Add stub for new tls12_prf_generate_next_block
2019-06-17 11:58:10 +00:00
/* We need a new block */
++tls12_prf->block_number;
Add tls12_prf_read for the new API Technically we could have reused the old one for the new API, but then we had to set an extra field during setup. The new version works when all the fields that haven't been set explicitely are zero-initialised.
2019-06-19 11:10:49 +00:00
tls12_prf->left_in_block = hash_length;
Add stub for new tls12_prf_generate_next_block
2019-06-17 11:58:10 +00:00
/* Recall the definition of the TLS-1.2-PRF from RFC 5246:
*
* PRF(secret, label, seed) = P_<hash>(secret, label + seed)
*
* P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
* HMAC_hash(secret, A(2) + seed) +
* HMAC_hash(secret, A(3) + seed) + ...
*
* A(0) = seed
Add tls12_prf key derivation to the new API The TLS 1.2 pseudorandom function does a lot of distinct HMAC operations with the same key. To save the battery and CPU cycles spent on calculating the paddings and hashing the inner padding, we keep the hash context in the status right after the inner padding having been hashed and clone it as needed.
2019-06-19 11:21:20 +00:00
* A(i) = HMAC_hash(secret, A(i-1))
Add stub for new tls12_prf_generate_next_block
2019-06-17 11:58:10 +00:00
*
Add tls12_prf key derivation to the new API The TLS 1.2 pseudorandom function does a lot of distinct HMAC operations with the same key. To save the battery and CPU cycles spent on calculating the paddings and hashing the inner padding, we keep the hash context in the status right after the inner padding having been hashed and clone it as needed.
2019-06-19 11:21:20 +00:00
* The `psa_tls12_prf_key_derivation` structure saves the block
Add stub for new tls12_prf_generate_next_block
2019-06-17 11:58:10 +00:00
* `HMAC_hash(secret, A(i) + seed)` from which the output
Clarify TLS PRF algorithm description
2019-06-26 11:50:36 +00:00
* is currently extracted as `output_block` and where i is
* `block_number`.
Add stub for new tls12_prf_generate_next_block
2019-06-17 11:58:10 +00:00
*/
Add tls12_prf key derivation to the new API The TLS 1.2 pseudorandom function does a lot of distinct HMAC operations with the same key. To save the battery and CPU cycles spent on calculating the paddings and hashing the inner padding, we keep the hash context in the status right after the inner padding having been hashed and clone it as needed.
2019-06-19 11:21:20 +00:00
/* Save the hash context before using it, to preserve the hash state with
* only the inner padding in it. We need this, because inner padding depends
* on the key (secret in the RFC's terminology). */
status = psa_hash_clone( &tls12_prf->hmac.hash_ctx, &backup );
if( status != PSA_SUCCESS )
goto cleanup;
/* Calculate A(i) where i = tls12_prf->block_number. */
if( tls12_prf->block_number == 1 )
{
/* A(1) = HMAC_hash(secret, A(0)), where A(0) = seed. (The RFC overloads
* the variable seed and in this instance means it in the context of the
* P_hash function, where seed = label + seed.) */
status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
tls12_prf->label, tls12_prf->label_length );
if( status != PSA_SUCCESS )
goto cleanup;
status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
tls12_prf->seed, tls12_prf->seed_length );
if( status != PSA_SUCCESS )
goto cleanup;
}
else
{
/* A(i) = HMAC_hash(secret, A(i-1)) */
status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
tls12_prf->Ai, hash_length );
if( status != PSA_SUCCESS )
goto cleanup;
}
status = psa_hmac_finish_internal( &tls12_prf->hmac,
tls12_prf->Ai, hash_length );
if( status != PSA_SUCCESS )
goto cleanup;
status = psa_hash_clone( &backup, &tls12_prf->hmac.hash_ctx );
if( status != PSA_SUCCESS )
goto cleanup;
/* Calculate HMAC_hash(secret, A(i) + label + seed). */
status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
tls12_prf->Ai, hash_length );
if( status != PSA_SUCCESS )
goto cleanup;
status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
tls12_prf->label, tls12_prf->label_length );
if( status != PSA_SUCCESS )
goto cleanup;
status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
tls12_prf->seed, tls12_prf->seed_length );
if( status != PSA_SUCCESS )
goto cleanup;
status = psa_hmac_finish_internal( &tls12_prf->hmac,
tls12_prf->output_block, hash_length );
if( status != PSA_SUCCESS )
goto cleanup;
status = psa_hash_clone( &backup, &tls12_prf->hmac.hash_ctx );
if( status != PSA_SUCCESS )
goto cleanup;
Add stub for new tls12_prf_generate_next_block
2019-06-17 11:58:10 +00:00
cleanup:
Add tls12_prf key derivation to the new API The TLS 1.2 pseudorandom function does a lot of distinct HMAC operations with the same key. To save the battery and CPU cycles spent on calculating the paddings and hashing the inner padding, we keep the hash context in the status right after the inner padding having been hashed and clone it as needed.
2019-06-19 11:21:20 +00:00
cleanup_status = psa_hash_abort( &backup );
if( status == PSA_SUCCESS && cleanup_status != PSA_SUCCESS )
status = cleanup_status;
return( status );
Add stub for new tls12_prf_generate_next_block
2019-06-17 11:58:10 +00:00
}
Add implementation of TLS-1.2 PRF
2018-10-09 16:33:01 +00:00
Add tls12_prf_read for the new API Technically we could have reused the old one for the new API, but then we had to set an extra field during setup. The new version works when all the fields that haven't been set explicitely are zero-initialised.
2019-06-19 11:10:49 +00:00
static psa_status_t psa_key_derivation_tls12_prf_read(
psa_tls12_prf_key_derivation_t *tls12_prf,
psa_algorithm_t alg,
uint8_t *output,
size_t output_length )
{
psa_algorithm_t hash_alg = PSA_ALG_TLS12_PRF_GET_HASH( alg );
Rename output buffer size macros Rename existing support macros for output buffer sizes for PSA Crypto API 1.0.0 Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-12-18 13:23:51 +00:00
uint8_t hash_length = PSA_HASH_LENGTH( hash_alg );
Add tls12_prf_read for the new API Technically we could have reused the old one for the new API, but then we had to set an extra field during setup. The new version works when all the fields that haven't been set explicitely are zero-initialised.
2019-06-19 11:10:49 +00:00
psa_status_t status;
uint8_t offset, length;
while( output_length != 0 )
{
/* Check if we have fully processed the current block. */
if( tls12_prf->left_in_block == 0 )
{
status = psa_key_derivation_tls12_prf_generate_next_block( tls12_prf,
alg );
if( status != PSA_SUCCESS )
return( status );
continue;
}
if( tls12_prf->left_in_block > output_length )
length = (uint8_t) output_length;
else
length = tls12_prf->left_in_block;
offset = hash_length - tls12_prf->left_in_block;
memcpy( output, tls12_prf->output_block + offset, length );
output += length;
output_length -= length;
tls12_prf->left_in_block -= length;
}
return( PSA_SUCCESS );
}
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF ||
* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Implement HKDF
2018-07-12 15:22:21 +00:00
Improve style
2019-06-17 11:38:20 +00:00
psa_status_t psa_key_derivation_output_bytes(
psa_key_derivation_operation_t *operation,
uint8_t *output,
size_t output_length )
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
{
psa_status_t status;
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg( operation );
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
if( operation->alg == 0 )
psa: Check generator validity before read Check generator validity (i.e. that alg has been initialized) before allowing reads from the generator or allowing reads of the generator's capacity. This aligns our implementation with the documented error code behavior in our crypto.h and the PSA Crypto API.
2019-02-15 13:05:49 +00:00
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
/* This is a blank operation. */
Style fixes * return is treated as a function call * space between opening and closing parentheses * remove whiteline between assignment and checking of same variable Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-05 13:43:42 +00:00
return( PSA_ERROR_BAD_STATE );
psa: Check generator validity before read Check generator validity (i.e. that alg has been initialized) before allowing reads from the generator or allowing reads of the generator's capacity. This aligns our implementation with the documented error code behavior in our crypto.h and the PSA Crypto API.
2019-02-15 13:05:49 +00:00
}
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
if( output_length > operation->capacity )
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
operation->capacity = 0;
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
/* Go through the error path to wipe all confidential data now
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
* that the operation object is useless. */
Replace PSA error code definitions with the ones defined in PSA spec
2019-02-14 11:48:10 +00:00
status = PSA_ERROR_INSUFFICIENT_DATA;
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
goto exit;
}
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
if( output_length == 0 && operation->capacity == 0 )
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
/* Edge case: this is a finished operation, and 0 bytes
psa: Check generator validity before read Check generator validity (i.e. that alg has been initialized) before allowing reads from the generator or allowing reads of the generator's capacity. This aligns our implementation with the documented error code behavior in our crypto.h and the PSA Crypto API.
2019-02-15 13:05:49 +00:00
* were requested. The right error in this case could
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
* be either INSUFFICIENT_CAPACITY or BAD_STATE. Return
* INSUFFICIENT_CAPACITY, which is right for a finished
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
* operation, for consistency with the case when
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
* output_length > 0. */
Replace PSA error code definitions with the ones defined in PSA spec
2019-02-14 11:48:10 +00:00
return( PSA_ERROR_INSUFFICIENT_DATA );
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
}
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
operation->capacity -= output_length;
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
Phase 2 support for MBEDTLS_PSA_CRYPTO_CONFIG This phase adds in support for the following features being added to the list of features that can be configured in the include/psa/crypto_config.h header file using the PSA_WANT_ALG_xxx macros: ECDH, HMAC, HKDF, and RSA. These changes include changes to the PSA crypto library to use the appropriate new guards that will allow the feature to be compiled in or out either using new PSA_WANT_ALG_xxx or the previous MBEDTLS_xxx macros. For HKDF and HMAC, most of the PSA library code did not have a specific matching MBEDTLS_xxx macro for that feature, but was instead using the generic dependent MBEDTLS_MD_C macro. The ECDH and RSA features more closely aligned with a direct replacement with a similar macro. The new tests for RSA, HMAC, and HKDF would normally unset additional dependent macros, but when attempting to implement that level of testing it required removal of too many core features like MD_C, PK_C, ECP_C and other low level features. This may point to additional phases of work to complete the transition of these features to the new model. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-30 04:37:36 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
if( PSA_ALG_IS_HKDF( kdf_alg ) )
Implement HKDF
2018-07-12 15:22:21 +00:00
{
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( kdf_alg );
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
status = psa_key_derivation_hkdf_read( &operation->ctx.hkdf, hash_alg,
Implement HKDF
2018-07-12 15:22:21 +00:00
output, output_length );
}
Remove the deprecated PSA_ALG_SELECT_RAW option This change affects the psa_key_derivation_s structure. With the buffer removed from the union, it is empty if MBEDTLS_MD_C is not defined. We can avoid undefined behaviour by adding a new dummy field that is always present or make the whole union conditional on MBEDTLS_MD_C. In this latter case the initialiser macro has to depend on MBEDTLS_MD_C as well. Furthermore the first structure would be either psa_hkdf_key_derivation_t or psa_tls12_prf_key_derivation_t both of which are very deep and would make the initialisation macro difficult to maintain, therefore we go with the first option.
2019-06-14 10:05:39 +00:00
else
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF */
#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Remove the deprecated PSA_ALG_SELECT_RAW option This change affects the psa_key_derivation_s structure. With the buffer removed from the union, it is empty if MBEDTLS_MD_C is not defined. We can avoid undefined behaviour by adding a new dummy field that is always present or make the whole union conditional on MBEDTLS_MD_C. In this latter case the initialiser macro has to depend on MBEDTLS_MD_C as well. Furthermore the first structure would be either psa_hkdf_key_derivation_t or psa_tls12_prf_key_derivation_t both of which are very deep and would make the initialisation macro difficult to maintain, therefore we go with the first option.
2019-06-14 10:05:39 +00:00
if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
Add implementation of TLS-1.2 PRF
2018-10-09 16:33:01 +00:00
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
status = psa_key_derivation_tls12_prf_read( &operation->ctx.tls12_prf,
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
kdf_alg, output,
Add implementation of TLS-1.2 PRF
2018-10-09 16:33:01 +00:00
output_length );
}
Implement HKDF
2018-07-12 15:22:21 +00:00
else
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF ||
* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
{
Fix unused variables in PSA core when no KDF algorithm is present Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-10 16:19:22 +00:00
(void) kdf_alg;
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
return( PSA_ERROR_BAD_STATE );
}
exit:
if( status != PSA_SUCCESS )
{
psa: Check generator validity before read Check generator validity (i.e. that alg has been initialized) before allowing reads from the generator or allowing reads of the generator's capacity. This aligns our implementation with the documented error code behavior in our crypto.h and the PSA Crypto API.
2019-02-15 13:05:49 +00:00
/* Preserve the algorithm upon errors, but clear all sensitive state.
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
* This allows us to differentiate between exhausted operations and
* blank operations, so we can return PSA_ERROR_BAD_STATE on blank
* operations. */
psa_algorithm_t alg = operation->alg;
psa_key_derivation_abort( operation );
operation->alg = alg;
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
memset( output, '!', output_length );
}
return( status );
}
Use proper conditional for software DES When converting definitions to use the new PSA defines, one erroneously was conditionalized on the WANT macro instead of on the BUILTIN macro. Signed-off-by: David Brown <david.brown@linaro.org>
2021-02-09 23:28:23 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Fix psa_generator_import_key for DES In psa_generator_import_key, if generating a DES or 3DES key, set the parity bits. Add tests for deriving a DES key. Also test deriving an AES key while I'm at it.
2018-07-19 15:05:42 +00:00
static void psa_des_set_key_parity( uint8_t *data, size_t data_size )
{
if( data_size >= 8 )
mbedtls_des_key_set_parity( data );
if( data_size >= 16 )
mbedtls_des_key_set_parity( data + 8 );
if( data_size >= 24 )
mbedtls_des_key_set_parity( data + 16 );
}
Use proper conditional for software DES When converting definitions to use the new PSA defines, one erroneously was conditionalized on the WANT macro instead of on the BUILTIN macro. Signed-off-by: David Brown <david.brown@linaro.org>
2021-02-09 23:28:23 +00:00
#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */
Fix psa_generator_import_key for DES In psa_generator_import_key, if generating a DES or 3DES key, set the parity bits. Add tests for deriving a DES key. Also test deriving an AES key while I'm at it.
2018-07-19 15:05:42 +00:00
Rename psa_generate_key() and psa_generator_import_key()
2019-05-03 14:44:28 +00:00
static psa_status_t psa_generate_derived_key_internal(
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 10:53:30 +00:00
psa_key_slot_t *slot,
size_t bits,
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
psa_key_derivation_operation_t *operation )
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
{
uint8_t *data = NULL;
size_t bytes = PSA_BITS_TO_BYTES( bits );
psa_status_t status;
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( ! key_type_is_raw_bytes( slot->attr.type ) )
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
return( PSA_ERROR_INVALID_ARGUMENT );
if( bits % 8 != 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
data = mbedtls_calloc( 1, bytes );
if( data == NULL )
return( PSA_ERROR_INSUFFICIENT_MEMORY );
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
status = psa_key_derivation_output_bytes( operation, data, bytes );
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
if( status != PSA_SUCCESS )
goto exit;
Change some conditionals of PSA to use BUILTIN Change a few conditionals in the psa library to be based on the MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES instead of the WANT macros. Future additions of HW acceleration will need to be mindful of these definitions if any of this code is needed in those instances. Signed-off-by: David Brown <david.brown@linaro.org>
2021-02-11 18:02:00 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( slot->attr.type == PSA_KEY_TYPE_DES )
Fix psa_generator_import_key for DES In psa_generator_import_key, if generating a DES or 3DES key, set the parity bits. Add tests for deriving a DES key. Also test deriving an AES key while I'm at it.
2018-07-19 15:05:42 +00:00
psa_des_set_key_parity( data, bytes );
Fix 2 endif comments Two endif comments didn't match the ifdef. Fix these to match. Signed-off-by: David Brown <david.brown@linaro.org>
2021-02-12 15:08:46 +00:00
#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */
psa: import: Move key buffer allocation Move key buffer allocation from psa_import_key_into_slot() function up to the two functions calling it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 14:14:42 +00:00
status = psa_allocate_buffer_to_slot( slot, bytes );
if( status != PSA_SUCCESS )
Fix memory leak in error case in psa_crypto In psa_generate_derived_key_internal() an error case was returning directly rather than jumping to the exit label, which meant that an allocated buffer would not be free'd. Found via coverity. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-02-09 18:58:20 +00:00
goto exit;
psa: import: Move key buffer allocation Move key buffer allocation from psa_import_key_into_slot() function up to the two functions calling it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 14:14:42 +00:00
psa: Call import software implementation as a driver Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 17:06:53 +00:00
slot->attr.bits = (psa_key_bits_t) bits;
psa: Change psa_import_key_into_slot() signature Change psa_import_key_into_slot() signature to the signature of an import_key driver entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 14:54:54 +00:00
psa_key_attributes_t attributes = {
.core = slot->attr
};
psa: Call import software implementation as a driver Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 17:06:53 +00:00
status = psa_driver_wrapper_import_key( &attributes,
data, bytes,
slot->key.data,
slot->key.bytes,
&slot->key.bytes, &bits );
if( bits != slot->attr.bits )
status = PSA_ERROR_INVALID_ARGUMENT;
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
exit:
mbedtls_free( data );
return( status );
}
Rename generator functions to psa_key_derivation_xxx Generators are mostly about key derivation (currently: only about key derivation). "Generator" is not a commonly used term in cryptography. So favor "derivation" as terminology. Call a generator a key derivation operation structure, since it behaves like other multipart operation structures. Furthermore, the function names are not fully consistent. In this commit, I rename the functions to consistently have the prefix "psa_key_derivation_". I used the following command: perl -i -pe '%t = ( psa_crypto_generator_t => "psa_key_derivation_operation_t", psa_crypto_generator_init => "psa_key_derivation_init", psa_key_derivation_setup => "psa_key_derivation_setup", psa_key_derivation_input_key => "psa_key_derivation_input_key", psa_key_derivation_input_bytes => "psa_key_derivation_input_bytes", psa_key_agreement => "psa_key_derivation_key_agreement", psa_set_generator_capacity => "psa_key_derivation_set_capacity", psa_get_generator_capacity => "psa_key_derivation_get_capacity", psa_generator_read => "psa_key_derivation_output_bytes", psa_generate_derived_key => "psa_key_derivation_output_key", psa_generator_abort => "psa_key_derivation_abort", PSA_CRYPTO_GENERATOR_INIT => "PSA_KEY_DERIVATION_OPERATION_INIT", PSA_GENERATOR_UNBRIDLED_CAPACITY => "PSA_KEY_DERIVATION_UNLIMITED_CAPACITY", ); s/\b(@{[join("|", keys %t)]})\b/$t{$1}/ge' $(git ls-files)
2019-05-16 13:28:51 +00:00
psa_status_t psa_key_derivation_output_key( const psa_key_attributes_t *attributes,
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
psa_key_derivation_operation_t *operation,
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
mbedtls_svc_key_id_t *key )
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 10:53:30 +00:00
{
psa_status_t status;
psa_key_slot_t *slot = NULL;
Driver table entries are now mutable Since driver table entries contain the driver context, which is mutable, they can't be const anymore.
2019-07-12 21:40:35 +00:00
psa_se_drv_table_entry_t *driver = NULL;
Reject keys of size 0 Implement the prohibition on keys of size 0.
2019-09-12 17:03:13 +00:00
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 11:10:32 +00:00
*key = MBEDTLS_SVC_KEY_ID_INIT;
Reject keys of size 0 Implement the prohibition on keys of size 0.
2019-09-12 17:03:13 +00:00
/* Reject any attempt to create a zero-length key so that we don't
* risk tripping up later, e.g. on a malloc(0) that returns NULL. */
if( psa_get_key_bits( attributes ) == 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
Key derivation: forbid output_key without input_key If none of the inputs to a key derivation is a PSA_KEY_DERIVATION_INPUT_SECRET passed with psa_key_derivation_input_key(), forbid psa_key_derivation_output_key(). It usually doesn't make sense to derive a key object if the secret isn't itself a proper key.
2019-09-24 16:21:06 +00:00
if( ! operation->can_output_key )
return( PSA_ERROR_NOT_PERMITTED );
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 11:10:32 +00:00
status = psa_start_key_creation( PSA_KEY_CREATION_DERIVE, attributes,
&slot, &driver );
SE keys: error out in key creation function that lack support
2019-07-24 11:44:30 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
if( driver != NULL )
{
/* Deriving a key in a secure element is not implemented yet. */
status = PSA_ERROR_NOT_SUPPORTED;
}
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 10:53:30 +00:00
if( status == PSA_SUCCESS )
{
Rename psa_generate_key() and psa_generator_import_key()
2019-05-03 14:44:28 +00:00
status = psa_generate_derived_key_internal( slot,
Move attribute fields to a substructure Move the "core attributes" to a substructure of psa_key_attribute_t. The motivation is to be able to use the new structure psa_core_key_attributes_t internally.
2019-07-30 11:48:52 +00:00
attributes->core.bits,
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
operation );
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 10:53:30 +00:00
}
if( status == PSA_SUCCESS )
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 11:10:32 +00:00
status = psa_finish_key_creation( slot, driver, key );
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 10:53:30 +00:00
if( status != PSA_SUCCESS )
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
psa_fail_key_creation( slot, driver );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 10:53:30 +00:00
return( status );
}
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
Add framework for simple key derivation New key type PSA_KEY_TYPE_DERIVE. New usage flag PSA_KEY_USAGE_DERIVE. New function psa_key_derivation. No key derivation algorithm is implemented yet. The code may not compile with -Wunused. Write some unit test code for psa_key_derivation. Most of it cannot be used yet due to the lack of a key derivation algorithm.
2018-07-12 15:17:20 +00:00
/****************************************************************/
/* Key derivation */
/****************************************************************/
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
#ifdef AT_LEAST_ONE_BUILTIN_KDF
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
static psa_status_t psa_key_derivation_setup_kdf(
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
psa_key_derivation_operation_t *operation,
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
psa_algorithm_t kdf_alg )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
{
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
int is_kdf_alg_supported;
Make key derivation initialisation consistent The macro initialiser might leave bytes in the union unspecified. Zeroising it in setup makes sure that the behaviour is the same independently of the initialisation method used.
2019-06-20 14:09:30 +00:00
/* Make sure that operation->ctx is properly zero-initialised. (Macro
* initialisers for this union leave some bytes unspecified.) */
memset( &operation->ctx, 0, sizeof( operation->ctx ) );
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
/* Make sure that kdf_alg is a supported key derivation algorithm. */
Phase 2 support for MBEDTLS_PSA_CRYPTO_CONFIG This phase adds in support for the following features being added to the list of features that can be configured in the include/psa/crypto_config.h header file using the PSA_WANT_ALG_xxx macros: ECDH, HMAC, HKDF, and RSA. These changes include changes to the PSA crypto library to use the appropriate new guards that will allow the feature to be compiled in or out either using new PSA_WANT_ALG_xxx or the previous MBEDTLS_xxx macros. For HKDF and HMAC, most of the PSA library code did not have a specific matching MBEDTLS_xxx macro for that feature, but was instead using the generic dependent MBEDTLS_MD_C macro. The ECDH and RSA features more closely aligned with a direct replacement with a similar macro. The new tests for RSA, HMAC, and HKDF would normally unset additional dependent macros, but when attempting to implement that level of testing it required removal of too many core features like MD_C, PK_C, ECP_C and other low level features. This may point to additional phases of work to complete the transition of these features to the new model. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-30 04:37:36 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
if( PSA_ALG_IS_HKDF( kdf_alg ) )
is_kdf_alg_supported = 1;
else
#endif
#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF)
if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) )
is_kdf_alg_supported = 1;
else
#endif
#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
if( PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
is_kdf_alg_supported = 1;
else
#endif
is_kdf_alg_supported = 0;
if( is_kdf_alg_supported )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
{
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( kdf_alg );
Rename output buffer size macros Rename existing support macros for output buffer sizes for PSA Crypto API 1.0.0 Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-12-18 13:23:51 +00:00
size_t hash_size = PSA_HASH_LENGTH( hash_alg );
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
if( hash_size == 0 )
return( PSA_ERROR_NOT_SUPPORTED );
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
if( ( PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) ) &&
fixup! Key derivation by small input steps: proof-of-concept Fix logic error that clang helpfully points out
2019-04-12 13:06:27 +00:00
! ( hash_alg == PSA_ALG_SHA_256 || hash_alg == PSA_ALG_SHA_384 ) )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
{
return( PSA_ERROR_NOT_SUPPORTED );
}
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
operation->capacity = 255 * hash_size;
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
return( PSA_SUCCESS );
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
}
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
return( PSA_ERROR_NOT_SUPPORTED );
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
}
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
#endif /* AT_LEAST_ONE_BUILTIN_KDF */
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
psa_status_t psa_key_derivation_setup( psa_key_derivation_operation_t *operation,
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
psa_algorithm_t alg )
{
psa_status_t status;
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
if( operation->alg != 0 )
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
return( PSA_ERROR_BAD_STATE );
Simplify the encoding of key agreement algorithms Get rid of "key selection" algorithms (of which there was only one: raw key selection). Encode key agreement by combining a raw key agreement with a KDF, rather than passing the KDF as an argument of a key agreement macro.
2019-01-18 15:44:49 +00:00
if( PSA_ALG_IS_RAW_KEY_AGREEMENT( alg ) )
return( PSA_ERROR_INVALID_ARGUMENT );
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
#ifdef AT_LEAST_ONE_BUILTIN_KDF
Simplify the encoding of key agreement algorithms Get rid of "key selection" algorithms (of which there was only one: raw key selection). Encode key agreement by combining a raw key agreement with a KDF, rather than passing the KDF as an argument of a key agreement macro.
2019-01-18 15:44:49 +00:00
else if( PSA_ALG_IS_KEY_AGREEMENT( alg ) )
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
{
psa_algorithm_t kdf_alg = PSA_ALG_KEY_AGREEMENT_GET_KDF( alg );
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
status = psa_key_derivation_setup_kdf( operation, kdf_alg );
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
}
else if( PSA_ALG_IS_KEY_DERIVATION( alg ) )
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
status = psa_key_derivation_setup_kdf( operation, alg );
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
}
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
#endif
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
else
return( PSA_ERROR_INVALID_ARGUMENT );
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
if( status == PSA_SUCCESS )
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
operation->alg = alg;
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
return( status );
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
}
Phase 2 support for MBEDTLS_PSA_CRYPTO_CONFIG This phase adds in support for the following features being added to the list of features that can be configured in the include/psa/crypto_config.h header file using the PSA_WANT_ALG_xxx macros: ECDH, HMAC, HKDF, and RSA. These changes include changes to the PSA crypto library to use the appropriate new guards that will allow the feature to be compiled in or out either using new PSA_WANT_ALG_xxx or the previous MBEDTLS_xxx macros. For HKDF and HMAC, most of the PSA library code did not have a specific matching MBEDTLS_xxx macro for that feature, but was instead using the generic dependent MBEDTLS_MD_C macro. The ECDH and RSA features more closely aligned with a direct replacement with a similar macro. The new tests for RSA, HMAC, and HKDF would normally unset additional dependent macros, but when attempting to implement that level of testing it required removal of too many core features like MD_C, PK_C, ECP_C and other low level features. This may point to additional phases of work to complete the transition of these features to the new model. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-30 04:37:36 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Rename generator-related internal identifiers perl -pe 's/crypto_generator/key_derivation/gi' $(git ls-files) perl -pe 's/_generator/_key_derivation/gi' $(git ls-files)
2019-05-16 14:59:18 +00:00
static psa_status_t psa_hkdf_input( psa_hkdf_key_derivation_t *hkdf,
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
psa_algorithm_t hash_alg,
psa_key_derivation_step_t step,
const uint8_t *data,
size_t data_length )
{
psa_status_t status;
switch( step )
{
Rename PSA_KDF_STEP_xxx -> PSA_KEY_DERIVATION_INPUT_xxx More consistent with the new function names.
2019-05-16 14:05:19 +00:00
case PSA_KEY_DERIVATION_INPUT_SALT:
fixup! Key derivation by small input steps: proof-of-concept Simplify the logic inside a few case statements. This removes unreachable break statements.
2019-04-12 13:11:49 +00:00
if( hkdf->state != HKDF_STATE_INIT )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
return( PSA_ERROR_BAD_STATE );
fixup! Key derivation by small input steps: proof-of-concept Simplify the logic inside a few case statements. This removes unreachable break statements.
2019-04-12 13:11:49 +00:00
status = psa_hmac_setup_internal( &hkdf->hmac,
data, data_length,
hash_alg );
if( status != PSA_SUCCESS )
return( status );
hkdf->state = HKDF_STATE_STARTED;
return( PSA_SUCCESS );
Rename PSA_KDF_STEP_xxx -> PSA_KEY_DERIVATION_INPUT_xxx More consistent with the new function names.
2019-05-16 14:05:19 +00:00
case PSA_KEY_DERIVATION_INPUT_SECRET:
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
/* If no salt was provided, use an empty salt. */
if( hkdf->state == HKDF_STATE_INIT )
{
status = psa_hmac_setup_internal( &hkdf->hmac,
NULL, 0,
Fix confusion between HMAC algorithm and the corresponding hash
2019-04-11 19:22:52 +00:00
hash_alg );
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
if( status != PSA_SUCCESS )
return( status );
hkdf->state = HKDF_STATE_STARTED;
}
fixup! Key derivation by small input steps: proof-of-concept Simplify the logic inside a few case statements. This removes unreachable break statements.
2019-04-12 13:11:49 +00:00
if( hkdf->state != HKDF_STATE_STARTED )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
return( PSA_ERROR_BAD_STATE );
fixup! Key derivation by small input steps: proof-of-concept Simplify the logic inside a few case statements. This removes unreachable break statements.
2019-04-12 13:11:49 +00:00
status = psa_hash_update( &hkdf->hmac.hash_ctx,
data, data_length );
if( status != PSA_SUCCESS )
return( status );
status = psa_hmac_finish_internal( &hkdf->hmac,
hkdf->prk,
sizeof( hkdf->prk ) );
if( status != PSA_SUCCESS )
return( status );
Rename output buffer size macros Rename existing support macros for output buffer sizes for PSA Crypto API 1.0.0 Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-12-18 13:23:51 +00:00
hkdf->offset_in_block = PSA_HASH_LENGTH( hash_alg );
fixup! Key derivation by small input steps: proof-of-concept Simplify the logic inside a few case statements. This removes unreachable break statements.
2019-04-12 13:11:49 +00:00
hkdf->block_number = 0;
hkdf->state = HKDF_STATE_KEYED;
return( PSA_SUCCESS );
Rename PSA_KDF_STEP_xxx -> PSA_KEY_DERIVATION_INPUT_xxx More consistent with the new function names.
2019-05-16 14:05:19 +00:00
case PSA_KEY_DERIVATION_INPUT_INFO:
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
if( hkdf->state == HKDF_STATE_OUTPUT )
return( PSA_ERROR_BAD_STATE );
if( hkdf->info_set )
return( PSA_ERROR_BAD_STATE );
hkdf->info_length = data_length;
if( data_length != 0 )
{
hkdf->info = mbedtls_calloc( 1, data_length );
if( hkdf->info == NULL )
return( PSA_ERROR_INSUFFICIENT_MEMORY );
memcpy( hkdf->info, data, data_length );
}
hkdf->info_set = 1;
return( PSA_SUCCESS );
default:
return( PSA_ERROR_INVALID_ARGUMENT );
}
}
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF */
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Add seed input for psa_tls12_prf_input
2019-06-13 08:05:41 +00:00
static psa_status_t psa_tls12_prf_set_seed( psa_tls12_prf_key_derivation_t *prf,
const uint8_t *data,
size_t data_length )
{
Rename unnamespaced identifiers Rename the enum constants TLS12_PRF_xxx, which are declared in a public header but not intended for use in application code, to start with MBEDTLS_PSA_. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-13 13:55:14 +00:00
if( prf->state != PSA_TLS12_PRF_STATE_INIT )
Add seed input for psa_tls12_prf_input
2019-06-13 08:05:41 +00:00
return( PSA_ERROR_BAD_STATE );
Fix zero-length seed or label in TLS 1.2 PRF The psa_tls12_prf_set_seed() and psa_tls12_prf_set_label() functions did not work on platforms where malloc(0) returns NULL. It does not affect the TLS use case but these PRFs are used in other protocols as well and might not be used the same way. For example EAP uses the TLS PRF with an empty secret. (This would not trigger the bug, but is a strong indication that it is not safe to assume that certain inputs to this function are not zero length.) The conditional block includes the memcpy() call as well to avoid passing a NULL pointer as a parameter resulting in undefined behaviour. The current tests are already using zero length label and seed, there is no need to add new test for this bug.
2019-07-04 08:11:38 +00:00
if( data_length != 0 )
{
prf->seed = mbedtls_calloc( 1, data_length );
if( prf->seed == NULL )
return( PSA_ERROR_INSUFFICIENT_MEMORY );
Add seed input for psa_tls12_prf_input
2019-06-13 08:05:41 +00:00
Fix zero-length seed or label in TLS 1.2 PRF The psa_tls12_prf_set_seed() and psa_tls12_prf_set_label() functions did not work on platforms where malloc(0) returns NULL. It does not affect the TLS use case but these PRFs are used in other protocols as well and might not be used the same way. For example EAP uses the TLS PRF with an empty secret. (This would not trigger the bug, but is a strong indication that it is not safe to assume that certain inputs to this function are not zero length.) The conditional block includes the memcpy() call as well to avoid passing a NULL pointer as a parameter resulting in undefined behaviour. The current tests are already using zero length label and seed, there is no need to add new test for this bug.
2019-07-04 08:11:38 +00:00
memcpy( prf->seed, data, data_length );
prf->seed_length = data_length;
}
Add seed input for psa_tls12_prf_input
2019-06-13 08:05:41 +00:00
Rename unnamespaced identifiers Rename the enum constants TLS12_PRF_xxx, which are declared in a public header but not intended for use in application code, to start with MBEDTLS_PSA_. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-13 13:55:14 +00:00
prf->state = PSA_TLS12_PRF_STATE_SEED_SET;
Add seed input for psa_tls12_prf_input
2019-06-13 08:05:41 +00:00
return( PSA_SUCCESS );
}
Add key import for psa_tls12_prf_input
2019-06-13 13:26:34 +00:00
static psa_status_t psa_tls12_prf_set_key( psa_tls12_prf_key_derivation_t *prf,
psa_algorithm_t hash_alg,
const uint8_t *data,
size_t data_length )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
{
psa_status_t status;
Rename unnamespaced identifiers Rename the enum constants TLS12_PRF_xxx, which are declared in a public header but not intended for use in application code, to start with MBEDTLS_PSA_. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-13 13:55:14 +00:00
if( prf->state != PSA_TLS12_PRF_STATE_SEED_SET )
Add key import for psa_tls12_prf_input
2019-06-13 13:26:34 +00:00
return( PSA_ERROR_BAD_STATE );
status = psa_hmac_setup_internal( &prf->hmac, data, data_length, hash_alg );
if( status != PSA_SUCCESS )
return( status );
Rename unnamespaced identifiers Rename the enum constants TLS12_PRF_xxx, which are declared in a public header but not intended for use in application code, to start with MBEDTLS_PSA_. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-13 13:55:14 +00:00
prf->state = PSA_TLS12_PRF_STATE_KEY_SET;
Add key import for psa_tls12_prf_input
2019-06-13 13:26:34 +00:00
return( PSA_SUCCESS );
}
Add label input for psa_tls12_prf_input
2019-06-13 08:15:47 +00:00
static psa_status_t psa_tls12_prf_set_label( psa_tls12_prf_key_derivation_t *prf,
const uint8_t *data,
size_t data_length )
{
Rename unnamespaced identifiers Rename the enum constants TLS12_PRF_xxx, which are declared in a public header but not intended for use in application code, to start with MBEDTLS_PSA_. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-13 13:55:14 +00:00
if( prf->state != PSA_TLS12_PRF_STATE_KEY_SET )
Add label input for psa_tls12_prf_input
2019-06-13 08:15:47 +00:00
return( PSA_ERROR_BAD_STATE );
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
Fix zero-length seed or label in TLS 1.2 PRF The psa_tls12_prf_set_seed() and psa_tls12_prf_set_label() functions did not work on platforms where malloc(0) returns NULL. It does not affect the TLS use case but these PRFs are used in other protocols as well and might not be used the same way. For example EAP uses the TLS PRF with an empty secret. (This would not trigger the bug, but is a strong indication that it is not safe to assume that certain inputs to this function are not zero length.) The conditional block includes the memcpy() call as well to avoid passing a NULL pointer as a parameter resulting in undefined behaviour. The current tests are already using zero length label and seed, there is no need to add new test for this bug.
2019-07-04 08:11:38 +00:00
if( data_length != 0 )
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
{
Fix zero-length seed or label in TLS 1.2 PRF The psa_tls12_prf_set_seed() and psa_tls12_prf_set_label() functions did not work on platforms where malloc(0) returns NULL. It does not affect the TLS use case but these PRFs are used in other protocols as well and might not be used the same way. For example EAP uses the TLS PRF with an empty secret. (This would not trigger the bug, but is a strong indication that it is not safe to assume that certain inputs to this function are not zero length.) The conditional block includes the memcpy() call as well to avoid passing a NULL pointer as a parameter resulting in undefined behaviour. The current tests are already using zero length label and seed, there is no need to add new test for this bug.
2019-07-04 08:11:38 +00:00
prf->label = mbedtls_calloc( 1, data_length );
if( prf->label == NULL )
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
return( PSA_ERROR_INSUFFICIENT_MEMORY );
Add label input for psa_tls12_prf_input
2019-06-13 08:15:47 +00:00
Fix zero-length seed or label in TLS 1.2 PRF The psa_tls12_prf_set_seed() and psa_tls12_prf_set_label() functions did not work on platforms where malloc(0) returns NULL. It does not affect the TLS use case but these PRFs are used in other protocols as well and might not be used the same way. For example EAP uses the TLS PRF with an empty secret. (This would not trigger the bug, but is a strong indication that it is not safe to assume that certain inputs to this function are not zero length.) The conditional block includes the memcpy() call as well to avoid passing a NULL pointer as a parameter resulting in undefined behaviour. The current tests are already using zero length label and seed, there is no need to add new test for this bug.
2019-07-04 08:11:38 +00:00
memcpy( prf->label, data, data_length );
prf->label_length = data_length;
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
}
Add label input for psa_tls12_prf_input
2019-06-13 08:15:47 +00:00
Rename unnamespaced identifiers Rename the enum constants TLS12_PRF_xxx, which are declared in a public header but not intended for use in application code, to start with MBEDTLS_PSA_. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-13 13:55:14 +00:00
prf->state = PSA_TLS12_PRF_STATE_LABEL_SET;
Add label input for psa_tls12_prf_input
2019-06-13 08:15:47 +00:00
return( PSA_SUCCESS );
}
Add stubs for psa_tls12_prf_input
2019-06-11 14:30:30 +00:00
static psa_status_t psa_tls12_prf_input( psa_tls12_prf_key_derivation_t *prf,
psa_algorithm_t hash_alg,
psa_key_derivation_step_t step,
const uint8_t *data,
size_t data_length )
{
switch( step )
{
Add seed input for psa_tls12_prf_input
2019-06-13 08:05:41 +00:00
case PSA_KEY_DERIVATION_INPUT_SEED:
return( psa_tls12_prf_set_seed( prf, data, data_length ) );
Add key import for psa_tls12_prf_input
2019-06-13 13:26:34 +00:00
case PSA_KEY_DERIVATION_INPUT_SECRET:
return( psa_tls12_prf_set_key( prf, hash_alg, data, data_length ) );
Add label input for psa_tls12_prf_input
2019-06-13 08:15:47 +00:00
case PSA_KEY_DERIVATION_INPUT_LABEL:
return( psa_tls12_prf_set_label( prf, data, data_length ) );
Add stubs for psa_tls12_prf_input
2019-06-11 14:30:30 +00:00
default:
return( PSA_ERROR_INVALID_ARGUMENT );
}
}
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) ||
* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
static psa_status_t psa_tls12_prf_psk_to_ms_set_key(
psa_tls12_prf_key_derivation_t *prf,
psa_algorithm_t hash_alg,
const uint8_t *data,
size_t data_length )
{
psa_status_t status;
Rename output buffer size macros Rename existing support macros for output buffer sizes for PSA Crypto API 1.0.0 Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-12-18 13:23:51 +00:00
uint8_t pms[ 4 + 2 * PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE ];
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
uint8_t *cur = pms;
Rename output buffer size macros Rename existing support macros for output buffer sizes for PSA Crypto API 1.0.0 Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-12-18 13:23:51 +00:00
if( data_length > PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE )
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
return( PSA_ERROR_INVALID_ARGUMENT );
/* Quoting RFC 4279, Section 2:
*
* The premaster secret is formed as follows: if the PSK is N octets
* long, concatenate a uint16 with the value N, N zero octets, a second
* uint16 with the value N, and the PSK itself.
*/
*cur++ = ( data_length >> 8 ) & 0xff;
*cur++ = ( data_length >> 0 ) & 0xff;
memset( cur, 0, data_length );
cur += data_length;
*cur++ = pms[0];
*cur++ = pms[1];
memcpy( cur, data, data_length );
cur += data_length;
status = psa_tls12_prf_set_key( prf, hash_alg, pms, cur - pms );
mbedtls_platform_zeroize( pms, sizeof( pms ) );
return( status );
}
Add TLS 1.2 PSK master secret generation
2019-06-17 07:44:03 +00:00
static psa_status_t psa_tls12_prf_psk_to_ms_input(
psa_tls12_prf_key_derivation_t *prf,
psa_algorithm_t hash_alg,
psa_key_derivation_step_t step,
const uint8_t *data,
size_t data_length )
{
if( step == PSA_KEY_DERIVATION_INPUT_SECRET )
Improve style
2019-06-28 12:35:36 +00:00
{
Add TLS 1.2 PSK master secret generation
2019-06-17 07:44:03 +00:00
return( psa_tls12_prf_psk_to_ms_set_key( prf, hash_alg,
data, data_length ) );
Improve style
2019-06-28 12:35:36 +00:00
}
Add TLS 1.2 PSK master secret generation
2019-06-17 07:44:03 +00:00
return( psa_tls12_prf_input( prf, hash_alg, step, data, data_length ) );
}
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
Use the constant PSA_KEY_TYPE_NONE rather than 0 No behavior change, just a readability improvement.
2019-09-24 14:21:10 +00:00
/** Check whether the given key type is acceptable for the given
* input step of a key derivation.
*
* Secret inputs must have the type #PSA_KEY_TYPE_DERIVE.
* Non-secret inputs must have the type #PSA_KEY_TYPE_RAW_DATA.
* Both secret and non-secret inputs can alternatively have the type
* #PSA_KEY_TYPE_NONE, which is never the type of a key object, meaning
* that the input was passed as a buffer rather than via a key object.
*/
Key derivation: allow both keys and direct inputs Allow a direct input as the SECRET input step in a key derivation, in addition to allowing DERIVE keys. This makes it easier for applications to run a key derivation where the "secret" input is obtained from somewhere else. This makes it possible for the "secret" input to be empty (keys cannot be empty), which some protocols do (for example the IV derivation in EAP-TLS). Conversely, allow a RAW_DATA key as the INFO/LABEL/SALT/SEED input to a key derivation, in addition to allowing direct inputs. This doesn't improve security, but removes a step when a personalization parameter is stored in the key store, and allows this personalization parameter to remain opaque. Add test cases that explore step/key-type-and-keyhood combinations.
2019-09-23 16:13:17 +00:00
static int psa_key_derivation_check_input_type(
psa_key_derivation_step_t step,
psa_key_type_t key_type )
{
switch( step )
{
case PSA_KEY_DERIVATION_INPUT_SECRET:
Use the constant PSA_KEY_TYPE_NONE rather than 0 No behavior change, just a readability improvement.
2019-09-24 14:21:10 +00:00
if( key_type == PSA_KEY_TYPE_DERIVE )
return( PSA_SUCCESS );
if( key_type == PSA_KEY_TYPE_NONE )
Key derivation: allow both keys and direct inputs Allow a direct input as the SECRET input step in a key derivation, in addition to allowing DERIVE keys. This makes it easier for applications to run a key derivation where the "secret" input is obtained from somewhere else. This makes it possible for the "secret" input to be empty (keys cannot be empty), which some protocols do (for example the IV derivation in EAP-TLS). Conversely, allow a RAW_DATA key as the INFO/LABEL/SALT/SEED input to a key derivation, in addition to allowing direct inputs. This doesn't improve security, but removes a step when a personalization parameter is stored in the key store, and allows this personalization parameter to remain opaque. Add test cases that explore step/key-type-and-keyhood combinations.
2019-09-23 16:13:17 +00:00
return( PSA_SUCCESS );
break;
case PSA_KEY_DERIVATION_INPUT_LABEL:
case PSA_KEY_DERIVATION_INPUT_SALT:
case PSA_KEY_DERIVATION_INPUT_INFO:
case PSA_KEY_DERIVATION_INPUT_SEED:
Use the constant PSA_KEY_TYPE_NONE rather than 0 No behavior change, just a readability improvement.
2019-09-24 14:21:10 +00:00
if( key_type == PSA_KEY_TYPE_RAW_DATA )
return( PSA_SUCCESS );
if( key_type == PSA_KEY_TYPE_NONE )
Key derivation: allow both keys and direct inputs Allow a direct input as the SECRET input step in a key derivation, in addition to allowing DERIVE keys. This makes it easier for applications to run a key derivation where the "secret" input is obtained from somewhere else. This makes it possible for the "secret" input to be empty (keys cannot be empty), which some protocols do (for example the IV derivation in EAP-TLS). Conversely, allow a RAW_DATA key as the INFO/LABEL/SALT/SEED input to a key derivation, in addition to allowing direct inputs. This doesn't improve security, but removes a step when a personalization parameter is stored in the key store, and allows this personalization parameter to remain opaque. Add test cases that explore step/key-type-and-keyhood combinations.
2019-09-23 16:13:17 +00:00
return( PSA_SUCCESS );
break;
}
return( PSA_ERROR_INVALID_ARGUMENT );
}
Rename psa_key_derivation_input_raw The function dispatches between all the available methods and does not just handle the raw key derivation case like the name suggests.
2019-06-12 14:54:46 +00:00
static psa_status_t psa_key_derivation_input_internal(
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
psa_key_derivation_operation_t *operation,
Improve the rules on key derivation input types Use separate step types for a KDF secret and for the private key in a key agreement. Determine which key type is allowed from the step type, independently of the KDF. Forbid raw inputs for certain steps. They definitely should be forbidden for asymmetric keys, which are structured. Also forbid them for KDF secrets: the secrets are supposed to be keys, even if they're unstructured.
2019-01-08 09:31:27 +00:00
psa_key_derivation_step_t step,
Key derivation: allow both keys and direct inputs Allow a direct input as the SECRET input step in a key derivation, in addition to allowing DERIVE keys. This makes it easier for applications to run a key derivation where the "secret" input is obtained from somewhere else. This makes it possible for the "secret" input to be empty (keys cannot be empty), which some protocols do (for example the IV derivation in EAP-TLS). Conversely, allow a RAW_DATA key as the INFO/LABEL/SALT/SEED input to a key derivation, in addition to allowing direct inputs. This doesn't improve security, but removes a step when a personalization parameter is stored in the key store, and allows this personalization parameter to remain opaque. Add test cases that explore step/key-type-and-keyhood combinations.
2019-09-23 16:13:17 +00:00
psa_key_type_t key_type,
Improve the rules on key derivation input types Use separate step types for a KDF secret and for the private key in a key agreement. Determine which key type is allowed from the step type, independently of the KDF. Forbid raw inputs for certain steps. They definitely should be forbidden for asymmetric keys, which are structured. Also forbid them for KDF secrets: the secrets are supposed to be keys, even if they're unstructured.
2019-01-08 09:31:27 +00:00
const uint8_t *data,
size_t data_length )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
{
Don't jump past a variable declaration This is valid C99 (since the variable in question is not a VLA and is not used) but not accepted by IAR 8.20.
2019-09-23 17:22:55 +00:00
psa_status_t status;
psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg( operation );
status = psa_key_derivation_check_input_type( step, key_type );
Key derivation: allow both keys and direct inputs Allow a direct input as the SECRET input step in a key derivation, in addition to allowing DERIVE keys. This makes it easier for applications to run a key derivation where the "secret" input is obtained from somewhere else. This makes it possible for the "secret" input to be empty (keys cannot be empty), which some protocols do (for example the IV derivation in EAP-TLS). Conversely, allow a RAW_DATA key as the INFO/LABEL/SALT/SEED input to a key derivation, in addition to allowing direct inputs. This doesn't improve security, but removes a step when a personalization parameter is stored in the key store, and allows this personalization parameter to remain opaque. Add test cases that explore step/key-type-and-keyhood combinations.
2019-09-23 16:13:17 +00:00
if( status != PSA_SUCCESS )
goto exit;
Phase 2 support for MBEDTLS_PSA_CRYPTO_CONFIG This phase adds in support for the following features being added to the list of features that can be configured in the include/psa/crypto_config.h header file using the PSA_WANT_ALG_xxx macros: ECDH, HMAC, HKDF, and RSA. These changes include changes to the PSA crypto library to use the appropriate new guards that will allow the feature to be compiled in or out either using new PSA_WANT_ALG_xxx or the previous MBEDTLS_xxx macros. For HKDF and HMAC, most of the PSA library code did not have a specific matching MBEDTLS_xxx macro for that feature, but was instead using the generic dependent MBEDTLS_MD_C macro. The ECDH and RSA features more closely aligned with a direct replacement with a similar macro. The new tests for RSA, HMAC, and HKDF would normally unset additional dependent macros, but when attempting to implement that level of testing it required removal of too many core features like MD_C, PK_C, ECP_C and other low level features. This may point to additional phases of work to complete the transition of these features to the new model. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-30 04:37:36 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
if( PSA_ALG_IS_HKDF( kdf_alg ) )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
status = psa_hkdf_input( &operation->ctx.hkdf,
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
PSA_ALG_HKDF_GET_HASH( kdf_alg ),
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
step, data, data_length );
}
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
else
#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF */
#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF)
if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
{
Add stubs for psa_tls12_prf_input
2019-06-11 14:30:30 +00:00
status = psa_tls12_prf_input( &operation->ctx.tls12_prf,
PSA_ALG_HKDF_GET_HASH( kdf_alg ),
step, data, data_length );
Add TLS 1.2 PSK master secret generation
2019-06-17 07:44:03 +00:00
}
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
else
#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF */
#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
if( PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
Add TLS 1.2 PSK master secret generation
2019-06-17 07:44:03 +00:00
{
status = psa_tls12_prf_psk_to_ms_input( &operation->ctx.tls12_prf,
PSA_ALG_HKDF_GET_HASH( kdf_alg ),
step, data, data_length );
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
}
else
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
/* This can't happen unless the operation object was not initialized */
Fix unused variables in PSA core when no KDF algorithm is present Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-10 16:19:22 +00:00
(void) data;
(void) data_length;
(void) kdf_alg;
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
return( PSA_ERROR_BAD_STATE );
}
Key derivation: allow both keys and direct inputs Allow a direct input as the SECRET input step in a key derivation, in addition to allowing DERIVE keys. This makes it easier for applications to run a key derivation where the "secret" input is obtained from somewhere else. This makes it possible for the "secret" input to be empty (keys cannot be empty), which some protocols do (for example the IV derivation in EAP-TLS). Conversely, allow a RAW_DATA key as the INFO/LABEL/SALT/SEED input to a key derivation, in addition to allowing direct inputs. This doesn't improve security, but removes a step when a personalization parameter is stored in the key store, and allows this personalization parameter to remain opaque. Add test cases that explore step/key-type-and-keyhood combinations.
2019-09-23 16:13:17 +00:00
exit:
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
if( status != PSA_SUCCESS )
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
psa_key_derivation_abort( operation );
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
return( status );
}
Style: enforce 80 column limit
2019-06-14 10:35:55 +00:00
psa_status_t psa_key_derivation_input_bytes(
psa_key_derivation_operation_t *operation,
psa_key_derivation_step_t step,
const uint8_t *data,
size_t data_length )
Improve the rules on key derivation input types Use separate step types for a KDF secret and for the private key in a key agreement. Determine which key type is allowed from the step type, independently of the KDF. Forbid raw inputs for certain steps. They definitely should be forbidden for asymmetric keys, which are structured. Also forbid them for KDF secrets: the secrets are supposed to be keys, even if they're unstructured.
2019-01-08 09:31:27 +00:00
{
Use the constant PSA_KEY_TYPE_NONE rather than 0 No behavior change, just a readability improvement.
2019-09-24 14:21:10 +00:00
return( psa_key_derivation_input_internal( operation, step,
PSA_KEY_TYPE_NONE,
Simplify psa_key_derivation_input_bytes The specific key derivation input functions support a subset of the input options and need to check it anyway. Checking it at the top level is redundant, it brings a very little value and comes with a cost in code size and maintainability.
2019-06-14 10:27:57 +00:00
data, data_length ) );
Improve the rules on key derivation input types Use separate step types for a KDF secret and for the private key in a key agreement. Determine which key type is allowed from the step type, independently of the KDF. Forbid raw inputs for certain steps. They definitely should be forbidden for asymmetric keys, which are structured. Also forbid them for KDF secrets: the secrets are supposed to be keys, even if they're unstructured.
2019-01-08 09:31:27 +00:00
}
Style: enforce 80 column limit
2019-06-14 10:35:55 +00:00
psa_status_t psa_key_derivation_input_key(
psa_key_derivation_operation_t *operation,
psa_key_derivation_step_t step,
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
mbedtls_svc_key_id_t key )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
{
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
psa_key_slot_t *slot;
Key derivation: forbid output_key without input_key If none of the inputs to a key derivation is a PSA_KEY_DERIVATION_INPUT_SECRET passed with psa_key_derivation_input_key(), forbid psa_key_derivation_output_key(). It usually doesn't make sense to derive a key object if the secret isn't itself a proper key.
2019-09-24 16:21:06 +00:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
status = psa_get_and_lock_transparent_key_slot_with_policy(
key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg );
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
if( status != PSA_SUCCESS )
Consistently abort key derivation operations on input error
2019-09-23 16:17:40 +00:00
{
psa_key_derivation_abort( operation );
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
return( status );
Consistently abort key derivation operations on input error
2019-09-23 16:17:40 +00:00
}
Key derivation: forbid output_key without input_key If none of the inputs to a key derivation is a PSA_KEY_DERIVATION_INPUT_SECRET passed with psa_key_derivation_input_key(), forbid psa_key_derivation_output_key(). It usually doesn't make sense to derive a key object if the secret isn't itself a proper key.
2019-09-24 16:21:06 +00:00
/* Passing a key object as a SECRET input unlocks the permission
* to output to a key object. */
if( step == PSA_KEY_DERIVATION_INPUT_SECRET )
operation->can_output_key = 1;
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
status = psa_key_derivation_input_internal( operation,
step, slot->attr.type,
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:52:23 +00:00
slot->key.data,
slot->key.bytes );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
unlock_status = psa_unlock_key_slot( slot );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
}
Add framework for simple key derivation New key type PSA_KEY_TYPE_DERIVE. New usage flag PSA_KEY_USAGE_DERIVE. New function psa_key_derivation. No key derivation algorithm is implemented yet. The code may not compile with -Wunused. Write some unit test code for psa_key_derivation. Most of it cannot be used yet due to the lack of a key derivation algorithm.
2018-07-12 15:17:20 +00:00
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 10:01:02 +00:00
/****************************************************************/
/* Key agreement */
/****************************************************************/
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 16:50:04 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
Implement ECDH
2018-09-18 10:11:27 +00:00
static psa_status_t psa_key_agreement_ecdh( const uint8_t *peer_key,
size_t peer_key_length,
const mbedtls_ecp_keypair *our_key,
uint8_t *shared_secret,
size_t shared_secret_size,
size_t *shared_secret_length )
{
Initialize key pointer in ecdh to NULL Since it is being dereferenced by free on exit it should be inited to NULL. Also added a small test that would trigger the issue. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-05 14:31:39 +00:00
mbedtls_ecp_keypair *their_key = NULL;
Implement ECDH
2018-09-18 10:11:27 +00:00
mbedtls_ecdh_context ecdh;
psa: Use psa_status_t in psa_key_agreement_ecdh() Use the PSA-native status type in psa_key_agreement_ecdh() in preparation for us calling PSA functions (and not just Mbed TLS functions) and still being able to return a psa_status_t (without having to translate it to a Mbed TLS error and then back again).
2019-01-10 19:38:51 +00:00
psa_status_t status;
Rework mbedlts group id to PSA curve conversion Don't rely on the PSA curve identifier determining the key size, in preparation for removing that.
2019-12-12 15:58:00 +00:00
size_t bits = 0;
Rename ECC Family Macros According to PSA Spec Rename PSA_ECC_CURVE_xxx to PSA_ECC_FAMILY_xxx, also rename PSA_KEY_TYPE_GET_CURVE to PSA_KEY_TYPE_ECC_GET_FAMILY and rename psa_ecc_curve_t to psa_ecc_family_t. Old defines are provided in include/crypto_compat.h for backward compatibility. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2020-06-02 16:19:28 +00:00
psa_ecc_family_t curve = mbedtls_ecc_group_to_psa( our_key->grp.id, &bits );
Implement ECDH
2018-09-18 10:11:27 +00:00
mbedtls_ecdh_init( &ecdh );
psa: Rename psa_load_rsa/ecp_representation Rename psa_load_rsa/ecp_representation to mbedtls_psa_rsa/ecp_load_representation before to move them in their RSA/ECP specific PSA crypto C modules. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 13:58:33 +00:00
status = mbedtls_psa_ecp_load_representation(
PSA_KEY_TYPE_ECC_PUBLIC_KEY(curve),
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 14:44:45 +00:00
bits,
psa: Rename psa_load_rsa/ecp_representation Rename psa_load_rsa/ecp_representation to mbedtls_psa_rsa/ecp_load_representation before to move them in their RSA/ECP specific PSA crypto C modules. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 13:58:33 +00:00
peer_key,
peer_key_length,
&their_key );
psa: Use psa_status_t in psa_key_agreement_ecdh() Use the PSA-native status type in psa_key_agreement_ecdh() in preparation for us calling PSA functions (and not just Mbed TLS functions) and still being able to return a psa_status_t (without having to translate it to a Mbed TLS error and then back again).
2019-01-10 19:38:51 +00:00
if( status != PSA_SUCCESS )
ECDH: check that the keys are on the same curve In psa_key_agreement_ecdh, check that the public key is on the same curve as the private key. The underlying mbedtls API doesn't check. If the curves don't match, psa_key_agreement_ecdh is practically guaranteed to return INVALID_ARGUMENT anyway, because way the code is written, the public point is interpreted on the curve of the private point, and it is rejected because the point is not on the curve. This is why the test case "PSA key agreement setup: ECDH, raw: public key on different curve" passed even before adding this check.
2018-11-14 19:51:23 +00:00
goto exit;
psa: Use psa_status_t in psa_key_agreement_ecdh() Use the PSA-native status type in psa_key_agreement_ecdh() in preparation for us calling PSA functions (and not just Mbed TLS functions) and still being able to return a psa_status_t (without having to translate it to a Mbed TLS error and then back again).
2019-01-10 19:38:51 +00:00
status = mbedtls_to_psa_error(
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:39 +00:00
mbedtls_ecdh_get_params( &ecdh, their_key, MBEDTLS_ECDH_THEIRS ) );
psa: Use psa_status_t in psa_key_agreement_ecdh() Use the PSA-native status type in psa_key_agreement_ecdh() in preparation for us calling PSA functions (and not just Mbed TLS functions) and still being able to return a psa_status_t (without having to translate it to a Mbed TLS error and then back again).
2019-01-10 19:38:51 +00:00
if( status != PSA_SUCCESS )
Implement ECDH
2018-09-18 10:11:27 +00:00
goto exit;
psa: Use psa_status_t in psa_key_agreement_ecdh() Use the PSA-native status type in psa_key_agreement_ecdh() in preparation for us calling PSA functions (and not just Mbed TLS functions) and still being able to return a psa_status_t (without having to translate it to a Mbed TLS error and then back again).
2019-01-10 19:38:51 +00:00
status = mbedtls_to_psa_error(
mbedtls_ecdh_get_params( &ecdh, our_key, MBEDTLS_ECDH_OURS ) );
if( status != PSA_SUCCESS )
Implement ECDH
2018-09-18 10:11:27 +00:00
goto exit;
psa: Use psa_status_t in psa_key_agreement_ecdh() Use the PSA-native status type in psa_key_agreement_ecdh() in preparation for us calling PSA functions (and not just Mbed TLS functions) and still being able to return a psa_status_t (without having to translate it to a Mbed TLS error and then back again).
2019-01-10 19:38:51 +00:00
status = mbedtls_to_psa_error(
mbedtls_ecdh_calc_secret( &ecdh,
shared_secret_length,
shared_secret, shared_secret_size,
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 16:02:26 +00:00
mbedtls_psa_get_random,
Replace mbedtls_psa_random_state( ... ) by MBEDTLS_PSA_RANDOM_STATE Hide the obtention of the pointer to the RNG state behind a macro. To make it possible to use this macro in a module other than psa_crypto.c, which will happen in the future, make sure that the definition of the macro does not reference internal variables of psa_crypto.c. For this purpose, in the internal-DRBG case, export a symbol containing the address of the DRBG state. When the RNG state is a pointer a DRBG state, just keep this pointer in a variable: there's no need to store a pointer to a larger structure. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-14 13:54:06 +00:00
MBEDTLS_PSA_RANDOM_STATE ) );
Rework mbedlts group id to PSA curve conversion Don't rely on the PSA curve identifier determining the key size, in preparation for removing that.
2019-12-12 15:58:00 +00:00
if( status != PSA_SUCCESS )
goto exit;
if( PSA_BITS_TO_BYTES( bits ) != *shared_secret_length )
status = PSA_ERROR_CORRUPTION_DETECTED;
Implement ECDH
2018-09-18 10:11:27 +00:00
exit:
psa_key_agreement_ecdh: zeroize output on failure If psa_key_agreement_ecdh fails, there may be output that leaks sensitive information in the output buffer. Zeroize it. If this is due to an underlying failure in the ECDH implementation, it is currently not an issue since both the traditional Mbed TLS/Crypto implementation and Everest only write to the output buffer once every intermediate step has succeeded, but zeroizing is more robust. If this is because the recently added key size check fails, a leak could be a serious issue.
2019-12-20 13:09:55 +00:00
if( status != PSA_SUCCESS )
mbedtls_platform_zeroize( shared_secret, shared_secret_size );
Implement ECDH
2018-09-18 10:11:27 +00:00
mbedtls_ecdh_free( &ecdh );
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:39 +00:00
mbedtls_ecp_keypair_free( their_key );
Cleanup * No null-check before calling free * Close memory leak * No need for double check of privkey validity Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-30 09:36:45 +00:00
mbedtls_free( their_key );
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:39 +00:00
psa: Use psa_status_t in psa_key_agreement_ecdh() Use the PSA-native status type in psa_key_agreement_ecdh() in preparation for us calling PSA functions (and not just Mbed TLS functions) and still being able to return a psa_status_t (without having to translate it to a Mbed TLS error and then back again).
2019-01-10 19:38:51 +00:00
return( status );
Implement ECDH
2018-09-18 10:11:27 +00:00
}
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 16:50:04 +00:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_ECDH */
Implement ECDH
2018-09-18 10:11:27 +00:00
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 10:01:02 +00:00
#define PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE MBEDTLS_ECP_MAX_BYTES
Implement psa_key_agreement_raw_shared_secret Refactor: split psa_key_agreement_raw_internal out of psa_key_agreement_internal, and call it from psa_key_agreement_raw_shared_secret as well.
2019-04-11 19:23:21 +00:00
static psa_status_t psa_key_agreement_raw_internal( psa_algorithm_t alg,
psa_key_slot_t *private_key,
const uint8_t *peer_key,
size_t peer_key_length,
uint8_t *shared_secret,
size_t shared_secret_size,
size_t *shared_secret_length )
{
switch( alg )
{
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 16:50:04 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
Implement psa_key_agreement_raw_shared_secret Refactor: split psa_key_agreement_raw_internal out of psa_key_agreement_internal, and call it from psa_key_agreement_raw_shared_secret as well.
2019-04-11 19:23:21 +00:00
case PSA_ALG_ECDH:
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( ! PSA_KEY_TYPE_IS_ECC_KEY_PAIR( private_key->attr.type ) )
Implement psa_key_agreement_raw_shared_secret Refactor: split psa_key_agreement_raw_internal out of psa_key_agreement_internal, and call it from psa_key_agreement_raw_shared_secret as well.
2019-04-11 19:23:21 +00:00
return( PSA_ERROR_INVALID_ARGUMENT );
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:39 +00:00
mbedtls_ecp_keypair *ecp = NULL;
psa: Rename psa_load_rsa/ecp_representation Rename psa_load_rsa/ecp_representation to mbedtls_psa_rsa/ecp_load_representation before to move them in their RSA/ECP specific PSA crypto C modules. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 13:58:33 +00:00
psa_status_t status = mbedtls_psa_ecp_load_representation(
private_key->attr.type,
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 14:44:45 +00:00
private_key->attr.bits,
psa: Rename psa_load_rsa/ecp_representation Rename psa_load_rsa/ecp_representation to mbedtls_psa_rsa/ecp_load_representation before to move them in their RSA/ECP specific PSA crypto C modules. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 13:58:33 +00:00
private_key->key.data,
private_key->key.bytes,
&ecp );
Remove ECP internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 21:09:52 +00:00
if( status != PSA_SUCCESS )
Style fixes * return is treated as a function call * space between opening and closing parentheses * remove whiteline between assignment and checking of same variable Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-05 13:43:42 +00:00
return( status );
Remove ECP internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 21:09:52 +00:00
status = psa_key_agreement_ecdh( peer_key, peer_key_length,
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:39 +00:00
ecp,
Remove ECP internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 21:09:52 +00:00
shared_secret, shared_secret_size,
shared_secret_length );
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 12:30:39 +00:00
mbedtls_ecp_keypair_free( ecp );
mbedtls_free( ecp );
Style fixes * return is treated as a function call * space between opening and closing parentheses * remove whiteline between assignment and checking of same variable Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-05 13:43:42 +00:00
return( status );
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 16:50:04 +00:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_ECDH */
Implement psa_key_agreement_raw_shared_secret Refactor: split psa_key_agreement_raw_internal out of psa_key_agreement_internal, and call it from psa_key_agreement_raw_shared_secret as well.
2019-04-11 19:23:21 +00:00
default:
(void) private_key;
(void) peer_key;
(void) peer_key_length;
(void) shared_secret;
(void) shared_secret_size;
(void) shared_secret_length;
return( PSA_ERROR_NOT_SUPPORTED );
}
}
Rename generator functions to psa_key_derivation_xxx Generators are mostly about key derivation (currently: only about key derivation). "Generator" is not a commonly used term in cryptography. So favor "derivation" as terminology. Call a generator a key derivation operation structure, since it behaves like other multipart operation structures. Furthermore, the function names are not fully consistent. In this commit, I rename the functions to consistently have the prefix "psa_key_derivation_". I used the following command: perl -i -pe '%t = ( psa_crypto_generator_t => "psa_key_derivation_operation_t", psa_crypto_generator_init => "psa_key_derivation_init", psa_key_derivation_setup => "psa_key_derivation_setup", psa_key_derivation_input_key => "psa_key_derivation_input_key", psa_key_derivation_input_bytes => "psa_key_derivation_input_bytes", psa_key_agreement => "psa_key_derivation_key_agreement", psa_set_generator_capacity => "psa_key_derivation_set_capacity", psa_get_generator_capacity => "psa_key_derivation_get_capacity", psa_generator_read => "psa_key_derivation_output_bytes", psa_generate_derived_key => "psa_key_derivation_output_key", psa_generator_abort => "psa_key_derivation_abort", PSA_CRYPTO_GENERATOR_INIT => "PSA_KEY_DERIVATION_OPERATION_INIT", PSA_GENERATOR_UNBRIDLED_CAPACITY => "PSA_KEY_DERIVATION_UNLIMITED_CAPACITY", ); s/\b(@{[join("|", keys %t)]})\b/$t{$1}/ge' $(git ls-files)
2019-05-16 13:28:51 +00:00
/* Note that if this function fails, you must call psa_key_derivation_abort()
Add missing cleanup on failure in psa_key_agreement If psa_key_derivation_internal() fails, it's up to the caller to clean up. Do this, and add a note at the top of psa_key_derivation_internal() and its auxiliary functions. There is no non-regression test because at the moment the only way to trigger an error is a borderline low-memory condition and we don't have the means to trigger this.
2018-11-16 15:05:06 +00:00
* to potentially free embedded data structures and wipe confidential data.
*/
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
static psa_status_t psa_key_agreement_internal( psa_key_derivation_operation_t *operation,
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
psa_key_derivation_step_t step,
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 16:12:32 +00:00
psa_key_slot_t *private_key,
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 10:01:02 +00:00
const uint8_t *peer_key,
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
size_t peer_key_length )
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 10:01:02 +00:00
{
psa_status_t status;
uint8_t shared_secret[PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE];
size_t shared_secret_length = 0;
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
psa_algorithm_t ka_alg = PSA_ALG_KEY_AGREEMENT_GET_BASE( operation->alg );
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 10:01:02 +00:00
/* Step 1: run the secret agreement algorithm to generate the shared
* secret. */
Implement psa_key_agreement_raw_shared_secret Refactor: split psa_key_agreement_raw_internal out of psa_key_agreement_internal, and call it from psa_key_agreement_raw_shared_secret as well.
2019-04-11 19:23:21 +00:00
status = psa_key_agreement_raw_internal( ka_alg,
private_key,
peer_key, peer_key_length,
Implement ECDH
2018-09-18 10:11:27 +00:00
shared_secret,
sizeof( shared_secret ),
&shared_secret_length );
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 10:01:02 +00:00
if( status != PSA_SUCCESS )
goto exit;
/* Step 2: set up the key derivation to generate key material from
Key derivation: allow both keys and direct inputs Allow a direct input as the SECRET input step in a key derivation, in addition to allowing DERIVE keys. This makes it easier for applications to run a key derivation where the "secret" input is obtained from somewhere else. This makes it possible for the "secret" input to be empty (keys cannot be empty), which some protocols do (for example the IV derivation in EAP-TLS). Conversely, allow a RAW_DATA key as the INFO/LABEL/SALT/SEED input to a key derivation, in addition to allowing direct inputs. This doesn't improve security, but removes a step when a personalization parameter is stored in the key store, and allows this personalization parameter to remain opaque. Add test cases that explore step/key-type-and-keyhood combinations.
2019-09-23 16:13:17 +00:00
* the shared secret. A shared secret is permitted wherever a key
* of type DERIVE is permitted. */
Rename psa_key_derivation_input_raw The function dispatches between all the available methods and does not just handle the raw key derivation case like the name suggests.
2019-06-12 14:54:46 +00:00
status = psa_key_derivation_input_internal( operation, step,
Key derivation: allow both keys and direct inputs Allow a direct input as the SECRET input step in a key derivation, in addition to allowing DERIVE keys. This makes it easier for applications to run a key derivation where the "secret" input is obtained from somewhere else. This makes it possible for the "secret" input to be empty (keys cannot be empty), which some protocols do (for example the IV derivation in EAP-TLS). Conversely, allow a RAW_DATA key as the INFO/LABEL/SALT/SEED input to a key derivation, in addition to allowing direct inputs. This doesn't improve security, but removes a step when a personalization parameter is stored in the key store, and allows this personalization parameter to remain opaque. Add test cases that explore step/key-type-and-keyhood combinations.
2019-09-23 16:13:17 +00:00
PSA_KEY_TYPE_DERIVE,
Rename psa_key_derivation_input_raw The function dispatches between all the available methods and does not just handle the raw key derivation case like the name suggests.
2019-06-12 14:54:46 +00:00
shared_secret,
shared_secret_length );
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 10:01:02 +00:00
exit:
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 17:14:53 +00:00
mbedtls_platform_zeroize( shared_secret, shared_secret_length );
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 10:01:02 +00:00
return( status );
}
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
psa_status_t psa_key_derivation_key_agreement( psa_key_derivation_operation_t *operation,
Wrap and reindent some lines After renaming several identifiers, re-wrap and re-indent some lines to make the code prettier.
2019-05-16 15:53:40 +00:00
psa_key_derivation_step_t step,
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
mbedtls_svc_key_id_t private_key,
Wrap and reindent some lines After renaming several identifiers, re-wrap and re-indent some lines to make the code prettier.
2019-05-16 15:53:40 +00:00
const uint8_t *peer_key,
size_t peer_key_length )
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 10:01:02 +00:00
{
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 16:12:32 +00:00
psa_key_slot_t *slot;
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
if( ! PSA_ALG_IS_KEY_AGREEMENT( operation->alg ) )
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 10:01:02 +00:00
return( PSA_ERROR_INVALID_ARGUMENT );
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
status = psa_get_and_lock_transparent_key_slot_with_policy(
private_key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg );
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 10:01:02 +00:00
if( status != PSA_SUCCESS )
return( status );
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
status = psa_key_agreement_internal( operation, step,
Add missing cleanup on failure in psa_key_agreement If psa_key_derivation_internal() fails, it's up to the caller to clean up. Do this, and add a note at the top of psa_key_derivation_internal() and its auxiliary functions. There is no non-regression test because at the moment the only way to trigger an error is a borderline low-memory condition and we don't have the means to trigger this.
2018-11-16 15:05:06 +00:00
slot,
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
peer_key, peer_key_length );
Add missing cleanup on failure in psa_key_agreement If psa_key_derivation_internal() fails, it's up to the caller to clean up. Do this, and add a note at the top of psa_key_derivation_internal() and its auxiliary functions. There is no non-regression test because at the moment the only way to trigger an error is a borderline low-memory condition and we don't have the means to trigger this.
2018-11-16 15:05:06 +00:00
if( status != PSA_SUCCESS )
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
psa_key_derivation_abort( operation );
Apply review feedback Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-15 15:07:12 +00:00
else
{
/* If a private key has been added as SECRET, we allow the derived
* key material to be used as a key in PSA Crypto. */
if( step == PSA_KEY_DERIVATION_INPUT_SECRET )
operation->can_output_key = 1;
}
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
unlock_status = psa_unlock_key_slot( slot );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
return( ( status == PSA_SUCCESS ) ? unlock_status : status );
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 10:01:02 +00:00
}
Shorten the name of psa_key_agreement_raw_shared_secret There is less of a risk of confusion with the KA+KDF function now.
2019-05-16 16:00:41 +00:00
psa_status_t psa_raw_key_agreement( psa_algorithm_t alg,
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
mbedtls_svc_key_id_t private_key,
Shorten the name of psa_key_agreement_raw_shared_secret There is less of a risk of confusion with the KA+KDF function now.
2019-05-16 16:00:41 +00:00
const uint8_t *peer_key,
size_t peer_key_length,
uint8_t *output,
size_t output_size,
size_t *output_length )
Implement psa_key_agreement_raw_shared_secret Refactor: split psa_key_agreement_raw_internal out of psa_key_agreement_internal, and call it from psa_key_agreement_raw_shared_secret as well.
2019-04-11 19:23:21 +00:00
{
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa_key_slot_t *slot = NULL;
Implement psa_key_agreement_raw_shared_secret Refactor: split psa_key_agreement_raw_internal out of psa_key_agreement_internal, and call it from psa_key_agreement_raw_shared_secret as well.
2019-04-11 19:23:21 +00:00
if( ! PSA_ALG_IS_KEY_AGREEMENT( alg ) )
{
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
}
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
status = psa_get_and_lock_transparent_key_slot_with_policy(
private_key, &slot, PSA_KEY_USAGE_DERIVE, alg );
Implement psa_key_agreement_raw_shared_secret Refactor: split psa_key_agreement_raw_internal out of psa_key_agreement_internal, and call it from psa_key_agreement_raw_shared_secret as well.
2019-04-11 19:23:21 +00:00
if( status != PSA_SUCCESS )
goto exit;
status = psa_key_agreement_raw_internal( alg, slot,
peer_key, peer_key_length,
output, output_size,
output_length );
exit:
if( status != PSA_SUCCESS )
{
/* If an error happens and is not handled properly, the output
* may be used as a key to protect sensitive data. Arrange for such
* a key to be random, which is likely to result in decryption or
* verification errors. This is better than filling the buffer with
* some constant data such as zeros, which would result in the data
* being protected with a reproducible, easily knowable key.
*/
psa_generate_random( output, output_size );
*output_length = output_size;
}
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
unlock_status = psa_unlock_key_slot( slot );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 15:35:34 +00:00
return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Implement psa_key_agreement_raw_shared_secret Refactor: split psa_key_agreement_raw_internal out of psa_key_agreement_internal, and call it from psa_key_agreement_raw_shared_secret as well.
2019-04-11 19:23:21 +00:00
}
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 10:01:02 +00:00
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 16:02:26 +00:00
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
/****************************************************************/
/* Random generation */
Implement psa_generate_random
2018-06-19 20:00:52 +00:00
/****************************************************************/
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 16:02:26 +00:00
/** Initialize the PSA random generator.
*/
static void mbedtls_psa_random_init( mbedtls_psa_random_context_t *rng )
{
Implement MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG Implement support for MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG. For test purposes, write an implementation that uses libc rand(). Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 17:47:18 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
memset( rng, 0, sizeof( *rng ) );
#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 16:02:26 +00:00
/* Set default configuration if
* mbedtls_psa_crypto_configure_entropy_sources() hasn't been called. */
if( rng->entropy_init == NULL )
rng->entropy_init = mbedtls_entropy_init;
if( rng->entropy_free == NULL )
rng->entropy_free = mbedtls_entropy_free;
rng->entropy_init( &rng->entropy );
#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \
defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES)
/* The PSA entropy injection feature depends on using NV seed as an entropy
* source. Add NV seed as an entropy source for PSA entropy injection. */
mbedtls_entropy_add_source( &rng->entropy,
mbedtls_nv_seed_poll, NULL,
MBEDTLS_ENTROPY_BLOCK_SIZE,
MBEDTLS_ENTROPY_SOURCE_STRONG );
#endif
Replace mbedtls_psa_random_state( ... ) by MBEDTLS_PSA_RANDOM_STATE Hide the obtention of the pointer to the RNG state behind a macro. To make it possible to use this macro in a module other than psa_crypto.c, which will happen in the future, make sure that the definition of the macro does not reference internal variables of psa_crypto.c. For this purpose, in the internal-DRBG case, export a symbol containing the address of the DRBG state. When the RNG state is a pointer a DRBG state, just keep this pointer in a variable: there's no need to store a pointer to a larger structure. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-14 13:54:06 +00:00
mbedtls_psa_drbg_init( MBEDTLS_PSA_RANDOM_STATE );
Implement MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG Implement support for MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG. For test purposes, write an implementation that uses libc rand(). Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 17:47:18 +00:00
#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 16:02:26 +00:00
}
/** Deinitialize the PSA random generator.
*/
static void mbedtls_psa_random_free( mbedtls_psa_random_context_t *rng )
{
Implement MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG Implement support for MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG. For test purposes, write an implementation that uses libc rand(). Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 17:47:18 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
memset( rng, 0, sizeof( *rng ) );
#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Replace mbedtls_psa_random_state( ... ) by MBEDTLS_PSA_RANDOM_STATE Hide the obtention of the pointer to the RNG state behind a macro. To make it possible to use this macro in a module other than psa_crypto.c, which will happen in the future, make sure that the definition of the macro does not reference internal variables of psa_crypto.c. For this purpose, in the internal-DRBG case, export a symbol containing the address of the DRBG state. When the RNG state is a pointer a DRBG state, just keep this pointer in a variable: there's no need to store a pointer to a larger structure. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-14 13:54:06 +00:00
mbedtls_psa_drbg_free( MBEDTLS_PSA_RANDOM_STATE );
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 16:02:26 +00:00
rng->entropy_free( &rng->entropy );
Implement MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG Implement support for MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG. For test purposes, write an implementation that uses libc rand(). Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 17:47:18 +00:00
#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 16:02:26 +00:00
}
/** Seed the PSA random generator.
*/
static psa_status_t mbedtls_psa_random_seed( mbedtls_psa_random_context_t *rng )
{
Implement MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG Implement support for MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG. For test purposes, write an implementation that uses libc rand(). Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 17:47:18 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
/* Do nothing: the external RNG seeds itself. */
(void) rng;
return( PSA_SUCCESS );
#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 16:02:26 +00:00
const unsigned char drbg_seed[] = "PSA";
Replace mbedtls_psa_random_state( ... ) by MBEDTLS_PSA_RANDOM_STATE Hide the obtention of the pointer to the RNG state behind a macro. To make it possible to use this macro in a module other than psa_crypto.c, which will happen in the future, make sure that the definition of the macro does not reference internal variables of psa_crypto.c. For this purpose, in the internal-DRBG case, export a symbol containing the address of the DRBG state. When the RNG state is a pointer a DRBG state, just keep this pointer in a variable: there's no need to store a pointer to a larger structure. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-14 13:54:06 +00:00
int ret = mbedtls_psa_drbg_seed( &rng->entropy,
drbg_seed, sizeof( drbg_seed ) - 1 );
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 16:02:26 +00:00
return mbedtls_to_psa_error( ret );
Implement MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG Implement support for MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG. For test purposes, write an implementation that uses libc rand(). Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 17:47:18 +00:00
#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 16:02:26 +00:00
}
Implement psa_generate_random
2018-06-19 20:00:52 +00:00
psa_status_t psa_generate_random( uint8_t *output,
size_t output_size )
{
Ensure the module is initialized in psa_generate_random
2018-09-06 13:24:41 +00:00
GUARD_MODULE_INITIALIZED;
Implement MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG Implement support for MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG. For test purposes, write an implementation that uses libc rand(). Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 17:47:18 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
size_t output_length = 0;
psa_status_t status = mbedtls_psa_external_get_random( &global_data.rng,
output, output_size,
&output_length );
if( status != PSA_SUCCESS )
return( status );
/* Breaking up a request into smaller chunks is currently not supported
* for the extrernal RNG interface. */
if( output_length != output_size )
return( PSA_ERROR_INSUFFICIENT_ENTROPY );
return( PSA_SUCCESS );
#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Simplify the chunk loop in psa_generate_random Make the code slightly more readable and slightly smaller. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-04 20:01:07 +00:00
while( output_size > 0 )
Fix psa_generate_random for >1024 bytes mbedtls_ctr_drbg_random can only return up to MBEDTLS_CTR_DRBG_MAX_REQUEST (normally 1024) bytes at a time. So if more than that is requested, call mbedtls_ctr_drbg_random in a loop.
2019-08-07 11:49:00 +00:00
{
Simplify the chunk loop in psa_generate_random Make the code slightly more readable and slightly smaller. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-04 20:01:07 +00:00
size_t request_size =
( output_size > MBEDTLS_PSA_RANDOM_MAX_REQUEST ?
MBEDTLS_PSA_RANDOM_MAX_REQUEST :
output_size );
Fix the error detection in psa_generate_random If a call to mbedtls_psa_get_random other than the last one failed, this went undetected. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-05 13:10:59 +00:00
int ret = mbedtls_psa_get_random( MBEDTLS_PSA_RANDOM_STATE,
output, request_size );
Fix psa_generate_random for >1024 bytes mbedtls_ctr_drbg_random can only return up to MBEDTLS_CTR_DRBG_MAX_REQUEST (normally 1024) bytes at a time. So if more than that is requested, call mbedtls_ctr_drbg_random in a loop.
2019-08-07 11:49:00 +00:00
if( ret != 0 )
return( mbedtls_to_psa_error( ret ) );
Simplify the chunk loop in psa_generate_random Make the code slightly more readable and slightly smaller. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-04 20:01:07 +00:00
output_size -= request_size;
output += request_size;
Fix psa_generate_random for >1024 bytes mbedtls_ctr_drbg_random can only return up to MBEDTLS_CTR_DRBG_MAX_REQUEST (normally 1024) bytes at a time. So if more than that is requested, call mbedtls_ctr_drbg_random in a loop.
2019-08-07 11:49:00 +00:00
}
Fix the error detection in psa_generate_random If a call to mbedtls_psa_get_random other than the last one failed, this went undetected. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-05 13:10:59 +00:00
return( PSA_SUCCESS );
Implement MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG Implement support for MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG. For test purposes, write an implementation that uses libc rand(). Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 17:47:18 +00:00
#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Implement psa_generate_random
2018-06-19 20:00:52 +00:00
}
Fix psa_generate_random for >1024 bytes mbedtls_ctr_drbg_random can only return up to MBEDTLS_CTR_DRBG_MAX_REQUEST (normally 1024) bytes at a time. So if more than that is requested, call mbedtls_ctr_drbg_random in a loop.
2019-08-07 11:49:00 +00:00
Make mbedtls_psa_get_random more usable outside psa_crypto.c In the external RNG case, don't make mbedtls_psa_get_random() a static inline function: this would likely result in identical instances of this function in every module that uses it. Instead, make it a single function with external linkage. In the non-external case, instead of a trivial wrapper function, make mbedtls_psa_get_random a constant pointer to whichever DRBG function is being used. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-14 14:33:44 +00:00
/* Wrapper function allowing the classic API to use the PSA RNG.
Explain the design of mbedtls_psa_get_random better Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-05 15:03:55 +00:00
*
* `mbedtls_psa_get_random(MBEDTLS_PSA_RANDOM_STATE, ...)` calls
* `psa_generate_random(...)`. The state parameter is ignored since the
* PSA API doesn't support passing an explicit state.
*
* In the non-external case, psa_generate_random() calls an
* `mbedtls_xxx_drbg_random` function which has exactly the same signature
* and semantics as mbedtls_psa_get_random(). As an optimization,
* instead of doing this back-and-forth between the PSA API and the
* classic API, psa_crypto_random_impl.h defines `mbedtls_psa_get_random`
* as a constant function pointer to `mbedtls_xxx_drbg_random`.
Make mbedtls_psa_get_random more usable outside psa_crypto.c In the external RNG case, don't make mbedtls_psa_get_random() a static inline function: this would likely result in identical instances of this function in every module that uses it. Instead, make it a single function with external linkage. In the non-external case, instead of a trivial wrapper function, make mbedtls_psa_get_random a constant pointer to whichever DRBG function is being used. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-14 14:33:44 +00:00
*/
#if defined (MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
int mbedtls_psa_get_random( void *p_rng,
unsigned char *output,
size_t output_size )
{
Explain the design of mbedtls_psa_get_random better Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-05 15:03:55 +00:00
/* This function takes a pointer to the RNG state because that's what
* classic mbedtls functions using an RNG expect. The PSA RNG manages
* its own state internally and doesn't let the caller access that state.
* So we just ignore the state parameter, and in practice we'll pass
* NULL. */
Make mbedtls_psa_get_random more usable outside psa_crypto.c In the external RNG case, don't make mbedtls_psa_get_random() a static inline function: this would likely result in identical instances of this function in every module that uses it. Instead, make it a single function with external linkage. In the non-external case, instead of a trivial wrapper function, make mbedtls_psa_get_random a constant pointer to whichever DRBG function is being used. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-14 14:33:44 +00:00
(void) p_rng;
psa_status_t status = psa_generate_random( output, output_size );
if( status == PSA_SUCCESS )
return( 0 );
else
return( MBEDTLS_ERR_ENTROPY_SOURCE_FAILED );
Implement psa_generate_random
2018-06-19 20:00:52 +00:00
}
Make mbedtls_psa_get_random more usable outside psa_crypto.c In the external RNG case, don't make mbedtls_psa_get_random() a static inline function: this would likely result in identical instances of this function in every module that uses it. Instead, make it a single function with external linkage. In the non-external case, instead of a trivial wrapper function, make mbedtls_psa_get_random a constant pointer to whichever DRBG function is being used. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-14 14:33:44 +00:00
#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Implement psa_generate_random
2018-06-19 20:00:52 +00:00
Gate entropy injection through a dedicated configuration option Entropy injection has specific testing requirements. Therefore it should depend on a specific option.
2019-02-25 10:04:06 +00:00
#if defined(MBEDTLS_PSA_INJECT_ENTROPY)
#include "mbedtls/entropy_poll.h"
Favor stdint.h types in implementation-specific API
2019-07-15 09:06:15 +00:00
psa_status_t mbedtls_psa_inject_entropy( const uint8_t *seed,
Add entropy injection function to psa cripto APIs
2018-11-19 09:53:02 +00:00
size_t seed_size )
{
if( global_data.initialized )
return( PSA_ERROR_NOT_PERMITTED );
Add Tests for psa crypto entropy incjection Adjust code to handle and work with MBEDTLS_ENTROPY_BLOCK_SIZE definition option
2018-11-19 09:53:55 +00:00
if( ( ( seed_size < MBEDTLS_ENTROPY_MIN_PLATFORM ) ||
( seed_size < MBEDTLS_ENTROPY_BLOCK_SIZE ) ) ||
( seed_size > MBEDTLS_ENTROPY_MAX_SEED_SIZE ) )
return( PSA_ERROR_INVALID_ARGUMENT );
Gate entropy injection through a dedicated configuration option Entropy injection has specific testing requirements. Therefore it should depend on a specific option.
2019-02-25 10:04:06 +00:00
return( mbedtls_psa_storage_inject_entropy( seed, seed_size ) );
Add entropy injection function to psa cripto APIs
2018-11-19 09:53:02 +00:00
}
Gate entropy injection through a dedicated configuration option Entropy injection has specific testing requirements. Therefore it should depend on a specific option.
2019-02-25 10:04:06 +00:00
#endif /* MBEDTLS_PSA_INJECT_ENTROPY */
Add entropy injection function to psa cripto APIs
2018-11-19 09:53:02 +00:00
psa: key generation: Use PSA_EXPORT_KEY_OUTPUT_SIZE Use PSA_EXPORT_KEY_OUTPUT_SIZE macro to compute the size of the buffer to contain the generated key instead of computing it alongside the key type and size validation. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-02-08 15:10:05 +00:00
/** Validate the key type and size for key generation
Move key buffer size computation out of psa_generate_key_internal() Preparatory commit to eventually change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. To be able to change the signature, the buffer to store the key has to be allocated before the call to psa_generate_key_internal() thus its size has to be calculed beforehand as well. This is the purpose of this commit: to move the computation of the key size in bytes out of psa_generate_key_internal(). Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-05 07:42:02 +00:00
*
psa: key generation: Use PSA_EXPORT_KEY_OUTPUT_SIZE Use PSA_EXPORT_KEY_OUTPUT_SIZE macro to compute the size of the buffer to contain the generated key instead of computing it alongside the key type and size validation. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-02-08 15:10:05 +00:00
* \param type The key type
* \param bits The number of bits of the key
Move key buffer size computation out of psa_generate_key_internal() Preparatory commit to eventually change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. To be able to change the signature, the buffer to store the key has to be allocated before the call to psa_generate_key_internal() thus its size has to be calculed beforehand as well. This is the purpose of this commit: to move the computation of the key size in bytes out of psa_generate_key_internal(). Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-05 07:42:02 +00:00
*
* \retval #PSA_SUCCESS
psa: key generation: Use PSA_EXPORT_KEY_OUTPUT_SIZE Use PSA_EXPORT_KEY_OUTPUT_SIZE macro to compute the size of the buffer to contain the generated key instead of computing it alongside the key type and size validation. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-02-08 15:10:05 +00:00
* The key type and size are valid.
Move key buffer size computation out of psa_generate_key_internal() Preparatory commit to eventually change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. To be able to change the signature, the buffer to store the key has to be allocated before the call to psa_generate_key_internal() thus its size has to be calculed beforehand as well. This is the purpose of this commit: to move the computation of the key size in bytes out of psa_generate_key_internal(). Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-05 07:42:02 +00:00
* \retval #PSA_ERROR_INVALID_ARGUMENT
* The size in bits of the key is not valid.
* \retval #PSA_ERROR_NOT_SUPPORTED
* The type and/or the size in bits of the key or the combination of
* the two is not supported.
*/
psa: key generation: Use PSA_EXPORT_KEY_OUTPUT_SIZE Use PSA_EXPORT_KEY_OUTPUT_SIZE macro to compute the size of the buffer to contain the generated key instead of computing it alongside the key type and size validation. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-02-08 15:10:05 +00:00
static psa_status_t psa_validate_key_type_and_size_for_key_generation(
psa_key_type_t type, size_t bits )
Move key buffer size computation out of psa_generate_key_internal() Preparatory commit to eventually change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. To be able to change the signature, the buffer to store the key has to be allocated before the call to psa_generate_key_internal() thus its size has to be calculed beforehand as well. This is the purpose of this commit: to move the computation of the key size in bytes out of psa_generate_key_internal(). Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-05 07:42:02 +00:00
{
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
if( key_type_is_raw_bytes( type ) )
{
status = validate_unstructured_key_bit_size( type, bits );
if( status != PSA_SUCCESS )
return( status );
}
else
psa: Extend psa_get_key_buffer_size scope When generating transparent keys, we need to be able to compute the size of the key buffer whether the key is generated by the Mbed TLS library or by an accelerator. Thus, change the RSA/ECP MBEDTLS_PSA_BUILTIN_... compilation guards with their PSA_WANT_... counterparts. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-12-07 10:07:24 +00:00
#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR)
Move key buffer size computation out of psa_generate_key_internal() Preparatory commit to eventually change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. To be able to change the signature, the buffer to store the key has to be allocated before the call to psa_generate_key_internal() thus its size has to be calculed beforehand as well. This is the purpose of this commit: to move the computation of the key size in bytes out of psa_generate_key_internal(). Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-05 07:42:02 +00:00
if( PSA_KEY_TYPE_IS_RSA( type ) && PSA_KEY_TYPE_IS_KEY_PAIR( type ) )
{
if( bits > PSA_VENDOR_RSA_MAX_KEY_BITS )
return( PSA_ERROR_NOT_SUPPORTED );
/* Accept only byte-aligned keys, for the same reasons as
* in psa_import_rsa_key(). */
if( bits % 8 != 0 )
return( PSA_ERROR_NOT_SUPPORTED );
}
else
psa: Extend psa_get_key_buffer_size scope When generating transparent keys, we need to be able to compute the size of the key buffer whether the key is generated by the Mbed TLS library or by an accelerator. Thus, change the RSA/ECP MBEDTLS_PSA_BUILTIN_... compilation guards with their PSA_WANT_... counterparts. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-12-07 10:07:24 +00:00
#endif /* defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR) */
Move key buffer size computation out of psa_generate_key_internal() Preparatory commit to eventually change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. To be able to change the signature, the buffer to store the key has to be allocated before the call to psa_generate_key_internal() thus its size has to be calculed beforehand as well. This is the purpose of this commit: to move the computation of the key size in bytes out of psa_generate_key_internal(). Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-05 07:42:02 +00:00
psa: Extend psa_get_key_buffer_size scope When generating transparent keys, we need to be able to compute the size of the key buffer whether the key is generated by the Mbed TLS library or by an accelerator. Thus, change the RSA/ECP MBEDTLS_PSA_BUILTIN_... compilation guards with their PSA_WANT_... counterparts. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-12-07 10:07:24 +00:00
#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR)
Move key buffer size computation out of psa_generate_key_internal() Preparatory commit to eventually change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. To be able to change the signature, the buffer to store the key has to be allocated before the call to psa_generate_key_internal() thus its size has to be calculed beforehand as well. This is the purpose of this commit: to move the computation of the key size in bytes out of psa_generate_key_internal(). Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-05 07:42:02 +00:00
if( PSA_KEY_TYPE_IS_ECC( type ) && PSA_KEY_TYPE_IS_KEY_PAIR( type ) )
{
psa: Avoid empty block Avoid empty block to ease maintenance. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-02-16 08:01:16 +00:00
/* To avoid empty block, return successfully here. */
return( PSA_SUCCESS );
Move key buffer size computation out of psa_generate_key_internal() Preparatory commit to eventually change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. To be able to change the signature, the buffer to store the key has to be allocated before the call to psa_generate_key_internal() thus its size has to be calculed beforehand as well. This is the purpose of this commit: to move the computation of the key size in bytes out of psa_generate_key_internal(). Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-05 07:42:02 +00:00
}
else
psa: Extend psa_get_key_buffer_size scope When generating transparent keys, we need to be able to compute the size of the key buffer whether the key is generated by the Mbed TLS library or by an accelerator. Thus, change the RSA/ECP MBEDTLS_PSA_BUILTIN_... compilation guards with their PSA_WANT_... counterparts. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-12-07 10:07:24 +00:00
#endif /* defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR) */
Move key buffer size computation out of psa_generate_key_internal() Preparatory commit to eventually change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. To be able to change the signature, the buffer to store the key has to be allocated before the call to psa_generate_key_internal() thus its size has to be calculed beforehand as well. This is the purpose of this commit: to move the computation of the key size in bytes out of psa_generate_key_internal(). Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-05 07:42:02 +00:00
{
return( PSA_ERROR_NOT_SUPPORTED );
}
return( PSA_SUCCESS );
}
Export "internally" psa_generate_key_internal() Export psa_generate_key_internal() to make it available to the driver wrapper. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-05 08:30:40 +00:00
psa_status_t psa_generate_key_internal(
Change psa_generate_key_internal() signature Change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. That way, this function can be called by the driver wrapper when a software fallback is necessary. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-02 18:02:04 +00:00
const psa_key_attributes_t *attributes,
uint8_t *key_buffer, size_t key_buffer_size, size_t *key_buffer_length )
Implement psa_generate_random
2018-06-19 20:00:52 +00:00
{
Improve psa_generate_key_internal() Small improvements to psa_generate_key_internal() implementation: . declare only once the status local variable and initialize it to PSA_ERROR_CORRUPTION_DETECTED to improve robustness against FI attacks. . remove an unnecessary assignment. . use type local variable instead of its global variable equivalent. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-02 18:11:59 +00:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Change psa_generate_key_internal() signature Change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. That way, this function can be called by the driver wrapper when a software fallback is necessary. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-02 18:02:04 +00:00
psa_key_type_t type = attributes->core.type;
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-19 22:20:32 +00:00
Change psa_generate_key_internal() signature Change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. That way, this function can be called by the driver wrapper when a software fallback is necessary. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-02 18:02:04 +00:00
if( ( attributes->domain_parameters == NULL ) &&
( attributes->domain_parameters_size != 0 ) )
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-19 22:20:32 +00:00
return( PSA_ERROR_INVALID_ARGUMENT );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 15:01:38 +00:00
Remove PSA_KEY_TYPE_IS_RAW_BYTES from crypto.h It isn't used to define other macros and it doesn't seem that useful for users. Remove it, we can reintroduce it if needed. Define a similar function key_type_is_raw_bytes in the implementation with a clear semantics: it's a key that's represented as a struct raw_data.
2018-06-21 12:15:31 +00:00
if( key_type_is_raw_bytes( type ) )
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-19 22:20:32 +00:00
{
Change psa_generate_key_internal() signature Change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. That way, this function can be called by the driver wrapper when a software fallback is necessary. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-02 18:02:04 +00:00
status = psa_generate_random( key_buffer, key_buffer_size );
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-19 22:20:32 +00:00
if( status != PSA_SUCCESS )
return( status );
Pull apart slot memory allocation from key validation. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 20:04:59 +00:00
Change some conditionals of PSA to use BUILTIN Change a few conditionals in the psa library to be based on the MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES instead of the WANT macros. Future additions of HW acceleration will need to be mindful of these definitions if any of this code is needed in those instances. Signed-off-by: David Brown <david.brown@linaro.org>
2021-02-11 18:02:00 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-19 22:20:32 +00:00
if( type == PSA_KEY_TYPE_DES )
Change psa_generate_key_internal() signature Change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. That way, this function can be called by the driver wrapper when a software fallback is necessary. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-02 18:02:04 +00:00
psa_des_set_key_parity( key_buffer, key_buffer_size );
Fix 2 endif comments Two endif comments didn't match the ifdef. Fix these to match. Signed-off-by: David Brown <david.brown@linaro.org>
2021-02-12 15:08:46 +00:00
#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-19 22:20:32 +00:00
}
else
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR)
Rename *KEYPAIR* to *KEY_PAIR* Be consistent with PUBLIC_KEY. perl -i -pe 's/KEYPAIR/KEY_PAIR/g' $(git ls-files)
2019-05-16 17:39:54 +00:00
if ( type == PSA_KEY_TYPE_RSA_KEY_PAIR )
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-19 22:20:32 +00:00
{
Move RSA key generation code to the PSA RSA specific C file Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-05 16:36:40 +00:00
return( mbedtls_psa_rsa_generate_key( attributes,
key_buffer,
key_buffer_size,
key_buffer_length ) );
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-19 22:20:32 +00:00
}
else
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 06:08:34 +00:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) */
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-19 22:20:32 +00:00
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 20:28:15 +00:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR)
Rename *KEYPAIR* to *KEY_PAIR* Be consistent with PUBLIC_KEY. perl -i -pe 's/KEYPAIR/KEY_PAIR/g' $(git ls-files)
2019-05-16 17:39:54 +00:00
if ( PSA_KEY_TYPE_IS_ECC( type ) && PSA_KEY_TYPE_IS_KEY_PAIR( type ) )
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-19 22:20:32 +00:00
{
Move ECP key generation code to the PSA ECP specific C file Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-20 17:17:42 +00:00
return( mbedtls_psa_ecp_generate_key( attributes,
key_buffer,
key_buffer_size,
key_buffer_length ) );
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-19 22:20:32 +00:00
}
else
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 20:28:15 +00:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) */
Style fixes * return is treated as a function call * space between opening and closing parentheses * remove whiteline between assignment and checking of same variable Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-05 13:43:42 +00:00
{
Change psa_generate_key_internal() signature Change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. That way, this function can be called by the driver wrapper when a software fallback is necessary. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-02 18:02:04 +00:00
(void)key_buffer_length;
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-19 22:20:32 +00:00
return( PSA_ERROR_NOT_SUPPORTED );
Style fixes * return is treated as a function call * space between opening and closing parentheses * remove whiteline between assignment and checking of same variable Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-05 13:43:42 +00:00
}
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-19 22:20:32 +00:00
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 10:53:30 +00:00
return( PSA_SUCCESS );
}
psa: Extend psa_generate_key to support persistent lifetimes
2018-11-07 16:05:30 +00:00
Rename psa_generate_random_key back to psa_generate_key generate_key is a more classical name. The longer name was only introduced to avoid confusion with getting a key from a generator, which is key derivation, but we no longer use the generator terminology so this reason no longer applies. perl -i -pe 's/psa_generate_random_key/psa_generate_key/g' $(git ls-files)
2019-05-16 17:42:05 +00:00
psa_status_t psa_generate_key( const psa_key_attributes_t *attributes,
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 07:51:30 +00:00
mbedtls_svc_key_id_t *key )
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 10:53:30 +00:00
{
psa_status_t status;
psa_key_slot_t *slot = NULL;
Driver table entries are now mutable Since driver table entries contain the driver context, which is mutable, they can't be const anymore.
2019-07-12 21:40:35 +00:00
psa_se_drv_table_entry_t *driver = NULL;
Move key buffer allocation out of psa_generate_key_internal() Preparatory commit to eventually change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. To be able to change the signature, the buffer to store the generated key has to be allocated before the call to psa_generate_key_internal(). This commit moves the allocation and clean-up in case of error of the buffer to store the generated key from psa_generate_key_internal() to psa_generate_key(). This has the nice benefit of factorizing the key buffer allocation and clean-up. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-05 08:02:26 +00:00
size_t key_buffer_size;
SE keys: implement and smoke-test p_generate
2019-08-06 16:36:36 +00:00
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 11:10:32 +00:00
*key = MBEDTLS_SVC_KEY_ID_INIT;
Reject keys of size 0 Implement the prohibition on keys of size 0.
2019-09-12 17:03:13 +00:00
/* Reject any attempt to create a zero-length key so that we don't
* risk tripping up later, e.g. on a malloc(0) that returns NULL. */
if( psa_get_key_bits( attributes ) == 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 11:10:32 +00:00
status = psa_start_key_creation( PSA_KEY_CREATION_GENERATE, attributes,
&slot, &driver );
SE keys: implement and smoke-test p_generate
2019-08-06 16:36:36 +00:00
if( status != PSA_SUCCESS )
goto exit;
Call software implementation as a driver Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-13 06:32:21 +00:00
/* In the case of a transparent key or an opaque key stored in local
* storage (thus not in the case of generating a key in a secure element
* or cryptoprocessor with storage), we have to allocate a buffer to
* hold the generated key material. */
if( slot->key.data == NULL )
{
if ( PSA_KEY_LIFETIME_GET_LOCATION( attributes->core.lifetime ) ==
PSA_KEY_LOCATION_LOCAL_STORAGE )
{
psa: key generation: Use PSA_EXPORT_KEY_OUTPUT_SIZE Use PSA_EXPORT_KEY_OUTPUT_SIZE macro to compute the size of the buffer to contain the generated key instead of computing it alongside the key type and size validation. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-02-08 15:10:05 +00:00
status = psa_validate_key_type_and_size_for_key_generation(
attributes->core.type, attributes->core.bits );
if( status != PSA_SUCCESS )
goto exit;
key_buffer_size = PSA_EXPORT_KEY_OUTPUT_SIZE(
attributes->core.type,
attributes->core.bits );
Call software implementation as a driver Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-13 06:32:21 +00:00
}
else
{
status = psa_driver_wrapper_get_key_buffer_size(
attributes, &key_buffer_size );
psa: key generation: Use PSA_EXPORT_KEY_OUTPUT_SIZE Use PSA_EXPORT_KEY_OUTPUT_SIZE macro to compute the size of the buffer to contain the generated key instead of computing it alongside the key type and size validation. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-02-08 15:10:05 +00:00
if( status != PSA_SUCCESS )
goto exit;
Call software implementation as a driver Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-13 06:32:21 +00:00
}
Move key buffer allocation out of psa_generate_key_internal() Preparatory commit to eventually change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. To be able to change the signature, the buffer to store the generated key has to be allocated before the call to psa_generate_key_internal(). This commit moves the allocation and clean-up in case of error of the buffer to store the generated key from psa_generate_key_internal() to psa_generate_key(). This has the nice benefit of factorizing the key buffer allocation and clean-up. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-05 08:02:26 +00:00
Call software implementation as a driver Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-13 06:32:21 +00:00
status = psa_allocate_buffer_to_slot( slot, key_buffer_size );
if( status != PSA_SUCCESS )
goto exit;
}
Move key buffer allocation out of psa_generate_key_internal() Preparatory commit to eventually change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. To be able to change the signature, the buffer to store the generated key has to be allocated before the call to psa_generate_key_internal(). This commit moves the allocation and clean-up in case of error of the buffer to store the generated key from psa_generate_key_internal() to psa_generate_key(). This has the nice benefit of factorizing the key buffer allocation and clean-up. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-05 08:02:26 +00:00
Call software implementation as a driver Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-13 06:32:21 +00:00
status = psa_driver_wrapper_generate_key( attributes,
slot->key.data, slot->key.bytes, &slot->key.bytes );
SE keys: implement and smoke-test p_generate
2019-08-06 16:36:36 +00:00
Move key buffer allocation out of psa_generate_key_internal() Preparatory commit to eventually change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. To be able to change the signature, the buffer to store the generated key has to be allocated before the call to psa_generate_key_internal(). This commit moves the allocation and clean-up in case of error of the buffer to store the generated key from psa_generate_key_internal() to psa_generate_key(). This has the nice benefit of factorizing the key buffer allocation and clean-up. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-05 08:02:26 +00:00
if( status != PSA_SUCCESS )
psa_remove_key_data_from_memory( slot );
SE keys: implement and smoke-test p_generate
2019-08-06 16:36:36 +00:00
exit:
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 10:53:30 +00:00
if( status == PSA_SUCCESS )
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 11:10:32 +00:00
status = psa_finish_key_creation( slot, driver, key );
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 10:53:30 +00:00
if( status != PSA_SUCCESS )
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
psa_fail_key_creation( slot, driver );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 13:24:49 +00:00
psa: Extend psa_generate_key to support persistent lifetimes
2018-11-07 16:05:30 +00:00
return( status );
Implement psa_generate_random
2018-06-19 20:00:52 +00:00
}
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
/****************************************************************/
/* Module setup */
/****************************************************************/
Implement MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG Implement support for MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG. For test purposes, write an implementation that uses libc rand(). Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 17:47:18 +00:00
#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
Add a facility to configure entropy sources Add a function to configure entropy sources. For testing only. Use it to test that the library initialization fails properly if there is no entropy source.
2018-11-20 20:59:56 +00:00
psa_status_t mbedtls_psa_crypto_configure_entropy_sources(
void (* entropy_init )( mbedtls_entropy_context *ctx ),
void (* entropy_free )( mbedtls_entropy_context *ctx ) )
{
if( global_data.rng_state != RNG_NOT_INITIALIZED )
return( PSA_ERROR_BAD_STATE );
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 16:02:26 +00:00
global_data.rng.entropy_init = entropy_init;
global_data.rng.entropy_free = entropy_free;
Add a facility to configure entropy sources Add a function to configure entropy sources. For testing only. Use it to test that the library initialization fails properly if there is no entropy source.
2018-11-20 20:59:56 +00:00
return( PSA_SUCCESS );
}
Implement MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG Implement support for MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG. For test purposes, write an implementation that uses libc rand(). Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 17:47:18 +00:00
#endif /* !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) */
Add a facility to configure entropy sources Add a function to configure entropy sources. For testing only. Use it to test that the library initialization fails properly if there is no entropy source.
2018-11-20 20:59:56 +00:00
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
void mbedtls_psa_crypto_free( void )
{
Move the key slot array to the slot management module Move the key slot array and its initialization and wiping to the slot management module. Also move the lowest-level key slot access function psa_get_key_slot and the auxiliary function for slot allocation psa_internal_allocate_key_slot to the slot management module.
2018-12-10 15:29:04 +00:00
psa_wipe_all_key_slots( );
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 20:42:52 +00:00
if( global_data.rng_state != RNG_NOT_INITIALIZED )
{
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 16:02:26 +00:00
mbedtls_psa_random_free( &global_data.rng );
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 14:48:15 +00:00
}
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 20:42:52 +00:00
/* Wipe all remaining data, including configuration.
* In particular, this sets all state indicator to the value
* indicating "uninitialized". */
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 17:14:53 +00:00
mbedtls_platform_zeroize( &global_data, sizeof( global_data ) );
Gate secure element support by a separate config option Secure element support has its own source file, and in addition requires many hooks in other files. This is a nontrivial amount of code, so make it optional (but default on).
2019-06-26 09:24:49 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Unregister drivers on library deinitialization
2019-06-24 12:34:43 +00:00
/* Unregister all secure element drivers, so that we restart from
* a pristine state. */
psa_unregister_all_se_drivers( );
Gate secure element support by a separate config option Secure element support has its own source file, and in addition requires many hooks in other files. This is a nontrivial amount of code, so make it optional (but default on).
2019-06-26 09:24:49 +00:00
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
}
Add boilerplate to recover a transaction during init
2019-07-25 15:52:59 +00:00
#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
/** Recover a transaction that was interrupted by a power failure.
*
* This function is called during initialization, before psa_crypto_init()
* returns. If this function returns a failure status, the initialization
* fails.
*/
static psa_status_t psa_crypto_recover_transaction(
const psa_crypto_transaction_t *transaction )
{
switch( transaction->unknown.type )
{
case PSA_CRYPTO_TRANSACTION_CREATE_KEY:
case PSA_CRYPTO_TRANSACTION_DESTROY_KEY:
Make TODO comments consistent
2019-08-13 11:15:34 +00:00
/* TODO - fall through to the failure case until this
Add issue numbers for some missing parts of secure element support
2019-08-13 14:17:16 +00:00
* is implemented.
* https://github.com/ARMmbed/mbed-crypto/issues/218
*/
Add boilerplate to recover a transaction during init
2019-07-25 15:52:59 +00:00
default:
/* We found an unsupported transaction in the storage.
* We don't know what state the storage is in. Give up. */
Use PSA_ERROR_DATA_INVALID error code If the file is read correctly, but it contains data that isn't valid, the crypto storage code returns PSA_ERROR_DATA_INVALID. The PSA_ERROR_DATA_CORRUPT and PSA_ERROR_STORAGE_FAILURE error codes are replaced with PSA_ERROR_DATA_INVALID, except in the ITS subsystem. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-11-09 16:39:56 +00:00
return( PSA_ERROR_DATA_INVALID );
Add boilerplate to recover a transaction during init
2019-07-25 15:52:59 +00:00
}
}
#endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
psa_status_t psa_crypto_init( void )
{
Move the key slot array to the slot management module Move the key slot array and its initialization and wiping to the slot management module. Also move the lowest-level key slot access function psa_get_key_slot and the auxiliary function for slot allocation psa_internal_allocate_key_slot to the slot management module.
2018-12-10 15:29:04 +00:00
psa_status_t status;
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 20:42:52 +00:00
/* Double initialization is explicitly allowed. */
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
if( global_data.initialized != 0 )
return( PSA_SUCCESS );
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 16:02:26 +00:00
/* Initialize and seed the random generator. */
mbedtls_psa_random_init( &global_data.rng );
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 20:42:52 +00:00
global_data.rng_state = RNG_INITIALIZED;
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 16:02:26 +00:00
status = mbedtls_psa_random_seed( &global_data.rng );
Move the key slot array to the slot management module Move the key slot array and its initialization and wiping to the slot management module. Also move the lowest-level key slot access function psa_get_key_slot and the auxiliary function for slot allocation psa_internal_allocate_key_slot to the slot management module.
2018-12-10 15:29:04 +00:00
if( status != PSA_SUCCESS )
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
goto exit;
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 20:42:52 +00:00
global_data.rng_state = RNG_SEEDED;
Move the key slot array to the slot management module Move the key slot array and its initialization and wiping to the slot management module. Also move the lowest-level key slot access function psa_get_key_slot and the auxiliary function for slot allocation psa_internal_allocate_key_slot to the slot management module.
2018-12-10 15:29:04 +00:00
status = psa_initialize_key_slots( );
if( status != PSA_SUCCESS )
goto exit;
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
SE driver: call the p_init method during psa_crypto_init()
2019-10-01 13:22:29 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
status = psa_init_all_se_drivers( );
if( status != PSA_SUCCESS )
goto exit;
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Transaction support: be more future-proof If there's ever a non-SE-related transaction, make sure it gets handled during init.
2019-07-24 13:56:31 +00:00
#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 17:30:34 +00:00
status = psa_crypto_load_transaction( );
if( status == PSA_SUCCESS )
{
Add boilerplate to recover a transaction during init
2019-07-25 15:52:59 +00:00
status = psa_crypto_recover_transaction( &psa_crypto_transaction );
if( status != PSA_SUCCESS )
goto exit;
status = psa_crypto_stop_transaction( );
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 17:30:34 +00:00
}
else if( status == PSA_ERROR_DOES_NOT_EXIST )
{
/* There's no transaction to complete. It's all good. */
status = PSA_SUCCESS;
}
Transaction support: be more future-proof If there's ever a non-SE-related transaction, make sure it gets handled during init.
2019-07-24 13:56:31 +00:00
#endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 17:30:34 +00:00
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 20:42:52 +00:00
/* All done. */
psa_crypto_init: set the global initialized flag
2018-03-07 13:16:44 +00:00
global_data.initialized = 1;
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
exit:
Move the key slot array to the slot management module Move the key slot array and its initialization and wiping to the slot management module. Also move the lowest-level key slot access function psa_get_key_slot and the auxiliary function for slot allocation psa_internal_allocate_key_slot to the slot management module.
2018-12-10 15:29:04 +00:00
if( status != PSA_SUCCESS )
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
mbedtls_psa_crypto_free( );
Move the key slot array to the slot management module Move the key slot array and its initialization and wiping to the slot management module. Also move the lowest-level key slot access function psa_get_key_slot and the auxiliary function for slot allocation psa_internal_allocate_key_slot to the slot management module.
2018-12-10 15:29:04 +00:00
return( status );
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
}
#endif /* MBEDTLS_PSA_CRYPTO_C */
Reference in a new issue Copy permalink