From 3d471814bc882db95c7d56d5a44c14005e744bec Mon Sep 17 00:00:00 2001 From: Ronald Cron Date: Thu, 18 Mar 2021 13:40:31 +0100 Subject: [PATCH] psa: Add missing PSA configs Add missing PSA_WANT_CCM/GCM/CMAC. This completes the set of PSA_WANT config options given the current support of PSA crypto in Mbed TLS. Signed-off-by: Ronald Cron --- include/mbedtls/config_psa.h | 36 ++++++++++++++++ include/psa/crypto_config.h | 3 ++ library/check_crypto_config.h | 19 +++++++++ library/psa_crypto.c | 80 +++++++++++++++++------------------ 4 files changed, 98 insertions(+), 40 deletions(-) diff --git a/include/mbedtls/config_psa.h b/include/mbedtls/config_psa.h index 39a500163..33ceaaa71 100644 --- a/include/mbedtls/config_psa.h +++ b/include/mbedtls/config_psa.h @@ -40,6 +40,20 @@ extern "C" { #if defined(MBEDTLS_PSA_CRYPTO_CONFIG) +#if defined(PSA_WANT_ALG_CCM) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_CCM) +#define MBEDTLS_PSA_BUILTIN_ALG_CCM 1 +#define MBEDTLS_CCM_C +#endif /* !MBEDTLS_PSA_ACCEL_ALG_CCM */ +#endif /* PSA_WANT_ALG_CCM */ + +#if defined(PSA_WANT_ALG_CMAC) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_CMAC) +#define MBEDTLS_PSA_BUILTIN_ALG_CMAC 1 +#define MBEDTLS_CMAC_C +#endif /* !MBEDTLS_PSA_ACCEL_ALG_CMAC */ +#endif /* PSA_WANT_ALG_CMAC */ + #if defined(PSA_WANT_ALG_DETERMINISTIC_ECDSA) #if !defined(MBEDTLS_PSA_ACCEL_ALG_DETERMINISTIC_ECDSA) #define MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA 1 @@ -66,6 +80,13 @@ extern "C" { #endif /* !MBEDTLS_PSA_ACCEL_ALG_ECDSA */ #endif /* PSA_WANT_ALG_ECDSA */ +#if defined(PSA_WANT_ALG_GCM) +#if !defined(MBEDTLS_PSA_ACCEL_ALG_GCM) +#define MBEDTLS_PSA_BUILTIN_ALG_GCM 1 +#define MBEDTLS_GCM_C +#endif /* !MBEDTLS_PSA_ACCEL_ALG_GCM */ +#endif /* PSA_WANT_ALG_GCM */ + #if defined(PSA_WANT_ALG_HKDF) #if !defined(MBEDTLS_PSA_ACCEL_ALG_HKDF) #define MBEDTLS_PSA_BUILTIN_ALG_HMAC 1 @@ -453,6 +474,16 @@ extern "C" { * is not defined */ +#if defined(MBEDTLS_CCM_C) +#define MBEDTLS_PSA_BUILTIN_ALG_CCM 1 +#define PSA_WANT_ALG_CCM 1 +#endif /* MBEDTLS_CCM_C */ + +#if defined(MBEDTLS_CMAC_C) +#define MBEDTLS_PSA_BUILTIN_ALG_CMAC 1 +#define PSA_WANT_ALG_CMAC 1 +#endif /* MBEDTLS_CMAC_C */ + #if defined(MBEDTLS_ECDH_C) #define MBEDTLS_PSA_BUILTIN_ALG_ECDH 1 #define PSA_WANT_ALG_ECDH 1 @@ -477,6 +508,11 @@ extern "C" { #define PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY 1 #endif /* MBEDTLS_ECP_C */ +#if defined(MBEDTLS_GCM_C) +#define MBEDTLS_PSA_BUILTIN_ALG_GCM 1 +#define PSA_WANT_ALG_GCM 1 +#endif /* MBEDTLS_GCM_C */ + #if defined(MBEDTLS_HKDF_C) #define MBEDTLS_PSA_BUILTIN_ALG_HMAC 1 #define PSA_WANT_ALG_HMAC 1 diff --git a/include/psa/crypto_config.h b/include/psa/crypto_config.h index afbaa66e5..6856a4653 100644 --- a/include/psa/crypto_config.h +++ b/include/psa/crypto_config.h @@ -52,13 +52,16 @@ #define PSA_WANT_ALG_CBC_NO_PADDING 1 #define PSA_WANT_ALG_CBC_PKCS7 1 +#define PSA_WANT_ALG_CCM 1 #define PSA_WANT_ALG_CFB 1 #define PSA_WANT_ALG_CHACHA20_POLY1305 1 +#define PSA_WANT_ALG_CMAC 1 #define PSA_WANT_ALG_CTR 1 #define PSA_WANT_ALG_DETERMINISTIC_ECDSA 1 #define PSA_WANT_ALG_ECB_NO_PADDING 1 #define PSA_WANT_ALG_ECDH 1 #define PSA_WANT_ALG_ECDSA 1 +#define PSA_WANT_ALG_GCM 1 #define PSA_WANT_ALG_HKDF 1 #define PSA_WANT_ALG_HMAC 1 #define PSA_WANT_ALG_MD2 1 diff --git a/library/check_crypto_config.h b/library/check_crypto_config.h index cac90a0df..e24246b9c 100644 --- a/library/check_crypto_config.h +++ b/library/check_crypto_config.h @@ -28,6 +28,18 @@ #ifndef MBEDTLS_CHECK_CRYPTO_CONFIG_H #define MBEDTLS_CHECK_CRYPTO_CONFIG_H +#if defined(PSA_WANT_ALG_CCM) && \ + !( defined(PSA_WANT_KEY_TYPE_AES) || \ + defined(PSA_WANT_KEY_TYPE_CAMELLIA) ) +#error "PSA_WANT_ALG_CCM defined, but not all prerequisites" +#endif + +#if defined(PSA_WANT_ALG_CMAC) && \ + !( defined(PSA_WANT_KEY_TYPE_AES) || \ + defined(PSA_WANT_KEY_TYPE_DES) ) +#error "PSA_WANT_ALG_CMAC defined, but not all prerequisites" +#endif + #if defined(PSA_WANT_ALG_DETERMINISTIC_ECDSA) && \ !( defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR) || \ defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) ) @@ -40,6 +52,13 @@ #error "PSA_WANT_ALG_ECDSA defined, but not all prerequisites" #endif +#if defined(PSA_WANT_ALG_GCM) && \ + !( defined(PSA_WANT_KEY_TYPE_AES) || \ + defined(PSA_WANT_KEY_TYPE_ARIA) || \ + defined(PSA_WANT_KEY_TYPE_CAMELLIA) ) +#error "PSA_WANT_ALG_GCM defined, but not all prerequisites" +#endif + #if defined(PSA_WANT_ALG_RSA_PKCS1V15_CRYPT) && \ !( defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR) || \ defined(PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY) ) diff --git a/library/psa_crypto.c b/library/psa_crypto.c index 5c560c29b..452d9ec98 100644 --- a/library/psa_crypto.c +++ b/library/psa_crypto.c @@ -2445,7 +2445,7 @@ static psa_status_t psa_mac_init( psa_mac_operation_t *operation, operation->has_input = 0; operation->is_sign = 0; -#if defined(MBEDTLS_CMAC_C) +#if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC) if( operation->alg == PSA_ALG_CMAC ) { operation->iv_required = 0; @@ -2453,7 +2453,7 @@ static psa_status_t psa_mac_init( psa_mac_operation_t *operation, status = PSA_SUCCESS; } else -#endif /* MBEDTLS_CMAC_C */ +#endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */ #if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC) if( PSA_ALG_IS_HMAC( operation->alg ) ) { @@ -2491,13 +2491,13 @@ psa_status_t psa_mac_abort( psa_mac_operation_t *operation ) return( PSA_SUCCESS ); } else -#if defined(MBEDTLS_CMAC_C) +#if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC) if( operation->alg == PSA_ALG_CMAC ) { mbedtls_cipher_free( &operation->ctx.cmac ); } else -#endif /* MBEDTLS_CMAC_C */ +#endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */ #if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC) if( PSA_ALG_IS_HMAC( operation->alg ) ) { @@ -2529,7 +2529,7 @@ bad_state: return( PSA_ERROR_BAD_STATE ); } -#if defined(MBEDTLS_CMAC_C) +#if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC) static psa_status_t psa_cmac_setup( psa_mac_operation_t *operation, psa_key_slot_t *slot ) { @@ -2551,7 +2551,7 @@ static psa_status_t psa_cmac_setup( psa_mac_operation_t *operation, exit: return( mbedtls_to_psa_error( ret ) ); } -#endif /* MBEDTLS_CMAC_C */ +#endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */ #if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC) static psa_status_t psa_hmac_setup_internal( psa_hmac_internal_data *hmac, @@ -2676,13 +2676,13 @@ static psa_status_t psa_mac_setup( psa_mac_operation_t *operation, goto exit; } -#if defined(MBEDTLS_CMAC_C) +#if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC) if( PSA_ALG_FULL_LENGTH_MAC( alg ) == PSA_ALG_CMAC ) { status = psa_cmac_setup( operation, slot ); } else -#endif /* MBEDTLS_CMAC_C */ +#endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */ #if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC) if( PSA_ALG_IS_HMAC( alg ) ) { @@ -2750,7 +2750,7 @@ psa_status_t psa_mac_update( psa_mac_operation_t *operation, return( PSA_ERROR_BAD_STATE ); operation->has_input = 1; -#if defined(MBEDTLS_CMAC_C) +#if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC) if( operation->alg == PSA_ALG_CMAC ) { int ret = mbedtls_cipher_cmac_update( &operation->ctx.cmac, @@ -2758,7 +2758,7 @@ psa_status_t psa_mac_update( psa_mac_operation_t *operation, status = mbedtls_to_psa_error( ret ); } else -#endif /* MBEDTLS_CMAC_C */ +#endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */ #if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC) if( PSA_ALG_IS_HMAC( operation->alg ) ) { @@ -2830,7 +2830,7 @@ static psa_status_t psa_mac_finish_internal( psa_mac_operation_t *operation, if( mac_size < operation->mac_size ) return( PSA_ERROR_BUFFER_TOO_SMALL ); -#if defined(MBEDTLS_CMAC_C) +#if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC) if( operation->alg == PSA_ALG_CMAC ) { uint8_t tmp[PSA_BLOCK_CIPHER_BLOCK_MAX_SIZE]; @@ -2841,7 +2841,7 @@ static psa_status_t psa_mac_finish_internal( psa_mac_operation_t *operation, return( mbedtls_to_psa_error( ret ) ); } else -#endif /* MBEDTLS_CMAC_C */ +#endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */ #if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC) if( PSA_ALG_IS_HMAC( operation->alg ) ) { @@ -3892,15 +3892,15 @@ typedef struct union { unsigned dummy; /* Make the union non-empty even with no supported algorithms. */ -#if defined(MBEDTLS_CCM_C) +#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM) mbedtls_ccm_context ccm; -#endif /* MBEDTLS_CCM_C */ -#if defined(MBEDTLS_GCM_C) +#endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */ +#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM) mbedtls_gcm_context gcm; -#endif /* MBEDTLS_GCM_C */ -#if defined(MBEDTLS_CHACHAPOLY_C) +#endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */ +#if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305) mbedtls_chachapoly_context chachapoly; -#endif /* MBEDTLS_CHACHAPOLY_C */ +#endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */ } ctx; psa_algorithm_t core_alg; uint8_t full_tag_length; @@ -3913,16 +3913,16 @@ static void psa_aead_abort_internal( aead_operation_t *operation ) { switch( operation->core_alg ) { -#if defined(MBEDTLS_CCM_C) +#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM) case PSA_ALG_CCM: mbedtls_ccm_free( &operation->ctx.ccm ); break; -#endif /* MBEDTLS_CCM_C */ -#if defined(MBEDTLS_GCM_C) +#endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */ +#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM) case PSA_ALG_GCM: mbedtls_gcm_free( &operation->ctx.gcm ); break; -#endif /* MBEDTLS_GCM_C */ +#endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */ } psa_unlock_key_slot( operation->slot ); @@ -3955,7 +3955,7 @@ static psa_status_t psa_aead_setup( aead_operation_t *operation, switch( PSA_ALG_AEAD_WITH_SHORTENED_TAG( alg, 0 ) ) { -#if defined(MBEDTLS_CCM_C) +#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM) case PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, 0 ): operation->core_alg = PSA_ALG_CCM; operation->full_tag_length = 16; @@ -3975,9 +3975,9 @@ static psa_status_t psa_aead_setup( aead_operation_t *operation, if( status != 0 ) goto cleanup; break; -#endif /* MBEDTLS_CCM_C */ +#endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */ -#if defined(MBEDTLS_GCM_C) +#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM) case PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_GCM, 0 ): operation->core_alg = PSA_ALG_GCM; operation->full_tag_length = 16; @@ -3997,9 +3997,9 @@ static psa_status_t psa_aead_setup( aead_operation_t *operation, if( status != 0 ) goto cleanup; break; -#endif /* MBEDTLS_GCM_C */ +#endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */ -#if defined(MBEDTLS_CHACHAPOLY_C) +#if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305) case PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CHACHA20_POLY1305, 0 ): operation->core_alg = PSA_ALG_CHACHA20_POLY1305; operation->full_tag_length = 16; @@ -4016,7 +4016,7 @@ static psa_status_t psa_aead_setup( aead_operation_t *operation, if( status != 0 ) goto cleanup; break; -#endif /* MBEDTLS_CHACHAPOLY_C */ +#endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */ default: status = PSA_ERROR_NOT_SUPPORTED; @@ -4068,7 +4068,7 @@ psa_status_t psa_aead_encrypt( mbedtls_svc_key_id_t key, } tag = ciphertext + plaintext_length; -#if defined(MBEDTLS_GCM_C) +#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM) if( operation.core_alg == PSA_ALG_GCM ) { status = mbedtls_to_psa_error( @@ -4081,8 +4081,8 @@ psa_status_t psa_aead_encrypt( mbedtls_svc_key_id_t key, operation.tag_length, tag ) ); } else -#endif /* MBEDTLS_GCM_C */ -#if defined(MBEDTLS_CCM_C) +#endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */ +#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM) if( operation.core_alg == PSA_ALG_CCM ) { status = mbedtls_to_psa_error( @@ -4095,8 +4095,8 @@ psa_status_t psa_aead_encrypt( mbedtls_svc_key_id_t key, tag, operation.tag_length ) ); } else -#endif /* MBEDTLS_CCM_C */ -#if defined(MBEDTLS_CHACHAPOLY_C) +#endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */ +#if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305) if( operation.core_alg == PSA_ALG_CHACHA20_POLY1305 ) { if( nonce_length != 12 || operation.tag_length != 16 ) @@ -4115,7 +4115,7 @@ psa_status_t psa_aead_encrypt( mbedtls_svc_key_id_t key, tag ) ); } else -#endif /* MBEDTLS_CHACHAPOLY_C */ +#endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */ { (void) tag; return( PSA_ERROR_NOT_SUPPORTED ); @@ -4180,7 +4180,7 @@ psa_status_t psa_aead_decrypt( mbedtls_svc_key_id_t key, if( status != PSA_SUCCESS ) goto exit; -#if defined(MBEDTLS_GCM_C) +#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM) if( operation.core_alg == PSA_ALG_GCM ) { status = mbedtls_to_psa_error( @@ -4193,8 +4193,8 @@ psa_status_t psa_aead_decrypt( mbedtls_svc_key_id_t key, ciphertext, plaintext ) ); } else -#endif /* MBEDTLS_GCM_C */ -#if defined(MBEDTLS_CCM_C) +#endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */ +#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM) if( operation.core_alg == PSA_ALG_CCM ) { status = mbedtls_to_psa_error( @@ -4207,8 +4207,8 @@ psa_status_t psa_aead_decrypt( mbedtls_svc_key_id_t key, tag, operation.tag_length ) ); } else -#endif /* MBEDTLS_CCM_C */ -#if defined(MBEDTLS_CHACHAPOLY_C) +#endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */ +#if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305) if( operation.core_alg == PSA_ALG_CHACHA20_POLY1305 ) { if( nonce_length != 12 || operation.tag_length != 16 ) @@ -4227,7 +4227,7 @@ psa_status_t psa_aead_decrypt( mbedtls_svc_key_id_t key, plaintext ) ); } else -#endif /* MBEDTLS_CHACHAPOLY_C */ +#endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */ { return( PSA_ERROR_NOT_SUPPORTED ); }