yuzu-emu/mbedtls
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
mbedtls/library/psa_crypto.c

6420 lines
221 KiB
C
Raw Normal View History

Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
/*
* PSA crypto layer on top of Mbed TLS crypto
*/
Add Apache-2.0 headers to all source files Also normalize the first line of the copyright headers. This commit was generated using the following script: # ======================== #!/bin/sh # Find scripts find -path './.git' -prune -o '(' -name '*.c' -o -name '*.cpp' -o -name '*.fmt' -o -name '*.h' ')' -print | xargs sed -i ' # Normalize the first line of the copyright headers (no text on the first line of a block comment) /^\/\*.*Copyright.*Arm/I { i\ /* s/^\// / } /Copyright.*Arm/I { # Print copyright declaration p # Read the two lines immediately following the copyright declaration N N # Insert Apache header if it is missing /SPDX/! i\ * SPDX-License-Identifier: Apache-2.0\ *\ * Licensed under the Apache License, Version 2.0 (the "License"); you may\ * not use this file except in compliance with the License.\ * You may obtain a copy of the License at\ *\ * http://www.apache.org/licenses/LICENSE-2.0\ *\ * Unless required by applicable law or agreed to in writing, software\ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT\ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\ * See the License for the specific language governing permissions and\ * limitations under the License. # Clear copyright declaration from buffer D } ' # ======================== Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2020-06-15 11:59:37 +02:00
/*
Update copyright notices to use Linux Foundation guidance As a result, the copyright of contributors other than Arm is now acknowledged, and the years of publishing are no longer tracked in the source files. Also remove the now-redundant lines declaring that the files are part of MbedTLS. This commit was generated using the following script: # ======================== #!/bin/sh # Find files find '(' -path './.git' -o -path './3rdparty' ')' -prune -o -type f -print | xargs sed -bi ' # Replace copyright attribution line s/Copyright.*Arm.*/Copyright The Mbed TLS Contributors/I # Remove redundant declaration and the preceding line $!N /This file is part of Mbed TLS/Id P D ' # ======================== Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2020-08-07 13:07:28 +02:00
* Copyright The Mbed TLS Contributors
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
* SPDX-License-Identifier: Apache-2.0
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may
* not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
Include common.h instead of config.h in library source files In library source files, include "common.h", which takes care of including "mbedtls/config.h" (or the alternative MBEDTLS_CONFIG_FILE) and other things that are used throughout the library. FROM=$'#if !defined(MBEDTLS_CONFIG_FILE)\n#include "mbedtls/config.h"\n#else\n#include MBEDTLS_CONFIG_FILE\n#endif' perl -i -0777 -pe 's~\Q$ENV{FROM}~#include "common.h"~' library/*.c 3rdparty/*/library/*.c scripts/data_files/error.fmt scripts/data_files/version_features.fmt Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-06-03 01:43:33 +02:00
#include "common.h"
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
#if defined(MBEDTLS_PSA_CRYPTO_C)
Modifications for psa-crypto in order to integrate with SPM Add required includes in tests and psa_crypto.c file in order to be able to compilef for the SPM solution. Some functions needed to be deprecated from psa_crypto.c since they already implemented in the SPM.
2018-07-03 12:16:15 +02:00
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
#if defined(MBEDTLS_PSA_CRYPTO_CONFIG)
#include "check_crypto_config.h"
#endif
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
#include "psa/crypto.h"
Only Weierstrass curves supported Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-24 08:47:29 +01:00
#include "psa/crypto_values.h"
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
psa: Add mbedtls_psa_cipher_encrypt/decrypt_setup functions Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-12-14 14:56:02 +01:00
#include "psa_crypto_cipher.h"
Expose the PSA key slot structure to internal modules Move psa_key_slot_t to a new header psa_crypto_core.h, to prepare for moving the responsibility for some fields to psa_crypto_slot_management.c.
2018-12-07 18:24:41 +01:00
#include "psa_crypto_core.h"
Add a facility to configure entropy sources Add a function to configure entropy sources. For testing only. Use it to test that the library initialization fails properly if there is no entropy source.
2018-11-20 21:59:56 +01:00
#include "psa_crypto_invasive.h"
Add a handcrafted first version of the driver wrapper code Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-16 20:28:36 +02:00
#include "psa_crypto_driver_wrappers.h"
psa: Move xxx_load_representation functions to RSA/ECP specific modules Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 15:25:26 +01:00
#include "psa_crypto_ecp.h"
Move mbedtls_md_info_from_psa into the mbedtls hash driver Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-15 11:07:12 +01:00
#include "psa_crypto_hash.h"
Move internal HMAC implementation into internal MAC driver This is a temporary measure. Other operations in the PSA Core which rely on this internal HMAC API should be rewritten to use the MAC API instead, since they can then leverage accelerated HMAC should a platform provide such acceleration support. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-19 17:39:17 +01:00
#include "psa_crypto_mac.h"
psa: Move xxx_load_representation functions to RSA/ECP specific modules Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 15:25:26 +01:00
#include "psa_crypto_rsa.h"
Move ECP key generation code to the PSA ECP specific C file Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-20 18:17:42 +01:00
#include "psa_crypto_ecp.h"
Gate secure element support by a separate config option Secure element support has its own source file, and in addition requires many hooks in other files. This is a nontrivial amount of code, so make it optional (but default on).
2019-06-26 11:24:49 +02:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Unregister drivers on library deinitialization
2019-06-24 14:34:43 +02:00
#include "psa_crypto_se.h"
Gate secure element support by a separate config option Secure element support has its own source file, and in addition requires many hooks in other files. This is a nontrivial amount of code, so make it optional (but default on).
2019-06-26 11:24:49 +02:00
#endif
Implement slot allocation Implement psa_allocate_key, psa_open_key, psa_create_key, psa_close_key. Add support for keys designated to handles to psa_get_key_slot, and thereby to the whole API. Allocated and non-allocated keys can coexist. This is a temporary stage in order to transition from the use of direct slot numbers to allocated handles only. Once all the tests and sample programs have been migrated to use handles, the implementation will be simplified and made more robust with support for handles only.
2018-11-30 18:54:54 +01:00
#include "psa_crypto_slot_management.h"
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
/* Include internal declarations that are useful for implementing persistently
* stored keys. */
#include "psa_crypto_storage.h"
Rename psa_crypto_random.h to psa_crypto_random_impl.h Make it clear that this is an abstraction of the random generator abstraction, and not an abstraction of the PSA random generator. mbedtls_psa_get_random and MBEDTLS_PSA_RANDOM_STATE are public-facing definitions and will be moved in a subsequent commit. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-14 16:43:58 +01:00
#include "psa_crypto_random_impl.h"
Create a header file for PSA crypto random generator abstraction Subsequent commits will move declarations and definitions there. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 15:39:19 +01:00
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 21:32:04 +02:00
#include <assert.h>
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
#include <stdlib.h>
#include <string.h>
#include "mbedtls/platform.h"
Always include platform.h for MBEDTLS_ERR_PLATFORM_xxx Recognize MBEDTLS_ERR_PLATFORM_xxx in mbedtls_to_psa_error().
2019-05-06 15:26:23 +02:00
#if !defined(MBEDTLS_PLATFORM_C)
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
#define mbedtls_calloc calloc
#define mbedtls_free free
#endif
Include headers in psa_crypto.h for mbedtls_to_psa_error psa_crypto must be able to convert error codes even from modules that it doesn't call directly. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 18:46:25 +01:00
#include "mbedtls/aes.h"
Convert ERR_ASN1 error codes to PSA This fixes the error code when psa_export_key on an asymmetric key reports that the output buffer is too small.
2018-06-21 09:35:35 +02:00
#include "mbedtls/asn1.h"
psa: Simplify RSA public key format Remove pkcs-1 and rsaEncryption front matter from RSA public keys. Move code that was shared between RSA and other key types (like EC keys) to be used only with non-RSA keys.
2019-01-10 11:23:21 +01:00
#include "mbedtls/asn1write.h"
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 16:10:23 +02:00
#include "mbedtls/bignum.h"
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
#include "mbedtls/camellia.h"
Implement ChaCha20 and ChaCha20-Poly1305 Smoke tests: test data for ChaCha20 calculated with PyCryptodome; test vector from RFC 7539 for ChaCha20-Poly1305.
2019-05-06 15:25:00 +02:00
#include "mbedtls/chacha20.h"
#include "mbedtls/chachapoly.h"
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
#include "mbedtls/cipher.h"
#include "mbedtls/ccm.h"
#include "mbedtls/cmac.h"
#include "mbedtls/des.h"
Implement ECDH
2018-09-18 12:11:27 +02:00
#include "mbedtls/ecdh.h"
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 18:16:59 +01:00
#include "mbedtls/ecp.h"
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
#include "mbedtls/entropy.h"
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
#include "mbedtls/error.h"
#include "mbedtls/gcm.h"
#include "mbedtls/md5.h"
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 22:44:14 +01:00
#include "mbedtls/md.h"
Rename <pk/md/cipher>_internal.h to *_wrap.h Revert changes introduced in 50518f419589d2c4746f4b6d6be0a2569a3386a8 as it is now clear that these headers are internal without the `*_internal.h` suffix. Signed-off-by: Chris Jones <christopher.jones@arm.com>
2021-03-09 18:03:29 +01:00
#include "md_wrap.h"
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
#include "mbedtls/pk.h"
Rename <pk/md/cipher>_internal.h to *_wrap.h Revert changes introduced in 50518f419589d2c4746f4b6d6be0a2569a3386a8 as it is now clear that these headers are internal without the `*_internal.h` suffix. Signed-off-by: Chris Jones <christopher.jones@arm.com>
2021-03-09 18:03:29 +01:00
#include "pk_wrap.h"
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 18:14:53 +01:00
#include "mbedtls/platform_util.h"
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 14:21:35 +01:00
#include "mbedtls/error.h"
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
#include "mbedtls/ripemd160.h"
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 18:16:59 +01:00
#include "mbedtls/rsa.h"
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
#include "mbedtls/sha1.h"
#include "mbedtls/sha256.h"
#include "mbedtls/sha512.h"
Fix buffer overflow in the slot array Slots are numbered from 1, but the slot array is a C array so it's numbered from 0. Add a non-regression test.
2018-08-01 15:45:45 +02:00
#define ARRAY_LENGTH( array ) ( sizeof( array ) / sizeof( *( array ) ) )
psa_crypto.c: add MBEDTLS_PSA_BUILTIN_ALG_ANY_HKDF macro to limit number of #if conditions Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-09 14:44:55 +02:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
Adapt macro name to meet requested criteria: MBEDTLS_PSA_BUILTIN_ALG_ANY_HKDF->BUILTIN_ALG_ANY_HKDF Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-10 12:59:51 +02:00
#define BUILTIN_ALG_ANY_HKDF 1
psa_crypto.c: add MBEDTLS_PSA_BUILTIN_ALG_ANY_HKDF macro to limit number of #if conditions Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-09 14:44:55 +02:00
#endif
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
/****************************************************************/
/* Global data, support functions and library management */
/****************************************************************/
Remove PSA_KEY_TYPE_IS_RAW_BYTES from crypto.h It isn't used to define other macros and it doesn't seem that useful for users. Remove it, we can reintroduce it if needed. Define a similar function key_type_is_raw_bytes in the implementation with a clear semantics: it's a key that's represented as a struct raw_data.
2018-06-21 14:15:31 +02:00
static int key_type_is_raw_bytes( psa_key_type_t type )
{
Change the bitwise encoding of key type categories There were only 5 categories (now 4). Reduce the category mask from 7 bits to 3. Combine unformatted, not-necessarily-uniform keys (HMAC, derivation) with raw data. Reintroduce a KEY_TYPE_IS_UNSTRUCTURED macro (which used to exist under the name KEY_TYPE_IS_RAW_DATA macro) for key types that don't have any structure, including both should-be-uniform keys (such as block cipher and stream cipher keys) and not-necessarily-uniform keys (such as HMAC keys and secrets for key derivation).
2018-08-10 16:03:41 +02:00
return( PSA_KEY_TYPE_IS_UNSTRUCTURED( type ) );
Remove PSA_KEY_TYPE_IS_RAW_BYTES from crypto.h It isn't used to define other macros and it doesn't seem that useful for users. Remove it, we can reintroduce it if needed. Define a similar function key_type_is_raw_bytes in the implementation with a clear semantics: it's a key that's represented as a struct raw_data.
2018-06-21 14:15:31 +02:00
}
Don't use an enum in a bit-field This isn't standard C. GCC and Clang accept it but not every compiler (e.g. Armcc 5).
2018-12-04 12:27:09 +01:00
/* Values for psa_global_data_t::rng_state */
#define RNG_NOT_INITIALIZED 0
#define RNG_INITIALIZED 1
#define RNG_SEEDED 2
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 21:42:52 +01:00
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 15:41:12 +02:00
typedef struct
{
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 21:42:52 +01:00
unsigned initialized : 1;
Don't use an enum in a bit-field This isn't standard C. GCC and Clang accept it but not every compiler (e.g. Armcc 5).
2018-12-04 12:27:09 +01:00
unsigned rng_state : 2;
PSA global data: move fields around to save code size Move fields around to have fewer accesses outside the 128-element Thumb direct access window. Make the same change as in 2.27+, for the same small benefit. Results (arm-none-eabi-gcc 7.3.1, build_arm_none_eabi_gcc_m0plus build): library/psa_crypto.o: 16434 -> 16414 (diff: 20) Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-11-08 22:20:03 +01:00
mbedtls_psa_random_context_t rng;
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
} psa_global_data_t;
static psa_global_data_t global_data;
Replace mbedtls_psa_random_state( ... ) by MBEDTLS_PSA_RANDOM_STATE Hide the obtention of the pointer to the RNG state behind a macro. To make it possible to use this macro in a module other than psa_crypto.c, which will happen in the future, make sure that the definition of the macro does not reference internal variables of psa_crypto.c. For this purpose, in the internal-DRBG case, export a symbol containing the address of the DRBG state. When the RNG state is a pointer a DRBG state, just keep this pointer in a variable: there's no need to store a pointer to a larger structure. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-14 14:54:06 +01:00
#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
mbedtls_psa_drbg_context_t *const mbedtls_psa_random_state =
&global_data.rng.drbg;
#endif
Ensure the module is initialized in psa_generate_random
2018-09-06 15:24:41 +02:00
#define GUARD_MODULE_INITIALIZED \
if( global_data.initialized == 0 ) \
return( PSA_ERROR_BAD_STATE );
Expose mbedtls_error_to_psa_status for use in test drivers Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-20 15:31:37 +02:00
psa_status_t mbedtls_to_psa_error( int ret )
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
{
mbedtls_to_psa_error: prefer dispatching on the low-level error When an Mbed TLS error code combines a low-level error and a high-level error, the low-level error is usually closer to the root cause (for example HW_ACCEL_FAILED or ENTROPY_SOURCE_FAILED is more informative than RSA_PRIVATE_FAILED). So prioritize the low-level code when converting to a PSA error code, rather than the high-level code as was (rather arbitrarily) done before. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-06 20:04:23 +01:00
/* Mbed TLS error codes can combine a high-level error code and a
* low-level error code. The low-level error usually reflects the
* root cause better, so dispatch on that preferably. */
int low_level_ret = - ( -ret & 0x007f );
switch( low_level_ret != 0 ? low_level_ret : ret )
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
{
case 0:
return( PSA_SUCCESS );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
case MBEDTLS_ERR_AES_INVALID_KEY_LENGTH:
case MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH:
return( PSA_ERROR_NOT_SUPPORTED );
Convert ERR_ASN1 error codes to PSA This fixes the error code when psa_export_key on an asymmetric key reports that the output buffer is too small.
2018-06-21 09:35:35 +02:00
case MBEDTLS_ERR_ASN1_OUT_OF_DATA:
case MBEDTLS_ERR_ASN1_UNEXPECTED_TAG:
case MBEDTLS_ERR_ASN1_INVALID_LENGTH:
case MBEDTLS_ERR_ASN1_LENGTH_MISMATCH:
case MBEDTLS_ERR_ASN1_INVALID_DATA:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_ASN1_ALLOC_FAILED:
return( PSA_ERROR_INSUFFICIENT_MEMORY );
case MBEDTLS_ERR_ASN1_BUF_TOO_SMALL:
return( PSA_ERROR_BUFFER_TOO_SMALL );
psa: Be compatible with deprecated constants In case the new constants aren't available yet in Mbed TLS, continue to use the deprecated constants if they are available.
2019-02-20 14:57:28 +01:00
#if defined(MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA)
psa: Use new generic error codes Mbed TLS has deprecated a few module specific error codes in favor of more general-purpose or cross-module error codes. Use these new error codes instead of the deprecated error codes.
2019-02-11 13:21:12 +01:00
case MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA:
psa: Be compatible with deprecated constants In case the new constants aren't available yet in Mbed TLS, continue to use the deprecated constants if they are available.
2019-02-20 14:57:28 +01:00
#endif
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
case MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_CCM_BAD_INPUT:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_CCM_AUTH_FAILED:
return( PSA_ERROR_INVALID_SIGNATURE );
Implement ChaCha20 and ChaCha20-Poly1305 Smoke tests: test data for ChaCha20 calculated with PyCryptodome; test vector from RFC 7539 for ChaCha20-Poly1305.
2019-05-06 15:25:00 +02:00
case MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_CHACHAPOLY_BAD_STATE:
return( PSA_ERROR_BAD_STATE );
case MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED:
return( PSA_ERROR_INVALID_SIGNATURE );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
case MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_CIPHER_ALLOC_FAILED:
return( PSA_ERROR_INSUFFICIENT_MEMORY );
case MBEDTLS_ERR_CIPHER_INVALID_PADDING:
return( PSA_ERROR_INVALID_PADDING );
case MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED:
Use PSA_ERROR_INVALID_ARGUMENT for invalid cipher input sizes ... as opposed to PSA_ERROR_BAD_STATE. The spec on psa_cipher_finish() states that PSA_ERROR_INVALID_ARGUMENT should be returned when: "The total input size passed to this operation is not valid for this particular algorithm. For example, the algorithm is a based on block cipher and requires a whole number of blocks, but the total input size is not a multiple of the block size." Currently, there is a distinction between encryption and decryption on whether INVALID_ARGUMENT or BAD_STATE is returned, but this is not a part of the spec. This fix ensures that PSA_ERROR_INVALID_ARGUMENT is returned consistently on invalid cipher input sizes. Signed-off-by: Fredrik Strupe <fredrik.strupe@silabs.com>
2020-09-28 16:11:33 +02:00
return( PSA_ERROR_INVALID_ARGUMENT );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
case MBEDTLS_ERR_CIPHER_AUTH_FAILED:
return( PSA_ERROR_INVALID_SIGNATURE );
case MBEDTLS_ERR_CIPHER_INVALID_CONTEXT:
Rename PSA_ERROR_TAMPERING_DETECTED to ..._CORRUPTION_DETECTED “Tampering detected” was misleading because in the real world it can also arise due to a software bug. “Corruption detected” is neutral and more precisely reflects what can trigger the error. perl -i -pe 's/PSA_ERROR_TAMPERING_DETECTED/PSA_ERROR_CORRUPTION_DETECTED/gi' $(git ls-files)
2019-05-16 21:35:18 +02:00
return( PSA_ERROR_CORRUPTION_DETECTED );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
PSA: support HMAC_DRBG Support using HMAC_DRBG instead of CTR_DRBG in the PSA subsystem. Use HMAC_DRBG if CTR_DRBG is available. Choose between SHA-256 and SHA-512 based on availability. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 21:31:17 +01:00
#if !( defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) || \
defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE) )
Explain the conditions for checking DRBG error codes Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-23 21:00:09 +01:00
/* Only check CTR_DRBG error codes if underlying mbedtls_xxx
* functions are passed a CTR_DRBG instance. */
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
case MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED:
return( PSA_ERROR_INSUFFICIENT_ENTROPY );
case MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG:
case MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR:
return( PSA_ERROR_INSUFFICIENT_ENTROPY );
PSA: support HMAC_DRBG Support using HMAC_DRBG instead of CTR_DRBG in the PSA subsystem. Use HMAC_DRBG if CTR_DRBG is available. Choose between SHA-256 and SHA-512 based on availability. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 21:31:17 +01:00
#endif
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
case MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH:
return( PSA_ERROR_NOT_SUPPORTED );
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
case MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED:
case MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE:
case MBEDTLS_ERR_ENTROPY_SOURCE_FAILED:
return( PSA_ERROR_INSUFFICIENT_ENTROPY );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
case MBEDTLS_ERR_GCM_AUTH_FAILED:
return( PSA_ERROR_INVALID_SIGNATURE );
Remove output buffer limitation for PSA with GCM. The requirement of minimum 15 bytes for output buffer in psa_aead_finish() and psa_aead_verify() does not apply to the built-in implementation of the GCM. Alternative implementations are expected to verify the length of the provided output buffers and to return the MBEDTLS_ERR_GCM_BUFFER_TOO_SMALL in case the buffer length is too small. Signed-off-by: Mateusz Starzyk <mateusz.starzyk@mobica.com>
2021-09-30 16:39:07 +02:00
case MBEDTLS_ERR_GCM_BUFFER_TOO_SMALL:
return( PSA_ERROR_BUFFER_TOO_SMALL );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
case MBEDTLS_ERR_GCM_BAD_INPUT:
Translate GCM_BAD_INPUT to INVALID_ARGUMENT, not NOT_SUPPORTED
2018-08-21 15:07:38 +02:00
return( PSA_ERROR_INVALID_ARGUMENT );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
PSA: support HMAC_DRBG Support using HMAC_DRBG instead of CTR_DRBG in the PSA subsystem. Use HMAC_DRBG if CTR_DRBG is available. Choose between SHA-256 and SHA-512 based on availability. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 21:31:17 +01:00
#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) && \
defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE)
Explain the conditions for checking DRBG error codes Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-23 21:00:09 +01:00
/* Only check HMAC_DRBG error codes if underlying mbedtls_xxx
* functions are passed a HMAC_DRBG instance. */
PSA: support HMAC_DRBG Support using HMAC_DRBG instead of CTR_DRBG in the PSA subsystem. Use HMAC_DRBG if CTR_DRBG is available. Choose between SHA-256 and SHA-512 based on availability. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 21:31:17 +01:00
case MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED:
return( PSA_ERROR_INSUFFICIENT_ENTROPY );
case MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG:
case MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR:
return( PSA_ERROR_INSUFFICIENT_ENTROPY );
#endif
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
case MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_MD_BAD_INPUT_DATA:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_MD_ALLOC_FAILED:
return( PSA_ERROR_INSUFFICIENT_MEMORY );
case MBEDTLS_ERR_MD_FILE_IO_ERROR:
return( PSA_ERROR_STORAGE_FAILURE );
Private EC key format: change to raw secret value (doc, import) Change the import/export format of private elliptic curve keys from RFC 5915 to the raw secret value. This commit updates the format specification and the import code, but not the export code.
2018-10-29 19:24:33 +01:00
case MBEDTLS_ERR_MPI_FILE_IO_ERROR:
return( PSA_ERROR_STORAGE_FAILURE );
case MBEDTLS_ERR_MPI_BAD_INPUT_DATA:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_MPI_INVALID_CHARACTER:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL:
return( PSA_ERROR_BUFFER_TOO_SMALL );
case MBEDTLS_ERR_MPI_NEGATIVE_VALUE:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_MPI_DIVISION_BY_ZERO:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_MPI_NOT_ACCEPTABLE:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_MPI_ALLOC_FAILED:
return( PSA_ERROR_INSUFFICIENT_MEMORY );
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
case MBEDTLS_ERR_PK_ALLOC_FAILED:
return( PSA_ERROR_INSUFFICIENT_MEMORY );
case MBEDTLS_ERR_PK_TYPE_MISMATCH:
case MBEDTLS_ERR_PK_BAD_INPUT_DATA:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_PK_FILE_IO_ERROR:
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
return( PSA_ERROR_STORAGE_FAILURE );
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
case MBEDTLS_ERR_PK_KEY_INVALID_VERSION:
case MBEDTLS_ERR_PK_KEY_INVALID_FORMAT:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_PK_UNKNOWN_PK_ALG:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_PK_PASSWORD_REQUIRED:
case MBEDTLS_ERR_PK_PASSWORD_MISMATCH:
return( PSA_ERROR_NOT_PERMITTED );
case MBEDTLS_ERR_PK_INVALID_PUBKEY:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_PK_INVALID_ALG:
case MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE:
case MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_PK_SIG_LEN_MISMATCH:
return( PSA_ERROR_INVALID_SIGNATURE );
Translate MBEDTLS_ERR_PK_BUFFER_TOO_SMALL for PSA The error is currently never returned to any function that PSA calls, but keep mbedtls_to_psa_error up to date in case this changes. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-06-23 20:32:27 +02:00
case MBEDTLS_ERR_PK_BUFFER_TOO_SMALL:
return( PSA_ERROR_BUFFER_TOO_SMALL );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
Always include platform.h for MBEDTLS_ERR_PLATFORM_xxx Recognize MBEDTLS_ERR_PLATFORM_xxx in mbedtls_to_psa_error().
2019-05-06 15:26:23 +02:00
case MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
return( PSA_ERROR_NOT_SUPPORTED );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
case MBEDTLS_ERR_RSA_BAD_INPUT_DATA:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_RSA_INVALID_PADDING:
return( PSA_ERROR_INVALID_PADDING );
case MBEDTLS_ERR_RSA_KEY_GEN_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_RSA_KEY_CHECK_FAILED:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_RSA_PUBLIC_FAILED:
case MBEDTLS_ERR_RSA_PRIVATE_FAILED:
Rename PSA_ERROR_TAMPERING_DETECTED to ..._CORRUPTION_DETECTED “Tampering detected” was misleading because in the real world it can also arise due to a software bug. “Corruption detected” is neutral and more precisely reflects what can trigger the error. perl -i -pe 's/PSA_ERROR_TAMPERING_DETECTED/PSA_ERROR_CORRUPTION_DETECTED/gi' $(git ls-files)
2019-05-16 21:35:18 +02:00
return( PSA_ERROR_CORRUPTION_DETECTED );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
case MBEDTLS_ERR_RSA_VERIFY_FAILED:
return( PSA_ERROR_INVALID_SIGNATURE );
case MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE:
return( PSA_ERROR_BUFFER_TOO_SMALL );
case MBEDTLS_ERR_RSA_RNG_FAILED:
mbedtls_to_psa_error: fix a copypasta and a missing translation Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-25 00:09:47 +01:00
return( PSA_ERROR_INSUFFICIENT_ENTROPY );
Revert "Remove deprecated things from hashing modules" This reverts commit c75d9f589bf392177dbeba7704693e53fe55cb19. This was merged by mistake in development instead of development_3.0. Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2021-04-15 12:23:55 +02:00
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 10:18:38 +02:00
case MBEDTLS_ERR_ECP_BAD_INPUT_DATA:
Added handling for MBEDTLS_ERR_ECP_XXX error codes Added handling for MBEDTLS_ERR_ECP_XXX error codes
2018-05-09 15:07:36 +02:00
case MBEDTLS_ERR_ECP_INVALID_KEY:
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 10:18:38 +02:00
return( PSA_ERROR_INVALID_ARGUMENT );
Added handling for MBEDTLS_ERR_ECP_XXX error codes Added handling for MBEDTLS_ERR_ECP_XXX error codes
2018-05-09 15:07:36 +02:00
case MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL:
return( PSA_ERROR_BUFFER_TOO_SMALL );
case MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH:
case MBEDTLS_ERR_ECP_VERIFY_FAILED:
return( PSA_ERROR_INVALID_SIGNATURE );
case MBEDTLS_ERR_ECP_ALLOC_FAILED:
return( PSA_ERROR_INSUFFICIENT_MEMORY );
mbedtls_to_psa_error: fix a copypasta and a missing translation Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-25 00:09:47 +01:00
case MBEDTLS_ERR_ECP_RANDOM_FAILED:
return( PSA_ERROR_INSUFFICIENT_ENTROPY );
Map the new Mbed TLS error value in PSA
2019-11-22 13:48:59 +01:00
case MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED:
return( PSA_ERROR_CORRUPTION_DETECTED );
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 10:18:38 +02:00
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
default:
Replace PSA error code definitions with the ones defined in PSA spec
2019-02-14 12:48:10 +01:00
return( PSA_ERROR_GENERIC_ERROR );
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
}
}
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
Be more consistent about blank lines
2018-06-18 21:49:39 +02:00
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
/****************************************************************/
/* Key management */
/****************************************************************/
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 21:28:15 +01:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 17:50:04 +01:00
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) || \
psa: Fix obsolete code guard Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-11-19 18:02:34 +01:00
defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
Rename ECC Family Macros According to PSA Spec Rename PSA_ECC_CURVE_xxx to PSA_ECC_FAMILY_xxx, also rename PSA_KEY_TYPE_GET_CURVE to PSA_KEY_TYPE_ECC_GET_FAMILY and rename psa_ecc_curve_t to psa_ecc_family_t. Old defines are provided in include/crypto_compat.h for backward compatibility. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2020-06-02 18:19:28 +02:00
mbedtls_ecp_group_id mbedtls_ecc_group_of_psa( psa_ecc_family_t curve,
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 15:44:45 +01:00
size_t bits,
int bits_is_sloppy )
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-20 00:20:32 +02:00
{
switch( curve )
{
Rename ECC Family Macros According to PSA Spec Rename PSA_ECC_CURVE_xxx to PSA_ECC_FAMILY_xxx, also rename PSA_KEY_TYPE_GET_CURVE to PSA_KEY_TYPE_ECC_GET_FAMILY and rename psa_ecc_curve_t to psa_ecc_family_t. Old defines are provided in include/crypto_compat.h for backward compatibility. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2020-06-02 18:19:28 +02:00
case PSA_ECC_FAMILY_SECP_R1:
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 15:44:45 +01:00
switch( bits )
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 17:24:19 +01:00
{
PSA: Reject curves that are not enabled in the PSA configuration If an elliptic curve was enabled in the Mbed TLS classic API (#define MBEDTLS_ECP_DP_xxx), but not enabled in the PSA configuration (#define PSA_WANT_ECC_xxx), it would still work if you tried to use it through PSA. This is generally benign, but could be a security issue if you want to disable a curve in PSA for some security reason (such as a known bug in its implementation, which may not matter in the classic API if Mbed TLS is running in a secure enclave and is only reachable from untrusted callers through the PSA API). More urgently, this broke test_suite_psa_crypto_not_supported.generated. So if a curve is not enabled in the PSA configuration, ensure that it's treated as unsupported through the PSA software implementation. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-03-23 13:12:34 +01:00
#if defined(PSA_WANT_ECC_SECP_R1_192)
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 15:44:45 +01:00
case 192:
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 17:24:19 +01:00
return( MBEDTLS_ECP_DP_SECP192R1 );
PSA: Reject curves that are not enabled in the PSA configuration If an elliptic curve was enabled in the Mbed TLS classic API (#define MBEDTLS_ECP_DP_xxx), but not enabled in the PSA configuration (#define PSA_WANT_ECC_xxx), it would still work if you tried to use it through PSA. This is generally benign, but could be a security issue if you want to disable a curve in PSA for some security reason (such as a known bug in its implementation, which may not matter in the classic API if Mbed TLS is running in a secure enclave and is only reachable from untrusted callers through the PSA API). More urgently, this broke test_suite_psa_crypto_not_supported.generated. So if a curve is not enabled in the PSA configuration, ensure that it's treated as unsupported through the PSA software implementation. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-03-23 13:12:34 +01:00
#endif
#if defined(PSA_WANT_ECC_SECP_R1_224)
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 15:44:45 +01:00
case 224:
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 17:24:19 +01:00
return( MBEDTLS_ECP_DP_SECP224R1 );
PSA: Reject curves that are not enabled in the PSA configuration If an elliptic curve was enabled in the Mbed TLS classic API (#define MBEDTLS_ECP_DP_xxx), but not enabled in the PSA configuration (#define PSA_WANT_ECC_xxx), it would still work if you tried to use it through PSA. This is generally benign, but could be a security issue if you want to disable a curve in PSA for some security reason (such as a known bug in its implementation, which may not matter in the classic API if Mbed TLS is running in a secure enclave and is only reachable from untrusted callers through the PSA API). More urgently, this broke test_suite_psa_crypto_not_supported.generated. So if a curve is not enabled in the PSA configuration, ensure that it's treated as unsupported through the PSA software implementation. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-03-23 13:12:34 +01:00
#endif
#if defined(PSA_WANT_ECC_SECP_R1_256)
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 15:44:45 +01:00
case 256:
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 17:24:19 +01:00
return( MBEDTLS_ECP_DP_SECP256R1 );
PSA: Reject curves that are not enabled in the PSA configuration If an elliptic curve was enabled in the Mbed TLS classic API (#define MBEDTLS_ECP_DP_xxx), but not enabled in the PSA configuration (#define PSA_WANT_ECC_xxx), it would still work if you tried to use it through PSA. This is generally benign, but could be a security issue if you want to disable a curve in PSA for some security reason (such as a known bug in its implementation, which may not matter in the classic API if Mbed TLS is running in a secure enclave and is only reachable from untrusted callers through the PSA API). More urgently, this broke test_suite_psa_crypto_not_supported.generated. So if a curve is not enabled in the PSA configuration, ensure that it's treated as unsupported through the PSA software implementation. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-03-23 13:12:34 +01:00
#endif
#if defined(PSA_WANT_ECC_SECP_R1_384)
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 15:44:45 +01:00
case 384:
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 17:24:19 +01:00
return( MBEDTLS_ECP_DP_SECP384R1 );
PSA: Reject curves that are not enabled in the PSA configuration If an elliptic curve was enabled in the Mbed TLS classic API (#define MBEDTLS_ECP_DP_xxx), but not enabled in the PSA configuration (#define PSA_WANT_ECC_xxx), it would still work if you tried to use it through PSA. This is generally benign, but could be a security issue if you want to disable a curve in PSA for some security reason (such as a known bug in its implementation, which may not matter in the classic API if Mbed TLS is running in a secure enclave and is only reachable from untrusted callers through the PSA API). More urgently, this broke test_suite_psa_crypto_not_supported.generated. So if a curve is not enabled in the PSA configuration, ensure that it's treated as unsupported through the PSA software implementation. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-03-23 13:12:34 +01:00
#endif
#if defined(PSA_WANT_ECC_SECP_R1_521)
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 15:44:45 +01:00
case 521:
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 17:24:19 +01:00
return( MBEDTLS_ECP_DP_SECP521R1 );
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 15:44:45 +01:00
case 528:
if( bits_is_sloppy )
return( MBEDTLS_ECP_DP_SECP521R1 );
break;
PSA: Reject curves that are not enabled in the PSA configuration If an elliptic curve was enabled in the Mbed TLS classic API (#define MBEDTLS_ECP_DP_xxx), but not enabled in the PSA configuration (#define PSA_WANT_ECC_xxx), it would still work if you tried to use it through PSA. This is generally benign, but could be a security issue if you want to disable a curve in PSA for some security reason (such as a known bug in its implementation, which may not matter in the classic API if Mbed TLS is running in a secure enclave and is only reachable from untrusted callers through the PSA API). More urgently, this broke test_suite_psa_crypto_not_supported.generated. So if a curve is not enabled in the PSA configuration, ensure that it's treated as unsupported through the PSA software implementation. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-03-23 13:12:34 +01:00
#endif
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 17:24:19 +01:00
}
break;
Rename ECC Family Macros According to PSA Spec Rename PSA_ECC_CURVE_xxx to PSA_ECC_FAMILY_xxx, also rename PSA_KEY_TYPE_GET_CURVE to PSA_KEY_TYPE_ECC_GET_FAMILY and rename psa_ecc_curve_t to psa_ecc_family_t. Old defines are provided in include/crypto_compat.h for backward compatibility. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2020-06-02 18:19:28 +02:00
case PSA_ECC_FAMILY_BRAINPOOL_P_R1:
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 15:44:45 +01:00
switch( bits )
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 17:24:19 +01:00
{
PSA: Reject curves that are not enabled in the PSA configuration If an elliptic curve was enabled in the Mbed TLS classic API (#define MBEDTLS_ECP_DP_xxx), but not enabled in the PSA configuration (#define PSA_WANT_ECC_xxx), it would still work if you tried to use it through PSA. This is generally benign, but could be a security issue if you want to disable a curve in PSA for some security reason (such as a known bug in its implementation, which may not matter in the classic API if Mbed TLS is running in a secure enclave and is only reachable from untrusted callers through the PSA API). More urgently, this broke test_suite_psa_crypto_not_supported.generated. So if a curve is not enabled in the PSA configuration, ensure that it's treated as unsupported through the PSA software implementation. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-03-23 13:12:34 +01:00
#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_256)
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 15:44:45 +01:00
case 256:
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 17:24:19 +01:00
return( MBEDTLS_ECP_DP_BP256R1 );
PSA: Reject curves that are not enabled in the PSA configuration If an elliptic curve was enabled in the Mbed TLS classic API (#define MBEDTLS_ECP_DP_xxx), but not enabled in the PSA configuration (#define PSA_WANT_ECC_xxx), it would still work if you tried to use it through PSA. This is generally benign, but could be a security issue if you want to disable a curve in PSA for some security reason (such as a known bug in its implementation, which may not matter in the classic API if Mbed TLS is running in a secure enclave and is only reachable from untrusted callers through the PSA API). More urgently, this broke test_suite_psa_crypto_not_supported.generated. So if a curve is not enabled in the PSA configuration, ensure that it's treated as unsupported through the PSA software implementation. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-03-23 13:12:34 +01:00
#endif
#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_384)
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 15:44:45 +01:00
case 384:
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 17:24:19 +01:00
return( MBEDTLS_ECP_DP_BP384R1 );
PSA: Reject curves that are not enabled in the PSA configuration If an elliptic curve was enabled in the Mbed TLS classic API (#define MBEDTLS_ECP_DP_xxx), but not enabled in the PSA configuration (#define PSA_WANT_ECC_xxx), it would still work if you tried to use it through PSA. This is generally benign, but could be a security issue if you want to disable a curve in PSA for some security reason (such as a known bug in its implementation, which may not matter in the classic API if Mbed TLS is running in a secure enclave and is only reachable from untrusted callers through the PSA API). More urgently, this broke test_suite_psa_crypto_not_supported.generated. So if a curve is not enabled in the PSA configuration, ensure that it's treated as unsupported through the PSA software implementation. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-03-23 13:12:34 +01:00
#endif
#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_512)
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 15:44:45 +01:00
case 512:
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 17:24:19 +01:00
return( MBEDTLS_ECP_DP_BP512R1 );
PSA: Reject curves that are not enabled in the PSA configuration If an elliptic curve was enabled in the Mbed TLS classic API (#define MBEDTLS_ECP_DP_xxx), but not enabled in the PSA configuration (#define PSA_WANT_ECC_xxx), it would still work if you tried to use it through PSA. This is generally benign, but could be a security issue if you want to disable a curve in PSA for some security reason (such as a known bug in its implementation, which may not matter in the classic API if Mbed TLS is running in a secure enclave and is only reachable from untrusted callers through the PSA API). More urgently, this broke test_suite_psa_crypto_not_supported.generated. So if a curve is not enabled in the PSA configuration, ensure that it's treated as unsupported through the PSA software implementation. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-03-23 13:12:34 +01:00
#endif
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 17:24:19 +01:00
}
break;
Rename ECC Family Macros According to PSA Spec Rename PSA_ECC_CURVE_xxx to PSA_ECC_FAMILY_xxx, also rename PSA_KEY_TYPE_GET_CURVE to PSA_KEY_TYPE_ECC_GET_FAMILY and rename psa_ecc_curve_t to psa_ecc_family_t. Old defines are provided in include/crypto_compat.h for backward compatibility. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2020-06-02 18:19:28 +02:00
case PSA_ECC_FAMILY_MONTGOMERY:
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 15:44:45 +01:00
switch( bits )
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 17:24:19 +01:00
{
PSA: Reject curves that are not enabled in the PSA configuration If an elliptic curve was enabled in the Mbed TLS classic API (#define MBEDTLS_ECP_DP_xxx), but not enabled in the PSA configuration (#define PSA_WANT_ECC_xxx), it would still work if you tried to use it through PSA. This is generally benign, but could be a security issue if you want to disable a curve in PSA for some security reason (such as a known bug in its implementation, which may not matter in the classic API if Mbed TLS is running in a secure enclave and is only reachable from untrusted callers through the PSA API). More urgently, this broke test_suite_psa_crypto_not_supported.generated. So if a curve is not enabled in the PSA configuration, ensure that it's treated as unsupported through the PSA software implementation. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-03-23 13:12:34 +01:00
#if defined(PSA_WANT_ECC_MONTGOMERY_255)
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 15:44:45 +01:00
case 255:
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 17:24:19 +01:00
return( MBEDTLS_ECP_DP_CURVE25519 );
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 15:44:45 +01:00
case 256:
if( bits_is_sloppy )
return( MBEDTLS_ECP_DP_CURVE25519 );
break;
PSA: Reject curves that are not enabled in the PSA configuration If an elliptic curve was enabled in the Mbed TLS classic API (#define MBEDTLS_ECP_DP_xxx), but not enabled in the PSA configuration (#define PSA_WANT_ECC_xxx), it would still work if you tried to use it through PSA. This is generally benign, but could be a security issue if you want to disable a curve in PSA for some security reason (such as a known bug in its implementation, which may not matter in the classic API if Mbed TLS is running in a secure enclave and is only reachable from untrusted callers through the PSA API). More urgently, this broke test_suite_psa_crypto_not_supported.generated. So if a curve is not enabled in the PSA configuration, ensure that it's treated as unsupported through the PSA software implementation. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-03-23 13:12:34 +01:00
#endif
#if defined(PSA_WANT_ECC_MONTGOMERY_448)
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 15:44:45 +01:00
case 448:
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 17:24:19 +01:00
return( MBEDTLS_ECP_DP_CURVE448 );
PSA: Reject curves that are not enabled in the PSA configuration If an elliptic curve was enabled in the Mbed TLS classic API (#define MBEDTLS_ECP_DP_xxx), but not enabled in the PSA configuration (#define PSA_WANT_ECC_xxx), it would still work if you tried to use it through PSA. This is generally benign, but could be a security issue if you want to disable a curve in PSA for some security reason (such as a known bug in its implementation, which may not matter in the classic API if Mbed TLS is running in a secure enclave and is only reachable from untrusted callers through the PSA API). More urgently, this broke test_suite_psa_crypto_not_supported.generated. So if a curve is not enabled in the PSA configuration, ensure that it's treated as unsupported through the PSA software implementation. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-03-23 13:12:34 +01:00
#endif
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 17:24:19 +01:00
}
break;
Rename ECC Family Macros According to PSA Spec Rename PSA_ECC_CURVE_xxx to PSA_ECC_FAMILY_xxx, also rename PSA_KEY_TYPE_GET_CURVE to PSA_KEY_TYPE_ECC_GET_FAMILY and rename psa_ecc_curve_t to psa_ecc_family_t. Old defines are provided in include/crypto_compat.h for backward compatibility. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2020-06-02 18:19:28 +02:00
case PSA_ECC_FAMILY_SECP_K1:
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 15:44:45 +01:00
switch( bits )
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 17:24:19 +01:00
{
PSA: Reject curves that are not enabled in the PSA configuration If an elliptic curve was enabled in the Mbed TLS classic API (#define MBEDTLS_ECP_DP_xxx), but not enabled in the PSA configuration (#define PSA_WANT_ECC_xxx), it would still work if you tried to use it through PSA. This is generally benign, but could be a security issue if you want to disable a curve in PSA for some security reason (such as a known bug in its implementation, which may not matter in the classic API if Mbed TLS is running in a secure enclave and is only reachable from untrusted callers through the PSA API). More urgently, this broke test_suite_psa_crypto_not_supported.generated. So if a curve is not enabled in the PSA configuration, ensure that it's treated as unsupported through the PSA software implementation. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-03-23 13:12:34 +01:00
#if defined(PSA_WANT_ECC_SECP_K1_192)
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 15:44:45 +01:00
case 192:
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 17:24:19 +01:00
return( MBEDTLS_ECP_DP_SECP192K1 );
PSA: Reject curves that are not enabled in the PSA configuration If an elliptic curve was enabled in the Mbed TLS classic API (#define MBEDTLS_ECP_DP_xxx), but not enabled in the PSA configuration (#define PSA_WANT_ECC_xxx), it would still work if you tried to use it through PSA. This is generally benign, but could be a security issue if you want to disable a curve in PSA for some security reason (such as a known bug in its implementation, which may not matter in the classic API if Mbed TLS is running in a secure enclave and is only reachable from untrusted callers through the PSA API). More urgently, this broke test_suite_psa_crypto_not_supported.generated. So if a curve is not enabled in the PSA configuration, ensure that it's treated as unsupported through the PSA software implementation. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-03-23 13:12:34 +01:00
#endif
#if defined(PSA_WANT_ECC_SECP_K1_224)
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 15:44:45 +01:00
case 224:
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 17:24:19 +01:00
return( MBEDTLS_ECP_DP_SECP224K1 );
PSA: Reject curves that are not enabled in the PSA configuration If an elliptic curve was enabled in the Mbed TLS classic API (#define MBEDTLS_ECP_DP_xxx), but not enabled in the PSA configuration (#define PSA_WANT_ECC_xxx), it would still work if you tried to use it through PSA. This is generally benign, but could be a security issue if you want to disable a curve in PSA for some security reason (such as a known bug in its implementation, which may not matter in the classic API if Mbed TLS is running in a secure enclave and is only reachable from untrusted callers through the PSA API). More urgently, this broke test_suite_psa_crypto_not_supported.generated. So if a curve is not enabled in the PSA configuration, ensure that it's treated as unsupported through the PSA software implementation. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-03-23 13:12:34 +01:00
#endif
#if defined(PSA_WANT_ECC_SECP_K1_256)
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 15:44:45 +01:00
case 256:
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 17:24:19 +01:00
return( MBEDTLS_ECP_DP_SECP256K1 );
PSA: Reject curves that are not enabled in the PSA configuration If an elliptic curve was enabled in the Mbed TLS classic API (#define MBEDTLS_ECP_DP_xxx), but not enabled in the PSA configuration (#define PSA_WANT_ECC_xxx), it would still work if you tried to use it through PSA. This is generally benign, but could be a security issue if you want to disable a curve in PSA for some security reason (such as a known bug in its implementation, which may not matter in the classic API if Mbed TLS is running in a secure enclave and is only reachable from untrusted callers through the PSA API). More urgently, this broke test_suite_psa_crypto_not_supported.generated. So if a curve is not enabled in the PSA configuration, ensure that it's treated as unsupported through the PSA software implementation. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-03-23 13:12:34 +01:00
#endif
Define EC curve family constants Define constants for ECC curve families and DH group families. These constants have 0x0000 in the lower 16 bits of the key type. Support these constants in the implementation and in the PSA metadata tests. Switch the slot management and secure element driver HAL tests to the new curve encodings. This requires SE driver code to become slightly more clever when figuring out the bit-size of an imported EC key since it now needs to take the data size into account. Switch some documentation to the new encodings. Remove the macro PSA_ECC_CURVE_BITS which can no longer be implemented.
2019-12-03 17:24:19 +01:00
}
break;
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-20 00:20:32 +02:00
}
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 15:44:45 +01:00
Fix unused parameter warning in some configurations Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-03-23 14:17:55 +01:00
(void) bits_is_sloppy;
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 15:44:45 +01:00
return( MBEDTLS_ECP_DP_NONE );
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-20 00:20:32 +02:00
}
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 21:28:15 +01:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
psa: Fix obsolete code guard Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-11-19 18:02:34 +01:00
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) ||
defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) ||
defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH) */
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-20 00:20:32 +02:00
Add test driver support for opaque key import -Add test driver support to import/export while wrapping keys meant to be stored in the PSA core as opaque( emulating an SE without storage ). -Export validate_unstructured_key_bit_size as psa_validate_unstructured_key_bit_size, thereby changing its scope. -Improve the import/export test cases in test_suite_psa_crypto to also cover opaque keys, thereby avoiding duplication. Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-07-06 23:20:22 +02:00
psa_status_t psa_validate_unstructured_key_bit_size( psa_key_type_t type,
Code style improvements Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-09-08 12:06:05 +02:00
size_t bits )
psa_import_key: validate symmetric key size When importing a symmetric key, validate that the key size is valid for the given key type. Non-supported key types may no longer be imported.
2018-06-19 21:31:50 +02:00
{
/* Check that the bit size is acceptable for the key type */
switch( type )
{
case PSA_KEY_TYPE_RAW_DATA:
case PSA_KEY_TYPE_HMAC:
Add framework for simple key derivation New key type PSA_KEY_TYPE_DERIVE. New usage flag PSA_KEY_USAGE_DERIVE. New function psa_key_derivation. No key derivation algorithm is implemented yet. The code may not compile with -Wunused. Write some unit test code for psa_key_derivation. Most of it cannot be used yet due to the lack of a key derivation algorithm.
2018-07-12 17:17:20 +02:00
case PSA_KEY_TYPE_DERIVE:
Allow KEY_TYPE_PASSWORD/KEY_TYPE_PASSWORD_HASH to be imported Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
2022-05-25 11:30:27 +02:00
case PSA_KEY_TYPE_PASSWORD:
case PSA_KEY_TYPE_PASSWORD_HASH:
Add framework for simple key derivation New key type PSA_KEY_TYPE_DERIVE. New usage flag PSA_KEY_USAGE_DERIVE. New function psa_key_derivation. No key derivation algorithm is implemented yet. The code may not compile with -Wunused. Write some unit test code for psa_key_derivation. Most of it cannot be used yet due to the lack of a key derivation algorithm.
2018-07-12 17:17:20 +02:00
break;
psa: cipher: Fix symmetric key management Symmetric key management is not intended to be delegated to drivers. Thus, key management code for a given symmetric key type should be included in the library whether or not the support for cryptographic operations based on that type of symmetric key may be delegated to drivers. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-12 09:59:30 +01:00
#if defined(PSA_WANT_KEY_TYPE_AES)
psa_import_key: validate symmetric key size When importing a symmetric key, validate that the key size is valid for the given key type. Non-supported key types may no longer be imported.
2018-06-19 21:31:50 +02:00
case PSA_KEY_TYPE_AES:
if( bits != 128 && bits != 192 && bits != 256 )
return( PSA_ERROR_INVALID_ARGUMENT );
break;
#endif
Add ARIA to the PSA API Use the encoding from an upcoming version of the specification. Add as much (or as little) testing as is currently present for Camellia. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-09-21 11:59:39 +02:00
#if defined(PSA_WANT_KEY_TYPE_ARIA)
case PSA_KEY_TYPE_ARIA:
if( bits != 128 && bits != 192 && bits != 256 )
psa_import_key: validate symmetric key size When importing a symmetric key, validate that the key size is valid for the given key type. Non-supported key types may no longer be imported.
2018-06-19 21:31:50 +02:00
return( PSA_ERROR_INVALID_ARGUMENT );
break;
#endif
psa: cipher: Fix symmetric key management Symmetric key management is not intended to be delegated to drivers. Thus, key management code for a given symmetric key type should be included in the library whether or not the support for cryptographic operations based on that type of symmetric key may be delegated to drivers. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-12 09:59:30 +01:00
#if defined(PSA_WANT_KEY_TYPE_CAMELLIA)
psa_import_key: validate symmetric key size When importing a symmetric key, validate that the key size is valid for the given key type. Non-supported key types may no longer be imported.
2018-06-19 21:31:50 +02:00
case PSA_KEY_TYPE_CAMELLIA:
if( bits != 128 && bits != 192 && bits != 256 )
return( PSA_ERROR_INVALID_ARGUMENT );
break;
#endif
psa: cipher: Fix symmetric key management Symmetric key management is not intended to be delegated to drivers. Thus, key management code for a given symmetric key type should be included in the library whether or not the support for cryptographic operations based on that type of symmetric key may be delegated to drivers. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-12 09:59:30 +01:00
#if defined(PSA_WANT_KEY_TYPE_DES)
psa_import_key: validate symmetric key size When importing a symmetric key, validate that the key size is valid for the given key type. Non-supported key types may no longer be imported.
2018-06-19 21:31:50 +02:00
case PSA_KEY_TYPE_DES:
if( bits != 64 && bits != 128 && bits != 192 )
return( PSA_ERROR_INVALID_ARGUMENT );
break;
#endif
psa: cipher: Fix symmetric key management Symmetric key management is not intended to be delegated to drivers. Thus, key management code for a given symmetric key type should be included in the library whether or not the support for cryptographic operations based on that type of symmetric key may be delegated to drivers. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-12 09:59:30 +01:00
#if defined(PSA_WANT_KEY_TYPE_CHACHA20)
Implement ChaCha20 and ChaCha20-Poly1305 Smoke tests: test data for ChaCha20 calculated with PyCryptodome; test vector from RFC 7539 for ChaCha20-Poly1305.
2019-05-06 15:25:00 +02:00
case PSA_KEY_TYPE_CHACHA20:
if( bits != 256 )
return( PSA_ERROR_INVALID_ARGUMENT );
break;
psa_import_key: validate symmetric key size When importing a symmetric key, validate that the key size is valid for the given key type. Non-supported key types may no longer be imported.
2018-06-19 21:31:50 +02:00
#endif
default:
return( PSA_ERROR_NOT_SUPPORTED );
}
Refuse non-byte-sized raw data keys Since the key size is stored in bytes, we can't have a key whose size isn't a whole number of bytes.
2018-06-21 09:32:47 +02:00
if( bits % 8 != 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
psa_import_key: validate symmetric key size When importing a symmetric key, validate that the key size is valid for the given key type. Non-supported key types may no longer be imported.
2018-06-19 21:31:50 +02:00
return( PSA_SUCCESS );
}
Rework MAC algorithm / key type validation Reworked the validation of MAC algorithm with the used key type by introducing psa_mac_key_can_do, which guarantees that PSA_MAC_LENGTH can be called successfully after validation of the algorithm and key type. This means psa_get_mac_output_length is no longer required. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-03 19:04:05 +01:00
/** Check whether a given key type is valid for use with a given MAC algorithm
Move MAC default length checking into psa_key_policy_permits Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 15:11:57 +01:00
*
Language & code readability updates No functional/behavioral changes in this commit Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-08 12:00:27 +01:00
* Upon successful return of this function, the behavior of #PSA_MAC_LENGTH
* when called with the validated \p algorithm and \p key_type is well-defined.
Rework MAC algorithm / key type validation Reworked the validation of MAC algorithm with the used key type by introducing psa_mac_key_can_do, which guarantees that PSA_MAC_LENGTH can be called successfully after validation of the algorithm and key type. This means psa_get_mac_output_length is no longer required. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-03 19:04:05 +01:00
*
* \param[in] algorithm The specific MAC algorithm (can be wildcard).
Move MAC default length checking into psa_key_policy_permits Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 15:11:57 +01:00
* \param[in] key_type The key type of the key to be used with the
* \p algorithm.
*
* \retval #PSA_SUCCESS
Rework MAC algorithm / key type validation Reworked the validation of MAC algorithm with the used key type by introducing psa_mac_key_can_do, which guarantees that PSA_MAC_LENGTH can be called successfully after validation of the algorithm and key type. This means psa_get_mac_output_length is no longer required. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-03 19:04:05 +01:00
* The \p key_type is valid for use with the \p algorithm
Reuse PSA_MAC_LENGTH in psa_get_mac_output_length Avoid code duplication. Also update the guarantees made by the function doc to match the guarantees given by PSA_MAC_LENGTH. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 21:29:45 +01:00
* \retval #PSA_ERROR_INVALID_ARGUMENT
Rework MAC algorithm / key type validation Reworked the validation of MAC algorithm with the used key type by introducing psa_mac_key_can_do, which guarantees that PSA_MAC_LENGTH can be called successfully after validation of the algorithm and key type. This means psa_get_mac_output_length is no longer required. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-03 19:04:05 +01:00
* The \p key_type is not valid for use with the \p algorithm
Move MAC default length checking into psa_key_policy_permits Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 15:11:57 +01:00
*/
Rework MAC algorithm / key type validation Reworked the validation of MAC algorithm with the used key type by introducing psa_mac_key_can_do, which guarantees that PSA_MAC_LENGTH can be called successfully after validation of the algorithm and key type. This means psa_get_mac_output_length is no longer required. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-03 19:04:05 +01:00
MBEDTLS_STATIC_TESTABLE psa_status_t psa_mac_key_can_do(
Make psa_get_mac_output_length testable and test it Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 21:31:17 +01:00
psa_algorithm_t algorithm,
Rework MAC algorithm / key type validation Reworked the validation of MAC algorithm with the used key type by introducing psa_mac_key_can_do, which guarantees that PSA_MAC_LENGTH can be called successfully after validation of the algorithm and key type. This means psa_get_mac_output_length is no longer required. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-03 19:04:05 +01:00
psa_key_type_t key_type )
Move MAC default length checking into psa_key_policy_permits Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 15:11:57 +01:00
{
Language & code readability updates No functional/behavioral changes in this commit Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-08 12:00:27 +01:00
if( PSA_ALG_IS_HMAC( algorithm ) )
{
Rework MAC algorithm / key type validation Reworked the validation of MAC algorithm with the used key type by introducing psa_mac_key_can_do, which guarantees that PSA_MAC_LENGTH can be called successfully after validation of the algorithm and key type. This means psa_get_mac_output_length is no longer required. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-03 19:04:05 +01:00
if( key_type == PSA_KEY_TYPE_HMAC )
return( PSA_SUCCESS );
Move MAC default length checking into psa_key_policy_permits Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 15:11:57 +01:00
}
Rework MAC algorithm / key type validation Reworked the validation of MAC algorithm with the used key type by introducing psa_mac_key_can_do, which guarantees that PSA_MAC_LENGTH can be called successfully after validation of the algorithm and key type. This means psa_get_mac_output_length is no longer required. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-03 19:04:05 +01:00
if( PSA_ALG_IS_BLOCK_CIPHER_MAC( algorithm ) )
Move MAC default length checking into psa_key_policy_permits Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 15:11:57 +01:00
{
Rework MAC algorithm / key type validation Reworked the validation of MAC algorithm with the used key type by introducing psa_mac_key_can_do, which guarantees that PSA_MAC_LENGTH can be called successfully after validation of the algorithm and key type. This means psa_get_mac_output_length is no longer required. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-03 19:04:05 +01:00
/* Check that we're calling PSA_BLOCK_CIPHER_BLOCK_LENGTH with a cipher
* key. */
if( ( key_type & PSA_KEY_TYPE_CATEGORY_MASK ) ==
PSA_KEY_TYPE_CATEGORY_SYMMETRIC )
{
/* PSA_BLOCK_CIPHER_BLOCK_LENGTH returns 1 for stream ciphers and
* the block length (larger than 1) for block ciphers. */
if( PSA_BLOCK_CIPHER_BLOCK_LENGTH( key_type ) > 1 )
return( PSA_SUCCESS );
}
Move MAC default length checking into psa_key_policy_permits Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 15:11:57 +01:00
}
Rework MAC algorithm / key type validation Reworked the validation of MAC algorithm with the used key type by introducing psa_mac_key_can_do, which guarantees that PSA_MAC_LENGTH can be called successfully after validation of the algorithm and key type. This means psa_get_mac_output_length is no longer required. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-03 19:04:05 +01:00
return( PSA_ERROR_INVALID_ARGUMENT );
Move MAC default length checking into psa_key_policy_permits Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 15:11:57 +01:00
}
leverage psa_allocate_buffer_to_slot from slot management It makes the implementation of psa_load_builtin_key_into_slot a lot cleaner. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-06 16:45:06 +02:00
psa_status_t psa_allocate_buffer_to_slot( psa_key_slot_t *slot,
size_t buffer_length )
Update after feedback on #3492 * Updated wording * Split out buffer allocation to a convenience function * Moved variable declarations to beginning of their code block Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 14:30:13 +02:00
{
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 17:52:23 +01:00
if( slot->key.data != NULL )
Style fixes * return is treated as a function call * space between opening and closing parentheses * remove whiteline between assignment and checking of same variable Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-05 15:43:42 +02:00
return( PSA_ERROR_ALREADY_EXISTS );
Update after feedback on #3492 * Updated wording * Split out buffer allocation to a convenience function * Moved variable declarations to beginning of their code block Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 14:30:13 +02:00
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 17:52:23 +01:00
slot->key.data = mbedtls_calloc( 1, buffer_length );
if( slot->key.data == NULL )
Style fixes * return is treated as a function call * space between opening and closing parentheses * remove whiteline between assignment and checking of same variable Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-05 15:43:42 +02:00
return( PSA_ERROR_INSUFFICIENT_MEMORY );
Update after feedback on #3492 * Updated wording * Split out buffer allocation to a convenience function * Moved variable declarations to beginning of their code block Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 14:30:13 +02:00
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 17:52:23 +01:00
slot->key.bytes = buffer_length;
Style fixes * return is treated as a function call * space between opening and closing parentheses * remove whiteline between assignment and checking of same variable Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-05 15:43:42 +02:00
return( PSA_SUCCESS );
Update after feedback on #3492 * Updated wording * Split out buffer allocation to a convenience function * Moved variable declarations to beginning of their code block Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 14:30:13 +02:00
}
Add internal helper function to load prevalidated key material Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-13 20:27:40 +02:00
psa_status_t psa_copy_key_material_into_slot( psa_key_slot_t *slot,
const uint8_t* data,
size_t data_length )
{
psa_status_t status = psa_allocate_buffer_to_slot( slot,
data_length );
if( status != PSA_SUCCESS )
return( status );
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 17:52:23 +01:00
memcpy( slot->key.data, data, data_length );
Add internal helper function to load prevalidated key material Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-13 20:27:40 +02:00
return( PSA_SUCCESS );
}
psa: Export internally psa_import_key_into_slot() Export psa_import_key_into_slot from psa_crypto.c to make it available to the driver wrapper. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-29 11:14:53 +01:00
psa_status_t psa_import_key_into_slot(
psa: Change psa_import_key_into_slot() signature Change psa_import_key_into_slot() signature to the signature of an import_key driver entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 15:54:54 +01:00
const psa_key_attributes_t *attributes,
const uint8_t *data, size_t data_length,
uint8_t *key_buffer, size_t key_buffer_size,
size_t *key_buffer_length, size_t *bits )
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
{
psa: Change psa_import_key_into_slot() signature Change psa_import_key_into_slot() signature to the signature of an import_key driver entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 15:54:54 +01:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa_key_type_t type = attributes->core.type;
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
Pull apart slot memory allocation from key validation. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 22:04:59 +02:00
/* zero-length keys are never supported. */
if( data_length == 0 )
return( PSA_ERROR_NOT_SUPPORTED );
psa: Change psa_import_key_into_slot() signature Change psa_import_key_into_slot() signature to the signature of an import_key driver entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 15:54:54 +01:00
if( key_type_is_raw_bytes( type ) )
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
{
psa: Change psa_import_key_into_slot() signature Change psa_import_key_into_slot() signature to the signature of an import_key driver entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 15:54:54 +01:00
*bits = PSA_BYTES_TO_BITS( data_length );
Pull apart slot memory allocation from key validation. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 22:04:59 +02:00
Code style improvements Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-09-08 12:06:05 +02:00
status = psa_validate_unstructured_key_bit_size( attributes->core.type,
*bits );
psa_import_key: validate symmetric key size When importing a symmetric key, validate that the key size is valid for the given key type. Non-supported key types may no longer be imported.
2018-06-19 21:31:50 +02:00
if( status != PSA_SUCCESS )
Style fixes * return is treated as a function call * space between opening and closing parentheses * remove whiteline between assignment and checking of same variable Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-05 15:43:42 +02:00
return( status );
Pull apart slot memory allocation from key validation. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 22:04:59 +02:00
psa: import: Move key buffer allocation Move key buffer allocation from psa_import_key_into_slot() function up to the two functions calling it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 15:14:42 +01:00
/* Copy the key material. */
memcpy( key_buffer, data, data_length );
*key_buffer_length = data_length;
(void)key_buffer_size;
Pull apart slot memory allocation from key validation. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 22:04:59 +02:00
Address review comments * zero key buffer on failure * readability improvements * psa_finish_key_creation adjustment after removing import_key_into_slot Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-29 11:42:22 +01:00
return( PSA_SUCCESS );
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
}
psa: Change psa_import_key_into_slot() signature Change psa_import_key_into_slot() signature to the signature of an import_key driver entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 15:54:54 +01:00
else if( PSA_KEY_TYPE_IS_ASYMMETRIC( type ) )
psa: Simplify EC public key format Remove front matter from our EC key format, to make it just the contents of an ECPoint as defined by SEC1 section 2.3.3. As a consequence of the simplification, remove the restriction on not being able to use an ECDH key with ECDSA. There is no longer any OID specified when importing a key, so we can't reject importing of an ECDH key for the purpose of ECDSA based on the OID.
2019-01-10 12:42:27 +01:00
{
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 21:28:15 +01:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)
psa: Change psa_import_key_into_slot() signature Change psa_import_key_into_slot() signature to the signature of an import_key driver entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 15:54:54 +01:00
if( PSA_KEY_TYPE_IS_ECC( type ) )
Separate 'import' from 'load into slot' Now that there's a validate_key entry point for drivers, it becomes much more important to separate the import action (where a key needs to be validated) from the load action (where a key has been previously validated, and thus re-validating it would be a waste of time). This also exposes why not storing the 'bits' attribute persistently was a bad idea. The only reason there's a rather large function to detect bit size is because loading from persistent storage requires it. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-23 11:37:05 +02:00
{
psa: Change psa_import_key_into_slot() signature Change psa_import_key_into_slot() signature to the signature of an import_key driver entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 15:54:54 +01:00
return( mbedtls_psa_ecp_import_key( attributes,
data, data_length,
key_buffer, key_buffer_size,
key_buffer_length,
bits ) );
Separate 'import' from 'load into slot' Now that there's a validate_key entry point for drivers, it becomes much more important to separate the import action (where a key needs to be validated) from the load action (where a key has been previously validated, and thus re-validating it would be a waste of time). This also exposes why not storing the 'bits' attribute persistently was a bad idea. The only reason there's a rather large function to detect bit size is because loading from persistent storage requires it. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-23 11:37:05 +02:00
}
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 21:28:15 +01:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
Add feature support for RSA for PSA crypto config In the original attempt to add RSA support to PSA crypto config was too generic. This set of changes adds support for the following RSA features: PSA_WANT_ALG_RSA_PKCS1V15_CRYPT, PSA_WANT_ALG_RSA_PKCS1V15_SIGN, PSA_WANT_ALG_RSA_OAEP, PSA_WANT_ALG_RSA_PSS, PSA_WANT_KEY_TYPE_RSA_KEY_PAIR, and PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY. There were also some updates to ensure the proper inclusion of PSA crypto library code when certain features are enabled. These updates were made to address warnings and errors in builds from the new tests for these features being added for PSA crypto configuration. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-01 06:06:54 +01:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
psa: Change psa_import_key_into_slot() signature Change psa_import_key_into_slot() signature to the signature of an import_key driver entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 15:54:54 +01:00
if( PSA_KEY_TYPE_IS_RSA( type ) )
Separate 'import' from 'load into slot' Now that there's a validate_key entry point for drivers, it becomes much more important to separate the import action (where a key needs to be validated) from the load action (where a key has been previously validated, and thus re-validating it would be a waste of time). This also exposes why not storing the 'bits' attribute persistently was a bad idea. The only reason there's a rather large function to detect bit size is because loading from persistent storage requires it. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-23 11:37:05 +02:00
{
psa: Change psa_import_key_into_slot() signature Change psa_import_key_into_slot() signature to the signature of an import_key driver entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 15:54:54 +01:00
return( mbedtls_psa_rsa_import_key( attributes,
data, data_length,
key_buffer, key_buffer_size,
key_buffer_length,
bits ) );
Separate 'import' from 'load into slot' Now that there's a validate_key entry point for drivers, it becomes much more important to separate the import action (where a key needs to be validated) from the load action (where a key has been previously validated, and thus re-validating it would be a waste of time). This also exposes why not storing the 'bits' attribute persistently was a bad idea. The only reason there's a rather large function to detect bit size is because loading from persistent storage requires it. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-23 11:37:05 +02:00
}
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 21:28:15 +01:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
}
psa: Change psa_import_key_into_slot() signature Change psa_import_key_into_slot() signature to the signature of an import_key driver entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 15:54:54 +01:00
return( PSA_ERROR_NOT_SUPPORTED );
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 12:21:11 +02:00
}
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 13:40:11 +01:00
/** Calculate the intersection of two algorithm usage policies.
*
* Return 0 (which allows no operation) on incompatibility.
*/
static psa_algorithm_t psa_key_policy_algorithm_intersection(
Make psa_key_policy_algorithm_intersection MAC-length aware This makes it more in-line with how psa_key_policy_permits works. It also adds consistency: the intersection of MAC with default length and MAC with exact-length is now computed correctly in case the exact length equals the default length of the algorithm when used with the given key type. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 16:34:49 +01:00
psa_key_type_t key_type,
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 13:40:11 +01:00
psa_algorithm_t alg1,
psa_algorithm_t alg2 )
{
Minor documentation improvements
2019-05-22 11:45:59 +02:00
/* Common case: both sides actually specify the same policy. */
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 13:40:11 +01:00
if( alg1 == alg2 )
return( alg1 );
Remove generic wildcard checks after review feedback Applied specific wildcard checks instead. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com> # Conflicts: # library/psa_crypto.c
2021-02-18 12:07:20 +01:00
/* If the policies are from the same hash-and-sign family, check
* if one is a wildcard. If so the other has the specific algorithm. */
Untangle PSA_ALG_IS_HASH_AND_SIGN and PSA_ALG_IS_SIGN_HASH The current definition of PSA_ALG_IS_HASH_AND_SIGN includes PSA_ALG_RSA_PKCS1V15_SIGN_RAW and PSA_ALG_ECDSA_ANY, which don't strictly follow the hash-and-sign paradigm: the algorithm does not encode a hash algorithm that is applied prior to the signature step. The definition in fact encompasses what can be used with psa_sign_hash/psa_verify_hash, so it's the correct definition for PSA_ALG_IS_SIGN_HASH. Therefore this commit moves definition of PSA_ALG_IS_HASH_AND_SIGN to PSA_ALG_IS_SIGN_HASH, and replace the definition of PSA_ALG_IS_HASH_AND_SIGN by a correct one (based on PSA_ALG_IS_SIGN_HASH, excluding the algorithms where the pre-signature step isn't to apply the hash encoded in the algorithm). In the definition of PSA_ALG_SIGN_GET_HASH, keep the condition for a nonzero output to be PSA_ALG_IS_HASH_AND_SIGN. Everywhere else in the code base (definition of PSA_ALG_IS_SIGN_MESSAGE, and every use of PSA_ALG_IS_HASH_AND_SIGN outside of crypto_values.h), we meant PSA_ALG_IS_SIGN_HASH where we wrote PSA_ALG_IS_HASH_AND_SIGN, so do a global replacement. ``` git grep -l IS_HASH_AND_SIGN ':!include/psa/crypto_values.h' | xargs perl -i -pe 's/ALG_IS_HASH_AND_SIGN/ALG_IS_SIGN_HASH/g' ``` Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-09-22 16:15:05 +02:00
if( PSA_ALG_IS_SIGN_HASH( alg1 ) &&
PSA_ALG_IS_SIGN_HASH( alg2 ) &&
Remove generic wildcard checks after review feedback Applied specific wildcard checks instead. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com> # Conflicts: # library/psa_crypto.c
2021-02-18 12:07:20 +01:00
( alg1 & ~PSA_ALG_HASH_MASK ) == ( alg2 & ~PSA_ALG_HASH_MASK ) )
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 13:40:11 +01:00
{
Remove generic wildcard checks after review feedback Applied specific wildcard checks instead. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com> # Conflicts: # library/psa_crypto.c
2021-02-18 12:07:20 +01:00
if( PSA_ALG_SIGN_GET_HASH( alg1 ) == PSA_ALG_ANY_HASH )
return( alg2 );
if( PSA_ALG_SIGN_GET_HASH( alg2 ) == PSA_ALG_ANY_HASH )
return( alg1 );
}
/* If the policies are from the same AEAD family, check whether
Language / verbiage fixes Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-22 17:05:56 +01:00
* one of them is a minimum-tag-length wildcard. Calculate the most
Remove generic wildcard checks after review feedback Applied specific wildcard checks instead. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com> # Conflicts: # library/psa_crypto.c
2021-02-18 12:07:20 +01:00
* restrictive tag length. */
if( PSA_ALG_IS_AEAD( alg1 ) && PSA_ALG_IS_AEAD( alg2 ) &&
( PSA_ALG_AEAD_WITH_SHORTENED_TAG( alg1, 0 ) ==
PSA_ALG_AEAD_WITH_SHORTENED_TAG( alg2, 0 ) ) )
{
size_t alg1_len = PSA_ALG_AEAD_GET_TAG_LENGTH( alg1 );
size_t alg2_len = PSA_ALG_AEAD_GET_TAG_LENGTH( alg2 );
Language & code readability updates No functional/behavioral changes in this commit Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-08 12:00:27 +01:00
size_t restricted_len = alg1_len > alg2_len ? alg1_len : alg2_len;
Remove generic wildcard checks after review feedback Applied specific wildcard checks instead. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com> # Conflicts: # library/psa_crypto.c
2021-02-18 12:07:20 +01:00
Language / verbiage fixes Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-22 17:05:56 +01:00
/* If both are wildcards, return most restrictive wildcard */
Rename _MINIMUM_LENGTH flags to _AT_LEAST_THIS_LENGTH Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-22 19:59:35 +01:00
if( ( ( alg1 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG ) != 0 ) &&
( ( alg2 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG ) != 0 ) )
Add support for minimum-tag-length AEAD and MAC policies Includes tests. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com> # Conflicts: # include/psa/crypto_values.h # tests/suites/test_suite_psa_crypto.function
2021-02-18 12:03:50 +01:00
{
Language & code readability updates No functional/behavioral changes in this commit Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-08 12:00:27 +01:00
return( PSA_ALG_AEAD_WITH_AT_LEAST_THIS_LENGTH_TAG(
alg1, restricted_len ) );
Add support for minimum-tag-length AEAD and MAC policies Includes tests. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com> # Conflicts: # include/psa/crypto_values.h # tests/suites/test_suite_psa_crypto.function
2021-02-18 12:03:50 +01:00
}
Remove generic wildcard checks after review feedback Applied specific wildcard checks instead. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com> # Conflicts: # library/psa_crypto.c
2021-02-18 12:07:20 +01:00
/* If only one is a wildcard, return specific algorithm if compatible. */
Rename _MINIMUM_LENGTH flags to _AT_LEAST_THIS_LENGTH Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-22 19:59:35 +01:00
if( ( ( alg1 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG ) != 0 ) &&
Remove generic wildcard checks after review feedback Applied specific wildcard checks instead. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com> # Conflicts: # library/psa_crypto.c
2021-02-18 12:07:20 +01:00
( alg1_len <= alg2_len ) )
Add support for minimum-tag-length AEAD and MAC policies Includes tests. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com> # Conflicts: # include/psa/crypto_values.h # tests/suites/test_suite_psa_crypto.function
2021-02-18 12:03:50 +01:00
{
Remove generic wildcard checks after review feedback Applied specific wildcard checks instead. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com> # Conflicts: # library/psa_crypto.c
2021-02-18 12:07:20 +01:00
return( alg2 );
Add support for minimum-tag-length AEAD and MAC policies Includes tests. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com> # Conflicts: # include/psa/crypto_values.h # tests/suites/test_suite_psa_crypto.function
2021-02-18 12:03:50 +01:00
}
Rename _MINIMUM_LENGTH flags to _AT_LEAST_THIS_LENGTH Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-22 19:59:35 +01:00
if( ( ( alg2 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG ) != 0 ) &&
Remove generic wildcard checks after review feedback Applied specific wildcard checks instead. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com> # Conflicts: # library/psa_crypto.c
2021-02-18 12:07:20 +01:00
( alg2_len <= alg1_len ) )
Add support for minimum-tag-length AEAD and MAC policies Includes tests. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com> # Conflicts: # include/psa/crypto_values.h # tests/suites/test_suite_psa_crypto.function
2021-02-18 12:03:50 +01:00
{
Remove generic wildcard checks after review feedback Applied specific wildcard checks instead. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com> # Conflicts: # library/psa_crypto.c
2021-02-18 12:07:20 +01:00
return( alg1 );
}
}
/* If the policies are from the same MAC family, check whether one
* of them is a minimum-MAC-length policy. Calculate the most
* restrictive tag length. */
if( PSA_ALG_IS_MAC( alg1 ) && PSA_ALG_IS_MAC( alg2 ) &&
( PSA_ALG_FULL_LENGTH_MAC( alg1 ) ==
PSA_ALG_FULL_LENGTH_MAC( alg2 ) ) )
{
Rework MAC algorithm / key type validation Reworked the validation of MAC algorithm with the used key type by introducing psa_mac_key_can_do, which guarantees that PSA_MAC_LENGTH can be called successfully after validation of the algorithm and key type. This means psa_get_mac_output_length is no longer required. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-03 19:04:05 +01:00
/* Validate the combination of key type and algorithm. Since the base
* algorithm of alg1 and alg2 are the same, we only need this once. */
if( PSA_SUCCESS != psa_mac_key_can_do( alg1, key_type ) )
Make psa_key_policy_algorithm_intersection MAC-length aware This makes it more in-line with how psa_key_policy_permits works. It also adds consistency: the intersection of MAC with default length and MAC with exact-length is now computed correctly in case the exact length equals the default length of the algorithm when used with the given key type. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 16:34:49 +01:00
return( 0 );
Clarify some policy-handling code comments Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-03 20:47:40 +01:00
/* Get the (exact or at-least) output lengths for both sides of the
* requested intersection. None of the currently supported algorithms
* have an output length dependent on the actual key size, so setting it
* to a bogus value of 0 is currently OK.
*
Rework MAC algorithm / key type validation Reworked the validation of MAC algorithm with the used key type by introducing psa_mac_key_can_do, which guarantees that PSA_MAC_LENGTH can be called successfully after validation of the algorithm and key type. This means psa_get_mac_output_length is no longer required. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-03 19:04:05 +01:00
* Note that for at-least-this-length wildcard algorithms, the output
* length is set to the shortest allowed length, which allows us to
* calculate the most restrictive tag length for the intersection. */
size_t alg1_len = PSA_MAC_LENGTH( key_type, 0, alg1 );
size_t alg2_len = PSA_MAC_LENGTH( key_type, 0, alg2 );
Language & code readability updates No functional/behavioral changes in this commit Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-08 12:00:27 +01:00
size_t restricted_len = alg1_len > alg2_len ? alg1_len : alg2_len;
Add support for minimum-tag-length AEAD and MAC policies Includes tests. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com> # Conflicts: # include/psa/crypto_values.h # tests/suites/test_suite_psa_crypto.function
2021-02-18 12:03:50 +01:00
Fix typos & copy-paste errors Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-25 10:20:29 +01:00
/* If both are wildcards, return most restrictive wildcard */
Rename _MINIMUM_LENGTH flags to _AT_LEAST_THIS_LENGTH Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-22 19:59:35 +01:00
if( ( ( alg1 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG ) != 0 ) &&
( ( alg2 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG ) != 0 ) )
Remove generic wildcard checks after review feedback Applied specific wildcard checks instead. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com> # Conflicts: # library/psa_crypto.c
2021-02-18 12:07:20 +01:00
{
Language & code readability updates No functional/behavioral changes in this commit Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-08 12:00:27 +01:00
return( PSA_ALG_AT_LEAST_THIS_LENGTH_MAC( alg1, restricted_len ) );
Remove generic wildcard checks after review feedback Applied specific wildcard checks instead. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com> # Conflicts: # library/psa_crypto.c
2021-02-18 12:07:20 +01:00
}
Clarify some policy-handling code comments Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-03 20:47:40 +01:00
/* If only one is an at-least-this-length policy, the intersection would
* be the other (fixed-length) policy as long as said fixed length is
* equal to or larger than the shortest allowed length. */
Make psa_key_policy_algorithm_intersection MAC-length aware This makes it more in-line with how psa_key_policy_permits works. It also adds consistency: the intersection of MAC with default length and MAC with exact-length is now computed correctly in case the exact length equals the default length of the algorithm when used with the given key type. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 16:34:49 +01:00
if( ( alg1 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG ) != 0 )
Remove generic wildcard checks after review feedback Applied specific wildcard checks instead. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com> # Conflicts: # library/psa_crypto.c
2021-02-18 12:07:20 +01:00
{
Language & code readability updates No functional/behavioral changes in this commit Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-08 12:00:27 +01:00
return( ( alg1_len <= alg2_len ) ? alg2 : 0 );
Remove generic wildcard checks after review feedback Applied specific wildcard checks instead. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com> # Conflicts: # library/psa_crypto.c
2021-02-18 12:07:20 +01:00
}
Make psa_key_policy_algorithm_intersection MAC-length aware This makes it more in-line with how psa_key_policy_permits works. It also adds consistency: the intersection of MAC with default length and MAC with exact-length is now computed correctly in case the exact length equals the default length of the algorithm when used with the given key type. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 16:34:49 +01:00
if( ( alg2 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG ) != 0 )
Remove generic wildcard checks after review feedback Applied specific wildcard checks instead. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com> # Conflicts: # library/psa_crypto.c
2021-02-18 12:07:20 +01:00
{
Language & code readability updates No functional/behavioral changes in this commit Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-08 12:00:27 +01:00
return( ( alg2_len <= alg1_len ) ? alg1 : 0 );
Add support for minimum-tag-length AEAD and MAC policies Includes tests. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com> # Conflicts: # include/psa/crypto_values.h # tests/suites/test_suite_psa_crypto.function
2021-02-18 12:03:50 +01:00
}
Clarify some policy-handling code comments Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-03 20:47:40 +01:00
Language & code readability updates No functional/behavioral changes in this commit Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-08 12:00:27 +01:00
/* If none of them are wildcards, check whether they define the same tag
* length. This is still possible here when one is default-length and
* the other specific-length. Ensure to always return the
* specific-length version for the intersection. */
Make psa_key_policy_algorithm_intersection MAC-length aware This makes it more in-line with how psa_key_policy_permits works. It also adds consistency: the intersection of MAC with default length and MAC with exact-length is now computed correctly in case the exact length equals the default length of the algorithm when used with the given key type. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 16:34:49 +01:00
if( alg1_len == alg2_len )
return( PSA_ALG_TRUNCATED_MAC( alg1, alg1_len ) );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 13:40:11 +01:00
}
/* If the policies are incompatible, allow nothing. */
return( 0 );
}
Move MAC default length checking into psa_key_policy_permits Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 15:11:57 +01:00
static int psa_key_algorithm_permits( psa_key_type_t key_type,
psa_algorithm_t policy_alg,
Keys may allow a second algorithm Add a second permitted algorithm to key policies. This commit includes smoke tests that do not cover psa_copy_key.
2019-05-10 19:33:38 +02:00
psa_algorithm_t requested_alg )
Add a hash wildcard value for hash-and-sign algorithm You can use PSA_ALG_ANY_HASH to build the algorithm value for a hash-and-sign algorithm in a policy. Then the policy allows usage with this hash-and-sign family with any hash. Test that PSA_ALG_ANY_HASH-based policies allow a specific hash, but not a different hash-and-sign family. Test that PSA_ALG_ANY_HASH is not valid for operations, only in policies.
2019-01-14 16:06:39 +01:00
{
Minor documentation improvements
2019-05-22 11:45:59 +02:00
/* Common case: the policy only allows requested_alg. */
Keys may allow a second algorithm Add a second permitted algorithm to key policies. This commit includes smoke tests that do not cover psa_copy_key.
2019-05-10 19:33:38 +02:00
if( requested_alg == policy_alg )
Add a hash wildcard value for hash-and-sign algorithm You can use PSA_ALG_ANY_HASH to build the algorithm value for a hash-and-sign algorithm in a policy. Then the policy allows usage with this hash-and-sign family with any hash. Test that PSA_ALG_ANY_HASH-based policies allow a specific hash, but not a different hash-and-sign family. Test that PSA_ALG_ANY_HASH is not valid for operations, only in policies.
2019-01-14 16:06:39 +01:00
return( 1 );
Remove generic wildcard checks after review feedback Applied specific wildcard checks instead. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com> # Conflicts: # library/psa_crypto.c
2021-02-18 12:07:20 +01:00
/* If policy_alg is a hash-and-sign with a wildcard for the hash,
* and requested_alg is the same hash-and-sign family with any hash,
* then requested_alg is compliant with policy_alg. */
Untangle PSA_ALG_IS_HASH_AND_SIGN and PSA_ALG_IS_SIGN_HASH The current definition of PSA_ALG_IS_HASH_AND_SIGN includes PSA_ALG_RSA_PKCS1V15_SIGN_RAW and PSA_ALG_ECDSA_ANY, which don't strictly follow the hash-and-sign paradigm: the algorithm does not encode a hash algorithm that is applied prior to the signature step. The definition in fact encompasses what can be used with psa_sign_hash/psa_verify_hash, so it's the correct definition for PSA_ALG_IS_SIGN_HASH. Therefore this commit moves definition of PSA_ALG_IS_HASH_AND_SIGN to PSA_ALG_IS_SIGN_HASH, and replace the definition of PSA_ALG_IS_HASH_AND_SIGN by a correct one (based on PSA_ALG_IS_SIGN_HASH, excluding the algorithms where the pre-signature step isn't to apply the hash encoded in the algorithm). In the definition of PSA_ALG_SIGN_GET_HASH, keep the condition for a nonzero output to be PSA_ALG_IS_HASH_AND_SIGN. Everywhere else in the code base (definition of PSA_ALG_IS_SIGN_MESSAGE, and every use of PSA_ALG_IS_HASH_AND_SIGN outside of crypto_values.h), we meant PSA_ALG_IS_SIGN_HASH where we wrote PSA_ALG_IS_HASH_AND_SIGN, so do a global replacement. ``` git grep -l IS_HASH_AND_SIGN ':!include/psa/crypto_values.h' | xargs perl -i -pe 's/ALG_IS_HASH_AND_SIGN/ALG_IS_SIGN_HASH/g' ``` Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-09-22 16:15:05 +02:00
if( PSA_ALG_IS_SIGN_HASH( requested_alg ) &&
Remove generic wildcard checks after review feedback Applied specific wildcard checks instead. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com> # Conflicts: # library/psa_crypto.c
2021-02-18 12:07:20 +01:00
PSA_ALG_SIGN_GET_HASH( policy_alg ) == PSA_ALG_ANY_HASH )
Add a hash wildcard value for hash-and-sign algorithm You can use PSA_ALG_ANY_HASH to build the algorithm value for a hash-and-sign algorithm in a policy. Then the policy allows usage with this hash-and-sign family with any hash. Test that PSA_ALG_ANY_HASH-based policies allow a specific hash, but not a different hash-and-sign family. Test that PSA_ALG_ANY_HASH is not valid for operations, only in policies.
2019-01-14 16:06:39 +01:00
{
Remove generic wildcard checks after review feedback Applied specific wildcard checks instead. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com> # Conflicts: # library/psa_crypto.c
2021-02-18 12:07:20 +01:00
return( ( policy_alg & ~PSA_ALG_HASH_MASK ) ==
( requested_alg & ~PSA_ALG_HASH_MASK ) );
}
/* If policy_alg is a wildcard AEAD algorithm of the same base as
* the requested algorithm, check the requested tag length to be
* equal-length or longer than the wildcard-specified length. */
if( PSA_ALG_IS_AEAD( policy_alg ) &&
PSA_ALG_IS_AEAD( requested_alg ) &&
( PSA_ALG_AEAD_WITH_SHORTENED_TAG( policy_alg, 0 ) ==
PSA_ALG_AEAD_WITH_SHORTENED_TAG( requested_alg, 0 ) ) &&
Rename _MINIMUM_LENGTH flags to _AT_LEAST_THIS_LENGTH Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-22 19:59:35 +01:00
( ( policy_alg & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG ) != 0 ) )
Remove generic wildcard checks after review feedback Applied specific wildcard checks instead. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com> # Conflicts: # library/psa_crypto.c
2021-02-18 12:07:20 +01:00
{
return( PSA_ALG_AEAD_GET_TAG_LENGTH( policy_alg ) <=
PSA_ALG_AEAD_GET_TAG_LENGTH( requested_alg ) );
}
Language & code readability updates No functional/behavioral changes in this commit Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-08 12:00:27 +01:00
/* If policy_alg is a MAC algorithm of the same base as the requested
* algorithm, check whether their MAC lengths are compatible. */
Remove generic wildcard checks after review feedback Applied specific wildcard checks instead. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com> # Conflicts: # library/psa_crypto.c
2021-02-18 12:07:20 +01:00
if( PSA_ALG_IS_MAC( policy_alg ) &&
PSA_ALG_IS_MAC( requested_alg ) &&
( PSA_ALG_FULL_LENGTH_MAC( policy_alg ) ==
Move MAC default length checking into psa_key_policy_permits Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 15:11:57 +01:00
PSA_ALG_FULL_LENGTH_MAC( requested_alg ) ) )
{
Rework MAC algorithm / key type validation Reworked the validation of MAC algorithm with the used key type by introducing psa_mac_key_can_do, which guarantees that PSA_MAC_LENGTH can be called successfully after validation of the algorithm and key type. This means psa_get_mac_output_length is no longer required. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-03 19:04:05 +01:00
/* Validate the combination of key type and algorithm. Since the policy
* and requested algorithms are the same, we only need this once. */
if( PSA_SUCCESS != psa_mac_key_can_do( policy_alg, key_type ) )
Move MAC default length checking into psa_key_policy_permits Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 15:11:57 +01:00
return( 0 );
Rework MAC algorithm / key type validation Reworked the validation of MAC algorithm with the used key type by introducing psa_mac_key_can_do, which guarantees that PSA_MAC_LENGTH can be called successfully after validation of the algorithm and key type. This means psa_get_mac_output_length is no longer required. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-03 19:04:05 +01:00
Clarify some policy-handling code comments Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-03 20:47:40 +01:00
/* Get both the requested output length for the algorithm which is to be
* verified, and the default output length for the base algorithm.
* Note that none of the currently supported algorithms have an output
* length dependent on actual key size, so setting it to a bogus value
* of 0 is currently OK. */
Rework MAC algorithm / key type validation Reworked the validation of MAC algorithm with the used key type by introducing psa_mac_key_can_do, which guarantees that PSA_MAC_LENGTH can be called successfully after validation of the algorithm and key type. This means psa_get_mac_output_length is no longer required. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-03 19:04:05 +01:00
size_t requested_output_length = PSA_MAC_LENGTH(
key_type, 0, requested_alg );
size_t default_output_length = PSA_MAC_LENGTH(
key_type, 0,
PSA_ALG_FULL_LENGTH_MAC( requested_alg ) );
Move MAC default length checking into psa_key_policy_permits Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 15:11:57 +01:00
/* If the policy is default-length, only allow an algorithm with
* a declared exact-length matching the default. */
if( PSA_MAC_TRUNCATED_LENGTH( policy_alg ) == 0 )
Rework MAC algorithm / key type validation Reworked the validation of MAC algorithm with the used key type by introducing psa_mac_key_can_do, which guarantees that PSA_MAC_LENGTH can be called successfully after validation of the algorithm and key type. This means psa_get_mac_output_length is no longer required. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-03 19:04:05 +01:00
return( requested_output_length == default_output_length );
Move MAC default length checking into psa_key_policy_permits Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 15:11:57 +01:00
/* If the requested algorithm is default-length, allow it if the policy
Language & code readability updates No functional/behavioral changes in this commit Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-08 12:00:27 +01:00
* length exactly matches the default length. */
Move MAC default length checking into psa_key_policy_permits Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 15:11:57 +01:00
if( PSA_MAC_TRUNCATED_LENGTH( requested_alg ) == 0 &&
PSA_MAC_TRUNCATED_LENGTH( policy_alg ) == default_output_length )
{
Remove generic wildcard checks after review feedback Applied specific wildcard checks instead. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com> # Conflicts: # library/psa_crypto.c
2021-02-18 12:07:20 +01:00
return( 1 );
Move MAC default length checking into psa_key_policy_permits Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 15:11:57 +01:00
}
Add support for minimum-tag-length AEAD and MAC policies Includes tests. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com> # Conflicts: # include/psa/crypto_values.h # tests/suites/test_suite_psa_crypto.function
2021-02-18 12:03:50 +01:00
Language & code readability updates No functional/behavioral changes in this commit Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-08 12:00:27 +01:00
/* If policy_alg is an at-least-this-length wildcard MAC algorithm,
* check for the requested MAC length to be equal to or longer than the
* minimum allowed length. */
Move MAC default length checking into psa_key_policy_permits Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 15:11:57 +01:00
if( ( policy_alg & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG ) != 0 )
{
return( PSA_MAC_TRUNCATED_LENGTH( policy_alg ) <=
Rework MAC algorithm / key type validation Reworked the validation of MAC algorithm with the used key type by introducing psa_mac_key_can_do, which guarantees that PSA_MAC_LENGTH can be called successfully after validation of the algorithm and key type. This means psa_get_mac_output_length is no longer required. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-03 19:04:05 +01:00
requested_output_length );
Move MAC default length checking into psa_key_policy_permits Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 15:11:57 +01:00
}
Add a hash wildcard value for hash-and-sign algorithm You can use PSA_ALG_ANY_HASH to build the algorithm value for a hash-and-sign algorithm in a policy. Then the policy allows usage with this hash-and-sign family with any hash. Test that PSA_ALG_ANY_HASH-based policies allow a specific hash, but not a different hash-and-sign family. Test that PSA_ALG_ANY_HASH is not valid for operations, only in policies.
2019-01-14 16:06:39 +01:00
}
Fix PSA crypto inconsistencies in agreement+derivation * #3741 Allow key agreement inside derivation with a key that's allowed for the relevant agreement. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-05 16:02:45 +02:00
/* If policy_alg is a generic key agreement operation, then using it for
Apply review feedback Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-15 17:07:12 +02:00
* a key derivation with that key agreement should also be allowed. This
* behaviour is expected to be defined in a future specification version. */
Fix PSA crypto inconsistencies in agreement+derivation * #3741 Allow key agreement inside derivation with a key that's allowed for the relevant agreement. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-05 16:02:45 +02:00
if( PSA_ALG_IS_RAW_KEY_AGREEMENT( policy_alg ) &&
PSA_ALG_IS_KEY_AGREEMENT( requested_alg ) )
{
return( PSA_ALG_KEY_AGREEMENT_GET_BASE( requested_alg ) ==
policy_alg );
}
Add support for minimum-tag-length AEAD and MAC policies Includes tests. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com> # Conflicts: # include/psa/crypto_values.h # tests/suites/test_suite_psa_crypto.function
2021-02-18 12:03:50 +01:00
/* If it isn't explicitly permitted, it's forbidden. */
Add a hash wildcard value for hash-and-sign algorithm You can use PSA_ALG_ANY_HASH to build the algorithm value for a hash-and-sign algorithm in a policy. Then the policy allows usage with this hash-and-sign family with any hash. Test that PSA_ALG_ANY_HASH-based policies allow a specific hash, but not a different hash-and-sign family. Test that PSA_ALG_ANY_HASH is not valid for operations, only in policies.
2019-01-14 16:06:39 +01:00
return( 0 );
}
Keys may allow a second algorithm Add a second permitted algorithm to key policies. This commit includes smoke tests that do not cover psa_copy_key.
2019-05-10 19:33:38 +02:00
/** Test whether a policy permits an algorithm.
*
* The caller must test usage flags separately.
Using a wildcard as a specific algorithm now reports invalid argument Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-23 14:18:32 +01:00
*
Add a note about why key_type is required Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 21:27:42 +01:00
* \note This function requires providing the key type for which the policy is
* being validated, since some algorithm policy definitions (e.g. MAC)
* have different properties depending on what kind of cipher it is
* combined with.
*
Using a wildcard as a specific algorithm now reports invalid argument Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-23 14:18:32 +01:00
* \retval PSA_SUCCESS When \p alg is a specific algorithm
* allowed by the \p policy.
* \retval PSA_ERROR_INVALID_ARGUMENT When \p alg is not a specific algorithm
* \retval PSA_ERROR_NOT_PERMITTED When \p alg is a specific algorithm, but
* the \p policy does not allow it.
Keys may allow a second algorithm Add a second permitted algorithm to key policies. This commit includes smoke tests that do not cover psa_copy_key.
2019-05-10 19:33:38 +02:00
*/
Using a wildcard as a specific algorithm now reports invalid argument Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-23 14:18:32 +01:00
static psa_status_t psa_key_policy_permits( const psa_key_policy_t *policy,
Move MAC default length checking into psa_key_policy_permits Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 15:11:57 +01:00
psa_key_type_t key_type,
Using a wildcard as a specific algorithm now reports invalid argument Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-23 14:18:32 +01:00
psa_algorithm_t alg )
Keys may allow a second algorithm Add a second permitted algorithm to key policies. This commit includes smoke tests that do not cover psa_copy_key.
2019-05-10 19:33:38 +02:00
{
Clarify usage of psa_key_policy_permits Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-25 11:29:17 +01:00
/* '0' is not a valid algorithm */
if( alg == 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
Using a wildcard as a specific algorithm now reports invalid argument Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-23 14:18:32 +01:00
/* A requested algorithm cannot be a wildcard. */
if( PSA_ALG_IS_WILDCARD( alg ) )
return( PSA_ERROR_INVALID_ARGUMENT );
Move MAC default length checking into psa_key_policy_permits Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 15:11:57 +01:00
if( psa_key_algorithm_permits( key_type, policy->alg, alg ) ||
psa_key_algorithm_permits( key_type, policy->alg2, alg ) )
Using a wildcard as a specific algorithm now reports invalid argument Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-23 14:18:32 +01:00
return( PSA_SUCCESS );
else
return( PSA_ERROR_NOT_PERMITTED );
Keys may allow a second algorithm Add a second permitted algorithm to key policies. This commit includes smoke tests that do not cover psa_copy_key.
2019-05-10 19:33:38 +02:00
}
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 13:40:11 +01:00
/** Restrict a key policy based on a constraint.
Add a note about why key_type is required Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 21:27:42 +01:00
*
* \note This function requires providing the key type for which the policy is
* being restricted, since some algorithm policy definitions (e.g. MAC)
* have different properties depending on what kind of cipher it is
* combined with.
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 13:40:11 +01:00
*
Make psa_key_policy_algorithm_intersection MAC-length aware This makes it more in-line with how psa_key_policy_permits works. It also adds consistency: the intersection of MAC with default length and MAC with exact-length is now computed correctly in case the exact length equals the default length of the algorithm when used with the given key type. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 16:34:49 +01:00
* \param[in] key_type The key type for which to restrict the policy
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 13:40:11 +01:00
* \param[in,out] policy The policy to restrict.
* \param[in] constraint The policy constraint to apply.
*
* \retval #PSA_SUCCESS
* \c *policy contains the intersection of the original value of
* \c *policy and \c *constraint.
* \retval #PSA_ERROR_INVALID_ARGUMENT
Make psa_key_policy_algorithm_intersection MAC-length aware This makes it more in-line with how psa_key_policy_permits works. It also adds consistency: the intersection of MAC with default length and MAC with exact-length is now computed correctly in case the exact length equals the default length of the algorithm when used with the given key type. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 16:34:49 +01:00
* \c key_type, \c *policy and \c *constraint are incompatible.
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 13:40:11 +01:00
* \c *policy is unchanged.
*/
static psa_status_t psa_restrict_key_policy(
Make psa_key_policy_algorithm_intersection MAC-length aware This makes it more in-line with how psa_key_policy_permits works. It also adds consistency: the intersection of MAC with default length and MAC with exact-length is now computed correctly in case the exact length equals the default length of the algorithm when used with the given key type. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 16:34:49 +01:00
psa_key_type_t key_type,
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 13:40:11 +01:00
psa_key_policy_t *policy,
const psa_key_policy_t *constraint )
{
psa_algorithm_t intersection_alg =
Make psa_key_policy_algorithm_intersection MAC-length aware This makes it more in-line with how psa_key_policy_permits works. It also adds consistency: the intersection of MAC with default length and MAC with exact-length is now computed correctly in case the exact length equals the default length of the algorithm when used with the given key type. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 16:34:49 +01:00
psa_key_policy_algorithm_intersection( key_type, policy->alg,
constraint->alg );
Keys may allow a second algorithm Add a second permitted algorithm to key policies. This commit includes smoke tests that do not cover psa_copy_key.
2019-05-10 19:33:38 +02:00
psa_algorithm_t intersection_alg2 =
Make psa_key_policy_algorithm_intersection MAC-length aware This makes it more in-line with how psa_key_policy_permits works. It also adds consistency: the intersection of MAC with default length and MAC with exact-length is now computed correctly in case the exact length equals the default length of the algorithm when used with the given key type. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 16:34:49 +01:00
psa_key_policy_algorithm_intersection( key_type, policy->alg2,
constraint->alg2 );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 13:40:11 +01:00
if( intersection_alg == 0 && policy->alg != 0 && constraint->alg != 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
Keys may allow a second algorithm Add a second permitted algorithm to key policies. This commit includes smoke tests that do not cover psa_copy_key.
2019-05-10 19:33:38 +02:00
if( intersection_alg2 == 0 && policy->alg2 != 0 && constraint->alg2 != 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 13:40:11 +01:00
policy->usage &= constraint->usage;
policy->alg = intersection_alg;
Keys may allow a second algorithm Add a second permitted algorithm to key policies. This commit includes smoke tests that do not cover psa_copy_key.
2019-05-10 19:33:38 +02:00
policy->alg2 = intersection_alg2;
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 13:40:11 +01:00
return( PSA_SUCCESS );
}
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
/** Get the description of a key given its identifier and policy constraints
* and lock it.
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
*
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
* The key must have allow all the usage flags set in \p usage. If \p alg is
Clarify usage of psa_key_policy_permits Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-25 11:29:17 +01:00
* nonzero, the key must allow operations with this algorithm. If \p alg is
* zero, the algorithm is not checked.
Miscellaneous documentation improvements Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-11 15:04:25 +01:00
*
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
* In case of a persistent key, the function loads the description of the key
* into a key slot if not already done.
*
* On success, the returned key slot is locked. It is the responsibility of
* the caller to unlock the key slot when it does not access it anymore.
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
*/
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
static psa_status_t psa_get_and_lock_key_slot_with_policy(
mbedtls_svc_key_id_t key,
psa_key_slot_t **p_slot,
psa_key_usage_t usage,
psa_algorithm_t alg )
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 12:21:11 +02:00
{
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa_key_slot_t *slot;
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 12:21:11 +02:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
status = psa_get_and_lock_key_slot( key, p_slot );
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 12:21:11 +02:00
if( status != PSA_SUCCESS )
return( status );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
slot = *p_slot;
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 12:21:11 +02:00
/* Enforce that usage policy for the key slot contains all the flags
* required by the usage parameter. There is one exception: public
* keys can always be exported, so we treat public key objects as
* if they had the export flag. */
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 20:06:31 +02:00
if( PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->attr.type ) )
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 12:21:11 +02:00
usage &= ~PSA_KEY_USAGE_EXPORT;
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 20:06:31 +02:00
if( ( slot->attr.policy.usage & usage ) != usage )
Language & readability touchups Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 11:44:51 +01:00
{
status = PSA_ERROR_NOT_PERMITTED;
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
goto error;
Language & readability touchups Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 11:44:51 +01:00
}
Add a hash wildcard value for hash-and-sign algorithm You can use PSA_ALG_ANY_HASH to build the algorithm value for a hash-and-sign algorithm in a policy. Then the policy allows usage with this hash-and-sign family with any hash. Test that PSA_ALG_ANY_HASH-based policies allow a specific hash, but not a different hash-and-sign family. Test that PSA_ALG_ANY_HASH is not valid for operations, only in policies.
2019-01-14 16:06:39 +01:00
Redo of PR#5345. Fixed spelling and typographical errors found by CodeSpell. Signed-off-by: Shaun Case <warmsocks@gmail.com> Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-12-21 06:14:10 +01:00
/* Enforce that the usage policy permits the requested algorithm. */
Using a wildcard as a specific algorithm now reports invalid argument Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-23 14:18:32 +01:00
if( alg != 0 )
{
Move MAC default length checking into psa_key_policy_permits Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 15:11:57 +01:00
status = psa_key_policy_permits( &slot->attr.policy,
slot->attr.type,
alg );
Using a wildcard as a specific algorithm now reports invalid argument Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-23 14:18:32 +01:00
if( status != PSA_SUCCESS )
goto error;
}
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 12:21:11 +02:00
return( PSA_SUCCESS );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
error:
*p_slot = NULL;
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
psa_unlock_key_slot( slot );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
return( status );
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 12:21:11 +02:00
}
psa: Refactor psa_import_key() Create a new function psa_import_key_into_slot() from psa_import_key(). This is common functionality that will be used both when importing a key and loading a key from persistent storage.
2018-07-13 14:18:51 +02:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
/** Get a key slot containing a transparent key and lock it.
SE keys: ensure that functions that lack support properly error out Introduce a new function psa_get_transparent_key which returns NOT_SUPPORTED if the key is in a secure element. Use this function in functions that don't support keys in a secure element. After this commit, all functions that access a key slot directly via psa_get_key_slot or psa_get_key_from_slot rather than via psa_get_transparent_key have at least enough support for secure elements not to crash or otherwise cause undefined behavior. Lesser bad behavior such as wrong results or resource leakage is still possible in error cases.
2019-07-24 13:30:31 +02:00
*
* A transparent key is a key for which the key material is directly
Clarify psa_get_and_lock_transparent_key_slot_with_policy() purpose Clarify the purpose of psa_get_and_lock_transparent_key_slot_with_policy() and define it even when MBEDTLS_PSA_CRYPTO_SE_C is disabled for the purpose of static drivers. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-08-24 15:39:44 +02:00
* available, as opposed to a key in a secure element and/or to be used
* by a secure element.
SE keys: ensure that functions that lack support properly error out Introduce a new function psa_get_transparent_key which returns NOT_SUPPORTED if the key is in a secure element. Use this function in functions that don't support keys in a secure element. After this commit, all functions that access a key slot directly via psa_get_key_slot or psa_get_key_from_slot rather than via psa_get_transparent_key have at least enough support for secure elements not to crash or otherwise cause undefined behavior. Lesser bad behavior such as wrong results or resource leakage is still possible in error cases.
2019-07-24 13:30:31 +02:00
*
Clarify psa_get_and_lock_transparent_key_slot_with_policy() purpose Clarify the purpose of psa_get_and_lock_transparent_key_slot_with_policy() and define it even when MBEDTLS_PSA_CRYPTO_SE_C is disabled for the purpose of static drivers. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-08-24 15:39:44 +02:00
* This is a temporary function that may be used instead of
* psa_get_and_lock_key_slot_with_policy() when there is no opaque key support
* for a cryptographic operation.
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
*
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
* On success, the returned key slot is locked. It is the responsibility of the
* caller to unlock the key slot when it does not access it anymore.
SE keys: ensure that functions that lack support properly error out Introduce a new function psa_get_transparent_key which returns NOT_SUPPORTED if the key is in a secure element. Use this function in functions that don't support keys in a secure element. After this commit, all functions that access a key slot directly via psa_get_key_slot or psa_get_key_from_slot rather than via psa_get_transparent_key have at least enough support for secure elements not to crash or otherwise cause undefined behavior. Lesser bad behavior such as wrong results or resource leakage is still possible in error cases.
2019-07-24 13:30:31 +02:00
*/
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
static psa_status_t psa_get_and_lock_transparent_key_slot_with_policy(
mbedtls_svc_key_id_t key,
psa_key_slot_t **p_slot,
psa_key_usage_t usage,
psa_algorithm_t alg )
SE keys: ensure that functions that lack support properly error out Introduce a new function psa_get_transparent_key which returns NOT_SUPPORTED if the key is in a secure element. Use this function in functions that don't support keys in a secure element. After this commit, all functions that access a key slot directly via psa_get_key_slot or psa_get_key_from_slot rather than via psa_get_transparent_key have at least enough support for secure elements not to crash or otherwise cause undefined behavior. Lesser bad behavior such as wrong results or resource leakage is still possible in error cases.
2019-07-24 13:30:31 +02:00
{
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
psa_status_t status = psa_get_and_lock_key_slot_with_policy( key, p_slot,
usage, alg );
SE keys: ensure that functions that lack support properly error out Introduce a new function psa_get_transparent_key which returns NOT_SUPPORTED if the key is in a secure element. Use this function in functions that don't support keys in a secure element. After this commit, all functions that access a key slot directly via psa_get_key_slot or psa_get_key_from_slot rather than via psa_get_transparent_key have at least enough support for secure elements not to crash or otherwise cause undefined behavior. Lesser bad behavior such as wrong results or resource leakage is still possible in error cases.
2019-07-24 13:30:31 +02:00
if( status != PSA_SUCCESS )
return( status );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
Clarify psa_get_and_lock_transparent_key_slot_with_policy() purpose Clarify the purpose of psa_get_and_lock_transparent_key_slot_with_policy() and define it even when MBEDTLS_PSA_CRYPTO_SE_C is disabled for the purpose of static drivers. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-08-24 15:39:44 +02:00
if( psa_key_lifetime_is_external( (*p_slot)->attr.lifetime ) )
SE keys: ensure that functions that lack support properly error out Introduce a new function psa_get_transparent_key which returns NOT_SUPPORTED if the key is in a secure element. Use this function in functions that don't support keys in a secure element. After this commit, all functions that access a key slot directly via psa_get_key_slot or psa_get_key_from_slot rather than via psa_get_transparent_key have at least enough support for secure elements not to crash or otherwise cause undefined behavior. Lesser bad behavior such as wrong results or resource leakage is still possible in error cases.
2019-07-24 13:30:31 +02:00
{
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
psa_unlock_key_slot( *p_slot );
SE keys: ensure that functions that lack support properly error out Introduce a new function psa_get_transparent_key which returns NOT_SUPPORTED if the key is in a secure element. Use this function in functions that don't support keys in a secure element. After this commit, all functions that access a key slot directly via psa_get_key_slot or psa_get_key_from_slot rather than via psa_get_transparent_key have at least enough support for secure elements not to crash or otherwise cause undefined behavior. Lesser bad behavior such as wrong results or resource leakage is still possible in error cases.
2019-07-24 13:30:31 +02:00
*p_slot = NULL;
return( PSA_ERROR_NOT_SUPPORTED );
}
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
SE keys: ensure that functions that lack support properly error out Introduce a new function psa_get_transparent_key which returns NOT_SUPPORTED if the key is in a secure element. Use this function in functions that don't support keys in a secure element. After this commit, all functions that access a key slot directly via psa_get_key_slot or psa_get_key_from_slot rather than via psa_get_transparent_key have at least enough support for secure elements not to crash or otherwise cause undefined behavior. Lesser bad behavior such as wrong results or resource leakage is still possible in error cases.
2019-07-24 13:30:31 +02:00
return( PSA_SUCCESS );
}
Use remove_key_data_from_memory instead of wipe_key_slot Since the loading attempt of a builtin key might be followed by trying to load a persistent key, we can only wipe the allocated key data, not the associated metadata. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-07 18:08:30 +02:00
psa_status_t psa_remove_key_data_from_memory( psa_key_slot_t *slot )
psa: Refactor psa_import_key() Create a new function psa_import_key_into_slot() from psa_import_key(). This is common functionality that will be used both when importing a key and loading a key from persistent storage.
2018-07-13 14:18:51 +02:00
{
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 17:52:23 +01:00
/* Data pointer will always be either a valid pointer or NULL in an
* initialized slot, so we can just free it. */
if( slot->key.data != NULL )
mbedtls_platform_zeroize( slot->key.data, slot->key.bytes);
mbedtls_free( slot->key.data );
slot->key.data = NULL;
slot->key.bytes = 0;
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
return( PSA_SUCCESS );
}
Factor the common idiom psa_wipe_key_slot into a function Many places in the code called psa_remove_key_data_from_memory (which preserves metadata for the sake of failues in psa_import_key) followed by clearing the slot data. Use an auxiliary function for this.
2018-12-03 11:58:46 +01:00
/** Completely wipe a slot in memory, including its policy.
* Persistent storage is not affected. */
Move the key slot array to the slot management module Move the key slot array and its initialization and wiping to the slot management module. Also move the lowest-level key slot access function psa_get_key_slot and the auxiliary function for slot allocation psa_internal_allocate_key_slot to the slot management module.
2018-12-10 16:29:04 +01:00
psa_status_t psa_wipe_key_slot( psa_key_slot_t *slot )
Factor the common idiom psa_wipe_key_slot into a function Many places in the code called psa_remove_key_data_from_memory (which preserves metadata for the sake of failues in psa_import_key) followed by clearing the slot data. Use an auxiliary function for this.
2018-12-03 11:58:46 +01:00
{
psa_status_t status = psa_remove_key_data_from_memory( slot );
psa: Add access counter check in slot wipe Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-30 14:07:07 +01:00
Reverting comments deleted in previous PR Signed-off-by: TRodziewicz <tomasz.rodziewicz@mobica.com>
2021-07-13 12:19:15 +02:00
/*
* As the return error code may not be handled in case of multiple errors,
Rewording comments Signed-off-by: TRodziewicz <tomasz.rodziewicz@mobica.com>
2021-07-14 10:16:26 +02:00
* do our best to report an unexpected lock counter. Assert with
* MBEDTLS_TEST_HOOK_TEST_ASSERT that the lock counter is equal to one:
* if the MBEDTLS_TEST_HOOKS configuration option is enabled and the
* function is called as part of the execution of a test suite, the
* execution of the test suite is stopped in error if the assertion fails.
Reverting comments deleted in previous PR Signed-off-by: TRodziewicz <tomasz.rodziewicz@mobica.com>
2021-07-13 12:19:15 +02:00
*/
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
if( slot->lock_count != 1 )
psa: Add access counter check in slot wipe Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-30 14:07:07 +01:00
{
Adding new macro for tests failing Signed-off-by: TRodziewicz <tomasz.rodziewicz@mobica.com>
2021-07-07 17:29:43 +02:00
MBEDTLS_TEST_HOOK_TEST_ASSERT( slot->lock_count == 1 );
psa: Add access counter check in slot wipe Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-30 14:07:07 +01:00
status = PSA_ERROR_CORRUPTION_DETECTED;
}
Document better what wiping a key slot does not do When a key slot is wiped, a copy of the key material may remain in operations. This is undesirable, but does not violate the safety of the code. Tracked in https://github.com/ARMmbed/mbed-crypto/issues/86
2019-08-13 15:01:08 +02:00
/* Multipart operations may still be using the key. This is safe
* because all multipart operation objects are independent from
* the key slot: if they need to access the key after the setup
* phase, they have a copy of the key. Note that this means that
* key material can linger until all operations are completed. */
Factor the common idiom psa_wipe_key_slot into a function Many places in the code called psa_remove_key_data_from_memory (which preserves metadata for the sake of failues in psa_import_key) followed by clearing the slot data. Use an auxiliary function for this.
2018-12-03 11:58:46 +01:00
/* At this point, key material and other type-specific content has
* been wiped. Clear remaining metadata. We can call memset and not
* zeroize because the metadata is not particularly sensitive. */
memset( slot, 0, sizeof( *slot ) );
return( status );
}
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 09:51:30 +02:00
psa_status_t psa_destroy_key( mbedtls_svc_key_id_t key )
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 15:48:15 +01:00
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *slot;
Clean up status code handling inside psa_destroy_key Adopt a simple method for tracking whether there was a failure: each fallible operation sets overall_status, unless overall_status is already non-successful. Thus in case of multiple failures, the function always reports whatever failed first. This may not always be the right thing, but it's simple. This revealed a bug whereby if the only failure was the call to psa_destroy_se_key(), i.e. if the driver reported a failure or if the driver lacked support for destroying keys, psa_destroy_key() would ignore that failure. For a key in a secure element, if creating a transaction file fails, don't touch storage, but close the key in memory. This may not be right, but it's no wronger than it was before. Tracked in https://github.com/ARMmbed/mbed-crypto/issues/215
2019-08-13 15:58:36 +02:00
psa_status_t status; /* status of the last operation */
psa_status_t overall_status = PSA_SUCCESS;
SE keys: support destroy When destroying a key in a secure element, call the driver's destroy method and update the driver's persistent data in storage.
2019-07-12 23:46:38 +02:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
psa_se_drv_table_entry_t *driver;
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 15:48:15 +01:00
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 09:51:30 +02:00
if( mbedtls_svc_key_id_is_null( key ) )
Make psa_close_key(0) and psa_destroy_key(0) succeed
2019-10-08 15:48:25 +02:00
return( PSA_SUCCESS );
psa: Do not reset a key slot under access When psa_close/destroy/purge_key is called, do not reset a key slot containing the description of a persistent key if it is currently accessed. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-29 17:51:10 +01:00
/*
Prefer persistent over permanent For consistency across the code base, prefer persistent over permanent to qualify a key stored in persistent storage. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-10 18:08:03 +01:00
* Get the description of the key in a key slot. In case of a persistent
psa: Do not reset a key slot under access When psa_close/destroy/purge_key is called, do not reset a key slot containing the description of a persistent key if it is currently accessed. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-29 17:51:10 +01:00
* key, this will load the key description from persistent memory if not
* done yet. We cannot avoid this loading as without it we don't know if
* the key is operated by an SE or not and this information is needed by
* the current implementation.
*/
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
status = psa_get_and_lock_key_slot( key, &slot );
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 15:48:15 +01:00
if( status != PSA_SUCCESS )
return( status );
psa: Do not reset a key slot under access When psa_close/destroy/purge_key is called, do not reset a key slot containing the description of a persistent key if it is currently accessed. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-29 17:51:10 +01:00
/*
* If the key slot containing the key description is under access by the
* library (apart from the present access), the key cannot be destroyed
* yet. For the time being, just return in error. Eventually (to be
* implemented), the key should be destroyed when all accesses have
* stopped.
*/
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
if( slot->lock_count > 1 )
psa: Do not reset a key slot under access When psa_close/destroy/purge_key is called, do not reset a key slot containing the description of a persistent key if it is currently accessed. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-29 17:51:10 +01:00
{
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
psa_unlock_key_slot( slot );
psa: Do not reset a key slot under access When psa_close/destroy/purge_key is called, do not reset a key slot containing the description of a persistent key if it is currently accessed. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-29 17:51:10 +01:00
return( PSA_ERROR_GENERIC_ERROR );
}
Refuse to destroy read-only keys Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-21 22:32:05 +02:00
if( PSA_KEY_LIFETIME_IS_READ_ONLY( slot->attr.lifetime ) )
{
/* Refuse the destruction of a read-only key (which may or may not work
* if we attempt it, depending on whether the key is merely read-only
* by policy or actually physically read-only).
Remove duplicate wipe call in psa_destroy_key Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-06-07 23:27:54 +02:00
* Just do the best we can, which is to wipe the copy in memory
* (done in this function's cleanup code). */
overall_status = PSA_ERROR_NOT_PERMITTED;
goto exit;
Refuse to destroy read-only keys Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-21 22:32:05 +02:00
}
SE keys: support destroy When destroying a key in a secure element, call the driver's destroy method and update the driver's persistent data in storage.
2019-07-12 23:46:38 +02:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 20:06:31 +02:00
driver = psa_get_se_driver_entry( slot->attr.lifetime );
SE keys: support destroy When destroying a key in a secure element, call the driver's destroy method and update the driver's persistent data in storage.
2019-07-12 23:46:38 +02:00
if( driver != NULL )
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 19:30:34 +02:00
{
Improve comments
2019-07-25 11:32:45 +02:00
/* For a key in a secure element, we need to do three things:
* remove the key file in internal storage, destroy the
* key inside the secure element, and update the driver's
* persistent data. Start a transaction that will encompass these
* three actions. */
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 19:30:34 +02:00
psa_crypto_prepare_transaction( PSA_CRYPTO_TRANSACTION_DESTROY_KEY );
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 20:06:31 +02:00
psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 17:52:23 +01:00
psa_crypto_transaction.key.slot = psa_key_slot_get_slot_number( slot );
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 20:06:31 +02:00
psa_crypto_transaction.key.id = slot->attr.id;
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 19:30:34 +02:00
status = psa_crypto_save_transaction( );
if( status != PSA_SUCCESS )
{
If starting a transaction fails, wipe the transaction data Nothing has been saved to disk yet, but there is stale data in psa_crypto_transaction. This stale data should not be reused, but do wipe it to reduce the risk of it mattering somehow in the future.
2019-07-25 18:02:52 +02:00
(void) psa_crypto_stop_transaction( );
Clean up status code handling inside psa_destroy_key Adopt a simple method for tracking whether there was a failure: each fallible operation sets overall_status, unless overall_status is already non-successful. Thus in case of multiple failures, the function always reports whatever failed first. This may not always be the right thing, but it's simple. This revealed a bug whereby if the only failure was the call to psa_destroy_se_key(), i.e. if the driver reported a failure or if the driver lacked support for destroying keys, psa_destroy_key() would ignore that failure. For a key in a secure element, if creating a transaction file fails, don't touch storage, but close the key in memory. This may not be right, but it's no wronger than it was before. Tracked in https://github.com/ARMmbed/mbed-crypto/issues/215
2019-08-13 15:58:36 +02:00
/* We should still try to destroy the key in the secure
* element and the key metadata in storage. This is especially
* important if the error is that the storage is full.
* But how to do it exactly without risking an inconsistent
* state after a reset?
* https://github.com/ARMmbed/mbed-crypto/issues/215
*/
overall_status = status;
goto exit;
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 19:30:34 +02:00
}
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 17:52:23 +01:00
status = psa_destroy_se_key( driver,
psa_key_slot_get_slot_number( slot ) );
Clean up status code handling inside psa_destroy_key Adopt a simple method for tracking whether there was a failure: each fallible operation sets overall_status, unless overall_status is already non-successful. Thus in case of multiple failures, the function always reports whatever failed first. This may not always be the right thing, but it's simple. This revealed a bug whereby if the only failure was the call to psa_destroy_se_key(), i.e. if the driver reported a failure or if the driver lacked support for destroying keys, psa_destroy_key() would ignore that failure. For a key in a secure element, if creating a transaction file fails, don't touch storage, but close the key in memory. This may not be right, but it's no wronger than it was before. Tracked in https://github.com/ARMmbed/mbed-crypto/issues/215
2019-08-13 15:58:36 +02:00
if( overall_status == PSA_SUCCESS )
overall_status = status;
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 19:30:34 +02:00
}
SE keys: support destroy When destroying a key in a secure element, call the driver's destroy method and update the driver's persistent data in storage.
2019-07-12 23:46:38 +02:00
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 15:48:15 +01:00
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
psa: Fix tests/handling of lifetime incompatible with location The lifetime of key attributes now encodes whether a key is volatile/persistent or not AND its location. Fix PSA code where the fact that the lifetime encodes the key location was not taken into account properly. Fix the impacted tests and add two non regression tests. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-23 18:00:55 +02:00
if( ! PSA_KEY_LIFETIME_IS_VOLATILE( slot->attr.lifetime ) )
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 15:48:15 +01:00
{
Clean up status code handling inside psa_destroy_key Adopt a simple method for tracking whether there was a failure: each fallible operation sets overall_status, unless overall_status is already non-successful. Thus in case of multiple failures, the function always reports whatever failed first. This may not always be the right thing, but it's simple. This revealed a bug whereby if the only failure was the call to psa_destroy_se_key(), i.e. if the driver reported a failure or if the driver lacked support for destroying keys, psa_destroy_key() would ignore that failure. For a key in a secure element, if creating a transaction file fails, don't touch storage, but close the key in memory. This may not be right, but it's no wronger than it was before. Tracked in https://github.com/ARMmbed/mbed-crypto/issues/215
2019-08-13 15:58:36 +02:00
status = psa_destroy_persistent_key( slot->attr.id );
if( overall_status == PSA_SUCCESS )
overall_status = status;
Note about destroying a key with other open handles https://github.com/ARMmbed/mbed-crypto/issues/214
2019-08-13 15:14:20 +02:00
/* TODO: other slots may have a copy of the same key. We should
* invalidate them.
* https://github.com/ARMmbed/mbed-crypto/issues/214
*/
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 15:48:15 +01:00
}
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 15:48:15 +01:00
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 19:30:34 +02:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
if( driver != NULL )
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
{
Bug fix: save the driver's persistent data in destroy_key
2019-07-25 11:31:48 +02:00
status = psa_save_se_persistent_data( driver );
Clean up status code handling inside psa_destroy_key Adopt a simple method for tracking whether there was a failure: each fallible operation sets overall_status, unless overall_status is already non-successful. Thus in case of multiple failures, the function always reports whatever failed first. This may not always be the right thing, but it's simple. This revealed a bug whereby if the only failure was the call to psa_destroy_se_key(), i.e. if the driver reported a failure or if the driver lacked support for destroying keys, psa_destroy_key() would ignore that failure. For a key in a secure element, if creating a transaction file fails, don't touch storage, but close the key in memory. This may not be right, but it's no wronger than it was before. Tracked in https://github.com/ARMmbed/mbed-crypto/issues/215
2019-08-13 15:58:36 +02:00
if( overall_status == PSA_SUCCESS )
overall_status = status;
status = psa_crypto_stop_transaction( );
if( overall_status == PSA_SUCCESS )
overall_status = status;
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
}
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 19:30:34 +02:00
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
Clean up status code handling inside psa_destroy_key Adopt a simple method for tracking whether there was a failure: each fallible operation sets overall_status, unless overall_status is already non-successful. Thus in case of multiple failures, the function always reports whatever failed first. This may not always be the right thing, but it's simple. This revealed a bug whereby if the only failure was the call to psa_destroy_se_key(), i.e. if the driver reported a failure or if the driver lacked support for destroying keys, psa_destroy_key() would ignore that failure. For a key in a secure element, if creating a transaction file fails, don't touch storage, but close the key in memory. This may not be right, but it's no wronger than it was before. Tracked in https://github.com/ARMmbed/mbed-crypto/issues/215
2019-08-13 15:58:36 +02:00
exit:
Factor the common idiom psa_wipe_key_slot into a function Many places in the code called psa_remove_key_data_from_memory (which preserves metadata for the sake of failues in psa_import_key) followed by clearing the slot data. Use an auxiliary function for this.
2018-12-03 11:58:46 +01:00
status = psa_wipe_key_slot( slot );
Clean up status code handling inside psa_destroy_key Adopt a simple method for tracking whether there was a failure: each fallible operation sets overall_status, unless overall_status is already non-successful. Thus in case of multiple failures, the function always reports whatever failed first. This may not always be the right thing, but it's simple. This revealed a bug whereby if the only failure was the call to psa_destroy_se_key(), i.e. if the driver reported a failure or if the driver lacked support for destroying keys, psa_destroy_key() would ignore that failure. For a key in a secure element, if creating a transaction file fails, don't touch storage, but close the key in memory. This may not be right, but it's no wronger than it was before. Tracked in https://github.com/ARMmbed/mbed-crypto/issues/215
2019-08-13 15:58:36 +02:00
/* Prioritize CORRUPTION_DETECTED from wiping over a storage error */
Remove duplicate wipe call in psa_destroy_key Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-06-07 23:27:54 +02:00
if( status != PSA_SUCCESS )
Clean up status code handling inside psa_destroy_key Adopt a simple method for tracking whether there was a failure: each fallible operation sets overall_status, unless overall_status is already non-successful. Thus in case of multiple failures, the function always reports whatever failed first. This may not always be the right thing, but it's simple. This revealed a bug whereby if the only failure was the call to psa_destroy_se_key(), i.e. if the driver reported a failure or if the driver lacked support for destroying keys, psa_destroy_key() would ignore that failure. For a key in a secure element, if creating a transaction file fails, don't touch storage, but close the key in memory. This may not be right, but it's no wronger than it was before. Tracked in https://github.com/ARMmbed/mbed-crypto/issues/215
2019-08-13 15:58:36 +02:00
overall_status = status;
return( overall_status );
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 15:48:15 +01:00
}
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
Add feature support for RSA for PSA crypto config In the original attempt to add RSA support to PSA crypto config was too generic. This set of changes adds support for the following RSA features: PSA_WANT_ALG_RSA_PKCS1V15_CRYPT, PSA_WANT_ALG_RSA_PKCS1V15_SIGN, PSA_WANT_ALG_RSA_OAEP, PSA_WANT_ALG_RSA_PSS, PSA_WANT_KEY_TYPE_RSA_KEY_PAIR, and PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY. There were also some updates to ensure the proper inclusion of PSA crypto library code when certain features are enabled. These updates were made to address warnings and errors in builds from the new tests for these features being added for PSA crypto configuration. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-01 06:06:54 +01:00
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Switch psa_{get,set}_domain_parameters to attributes Change psa_get_domain_parameters() and psa_set_domain_parameters() to access a psa_key_attributes_t structure rather than a key handle. In psa_get_key_attributes(), treat the RSA public exponent as a domain parameter and read it out. This is in preparation for removing the `extra` parameter of psa_generate_key() and setting the RSA public exponent for key generation via domain parameters. In this commit, the default public exponent 65537 is not treated specially, which allows us to verify that test code that should be calling psa_reset_key_attributes() after retrieving the attributes of an RSA key is doing so properly (if it wasn't, there would be a memory leak), even if the test data happens to use an RSA key with the default public exponent.
2019-04-26 16:06:02 +02:00
static psa_status_t psa_get_rsa_public_exponent(
const mbedtls_rsa_context *rsa,
psa_key_attributes_t *attributes )
{
mbedtls_mpi mpi;
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 14:21:35 +01:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Switch psa_{get,set}_domain_parameters to attributes Change psa_get_domain_parameters() and psa_set_domain_parameters() to access a psa_key_attributes_t structure rather than a key handle. In psa_get_key_attributes(), treat the RSA public exponent as a domain parameter and read it out. This is in preparation for removing the `extra` parameter of psa_generate_key() and setting the RSA public exponent for key generation via domain parameters. In this commit, the default public exponent 65537 is not treated specially, which allows us to verify that test code that should be calling psa_reset_key_attributes() after retrieving the attributes of an RSA key is doing so properly (if it wasn't, there would be a memory leak), even if the test data happens to use an RSA key with the default public exponent.
2019-04-26 16:06:02 +02:00
uint8_t *buffer = NULL;
size_t buflen;
mbedtls_mpi_init( &mpi );
ret = mbedtls_rsa_export( rsa, NULL, NULL, NULL, NULL, &mpi );
if( ret != 0 )
goto exit;
psa_get_domain_parameters: for RSA, if e=65537, output an empty string
2019-04-26 17:37:21 +02:00
if( mbedtls_mpi_cmp_int( &mpi, 65537 ) == 0 )
{
/* It's the default value, which is reported as an empty string,
* so there's nothing to do. */
goto exit;
}
Switch psa_{get,set}_domain_parameters to attributes Change psa_get_domain_parameters() and psa_set_domain_parameters() to access a psa_key_attributes_t structure rather than a key handle. In psa_get_key_attributes(), treat the RSA public exponent as a domain parameter and read it out. This is in preparation for removing the `extra` parameter of psa_generate_key() and setting the RSA public exponent for key generation via domain parameters. In this commit, the default public exponent 65537 is not treated specially, which allows us to verify that test code that should be calling psa_reset_key_attributes() after retrieving the attributes of an RSA key is doing so properly (if it wasn't, there would be a memory leak), even if the test data happens to use an RSA key with the default public exponent.
2019-04-26 16:06:02 +02:00
buflen = mbedtls_mpi_size( &mpi );
buffer = mbedtls_calloc( 1, buflen );
if( buffer == NULL )
{
ret = MBEDTLS_ERR_MPI_ALLOC_FAILED;
goto exit;
}
ret = mbedtls_mpi_write_binary( &mpi, buffer, buflen );
if( ret != 0 )
goto exit;
attributes->domain_parameters = buffer;
attributes->domain_parameters_size = buflen;
exit:
mbedtls_mpi_free( &mpi );
if( ret != 0 )
mbedtls_free( buffer );
return( mbedtls_to_psa_error( ret ) );
New internal function psa_get_key_bits Isolate the code of psa_get_key_information that calculates the bit size of a key into its own function which can be called by functions that have a key slot pointer.
2018-07-06 16:02:09 +02:00
}
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 21:28:15 +01:00
* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
New internal function psa_get_key_bits Isolate the code of psa_get_key_information that calculates the bit size of a key into its own function which can be called by functions that have a key slot pointer.
2018-07-06 16:02:09 +02:00
Use a key attribute structure in the internal storage interface Pass information via a key attribute structure rather than as separate parameters to psa_crypto_storage functions. This makes it easier to maintain the code when the metadata of a key evolves. This has negligible impact on code size (+4B with "gcc -Os" on x86_64).
2019-07-23 11:58:03 +02:00
/** Retrieve all the publicly-accessible attributes of a key.
*/
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 09:51:30 +02:00
psa_status_t psa_get_key_attributes( mbedtls_svc_key_id_t key,
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 21:44:46 +02:00
psa_key_attributes_t *attributes )
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
{
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *slot;
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 21:44:46 +02:00
psa_reset_key_attributes( attributes );
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
status = psa_get_and_lock_key_slot_with_policy( key, &slot, 0, 0 );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
if( status != PSA_SUCCESS )
return( status );
New internal function psa_get_key_bits Isolate the code of psa_get_key_information that calculates the bit size of a key into its own function which can be called by functions that have a key slot pointer.
2018-07-06 16:02:09 +02:00
Take advantage of psa_core_key_attributes_t internally #2 Key creation and psa_get_key_attributes
2019-07-31 14:15:34 +02:00
attributes->core = slot->attr;
Add slot_number attribute Add a slot_number field to psa_key_attributes_t and getter/setter functions. Since slot numbers can have the value 0, indicate the presence of the field via a separate flag. In psa_get_key_attributes(), report the slot number if the key is in a secure element. When creating a key, for now, applications cannot choose a slot number. A subsequent commit will add this capability in the secure element HAL.
2019-08-02 20:15:51 +02:00
attributes->core.flags &= ( MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY |
MBEDTLS_PSA_KA_MASK_DUAL_USE );
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
psa: Fix slot number key attribute Slot number key attribute is specific of dynamically registered drivers and should thus not be computed/ returned in case of keys associated to drivers implementing the new unified driver interface. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-08-24 15:50:05 +02:00
if( psa_get_se_driver_entry( slot->attr.lifetime ) != NULL )
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 17:52:23 +01:00
psa_set_key_slot_number( attributes,
psa_key_slot_get_slot_number( slot ) );
Add slot_number attribute Add a slot_number field to psa_key_attributes_t and getter/setter functions. Since slot numbers can have the value 0, indicate the presence of the field via a separate flag. In psa_get_key_attributes(), report the slot number if the key is in a secure element. When creating a key, for now, applications cannot choose a slot number. A subsequent commit will add this capability in the secure element HAL.
2019-08-02 20:15:51 +02:00
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Switch psa_{get,set}_domain_parameters to attributes Change psa_get_domain_parameters() and psa_set_domain_parameters() to access a psa_key_attributes_t structure rather than a key handle. In psa_get_key_attributes(), treat the RSA public exponent as a domain parameter and read it out. This is in preparation for removing the `extra` parameter of psa_generate_key() and setting the RSA public exponent for key generation via domain parameters. In this commit, the default public exponent 65537 is not treated specially, which allows us to verify that test code that should be calling psa_reset_key_attributes() after retrieving the attributes of an RSA key is doing so properly (if it wasn't, there would be a memory leak), even if the test data happens to use an RSA key with the default public exponent.
2019-04-26 16:06:02 +02:00
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 20:06:31 +02:00
switch( slot->attr.type )
Switch psa_{get,set}_domain_parameters to attributes Change psa_get_domain_parameters() and psa_set_domain_parameters() to access a psa_key_attributes_t structure rather than a key handle. In psa_get_key_attributes(), treat the RSA public exponent as a domain parameter and read it out. This is in preparation for removing the `extra` parameter of psa_generate_key() and setting the RSA public exponent for key generation via domain parameters. In this commit, the default public exponent 65537 is not treated specially, which allows us to verify that test code that should be calling psa_reset_key_attributes() after retrieving the attributes of an RSA key is doing so properly (if it wasn't, there would be a memory leak), even if the test data happens to use an RSA key with the default public exponent.
2019-04-26 16:06:02 +02:00
{
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
Add feature support for RSA for PSA crypto config In the original attempt to add RSA support to PSA crypto config was too generic. This set of changes adds support for the following RSA features: PSA_WANT_ALG_RSA_PKCS1V15_CRYPT, PSA_WANT_ALG_RSA_PKCS1V15_SIGN, PSA_WANT_ALG_RSA_OAEP, PSA_WANT_ALG_RSA_PSS, PSA_WANT_KEY_TYPE_RSA_KEY_PAIR, and PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY. There were also some updates to ensure the proper inclusion of PSA crypto library code when certain features are enabled. These updates were made to address warnings and errors in builds from the new tests for these features being added for PSA crypto configuration. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-01 06:06:54 +01:00
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Rename *KEYPAIR* to *KEY_PAIR* Be consistent with PUBLIC_KEY. perl -i -pe 's/KEYPAIR/KEY_PAIR/g' $(git ls-files)
2019-05-16 19:39:54 +02:00
case PSA_KEY_TYPE_RSA_KEY_PAIR:
Switch psa_{get,set}_domain_parameters to attributes Change psa_get_domain_parameters() and psa_set_domain_parameters() to access a psa_key_attributes_t structure rather than a key handle. In psa_get_key_attributes(), treat the RSA public exponent as a domain parameter and read it out. This is in preparation for removing the `extra` parameter of psa_generate_key() and setting the RSA public exponent for key generation via domain parameters. In this commit, the default public exponent 65537 is not treated specially, which allows us to verify that test code that should be calling psa_reset_key_attributes() after retrieving the attributes of an RSA key is doing so properly (if it wasn't, there would be a memory leak), even if the test data happens to use an RSA key with the default public exponent.
2019-04-26 16:06:02 +02:00
case PSA_KEY_TYPE_RSA_PUBLIC_KEY:
Make TODO comments consistent
2019-08-13 13:15:34 +02:00
/* TODO: reporting the public exponent for opaque keys
Add issue numbers for some missing parts of secure element support
2019-08-13 16:17:16 +02:00
* is not yet implemented.
* https://github.com/ARMmbed/mbed-crypto/issues/216
*/
psa: Remove buggy report of RSA public exponent for opaque keys The report of RSA public exponent for opaque keys is not supported. Do not attempt to compute the RSA public exponent of an RSA opaque key associated to a driver implementing the new driver interface when MBEDTLS_PSA_CRYPTO_SE_C is disabled. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-08-24 16:00:51 +02:00
if( ! psa_key_lifetime_is_external( slot->attr.lifetime ) )
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 22:48:15 +02:00
{
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 14:30:39 +02:00
mbedtls_rsa_context *rsa = NULL;
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 22:48:15 +02:00
psa: Rename psa_load_rsa/ecp_representation Rename psa_load_rsa/ecp_representation to mbedtls_psa_rsa/ecp_load_representation before to move them in their RSA/ECP specific PSA crypto C modules. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 14:58:33 +01:00
status = mbedtls_psa_rsa_load_representation(
slot->attr.type,
slot->key.data,
slot->key.bytes,
&rsa );
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 22:48:15 +02:00
if( status != PSA_SUCCESS )
break;
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 14:30:39 +02:00
status = psa_get_rsa_public_exponent( rsa,
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 22:48:15 +02:00
attributes );
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 14:30:39 +02:00
mbedtls_rsa_free( rsa );
mbedtls_free( rsa );
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 22:48:15 +02:00
}
Switch psa_{get,set}_domain_parameters to attributes Change psa_get_domain_parameters() and psa_set_domain_parameters() to access a psa_key_attributes_t structure rather than a key handle. In psa_get_key_attributes(), treat the RSA public exponent as a domain parameter and read it out. This is in preparation for removing the `extra` parameter of psa_generate_key() and setting the RSA public exponent for key generation via domain parameters. In this commit, the default public exponent 65537 is not treated specially, which allows us to verify that test code that should be calling psa_reset_key_attributes() after retrieving the attributes of an RSA key is doing so properly (if it wasn't, there would be a memory leak), even if the test data happens to use an RSA key with the default public exponent.
2019-04-26 16:06:02 +02:00
break;
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 21:28:15 +01:00
* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Switch psa_{get,set}_domain_parameters to attributes Change psa_get_domain_parameters() and psa_set_domain_parameters() to access a psa_key_attributes_t structure rather than a key handle. In psa_get_key_attributes(), treat the RSA public exponent as a domain parameter and read it out. This is in preparation for removing the `extra` parameter of psa_generate_key() and setting the RSA public exponent for key generation via domain parameters. In this commit, the default public exponent 65537 is not treated specially, which allows us to verify that test code that should be calling psa_reset_key_attributes() after retrieving the attributes of an RSA key is doing so properly (if it wasn't, there would be a memory leak), even if the test data happens to use an RSA key with the default public exponent.
2019-04-26 16:06:02 +02:00
default:
/* Nothing else to do. */
break;
}
if( status != PSA_SUCCESS )
psa_reset_key_attributes( attributes );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
unlock_status = psa_unlock_key_slot( slot );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
}
Add slot_number attribute Add a slot_number field to psa_key_attributes_t and getter/setter functions. Since slot numbers can have the value 0, indicate the presence of the field via a separate flag. In psa_get_key_attributes(), report the slot number if the key is in a secure element. When creating a key, for now, applications cannot choose a slot number. A subsequent commit will add this capability in the secure element HAL.
2019-08-02 20:15:51 +02:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
psa_status_t psa_get_key_slot_number(
const psa_key_attributes_t *attributes,
psa_key_slot_number_t *slot_number )
{
if( attributes->core.flags & MBEDTLS_PSA_KA_FLAG_HAS_SLOT_NUMBER )
{
*slot_number = attributes->slot_number;
return( PSA_SUCCESS );
}
else
return( PSA_ERROR_INVALID_ARGUMENT );
}
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
psa: Change psa_export_(public_)key_internal signature Change psa_export_(public_)key_internal signature to the signature of an export_(public_)key driver entry point. This is a preparatory commit to be able to call the software implementations as a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:46:05 +01:00
static psa_status_t psa_export_key_buffer_internal( const uint8_t *key_buffer,
size_t key_buffer_size,
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 22:48:15 +02:00
uint8_t *data,
size_t data_size,
size_t *data_length )
{
psa: Change psa_export_(public_)key_internal signature Change psa_export_(public_)key_internal signature to the signature of an export_(public_)key driver entry point. This is a preparatory commit to be able to call the software implementations as a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:46:05 +01:00
if( key_buffer_size > data_size )
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 22:48:15 +02:00
return( PSA_ERROR_BUFFER_TOO_SMALL );
psa: Change psa_export_(public_)key_internal signature Change psa_export_(public_)key_internal signature to the signature of an export_(public_)key driver entry point. This is a preparatory commit to be able to call the software implementations as a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:46:05 +01:00
memcpy( data, key_buffer, key_buffer_size );
memset( data + key_buffer_size, 0,
data_size - key_buffer_size );
*data_length = key_buffer_size;
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 22:48:15 +02:00
return( PSA_SUCCESS );
}
psa: Export internally psa_export_(public_)key_internal Export psa_export_(public_)key_internal from psa_crypto.c to make it available to the driver wrapper. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-26 14:46:37 +01:00
psa_status_t psa_export_key_internal(
psa: Change psa_export_(public_)key_internal signature Change psa_export_(public_)key_internal signature to the signature of an export_(public_)key driver entry point. This is a preparatory commit to be able to call the software implementations as a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:46:05 +01:00
const psa_key_attributes_t *attributes,
const uint8_t *key_buffer, size_t key_buffer_size,
uint8_t *data, size_t data_size, size_t *data_length )
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
{
psa: Change psa_export_(public_)key_internal signature Change psa_export_(public_)key_internal signature to the signature of an export_(public_)key driver entry point. This is a preparatory commit to be able to call the software implementations as a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:46:05 +01:00
psa_key_type_t type = attributes->core.type;
if( key_type_is_raw_bytes( type ) ||
PSA_KEY_TYPE_IS_RSA( type ) ||
PSA_KEY_TYPE_IS_ECC( type ) )
psa: Disentangle public export and export code Disentangle public export and export code to be able to move the call to export and public export operations to the driver wrapper. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-26 13:36:23 +01:00
{
return( psa_export_key_buffer_internal(
psa: Change psa_export_(public_)key_internal signature Change psa_export_(public_)key_internal signature to the signature of an export_(public_)key driver entry point. This is a preparatory commit to be able to call the software implementations as a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:46:05 +01:00
key_buffer, key_buffer_size,
data, data_size, data_length ) );
psa: Disentangle public export and export code Disentangle public export and export code to be able to move the call to export and public export operations to the driver wrapper. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-26 13:36:23 +01:00
}
else
{
/* This shouldn't happen in the reference implementation, but
it is valid for a special-purpose implementation to omit
support for exporting certain key types. */
return( PSA_ERROR_NOT_SUPPORTED );
}
}
psa_status_t psa_export_key( mbedtls_svc_key_id_t key,
uint8_t *data,
size_t data_size,
size_t *data_length )
{
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
psa_key_slot_t *slot;
psa: export: Check output buffer size earlier Check output buffer size before doing anything that requires a clean-up if a failure happens. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-01-18 13:22:38 +01:00
/* Reject a zero-length output buffer now, since this can never be a
* valid key representation. This way we know that data must be a valid
* pointer and we can do things like memset(data, ..., data_size). */
if( data_size == 0 )
return( PSA_ERROR_BUFFER_TOO_SMALL );
psa: Disentangle public export and export code Disentangle public export and export code to be able to move the call to export and public export operations to the driver wrapper. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-26 13:36:23 +01:00
/* Set the key to empty now, so that even when there are errors, we always
* set data_length to a value between 0 and data_size. On error, setting
* the key to empty is a good choice because an empty key representation is
* unlikely to be accepted anywhere. */
psa_export_key: Always set a valid data length Make psa_export_key() always set a valid data_length when exporting, even when there are errors. This makes the API easier to use for buggy programs (like our test code). Our test code previously used exported_length uninitialized when checking to see that the buffer returned was all zero in import_export() in the case where an error was returned from psa_export_key(). Initialize exported_length to an invalid length, and check that it gets set properly by psa_export_key(), to avoid this using export_length uninitialized. Note that the mem_is_zero() check is still valid when psa_export_key() returns an error, e.g. where exported_length is 0, as we want to check that nothing was written to the buffer on error. Out test code also previous passed NULL for the data_length parameter of psa_export_key() when it expected a failure (in key_policy_fail()). However, data_length is not allowed to be NULL, especially now that we write to data_length from psa_export_key() even when there are errors. Update the test code to not pass in a NULL data_length.
2018-06-27 18:20:43 +02:00
*data_length = 0;
psa: Disentangle public export and export code Disentangle public export and export code to be able to move the call to export and public export operations to the driver wrapper. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-26 13:36:23 +01:00
/* Export requires the EXPORT flag. There is an exception for public keys,
* which don't require any flag, but
* psa_get_and_lock_key_slot_with_policy() takes care of this.
*/
status = psa_get_and_lock_key_slot_with_policy( key, &slot,
PSA_KEY_USAGE_EXPORT, 0 );
if( status != PSA_SUCCESS )
return( status );
integrate policy key usage in export and asymmetric sign functions
2018-03-28 12:17:44 +02:00
psa: Change psa_export_(public_)key_internal signature Change psa_export_(public_)key_internal signature to the signature of an export_(public_)key driver entry point. This is a preparatory commit to be able to call the software implementations as a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:46:05 +01:00
psa_key_attributes_t attributes = {
.core = slot->attr
};
psa: Call export software implementation as a driver Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-26 15:16:05 +01:00
status = psa_driver_wrapper_export_key( &attributes,
psa: Change psa_export_(public_)key_internal signature Change psa_export_(public_)key_internal signature to the signature of an export_(public_)key driver entry point. This is a preparatory commit to be able to call the software implementations as a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:46:05 +01:00
slot->key.data, slot->key.bytes,
data, data_size, data_length );
psa: Disentangle public export and export code Disentangle public export and export code to be able to move the call to export and public export operations to the driver wrapper. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-26 13:36:23 +01:00
unlock_status = psa_unlock_key_slot( slot );
return( ( status == PSA_SUCCESS ) ? unlock_status : status );
}
psa: Export internally psa_export_(public_)key_internal Export psa_export_(public_)key_internal from psa_crypto.c to make it available to the driver wrapper. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-26 14:46:37 +01:00
psa_status_t psa_export_public_key_internal(
psa: Change psa_export_(public_)key_internal signature Change psa_export_(public_)key_internal signature to the signature of an export_(public_)key driver entry point. This is a preparatory commit to be able to call the software implementations as a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:46:05 +01:00
const psa_key_attributes_t *attributes,
const uint8_t *key_buffer,
size_t key_buffer_size,
uint8_t *data,
size_t data_size,
size_t *data_length )
psa: Disentangle public export and export code Disentangle public export and export code to be able to move the call to export and public export operations to the driver wrapper. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-26 13:36:23 +01:00
{
psa: Change psa_export_(public_)key_internal signature Change psa_export_(public_)key_internal signature to the signature of an export_(public_)key driver entry point. This is a preparatory commit to be able to call the software implementations as a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:46:05 +01:00
psa_key_type_t type = attributes->core.type;
if( PSA_KEY_TYPE_IS_RSA( type ) || PSA_KEY_TYPE_IS_ECC( type ) )
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
{
psa: Change psa_export_(public_)key_internal signature Change psa_export_(public_)key_internal signature to the signature of an export_(public_)key driver entry point. This is a preparatory commit to be able to call the software implementations as a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:46:05 +01:00
if( PSA_KEY_TYPE_IS_PUBLIC_KEY( type ) )
Unify key handling logic Now that both ECP and RSA keys are represented in export representation, they can be treated more uniformly. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 23:20:24 +02:00
{
/* Exporting public -> public */
psa: Disentangle public export and export code Disentangle public export and export code to be able to move the call to export and public export operations to the driver wrapper. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-26 13:36:23 +01:00
return( psa_export_key_buffer_internal(
psa: Change psa_export_(public_)key_internal signature Change psa_export_(public_)key_internal signature to the signature of an export_(public_)key driver entry point. This is a preparatory commit to be able to call the software implementations as a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:46:05 +01:00
key_buffer, key_buffer_size,
data, data_size, data_length ) );
Unify key handling logic Now that both ECP and RSA keys are represented in export representation, they can be treated more uniformly. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 23:20:24 +02:00
}
Plug in the entry point for public key export through driver Including test. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-14 14:39:20 +02:00
psa: Change psa_export_(public_)key_internal signature Change psa_export_(public_)key_internal signature to the signature of an export_(public_)key driver entry point. This is a preparatory commit to be able to call the software implementations as a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:46:05 +01:00
if( PSA_KEY_TYPE_IS_RSA( type ) )
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 18:16:59 +01:00
{
Add feature support for RSA for PSA crypto config In the original attempt to add RSA support to PSA crypto config was too generic. This set of changes adds support for the following RSA features: PSA_WANT_ALG_RSA_PKCS1V15_CRYPT, PSA_WANT_ALG_RSA_PKCS1V15_SIGN, PSA_WANT_ALG_RSA_OAEP, PSA_WANT_ALG_RSA_PSS, PSA_WANT_KEY_TYPE_RSA_KEY_PAIR, and PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY. There were also some updates to ensure the proper inclusion of PSA crypto library code when certain features are enabled. These updates were made to address warnings and errors in builds from the new tests for these features being added for PSA crypto configuration. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-01 06:06:54 +01:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
psa: Move RSA/ECP export code to RSA/ECP specific C file Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-26 16:36:16 +01:00
return( mbedtls_psa_rsa_export_public_key( attributes,
key_buffer,
key_buffer_size,
data,
data_size,
data_length ) );
Add ifdefs for psa_internal_export_key function MBEDTLS_PK_WRITE_C only requires either MBEDTLS_RSA_C or MBEDTLS_ECP_C to be defined. Added wrappers to handle the cases where only one has been defined. Moved mbedtls_pk_init to be within the ifdefs, so it's only called if appropriate.
2018-07-24 17:33:30 +02:00
#else
Unify key handling logic Now that both ECP and RSA keys are represented in export representation, they can be treated more uniformly. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 23:20:24 +02:00
/* We don't know how to convert a private RSA key to public. */
return( PSA_ERROR_NOT_SUPPORTED );
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 21:28:15 +01:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Unify key handling logic Now that both ECP and RSA keys are represented in export representation, they can be treated more uniformly. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 23:20:24 +02:00
}
else
{
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 17:50:04 +01:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)
psa: Move RSA/ECP export code to RSA/ECP specific C file Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-26 16:36:16 +01:00
return( mbedtls_psa_ecp_export_public_key( attributes,
key_buffer,
key_buffer_size,
data,
data_size,
data_length ) );
Add ifdefs for psa_internal_export_key function MBEDTLS_PK_WRITE_C only requires either MBEDTLS_RSA_C or MBEDTLS_ECP_C to be defined. Added wrappers to handle the cases where only one has been defined. Moved mbedtls_pk_init to be within the ifdefs, so it's only called if appropriate.
2018-07-24 17:33:30 +02:00
#else
Unify key handling logic Now that both ECP and RSA keys are represented in export representation, they can be treated more uniformly. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 23:20:24 +02:00
/* We don't know how to convert a private ECC key to public */
psa_internal_export_key function for common code. create psa_internal_export_key function for common code in psa_export_key and psa_export_public_key.
2018-04-16 17:16:20 +02:00
return( PSA_ERROR_NOT_SUPPORTED );
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 21:28:15 +01:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 18:16:59 +01:00
}
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
}
Unify key handling logic Now that both ECP and RSA keys are represented in export representation, they can be treated more uniformly. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 23:20:24 +02:00
else
{
/* This shouldn't happen in the reference implementation, but
it is valid for a special-purpose implementation to omit
support for exporting certain key types. */
return( PSA_ERROR_NOT_SUPPORTED );
}
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
}
psa: Change psa_export_(public_)key_internal signature Change psa_export_(public_)key_internal signature to the signature of an export_(public_)key driver entry point. This is a preparatory commit to be able to call the software implementations as a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:46:05 +01:00
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 09:51:30 +02:00
psa_status_t psa_export_public_key( mbedtls_svc_key_id_t key,
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 15:41:12 +02:00
uint8_t *data,
size_t data_size,
size_t *data_length )
export public key
2018-04-03 14:30:03 +02:00
{
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *slot;
psa: Refactor psa_internal_export_key to use slot, rather than key When generating keys that have persistent lifetime, we will need the keys to be in the exported format to save to persistent storage. This refactoring to separate checking the slots usage from the exporting of the key data will be necessary for using psa_internal_export_key in psa_generate_key.
2018-11-07 17:00:44 +01:00
psa: export: Check output buffer size earlier Check output buffer size before doing anything that requires a clean-up if a failure happens. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-01-18 13:22:38 +01:00
/* Reject a zero-length output buffer now, since this can never be a
* valid key representation. This way we know that data must be a valid
* pointer and we can do things like memset(data, ..., data_size). */
if( data_size == 0 )
return( PSA_ERROR_BUFFER_TOO_SMALL );
psa: Refactor psa_internal_export_key to use slot, rather than key When generating keys that have persistent lifetime, we will need the keys to be in the exported format to save to persistent storage. This refactoring to separate checking the slots usage from the exporting of the key data will be necessary for using psa_internal_export_key in psa_generate_key.
2018-11-07 17:00:44 +01:00
/* Set the key to empty now, so that even when there are errors, we always
* set data_length to a value between 0 and data_size. On error, setting
* the key to empty is a good choice because an empty key representation is
* unlikely to be accepted anywhere. */
*data_length = 0;
/* Exporting a public key doesn't require a usage flag. */
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
status = psa_get_and_lock_key_slot_with_policy( key, &slot, 0, 0 );
psa: Refactor psa_internal_export_key to use slot, rather than key When generating keys that have persistent lifetime, we will need the keys to be in the exported format to save to persistent storage. This refactoring to separate checking the slots usage from the exporting of the key data will be necessary for using psa_internal_export_key in psa_generate_key.
2018-11-07 17:00:44 +01:00
if( status != PSA_SUCCESS )
return( status );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa: Disentangle public export and export code Disentangle public export and export code to be able to move the call to export and public export operations to the driver wrapper. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-26 13:36:23 +01:00
if( ! PSA_KEY_TYPE_IS_ASYMMETRIC( slot->attr.type ) )
{
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
}
psa: Change psa_export_(public_)key_internal signature Change psa_export_(public_)key_internal signature to the signature of an export_(public_)key driver entry point. This is a preparatory commit to be able to call the software implementations as a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:46:05 +01:00
psa_key_attributes_t attributes = {
.core = slot->attr
};
psa: Call export software implementation as a driver Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-26 15:16:05 +01:00
status = psa_driver_wrapper_export_public_key(
psa: Change psa_export_(public_)key_internal signature Change psa_export_(public_)key_internal signature to the signature of an export_(public_)key driver entry point. This is a preparatory commit to be able to call the software implementations as a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 16:46:05 +01:00
&attributes, slot->key.data, slot->key.bytes,
data, data_size, data_length );
psa: Disentangle public export and export code Disentangle public export and export code to be able to move the call to export and public export operations to the driver wrapper. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-26 13:36:23 +01:00
exit:
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
unlock_status = psa_unlock_key_slot( slot );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
return( ( status == PSA_SUCCESS ) ? unlock_status : status );
export public key
2018-04-03 14:30:03 +02:00
}
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
Add infrastructure for key attribute flags Add infrastructure for internal, external and dual-use flags, with a compile-time check (if static_assert is available) to ensure that the same numerical value doesn't get declared for two different purposes in crypto_struct.h (external or dual-use) and psa_crypto_core.h (internal).
2019-08-02 19:19:39 +02:00
#if defined(static_assert)
static_assert( ( MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE ) == 0,
"One or more key attribute flag is listed as both external-only and dual-use" );
Rename internal macro to pass check-names.sh check-names.sh rejects MBEDTLS_XXX identifiers that are not defined in a public header.
2019-08-05 17:32:13 +02:00
static_assert( ( PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE ) == 0,
Fix copypasta
2019-08-07 18:19:46 +02:00
"One or more key attribute flag is listed as both internal-only and dual-use" );
Rename internal macro to pass check-names.sh check-names.sh rejects MBEDTLS_XXX identifiers that are not defined in a public header.
2019-08-05 17:32:13 +02:00
static_assert( ( PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY ) == 0,
Add infrastructure for key attribute flags Add infrastructure for internal, external and dual-use flags, with a compile-time check (if static_assert is available) to ensure that the same numerical value doesn't get declared for two different purposes in crypto_struct.h (external or dual-use) and psa_crypto_core.h (internal).
2019-08-02 19:19:39 +02:00
"One or more key attribute flag is listed as both internal-only and external-only" );
#endif
More refactoring: consolidate attribute validation Consolidate attribute validation at the beginning of key creation into a single function. Improve comments.
2019-07-31 17:21:46 +02:00
/** Validate that a key policy is internally well-formed.
*
* This function only rejects invalid policies. It does not validate the
* consistency of the policy with respect to other attributes of the key
* such as the key type.
*/
static psa_status_t psa_validate_key_policy( const psa_key_policy_t *policy )
psa: Extend psa_generate_key to support persistent lifetimes
2018-11-07 17:05:30 +01:00
{
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 15:05:45 +02:00
if( ( policy->usage & ~( PSA_KEY_USAGE_EXPORT |
New usage flag PSA_KEY_USAGE_COPY Document the new flag and allow its use.
2019-05-14 14:24:28 +02:00
PSA_KEY_USAGE_COPY |
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 15:05:45 +02:00
PSA_KEY_USAGE_ENCRYPT |
PSA_KEY_USAGE_DECRYPT |
Implement psa_sign_message and psa_verify_message functions Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-14 21:14:28 +02:00
PSA_KEY_USAGE_SIGN_MESSAGE |
PSA_KEY_USAGE_VERIFY_MESSAGE |
Rename some signature-related identifiers Rename some macros and functions related to signature which are changing as part of the addition of psa_sign_message and psa_verify_message. perl -i -pe '%t = ( PSA_KEY_USAGE_SIGN => PSA_KEY_USAGE_SIGN_HASH, PSA_KEY_USAGE_VERIFY => PSA_KEY_USAGE_VERIFY_HASH, PSA_ASYMMETRIC_SIGNATURE_MAX_SIZE => PSA_SIGNATURE_MAX_SIZE, PSA_ASYMMETRIC_SIGN_OUTPUT_SIZE => PSA_SIGN_OUTPUT_SIZE, psa_asymmetric_sign => psa_sign_hash, psa_asymmetric_verify => psa_verify_hash, ); s/\b(@{[join("|", keys %t)]})\b/$t{$1}/ge' $(git ls-files . ':!:**/crypto_compat.h')
2019-11-26 17:01:59 +01:00
PSA_KEY_USAGE_SIGN_HASH |
PSA_KEY_USAGE_VERIFY_HASH |
Update psa_validate_key_policy() for the new policy Signed-off-by: Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com>
2021-05-04 09:49:59 +02:00
PSA_KEY_USAGE_VERIFY_DERIVATION |
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 15:05:45 +02:00
PSA_KEY_USAGE_DERIVE ) ) != 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
return( PSA_SUCCESS );
psa: Extend psa_generate_key to support persistent lifetimes
2018-11-07 17:05:30 +01:00
}
More refactoring: consolidate attribute validation Consolidate attribute validation at the beginning of key creation into a single function. Improve comments.
2019-07-31 17:21:46 +02:00
/** Validate the internal consistency of key attributes.
*
* This function only rejects invalid attribute values. If does not
* validate the consistency of the attributes with any key data that may
* be involved in the creation of the key.
*
* Call this function early in the key creation process.
*
* \param[in] attributes Key attributes for the new key.
* \param[out] p_drv On any return, the driver for the key, if any.
* NULL for a transparent key.
*
*/
static psa_status_t psa_validate_key_attributes(
const psa_key_attributes_t *attributes,
psa_se_drv_table_entry_t **p_drv )
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 13:40:11 +01:00
{
Split 'validate persistent key parameters' into independent validation Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-06-08 18:37:19 +02:00
psa_status_t status = PSA_ERROR_INVALID_ARGUMENT;
Split persistence and key id validation With key usage based on key identifiers and not key handles (openless APIs), volatile keys will also have a key identifier. Thus, isolate key identifier validation from key persistence validation to clarify that key identifiers are not specific to persistent keys. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-07-17 16:11:30 +02:00
psa_key_lifetime_t lifetime = psa_get_key_lifetime( attributes );
Add key id check when creating a volatile key Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-23 17:11:13 +02:00
mbedtls_svc_key_id_t key = psa_get_key_id( attributes );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 13:40:11 +01:00
psa: Forbid creation/registration of keys in vendor range The identifier of keys created/registred should be in the application range. This is by spec for key creation. This may change for registered key. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-29 15:26:43 +01:00
status = psa_validate_key_location( lifetime, p_drv );
Split 'validate persistent key parameters' into independent validation Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-06-08 18:37:19 +02:00
if( status != PSA_SUCCESS )
return( status );
Split persistence and key id validation With key usage based on key identifiers and not key handles (openless APIs), volatile keys will also have a key identifier. Thus, isolate key identifier validation from key persistence validation to clarify that key identifiers are not specific to persistent keys. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-07-17 16:11:30 +02:00
status = psa_validate_key_persistence( lifetime );
Split 'validate persistent key parameters' into independent validation Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-06-08 18:37:19 +02:00
if( status != PSA_SUCCESS )
return( status );
More refactoring: consolidate attribute validation Consolidate attribute validation at the beginning of key creation into a single function. Improve comments.
2019-07-31 17:21:46 +02:00
Add key id check when creating a volatile key Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-23 17:11:13 +02:00
if ( PSA_KEY_LIFETIME_IS_VOLATILE( lifetime ) )
{
if( MBEDTLS_SVC_KEY_ID_GET_KEY_ID( key ) != 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
}
else
Split persistence and key id validation With key usage based on key identifiers and not key handles (openless APIs), volatile keys will also have a key identifier. Thus, isolate key identifier validation from key persistence validation to clarify that key identifiers are not specific to persistent keys. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-07-17 16:11:30 +02:00
{
psa: Fix error code when creating/registering a key with invalid id When creating a persistent key or registering a key with an invalid key identifier return PSA_ERROR_INVALID_ARGUMENT instead of PSA_ERROR_INVALID_HANDLE. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-31 17:36:31 +02:00
if( !psa_is_valid_key_id( psa_get_key_id( attributes ), 0 ) )
return( PSA_ERROR_INVALID_ARGUMENT );
Split persistence and key id validation With key usage based on key identifiers and not key handles (openless APIs), volatile keys will also have a key identifier. Thus, isolate key identifier validation from key persistence validation to clarify that key identifiers are not specific to persistent keys. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-07-17 16:11:30 +02:00
}
More refactoring: consolidate attribute validation Consolidate attribute validation at the beginning of key creation into a single function. Improve comments.
2019-07-31 17:21:46 +02:00
status = psa_validate_key_policy( &attributes->core.policy );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 13:40:11 +01:00
if( status != PSA_SUCCESS )
More refactoring: consolidate attribute validation Consolidate attribute validation at the beginning of key creation into a single function. Improve comments.
2019-07-31 17:21:46 +02:00
return( status );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 13:40:11 +01:00
More refactoring: consolidate attribute validation Consolidate attribute validation at the beginning of key creation into a single function. Improve comments.
2019-07-31 17:21:46 +02:00
/* Refuse to create overly large keys.
* Note that this doesn't trigger on import if the attributes don't
* explicitly specify a size (so psa_get_key_bits returns 0), so
* psa_import_key() needs its own checks. */
if( psa_get_key_bits( attributes ) > PSA_MAX_KEY_BITS )
return( PSA_ERROR_NOT_SUPPORTED );
Add infrastructure for key attribute flags Add infrastructure for internal, external and dual-use flags, with a compile-time check (if static_assert is available) to ensure that the same numerical value doesn't get declared for two different purposes in crypto_struct.h (external or dual-use) and psa_crypto_core.h (internal).
2019-08-02 19:19:39 +02:00
/* Reject invalid flags. These should not be reachable through the API. */
if( attributes->core.flags & ~ ( MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY |
MBEDTLS_PSA_KA_MASK_DUAL_USE ) )
return( PSA_ERROR_INVALID_ARGUMENT );
More refactoring: consolidate attribute validation Consolidate attribute validation at the beginning of key creation into a single function. Improve comments.
2019-07-31 17:21:46 +02:00
return( PSA_SUCCESS );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 13:40:11 +01:00
}
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 15:05:45 +02:00
/** Prepare a key slot to receive key material.
*
* This function allocates a key slot and sets its metadata.
*
* If this function fails, call psa_fail_key_creation().
*
Document the key creation flow (start, variable, finish, and fail)
2019-04-28 11:37:03 +02:00
* This function is intended to be used as follows:
* -# Call psa_start_key_creation() to allocate a key slot, prepare
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 09:51:30 +02:00
* it with the specified attributes, and in case of a volatile key assign it
* a volatile key identifier.
Document the key creation flow (start, variable, finish, and fail)
2019-04-28 11:37:03 +02:00
* -# Populate the slot with the key material.
* -# Call psa_finish_key_creation() to finalize the creation of the slot.
* In case of failure at any step, stop the sequence and call
* psa_fail_key_creation().
*
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
* On success, the key slot is locked. It is the responsibility of the caller
* to unlock the key slot when it does not access it anymore.
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
*
psa_start_key_creation: take the method as a parameter Let psa_start_key_creation know what type of key creation this is. This will be used at least for key registration in a secure element, which is a peculiar kind of creation since it uses existing key material.
2019-07-15 22:02:14 +02:00
* \param method An identification of the calling function.
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 18:34:38 +02:00
* \param[in] attributes Key attributes for the new key.
* \param[out] p_slot On success, a pointer to the prepared slot.
* \param[out] p_drv On any return, the driver for the key, if any.
* NULL for a transparent key.
Document the key creation flow (start, variable, finish, and fail)
2019-04-28 11:37:03 +02:00
*
* \retval #PSA_SUCCESS
* The key slot is ready to receive key material.
* \return If this function fails, the key slot is an invalid state.
* You must call psa_fail_key_creation() to wipe and free the slot.
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 15:05:45 +02:00
*/
static psa_status_t psa_start_key_creation(
psa_start_key_creation: take the method as a parameter Let psa_start_key_creation know what type of key creation this is. This will be used at least for key registration in a secure element, which is a peculiar kind of creation since it uses existing key material.
2019-07-15 22:02:14 +02:00
psa_key_creation_method_t method,
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 15:05:45 +02:00
const psa_key_attributes_t *attributes,
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 18:34:38 +02:00
psa_key_slot_t **p_slot,
Driver table entries are now mutable Since driver table entries contain the driver context, which is mutable, they can't be const anymore.
2019-07-12 23:40:35 +02:00
psa_se_drv_table_entry_t **p_drv )
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 13:40:11 +01:00
{
psa_status_t status;
Add volatile key identifiers Volatile key identifiers are introduced in PSA Crypto API v1.0.0. They are returned by the APIs when importing or generating or deriving a volatile key. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-07-17 14:13:26 +02:00
psa_key_id_t volatile_key_id;
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 15:05:45 +02:00
psa_key_slot_t *slot;
psa_start_key_creation: take the method as a parameter Let psa_start_key_creation know what type of key creation this is. This will be used at least for key registration in a secure element, which is a peculiar kind of creation since it uses existing key material.
2019-07-15 22:02:14 +02:00
(void) method;
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 18:34:38 +02:00
*p_drv = NULL;
More refactoring: consolidate attribute validation Consolidate attribute validation at the beginning of key creation into a single function. Improve comments.
2019-07-31 17:21:46 +02:00
status = psa_validate_key_attributes( attributes, p_drv );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 13:40:11 +01:00
if( status != PSA_SUCCESS )
return( status );
Define handles as key identifiers Define psa_key_handle_t to be equal to mbedtls_svc_key_id_t. Make the handle of a persistent key be equal to its key identifier. For volatile keys, make the key handle equal to the volatile key identifier of the created volatile key. The unit tests are modified just to make them compile not to make them run successfully. They are fixed in the subsequent commits. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-07-31 11:26:37 +02:00
status = psa_get_empty_key_slot( &volatile_key_id, p_slot );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 13:40:11 +01:00
if( status != PSA_SUCCESS )
return( status );
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 15:05:45 +02:00
slot = *p_slot;
Take advantage of psa_core_key_attributes_t internally #2 Key creation and psa_get_key_attributes
2019-07-31 14:15:34 +02:00
/* We're storing the declared bit-size of the key. It's up to each
* creation mechanism to verify that this information is correct.
* It's automatically correct for mechanisms that use the bit-size as
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 21:32:04 +02:00
* an input (generate, device) but not for those where the bit-size
Define handles as key identifiers Define psa_key_handle_t to be equal to mbedtls_svc_key_id_t. Make the handle of a persistent key be equal to its key identifier. For volatile keys, make the key handle equal to the volatile key identifier of the created volatile key. The unit tests are modified just to make them compile not to make them run successfully. They are fixed in the subsequent commits. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-07-31 11:26:37 +02:00
* is optional (import, copy). In case of a volatile key, assign it the
* volatile key identifier associated to the slot returned to contain its
* definition. */
Take advantage of psa_core_key_attributes_t internally #2 Key creation and psa_get_key_attributes
2019-07-31 14:15:34 +02:00
slot->attr = attributes->core;
Define handles as key identifiers Define psa_key_handle_t to be equal to mbedtls_svc_key_id_t. Make the handle of a persistent key be equal to its key identifier. For volatile keys, make the key handle equal to the volatile key identifier of the created volatile key. The unit tests are modified just to make them compile not to make them run successfully. They are fixed in the subsequent commits. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-07-31 11:26:37 +02:00
if( PSA_KEY_LIFETIME_IS_VOLATILE( slot->attr.lifetime ) )
{
#if !defined(MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER)
slot->attr.id = volatile_key_id;
#else
slot->attr.id.key_id = volatile_key_id;
#endif
}
Limit keys to 65528 bits 65528 bits is more than any reasonable key until we start supporting post-quantum cryptography. This limit is chosen to allow bit-sizes to be stored in 16 bits, with 65535 left to indicate an invalid value. It's a whole number of bytes, which facilitates some calculations, in particular allowing a key of exactly PSA_CRYPTO_MAX_STORAGE_SIZE to be created but not one bit more. As a resource usage limit, this is arguably too large, but that's out of scope of the current commit. Test that key import, generation and derivation reject overly large sizes.
2019-07-30 17:26:54 +02:00
Add infrastructure for key attribute flags Add infrastructure for internal, external and dual-use flags, with a compile-time check (if static_assert is available) to ensure that the same numerical value doesn't get declared for two different purposes in crypto_struct.h (external or dual-use) and psa_crypto_core.h (internal).
2019-08-02 19:19:39 +02:00
/* Erase external-only flags from the internal copy. To access
Fix erasure of external flags This didn't break anything now, but would have broken things once we start to add internal flags.
2019-08-07 15:42:14 +02:00
* external-only flags, query `attributes`. Thanks to the check
* in psa_validate_key_attributes(), this leaves the dual-use
Rename psa_internal_allocate_key_slot to psa_get_empty_key_slot This function no longer modifies anything, so it doesn't actually allocate the slot. Now, it just returns the empty key slot, and it's up to the caller to cause the slot to be in use (or not).
2019-08-07 18:19:59 +02:00
* flags and any internal flag that psa_get_empty_key_slot()
Fix erasure of external flags This didn't break anything now, but would have broken things once we start to add internal flags.
2019-08-07 15:42:14 +02:00
* may have set. */
slot->attr.flags &= ~MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY;
Add infrastructure for key attribute flags Add infrastructure for internal, external and dual-use flags, with a compile-time check (if static_assert is available) to ensure that the same numerical value doesn't get declared for two different purposes in crypto_struct.h (external or dual-use) and psa_crypto_core.h (internal).
2019-08-02 19:19:39 +02:00
SE keys: allocate a slot before creating the key
2019-07-12 23:46:04 +02:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
New function mbedtls_psa_register_se_key Register an existing key in a secure element. Minimal implementation that doesn't call any driver method and just lets the application declare whatever it wants.
2019-08-05 15:55:54 +02:00
/* For a key in a secure element, we need to do three things
Do not persist transactions on volatile external keys Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-06-08 18:29:44 +02:00
* when creating or registering a persistent key:
Improve comments
2019-07-25 11:32:45 +02:00
* create the key file in internal storage, create the
* key inside the secure element, and update the driver's
Do not persist transactions on volatile external keys Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-06-08 18:29:44 +02:00
* persistent data. This is done by starting a transaction that will
* encompass these three actions.
* For registering a volatile key, we just need to find an appropriate
* slot number inside the SE. Since the key is designated volatile, creating
* a transaction is not required. */
Improve comments
2019-07-25 11:32:45 +02:00
/* The first thing to do is to find a slot number for the new key.
* We save the slot number in persistent storage as part of the
* transaction data. It will be needed to recover if the power
* fails during the key creation process, to clean up on the secure
* element side after restarting. Obtaining a slot number from the
* secure element driver updates its persistent state, but we do not yet
* save the driver's persistent state, so that if the power fails,
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 19:30:34 +02:00
* we can roll back to a state where the key doesn't exist. */
SE support: Use a transaction when registering a key When registering a key in a secure element, go through the transaction mechanism. This makes the code simpler, at the expense of a few extra storage operations. Given that registering a key is typically very rare over the lifetime of a device, this is an acceptable loss. Drivers must now have a p_validate_slot_number method, otherwise registering a key is not possible. This reduces the risk that due to a mistake during the integration of a device, an application might claim a slot in a way that is not supported by the driver.
2019-10-01 14:18:35 +02:00
if( *p_drv != NULL )
SE keys: allocate a slot before creating the key
2019-07-12 23:46:04 +02:00
{
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 17:52:23 +01:00
psa_key_slot_number_t slot_number;
Pass the key creation method to drivers Pass the key creation method (import/generate/derive/copy) to the driver methods to allocate or validate a slot number. This allows drivers to enforce policies such as "this key slot can only be used for keys generated inside the secure element".
2019-08-05 16:44:14 +02:00
status = psa_find_se_slot_for_key( attributes, method, *p_drv,
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 17:52:23 +01:00
&slot_number );
SE keys: allocate a slot before creating the key
2019-07-12 23:46:04 +02:00
if( status != PSA_SUCCESS )
return( status );
Do not persist transactions on volatile external keys Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-06-08 18:29:44 +02:00
if( ! PSA_KEY_LIFETIME_IS_VOLATILE( attributes->core.lifetime ) )
If starting a transaction fails, wipe the transaction data Nothing has been saved to disk yet, but there is stale data in psa_crypto_transaction. This stale data should not be reused, but do wipe it to reduce the risk of it mattering somehow in the future.
2019-07-25 18:02:52 +02:00
{
Do not persist transactions on volatile external keys Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-06-08 18:29:44 +02:00
psa_crypto_prepare_transaction( PSA_CRYPTO_TRANSACTION_CREATE_KEY );
psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 17:52:23 +01:00
psa_crypto_transaction.key.slot = slot_number;
Do not persist transactions on volatile external keys Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-06-08 18:29:44 +02:00
psa_crypto_transaction.key.id = slot->attr.id;
status = psa_crypto_save_transaction( );
if( status != PSA_SUCCESS )
{
(void) psa_crypto_stop_transaction( );
return( status );
}
If starting a transaction fails, wipe the transaction data Nothing has been saved to disk yet, but there is stale data in psa_crypto_transaction. This stale data should not be reused, but do wipe it to reduce the risk of it mattering somehow in the future.
2019-07-25 18:02:52 +02:00
}
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 17:52:23 +01:00
status = psa_copy_key_material_into_slot(
slot, (uint8_t *)( &slot_number ), sizeof( slot_number ) );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 13:40:11 +01:00
}
SE support: Use a transaction when registering a key When registering a key in a secure element, go through the transaction mechanism. This makes the code simpler, at the expense of a few extra storage operations. Given that registering a key is typically very rare over the lifetime of a device, this is an acceptable loss. Drivers must now have a p_validate_slot_number method, otherwise registering a key is not possible. This reduces the risk that due to a mistake during the integration of a device, an application might claim a slot in a way that is not supported by the driver.
2019-10-01 14:18:35 +02:00
if( *p_drv == NULL && method == PSA_KEY_CREATION_REGISTER )
{
/* Key registration only makes sense with a secure element. */
return( PSA_ERROR_INVALID_ARGUMENT );
}
SE keys: allocate a slot before creating the key
2019-07-12 23:46:04 +02:00
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 13:40:11 +01:00
Define handles as key identifiers Define psa_key_handle_t to be equal to mbedtls_svc_key_id_t. Make the handle of a persistent key be equal to its key identifier. For volatile keys, make the key handle equal to the volatile key identifier of the created volatile key. The unit tests are modified just to make them compile not to make them run successfully. They are fixed in the subsequent commits. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-07-31 11:26:37 +02:00
return( PSA_SUCCESS );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 13:40:11 +01:00
}
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 15:05:45 +02:00
/** Finalize the creation of a key once its key material has been set.
*
* This entails writing the key to persistent storage.
*
* If this function fails, call psa_fail_key_creation().
Document the key creation flow (start, variable, finish, and fail)
2019-04-28 11:37:03 +02:00
* See the documentation of psa_start_key_creation() for the intended use
* of this function.
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 15:05:45 +02:00
*
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
* If the finalization succeeds, the function unlocks the key slot (it was
* locked by psa_start_key_creation()) and the key slot cannot be accessed
* anymore as part of the key creation process.
psa: Decrement slot access count when finalizing key creation Decrement the slot access count in psa_finish_key_creation() when the finalization succeeds instead of in functions calling psa_finish_key_creation(). That way the decrementation cannot be forgotten and it reduces the code size. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 11:28:25 +01:00
*
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 18:34:38 +02:00
* \param[in,out] slot Pointer to the slot with key material.
* \param[in] driver The secure element driver for the key,
* or NULL for a transparent key.
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 12:10:32 +01:00
* \param[out] key On success, identifier of the key. Note that the
* key identifier is also stored in the key slot.
Document the key creation flow (start, variable, finish, and fail)
2019-04-28 11:37:03 +02:00
*
* \retval #PSA_SUCCESS
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 09:51:30 +02:00
* The key was successfully created.
Update documentation The return values of the functions are updated in the documetation. All possible return values are added including nested functions' return values. The values which cannot be returned are removed. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-11-09 17:42:55 +01:00
* \retval #PSA_ERROR_INSUFFICIENT_MEMORY
* \retval #PSA_ERROR_INSUFFICIENT_STORAGE
* \retval #PSA_ERROR_ALREADY_EXISTS
* \retval #PSA_ERROR_DATA_INVALID
* \retval #PSA_ERROR_DATA_CORRUPT
Fix possible error codes in the documentation Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-11-30 16:50:34 +01:00
* \retval #PSA_ERROR_STORAGE_FAILURE
Update documentation The return values of the functions are updated in the documetation. All possible return values are added including nested functions' return values. The values which cannot be returned are removed. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-11-09 17:42:55 +01:00
*
Document the key creation flow (start, variable, finish, and fail)
2019-04-28 11:37:03 +02:00
* \return If this function fails, the key slot is an invalid state.
* You must call psa_fail_key_creation() to wipe and free the slot.
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 15:05:45 +02:00
*/
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 18:34:38 +02:00
static psa_status_t psa_finish_key_creation(
psa_key_slot_t *slot,
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 12:10:32 +01:00
psa_se_drv_table_entry_t *driver,
mbedtls_svc_key_id_t *key)
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 15:05:45 +02:00
{
psa_status_t status = PSA_SUCCESS;
Fix build errors with MBEDTLS_PSA_CRYPTO_STORAGE_C disabled
2019-04-25 13:47:40 +02:00
(void) slot;
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 18:34:38 +02:00
(void) driver;
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 15:05:45 +02:00
#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Refactor lifetime checking to reflect split in location and persistence Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-06-08 18:28:25 +02:00
if( ! PSA_KEY_LIFETIME_IS_VOLATILE( slot->attr.lifetime ) )
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 15:05:45 +02:00
{
SE keys: implement persistent storage For a key in a secure element, persist the key slot. This is implemented in the nominal case. Failures may not be handled properly.
2019-07-23 16:13:14 +02:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
if( driver != NULL )
{
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 21:32:04 +02:00
psa_se_key_data_storage_t data;
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 17:52:23 +01:00
psa_key_slot_number_t slot_number =
psa_key_slot_get_slot_number( slot ) ;
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 21:32:04 +02:00
#if defined(static_assert)
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 17:52:23 +01:00
static_assert( sizeof( slot_number ) ==
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 21:32:04 +02:00
sizeof( data.slot_number ),
"Slot number size does not match psa_se_key_data_storage_t" );
#endif
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 17:52:23 +01:00
memcpy( &data.slot_number, &slot_number, sizeof( slot_number ) );
Take advantage of psa_core_key_attributes_t internally #2 Key creation and psa_get_key_attributes
2019-07-31 14:15:34 +02:00
status = psa_save_persistent_key( &slot->attr,
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 21:32:04 +02:00
(uint8_t*) &data,
sizeof( data ) );
SE keys: implement persistent storage For a key in a secure element, persist the key slot. This is implemented in the nominal case. Failures may not be handled properly.
2019-07-23 16:13:14 +02:00
}
else
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
{
Address review comments * zero key buffer on failure * readability improvements * psa_finish_key_creation adjustment after removing import_key_into_slot Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-29 11:42:22 +01:00
/* Key material is saved in export representation in the slot, so
* just pass the slot buffer for storage. */
status = psa_save_persistent_key( &slot->attr,
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 17:52:23 +01:00
slot->key.data,
slot->key.bytes );
SE keys: implement persistent storage For a key in a secure element, persist the key slot. This is implemented in the nominal case. Failures may not be handled properly.
2019-07-23 16:13:14 +02:00
}
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 15:05:45 +02:00
}
#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
SE keys: allocate a slot before creating the key
2019-07-12 23:46:04 +02:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
New function mbedtls_psa_register_se_key Register an existing key in a secure element. Minimal implementation that doesn't call any driver method and just lets the application declare whatever it wants.
2019-08-05 15:55:54 +02:00
/* Finish the transaction for a key creation. This does not
* happen when registering an existing key. Detect this case
* by checking whether a transaction is in progress (actual
Do not persist transactions on volatile external keys Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-06-08 18:29:44 +02:00
* creation of a persistent key in a secure element requires a transaction,
* but registration or volatile key creation doesn't use one). */
New function mbedtls_psa_register_se_key Register an existing key in a secure element. Minimal implementation that doesn't call any driver method and just lets the application declare whatever it wants.
2019-08-05 15:55:54 +02:00
if( driver != NULL &&
psa_crypto_transaction.unknown.type == PSA_CRYPTO_TRANSACTION_CREATE_KEY )
SE keys: allocate a slot before creating the key
2019-07-12 23:46:04 +02:00
{
status = psa_save_se_persistent_data( driver );
if( status != PSA_SUCCESS )
{
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 20:06:31 +02:00
psa_destroy_persistent_key( slot->attr.id );
SE keys: allocate a slot before creating the key
2019-07-12 23:46:04 +02:00
return( status );
}
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 19:30:34 +02:00
status = psa_crypto_stop_transaction( );
SE keys: allocate a slot before creating the key
2019-07-12 23:46:04 +02:00
}
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
psa: Decrement slot access count when finalizing key creation Decrement the slot access count in psa_finish_key_creation() when the finalization succeeds instead of in functions calling psa_finish_key_creation(). That way the decrementation cannot be forgotten and it reduces the code size. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 11:28:25 +01:00
if( status == PSA_SUCCESS )
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 12:10:32 +01:00
{
*key = slot->attr.id;
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
status = psa_unlock_key_slot( slot );
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 12:10:32 +01:00
if( status != PSA_SUCCESS )
*key = MBEDTLS_SVC_KEY_ID_INIT;
}
psa: Decrement slot access count when finalizing key creation Decrement the slot access count in psa_finish_key_creation() when the finalization succeeds instead of in functions calling psa_finish_key_creation(). That way the decrementation cannot be forgotten and it reduces the code size. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 11:28:25 +01:00
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 15:05:45 +02:00
return( status );
}
/** Abort the creation of a key.
*
* You may call this function after calling psa_start_key_creation(),
* or after psa_finish_key_creation() fails. In other circumstances, this
* function may not clean up persistent storage.
Document the key creation flow (start, variable, finish, and fail)
2019-04-28 11:37:03 +02:00
* See the documentation of psa_start_key_creation() for the intended use
* of this function.
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 15:05:45 +02:00
*
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 18:34:38 +02:00
* \param[in,out] slot Pointer to the slot with key material.
* \param[in] driver The secure element driver for the key,
* or NULL for a transparent key.
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 15:05:45 +02:00
*/
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 18:34:38 +02:00
static void psa_fail_key_creation( psa_key_slot_t *slot,
Driver table entries are now mutable Since driver table entries contain the driver context, which is mutable, they can't be const anymore.
2019-07-12 23:40:35 +02:00
psa_se_drv_table_entry_t *driver )
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 15:05:45 +02:00
{
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 18:34:38 +02:00
(void) driver;
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 15:05:45 +02:00
if( slot == NULL )
return;
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 18:34:38 +02:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Make TODO comments consistent
2019-08-13 13:15:34 +02:00
/* TODO: If the key has already been created in the secure
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 18:34:38 +02:00
* element, and the failure happened later (when saving metadata
* to internal storage), we need to destroy the key in the secure
Add issue numbers for some missing parts of secure element support
2019-08-13 16:17:16 +02:00
* element.
* https://github.com/ARMmbed/mbed-crypto/issues/217
*/
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 19:30:34 +02:00
New function mbedtls_psa_register_se_key Register an existing key in a secure element. Minimal implementation that doesn't call any driver method and just lets the application declare whatever it wants.
2019-08-05 15:55:54 +02:00
/* Abort the ongoing transaction if any (there may not be one if
* the creation process failed before starting one, or if the
* key creation is a registration of a key in a secure element).
* Earlier functions must already have done what it takes to undo any
* partial creation. All that's left is to update the transaction data
* itself. */
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 19:30:34 +02:00
(void) psa_crypto_stop_transaction( );
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 18:34:38 +02:00
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 15:05:45 +02:00
psa_wipe_key_slot( slot );
}
More refactoring: consolidate attribute validation Consolidate attribute validation at the beginning of key creation into a single function. Improve comments.
2019-07-31 17:21:46 +02:00
/** Validate optional attributes during key creation.
*
* Some key attributes are optional during key creation. If they are
* specified in the attributes structure, check that they are consistent
* with the data in the slot.
*
* This function should be called near the end of key creation, after
* the slot in memory is fully populated but before saving persistent data.
*/
static psa_status_t psa_validate_optional_attributes(
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 16:57:15 +02:00
const psa_key_slot_t *slot,
const psa_key_attributes_t *attributes )
{
Move attribute fields to a substructure Move the "core attributes" to a substructure of psa_key_attribute_t. The motivation is to be able to use the new structure psa_core_key_attributes_t internally.
2019-07-30 13:48:52 +02:00
if( attributes->core.type != 0 )
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 16:57:15 +02:00
{
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 20:06:31 +02:00
if( attributes->core.type != slot->attr.type )
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 16:57:15 +02:00
return( PSA_ERROR_INVALID_ARGUMENT );
}
if( attributes->domain_parameters_size != 0 )
{
Add feature support for RSA for PSA crypto config In the original attempt to add RSA support to PSA crypto config was too generic. This set of changes adds support for the following RSA features: PSA_WANT_ALG_RSA_PKCS1V15_CRYPT, PSA_WANT_ALG_RSA_PKCS1V15_SIGN, PSA_WANT_ALG_RSA_OAEP, PSA_WANT_ALG_RSA_PSS, PSA_WANT_KEY_TYPE_RSA_KEY_PAIR, and PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY. There were also some updates to ensure the proper inclusion of PSA crypto library code when certain features are enabled. These updates were made to address warnings and errors in builds from the new tests for these features being added for PSA crypto configuration. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-01 06:06:54 +01:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 20:06:31 +02:00
if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 16:57:15 +02:00
{
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 14:30:39 +02:00
mbedtls_rsa_context *rsa = NULL;
Update after feedback on #3492 * Updated wording * Split out buffer allocation to a convenience function * Moved variable declarations to beginning of their code block Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 14:30:13 +02:00
mbedtls_mpi actual, required;
Cleanup * No null-check before calling free * Close memory leak * No need for double check of privkey validity Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-30 11:36:45 +02:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 22:48:15 +02:00
psa: Rename psa_load_rsa/ecp_representation Rename psa_load_rsa/ecp_representation to mbedtls_psa_rsa/ecp_load_representation before to move them in their RSA/ECP specific PSA crypto C modules. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 14:58:33 +01:00
psa_status_t status = mbedtls_psa_rsa_load_representation(
slot->attr.type,
slot->key.data,
slot->key.bytes,
&rsa );
Remove RSA internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 22:48:15 +02:00
if( status != PSA_SUCCESS )
Style fixes * return is treated as a function call * space between opening and closing parentheses * remove whiteline between assignment and checking of same variable Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-05 15:43:42 +02:00
return( status );
Update after feedback on #3492 * Updated wording * Split out buffer allocation to a convenience function * Moved variable declarations to beginning of their code block Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 14:30:13 +02:00
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 16:57:15 +02:00
mbedtls_mpi_init( &actual );
mbedtls_mpi_init( &required );
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 14:30:39 +02:00
ret = mbedtls_rsa_export( rsa,
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 16:57:15 +02:00
NULL, NULL, NULL, NULL, &actual );
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 14:30:39 +02:00
mbedtls_rsa_free( rsa );
mbedtls_free( rsa );
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 16:57:15 +02:00
if( ret != 0 )
goto rsa_exit;
ret = mbedtls_mpi_read_binary( &required,
attributes->domain_parameters,
attributes->domain_parameters_size );
if( ret != 0 )
goto rsa_exit;
if( mbedtls_mpi_cmp_mpi( &actual, &required ) != 0 )
ret = MBEDTLS_ERR_RSA_BAD_INPUT_DATA;
rsa_exit:
mbedtls_mpi_free( &actual );
mbedtls_mpi_free( &required );
if( ret != 0)
return( mbedtls_to_psa_error( ret ) );
}
else
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 21:28:15 +01:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 16:57:15 +02:00
{
return( PSA_ERROR_INVALID_ARGUMENT );
}
}
Move attribute fields to a substructure Move the "core attributes" to a substructure of psa_key_attribute_t. The motivation is to be able to use the new structure psa_core_key_attributes_t internally.
2019-07-30 13:48:52 +02:00
if( attributes->core.bits != 0 )
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 16:57:15 +02:00
{
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 21:32:04 +02:00
if( attributes->core.bits != slot->attr.bits )
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 16:57:15 +02:00
return( PSA_ERROR_INVALID_ARGUMENT );
}
return( PSA_SUCCESS );
}
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 15:05:45 +02:00
psa_status_t psa_import_key( const psa_key_attributes_t *attributes,
const uint8_t *data,
Put handle parameter last: psa_import_key In psa_import_key, change the order of parameters to pass the pointer where the newly created handle will be stored last. This is consistent with most other library functions that put inputs before outputs.
2019-05-15 20:15:10 +02:00
size_t data_length,
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 09:51:30 +02:00
mbedtls_svc_key_id_t *key )
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 15:05:45 +02:00
{
psa_status_t status;
psa_key_slot_t *slot = NULL;
Driver table entries are now mutable Since driver table entries contain the driver context, which is mutable, they can't be const anymore.
2019-07-12 23:40:35 +02:00
psa_se_drv_table_entry_t *driver = NULL;
psa: import: Move registered SE support to the driver wrapper Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-30 12:11:01 +01:00
size_t bits;
Sizing of key buffer for opaque keys Create a new sizing function for determining the size required for key storage based on the input key data. This is required for key imports where the key length might need to be derived from the data. Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-06-14 06:34:16 +02:00
size_t storage_size = data_length;
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 16:57:15 +02:00
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 12:10:32 +01:00
*key = MBEDTLS_SVC_KEY_ID_INIT;
Reject keys of size 0 Implement the prohibition on keys of size 0.
2019-09-12 19:03:13 +02:00
/* Reject zero-length symmetric keys (including raw data key objects).
* This also rejects any key which might be encoded as an empty string,
* which is never valid. */
if( data_length == 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
Code style improvements Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-09-08 12:06:05 +02:00
/* Ensure that the bytes-to-bits conversion cannot overflow. */
pre-existing validation extended The validation against key width and max key bits is extended to all key types from the existing validation for only symmetric keys. Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-08-04 07:17:15 +02:00
if( data_length > SIZE_MAX / 8 )
return( PSA_ERROR_NOT_SUPPORTED );
psa_start_key_creation: take the method as a parameter Let psa_start_key_creation know what type of key creation this is. This will be used at least for key registration in a secure element, which is a peculiar kind of creation since it uses existing key material.
2019-07-15 22:02:14 +02:00
status = psa_start_key_creation( PSA_KEY_CREATION_IMPORT, attributes,
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 12:10:32 +01:00
&slot, &driver );
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 16:57:15 +02:00
if( status != PSA_SUCCESS )
goto exit;
psa: import: Move registered SE support to the driver wrapper Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-30 12:11:01 +01:00
/* In the case of a transparent key or an opaque key stored in local
Code style improvements Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-09-08 12:06:05 +02:00
* storage ( thus not in the case of importing a key in a secure element
* with storage ( MBEDTLS_PSA_CRYPTO_SE_C ) ),we have to allocate a
* buffer to hold the imported key material. */
psa: import: Move registered SE support to the driver wrapper Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-30 12:11:01 +01:00
if( slot->key.data == NULL )
SE keys: support import and export
2019-07-12 23:47:28 +02:00
{
Sizing of key buffer for opaque keys Create a new sizing function for determining the size required for key storage based on the input key data. This is required for key imports where the key length might need to be derived from the data. Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-06-14 06:34:16 +02:00
if( psa_key_lifetime_is_external( attributes->core.lifetime ) )
{
Code style improvements Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-09-08 12:06:05 +02:00
status = psa_driver_wrapper_get_key_buffer_size_from_key_data(
attributes, data, data_length, &storage_size );
Sizing of key buffer for opaque keys Create a new sizing function for determining the size required for key storage based on the input key data. This is required for key imports where the key length might need to be derived from the data. Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-06-14 06:34:16 +02:00
if( status != PSA_SUCCESS )
goto exit;
}
status = psa_allocate_buffer_to_slot( slot, storage_size );
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 21:32:04 +02:00
if( status != PSA_SUCCESS )
goto exit;
SE keys: support import and export
2019-07-12 23:47:28 +02:00
}
psa: import: Move registered SE support to the driver wrapper Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-30 12:11:01 +01:00
bits = slot->attr.bits;
status = psa_driver_wrapper_import_key( attributes,
data, data_length,
slot->key.data,
slot->key.bytes,
&slot->key.bytes, &bits );
if( status != PSA_SUCCESS )
goto exit;
if( slot->attr.bits == 0 )
slot->attr.bits = (psa_key_bits_t) bits;
else if( bits != slot->attr.bits )
Apply review feedback Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-01-15 17:36:02 +01:00
{
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
SE keys: support import and export
2019-07-12 23:47:28 +02:00
}
psa: Change psa_import_key_into_slot() signature Change psa_import_key_into_slot() signature to the signature of an import_key driver entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 15:54:54 +01:00
pre-existing validation extended The validation against key width and max key bits is extended to all key types from the existing validation for only symmetric keys. Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-08-04 07:17:15 +02:00
/* Enforce a size limit, and in particular ensure that the bit
* size fits in its representation type.*/
if( bits > PSA_MAX_KEY_BITS )
{
status = PSA_ERROR_NOT_SUPPORTED;
goto exit;
}
More refactoring: consolidate attribute validation Consolidate attribute validation at the beginning of key creation into a single function. Improve comments.
2019-07-31 17:21:46 +02:00
status = psa_validate_optional_attributes( slot, attributes );
SE driver: report the bit size on key import Add a parameter to the key import method of a secure element driver to make it report the key size in bits. This is necessary (otherwise the core has no idea what the bit-size is), and making import report it is easier than adding a separate method (for other key creation methods, this information is an input, not an output).
2019-07-24 20:25:59 +02:00
if( status != PSA_SUCCESS )
goto exit;
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 16:57:15 +02:00
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 12:10:32 +01:00
status = psa_finish_key_creation( slot, driver, key );
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 16:57:15 +02:00
exit:
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 15:05:45 +02:00
if( status != PSA_SUCCESS )
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 18:34:38 +02:00
psa_fail_key_creation( slot, driver );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 15:05:45 +02:00
return( status );
}
New function mbedtls_psa_register_se_key Register an existing key in a secure element. Minimal implementation that doesn't call any driver method and just lets the application declare whatever it wants.
2019-08-05 15:55:54 +02:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
psa_status_t mbedtls_psa_register_se_key(
const psa_key_attributes_t *attributes )
{
psa_status_t status;
psa_key_slot_t *slot = NULL;
psa_se_drv_table_entry_t *driver = NULL;
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 09:51:30 +02:00
mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT;
New function mbedtls_psa_register_se_key Register an existing key in a secure element. Minimal implementation that doesn't call any driver method and just lets the application declare whatever it wants.
2019-08-05 15:55:54 +02:00
/* Leaving attributes unspecified is not currently supported.
* It could make sense to query the key type and size from the
* secure element, but not all secure elements support this
* and the driver HAL doesn't currently support it. */
if( psa_get_key_type( attributes ) == PSA_KEY_TYPE_NONE )
return( PSA_ERROR_NOT_SUPPORTED );
if( psa_get_key_bits( attributes ) == 0 )
return( PSA_ERROR_NOT_SUPPORTED );
status = psa_start_key_creation( PSA_KEY_CREATION_REGISTER, attributes,
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 12:10:32 +01:00
&slot, &driver );
New function mbedtls_psa_register_se_key Register an existing key in a secure element. Minimal implementation that doesn't call any driver method and just lets the application declare whatever it wants.
2019-08-05 15:55:54 +02:00
if( status != PSA_SUCCESS )
goto exit;
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 12:10:32 +01:00
status = psa_finish_key_creation( slot, driver, &key );
New function mbedtls_psa_register_se_key Register an existing key in a secure element. Minimal implementation that doesn't call any driver method and just lets the application declare whatever it wants.
2019-08-05 15:55:54 +02:00
exit:
if( status != PSA_SUCCESS )
psa_fail_key_creation( slot, driver );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
New function mbedtls_psa_register_se_key Register an existing key in a secure element. Minimal implementation that doesn't call any driver method and just lets the application declare whatever it wants.
2019-08-05 15:55:54 +02:00
/* Registration doesn't keep the key in RAM. */
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 09:51:30 +02:00
psa_close_key( key );
New function mbedtls_psa_register_se_key Register an existing key in a secure element. Minimal implementation that doesn't call any driver method and just lets the application declare whatever it wants.
2019-08-05 15:55:54 +02:00
return( status );
}
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 09:51:30 +02:00
psa_status_t psa_copy_key( mbedtls_svc_key_id_t source_key,
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 21:44:46 +02:00
const psa_key_attributes_t *specified_attributes,
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 09:51:30 +02:00
mbedtls_svc_key_id_t *target_key )
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 21:44:46 +02:00
{
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 21:44:46 +02:00
psa_key_slot_t *source_slot = NULL;
psa_key_slot_t *target_slot = NULL;
psa_key_attributes_t actual_attributes = *specified_attributes;
Driver table entries are now mutable Since driver table entries contain the driver context, which is mutable, they can't be const anymore.
2019-07-12 23:40:35 +02:00
psa_se_drv_table_entry_t *driver = NULL;
Add opaque test driver support for copy key A minimal test driver extension is added to support copy of opaque keys within the same location. Test vector support is extended to cover opaque keys. Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-07-04 22:48:48 +02:00
size_t storage_size = 0;
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 21:44:46 +02:00
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 12:10:32 +01:00
*target_key = MBEDTLS_SVC_KEY_ID_INIT;
Add opaque test driver support for copy key A minimal test driver extension is added to support copy of opaque keys within the same location. Test vector support is extended to cover opaque keys. Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-07-04 22:48:48 +02:00
status = psa_get_and_lock_key_slot_with_policy(
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
source_key, &source_slot, PSA_KEY_USAGE_COPY, 0 );
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 21:44:46 +02:00
if( status != PSA_SUCCESS )
goto exit;
More refactoring: consolidate attribute validation Consolidate attribute validation at the beginning of key creation into a single function. Improve comments.
2019-07-31 17:21:46 +02:00
status = psa_validate_optional_attributes( source_slot,
specified_attributes );
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 16:57:15 +02:00
if( status != PSA_SUCCESS )
goto exit;
Styling and refactoring Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-09-10 02:52:44 +02:00
/* The target key type and number of bits have been validated by
* psa_validate_optional_attributes() to be either equal to zero or
* equal to the ones of the source key. So it is safe to inherit
* them from the source key now."
Handle zeroed attributes key bits and type in copy The target attributes for key copy could have key bits and type zeroed. If so, they need to be overwritten/ inherited from the source key. This is now forcefully overwritten after validating the optional attributes. As a result assigning attributes type and bits after copy are no longer necessary. Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-09-08 12:20:28 +02:00
* */
Styling and refactoring Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-09-10 02:52:44 +02:00
actual_attributes.core.bits = source_slot->attr.bits;
actual_attributes.core.type = source_slot->attr.type;
Handle zeroed attributes key bits and type in copy The target attributes for key copy could have key bits and type zeroed. If so, they need to be overwritten/ inherited from the source key. This is now forcefully overwritten after validating the optional attributes. As a result assigning attributes type and bits after copy are no longer necessary. Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-09-08 12:20:28 +02:00
Make psa_key_policy_algorithm_intersection MAC-length aware This makes it more in-line with how psa_key_policy_permits works. It also adds consistency: the intersection of MAC with default length and MAC with exact-length is now computed correctly in case the exact length equals the default length of the algorithm when used with the given key type. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 16:34:49 +01:00
status = psa_restrict_key_policy( source_slot->attr.type,
&actual_attributes.core.policy,
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 20:06:31 +02:00
&source_slot->attr.policy );
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 21:44:46 +02:00
if( status != PSA_SUCCESS )
goto exit;
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 12:10:32 +01:00
status = psa_start_key_creation( PSA_KEY_CREATION_COPY, &actual_attributes,
&target_slot, &driver );
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 21:44:46 +02:00
if( status != PSA_SUCCESS )
goto exit;
Add opaque test driver support for copy key A minimal test driver extension is added to support copy of opaque keys within the same location. Test vector support is extended to cover opaque keys. Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-07-04 22:48:48 +02:00
if( PSA_KEY_LIFETIME_GET_LOCATION( target_slot->attr.lifetime ) !=
PSA_KEY_LIFETIME_GET_LOCATION( source_slot->attr.lifetime ) )
SE keys: error out in key creation function that lack support
2019-07-24 13:44:30 +02:00
{
Add opaque test driver support for copy key A minimal test driver extension is added to support copy of opaque keys within the same location. Test vector support is extended to cover opaque keys. Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-07-04 22:48:48 +02:00
/*
Styling and refactoring Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-09-10 02:52:44 +02:00
* If the source and target keys are stored in different locations,
Add opaque test driver support for copy key A minimal test driver extension is added to support copy of opaque keys within the same location. Test vector support is extended to cover opaque keys. Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-07-04 22:48:48 +02:00
* the source key would need to be exported as plaintext and re-imported
* in the other location. This has security implications which have not
Code style improvements Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-09-08 12:06:05 +02:00
* been fully mapped. For now, this can be achieved through
Add opaque test driver support for copy key A minimal test driver extension is added to support copy of opaque keys within the same location. Test vector support is extended to cover opaque keys. Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-07-04 22:48:48 +02:00
* appropriate API invocations from the application, if needed.
* */
SE keys: error out in key creation function that lack support
2019-07-24 13:44:30 +02:00
status = PSA_ERROR_NOT_SUPPORTED;
goto exit;
}
Add opaque test driver support for copy key A minimal test driver extension is added to support copy of opaque keys within the same location. Test vector support is extended to cover opaque keys. Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-07-04 22:48:48 +02:00
/*
* When the source and target keys are within the same location,
Code style improvements Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-09-08 12:06:05 +02:00
* - For transparent keys it is a blind copy without any driver invocation,
Add opaque test driver support for copy key A minimal test driver extension is added to support copy of opaque keys within the same location. Test vector support is extended to cover opaque keys. Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-07-04 22:48:48 +02:00
* - For opaque keys this translates to an invocation of the drivers'
* copy_key entry point through the dispatch layer.
* */
psa: Return in error when requested to copy a key to an opaque driver Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-04-02 12:27:47 +02:00
if( psa_key_lifetime_is_external( actual_attributes.core.lifetime ) )
{
Add opaque test driver support for copy key A minimal test driver extension is added to support copy of opaque keys within the same location. Test vector support is extended to cover opaque keys. Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-07-04 22:48:48 +02:00
status = psa_driver_wrapper_get_key_buffer_size( &actual_attributes,
Code style improvements Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-09-08 12:06:05 +02:00
&storage_size );
Add opaque test driver support for copy key A minimal test driver extension is added to support copy of opaque keys within the same location. Test vector support is extended to cover opaque keys. Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-07-04 22:48:48 +02:00
if( status != PSA_SUCCESS )
goto exit;
psa: Return in error when requested to copy a key to an opaque driver Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-04-02 12:27:47 +02:00
Add opaque test driver support for copy key A minimal test driver extension is added to support copy of opaque keys within the same location. Test vector support is extended to cover opaque keys. Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-07-04 22:48:48 +02:00
status = psa_allocate_buffer_to_slot( target_slot, storage_size );
if( status != PSA_SUCCESS )
goto exit;
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 21:44:46 +02:00
Add opaque test driver support for copy key A minimal test driver extension is added to support copy of opaque keys within the same location. Test vector support is extended to cover opaque keys. Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-07-04 22:48:48 +02:00
status = psa_driver_wrapper_copy_key( &actual_attributes,
source_slot->key.data,
source_slot->key.bytes,
target_slot->key.data,
target_slot->key.bytes,
&target_slot->key.bytes );
if( status != PSA_SUCCESS )
goto exit;
}
else
{
Styling and refactoring Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-09-10 02:52:44 +02:00
status = psa_copy_key_material_into_slot( target_slot,
source_slot->key.data,
source_slot->key.bytes );
Add opaque test driver support for copy key A minimal test driver extension is added to support copy of opaque keys within the same location. Test vector support is extended to cover opaque keys. Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-07-04 22:48:48 +02:00
if( status != PSA_SUCCESS )
goto exit;
psa: Return in error when requested to copy a key to an opaque driver Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-04-02 12:27:47 +02:00
}
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 12:10:32 +01:00
status = psa_finish_key_creation( target_slot, driver, target_key );
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 21:44:46 +02:00
exit:
if( status != PSA_SUCCESS )
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 18:34:38 +02:00
psa_fail_key_creation( target_slot, driver );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
unlock_status = psa_unlock_key_slot( source_slot );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 21:44:46 +02:00
}
Be more consistent about blank lines
2018-06-18 21:49:39 +02:00
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 22:44:14 +01:00
/****************************************************************/
/* Message digests */
/****************************************************************/
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 21:05:37 +01:00
psa_status_t psa_hash_abort( psa_hash_operation_t *operation )
{
Change the way driver context structures are used Apparently there's a goal to make the PSA Crypto core free from dynamic memory allocations. Therefore, all driver context structures need to be known at compile time in order for the core to know their final size. This change defines & implements for hashing operations how the context structures get defined. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-04 13:01:18 +01:00
/* Aborting a non-active operation is allowed */
if( operation->id == 0 )
return( PSA_SUCCESS );
psa_status_t status = psa_driver_wrapper_hash_abort( operation );
operation->id = 0;
return( status );
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 21:05:37 +01:00
}
Rename psa_hash_start -> psa_hash_setup Make function names for multipart operations more consistent (hash edition).
2018-07-08 19:46:38 +02:00
psa_status_t psa_hash_setup( psa_hash_operation_t *operation,
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 21:05:37 +01:00
psa_algorithm_t alg )
{
Update multipart hash operations to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 12:49:14 +02:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Change the way driver context structures are used Apparently there's a goal to make the PSA Crypto core free from dynamic memory allocations. Therefore, all driver context structures need to be known at compile time in order for the core to know their final size. This change defines & implements for hashing operations how the context structures get defined. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-04 13:01:18 +01:00
/* A context must be freshly initialized before it can be set up. */
if( operation->id != 0 )
Correct coding style issues Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 17:17:43 +02:00
{
Update multipart hash operations to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 12:49:14 +02:00
status = PSA_ERROR_BAD_STATE;
goto exit;
}
Change the way driver context structures are used Apparently there's a goal to make the PSA Crypto core free from dynamic memory allocations. Therefore, all driver context structures need to be known at compile time in order for the core to know their final size. This change defines & implements for hashing operations how the context structures get defined. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-04 13:01:18 +01:00
if( !PSA_ALG_IS_HASH( alg ) )
Correct coding style issues Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 17:17:43 +02:00
{
Update multipart hash operations to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 12:49:14 +02:00
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
}
psa: Disallow repeated setup Calling psa_*_setup() twice on a MAC, cipher, or hash context should result in a PSA_ERROR_BAD_STATE error because the operation has already been set up. Fixes #10
2019-02-19 10:25:10 +01:00
Clear up language on zeroizing driver context at setup Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-15 19:00:14 +01:00
/* Ensure all of the context is zeroized, since PSA_HASH_OPERATION_INIT only
* directly zeroes the int-sized dummy member of the context union. */
Ensure the full driver structure is zeroized at setup Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-15 12:23:37 +01:00
memset( &operation->ctx, 0, sizeof( operation->ctx ) );
Update multipart hash operations to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 12:49:14 +02:00
status = psa_driver_wrapper_hash_setup( operation, alg );
exit:
if( status != PSA_SUCCESS )
Correct coding style issues Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 17:17:43 +02:00
psa_hash_abort( operation );
Update multipart hash operations to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 12:49:14 +02:00
return status;
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 21:05:37 +01:00
}
psa_status_t psa_hash_update( psa_hash_operation_t *operation,
const uint8_t *input,
size_t input_length )
{
Update multipart hash operations to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 12:49:14 +02:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Change the way driver context structures are used Apparently there's a goal to make the PSA Crypto core free from dynamic memory allocations. Therefore, all driver context structures need to be known at compile time in order for the core to know their final size. This change defines & implements for hashing operations how the context structures get defined. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-04 13:01:18 +01:00
if( operation->id == 0 )
Correct coding style issues Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 17:17:43 +02:00
{
Update multipart hash operations to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 12:49:14 +02:00
status = PSA_ERROR_BAD_STATE;
goto exit;
}
psa_hash_update: robustify the case length=0 Don't require hash implementations to behave correctly on a zero-length input, which may have an invalid pointer.
2018-07-12 16:58:43 +02:00
move hash update zero-length-input check back into the core Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-04 14:02:19 +01:00
/* Don't require hash implementations to behave correctly on a
* zero-length input, which may have an invalid pointer. */
if( input_length == 0 )
return( PSA_SUCCESS );
Update multipart hash operations to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 12:49:14 +02:00
status = psa_driver_wrapper_hash_update( operation, input, input_length );
exit:
Change the way driver context structures are used Apparently there's a goal to make the PSA Crypto core free from dynamic memory allocations. Therefore, all driver context structures need to be known at compile time in order for the core to know their final size. This change defines & implements for hashing operations how the context structures get defined. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-04 13:01:18 +01:00
if( status != PSA_SUCCESS )
psa_hash_abort( operation );
return( status );
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 21:05:37 +01:00
}
psa_status_t psa_hash_finish( psa_hash_operation_t *operation,
uint8_t *hash,
size_t hash_size,
size_t *hash_length )
{
Set output length to 0 at start of function This behaviour was present previously, and is depended on by the test suites. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-08 18:41:12 +01:00
*hash_length = 0;
Change the way driver context structures are used Apparently there's a goal to make the PSA Crypto core free from dynamic memory allocations. Therefore, all driver context structures need to be known at compile time in order for the core to know their final size. This change defines & implements for hashing operations how the context structures get defined. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-04 13:01:18 +01:00
if( operation->id == 0 )
return( PSA_ERROR_BAD_STATE );
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 21:05:37 +01:00
Dispatch hashing calls through the driver wrapper layer Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-18 17:24:37 +01:00
psa_status_t status = psa_driver_wrapper_hash_finish(
Change the way driver context structures are used Apparently there's a goal to make the PSA Crypto core free from dynamic memory allocations. Therefore, all driver context structures need to be known at compile time in order for the core to know their final size. This change defines & implements for hashing operations how the context structures get defined. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-04 13:01:18 +01:00
operation, hash, hash_size, hash_length );
Split hashing operations out into an mbedTLS hash driver Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-18 16:18:32 +01:00
psa_hash_abort( operation );
return( status );
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 21:05:37 +01:00
}
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 15:41:12 +02:00
psa_status_t psa_hash_verify( psa_hash_operation_t *operation,
const uint8_t *hash,
size_t hash_length )
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 21:05:37 +01:00
{
psa: Fix the size of hash buffers Fix the size of hash buffers for PSA hash operations. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-10-18 09:47:58 +02:00
uint8_t actual_hash[PSA_HASH_MAX_SIZE];
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 21:05:37 +01:00
size_t actual_hash_length;
Change the way driver context structures are used Apparently there's a goal to make the PSA Crypto core free from dynamic memory allocations. Therefore, all driver context structures need to be known at compile time in order for the core to know their final size. This change defines & implements for hashing operations how the context structures get defined. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-04 13:01:18 +01:00
psa_status_t status = psa_hash_finish(
operation,
Dispatch hashing calls through the driver wrapper layer Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-18 17:24:37 +01:00
actual_hash, sizeof( actual_hash ),
&actual_hash_length );
Update multipart hash operations to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 12:49:14 +02:00
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 21:05:37 +01:00
if( status != PSA_SUCCESS )
Update multipart hash operations to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 12:49:14 +02:00
goto exit;
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 21:05:37 +01:00
if( actual_hash_length != hash_length )
Correct coding style issues Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 17:17:43 +02:00
{
Update multipart hash operations to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 12:49:14 +02:00
status = PSA_ERROR_INVALID_SIGNATURE;
goto exit;
}
Make safer_memcmp available to all compile units under PSA Now renamed to mbedtls_psa_safer_memcmp, it provides a single location for buffer comparison. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-29 16:37:59 +02:00
if( mbedtls_psa_safer_memcmp( hash, actual_hash, actual_hash_length ) != 0 )
Update multipart hash operations to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 12:49:14 +02:00
status = PSA_ERROR_INVALID_SIGNATURE;
exit:
PSA hash verification: zeroize expected hash on hash mismatch Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-12-13 12:33:18 +01:00
mbedtls_platform_zeroize( actual_hash, sizeof( actual_hash ) );
Update multipart hash operations to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 12:49:14 +02:00
if( status != PSA_SUCCESS )
psa_hash_abort(operation);
return( status );
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 21:05:37 +01:00
}
Implement and test psa_hash_compute, psa_hash_compare
2019-11-28 19:33:58 +01:00
psa_status_t psa_hash_compute( psa_algorithm_t alg,
const uint8_t *input, size_t input_length,
uint8_t *hash, size_t hash_size,
size_t *hash_length )
{
Set output length to 0 at start of function This behaviour was present previously, and is depended on by the test suites. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-08 18:41:12 +01:00
*hash_length = 0;
Apply same argument checking as in psa_hash_setup Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-08 18:40:40 +01:00
if( !PSA_ALG_IS_HASH( alg ) )
return( PSA_ERROR_INVALID_ARGUMENT );
Dispatch hashing calls through the driver wrapper layer Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-18 17:24:37 +01:00
return( psa_driver_wrapper_hash_compute( alg, input, input_length,
hash, hash_size, hash_length ) );
Implement and test psa_hash_compute, psa_hash_compare
2019-11-28 19:33:58 +01:00
}
psa_status_t psa_hash_compare( psa_algorithm_t alg,
const uint8_t *input, size_t input_length,
const uint8_t *hash, size_t hash_length )
{
psa: Fix the size of hash buffers Fix the size of hash buffers for PSA hash operations. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-10-18 09:47:58 +02:00
uint8_t actual_hash[PSA_HASH_MAX_SIZE];
Make psa_hash_compare go through hash_compute It's more efficient when dealing with hardware drivers. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-18 16:22:53 +01:00
size_t actual_hash_length;
Apply same argument checking as in psa_hash_setup Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-08 18:40:40 +01:00
if( !PSA_ALG_IS_HASH( alg ) )
return( PSA_ERROR_INVALID_ARGUMENT );
Dispatch hashing calls through the driver wrapper layer Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-18 17:24:37 +01:00
psa_status_t status = psa_driver_wrapper_hash_compute(
alg, input, input_length,
actual_hash, sizeof(actual_hash),
&actual_hash_length );
Implement and test psa_hash_compute, psa_hash_compare
2019-11-28 19:33:58 +01:00
if( status != PSA_SUCCESS )
PSA hash verification: zeroize expected hash on hash mismatch Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-12-13 12:33:18 +01:00
goto exit;
Make psa_hash_compare go through hash_compute It's more efficient when dealing with hardware drivers. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-18 16:22:53 +01:00
if( actual_hash_length != hash_length )
PSA hash verification: zeroize expected hash on hash mismatch Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-12-13 12:33:18 +01:00
{
status = PSA_ERROR_INVALID_SIGNATURE;
goto exit;
}
Make safer_memcmp available to all compile units under PSA Now renamed to mbedtls_psa_safer_memcmp, it provides a single location for buffer comparison. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-29 16:37:59 +02:00
if( mbedtls_psa_safer_memcmp( hash, actual_hash, actual_hash_length ) != 0 )
PSA hash verification: zeroize expected hash on hash mismatch Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-12-13 12:33:18 +01:00
status = PSA_ERROR_INVALID_SIGNATURE;
exit:
mbedtls_platform_zeroize( actual_hash, sizeof( actual_hash ) );
return( status );
Implement and test psa_hash_compute, psa_hash_compare
2019-11-28 19:33:58 +01:00
}
Style fix
2019-01-22 17:56:16 +01:00
psa_status_t psa_hash_clone( const psa_hash_operation_t *source_operation,
psa_hash_operation_t *target_operation )
New function psa_hash_clone Clone a hash operation. Test good cases as part as multipart tests. Add new test functions for the state machine.
2019-01-19 12:03:41 +01:00
{
Change the way driver context structures are used Apparently there's a goal to make the PSA Crypto core free from dynamic memory allocations. Therefore, all driver context structures need to be known at compile time in order for the core to know their final size. This change defines & implements for hashing operations how the context structures get defined. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-04 13:01:18 +01:00
if( source_operation->id == 0 ||
target_operation->id != 0 )
{
return( PSA_ERROR_BAD_STATE );
}
New function psa_hash_clone Clone a hash operation. Test good cases as part as multipart tests. Add new test functions for the state machine.
2019-01-19 12:03:41 +01:00
Change the way driver context structures are used Apparently there's a goal to make the PSA Crypto core free from dynamic memory allocations. Therefore, all driver context structures need to be known at compile time in order for the core to know their final size. This change defines & implements for hashing operations how the context structures get defined. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-04 13:01:18 +01:00
psa_status_t status = psa_driver_wrapper_hash_clone( source_operation,
target_operation );
if( status != PSA_SUCCESS )
psa_hash_abort( target_operation );
return( status );
New function psa_hash_clone Clone a hash operation. Test good cases as part as multipart tests. Add new test functions for the state machine.
2019-01-19 12:03:41 +01:00
}
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 21:05:37 +01:00
/****************************************************************/
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
/* MAC */
/****************************************************************/
Migrate MAC setup/abort calls into the software driver Step 1/x in moving the driver. Separate commits should make for easier review. Additional changes on top of just moving code: * Added a sanity check on the key buffer size for CMAC. * Transfered responsibility for resetting the core members of the PSA MAC operation structure back to the core (from the driver wrapper layer) Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-19 18:28:56 +01:00
psa_status_t psa_mac_abort( psa_mac_operation_t *operation )
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 16:05:20 +02:00
{
Migrate MAC setup/abort calls into the software driver Step 1/x in moving the driver. Separate commits should make for easier review. Additional changes on top of just moving code: * Added a sanity check on the key buffer size for CMAC. * Transfered responsibility for resetting the core members of the PSA MAC operation structure back to the core (from the driver wrapper layer) Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-19 18:28:56 +01:00
/* Aborting a non-active operation is allowed */
if( operation->id == 0 )
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
return( PSA_SUCCESS );
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 17:26:17 +02:00
Migrate MAC setup/abort calls into the software driver Step 1/x in moving the driver. Separate commits should make for easier review. Additional changes on top of just moving code: * Added a sanity check on the key buffer size for CMAC. * Transfered responsibility for resetting the core members of the PSA MAC operation structure back to the core (from the driver wrapper layer) Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-19 18:28:56 +01:00
psa_status_t status = psa_driver_wrapper_mac_abort( operation );
Move is_sign and mac_size checking back to PSA core scope It makes sense to do the length checking in the core rather than expect each driver to deal with it themselves. This puts the onus on the core to dictate which algorithm/key combinations are valid before calling a driver. Additionally, this commit also updates the psa_mac_sign_finish function to better deal with output buffer sanitation, as per the review comments on #4247. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-05-07 14:14:37 +02:00
operation->mac_size = 0;
operation->is_sign = 0;
Migrate MAC setup/abort calls into the software driver Step 1/x in moving the driver. Separate commits should make for easier review. Additional changes on top of just moving code: * Added a sanity check on the key buffer size for CMAC. * Transfered responsibility for resetting the core members of the PSA MAC operation structure back to the core (from the driver wrapper layer) Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-19 18:28:56 +01:00
operation->id = 0;
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 17:26:17 +02:00
Migrate MAC setup/abort calls into the software driver Step 1/x in moving the driver. Separate commits should make for easier review. Additional changes on top of just moving code: * Added a sanity check on the key buffer size for CMAC. * Transfered responsibility for resetting the core members of the PSA MAC operation structure back to the core (from the driver wrapper layer) Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-19 18:28:56 +01:00
return( status );
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 17:26:17 +02:00
}
psa: mac: Split psa_mac_setup() Split out of psa_mac_setup() the final checks on the requested algorithm and the key attributes. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-17 16:33:22 +02:00
static psa_status_t psa_mac_finalize_alg_and_key_validation(
psa_algorithm_t alg,
psa: mac: Improve implementation of psa_mac_finalize_alg_and_key_validation() Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-17 16:46:44 +02:00
const psa_key_attributes_t *attributes,
uint8_t *mac_size )
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
{
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa: mac: Improve implementation of psa_mac_finalize_alg_and_key_validation() Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-17 16:46:44 +02:00
psa_key_type_t key_type = psa_get_key_type( attributes );
size_t key_bits = psa_get_key_bits( attributes );
Move the MAC operation structure into the driver headers Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-19 17:05:52 +01:00
psa: mac: Re-organize psa_mac_setup() internal function Re-organize psa_mac_setup() to prepare the move to a dedicated function of the additional checks on the algorithm and the key attributes done by this function. We want to move those checks in a dedicated function to be able to do them without duplicating them in psa_mac_compute(). Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-17 16:10:24 +02:00
if( ! PSA_ALG_IS_MAC( alg ) )
psa: mac: Improve implementation of psa_mac_finalize_alg_and_key_validation() Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-17 16:46:44 +02:00
return( PSA_ERROR_INVALID_ARGUMENT );
Migrate MAC setup/abort calls into the software driver Step 1/x in moving the driver. Separate commits should make for easier review. Additional changes on top of just moving code: * Added a sanity check on the key buffer size for CMAC. * Transfered responsibility for resetting the core members of the PSA MAC operation structure back to the core (from the driver wrapper layer) Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-19 18:28:56 +01:00
Rework MAC algorithm / key type validation Reworked the validation of MAC algorithm with the used key type by introducing psa_mac_key_can_do, which guarantees that PSA_MAC_LENGTH can be called successfully after validation of the algorithm and key type. This means psa_get_mac_output_length is no longer required. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-03 19:04:05 +01:00
/* Validate the combination of key type and algorithm */
psa: mac: Improve implementation of psa_mac_finalize_alg_and_key_validation() Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-17 16:46:44 +02:00
status = psa_mac_key_can_do( alg, key_type );
Clean up psa_mac_setup now that we have an output length calculator Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 16:16:22 +01:00
if( status != PSA_SUCCESS )
psa: mac: Improve implementation of psa_mac_finalize_alg_and_key_validation() Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-17 16:46:44 +02:00
return( status );
Clean up psa_mac_setup now that we have an output length calculator Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 16:16:22 +01:00
Supply actual key bits to PSA_MAC_LENGTH during MAC setup Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-05-10 11:13:41 +02:00
/* Get the output length for the algorithm and key combination */
psa: mac: Improve implementation of psa_mac_finalize_alg_and_key_validation() Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-17 16:46:44 +02:00
*mac_size = PSA_MAC_LENGTH( key_type, key_bits, alg );
Clean up psa_mac_setup now that we have an output length calculator Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 16:16:22 +01:00
psa: mac: Improve implementation of psa_mac_finalize_alg_and_key_validation() Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-17 16:46:44 +02:00
if( *mac_size < 4 )
Clean up psa_mac_setup now that we have an output length calculator Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 16:16:22 +01:00
{
/* A very short MAC is too short for security since it can be
* brute-forced. Ancient protocols with 32-bit MACs do exist,
* so we make this our minimum, even though 32 bits is still
* too small for security. */
psa: mac: Improve implementation of psa_mac_finalize_alg_and_key_validation() Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-17 16:46:44 +02:00
return( PSA_ERROR_NOT_SUPPORTED );
Clean up psa_mac_setup now that we have an output length calculator Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 16:16:22 +01:00
}
Don't call psa_get_key_information internally When you have a key slot pointer, read the key type directly, and call psa_get_key_bits to get the bit size.
2018-07-06 16:07:47 +02:00
psa: mac: Improve implementation of psa_mac_finalize_alg_and_key_validation() Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-17 16:46:44 +02:00
if( *mac_size > PSA_MAC_LENGTH( key_type, key_bits,
PSA_ALG_FULL_LENGTH_MAC( alg ) ) )
Rework MAC algorithm / key type validation Reworked the validation of MAC algorithm with the used key type by introducing psa_mac_key_can_do, which guarantees that PSA_MAC_LENGTH can be called successfully after validation of the algorithm and key type. This means psa_get_mac_output_length is no longer required. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-03 19:04:05 +01:00
{
/* It's impossible to "truncate" to a larger length than the full length
* of the algorithm. */
psa: mac: Improve implementation of psa_mac_finalize_alg_and_key_validation() Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-17 16:46:44 +02:00
return( PSA_ERROR_INVALID_ARGUMENT );
Rework MAC algorithm / key type validation Reworked the validation of MAC algorithm with the used key type by introducing psa_mac_key_can_do, which guarantees that PSA_MAC_LENGTH can be called successfully after validation of the algorithm and key type. This means psa_get_mac_output_length is no longer required. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-03 19:04:05 +01:00
}
Fix psa_mac_verify() returning BUFFER_TOO_SMALL It doesn't make sense for psa_mac_verify() to return PSA_ERROR_BUFFER_TOO_SMALL since it doesn't have an output buffer. But this was happening when requesting the verification of an unsupported algorithm whose output size is larger than the maximum supported MAC size, e.g. HMAC-SHA-512 when building with only SHA-256 support. Arrange to return PSA_ERROR_NOT_SUPPORTED instead. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2022-03-16 13:54:49 +01:00
if( *mac_size > PSA_MAC_MAX_SIZE )
{
/* PSA_MAC_LENGTH returns the correct length even for a MAC algorithm
* that is disabled in the compile-time configuration. The result can
* therefore be larger than PSA_MAC_MAX_SIZE, which does take the
* configuration into account. In this case, force a return of
* PSA_ERROR_NOT_SUPPORTED here. Otherwise psa_mac_verify(), or
* psa_mac_compute(mac_size=PSA_MAC_MAX_SIZE), would return
* PSA_ERROR_BUFFER_TOO_SMALL for an unsupported algorithm whose MAC size
* is larger than PSA_MAC_MAX_SIZE, which is misleading and which breaks
* systematically generated tests. */
return( PSA_ERROR_NOT_SUPPORTED );
}
psa: mac: Improve implementation of psa_mac_finalize_alg_and_key_validation() Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-17 16:46:44 +02:00
return( PSA_SUCCESS );
psa: mac: Split psa_mac_setup() Split out of psa_mac_setup() the final checks on the requested algorithm and the key attributes. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-17 16:33:22 +02:00
}
Migrate MAC setup/abort calls into the software driver Step 1/x in moving the driver. Separate commits should make for easier review. Additional changes on top of just moving code: * Added a sanity check on the key buffer size for CMAC. * Transfered responsibility for resetting the core members of the PSA MAC operation structure back to the core (from the driver wrapper layer) Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-19 18:28:56 +01:00
static psa_status_t psa_mac_setup( psa_mac_operation_t *operation,
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 09:51:30 +02:00
mbedtls_svc_key_id_t key,
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 20:12:23 +02:00
psa_algorithm_t alg,
int is_sign )
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
{
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Call abort on error in psa_mac/cipher setup Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 12:49:45 +02:00
psa_key_slot_t *slot = NULL;
Move the MAC operation structure into the driver headers Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-19 17:05:52 +01:00
psa: Disallow repeated setup Calling psa_*_setup() twice on a MAC, cipher, or hash context should result in a PSA_ERROR_BAD_STATE error because the operation has already been set up. Fixes #10
2019-02-19 10:25:10 +01:00
/* A context must be freshly initialized before it can be set up. */
Migrate MAC setup/abort calls into the software driver Step 1/x in moving the driver. Separate commits should make for easier review. Additional changes on top of just moving code: * Added a sanity check on the key buffer size for CMAC. * Transfered responsibility for resetting the core members of the PSA MAC operation structure back to the core (from the driver wrapper layer) Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-19 18:28:56 +01:00
if( operation->id != 0 )
Correct coding style issues Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 17:17:43 +02:00
{
Call abort on error in psa_mac/cipher setup Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 12:49:45 +02:00
status = PSA_ERROR_BAD_STATE;
goto exit;
}
Code flow/readability improvements after review * Early return since there's nothing to clean up * Get rid of unnecessary local variable * Check algorithm validity for MAC in the PSA core instead of in the driver Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-29 16:21:24 +02:00
Migrate MAC setup/abort calls into the software driver Step 1/x in moving the driver. Separate commits should make for easier review. Additional changes on top of just moving code: * Added a sanity check on the key buffer size for CMAC. * Transfered responsibility for resetting the core members of the PSA MAC operation structure back to the core (from the driver wrapper layer) Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-19 18:28:56 +01:00
status = psa_get_and_lock_key_slot_with_policy(
Code flow/readability improvements after review * Early return since there's nothing to clean up * Get rid of unnecessary local variable * Check algorithm validity for MAC in the PSA core instead of in the driver Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-29 16:21:24 +02:00
key,
&slot,
Require MESSAGE flag in PSA MAC setup. Signed-off-by: Mateusz Starzyk <mateusz.starzyk@mobica.com>
2021-08-17 15:24:32 +02:00
is_sign ? PSA_KEY_USAGE_SIGN_MESSAGE : PSA_KEY_USAGE_VERIFY_MESSAGE,
Code flow/readability improvements after review * Early return since there's nothing to clean up * Get rid of unnecessary local variable * Check algorithm validity for MAC in the PSA core instead of in the driver Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-29 16:21:24 +02:00
alg );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
if( status != PSA_SUCCESS )
Call abort on error in psa_mac/cipher setup Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 12:49:45 +02:00
goto exit;
Clean up psa_mac_setup now that we have an output length calculator Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 16:16:22 +01:00
Migrate MAC setup/abort calls into the software driver Step 1/x in moving the driver. Separate commits should make for easier review. Additional changes on top of just moving code: * Added a sanity check on the key buffer size for CMAC. * Transfered responsibility for resetting the core members of the PSA MAC operation structure back to the core (from the driver wrapper layer) Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-19 18:28:56 +01:00
psa_key_attributes_t attributes = {
.core = slot->attr
};
psa: mac: Improve implementation of psa_mac_finalize_alg_and_key_validation() Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-17 16:46:44 +02:00
status = psa_mac_finalize_alg_and_key_validation( alg, &attributes,
&operation->mac_size );
Clean up psa_mac_setup now that we have an output length calculator Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-02 16:16:22 +01:00
if( status != PSA_SUCCESS )
goto exit;
Move is_sign and mac_size checking back to PSA core scope It makes sense to do the length checking in the core rather than expect each driver to deal with it themselves. This puts the onus on the core to dictate which algorithm/key combinations are valid before calling a driver. Additionally, this commit also updates the psa_mac_sign_finish function to better deal with output buffer sanitation, as per the review comments on #4247. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-05-07 14:14:37 +02:00
operation->is_sign = is_sign;
Migrate MAC setup/abort calls into the software driver Step 1/x in moving the driver. Separate commits should make for easier review. Additional changes on top of just moving code: * Added a sanity check on the key buffer size for CMAC. * Transfered responsibility for resetting the core members of the PSA MAC operation structure back to the core (from the driver wrapper layer) Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-19 18:28:56 +01:00
/* Dispatch the MAC setup call with validated input */
if( is_sign )
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
{
Migrate MAC setup/abort calls into the software driver Step 1/x in moving the driver. Separate commits should make for easier review. Additional changes on top of just moving code: * Added a sanity check on the key buffer size for CMAC. * Transfered responsibility for resetting the core members of the PSA MAC operation structure back to the core (from the driver wrapper layer) Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-19 18:28:56 +01:00
status = psa_driver_wrapper_mac_sign_setup( operation,
&attributes,
slot->key.data,
slot->key.bytes,
alg );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
}
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
else
{
Migrate MAC setup/abort calls into the software driver Step 1/x in moving the driver. Separate commits should make for easier review. Additional changes on top of just moving code: * Added a sanity check on the key buffer size for CMAC. * Transfered responsibility for resetting the core members of the PSA MAC operation structure back to the core (from the driver wrapper layer) Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-19 18:28:56 +01:00
status = psa_driver_wrapper_mac_verify_setup( operation,
&attributes,
slot->key.data,
slot->key.bytes,
alg );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
}
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 17:26:17 +02:00
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
exit:
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 17:26:17 +02:00
if( status != PSA_SUCCESS )
Migrate MAC setup/abort calls into the software driver Step 1/x in moving the driver. Separate commits should make for easier review. Additional changes on top of just moving code: * Added a sanity check on the key buffer size for CMAC. * Transfered responsibility for resetting the core members of the PSA MAC operation structure back to the core (from the driver wrapper layer) Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-19 18:28:56 +01:00
psa_mac_abort( operation );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
unlock_status = psa_unlock_key_slot( slot );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
return( ( status == PSA_SUCCESS ) ? unlock_status : status );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
}
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 20:12:23 +02:00
psa_status_t psa_mac_sign_setup( psa_mac_operation_t *operation,
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 09:51:30 +02:00
mbedtls_svc_key_id_t key,
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 20:12:23 +02:00
psa_algorithm_t alg )
{
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 09:51:30 +02:00
return( psa_mac_setup( operation, key, alg, 1 ) );
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 20:12:23 +02:00
}
psa_status_t psa_mac_verify_setup( psa_mac_operation_t *operation,
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 09:51:30 +02:00
mbedtls_svc_key_id_t key,
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 20:12:23 +02:00
psa_algorithm_t alg )
{
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 09:51:30 +02:00
return( psa_mac_setup( operation, key, alg, 0 ) );
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 20:12:23 +02:00
}
Migrate MAC update call into the software driver Step 2/x in moving the driver. Separate commits should make for easier review. Additional changes on top of code movement: * Early-return success on input with zero-length to mac_update, to avoid NULL pointers getting passed into the driver dispatch Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-19 18:38:46 +01:00
psa_status_t psa_mac_update( psa_mac_operation_t *operation,
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
const uint8_t *input,
size_t input_length )
{
Migrate MAC update call into the software driver Step 2/x in moving the driver. Separate commits should make for easier review. Additional changes on top of code movement: * Early-return success on input with zero-length to mac_update, to avoid NULL pointers getting passed into the driver dispatch Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-19 18:38:46 +01:00
if( operation->id == 0 )
psa: Don't abort when operations are invalid In places where we detect a context is in a bad state and there is no sensitive data to clear, simply return PSA_ERROR_BAD_STATE and don't abort on behalf of the application. The application will choose what to do when it gets a bad state error. The motivation for this change is that an application should decide what to do when it misuses the API and encounters a PSA_ERROR_BAD_STATE error. The library should not attempt to abort on behalf of the application, as that may not be the correct thing to do in all circumstances.
2019-02-20 16:37:15 +01:00
return( PSA_ERROR_BAD_STATE );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
Migrate MAC update call into the software driver Step 2/x in moving the driver. Separate commits should make for easier review. Additional changes on top of code movement: * Early-return success on input with zero-length to mac_update, to avoid NULL pointers getting passed into the driver dispatch Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-19 18:38:46 +01:00
/* Don't require hash implementations to behave correctly on a
* zero-length input, which may have an invalid pointer. */
if( input_length == 0 )
return( PSA_SUCCESS );
Commit changes to hmac to not use MD abstraction this PR is part of efforts to use "lower level" mbedTLS APIs vs "higher level" abstract APIs.
2018-06-04 15:03:32 +02:00
Migrate MAC update call into the software driver Step 2/x in moving the driver. Separate commits should make for easier review. Additional changes on top of code movement: * Early-return success on input with zero-length to mac_update, to avoid NULL pointers getting passed into the driver dispatch Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-19 18:38:46 +01:00
psa_status_t status = psa_driver_wrapper_mac_update( operation,
input, input_length );
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
if( status != PSA_SUCCESS )
Migrate MAC update call into the software driver Step 2/x in moving the driver. Separate commits should make for easier review. Additional changes on top of code movement: * Early-return success on input with zero-length to mac_update, to avoid NULL pointers getting passed into the driver dispatch Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-19 18:38:46 +01:00
psa_mac_abort( operation );
Formatting improvements Avoid lines longer than 80 columns. Remove some redundant parentheses, e.g. change if( ( a == b ) && ( c == d ) ) to if( a == b && c == d ) which makes lines less long and makes the remaining parentheses more relevant. Add missing parentheses around return statements. There should be no semantic change in this commit.
2018-06-18 16:04:39 +02:00
return( status );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
}
Migrate MAC finish calls into the software driver Step 3/x in moving the driver. Separate commits should make for easier review. Additional changes on top of code movement: * Copied the implementation of safer_memcmp from psa_crypto into psa_cipher_mac since the mac_verify driver implementation depends on it, and it isn't available through external linkage Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-19 19:04:39 +01:00
psa_status_t psa_mac_sign_finish( psa_mac_operation_t *operation,
Rename psa_mac_{finish,verify} -> psa_mac_{sign,verify}_finish Make function names for multipart operations more consistent (MAC finish edition).
2018-07-08 19:56:25 +02:00
uint8_t *mac,
size_t mac_size,
size_t *mac_length )
Add static internal MAC finish function add new psa_mac_finish_internal() to be called by psa_mac_finish() and psa_mac_verify() in order to be able to check key usage separatly.
2018-04-02 17:34:15 +02:00
{
Migrate MAC finish calls into the software driver Step 3/x in moving the driver. Separate commits should make for easier review. Additional changes on top of code movement: * Copied the implementation of safer_memcmp from psa_crypto into psa_cipher_mac since the mac_verify driver implementation depends on it, and it isn't available through external linkage Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-19 19:04:39 +01:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED;
Streamline cleanup logic in MAC finish Reorganize error handling code in psa_mac_finish_internal, psa_mac_sign_finish and psa_mac_verify finish to ensure that: * psa_mac_abort() is always called, on all success and error paths. * psa_mac_finish places a safe value in the output parameters on all error paths, even if abort fails.
2018-07-08 20:35:02 +02:00
Migrate MAC finish calls into the software driver Step 3/x in moving the driver. Separate commits should make for easier review. Additional changes on top of code movement: * Copied the implementation of safer_memcmp from psa_crypto into psa_cipher_mac since the mac_verify driver implementation depends on it, and it isn't available through external linkage Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-19 19:04:39 +01:00
if( operation->id == 0 )
Tidy up logic in psa_mac_sign_finish Simplify the logic in psa_mac_sign_finish. Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 17:19:08 +02:00
{
Update cipher and mac functions to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-23 12:38:39 +02:00
status = PSA_ERROR_BAD_STATE;
Use more standard label name Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-25 10:09:02 +02:00
goto exit;
Update cipher and mac functions to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-23 12:38:39 +02:00
}
psa: Disallow use of invalid MAC contexts Ensure that when doing MAC operations out of order, PSA_ERROR_BAD_STATE is returned as documented in crypto.h and the PSA Crypto specification.
2019-02-15 15:05:35 +01:00
Move is_sign and mac_size checking back to PSA core scope It makes sense to do the length checking in the core rather than expect each driver to deal with it themselves. This puts the onus on the core to dictate which algorithm/key combinations are valid before calling a driver. Additionally, this commit also updates the psa_mac_sign_finish function to better deal with output buffer sanitation, as per the review comments on #4247. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-05-07 14:14:37 +02:00
if( ! operation->is_sign )
Correct coding style issues Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 17:17:43 +02:00
{
Update cipher and mac functions to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-23 12:38:39 +02:00
status = PSA_ERROR_BAD_STATE;
Use more standard label name Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-25 10:09:02 +02:00
goto exit;
Update cipher and mac functions to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-23 12:38:39 +02:00
}
Streamline cleanup logic in MAC finish Reorganize error handling code in psa_mac_finish_internal, psa_mac_sign_finish and psa_mac_verify finish to ensure that: * psa_mac_abort() is always called, on all success and error paths. * psa_mac_finish places a safe value in the output parameters on all error paths, even if abort fails.
2018-07-08 20:35:02 +02:00
Be explicit about why the zero-length check is there Since a valid mac operation context would guarantee that the stored mac size is >= 4, it wasn't immediately obvious that the zero-length check is meant for static analyzers and a bit of robustness. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-05-11 11:09:13 +02:00
/* Sanity check. This will guarantee that mac_size != 0 (and so mac != NULL)
* once all the error checks are done. */
if( operation->mac_size == 0 )
Correct coding style issues Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 17:17:43 +02:00
{
Update cipher and mac functions to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-23 12:38:39 +02:00
status = PSA_ERROR_BAD_STATE;
Use more standard label name Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-25 10:09:02 +02:00
goto exit;
Update cipher and mac functions to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-23 12:38:39 +02:00
}
Be explicit about why the zero-length check is there Since a valid mac operation context would guarantee that the stored mac size is >= 4, it wasn't immediately obvious that the zero-length check is meant for static analyzers and a bit of robustness. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-05-11 11:09:13 +02:00
if( mac_size < operation->mac_size )
Correct coding style issues Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 17:17:43 +02:00
{
Update cipher and mac functions to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-23 12:38:39 +02:00
status = PSA_ERROR_BUFFER_TOO_SMALL;
Use more standard label name Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-25 10:09:02 +02:00
goto exit;
Update cipher and mac functions to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-23 12:38:39 +02:00
}
Add static internal MAC finish function add new psa_mac_finish_internal() to be called by psa_mac_finish() and psa_mac_verify() in order to be able to check key usage separatly.
2018-04-02 17:34:15 +02:00
Move is_sign and mac_size checking back to PSA core scope It makes sense to do the length checking in the core rather than expect each driver to deal with it themselves. This puts the onus on the core to dictate which algorithm/key combinations are valid before calling a driver. Additionally, this commit also updates the psa_mac_sign_finish function to better deal with output buffer sanitation, as per the review comments on #4247. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-05-07 14:14:37 +02:00
status = psa_driver_wrapper_mac_sign_finish( operation,
mac, operation->mac_size,
mac_length );
Streamline cleanup logic in MAC finish Reorganize error handling code in psa_mac_finish_internal, psa_mac_sign_finish and psa_mac_verify finish to ensure that: * psa_mac_abort() is always called, on all success and error paths. * psa_mac_finish places a safe value in the output parameters on all error paths, even if abort fails.
2018-07-08 20:35:02 +02:00
Use more standard label name Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-25 10:09:02 +02:00
exit:
psa: mac: Improve MAC finalization code Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-18 13:05:48 +02:00
/* In case of success, set the potential excess room in the output buffer
* to an invalid value, to avoid potentially leaking a longer MAC.
* In case of error, set the output length and content to a safe default,
* such that in case the caller misses an error check, the output would be
* an unachievable MAC.
*/
if( status != PSA_SUCCESS )
Move is_sign and mac_size checking back to PSA core scope It makes sense to do the length checking in the core rather than expect each driver to deal with it themselves. This puts the onus on the core to dictate which algorithm/key combinations are valid before calling a driver. Additionally, this commit also updates the psa_mac_sign_finish function to better deal with output buffer sanitation, as per the review comments on #4247. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-05-07 14:14:37 +02:00
{
*mac_length = mac_size;
psa: mac: Improve MAC finalization code Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-18 13:05:48 +02:00
operation->mac_size = 0;
Move is_sign and mac_size checking back to PSA core scope It makes sense to do the length checking in the core rather than expect each driver to deal with it themselves. This puts the onus on the core to dictate which algorithm/key combinations are valid before calling a driver. Additionally, this commit also updates the psa_mac_sign_finish function to better deal with output buffer sanitation, as per the review comments on #4247. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-05-07 14:14:37 +02:00
}
psa: mac: Improve MAC finalization code Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-18 13:05:48 +02:00
if( mac_size > operation->mac_size )
memset( &mac[operation->mac_size], '!',
mac_size - operation->mac_size );
Move is_sign and mac_size checking back to PSA core scope It makes sense to do the length checking in the core rather than expect each driver to deal with it themselves. This puts the onus on the core to dictate which algorithm/key combinations are valid before calling a driver. Additionally, this commit also updates the psa_mac_sign_finish function to better deal with output buffer sanitation, as per the review comments on #4247. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-05-07 14:14:37 +02:00
abort_status = psa_mac_abort( operation );
Migrate MAC finish calls into the software driver Step 3/x in moving the driver. Separate commits should make for easier review. Additional changes on top of code movement: * Copied the implementation of safer_memcmp from psa_crypto into psa_cipher_mac since the mac_verify driver implementation depends on it, and it isn't available through external linkage Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-19 19:04:39 +01:00
return( status == PSA_SUCCESS ? abort_status : status );
Add static internal MAC finish function add new psa_mac_finish_internal() to be called by psa_mac_finish() and psa_mac_verify() in order to be able to check key usage separatly.
2018-04-02 17:34:15 +02:00
}
Migrate MAC finish calls into the software driver Step 3/x in moving the driver. Separate commits should make for easier review. Additional changes on top of code movement: * Copied the implementation of safer_memcmp from psa_crypto into psa_cipher_mac since the mac_verify driver implementation depends on it, and it isn't available through external linkage Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-19 19:04:39 +01:00
psa_status_t psa_mac_verify_finish( psa_mac_operation_t *operation,
Rename psa_mac_{finish,verify} -> psa_mac_{sign,verify}_finish Make function names for multipart operations more consistent (MAC finish edition).
2018-07-08 19:56:25 +02:00
const uint8_t *mac,
size_t mac_length )
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
{
Migrate MAC finish calls into the software driver Step 3/x in moving the driver. Separate commits should make for easier review. Additional changes on top of code movement: * Copied the implementation of safer_memcmp from psa_crypto into psa_cipher_mac since the mac_verify driver implementation depends on it, and it isn't available through external linkage Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-19 19:04:39 +01:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED;
psa: Disallow use of invalid MAC contexts Ensure that when doing MAC operations out of order, PSA_ERROR_BAD_STATE is returned as documented in crypto.h and the PSA Crypto specification.
2019-02-15 15:05:35 +01:00
Migrate MAC finish calls into the software driver Step 3/x in moving the driver. Separate commits should make for easier review. Additional changes on top of code movement: * Copied the implementation of safer_memcmp from psa_crypto into psa_cipher_mac since the mac_verify driver implementation depends on it, and it isn't available through external linkage Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-19 19:04:39 +01:00
if( operation->id == 0 )
Correct coding style issues Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 17:17:43 +02:00
{
Update cipher and mac functions to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-23 12:38:39 +02:00
status = PSA_ERROR_BAD_STATE;
Use more standard label name Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-25 10:09:02 +02:00
goto exit;
Update cipher and mac functions to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-23 12:38:39 +02:00
}
Add static internal MAC finish function add new psa_mac_finish_internal() to be called by psa_mac_finish() and psa_mac_verify() in order to be able to check key usage separatly.
2018-04-02 17:34:15 +02:00
Move is_sign and mac_size checking back to PSA core scope It makes sense to do the length checking in the core rather than expect each driver to deal with it themselves. This puts the onus on the core to dictate which algorithm/key combinations are valid before calling a driver. Additionally, this commit also updates the psa_mac_sign_finish function to better deal with output buffer sanitation, as per the review comments on #4247. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-05-07 14:14:37 +02:00
if( operation->is_sign )
Correct coding style issues Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 17:17:43 +02:00
{
Update cipher and mac functions to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-23 12:38:39 +02:00
status = PSA_ERROR_BAD_STATE;
Use more standard label name Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-25 10:09:02 +02:00
goto exit;
Update cipher and mac functions to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-23 12:38:39 +02:00
}
Move is_sign and mac_size checking back to PSA core scope It makes sense to do the length checking in the core rather than expect each driver to deal with it themselves. This puts the onus on the core to dictate which algorithm/key combinations are valid before calling a driver. Additionally, this commit also updates the psa_mac_sign_finish function to better deal with output buffer sanitation, as per the review comments on #4247. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-05-07 14:14:37 +02:00
if( operation->mac_size != mac_length )
{
status = PSA_ERROR_INVALID_SIGNATURE;
Use more standard label name Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-25 10:09:02 +02:00
goto exit;
Move is_sign and mac_size checking back to PSA core scope It makes sense to do the length checking in the core rather than expect each driver to deal with it themselves. This puts the onus on the core to dictate which algorithm/key combinations are valid before calling a driver. Additionally, this commit also updates the psa_mac_sign_finish function to better deal with output buffer sanitation, as per the review comments on #4247. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-05-07 14:14:37 +02:00
}
Migrate MAC finish calls into the software driver Step 3/x in moving the driver. Separate commits should make for easier review. Additional changes on top of code movement: * Copied the implementation of safer_memcmp from psa_crypto into psa_cipher_mac since the mac_verify driver implementation depends on it, and it isn't available through external linkage Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-19 19:04:39 +01:00
status = psa_driver_wrapper_mac_verify_finish( operation,
mac, mac_length );
Move is_sign and mac_size checking back to PSA core scope It makes sense to do the length checking in the core rather than expect each driver to deal with it themselves. This puts the onus on the core to dictate which algorithm/key combinations are valid before calling a driver. Additionally, this commit also updates the psa_mac_sign_finish function to better deal with output buffer sanitation, as per the review comments on #4247. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-05-07 14:14:37 +02:00
Use more standard label name Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-25 10:09:02 +02:00
exit:
Migrate MAC finish calls into the software driver Step 3/x in moving the driver. Separate commits should make for easier review. Additional changes on top of code movement: * Copied the implementation of safer_memcmp from psa_crypto into psa_cipher_mac since the mac_verify driver implementation depends on it, and it isn't available through external linkage Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-19 19:04:39 +01:00
abort_status = psa_mac_abort( operation );
Streamline cleanup logic in MAC finish Reorganize error handling code in psa_mac_finish_internal, psa_mac_sign_finish and psa_mac_verify finish to ensure that: * psa_mac_abort() is always called, on all success and error paths. * psa_mac_finish places a safe value in the output parameters on all error paths, even if abort fails.
2018-07-08 20:35:02 +02:00
Migrate MAC finish calls into the software driver Step 3/x in moving the driver. Separate commits should make for easier review. Additional changes on top of code movement: * Copied the implementation of safer_memcmp from psa_crypto into psa_cipher_mac since the mac_verify driver implementation depends on it, and it isn't available through external linkage Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-03-19 19:04:39 +01:00
return( status == PSA_SUCCESS ? abort_status : status );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
}
psa: mac: Introduce psa_mac_compute_internal Introduce psa_mac_compute_internal with an additional `is_sign` parameter compared to the psa_mac_compute API. The intent is to call psa_mac_compute_internal() from psa_mac_verify() as well to compute the message MAC. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-18 14:23:33 +02:00
static psa_status_t psa_mac_compute_internal( mbedtls_svc_key_id_t key,
psa_algorithm_t alg,
const uint8_t *input,
size_t input_length,
uint8_t *mac,
size_t mac_size,
size_t *mac_length,
int is_sign )
Implement one-shot MAC functions Implement one-shot MAC APIs, psa_mac_compute and psa_mac_verify, introduced in PSA Crypto API 1.0. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-01 15:34:18 +01:00
{
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa: mac: Add driver delegation support for psa_mac_compute() Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-17 17:17:20 +02:00
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
psa_key_slot_t *slot;
uint8_t operation_mac_size = 0;
Implement one-shot MAC functions Implement one-shot MAC APIs, psa_mac_compute and psa_mac_verify, introduced in PSA Crypto API 1.0. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-01 15:34:18 +01:00
psa: mac: Add driver delegation support for psa_mac_compute() Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-17 17:17:20 +02:00
status = psa_get_and_lock_key_slot_with_policy(
Require MESSAGE flag in PSA MAC setup. Signed-off-by: Mateusz Starzyk <mateusz.starzyk@mobica.com>
2021-08-17 15:24:32 +02:00
key,
&slot,
is_sign ? PSA_KEY_USAGE_SIGN_MESSAGE : PSA_KEY_USAGE_VERIFY_MESSAGE,
psa: mac: Introduce psa_mac_compute_internal Introduce psa_mac_compute_internal with an additional `is_sign` parameter compared to the psa_mac_compute API. The intent is to call psa_mac_compute_internal() from psa_mac_verify() as well to compute the message MAC. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-18 14:23:33 +02:00
alg );
Implement one-shot MAC functions Implement one-shot MAC APIs, psa_mac_compute and psa_mac_verify, introduced in PSA Crypto API 1.0. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-01 15:34:18 +01:00
if( status != PSA_SUCCESS )
goto exit;
psa: mac: Add driver delegation support for psa_mac_compute() Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-17 17:17:20 +02:00
psa_key_attributes_t attributes = {
.core = slot->attr
};
status = psa_mac_finalize_alg_and_key_validation( alg, &attributes,
&operation_mac_size );
Implement one-shot MAC functions Implement one-shot MAC APIs, psa_mac_compute and psa_mac_verify, introduced in PSA Crypto API 1.0. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-01 15:34:18 +01:00
if( status != PSA_SUCCESS )
goto exit;
psa: mac: Add driver delegation support for psa_mac_compute() Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-17 17:17:20 +02:00
if( mac_size < operation_mac_size )
{
status = PSA_ERROR_BUFFER_TOO_SMALL;
Implement one-shot MAC functions Implement one-shot MAC APIs, psa_mac_compute and psa_mac_verify, introduced in PSA Crypto API 1.0. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-01 15:34:18 +01:00
goto exit;
psa: mac: Add driver delegation support for psa_mac_compute() Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-17 17:17:20 +02:00
}
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
psa: mac: Add driver delegation support for psa_mac_compute() Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-17 17:17:20 +02:00
status = psa_driver_wrapper_mac_compute(
&attributes,
slot->key.data, slot->key.bytes,
alg,
input, input_length,
mac, operation_mac_size, mac_length );
Implement one-shot MAC functions Implement one-shot MAC APIs, psa_mac_compute and psa_mac_verify, introduced in PSA Crypto API 1.0. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-01 15:34:18 +01:00
exit:
psa: mac: Improve MAC finalization code Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-18 13:05:48 +02:00
/* In case of success, set the potential excess room in the output buffer
* to an invalid value, to avoid potentially leaking a longer MAC.
* In case of error, set the output length and content to a safe default,
* such that in case the caller misses an error check, the output would be
* an unachievable MAC.
*/
if( status != PSA_SUCCESS )
psa: mac: Add driver delegation support for psa_mac_compute() Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-17 17:17:20 +02:00
{
*mac_length = mac_size;
psa: mac: Improve MAC finalization code Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-18 13:05:48 +02:00
operation_mac_size = 0;
psa: mac: Add driver delegation support for psa_mac_compute() Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-17 17:17:20 +02:00
}
psa: mac: Improve MAC finalization code Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-18 13:05:48 +02:00
if( mac_size > operation_mac_size )
memset( &mac[operation_mac_size], '!', mac_size - operation_mac_size );
Implement one-shot MAC functions Implement one-shot MAC APIs, psa_mac_compute and psa_mac_verify, introduced in PSA Crypto API 1.0. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-01 15:34:18 +01:00
psa: mac: Add driver delegation support for psa_mac_compute() Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-17 17:17:20 +02:00
unlock_status = psa_unlock_key_slot( slot );
return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Implement one-shot MAC functions Implement one-shot MAC APIs, psa_mac_compute and psa_mac_verify, introduced in PSA Crypto API 1.0. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-01 15:34:18 +01:00
}
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
psa: mac: Introduce psa_mac_compute_internal Introduce psa_mac_compute_internal with an additional `is_sign` parameter compared to the psa_mac_compute API. The intent is to call psa_mac_compute_internal() from psa_mac_verify() as well to compute the message MAC. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-18 14:23:33 +02:00
psa_status_t psa_mac_compute( mbedtls_svc_key_id_t key,
psa_algorithm_t alg,
const uint8_t *input,
size_t input_length,
uint8_t *mac,
size_t mac_size,
size_t *mac_length)
{
return( psa_mac_compute_internal( key, alg,
input, input_length,
mac, mac_size, mac_length, 1 ) );
}
Implement one-shot MAC functions Implement one-shot MAC APIs, psa_mac_compute and psa_mac_verify, introduced in PSA Crypto API 1.0. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-01 15:34:18 +01:00
psa_status_t psa_mac_verify( mbedtls_svc_key_id_t key,
psa_algorithm_t alg,
const uint8_t *input,
size_t input_length,
const uint8_t *mac,
size_t mac_length)
{
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa: mac: Add driver delegation support for psa_mac_verify() Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-18 14:51:29 +02:00
uint8_t actual_mac[PSA_MAC_MAX_SIZE];
size_t actual_mac_length;
Implement one-shot MAC functions Implement one-shot MAC APIs, psa_mac_compute and psa_mac_verify, introduced in PSA Crypto API 1.0. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-01 15:34:18 +01:00
psa: mac: Add driver delegation support for psa_mac_verify() Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-18 14:51:29 +02:00
status = psa_mac_compute_internal( key, alg,
input, input_length,
actual_mac, sizeof( actual_mac ),
&actual_mac_length, 0 );
Implement one-shot MAC functions Implement one-shot MAC APIs, psa_mac_compute and psa_mac_verify, introduced in PSA Crypto API 1.0. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-01 15:34:18 +01:00
if( status != PSA_SUCCESS )
goto exit;
psa: mac: Add driver delegation support for psa_mac_verify() Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-18 14:51:29 +02:00
if( mac_length != actual_mac_length )
{
status = PSA_ERROR_INVALID_SIGNATURE;
Implement one-shot MAC functions Implement one-shot MAC APIs, psa_mac_compute and psa_mac_verify, introduced in PSA Crypto API 1.0. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-01 15:34:18 +01:00
goto exit;
psa: mac: Add driver delegation support for psa_mac_verify() Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-18 14:51:29 +02:00
}
if( mbedtls_psa_safer_memcmp( mac, actual_mac, actual_mac_length ) != 0 )
{
status = PSA_ERROR_INVALID_SIGNATURE;
Implement one-shot MAC functions Implement one-shot MAC APIs, psa_mac_compute and psa_mac_verify, introduced in PSA Crypto API 1.0. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-01 15:34:18 +01:00
goto exit;
psa: mac: Add driver delegation support for psa_mac_verify() Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-18 14:51:29 +02:00
}
Implement one-shot MAC functions Implement one-shot MAC APIs, psa_mac_compute and psa_mac_verify, introduced in PSA Crypto API 1.0. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-01 15:34:18 +01:00
exit:
psa: mac: Add driver delegation support for psa_mac_verify() Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-06-18 14:51:29 +02:00
mbedtls_platform_zeroize( actual_mac, sizeof( actual_mac ) );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
Implement one-shot MAC functions Implement one-shot MAC APIs, psa_mac_compute and psa_mac_verify, introduced in PSA Crypto API 1.0. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-01 15:34:18 +01:00
return ( status );
}
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 22:44:14 +01:00
/****************************************************************/
/* Asymmetric cryptography */
/****************************************************************/
Unify variable type and rename to be unambiguous Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-12 11:03:09 +02:00
static psa_status_t psa_sign_verify_check_alg( int input_is_message,
Use bool variable instead of enum values Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-05 13:56:27 +02:00
psa_algorithm_t alg )
Unify similar functions Use common funtion for psa_sign_hash and psa_sign_message and one for psa_verify_hash and psa_verify_message to unify them. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-20 12:11:35 +02:00
{
Unify variable type and rename to be unambiguous Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-12 11:03:09 +02:00
if( input_is_message )
Use bool variable instead of enum values Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-05 13:56:27 +02:00
{
if( ! PSA_ALG_IS_SIGN_MESSAGE( alg ) )
return( PSA_ERROR_INVALID_ARGUMENT );
Unify similar functions Use common funtion for psa_sign_hash and psa_sign_message and one for psa_verify_hash and psa_verify_message to unify them. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-20 12:11:35 +02:00
Untangle PSA_ALG_IS_HASH_AND_SIGN and PSA_ALG_IS_SIGN_HASH The current definition of PSA_ALG_IS_HASH_AND_SIGN includes PSA_ALG_RSA_PKCS1V15_SIGN_RAW and PSA_ALG_ECDSA_ANY, which don't strictly follow the hash-and-sign paradigm: the algorithm does not encode a hash algorithm that is applied prior to the signature step. The definition in fact encompasses what can be used with psa_sign_hash/psa_verify_hash, so it's the correct definition for PSA_ALG_IS_SIGN_HASH. Therefore this commit moves definition of PSA_ALG_IS_HASH_AND_SIGN to PSA_ALG_IS_SIGN_HASH, and replace the definition of PSA_ALG_IS_HASH_AND_SIGN by a correct one (based on PSA_ALG_IS_SIGN_HASH, excluding the algorithms where the pre-signature step isn't to apply the hash encoded in the algorithm). In the definition of PSA_ALG_SIGN_GET_HASH, keep the condition for a nonzero output to be PSA_ALG_IS_HASH_AND_SIGN. Everywhere else in the code base (definition of PSA_ALG_IS_SIGN_MESSAGE, and every use of PSA_ALG_IS_HASH_AND_SIGN outside of crypto_values.h), we meant PSA_ALG_IS_SIGN_HASH where we wrote PSA_ALG_IS_HASH_AND_SIGN, so do a global replacement. ``` git grep -l IS_HASH_AND_SIGN ':!include/psa/crypto_values.h' | xargs perl -i -pe 's/ALG_IS_HASH_AND_SIGN/ALG_IS_SIGN_HASH/g' ``` Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-09-22 16:15:05 +02:00
if ( PSA_ALG_IS_SIGN_HASH( alg ) )
Use bool variable instead of enum values Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-05 13:56:27 +02:00
{
if( ! PSA_ALG_IS_HASH( PSA_ALG_SIGN_GET_HASH( alg ) ) )
return( PSA_ERROR_INVALID_ARGUMENT );
}
}
else
{
Add missing PSA_ALG_IS_SIGN_HASH macro. Signed-off-by: Mateusz Starzyk <mateusz.starzyk@mobica.com>
2021-08-26 11:46:14 +02:00
if( ! PSA_ALG_IS_SIGN_HASH( alg ) )
Use bool variable instead of enum values Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-05 13:56:27 +02:00
return( PSA_ERROR_INVALID_ARGUMENT );
}
return( PSA_SUCCESS );
}
Unify similar functions Use common funtion for psa_sign_hash and psa_sign_message and one for psa_verify_hash and psa_verify_message to unify them. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-20 12:11:35 +02:00
static psa_status_t psa_sign_internal( mbedtls_svc_key_id_t key,
Unify variable type and rename to be unambiguous Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-12 11:03:09 +02:00
int input_is_message,
Unify similar functions Use common funtion for psa_sign_hash and psa_sign_message and one for psa_verify_hash and psa_verify_message to unify them. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-20 12:11:35 +02:00
psa_algorithm_t alg,
const uint8_t * input,
size_t input_length,
uint8_t * signature,
size_t signature_size,
size_t * signature_length )
Implement psa_sign_message and psa_verify_message functions Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-14 21:14:28 +02:00
{
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
psa_key_slot_t *slot;
*signature_length = 0;
Unify variable type and rename to be unambiguous Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-12 11:03:09 +02:00
status = psa_sign_verify_check_alg( input_is_message, alg );
Use bool variable instead of enum values Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-05 13:56:27 +02:00
if( status != PSA_SUCCESS )
return status;
Implement psa_sign_message and psa_verify_message functions Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-14 21:14:28 +02:00
/* Immediately reject a zero-length signature buffer. This guarantees
Fix documentation Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-05 13:54:55 +02:00
* that signature must be a valid pointer. (On the other hand, the input
Implement psa_sign_message and psa_verify_message functions Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-14 21:14:28 +02:00
* buffer can in principle be empty since it doesn't actually have
* to be a hash.) */
if( signature_size == 0 )
return( PSA_ERROR_BUFFER_TOO_SMALL );
Unify similar functions Use common funtion for psa_sign_hash and psa_sign_message and one for psa_verify_hash and psa_verify_message to unify them. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-20 12:11:35 +02:00
status = psa_get_and_lock_key_slot_with_policy(
key, &slot,
Unify variable type and rename to be unambiguous Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-12 11:03:09 +02:00
input_is_message ? PSA_KEY_USAGE_SIGN_MESSAGE :
PSA_KEY_USAGE_SIGN_HASH,
Unify similar functions Use common funtion for psa_sign_hash and psa_sign_message and one for psa_verify_hash and psa_verify_message to unify them. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-20 12:11:35 +02:00
alg );
Implement psa_sign_message and psa_verify_message functions Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-14 21:14:28 +02:00
if( status != PSA_SUCCESS )
goto exit;
if( ! PSA_KEY_TYPE_IS_KEY_PAIR( slot->attr.type ) )
{
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
}
psa_key_attributes_t attributes = {
.core = slot->attr
};
Unify variable type and rename to be unambiguous Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-12 11:03:09 +02:00
if( input_is_message )
Implement psa_sign_message and psa_verify_message functions Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-14 21:14:28 +02:00
{
Dispatch sign/verify funtions through the driver interface Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-22 11:32:19 +02:00
status = psa_driver_wrapper_sign_message(
Unify similar functions Use common funtion for psa_sign_hash and psa_sign_message and one for psa_verify_hash and psa_verify_message to unify them. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-20 12:11:35 +02:00
&attributes, slot->key.data, slot->key.bytes,
Dispatch sign/verify funtions through the driver interface Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-22 11:32:19 +02:00
alg, input, input_length,
Unify similar functions Use common funtion for psa_sign_hash and psa_sign_message and one for psa_verify_hash and psa_verify_message to unify them. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-20 12:11:35 +02:00
signature, signature_size, signature_length );
Implement psa_sign_message and psa_verify_message functions Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-14 21:14:28 +02:00
}
Use bool variable instead of enum values Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-05 13:56:27 +02:00
else
Unify similar functions Use common funtion for psa_sign_hash and psa_sign_message and one for psa_verify_hash and psa_verify_message to unify them. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-20 12:11:35 +02:00
{
Implement psa_sign_message and psa_verify_message functions Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-14 21:14:28 +02:00
Unify similar functions Use common funtion for psa_sign_hash and psa_sign_message and one for psa_verify_hash and psa_verify_message to unify them. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-20 12:11:35 +02:00
status = psa_driver_wrapper_sign_hash(
&attributes, slot->key.data, slot->key.bytes,
alg, input, input_length,
signature, signature_size, signature_length );
}
Implement psa_sign_message and psa_verify_message functions Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-14 21:14:28 +02:00
exit:
/* Fill the unused part of the output buffer (the whole buffer on error,
* the trailing part on success) with something that isn't a valid signature
* (barring an attack on the signature and deliberately-crafted input),
* in case the caller doesn't check the return status properly. */
if( status == PSA_SUCCESS )
memset( signature + *signature_length, '!',
signature_size - *signature_length );
else
memset( signature, '!', signature_size );
/* If signature_size is 0 then we have nothing to do. We must not call
* memset because signature may be NULL in this case. */
unlock_status = psa_unlock_key_slot( slot );
return( ( status == PSA_SUCCESS ) ? unlock_status : status );
}
Unify similar functions Use common funtion for psa_sign_hash and psa_sign_message and one for psa_verify_hash and psa_verify_message to unify them. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-20 12:11:35 +02:00
static psa_status_t psa_verify_internal( mbedtls_svc_key_id_t key,
Unify variable type and rename to be unambiguous Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-12 11:03:09 +02:00
int input_is_message,
Unify similar functions Use common funtion for psa_sign_hash and psa_sign_message and one for psa_verify_hash and psa_verify_message to unify them. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-20 12:11:35 +02:00
psa_algorithm_t alg,
const uint8_t * input,
size_t input_length,
const uint8_t * signature,
size_t signature_length )
Implement psa_sign_message and psa_verify_message functions Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-14 21:14:28 +02:00
{
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
psa_key_slot_t *slot;
Unify variable type and rename to be unambiguous Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-12 11:03:09 +02:00
status = psa_sign_verify_check_alg( input_is_message, alg );
Use bool variable instead of enum values Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-05 13:56:27 +02:00
if( status != PSA_SUCCESS )
return status;
Unify similar functions Use common funtion for psa_sign_hash and psa_sign_message and one for psa_verify_hash and psa_verify_message to unify them. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-20 12:11:35 +02:00
status = psa_get_and_lock_key_slot_with_policy(
key, &slot,
Unify variable type and rename to be unambiguous Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-12 11:03:09 +02:00
input_is_message ? PSA_KEY_USAGE_VERIFY_MESSAGE :
PSA_KEY_USAGE_VERIFY_HASH,
Unify similar functions Use common funtion for psa_sign_hash and psa_sign_message and one for psa_verify_hash and psa_verify_message to unify them. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-20 12:11:35 +02:00
alg );
Implement psa_sign_message and psa_verify_message functions Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-14 21:14:28 +02:00
if( status != PSA_SUCCESS )
return( status );
psa_key_attributes_t attributes = {
.core = slot->attr
};
Unify variable type and rename to be unambiguous Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-12 11:03:09 +02:00
if( input_is_message )
Implement psa_sign_message and psa_verify_message functions Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-14 21:14:28 +02:00
{
Dispatch sign/verify funtions through the driver interface Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-22 11:32:19 +02:00
status = psa_driver_wrapper_verify_message(
Unify similar functions Use common funtion for psa_sign_hash and psa_sign_message and one for psa_verify_hash and psa_verify_message to unify them. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-20 12:11:35 +02:00
&attributes, slot->key.data, slot->key.bytes,
Dispatch sign/verify funtions through the driver interface Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-22 11:32:19 +02:00
alg, input, input_length,
Unify similar functions Use common funtion for psa_sign_hash and psa_sign_message and one for psa_verify_hash and psa_verify_message to unify them. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-20 12:11:35 +02:00
signature, signature_length );
}
Use bool variable instead of enum values Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-05 13:56:27 +02:00
else
Unify similar functions Use common funtion for psa_sign_hash and psa_sign_message and one for psa_verify_hash and psa_verify_message to unify them. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-20 12:11:35 +02:00
{
status = psa_driver_wrapper_verify_hash(
&attributes, slot->key.data, slot->key.bytes,
alg, input, input_length,
signature, signature_length );
}
Implement psa_sign_message and psa_verify_message functions Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-14 21:14:28 +02:00
unlock_status = psa_unlock_key_slot( slot );
return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Unify similar functions Use common funtion for psa_sign_hash and psa_sign_message and one for psa_verify_hash and psa_verify_message to unify them. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-20 12:11:35 +02:00
}
Rename sign/verify builtin functions called by driver wrapper functions Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-05 14:18:36 +02:00
psa_status_t psa_sign_message_builtin(
Dispatch sign/verify funtions through the driver interface Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-22 11:32:19 +02:00
const psa_key_attributes_t *attributes,
const uint8_t *key_buffer,
size_t key_buffer_size,
psa_algorithm_t alg,
const uint8_t *input,
size_t input_length,
uint8_t *signature,
size_t signature_size,
size_t *signature_length )
{
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Untangle PSA_ALG_IS_HASH_AND_SIGN and PSA_ALG_IS_SIGN_HASH The current definition of PSA_ALG_IS_HASH_AND_SIGN includes PSA_ALG_RSA_PKCS1V15_SIGN_RAW and PSA_ALG_ECDSA_ANY, which don't strictly follow the hash-and-sign paradigm: the algorithm does not encode a hash algorithm that is applied prior to the signature step. The definition in fact encompasses what can be used with psa_sign_hash/psa_verify_hash, so it's the correct definition for PSA_ALG_IS_SIGN_HASH. Therefore this commit moves definition of PSA_ALG_IS_HASH_AND_SIGN to PSA_ALG_IS_SIGN_HASH, and replace the definition of PSA_ALG_IS_HASH_AND_SIGN by a correct one (based on PSA_ALG_IS_SIGN_HASH, excluding the algorithms where the pre-signature step isn't to apply the hash encoded in the algorithm). In the definition of PSA_ALG_SIGN_GET_HASH, keep the condition for a nonzero output to be PSA_ALG_IS_HASH_AND_SIGN. Everywhere else in the code base (definition of PSA_ALG_IS_SIGN_MESSAGE, and every use of PSA_ALG_IS_HASH_AND_SIGN outside of crypto_values.h), we meant PSA_ALG_IS_SIGN_HASH where we wrote PSA_ALG_IS_HASH_AND_SIGN, so do a global replacement. ``` git grep -l IS_HASH_AND_SIGN ':!include/psa/crypto_values.h' | xargs perl -i -pe 's/ALG_IS_HASH_AND_SIGN/ALG_IS_SIGN_HASH/g' ``` Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-09-22 16:15:05 +02:00
if ( PSA_ALG_IS_SIGN_HASH( alg ) )
Enable algorithms other than hash-then-sign For psa_hash/verify_message other algorithms than hash-then-sign is enabled like PureEdDSA. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-29 16:48:44 +02:00
{
Fix for algorithms other than hash-then-sign Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-03 16:26:20 +02:00
size_t hash_length;
uint8_t hash[PSA_HASH_MAX_SIZE];
Enable algorithms other than hash-then-sign For psa_hash/verify_message other algorithms than hash-then-sign is enabled like PureEdDSA. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-29 16:48:44 +02:00
status = psa_driver_wrapper_hash_compute(
PSA_ALG_SIGN_GET_HASH( alg ),
input, input_length,
hash, sizeof( hash ), &hash_length );
Dispatch sign/verify funtions through the driver interface Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-22 11:32:19 +02:00
Enable algorithms other than hash-then-sign For psa_hash/verify_message other algorithms than hash-then-sign is enabled like PureEdDSA. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-29 16:48:44 +02:00
if( status != PSA_SUCCESS )
return status;
Fix for algorithms other than hash-then-sign Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-03 16:26:20 +02:00
return psa_driver_wrapper_sign_hash(
attributes, key_buffer, key_buffer_size,
alg, hash, hash_length,
signature, signature_size, signature_length );
Enable algorithms other than hash-then-sign For psa_hash/verify_message other algorithms than hash-then-sign is enabled like PureEdDSA. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-29 16:48:44 +02:00
}
Dispatch sign/verify funtions through the driver interface Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-22 11:32:19 +02:00
Use bool variable instead of enum values Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-05 13:56:27 +02:00
return( PSA_ERROR_NOT_SUPPORTED );
Dispatch sign/verify funtions through the driver interface Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-22 11:32:19 +02:00
}
Unify similar functions Use common funtion for psa_sign_hash and psa_sign_message and one for psa_verify_hash and psa_verify_message to unify them. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-20 12:11:35 +02:00
psa_status_t psa_sign_message( mbedtls_svc_key_id_t key,
psa_algorithm_t alg,
const uint8_t * input,
size_t input_length,
uint8_t * signature,
size_t signature_size,
size_t * signature_length )
{
return psa_sign_internal(
Use bool variable instead of enum values Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-05 13:56:27 +02:00
key, 1, alg, input, input_length,
Unify similar functions Use common funtion for psa_sign_hash and psa_sign_message and one for psa_verify_hash and psa_verify_message to unify them. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-20 12:11:35 +02:00
signature, signature_size, signature_length );
}
Rename sign/verify builtin functions called by driver wrapper functions Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-05 14:18:36 +02:00
psa_status_t psa_verify_message_builtin(
Dispatch sign/verify funtions through the driver interface Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-22 11:32:19 +02:00
const psa_key_attributes_t *attributes,
const uint8_t *key_buffer,
size_t key_buffer_size,
psa_algorithm_t alg,
const uint8_t *input,
size_t input_length,
const uint8_t *signature,
size_t signature_length )
{
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Untangle PSA_ALG_IS_HASH_AND_SIGN and PSA_ALG_IS_SIGN_HASH The current definition of PSA_ALG_IS_HASH_AND_SIGN includes PSA_ALG_RSA_PKCS1V15_SIGN_RAW and PSA_ALG_ECDSA_ANY, which don't strictly follow the hash-and-sign paradigm: the algorithm does not encode a hash algorithm that is applied prior to the signature step. The definition in fact encompasses what can be used with psa_sign_hash/psa_verify_hash, so it's the correct definition for PSA_ALG_IS_SIGN_HASH. Therefore this commit moves definition of PSA_ALG_IS_HASH_AND_SIGN to PSA_ALG_IS_SIGN_HASH, and replace the definition of PSA_ALG_IS_HASH_AND_SIGN by a correct one (based on PSA_ALG_IS_SIGN_HASH, excluding the algorithms where the pre-signature step isn't to apply the hash encoded in the algorithm). In the definition of PSA_ALG_SIGN_GET_HASH, keep the condition for a nonzero output to be PSA_ALG_IS_HASH_AND_SIGN. Everywhere else in the code base (definition of PSA_ALG_IS_SIGN_MESSAGE, and every use of PSA_ALG_IS_HASH_AND_SIGN outside of crypto_values.h), we meant PSA_ALG_IS_SIGN_HASH where we wrote PSA_ALG_IS_HASH_AND_SIGN, so do a global replacement. ``` git grep -l IS_HASH_AND_SIGN ':!include/psa/crypto_values.h' | xargs perl -i -pe 's/ALG_IS_HASH_AND_SIGN/ALG_IS_SIGN_HASH/g' ``` Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-09-22 16:15:05 +02:00
if ( PSA_ALG_IS_SIGN_HASH( alg ) )
Enable algorithms other than hash-then-sign For psa_hash/verify_message other algorithms than hash-then-sign is enabled like PureEdDSA. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-29 16:48:44 +02:00
{
Fix for algorithms other than hash-then-sign Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-03 16:26:20 +02:00
size_t hash_length;
uint8_t hash[PSA_HASH_MAX_SIZE];
Enable algorithms other than hash-then-sign For psa_hash/verify_message other algorithms than hash-then-sign is enabled like PureEdDSA. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-29 16:48:44 +02:00
status = psa_driver_wrapper_hash_compute(
PSA_ALG_SIGN_GET_HASH( alg ),
input, input_length,
hash, sizeof( hash ), &hash_length );
Dispatch sign/verify funtions through the driver interface Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-22 11:32:19 +02:00
Enable algorithms other than hash-then-sign For psa_hash/verify_message other algorithms than hash-then-sign is enabled like PureEdDSA. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-29 16:48:44 +02:00
if( status != PSA_SUCCESS )
return status;
Fix for algorithms other than hash-then-sign Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-03 16:26:20 +02:00
return psa_driver_wrapper_verify_hash(
attributes, key_buffer, key_buffer_size,
alg, hash, hash_length,
signature, signature_length );
Enable algorithms other than hash-then-sign For psa_hash/verify_message other algorithms than hash-then-sign is enabled like PureEdDSA. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-29 16:48:44 +02:00
}
Dispatch sign/verify funtions through the driver interface Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-22 11:32:19 +02:00
Return error if algorithm is not hash-then-sign for psa_sign_message Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-05 13:59:01 +02:00
return( PSA_ERROR_NOT_SUPPORTED );
Dispatch sign/verify funtions through the driver interface Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-22 11:32:19 +02:00
}
Unify similar functions Use common funtion for psa_sign_hash and psa_sign_message and one for psa_verify_hash and psa_verify_message to unify them. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-20 12:11:35 +02:00
psa_status_t psa_verify_message( mbedtls_svc_key_id_t key,
psa_algorithm_t alg,
const uint8_t * input,
size_t input_length,
const uint8_t * signature,
size_t signature_length )
{
return psa_verify_internal(
Use bool variable instead of enum values Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-05 13:56:27 +02:00
key, 1, alg, input, input_length,
Unify similar functions Use common funtion for psa_sign_hash and psa_sign_message and one for psa_verify_hash and psa_verify_message to unify them. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-20 12:11:35 +02:00
signature, signature_length );
Implement psa_sign_message and psa_verify_message functions Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-14 21:14:28 +02:00
}
Rename sign/verify builtin functions called by driver wrapper functions Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-05 14:18:36 +02:00
psa_status_t psa_sign_hash_builtin(
psa: sign/verify_hash: Wrap software implementation Wrap sign/verify_hash software implementation into psa_sign/verify_hash_internal() functions whose signature is that of a sign/verify_hash driver entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-12-08 16:32:23 +01:00
const psa_key_attributes_t *attributes,
const uint8_t *key_buffer, size_t key_buffer_size,
psa_algorithm_t alg, const uint8_t *hash, size_t hash_length,
uint8_t *signature, size_t signature_size, size_t *signature_length )
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 22:44:14 +01:00
{
psa: Prepare sign/verify code for software implementation split Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-02-17 10:33:32 +01:00
if( attributes->core.type == PSA_KEY_TYPE_RSA_KEY_PAIR )
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 15:42:46 +02:00
{
psa: sign: Return INVALID_ARGUMENT instead of NOT_SUPPORTED To run succesfully the test "PSA sign: invalid algorithm for ECC key" of test_suite_psa_crypto when ECDSA support is not included in the library, always return INVALID_ARGUMENT in case of an ECC key not used for ECDSA, whether ECDSA support is present or not. Then apply the same logic to RSA sign RSA and RSA/ECC verify for the sake of consistency. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-19 20:09:32 +01:00
if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) ||
PSA_ALG_IS_RSA_PSS( alg) )
{
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
return( mbedtls_psa_rsa_sign_hash(
attributes,
key_buffer, key_buffer_size,
alg, hash, hash_length,
signature, signature_size, signature_length ) );
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 17:50:04 +01:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
psa: sign: Return INVALID_ARGUMENT instead of NOT_SUPPORTED To run succesfully the test "PSA sign: invalid algorithm for ECC key" of test_suite_psa_crypto when ECDSA support is not included in the library, always return INVALID_ARGUMENT in case of an ECC key not used for ECDSA, whether ECDSA support is present or not. Then apply the same logic to RSA sign RSA and RSA/ECC verify for the sake of consistency. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-19 20:09:32 +01:00
}
else
{
return( PSA_ERROR_INVALID_ARGUMENT );
}
}
tests: psa driver: Align RSA/ECP sign/verify hash dispatch Align RSA/ECP sign/verify hash dispatch with the corresponding code of the library. The library code was modified recently but not the test code one and these modifications ease the following work. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-04-09 15:32:03 +02:00
else if( PSA_KEY_TYPE_IS_ECC( attributes->core.type ) )
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 16:10:23 +02:00
{
psa: ecdsa: Rework deterministic support check Move the check that ECDSA is supported from the caller of the function responsible for Mbed TLS ECDSA signatures to this function, namely mbedtls_psa_ecdsa_sign_hash(). This makes the caller code more readable and is more aligned with what is expected from a sign_hash() PSA driver entry point. Add a negative test case where a deterministic ECDSA signature is requested while the library does not support deterministic ECDSA. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-04 11:26:03 +01:00
if( PSA_ALG_IS_ECDSA( alg ) )
Remove ECP internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 23:09:52 +02:00
{
psa: sign: Return INVALID_ARGUMENT instead of NOT_SUPPORTED To run succesfully the test "PSA sign: invalid algorithm for ECC key" of test_suite_psa_crypto when ECDSA support is not included in the library, always return INVALID_ARGUMENT in case of an ECC key not used for ECDSA, whether ECDSA support is present or not. Then apply the same logic to RSA sign RSA and RSA/ECC verify for the sake of consistency. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-19 20:09:32 +01:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
psa: Move ECDSA sign/verify to PSA ECP specific file Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-12-09 16:36:19 +01:00
return( mbedtls_psa_ecdsa_sign_hash(
attributes,
key_buffer, key_buffer_size,
alg, hash, hash_length,
signature, signature_size, signature_length ) );
psa: sign: Return INVALID_ARGUMENT instead of NOT_SUPPORTED To run succesfully the test "PSA sign: invalid algorithm for ECC key" of test_suite_psa_crypto when ECDSA support is not included in the library, always return INVALID_ARGUMENT in case of an ECC key not used for ECDSA, whether ECDSA support is present or not. Then apply the same logic to RSA sign RSA and RSA/ECC verify for the sake of consistency. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-19 20:09:32 +01:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
* defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
Remove ECP internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 23:09:52 +02:00
}
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 16:10:23 +02:00
else
{
psa: Post move adjustments to psa_sign/verify_hash_internal Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-02-17 09:49:51 +01:00
return( PSA_ERROR_INVALID_ARGUMENT );
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 16:10:23 +02:00
}
}
Change ECDSA signature representation to r||s Change the representation of an ECDSA signature from the ASN.1 DER encoding used in TLS and X.509, to the concatenation of r and s in big-endian order with a fixed size. A fixed size helps memory and buffer management and this representation is generally easier to use for anything that doesn't require the ASN.1 representation. This is the same representation as PKCS#11 (Cryptoki) except that PKCS#11 allows r and s to be truncated (both to the same length), which complicates the implementation and negates the advantage of a fixed-size representation.
2018-06-28 13:56:01 +02:00
psa: sign: Return INVALID_ARGUMENT instead of NOT_SUPPORTED To run succesfully the test "PSA sign: invalid algorithm for ECC key" of test_suite_psa_crypto when ECDSA support is not included in the library, always return INVALID_ARGUMENT in case of an ECC key not used for ECDSA, whether ECDSA support is present or not. Then apply the same logic to RSA sign RSA and RSA/ECC verify for the sake of consistency. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-19 20:09:32 +01:00
(void)key_buffer;
(void)key_buffer_size;
(void)hash;
(void)hash_length;
(void)signature;
(void)signature_size;
(void)signature_length;
return( PSA_ERROR_NOT_SUPPORTED );
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 16:10:23 +02:00
}
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 09:51:30 +02:00
psa_status_t psa_sign_hash( mbedtls_svc_key_id_t key,
Rename some signature-related identifiers Rename some macros and functions related to signature which are changing as part of the addition of psa_sign_message and psa_verify_message. perl -i -pe '%t = ( PSA_KEY_USAGE_SIGN => PSA_KEY_USAGE_SIGN_HASH, PSA_KEY_USAGE_VERIFY => PSA_KEY_USAGE_VERIFY_HASH, PSA_ASYMMETRIC_SIGNATURE_MAX_SIZE => PSA_SIGNATURE_MAX_SIZE, PSA_ASYMMETRIC_SIGN_OUTPUT_SIZE => PSA_SIGN_OUTPUT_SIZE, psa_asymmetric_sign => psa_sign_hash, psa_asymmetric_verify => psa_verify_hash, ); s/\b(@{[join("|", keys %t)]})\b/$t{$1}/ge' $(git ls-files . ':!:**/crypto_compat.h')
2019-11-26 17:01:59 +01:00
psa_algorithm_t alg,
const uint8_t *hash,
size_t hash_length,
uint8_t *signature,
size_t signature_size,
size_t *signature_length )
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 22:44:14 +01:00
{
Unify similar functions Use common funtion for psa_sign_hash and psa_sign_message and one for psa_verify_hash and psa_verify_message to unify them. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-20 12:11:35 +02:00
return psa_sign_internal(
Use bool variable instead of enum values Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-05 13:56:27 +02:00
key, 0, alg, hash, hash_length,
psa: Change psa_driver_wrapper_sign/verify_hash signature Change psa_driver_wrapper_sign/verify_hash signature to that of a sign/verify_hash driver entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-12-08 17:07:25 +01:00
signature, signature_size, signature_length );
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 10:18:38 +02:00
}
Rename sign/verify builtin functions called by driver wrapper functions Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-05 14:18:36 +02:00
psa_status_t psa_verify_hash_builtin(
psa: sign/verify_hash: Wrap software implementation Wrap sign/verify_hash software implementation into psa_sign/verify_hash_internal() functions whose signature is that of a sign/verify_hash driver entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-12-08 16:32:23 +01:00
const psa_key_attributes_t *attributes,
const uint8_t *key_buffer, size_t key_buffer_size,
psa_algorithm_t alg, const uint8_t *hash, size_t hash_length,
const uint8_t *signature, size_t signature_length )
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 10:18:38 +02:00
{
psa: Prepare sign/verify code for software implementation split Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-02-17 10:33:32 +01:00
if( PSA_KEY_TYPE_IS_RSA( attributes->core.type ) )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 22:16:26 +02:00
{
psa: sign: Return INVALID_ARGUMENT instead of NOT_SUPPORTED To run succesfully the test "PSA sign: invalid algorithm for ECC key" of test_suite_psa_crypto when ECDSA support is not included in the library, always return INVALID_ARGUMENT in case of an ECC key not used for ECDSA, whether ECDSA support is present or not. Then apply the same logic to RSA sign RSA and RSA/ECC verify for the sake of consistency. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-19 20:09:32 +01:00
if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) ||
PSA_ALG_IS_RSA_PSS( alg) )
{
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
return( mbedtls_psa_rsa_verify_hash(
attributes,
key_buffer, key_buffer_size,
alg, hash, hash_length,
signature, signature_length ) );
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 17:50:04 +01:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
psa: sign: Return INVALID_ARGUMENT instead of NOT_SUPPORTED To run succesfully the test "PSA sign: invalid algorithm for ECC key" of test_suite_psa_crypto when ECDSA support is not included in the library, always return INVALID_ARGUMENT in case of an ECC key not used for ECDSA, whether ECDSA support is present or not. Then apply the same logic to RSA sign RSA and RSA/ECC verify for the sake of consistency. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-19 20:09:32 +01:00
}
else
{
return( PSA_ERROR_INVALID_ARGUMENT );
}
}
tests: psa driver: Align RSA/ECP sign/verify hash dispatch Align RSA/ECP sign/verify hash dispatch with the corresponding code of the library. The library code was modified recently but not the test code one and these modifications ease the following work. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-04-09 15:32:03 +02:00
else if( PSA_KEY_TYPE_IS_ECC( attributes->core.type ) )
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 10:18:38 +02:00
{
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 16:10:23 +02:00
if( PSA_ALG_IS_ECDSA( alg ) )
Remove ECP internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 23:09:52 +02:00
{
psa: sign: Return INVALID_ARGUMENT instead of NOT_SUPPORTED To run succesfully the test "PSA sign: invalid algorithm for ECC key" of test_suite_psa_crypto when ECDSA support is not included in the library, always return INVALID_ARGUMENT in case of an ECC key not used for ECDSA, whether ECDSA support is present or not. Then apply the same logic to RSA sign RSA and RSA/ECC verify for the sake of consistency. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-19 20:09:32 +01:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
psa: Move ECDSA sign/verify to PSA ECP specific file Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-12-09 16:36:19 +01:00
return( mbedtls_psa_ecdsa_verify_hash(
attributes,
key_buffer, key_buffer_size,
alg, hash, hash_length,
signature, signature_length ) );
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 21:28:15 +01:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
* defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
psa: sign: Return INVALID_ARGUMENT instead of NOT_SUPPORTED To run succesfully the test "PSA sign: invalid algorithm for ECC key" of test_suite_psa_crypto when ECDSA support is not included in the library, always return INVALID_ARGUMENT in case of an ECC key not used for ECDSA, whether ECDSA support is present or not. Then apply the same logic to RSA sign RSA and RSA/ECC verify for the sake of consistency. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-19 20:09:32 +01:00
}
else
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 16:10:23 +02:00
{
psa: Post move adjustments to psa_sign/verify_hash_internal Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-02-17 09:49:51 +01:00
return( PSA_ERROR_INVALID_ARGUMENT );
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 16:10:23 +02:00
}
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 10:18:38 +02:00
}
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa: sign: Return INVALID_ARGUMENT instead of NOT_SUPPORTED To run succesfully the test "PSA sign: invalid algorithm for ECC key" of test_suite_psa_crypto when ECDSA support is not included in the library, always return INVALID_ARGUMENT in case of an ECC key not used for ECDSA, whether ECDSA support is present or not. Then apply the same logic to RSA sign RSA and RSA/ECC verify for the sake of consistency. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-19 20:09:32 +01:00
(void)key_buffer;
(void)key_buffer_size;
(void)hash;
(void)hash_length;
(void)signature;
(void)signature_length;
return( PSA_ERROR_NOT_SUPPORTED );
psa: sign/verify_hash: Wrap software implementation Wrap sign/verify_hash software implementation into psa_sign/verify_hash_internal() functions whose signature is that of a sign/verify_hash driver entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-12-08 16:32:23 +01:00
}
psa_status_t psa_verify_hash( mbedtls_svc_key_id_t key,
psa_algorithm_t alg,
const uint8_t *hash,
size_t hash_length,
const uint8_t *signature,
size_t signature_length )
{
Unify similar functions Use common funtion for psa_sign_hash and psa_sign_message and one for psa_verify_hash and psa_verify_message to unify them. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-04-20 12:11:35 +02:00
return psa_verify_internal(
Use bool variable instead of enum values Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-05-05 13:56:27 +02:00
key, 0, alg, hash, hash_length,
psa: Change psa_driver_wrapper_sign/verify_hash signature Change psa_driver_wrapper_sign/verify_hash signature to that of a sign/verify_hash driver entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-12-08 17:07:25 +01:00
signature, signature_length );
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 22:44:14 +01:00
}
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 09:51:30 +02:00
psa_status_t psa_asymmetric_encrypt( mbedtls_svc_key_id_t key,
Normalize whitespace to Mbed TLS standards Only whitespace changes in this commit.
2018-06-08 16:09:36 +02:00
psa_algorithm_t alg,
const uint8_t *input,
size_t input_length,
const uint8_t *salt,
size_t salt_length,
uint8_t *output,
size_t output_size,
size_t *output_length )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 22:16:26 +02:00
{
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *slot;
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
Add handling for (sometimes) unused parameters
2018-07-24 16:34:10 +02:00
(void) input;
(void) input_length;
(void) salt;
(void) output;
(void) output_size;
Set output length to safe value
2018-06-04 15:43:12 +02:00
*output_length = 0;
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 22:16:26 +02:00
psa_asymmetric_{encrypt,decrypt}: reject salt when not allowed In psa_asymmetric_encrypt and psa_asymmetric_decrypt, if the algorithm does not use a salt, require the salt to be empty.
2018-06-30 19:04:35 +02:00
if( ! PSA_ALG_IS_RSA_OAEP( alg ) && salt_length != 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
status = psa_get_and_lock_transparent_key_slot_with_policy(
key, &slot, PSA_KEY_USAGE_ENCRYPT, alg );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
if( status != PSA_SUCCESS )
return( status );
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 20:06:31 +02:00
if( ! ( PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->attr.type ) ||
PSA_KEY_TYPE_IS_KEY_PAIR( slot->attr.type ) ) )
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
{
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
}
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 22:16:26 +02:00
psa_asymmetric_encrypt: access the key store and call driver dispatch Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-12-09 11:09:11 +01:00
psa_key_attributes_t attributes = {
.core = slot->attr
};
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa_asymmetric_encrypt: access the key store and call driver dispatch Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-12-09 11:09:11 +01:00
status = psa_driver_wrapper_asymmetric_encrypt(
&attributes, slot->key.data, slot->key.bytes,
alg, input, input_length, salt, salt_length,
output, output_size, output_length );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
exit:
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
unlock_status = psa_unlock_key_slot( slot );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Remove trailing whitespace Only horizontal whitespace changes in this commit.
2018-05-31 13:25:48 +02:00
}
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 09:51:30 +02:00
psa_status_t psa_asymmetric_decrypt( mbedtls_svc_key_id_t key,
Normalize whitespace to Mbed TLS standards Only whitespace changes in this commit.
2018-06-08 16:09:36 +02:00
psa_algorithm_t alg,
const uint8_t *input,
size_t input_length,
const uint8_t *salt,
size_t salt_length,
uint8_t *output,
size_t output_size,
size_t *output_length )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 22:16:26 +02:00
{
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *slot;
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
Add handling for (sometimes) unused parameters
2018-07-24 16:34:10 +02:00
(void) input;
(void) input_length;
(void) salt;
(void) output;
(void) output_size;
Set output length to safe value
2018-06-04 15:43:12 +02:00
*output_length = 0;
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 22:16:26 +02:00
psa_asymmetric_{encrypt,decrypt}: reject salt when not allowed In psa_asymmetric_encrypt and psa_asymmetric_decrypt, if the algorithm does not use a salt, require the salt to be empty.
2018-06-30 19:04:35 +02:00
if( ! PSA_ALG_IS_RSA_OAEP( alg ) && salt_length != 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
status = psa_get_and_lock_transparent_key_slot_with_policy(
key, &slot, PSA_KEY_USAGE_DECRYPT, alg );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
if( status != PSA_SUCCESS )
return( status );
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 20:06:31 +02:00
if( ! PSA_KEY_TYPE_IS_KEY_PAIR( slot->attr.type ) )
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
{
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
}
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 22:16:26 +02:00
psa_asymmetric_decrypt: access the key store and call driver dispatch Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-12-13 08:58:19 +01:00
psa_key_attributes_t attributes = {
.core = slot->attr
};
Remove duplicate / unneeded code 1. remove duplicate function introduced by re-base 2. remove unneeded code
2018-06-04 15:36:15 +02:00
psa_asymmetric_decrypt: access the key store and call driver dispatch Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-12-13 08:58:19 +01:00
status = psa_driver_wrapper_asymmetric_decrypt(
&attributes, slot->key.data, slot->key.bytes,
alg, input, input_length, salt, salt_length,
output, output_size, output_length );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
exit:
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
unlock_status = psa_unlock_key_slot( slot );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Remove trailing whitespace Only horizontal whitespace changes in this commit.
2018-05-31 13:25:48 +02:00
}
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 22:44:14 +01:00
Be more consistent about blank lines
2018-06-18 21:49:39 +02:00
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
/****************************************************************/
/* Symmetric cryptography */
/****************************************************************/
psa: Rework psa_cipher_setup (2) Split out the cipher setup based on cipher.c in psa_cipher_setup_internal() whose signature is that of a PSA driver cipher_setup entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-01 16:38:28 +02:00
static psa_status_t psa_cipher_setup( psa_cipher_operation_t *operation,
mbedtls_svc_key_id_t key,
psa_algorithm_t alg,
mbedtls_operation_t cipher_operation )
{
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Call abort on error in psa_mac/cipher setup Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 12:49:45 +02:00
psa_key_slot_t *slot = NULL;
psa: Rework psa_cipher_setup (2) Split out the cipher setup based on cipher.c in psa_cipher_setup_internal() whose signature is that of a PSA driver cipher_setup entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-01 16:38:28 +02:00
psa_key_usage_t usage = ( cipher_operation == MBEDTLS_ENCRYPT ?
PSA_KEY_USAGE_ENCRYPT :
PSA_KEY_USAGE_DECRYPT );
/* A context must be freshly initialized before it can be set up. */
psa: cipher: Dispatch based on driver identifier For cipher multi-part operations, dispatch based on the driver identifier even in the case of the Mbed TLS software implementation (viewed as a driver). Also use the driver identifier to check that an cipher operation context is active or not. This aligns the way hash and cipher multi-part operations are dispatched. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-10 08:34:23 +01:00
if( operation->id != 0 )
Correct coding style issues Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 17:17:43 +02:00
{
Call abort on error in psa_mac/cipher setup Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 12:49:45 +02:00
status = PSA_ERROR_BAD_STATE;
goto exit;
}
psa: Rework psa_cipher_setup (2) Split out the cipher setup based on cipher.c in psa_cipher_setup_internal() whose signature is that of a PSA driver cipher_setup entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-01 16:38:28 +02:00
if( ! PSA_ALG_IS_CIPHER( alg ) )
Correct coding style issues Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 17:17:43 +02:00
{
Call abort on error in psa_mac/cipher setup Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 12:49:45 +02:00
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
}
psa: Rework psa_cipher_setup (2) Split out the cipher setup based on cipher.c in psa_cipher_setup_internal() whose signature is that of a PSA driver cipher_setup entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-01 16:38:28 +02:00
status = psa_get_and_lock_key_slot_with_policy( key, &slot, usage, alg );
if( status != PSA_SUCCESS )
goto exit;
psa: cipher: Dispatch based on driver identifier For cipher multi-part operations, dispatch based on the driver identifier even in the case of the Mbed TLS software implementation (viewed as a driver). Also use the driver identifier to check that an cipher operation context is active or not. This aligns the way hash and cipher multi-part operations are dispatched. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-10 08:34:23 +01:00
/* Initialize the operation struct members, except for id. The id member
psa: Rework psa_cipher_setup (2) Split out the cipher setup based on cipher.c in psa_cipher_setup_internal() whose signature is that of a PSA driver cipher_setup entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-01 16:38:28 +02:00
* is used to indicate to psa_cipher_abort that there are resources to free,
psa: cipher: Dispatch based on driver identifier For cipher multi-part operations, dispatch based on the driver identifier even in the case of the Mbed TLS software implementation (viewed as a driver). Also use the driver identifier to check that an cipher operation context is active or not. This aligns the way hash and cipher multi-part operations are dispatched. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-10 08:34:23 +01:00
* so we only set it (in the driver wrapper) after resources have been
* allocated/initialized. */
psa: Rework psa_cipher_setup (2) Split out the cipher setup based on cipher.c in psa_cipher_setup_internal() whose signature is that of a PSA driver cipher_setup entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-01 16:38:28 +02:00
operation->iv_set = 0;
if( alg == PSA_ALG_ECB_NO_PADDING )
operation->iv_required = 0;
else
operation->iv_required = 1;
psa: cipher: Remove cipher_generate_iv driver entry point Remove cipher_generate_iv driver entry point as there is no known use case to delegate this to a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-26 09:52:26 +01:00
operation->default_iv_length = PSA_CIPHER_IV_LENGTH( slot->attr.type, alg );
psa: Rework psa_cipher_setup (2) Split out the cipher setup based on cipher.c in psa_cipher_setup_internal() whose signature is that of a PSA driver cipher_setup entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-01 16:38:28 +02:00
psa: driver wrapper: Change cipher_*_setup signatures Change the signature of psa_driver_wrapper_cipher_encrypt/decrypt_setup to that of a PSA driver cipher_encrypt/decrypt_setup entry point. Change the operation context to the PSA one to be able to call the software implementation from the driver wrapper later on. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-12-14 14:36:06 +01:00
psa_key_attributes_t attributes = {
.core = slot->attr
};
psa: Rework psa_cipher_setup (2) Split out the cipher setup based on cipher.c in psa_cipher_setup_internal() whose signature is that of a PSA driver cipher_setup entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-01 16:38:28 +02:00
/* Try doing the operation through a driver before using software fallback. */
if( cipher_operation == MBEDTLS_ENCRYPT )
psa: driver wrapper: Change cipher_*_setup signatures Change the signature of psa_driver_wrapper_cipher_encrypt/decrypt_setup to that of a PSA driver cipher_encrypt/decrypt_setup entry point. Change the operation context to the PSA one to be able to call the software implementation from the driver wrapper later on. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-12-14 14:36:06 +01:00
status = psa_driver_wrapper_cipher_encrypt_setup( operation,
&attributes,
slot->key.data,
slot->key.bytes,
psa: Rework psa_cipher_setup (2) Split out the cipher setup based on cipher.c in psa_cipher_setup_internal() whose signature is that of a PSA driver cipher_setup entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-01 16:38:28 +02:00
alg );
else
psa: driver wrapper: Change cipher_*_setup signatures Change the signature of psa_driver_wrapper_cipher_encrypt/decrypt_setup to that of a PSA driver cipher_encrypt/decrypt_setup entry point. Change the operation context to the PSA one to be able to call the software implementation from the driver wrapper later on. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-12-14 14:36:06 +01:00
status = psa_driver_wrapper_cipher_decrypt_setup( operation,
&attributes,
slot->key.data,
slot->key.bytes,
psa: Rework psa_cipher_setup (2) Split out the cipher setup based on cipher.c in psa_cipher_setup_internal() whose signature is that of a PSA driver cipher_setup entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-01 16:38:28 +02:00
alg );
Fix cleanup in psa_cipher_setup In some error cases, psa_cipher_setup was leaving a partly-initialized operation context.
2019-02-25 17:43:14 +01:00
exit:
psa: cipher: Remove unused `key_set` operation field Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-09 17:32:57 +01:00
if( status != PSA_SUCCESS )
Fix cleanup in psa_cipher_setup In some error cases, psa_cipher_setup was leaving a partly-initialized operation context.
2019-02-25 17:43:14 +01:00
psa_cipher_abort( operation );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
unlock_status = psa_unlock_key_slot( slot );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
return( ( status == PSA_SUCCESS ) ? unlock_status : status );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
}
Rename psa cipher functions to psa_cipher_xxx Make function names for multipart operations more consistent (cipher edition). Rename symmetric cipher multipart operation functions so that they all start with psa_cipher_: * psa_encrypt_setup -> psa_cipher_encrypt_setup * psa_decrypt_setup -> psa_cipher_decrypt_setup * psa_encrypt_set_iv -> psa_cipher_set_iv * psa_encrypt_generate_iv -> psa_cipher_generate_iv
2018-07-08 21:39:34 +02:00
psa_status_t psa_cipher_encrypt_setup( psa_cipher_operation_t *operation,
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 09:51:30 +02:00
mbedtls_svc_key_id_t key,
Rename psa cipher functions to psa_cipher_xxx Make function names for multipart operations more consistent (cipher edition). Rename symmetric cipher multipart operation functions so that they all start with psa_cipher_: * psa_encrypt_setup -> psa_cipher_encrypt_setup * psa_decrypt_setup -> psa_cipher_decrypt_setup * psa_encrypt_set_iv -> psa_cipher_set_iv * psa_encrypt_generate_iv -> psa_cipher_generate_iv
2018-07-08 21:39:34 +02:00
psa_algorithm_t alg )
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 12:57:31 +01:00
{
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 09:51:30 +02:00
return( psa_cipher_setup( operation, key, alg, MBEDTLS_ENCRYPT ) );
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 12:57:31 +01:00
}
Rename psa cipher functions to psa_cipher_xxx Make function names for multipart operations more consistent (cipher edition). Rename symmetric cipher multipart operation functions so that they all start with psa_cipher_: * psa_encrypt_setup -> psa_cipher_encrypt_setup * psa_decrypt_setup -> psa_cipher_decrypt_setup * psa_encrypt_set_iv -> psa_cipher_set_iv * psa_encrypt_generate_iv -> psa_cipher_generate_iv
2018-07-08 21:39:34 +02:00
psa_status_t psa_cipher_decrypt_setup( psa_cipher_operation_t *operation,
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 09:51:30 +02:00
mbedtls_svc_key_id_t key,
Rename psa cipher functions to psa_cipher_xxx Make function names for multipart operations more consistent (cipher edition). Rename symmetric cipher multipart operation functions so that they all start with psa_cipher_: * psa_encrypt_setup -> psa_cipher_encrypt_setup * psa_decrypt_setup -> psa_cipher_decrypt_setup * psa_encrypt_set_iv -> psa_cipher_set_iv * psa_encrypt_generate_iv -> psa_cipher_generate_iv
2018-07-08 21:39:34 +02:00
psa_algorithm_t alg )
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 12:57:31 +01:00
{
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 09:51:30 +02:00
return( psa_cipher_setup( operation, key, alg, MBEDTLS_DECRYPT ) );
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 12:57:31 +01:00
}
Rename psa cipher functions to psa_cipher_xxx Make function names for multipart operations more consistent (cipher edition). Rename symmetric cipher multipart operation functions so that they all start with psa_cipher_: * psa_encrypt_setup -> psa_cipher_encrypt_setup * psa_decrypt_setup -> psa_cipher_decrypt_setup * psa_encrypt_set_iv -> psa_cipher_set_iv * psa_encrypt_generate_iv -> psa_cipher_generate_iv
2018-07-08 21:39:34 +02:00
psa_status_t psa_cipher_generate_iv( psa_cipher_operation_t *operation,
Apply same changes to implementation source code
2019-05-15 13:33:23 +02:00
uint8_t *iv,
Rename psa cipher functions to psa_cipher_xxx Make function names for multipart operations more consistent (cipher edition). Rename symmetric cipher multipart operation functions so that they all start with psa_cipher_: * psa_encrypt_setup -> psa_cipher_encrypt_setup * psa_decrypt_setup -> psa_cipher_decrypt_setup * psa_encrypt_set_iv -> psa_cipher_set_iv * psa_encrypt_generate_iv -> psa_cipher_generate_iv
2018-07-08 21:39:34 +02:00
size_t iv_size,
size_t *iv_length )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
{
psa: Add mbedtls_psa_cipher_xyz() APIs Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-01 14:10:20 +02:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa: cipher: Fix invalid output buffer usage in psa_cipher_generate_iv() Don't use the output buffer in psa_cipher_generate_iv() to pass the generated IV to the driver as local attacker could potentially control it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-07-05 12:31:44 +02:00
uint8_t local_iv[PSA_CIPHER_IV_MAX_SIZE];
size_t default_iv_length;
psa: cipher: Remove cipher_generate_iv driver entry point Remove cipher_generate_iv driver entry point as there is no known use case to delegate this to a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-26 09:52:26 +01:00
psa: cipher: Dispatch based on driver identifier For cipher multi-part operations, dispatch based on the driver identifier even in the case of the Mbed TLS software implementation (viewed as a driver). Also use the driver identifier to check that an cipher operation context is active or not. This aligns the way hash and cipher multi-part operations are dispatched. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-10 08:34:23 +01:00
if( operation->id == 0 )
Fix PSA SE driver tests Fix PSA SE driver tests in configuration full + MBEDTLS_PSA_CRYPTO_DRIVERS. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-09-29 16:18:05 +02:00
{
Update cipher and mac functions to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-23 12:38:39 +02:00
status = PSA_ERROR_BAD_STATE;
goto exit;
Fix PSA SE driver tests Fix PSA SE driver tests in configuration full + MBEDTLS_PSA_CRYPTO_DRIVERS. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-09-29 16:18:05 +02:00
}
Check & set operation flags for both driver and software in the core Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-09 15:28:49 +02:00
if( operation->iv_set || ! operation->iv_required )
{
Update cipher and mac functions to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-23 12:38:39 +02:00
status = PSA_ERROR_BAD_STATE;
goto exit;
Check & set operation flags for both driver and software in the core Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-09 15:28:49 +02:00
}
Restructure cipher context object to contain driver switch Once an operation has been 'accepted' by a driver, the remainder is bound to the same driver, since driver-specific context structs cannot be shared. This provides a pretty good gate mechanism for the fallback logic, too. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-01 15:56:14 +02:00
psa: cipher: Fix invalid output buffer usage in psa_cipher_generate_iv() Don't use the output buffer in psa_cipher_generate_iv() to pass the generated IV to the driver as local attacker could potentially control it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-07-05 12:31:44 +02:00
default_iv_length = operation->default_iv_length;
if( iv_size < default_iv_length )
psa: cipher: Remove cipher_generate_iv driver entry point Remove cipher_generate_iv driver entry point as there is no known use case to delegate this to a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-26 09:52:26 +01:00
{
status = PSA_ERROR_BUFFER_TOO_SMALL;
goto exit;
}
psa: cipher: Fix invalid output buffer usage in psa_cipher_generate_iv() Don't use the output buffer in psa_cipher_generate_iv() to pass the generated IV to the driver as local attacker could potentially control it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-07-05 12:31:44 +02:00
if( default_iv_length > PSA_CIPHER_IV_MAX_SIZE )
{
status = PSA_ERROR_GENERIC_ERROR;
goto exit;
}
status = psa_generate_random( local_iv, default_iv_length );
psa: cipher: Remove cipher_generate_iv driver entry point Remove cipher_generate_iv driver entry point as there is no known use case to delegate this to a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-26 09:52:26 +01:00
if( status != PSA_SUCCESS )
goto exit;
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 16:22:46 +02:00
psa: cipher: Remove cipher_generate_iv driver entry point Remove cipher_generate_iv driver entry point as there is no known use case to delegate this to a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-26 09:52:26 +01:00
status = psa_driver_wrapper_cipher_set_iv( operation,
psa: cipher: Fix invalid output buffer usage in psa_cipher_generate_iv() Don't use the output buffer in psa_cipher_generate_iv() to pass the generated IV to the driver as local attacker could potentially control it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-07-05 12:31:44 +02:00
local_iv, default_iv_length );
psa: cipher: Remove cipher_generate_iv driver entry point Remove cipher_generate_iv driver entry point as there is no known use case to delegate this to a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-26 09:52:26 +01:00
exit:
Check & set operation flags for both driver and software in the core Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-09 15:28:49 +02:00
if( status == PSA_SUCCESS )
psa: cipher: Remove cipher_generate_iv driver entry point Remove cipher_generate_iv driver entry point as there is no known use case to delegate this to a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-26 09:52:26 +01:00
{
psa: cipher: Fix invalid output buffer usage in psa_cipher_generate_iv() Don't use the output buffer in psa_cipher_generate_iv() to pass the generated IV to the driver as local attacker could potentially control it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-07-05 12:31:44 +02:00
memcpy( iv, local_iv, default_iv_length );
*iv_length = default_iv_length;
Check & set operation flags for both driver and software in the core Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-09 15:28:49 +02:00
operation->iv_set = 1;
psa: cipher: Remove cipher_generate_iv driver entry point Remove cipher_generate_iv driver entry point as there is no known use case to delegate this to a driver. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-26 09:52:26 +01:00
}
Check & set operation flags for both driver and software in the core Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-09 15:28:49 +02:00
else
psa: cipher: Fix invalid output buffer usage in psa_cipher_generate_iv() Don't use the output buffer in psa_cipher_generate_iv() to pass the generated IV to the driver as local attacker could potentially control it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-07-05 12:31:44 +02:00
{
*iv_length = 0;
adjust indentation per Mbed TLS standards
2018-05-31 13:07:14 +02:00
psa_cipher_abort( operation );
psa: cipher: Fix invalid output buffer usage in psa_cipher_generate_iv() Don't use the output buffer in psa_cipher_generate_iv() to pass the generated IV to the driver as local attacker could potentially control it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-07-05 12:31:44 +02:00
}
psa: Add mbedtls_psa_cipher_xyz() APIs Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-01 14:10:20 +02:00
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 12:56:32 +02:00
return( status );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
}
Rename psa cipher functions to psa_cipher_xxx Make function names for multipart operations more consistent (cipher edition). Rename symmetric cipher multipart operation functions so that they all start with psa_cipher_: * psa_encrypt_setup -> psa_cipher_encrypt_setup * psa_decrypt_setup -> psa_cipher_decrypt_setup * psa_encrypt_set_iv -> psa_cipher_set_iv * psa_encrypt_generate_iv -> psa_cipher_generate_iv
2018-07-08 21:39:34 +02:00
psa_status_t psa_cipher_set_iv( psa_cipher_operation_t *operation,
Apply same changes to implementation source code
2019-05-15 13:33:23 +02:00
const uint8_t *iv,
Rename psa cipher functions to psa_cipher_xxx Make function names for multipart operations more consistent (cipher edition). Rename symmetric cipher multipart operation functions so that they all start with psa_cipher_: * psa_encrypt_setup -> psa_cipher_encrypt_setup * psa_decrypt_setup -> psa_cipher_decrypt_setup * psa_encrypt_set_iv -> psa_cipher_set_iv * psa_encrypt_generate_iv -> psa_cipher_generate_iv
2018-07-08 21:39:34 +02:00
size_t iv_length )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
{
psa: Add mbedtls_psa_cipher_xyz() APIs Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-01 14:10:20 +02:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Fix PSA SE driver tests Fix PSA SE driver tests in configuration full + MBEDTLS_PSA_CRYPTO_DRIVERS. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-09-29 16:18:05 +02:00
psa: cipher: Dispatch based on driver identifier For cipher multi-part operations, dispatch based on the driver identifier even in the case of the Mbed TLS software implementation (viewed as a driver). Also use the driver identifier to check that an cipher operation context is active or not. This aligns the way hash and cipher multi-part operations are dispatched. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-10 08:34:23 +01:00
if( operation->id == 0 )
Correct coding style issues Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 17:17:43 +02:00
{
Update cipher and mac functions to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-23 12:38:39 +02:00
status = PSA_ERROR_BAD_STATE;
goto exit;
}
Fix PSA SE driver tests Fix PSA SE driver tests in configuration full + MBEDTLS_PSA_CRYPTO_DRIVERS. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-09-29 16:18:05 +02:00
Check & set operation flags for both driver and software in the core Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-09 15:28:49 +02:00
if( operation->iv_set || ! operation->iv_required )
Correct coding style issues Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 17:17:43 +02:00
{
Update cipher and mac functions to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-23 12:38:39 +02:00
status = PSA_ERROR_BAD_STATE;
goto exit;
}
psa: cipher: Add bound check of the IV length in the core Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-26 10:15:08 +01:00
if( iv_length > PSA_CIPHER_IV_MAX_SIZE )
Correct coding style issues Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-24 17:17:43 +02:00
{
Update cipher and mac functions to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-23 12:38:39 +02:00
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
}
Restructure cipher context object to contain driver switch Once an operation has been 'accepted' by a driver, the remainder is bound to the same driver, since driver-specific context structs cannot be shared. This provides a pretty good gate mechanism for the fallback logic, too. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-01 15:56:14 +02:00
psa: Call cipher operations software implementations as a driver Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-12-15 14:10:01 +01:00
status = psa_driver_wrapper_cipher_set_iv( operation,
iv,
iv_length );
psa: Add mbedtls_psa_cipher_xyz() APIs Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-01 14:10:20 +02:00
Update cipher and mac functions to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-23 12:38:39 +02:00
exit:
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 12:56:32 +02:00
if( status == PSA_SUCCESS )
operation->iv_set = 1;
else
psa_cipher_abort( operation );
return( status );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
}
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 16:22:46 +02:00
psa_status_t psa_cipher_update( psa_cipher_operation_t *operation,
const uint8_t *input,
size_t input_length,
Apply same changes to implementation source code
2019-05-15 13:33:23 +02:00
uint8_t *output,
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 16:22:46 +02:00
size_t output_size,
size_t *output_length )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
{
Implement support for multipart ECB and add tests Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-25 15:13:13 +02:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa: Add mbedtls_psa_cipher_xyz() APIs Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-01 14:10:20 +02:00
psa: cipher: Dispatch based on driver identifier For cipher multi-part operations, dispatch based on the driver identifier even in the case of the Mbed TLS software implementation (viewed as a driver). Also use the driver identifier to check that an cipher operation context is active or not. This aligns the way hash and cipher multi-part operations are dispatched. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-10 08:34:23 +01:00
if( operation->id == 0 )
Check & set operation flags for both driver and software in the core Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-09 15:28:49 +02:00
{
Update cipher and mac functions to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-23 12:38:39 +02:00
status = PSA_ERROR_BAD_STATE;
goto exit;
Check & set operation flags for both driver and software in the core Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-09 15:28:49 +02:00
}
Update cipher and mac functions to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-23 12:38:39 +02:00
Check & set operation flags for both driver and software in the core Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-09 15:28:49 +02:00
if( operation->iv_required && ! operation->iv_set )
{
Update cipher and mac functions to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-23 12:38:39 +02:00
status = PSA_ERROR_BAD_STATE;
goto exit;
Check & set operation flags for both driver and software in the core Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-09 15:28:49 +02:00
}
psa: Disallow use of invalid cipher contexts Ensure that when doing cipher operations out of order, PSA_ERROR_BAD_STATE is returned as documented in crypto.h and the PSA Crypto specification.
2019-02-15 15:12:05 +01:00
psa: Call cipher operations software implementations as a driver Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-12-15 14:10:01 +01:00
status = psa_driver_wrapper_cipher_update( operation,
input,
input_length,
output,
output_size,
output_length );
Update cipher and mac functions to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-23 12:38:39 +02:00
exit:
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 12:56:32 +02:00
if( status != PSA_SUCCESS )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
psa_cipher_abort( operation );
psa: Add mbedtls_psa_cipher_xyz() APIs Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-01 14:10:20 +02:00
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 12:56:32 +02:00
return( status );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
}
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 16:22:46 +02:00
psa_status_t psa_cipher_finish( psa_cipher_operation_t *operation,
uint8_t *output,
size_t output_size,
size_t *output_length )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
{
Replace PSA error code definitions with the ones defined in PSA spec
2019-02-14 12:48:10 +01:00
psa_status_t status = PSA_ERROR_GENERIC_ERROR;
psa: Add mbedtls_psa_cipher_xyz() APIs Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-01 14:10:20 +02:00
psa: cipher: Dispatch based on driver identifier For cipher multi-part operations, dispatch based on the driver identifier even in the case of the Mbed TLS software implementation (viewed as a driver). Also use the driver identifier to check that an cipher operation context is active or not. This aligns the way hash and cipher multi-part operations are dispatched. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-10 08:34:23 +01:00
if( operation->id == 0 )
Check & set operation flags for both driver and software in the core Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-09 15:28:49 +02:00
{
Update cipher and mac functions to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-23 12:38:39 +02:00
status = PSA_ERROR_BAD_STATE;
goto exit;
Check & set operation flags for both driver and software in the core Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-09 15:28:49 +02:00
}
Update cipher and mac functions to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-23 12:38:39 +02:00
Check & set operation flags for both driver and software in the core Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-09 15:28:49 +02:00
if( operation->iv_required && ! operation->iv_set )
{
Update cipher and mac functions to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-23 12:38:39 +02:00
status = PSA_ERROR_BAD_STATE;
goto exit;
Check & set operation flags for both driver and software in the core Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-09 15:28:49 +02:00
}
fix missing check on output_size in psa_cipher_finish func
2018-04-22 19:19:20 +02:00
psa: Call cipher operations software implementations as a driver Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-12-15 14:10:01 +01:00
status = psa_driver_wrapper_cipher_finish( operation,
output,
output_size,
output_length );
Update cipher and mac functions to abort on error Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-06-23 12:38:39 +02:00
exit:
Apply review feedback * Reworked the cipher context once again to be more robustly defined * Removed redundant memset * Unified behaviour on failure between driver and software in cipher_finish * Cipher test driver setup function now also returns early when its status is overridden, like the other test driver functions * Removed redundant test cases * Added bad-order checking to verify the driver doesn't get called where the spec says it won't. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-11 11:44:50 +02:00
if( status == PSA_SUCCESS )
return( psa_cipher_abort( operation ) );
else
{
*output_length = 0;
(void) psa_cipher_abort( operation );
Fix memory leak in psa_cipher_finish()
2018-07-09 17:04:51 +02:00
Apply review feedback * Reworked the cipher context once again to be more robustly defined * Removed redundant memset * Unified behaviour on failure between driver and software in cipher_finish * Cipher test driver setup function now also returns early when its status is overridden, like the other test driver functions * Removed redundant test cases * Added bad-order checking to verify the driver doesn't get called where the spec says it won't. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-11 11:44:50 +02:00
return( status );
}
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
}
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 16:22:46 +02:00
psa_status_t psa_cipher_abort( psa_cipher_operation_t *operation )
{
psa: cipher: Dispatch based on driver identifier For cipher multi-part operations, dispatch based on the driver identifier even in the case of the Mbed TLS software implementation (viewed as a driver). Also use the driver identifier to check that an cipher operation context is active or not. This aligns the way hash and cipher multi-part operations are dispatched. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-10 08:34:23 +01:00
if( operation->id == 0 )
psa_hash_abort: return PSA_SUCCESS if alg=0 Make psa_hash_abort consistent with psa_mac_abort and psa_cipher_abort. Add a comment explaining the reasoning.
2018-06-26 15:04:31 +02:00
{
Update semantics around driver context use in psa_cipher_setup Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-09-10 14:54:14 +02:00
/* The object has (apparently) been initialized but it is not (yet)
psa_hash_abort: return PSA_SUCCESS if alg=0 Make psa_hash_abort consistent with psa_mac_abort and psa_cipher_abort. Add a comment explaining the reasoning.
2018-06-26 15:04:31 +02:00
* in use. It's ok to call abort on such an object, and there's
* nothing to do. */
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 16:05:20 +02:00
return( PSA_SUCCESS );
psa_hash_abort: return PSA_SUCCESS if alg=0 Make psa_hash_abort consistent with psa_mac_abort and psa_cipher_abort. Add a comment explaining the reasoning.
2018-06-26 15:04:31 +02:00
}
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 16:05:20 +02:00
psa: Call cipher operations software implementations as a driver Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-12-15 14:10:01 +01:00
psa_driver_wrapper_cipher_abort( operation );
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 16:22:46 +02:00
psa: cipher: Dispatch based on driver identifier For cipher multi-part operations, dispatch based on the driver identifier even in the case of the Mbed TLS software implementation (viewed as a driver). Also use the driver identifier to check that an cipher operation context is active or not. This aligns the way hash and cipher multi-part operations are dispatched. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-10 08:34:23 +01:00
operation->id = 0;
add iv_required field to psa_cipher_operation_s and fix relevant functions
2018-04-30 11:31:04 +02:00
operation->iv_set = 0;
operation->iv_required = 0;
partly pr fix
2018-04-04 14:43:05 +02:00
adjust indentation per Mbed TLS standards
2018-05-31 13:07:14 +02:00
return( PSA_SUCCESS );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
}
Implement one-shot cipher Implement one-shot cipher APIs, psa_cipher_encrypt and psa_cipher_decrypt, introduced in PSA Crypto API 1.0. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-01 15:04:24 +01:00
psa_status_t psa_cipher_encrypt( mbedtls_svc_key_id_t key,
psa_algorithm_t alg,
const uint8_t *input,
size_t input_length,
uint8_t *output,
size_t output_size,
size_t *output_length )
{
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Dispatch cipher functions through the driver interface Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-25 11:17:10 +01:00
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
psa: cipher: Align APIs execution flow Align the execution of cipher one-shot APIs with that of cipher multi-part APIs: always exit through the exit-labelled section. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-07-08 19:00:07 +02:00
psa_key_slot_t *slot = NULL;
psa: cipher: Fix invalid output buffer usage in psa_cipher_encrypt() Don't use the output buffer in psa_cipher_encrypt() to pass the generated IV to the driver as local attacker could potentially control it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-07-09 18:44:58 +02:00
uint8_t local_iv[PSA_CIPHER_IV_MAX_SIZE];
size_t default_iv_length = 0;
Initialize output buffer length to 0 Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-25 15:21:11 +02:00
Dispatch cipher functions through the driver interface Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-25 11:17:10 +01:00
if( ! PSA_ALG_IS_CIPHER( alg ) )
psa: cipher: Align APIs execution flow Align the execution of cipher one-shot APIs with that of cipher multi-part APIs: always exit through the exit-labelled section. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-07-08 19:00:07 +02:00
{
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
}
Implement one-shot cipher Implement one-shot cipher APIs, psa_cipher_encrypt and psa_cipher_decrypt, introduced in PSA Crypto API 1.0. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-01 15:04:24 +01:00
Dispatch cipher functions through the driver interface Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-25 11:17:10 +01:00
status = psa_get_and_lock_key_slot_with_policy( key, &slot,
PSA_KEY_USAGE_ENCRYPT,
alg );
Implement one-shot cipher Implement one-shot cipher APIs, psa_cipher_encrypt and psa_cipher_decrypt, introduced in PSA Crypto API 1.0. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-01 15:04:24 +01:00
if( status != PSA_SUCCESS )
psa: cipher: Align APIs execution flow Align the execution of cipher one-shot APIs with that of cipher multi-part APIs: always exit through the exit-labelled section. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-07-08 19:00:07 +02:00
goto exit;
Implement one-shot cipher Implement one-shot cipher APIs, psa_cipher_encrypt and psa_cipher_decrypt, introduced in PSA Crypto API 1.0. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-01 15:04:24 +01:00
Dispatch cipher functions through the driver interface Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-25 11:17:10 +01:00
psa_key_attributes_t attributes = {
.core = slot->attr
};
psa: cipher: Fix invalid output buffer usage in psa_cipher_encrypt() Don't use the output buffer in psa_cipher_encrypt() to pass the generated IV to the driver as local attacker could potentially control it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-07-09 18:44:58 +02:00
default_iv_length = PSA_CIPHER_IV_LENGTH( slot->attr.type, alg );
if( default_iv_length > PSA_CIPHER_IV_MAX_SIZE )
{
status = PSA_ERROR_GENERIC_ERROR;
goto exit;
}
Dispatch cipher functions through the driver interface Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-25 11:17:10 +01:00
psa: cipher: Fix invalid output buffer usage in psa_cipher_encrypt() Don't use the output buffer in psa_cipher_encrypt() to pass the generated IV to the driver as local attacker could potentially control it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-07-09 18:44:58 +02:00
if( default_iv_length > 0 )
Implement one-shot cipher Implement one-shot cipher APIs, psa_cipher_encrypt and psa_cipher_decrypt, introduced in PSA Crypto API 1.0. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-01 15:04:24 +01:00
{
psa: cipher: Fix invalid output buffer usage in psa_cipher_encrypt() Don't use the output buffer in psa_cipher_encrypt() to pass the generated IV to the driver as local attacker could potentially control it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-07-09 18:44:58 +02:00
if( output_size < default_iv_length )
Dispatch cipher functions through the driver interface Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-25 11:17:10 +01:00
{
status = PSA_ERROR_BUFFER_TOO_SMALL;
goto exit;
}
psa: cipher: Fix invalid output buffer usage in psa_cipher_encrypt() Don't use the output buffer in psa_cipher_encrypt() to pass the generated IV to the driver as local attacker could potentially control it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-07-09 18:44:58 +02:00
status = psa_generate_random( local_iv, default_iv_length );
Implement one-shot cipher Implement one-shot cipher APIs, psa_cipher_encrypt and psa_cipher_decrypt, introduced in PSA Crypto API 1.0. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-01 15:04:24 +01:00
if( status != PSA_SUCCESS )
goto exit;
}
Dispatch cipher functions through the driver interface Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-25 11:17:10 +01:00
status = psa_driver_wrapper_cipher_encrypt(
&attributes, slot->key.data, slot->key.bytes,
psa: cipher: Fix invalid output buffer usage in psa_cipher_encrypt() Don't use the output buffer in psa_cipher_encrypt() to pass the generated IV to the driver as local attacker could potentially control it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-07-09 18:44:58 +02:00
alg, local_iv, default_iv_length, input, input_length,
output + default_iv_length, output_size - default_iv_length,
output_length );
Implement one-shot cipher Implement one-shot cipher APIs, psa_cipher_encrypt and psa_cipher_decrypt, introduced in PSA Crypto API 1.0. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-01 15:04:24 +01:00
exit:
Dispatch cipher functions through the driver interface Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-25 11:17:10 +01:00
unlock_status = psa_unlock_key_slot( slot );
psa: cipher: Align APIs execution flow Align the execution of cipher one-shot APIs with that of cipher multi-part APIs: always exit through the exit-labelled section. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-07-08 19:00:07 +02:00
if( status == PSA_SUCCESS )
status = unlock_status;
Implement one-shot cipher Implement one-shot cipher APIs, psa_cipher_encrypt and psa_cipher_decrypt, introduced in PSA Crypto API 1.0. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-01 15:04:24 +01:00
psa: cipher: Add IV parameters to cipher_encrypt entry point Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-07-09 09:19:35 +02:00
if( status == PSA_SUCCESS )
psa: cipher: Fix invalid output buffer usage in psa_cipher_encrypt() Don't use the output buffer in psa_cipher_encrypt() to pass the generated IV to the driver as local attacker could potentially control it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-07-09 18:44:58 +02:00
{
if( default_iv_length > 0 )
memcpy( output, local_iv, default_iv_length );
*output_length += default_iv_length;
}
psa: cipher: Add IV parameters to cipher_encrypt entry point Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-07-09 09:19:35 +02:00
else
psa: cipher: Align APIs execution flow Align the execution of cipher one-shot APIs with that of cipher multi-part APIs: always exit through the exit-labelled section. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-07-08 19:00:07 +02:00
*output_length = 0;
return( status );
Implement one-shot cipher Implement one-shot cipher APIs, psa_cipher_encrypt and psa_cipher_decrypt, introduced in PSA Crypto API 1.0. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-01 15:04:24 +01:00
}
psa_status_t psa_cipher_decrypt( mbedtls_svc_key_id_t key,
psa_algorithm_t alg,
const uint8_t *input,
size_t input_length,
uint8_t *output,
size_t output_size,
size_t *output_length )
{
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Dispatch cipher functions through the driver interface Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-25 11:17:10 +01:00
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
psa: cipher: Align APIs execution flow Align the execution of cipher one-shot APIs with that of cipher multi-part APIs: always exit through the exit-labelled section. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-07-08 19:00:07 +02:00
psa_key_slot_t *slot = NULL;
Initialize output buffer length to 0 Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-25 15:21:11 +02:00
Dispatch cipher functions through the driver interface Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-25 11:17:10 +01:00
if( ! PSA_ALG_IS_CIPHER( alg ) )
psa: cipher: Align APIs execution flow Align the execution of cipher one-shot APIs with that of cipher multi-part APIs: always exit through the exit-labelled section. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-07-08 19:00:07 +02:00
{
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
}
Implement one-shot cipher Implement one-shot cipher APIs, psa_cipher_encrypt and psa_cipher_decrypt, introduced in PSA Crypto API 1.0. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-01 15:04:24 +01:00
Dispatch cipher functions through the driver interface Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-25 11:17:10 +01:00
status = psa_get_and_lock_key_slot_with_policy( key, &slot,
PSA_KEY_USAGE_DECRYPT,
alg );
Implement one-shot cipher Implement one-shot cipher APIs, psa_cipher_encrypt and psa_cipher_decrypt, introduced in PSA Crypto API 1.0. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-01 15:04:24 +01:00
if( status != PSA_SUCCESS )
psa: cipher: Align APIs execution flow Align the execution of cipher one-shot APIs with that of cipher multi-part APIs: always exit through the exit-labelled section. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-07-08 19:00:07 +02:00
goto exit;
Implement one-shot cipher Implement one-shot cipher APIs, psa_cipher_encrypt and psa_cipher_decrypt, introduced in PSA Crypto API 1.0. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-01 15:04:24 +01:00
Dispatch cipher functions through the driver interface Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-25 11:17:10 +01:00
psa_key_attributes_t attributes = {
.core = slot->attr
};
Implement one-shot cipher Implement one-shot cipher APIs, psa_cipher_encrypt and psa_cipher_decrypt, introduced in PSA Crypto API 1.0. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-01 15:04:24 +01:00
Add support for CCM*-no-tag to PSA. Signed-off-by: Mateusz Starzyk <mateusz.starzyk@mobica.com>
2021-10-14 12:23:06 +02:00
if( alg == PSA_ALG_CCM_STAR_NO_TAG && input_length < PSA_BLOCK_CIPHER_BLOCK_LENGTH( slot->attr.type ) )
{
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
}
else if ( input_length < PSA_CIPHER_IV_LENGTH( slot->attr.type, alg ) )
Add checks for buffer size Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-25 15:25:38 +02:00
{
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
}
Dispatch cipher functions through the driver interface Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-25 11:17:10 +01:00
status = psa_driver_wrapper_cipher_decrypt(
&attributes, slot->key.data, slot->key.bytes,
alg, input, input_length,
output, output_size, output_length );
Implement one-shot cipher Implement one-shot cipher APIs, psa_cipher_encrypt and psa_cipher_decrypt, introduced in PSA Crypto API 1.0. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-01 15:04:24 +01:00
Add checks for buffer size Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-06-25 15:25:38 +02:00
exit:
Dispatch cipher functions through the driver interface Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-25 11:17:10 +01:00
unlock_status = psa_unlock_key_slot( slot );
psa: cipher: Align APIs execution flow Align the execution of cipher one-shot APIs with that of cipher multi-part APIs: always exit through the exit-labelled section. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-07-08 19:00:07 +02:00
if( status == PSA_SUCCESS )
status = unlock_status;
Dispatch cipher functions through the driver interface Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-25 11:17:10 +01:00
psa: cipher: Align APIs execution flow Align the execution of cipher one-shot APIs with that of cipher multi-part APIs: always exit through the exit-labelled section. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-07-08 19:00:07 +02:00
if( status != PSA_SUCCESS )
*output_length = 0;
return( status );
Implement one-shot cipher Implement one-shot cipher APIs, psa_cipher_encrypt and psa_cipher_decrypt, introduced in PSA Crypto API 1.0. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2021-03-01 15:04:24 +01:00
}
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 23:53:03 +02:00
/****************************************************************/
/* AEAD */
/****************************************************************/
Be more consistent about blank lines
2018-06-18 21:49:39 +02:00
Make sure nonce length checks use base algorithm Nonce length checks are now being used in the oneshot AEAD code as well, which passes variant algorithms, not the base version, so need to convert to base if necessary. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-09-28 18:44:45 +02:00
/* Helper function to get the base algorithm from its variants. */
static psa_algorithm_t psa_aead_get_base_algorithm( psa_algorithm_t alg )
{
return PSA_ALG_AEAD_WITH_DEFAULT_LENGTH_TAG( alg );
}
/* Helper function to perform common nonce length checks. */
Move all nonce length checks to PSA Core Remove duplicated code from oneshot API Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-09-28 12:14:27 +02:00
static psa_status_t psa_aead_check_nonce_length( psa_algorithm_t alg,
size_t nonce_length )
{
Make sure nonce length checks use base algorithm Nonce length checks are now being used in the oneshot AEAD code as well, which passes variant algorithms, not the base version, so need to convert to base if necessary. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-09-28 18:44:45 +02:00
psa_algorithm_t base_alg = psa_aead_get_base_algorithm( alg );
psa_crypto.c: use switch instead if-else in psa_aead_check_nonce_length and psa_aead_set_lengths (fixes #5065) Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-10-13 11:12:08 +02:00
switch(base_alg)
{
Switch cipher enabled macros Switch from using MBEDTLS_PSA_BUILTIN_ macros over to using PSA_WANT_ macros, as code was moved from the internal drivers to the PSA Core. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-09-29 15:10:20 +02:00
#if defined(PSA_WANT_ALG_GCM)
psa_crypto.c: use switch instead if-else in psa_aead_check_nonce_length and psa_aead_set_lengths (fixes #5065) Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-10-13 11:12:08 +02:00
case PSA_ALG_GCM:
/* Not checking max nonce size here as GCM spec allows almost
* arbitrarily large nonces. Please note that we do not generally
* recommend the usage of nonces of greater length than
* PSA_AEAD_NONCE_MAX_SIZE, as large nonces are hashed to a shorter
* size, which can then lead to collisions if you encrypt a very
* large number of messages.*/
if( nonce_length != 0 )
return( PSA_SUCCESS );
break;
Switch cipher enabled macros Switch from using MBEDTLS_PSA_BUILTIN_ macros over to using PSA_WANT_ macros, as code was moved from the internal drivers to the PSA Core. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-09-29 15:10:20 +02:00
#endif /* PSA_WANT_ALG_GCM */
#if defined(PSA_WANT_ALG_CCM)
psa_crypto.c: use switch instead if-else in psa_aead_check_nonce_length and psa_aead_set_lengths (fixes #5065) Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-10-13 11:12:08 +02:00
case PSA_ALG_CCM:
if( nonce_length >= 7 && nonce_length <= 13 )
return( PSA_SUCCESS );
break;
Switch cipher enabled macros Switch from using MBEDTLS_PSA_BUILTIN_ macros over to using PSA_WANT_ macros, as code was moved from the internal drivers to the PSA Core. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-09-29 15:10:20 +02:00
#endif /* PSA_WANT_ALG_CCM */
#if defined(PSA_WANT_ALG_CHACHA20_POLY1305)
psa_crypto.c: use switch instead if-else in psa_aead_check_nonce_length and psa_aead_set_lengths (fixes #5065) Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-10-13 11:12:08 +02:00
case PSA_ALG_CHACHA20_POLY1305:
if( nonce_length == 12 )
return( PSA_SUCCESS );
Indicate nonce sizes invalid for ChaCha20-Poly1305 Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2021-11-15 20:04:15 +01:00
else if( nonce_length == 8 )
return( PSA_ERROR_NOT_SUPPORTED );
break;
Switch cipher enabled macros Switch from using MBEDTLS_PSA_BUILTIN_ macros over to using PSA_WANT_ macros, as code was moved from the internal drivers to the PSA Core. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-09-29 15:10:20 +02:00
#endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */
psa_crypto.c: use switch instead if-else in psa_aead_check_nonce_length and psa_aead_set_lengths (fixes #5065) Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-10-13 11:12:08 +02:00
default:
Indicate if we know that a nonce length is invalid This restores the behaviour found in the previously released versions and development_2.x. Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2021-11-09 13:17:17 +01:00
return( PSA_ERROR_NOT_SUPPORTED );
psa_crypto.c: use switch instead if-else in psa_aead_check_nonce_length and psa_aead_set_lengths (fixes #5065) Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-10-13 11:12:08 +02:00
}
Move all nonce length checks to PSA Core Remove duplicated code from oneshot API Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-09-28 12:14:27 +02:00
Indicate if we know that a nonce length is invalid This restores the behaviour found in the previously released versions and development_2.x. Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2021-11-09 13:17:17 +01:00
return( PSA_ERROR_INVALID_ARGUMENT );
Move all nonce length checks to PSA Core Remove duplicated code from oneshot API Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-09-28 12:14:27 +02:00
}
Fix brace placement Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2022-01-13 16:26:03 +01:00
static psa_status_t psa_aead_check_algorithm( psa_algorithm_t alg )
{
Return the same error in multipart and single shot AEAD psa_aead_encrypt_setup() and psa_aead_decrypt_setup() were returning PSA_ERROR_INVALID_ARGUMENT, while the same failed checks were producing PSA_ERROR_NOT_SUPPORTED if they happened in psa_aead_encrypt() or psa_aead_decrypt(). The PSA Crypto API 1.1 spec will specify PSA_ERROR_INVALID_ARGUMENT in the case that the supplied algorithm is not an AEAD one. Also move these shared checks to a helper function, to reduce code duplication and ensure that the functions remain in sync. Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2021-12-08 21:07:13 +01:00
if( !PSA_ALG_IS_AEAD( alg ) || PSA_ALG_IS_WILDCARD( alg ) )
return( PSA_ERROR_INVALID_ARGUMENT );
return( PSA_SUCCESS );
}
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 09:51:30 +02:00
psa_status_t psa_aead_encrypt( mbedtls_svc_key_id_t key,
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 23:53:03 +02:00
psa_algorithm_t alg,
const uint8_t *nonce,
size_t nonce_length,
const uint8_t *additional_data,
size_t additional_data_length,
const uint8_t *plaintext,
size_t plaintext_length,
uint8_t *ciphertext,
size_t ciphertext_size,
size_t *ciphertext_length )
{
psa: aead: Implement aead operations as a driver entry point Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-16 17:15:37 +01:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa_key_slot_t *slot;
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 15:41:12 +02:00
set output length to zero to cover output length in error case
2018-06-03 14:05:47 +02:00
*ciphertext_length = 0;
fix condition over key type
2018-05-09 13:58:32 +02:00
Rename helper function to psa_aead_check_algorithm Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2022-01-13 14:33:45 +01:00
status = psa_aead_check_algorithm( alg );
Return the same error in multipart and single shot AEAD psa_aead_encrypt_setup() and psa_aead_decrypt_setup() were returning PSA_ERROR_INVALID_ARGUMENT, while the same failed checks were producing PSA_ERROR_NOT_SUPPORTED if they happened in psa_aead_encrypt() or psa_aead_decrypt(). The PSA Crypto API 1.1 spec will specify PSA_ERROR_INVALID_ARGUMENT in the case that the supplied algorithm is not an AEAD one. Also move these shared checks to a helper function, to reduce code duplication and ensure that the functions remain in sync. Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2021-12-08 21:07:13 +01:00
if( status != PSA_SUCCESS )
return( status );
Do validation on the algorithm argument in AEAD Corresponds better to the validation done in other modules of PSA Crypto. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com> Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-17 16:28:00 +01:00
psa: aead: Accept opaque keys for encryption/decryption Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-26 12:40:07 +01:00
status = psa_get_and_lock_key_slot_with_policy(
psa: aead: Implement aead operations as a driver entry point Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-16 17:15:37 +01:00
key, &slot, PSA_KEY_USAGE_ENCRYPT, alg );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
if( status != PSA_SUCCESS )
return( status );
add Key and Algorithm validation
2018-05-09 11:24:42 +02:00
psa: aead: Implement aead operations as a driver entry point Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-16 17:15:37 +01:00
psa_key_attributes_t attributes = {
.core = slot->attr
};
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 23:53:03 +02:00
Move all nonce length checks to PSA Core Remove duplicated code from oneshot API Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-09-28 12:14:27 +02:00
status = psa_aead_check_nonce_length( alg, nonce_length );
if( status != PSA_SUCCESS )
goto exit;
psa: aead: Add driver delegation Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-17 16:08:20 +01:00
status = psa_driver_wrapper_aead_encrypt(
psa: aead: Implement aead operations as a driver entry point Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-16 17:15:37 +01:00
&attributes, slot->key.data, slot->key.bytes,
alg,
nonce, nonce_length,
additional_data, additional_data_length,
plaintext, plaintext_length,
ciphertext, ciphertext_size, ciphertext_length );
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 15:41:12 +02:00
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
if( status != PSA_SUCCESS && ciphertext_size != 0 )
memset( ciphertext, 0, ciphertext_size );
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 15:41:12 +02:00
Move all nonce length checks to PSA Core Remove duplicated code from oneshot API Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-09-28 12:14:27 +02:00
exit:
psa: aead: Remove key slot from operation context Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-16 16:36:37 +01:00
psa_unlock_key_slot( slot );
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 23:53:03 +02:00
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
return( status );
Fix psa_aead_decrypt to read the tag at the end of the ciphertext
2018-06-01 19:23:52 +02:00
}
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 09:51:30 +02:00
psa_status_t psa_aead_decrypt( mbedtls_svc_key_id_t key,
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 23:53:03 +02:00
psa_algorithm_t alg,
const uint8_t *nonce,
size_t nonce_length,
const uint8_t *additional_data,
size_t additional_data_length,
const uint8_t *ciphertext,
size_t ciphertext_length,
uint8_t *plaintext,
size_t plaintext_size,
size_t *plaintext_length )
{
psa: aead: Implement aead operations as a driver entry point Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-16 17:15:37 +01:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa_key_slot_t *slot;
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 15:41:12 +02:00
Fix psa_aead_decrypt to read the tag at the end of the ciphertext
2018-06-01 19:23:52 +02:00
*plaintext_length = 0;
Fix parameter validation
2018-04-26 11:07:35 +02:00
Rename helper function to psa_aead_check_algorithm Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2022-01-13 14:33:45 +01:00
status = psa_aead_check_algorithm( alg );
Return the same error in multipart and single shot AEAD psa_aead_encrypt_setup() and psa_aead_decrypt_setup() were returning PSA_ERROR_INVALID_ARGUMENT, while the same failed checks were producing PSA_ERROR_NOT_SUPPORTED if they happened in psa_aead_encrypt() or psa_aead_decrypt(). The PSA Crypto API 1.1 spec will specify PSA_ERROR_INVALID_ARGUMENT in the case that the supplied algorithm is not an AEAD one. Also move these shared checks to a helper function, to reduce code duplication and ensure that the functions remain in sync. Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2021-12-08 21:07:13 +01:00
if( status != PSA_SUCCESS )
return( status );
Do validation on the algorithm argument in AEAD Corresponds better to the validation done in other modules of PSA Crypto. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com> Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-17 16:28:00 +01:00
psa: aead: Accept opaque keys for encryption/decryption Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-26 12:40:07 +01:00
status = psa_get_and_lock_key_slot_with_policy(
psa: aead: Implement aead operations as a driver entry point Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-16 17:15:37 +01:00
key, &slot, PSA_KEY_USAGE_DECRYPT, alg );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
if( status != PSA_SUCCESS )
return( status );
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 23:53:03 +02:00
psa: aead: Implement aead operations as a driver entry point Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-16 17:15:37 +01:00
psa_key_attributes_t attributes = {
.core = slot->attr
};
Minor refactoring in AEAD code Make it a little easier to add ChaCha20-Poly1305. This also fixes the error code in case mbedtls_gcm_setkey() fails with a status that doesn't map to INVALID_ARGUMENT.
2019-05-06 15:27:16 +02:00
Move all nonce length checks to PSA Core Remove duplicated code from oneshot API Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-09-28 12:14:27 +02:00
status = psa_aead_check_nonce_length( alg, nonce_length );
if( status != PSA_SUCCESS )
goto exit;
psa: aead: Add driver delegation Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-17 16:08:20 +01:00
status = psa_driver_wrapper_aead_decrypt(
psa: aead: Implement aead operations as a driver entry point Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-16 17:15:37 +01:00
&attributes, slot->key.data, slot->key.bytes,
alg,
nonce, nonce_length,
additional_data, additional_data_length,
ciphertext, ciphertext_length,
plaintext, plaintext_size, plaintext_length );
Whitespace fixes Changed indentation to match Mbed TLS style. Wrapped some lines to 80 columns.
2018-06-01 16:28:30 +02:00
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
if( status != PSA_SUCCESS && plaintext_size != 0 )
memset( plaintext, 0, plaintext_size );
remove unnecessary argument to the psa_aead_unpadded_locate_tag function
2018-06-03 16:20:42 +02:00
Move all nonce length checks to PSA Core Remove duplicated code from oneshot API Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-09-28 12:14:27 +02:00
exit:
psa: aead: Implement aead operations as a driver entry point Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-03-16 17:15:37 +01:00
psa_unlock_key_slot( slot );
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
return( status );
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 23:53:03 +02:00
}
Detect invalid tag lengths in psa_aead_setup Read tag lengths from the driver and validate against preset values. Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2021-12-19 17:00:12 +01:00
static psa_status_t psa_validate_tag_length( psa_aead_operation_t *operation,
psa_algorithm_t alg ) {
uint8_t tag_len = 0;
if( psa_driver_get_tag_len( operation, &tag_len ) != PSA_SUCCESS )
{
return( PSA_ERROR_INVALID_ARGUMENT );
}
switch( PSA_ALG_AEAD_WITH_SHORTENED_TAG( alg, 0 ) )
{
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM)
case PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, 0 ):
/* CCM allows the following tag lengths: 4, 6, 8, 10, 12, 14, 16.*/
if( tag_len < 4 || tag_len > 16 || tag_len % 2 )
return( PSA_ERROR_INVALID_ARGUMENT );
break;
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */
#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM)
case PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_GCM, 0 ):
/* GCM allows the following tag lengths: 4, 8, 12, 13, 14, 15, 16. */
if( tag_len != 4 && tag_len != 8 && ( tag_len < 12 || tag_len > 16 ) )
return( PSA_ERROR_INVALID_ARGUMENT );
break;
#endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */
#if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305)
case PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CHACHA20_POLY1305, 0 ):
/* We only support the default tag length. */
if( tag_len != 16 )
return( PSA_ERROR_INVALID_ARGUMENT );
break;
#endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */
default:
(void) tag_len;
return( PSA_ERROR_NOT_SUPPORTED );
}
return( PSA_SUCCESS );
}
Refactor aead setup functions into single function Move common encrypt / decrypt code into common function, and roll in previously refactored setup checks function, as this is now the only place it is called. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-08-19 19:55:56 +02:00
/* Set the key for a multipart authenticated operation. */
static psa_status_t psa_aead_setup( psa_aead_operation_t *operation,
Refactor is_encrypt into aead setup arguments Avoid touching the operation until later. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-08-23 19:59:49 +02:00
int is_encrypt,
Refactor aead setup functions into single function Move common encrypt / decrypt code into common function, and roll in previously refactored setup checks function, as this is now the only place it is called. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-08-19 19:55:56 +02:00
mbedtls_svc_key_id_t key,
psa_algorithm_t alg )
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
{
Refactor aead setup functions into single function Move common encrypt / decrypt code into common function, and roll in previously refactored setup checks function, as this is now the only place it is called. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-08-19 19:55:56 +02:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
psa_key_slot_t *slot = NULL;
psa_key_usage_t key_usage = 0;
Rename helper function to psa_aead_check_algorithm Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2022-01-13 14:33:45 +01:00
status = psa_aead_check_algorithm( alg );
Return the same error in multipart and single shot AEAD psa_aead_encrypt_setup() and psa_aead_decrypt_setup() were returning PSA_ERROR_INVALID_ARGUMENT, while the same failed checks were producing PSA_ERROR_NOT_SUPPORTED if they happened in psa_aead_encrypt() or psa_aead_decrypt(). The PSA Crypto API 1.1 spec will specify PSA_ERROR_INVALID_ARGUMENT in the case that the supplied algorithm is not an AEAD one. Also move these shared checks to a helper function, to reduce code duplication and ensure that the functions remain in sync. Signed-off-by: Bence Szépkúti <bence.szepkuti@arm.com>
2021-12-08 21:07:13 +01:00
if( status != PSA_SUCCESS )
Refactor aead setup functions into single function Move common encrypt / decrypt code into common function, and roll in previously refactored setup checks function, as this is now the only place it is called. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-08-19 19:55:56 +02:00
goto exit;
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
Seperate id checks from other state checks Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-20 15:29:20 +02:00
if( operation->id != 0 )
{
Refactor aead setup functions into single function Move common encrypt / decrypt code into common function, and roll in previously refactored setup checks function, as this is now the only place it is called. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-08-19 19:55:56 +02:00
status = PSA_ERROR_BAD_STATE;
goto exit;
Seperate id checks from other state checks Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-20 15:29:20 +02:00
}
Improve state logic Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-21 18:41:41 +02:00
if( operation->nonce_set || operation->lengths_set ||
operation->ad_started || operation->body_started )
Split multipart AEAD contexts into two parts Split to data required for internal implementation and data required for driver implementation with data left over for the PSA layer. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-10 19:19:46 +02:00
{
Refactor aead setup functions into single function Move common encrypt / decrypt code into common function, and roll in previously refactored setup checks function, as this is now the only place it is called. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-08-19 19:55:56 +02:00
status = PSA_ERROR_BAD_STATE;
goto exit;
Split multipart AEAD contexts into two parts Split to data required for internal implementation and data required for driver implementation with data left over for the PSA layer. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-10 19:19:46 +02:00
}
Refactor is_encrypt into aead setup arguments Avoid touching the operation until later. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-08-23 19:59:49 +02:00
if( is_encrypt )
Refactor aead setup functions into single function Move common encrypt / decrypt code into common function, and roll in previously refactored setup checks function, as this is now the only place it is called. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-08-19 19:55:56 +02:00
key_usage = PSA_KEY_USAGE_ENCRYPT;
else
key_usage = PSA_KEY_USAGE_DECRYPT;
Simplify logic and factor out initial checks Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-06-24 19:17:52 +02:00
Refactor aead setup functions into single function Move common encrypt / decrypt code into common function, and roll in previously refactored setup checks function, as this is now the only place it is called. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-08-19 19:55:56 +02:00
status = psa_get_and_lock_key_slot_with_policy( key, &slot, key_usage,
alg );
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
if( status != PSA_SUCCESS )
Add abort call to all failure points Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 20:16:09 +02:00
goto exit;
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
psa_key_attributes_t attributes = {
Refactor aead setup functions into single function Move common encrypt / decrypt code into common function, and roll in previously refactored setup checks function, as this is now the only place it is called. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-08-19 19:55:56 +02:00
.core = slot->attr
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
};
Refactor is_encrypt into aead setup arguments Avoid touching the operation until later. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-08-23 19:59:49 +02:00
if( is_encrypt )
Refactor aead setup functions into single function Move common encrypt / decrypt code into common function, and roll in previously refactored setup checks function, as this is now the only place it is called. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-08-19 19:55:56 +02:00
status = psa_driver_wrapper_aead_encrypt_setup( operation,
&attributes,
slot->key.data,
slot->key.bytes,
alg );
else
status = psa_driver_wrapper_aead_decrypt_setup( operation,
&attributes,
slot->key.data,
slot->key.bytes,
alg );
Add abort call to all failure points Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 20:16:09 +02:00
if( status != PSA_SUCCESS )
goto exit;
Detect invalid tag lengths in psa_aead_setup Read tag lengths from the driver and validate against preset values. Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2021-12-19 17:00:12 +01:00
if( ( status = psa_validate_tag_length( operation, alg ) ) != PSA_SUCCESS )
goto exit;
Split multipart AEAD contexts into two parts Split to data required for internal implementation and data required for driver implementation with data left over for the PSA layer. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-10 19:19:46 +02:00
operation->key_type = psa_get_key_type( &attributes );
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
Ensure that key gets unlocked in case of error Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-20 15:33:13 +02:00
exit:
Remove unneccessary guard for key unlock Also make sure failure is not hidden by key unlock failure Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-21 18:13:50 +02:00
unlock_status = psa_unlock_key_slot( slot );
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
Split multipart AEAD contexts into two parts Split to data required for internal implementation and data required for driver implementation with data left over for the PSA layer. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-10 19:19:46 +02:00
if( status == PSA_SUCCESS )
Ensure generate nonce unavailable in decrypt Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-06-22 18:25:57 +02:00
{
Simplify logic and factor out initial checks Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-06-24 19:17:52 +02:00
status = unlock_status;
Split multipart AEAD contexts into two parts Split to data required for internal implementation and data required for driver implementation with data left over for the PSA layer. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-10 19:19:46 +02:00
operation->alg = psa_aead_get_base_algorithm( alg );
Refactor is_encrypt into aead setup arguments Avoid touching the operation until later. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-08-23 19:59:49 +02:00
operation->is_encrypt = is_encrypt;
Ensure generate nonce unavailable in decrypt Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-06-22 18:25:57 +02:00
}
Add abort call to all failure points Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 20:16:09 +02:00
else
psa_aead_abort( operation );
Split multipart AEAD contexts into two parts Split to data required for internal implementation and data required for driver implementation with data left over for the PSA layer. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-10 19:19:46 +02:00
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
return( status );
}
Refactor aead setup functions into single function Move common encrypt / decrypt code into common function, and roll in previously refactored setup checks function, as this is now the only place it is called. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-08-19 19:55:56 +02:00
/* Set the key for a multipart authenticated encryption operation. */
psa_status_t psa_aead_encrypt_setup( psa_aead_operation_t *operation,
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
mbedtls_svc_key_id_t key,
psa_algorithm_t alg )
{
Refactor is_encrypt into aead setup arguments Avoid touching the operation until later. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-08-23 19:59:49 +02:00
return( psa_aead_setup( operation, 1, key, alg ) );
Refactor aead setup functions into single function Move common encrypt / decrypt code into common function, and roll in previously refactored setup checks function, as this is now the only place it is called. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-08-19 19:55:56 +02:00
}
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
Refactor aead setup functions into single function Move common encrypt / decrypt code into common function, and roll in previously refactored setup checks function, as this is now the only place it is called. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-08-19 19:55:56 +02:00
/* Set the key for a multipart authenticated decryption operation. */
psa_status_t psa_aead_decrypt_setup( psa_aead_operation_t *operation,
mbedtls_svc_key_id_t key,
psa_algorithm_t alg )
{
Refactor is_encrypt into aead setup arguments Avoid touching the operation until later. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-08-23 19:59:49 +02:00
return( psa_aead_setup( operation, 0, key, alg ) );
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
}
/* Generate a random nonce / IV for multipart AEAD operation */
psa_status_t psa_aead_generate_nonce( psa_aead_operation_t *operation,
uint8_t *nonce,
size_t nonce_size,
size_t *nonce_length )
{
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa: aead: Fix invalid output buffer usage in generate_nonce() Don't use the output buffer in psa_aead_generate_nonce() to pass the generated nonce to the driver as a local attacker could potentially control it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-11-26 18:53:58 +01:00
uint8_t local_nonce[PSA_AEAD_NONCE_MAX_SIZE];
Remove unrequired initialisation Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-20 15:43:47 +02:00
size_t required_nonce_size;
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
Add generate nonce test Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-06-04 17:42:21 +02:00
*nonce_length = 0;
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
Seperate id checks from other state checks Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-20 15:29:20 +02:00
if( operation->id == 0 )
{
status = PSA_ERROR_BAD_STATE;
goto exit;
}
Remove extraneous state checks Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-08-25 17:24:58 +02:00
if( operation->nonce_set || !operation->is_encrypt )
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
{
Add abort call to all failure points Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 20:16:09 +02:00
status = PSA_ERROR_BAD_STATE;
goto exit;
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
}
Add Multipart AEAD CCM internal implementation Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-10-01 14:00:16 +02:00
/* For CCM, this size may not be correct according to the PSA
* specification. The PSA Crypto 1.0.1 specification states:
*
* CCM encodes the plaintext length pLen in L octets, with L the smallest
* integer >= 2 where pLen < 2^(8L). The nonce length is then 15 - L bytes.
*
* However this restriction that L has to be the smallest integer is not
* applied in practice, and it is not implementable here since the
* plaintext length may or may not be known at this time. */
Formatting fixes for psa_crypto.c Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 23:22:42 +02:00
required_nonce_size = PSA_AEAD_NONCE_LENGTH( operation->key_type,
Fix formatting issue Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-08-25 17:33:47 +02:00
operation->alg );
Add abort call to all failure points Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 20:16:09 +02:00
if( nonce_size < required_nonce_size )
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
{
Add abort call to all failure points Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 20:16:09 +02:00
status = PSA_ERROR_BUFFER_TOO_SMALL;
goto exit;
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
}
psa: aead: Fix invalid output buffer usage in generate_nonce() Don't use the output buffer in psa_aead_generate_nonce() to pass the generated nonce to the driver as a local attacker could potentially control it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-11-26 18:53:58 +01:00
status = psa_generate_random( local_nonce, required_nonce_size );
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
if( status != PSA_SUCCESS )
Add abort call to all failure points Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 20:16:09 +02:00
goto exit;
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
psa: aead: Fix invalid output buffer usage in generate_nonce() Don't use the output buffer in psa_aead_generate_nonce() to pass the generated nonce to the driver as a local attacker could potentially control it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-11-26 18:53:58 +01:00
status = psa_aead_set_nonce( operation, local_nonce, required_nonce_size );
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
Add abort call to all failure points Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 20:16:09 +02:00
exit:
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
if( status == PSA_SUCCESS )
psa: aead: Fix invalid output buffer usage in generate_nonce() Don't use the output buffer in psa_aead_generate_nonce() to pass the generated nonce to the driver as a local attacker could potentially control it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-11-26 18:53:58 +01:00
{
memcpy( nonce, local_nonce, required_nonce_size );
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
*nonce_length = required_nonce_size;
psa: aead: Fix invalid output buffer usage in generate_nonce() Don't use the output buffer in psa_aead_generate_nonce() to pass the generated nonce to the driver as a local attacker could potentially control it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-11-26 18:53:58 +01:00
}
Add abort call to all failure points Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 20:16:09 +02:00
else
psa_aead_abort( operation );
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
Add abort call to all failure points Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 20:16:09 +02:00
return( status );
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
}
/* Set the nonce for a multipart authenticated encryption or decryption
operation.*/
psa_status_t psa_aead_set_nonce( psa_aead_operation_t *operation,
const uint8_t *nonce,
size_t nonce_length )
{
Split multipart AEAD contexts into two parts Split to data required for internal implementation and data required for driver implementation with data left over for the PSA layer. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-10 19:19:46 +02:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Seperate id checks from other state checks Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-20 15:29:20 +02:00
if( operation->id == 0 )
{
status = PSA_ERROR_BAD_STATE;
goto exit;
}
Formatting fixes Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-09-01 11:33:14 +02:00
if( operation->nonce_set )
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
{
Add abort call to all failure points Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 20:16:09 +02:00
status = PSA_ERROR_BAD_STATE;
goto exit;
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
}
Move all nonce length checks to PSA Core Remove duplicated code from oneshot API Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-09-28 12:14:27 +02:00
status = psa_aead_check_nonce_length( operation->alg, nonce_length );
if( status != PSA_SUCCESS )
Move nonce size checking to PSA Core Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-09-27 19:09:28 +02:00
{
Move all nonce length checks to PSA Core Remove duplicated code from oneshot API Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-09-28 12:14:27 +02:00
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
Move nonce size checking to PSA Core Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-09-27 19:09:28 +02:00
}
Properly handle GCM's range of nonce sizes Add comment to the effect that we cannot really check nonce size as the GCM spec allows almost arbitrarily large nonces. As a result of this, change the operation nonce over to an allocated buffer to avoid overflow situations. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-20 19:24:07 +02:00
Split multipart AEAD contexts into two parts Split to data required for internal implementation and data required for driver implementation with data left over for the PSA layer. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-10 19:19:46 +02:00
status = psa_driver_wrapper_aead_set_nonce( operation, nonce,
nonce_length );
Add abort call to all failure points Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 20:16:09 +02:00
exit:
Split multipart AEAD contexts into two parts Split to data required for internal implementation and data required for driver implementation with data left over for the PSA layer. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-10 19:19:46 +02:00
if( status == PSA_SUCCESS )
operation->nonce_set = 1;
Add abort call to all failure points Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 20:16:09 +02:00
else
psa_aead_abort( operation );
Split multipart AEAD contexts into two parts Split to data required for internal implementation and data required for driver implementation with data left over for the PSA layer. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-10 19:19:46 +02:00
return( status );
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
}
/* Declare the lengths of the message and additional data for multipart AEAD. */
psa_status_t psa_aead_set_lengths( psa_aead_operation_t *operation,
size_t ad_length,
size_t plaintext_length )
{
Split multipart AEAD contexts into two parts Split to data required for internal implementation and data required for driver implementation with data left over for the PSA layer. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-10 19:19:46 +02:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Seperate id checks from other state checks Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-20 15:29:20 +02:00
if( operation->id == 0 )
{
status = PSA_ERROR_BAD_STATE;
goto exit;
}
Improve state logic Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-21 18:41:41 +02:00
if( operation->lengths_set || operation->ad_started ||
Remove code duplication and fix formatting Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-06-24 19:08:54 +02:00
operation->body_started )
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
{
Add abort call to all failure points Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 20:16:09 +02:00
status = PSA_ERROR_BAD_STATE;
goto exit;
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
}
psa_crypto.c: use switch instead if-else in psa_aead_check_nonce_length and psa_aead_set_lengths (fixes #5065) Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-10-13 11:12:08 +02:00
switch(operation->alg)
Move set lengths checking to PSA Core Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-09-27 18:56:28 +02:00
{
psa_crypto.c: use switch instead if-else in psa_aead_check_nonce_length and psa_aead_set_lengths (fixes #5065) Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-10-13 11:12:08 +02:00
#if defined(PSA_WANT_ALG_GCM)
case PSA_ALG_GCM:
/* Lengths can only be too large for GCM if size_t is bigger than 32
* bits. Without the guard this code will generate warnings on 32bit
* builds. */
Move set lengths checking to PSA Core Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-09-27 18:56:28 +02:00
#if SIZE_MAX > UINT32_MAX
psa_crypto.c: use switch instead if-else in psa_aead_check_nonce_length and psa_aead_set_lengths (fixes #5065) Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-10-13 11:12:08 +02:00
if( (( uint64_t ) ad_length ) >> 61 != 0 ||
(( uint64_t ) plaintext_length ) > 0xFFFFFFFE0ull )
{
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
}
Move set lengths checking to PSA Core Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-09-27 18:56:28 +02:00
#endif
psa_crypto.c: use switch instead if-else in psa_aead_check_nonce_length and psa_aead_set_lengths (fixes #5065) Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-10-13 11:12:08 +02:00
break;
Switch cipher enabled macros Switch from using MBEDTLS_PSA_BUILTIN_ macros over to using PSA_WANT_ macros, as code was moved from the internal drivers to the PSA Core. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-09-29 15:10:20 +02:00
#endif /* PSA_WANT_ALG_GCM */
#if defined(PSA_WANT_ALG_CCM)
psa_crypto.c: use switch instead if-else in psa_aead_check_nonce_length and psa_aead_set_lengths (fixes #5065) Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-10-13 11:12:08 +02:00
case PSA_ALG_CCM:
if( ad_length > 0xFF00 )
{
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
}
break;
Switch cipher enabled macros Switch from using MBEDTLS_PSA_BUILTIN_ macros over to using PSA_WANT_ macros, as code was moved from the internal drivers to the PSA Core. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-09-29 15:10:20 +02:00
#endif /* PSA_WANT_ALG_CCM */
#if defined(PSA_WANT_ALG_CHACHA20_POLY1305)
psa_crypto.c: use switch instead if-else in psa_aead_check_nonce_length and psa_aead_set_lengths (fixes #5065) Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-10-13 11:12:08 +02:00
case PSA_ALG_CHACHA20_POLY1305:
/* No length restrictions for ChaChaPoly. */
break;
Switch cipher enabled macros Switch from using MBEDTLS_PSA_BUILTIN_ macros over to using PSA_WANT_ macros, as code was moved from the internal drivers to the PSA Core. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-09-29 15:10:20 +02:00
#endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */
psa_crypto.c: use switch instead if-else in psa_aead_check_nonce_length and psa_aead_set_lengths (fixes #5065) Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-10-13 11:12:08 +02:00
default:
break;
}
Move set lengths checking to PSA Core Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-09-27 18:56:28 +02:00
Split multipart AEAD contexts into two parts Split to data required for internal implementation and data required for driver implementation with data left over for the PSA layer. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-10 19:19:46 +02:00
status = psa_driver_wrapper_aead_set_lengths( operation, ad_length,
plaintext_length );
Add abort call to all failure points Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 20:16:09 +02:00
exit:
Split multipart AEAD contexts into two parts Split to data required for internal implementation and data required for driver implementation with data left over for the PSA layer. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-10 19:19:46 +02:00
if( status == PSA_SUCCESS )
Move AEAD length checks to PSA core Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-20 18:25:06 +02:00
{
operation->ad_remaining = ad_length;
operation->body_remaining = plaintext_length;
Split multipart AEAD contexts into two parts Split to data required for internal implementation and data required for driver implementation with data left over for the PSA layer. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-10 19:19:46 +02:00
operation->lengths_set = 1;
Move AEAD length checks to PSA core Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-20 18:25:06 +02:00
}
Add abort call to all failure points Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 20:16:09 +02:00
else
psa_aead_abort( operation );
Split multipart AEAD contexts into two parts Split to data required for internal implementation and data required for driver implementation with data left over for the PSA layer. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-10 19:19:46 +02:00
Add abort call to all failure points Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 20:16:09 +02:00
return( status );
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
}
Formatting fixes Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-09-01 11:33:14 +02:00
/* Pass additional data to an active multipart AEAD operation. */
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
psa_status_t psa_aead_update_ad( psa_aead_operation_t *operation,
const uint8_t *input,
size_t input_length )
{
Split multipart AEAD contexts into two parts Split to data required for internal implementation and data required for driver implementation with data left over for the PSA layer. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-10 19:19:46 +02:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Seperate id checks from other state checks Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-20 15:29:20 +02:00
if( operation->id == 0 )
{
status = PSA_ERROR_BAD_STATE;
goto exit;
}
Improve state logic Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-21 18:41:41 +02:00
if( !operation->nonce_set || operation->body_started )
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
{
Add abort call to all failure points Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 20:16:09 +02:00
status = PSA_ERROR_BAD_STATE;
goto exit;
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
}
Move AEAD length checks to PSA core Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-20 18:25:06 +02:00
if( operation->lengths_set )
{
Improve state logic Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-21 18:41:41 +02:00
if( operation->ad_remaining < input_length )
Move AEAD length checks to PSA core Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-20 18:25:06 +02:00
{
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
}
operation->ad_remaining -= input_length;
}
Add Multipart AEAD CCM internal implementation Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-10-01 14:00:16 +02:00
#if defined(PSA_WANT_ALG_CCM)
else if( operation->alg == PSA_ALG_CCM )
{
status = PSA_ERROR_BAD_STATE;
goto exit;
}
#endif /* PSA_WANT_ALG_CCM */
Move AEAD length checks to PSA core Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-20 18:25:06 +02:00
Split multipart AEAD contexts into two parts Split to data required for internal implementation and data required for driver implementation with data left over for the PSA layer. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-10 19:19:46 +02:00
status = psa_driver_wrapper_aead_update_ad( operation, input,
input_length );
Add abort call to all failure points Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 20:16:09 +02:00
exit:
Split multipart AEAD contexts into two parts Split to data required for internal implementation and data required for driver implementation with data left over for the PSA layer. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-10 19:19:46 +02:00
if( status == PSA_SUCCESS )
operation->ad_started = 1;
Add abort call to all failure points Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 20:16:09 +02:00
else
psa_aead_abort( operation );
Split multipart AEAD contexts into two parts Split to data required for internal implementation and data required for driver implementation with data left over for the PSA layer. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-10 19:19:46 +02:00
Add abort call to all failure points Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 20:16:09 +02:00
return( status );
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
}
/* Encrypt or decrypt a message fragment in an active multipart AEAD
operation.*/
psa_status_t psa_aead_update( psa_aead_operation_t *operation,
const uint8_t *input,
size_t input_length,
uint8_t *output,
size_t output_size,
size_t *output_length )
{
Split multipart AEAD contexts into two parts Split to data required for internal implementation and data required for driver implementation with data left over for the PSA layer. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-10 19:19:46 +02:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
*output_length = 0;
Seperate id checks from other state checks Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-20 15:29:20 +02:00
if( operation->id == 0 )
{
status = PSA_ERROR_BAD_STATE;
goto exit;
}
Improve state logic Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-21 18:41:41 +02:00
if( !operation->nonce_set )
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
{
Add abort call to all failure points Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 20:16:09 +02:00
status = PSA_ERROR_BAD_STATE;
goto exit;
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
}
Move AEAD length checks to PSA core Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-20 18:25:06 +02:00
if( operation->lengths_set )
{
/* Additional data length was supplied, but not all the additional
data was supplied.*/
if( operation->ad_remaining != 0 )
{
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
}
/* Too much data provided. */
if( operation->body_remaining < input_length )
{
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
}
operation->body_remaining -= input_length;
}
Add Multipart AEAD CCM internal implementation Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-10-01 14:00:16 +02:00
#if defined(PSA_WANT_ALG_CCM)
else if( operation->alg == PSA_ALG_CCM )
{
status = PSA_ERROR_BAD_STATE;
goto exit;
}
#endif /* PSA_WANT_ALG_CCM */
Move AEAD length checks to PSA core Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-20 18:25:06 +02:00
Split multipart AEAD contexts into two parts Split to data required for internal implementation and data required for driver implementation with data left over for the PSA layer. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-10 19:19:46 +02:00
status = psa_driver_wrapper_aead_update( operation, input, input_length,
output, output_size,
output_length );
Add abort call to all failure points Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 20:16:09 +02:00
exit:
Split multipart AEAD contexts into two parts Split to data required for internal implementation and data required for driver implementation with data left over for the PSA layer. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-10 19:19:46 +02:00
if( status == PSA_SUCCESS )
operation->body_started = 1;
Add abort call to all failure points Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 20:16:09 +02:00
else
psa_aead_abort( operation );
Split multipart AEAD contexts into two parts Split to data required for internal implementation and data required for driver implementation with data left over for the PSA layer. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-10 19:19:46 +02:00
Add abort call to all failure points Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 20:16:09 +02:00
return( status );
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
}
Const correctness Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-09-19 19:26:37 +02:00
static psa_status_t psa_aead_final_checks( const psa_aead_operation_t *operation )
Move common final checks to function Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-06-23 09:50:14 +02:00
{
Remove code duplication and fix formatting Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-06-24 19:08:54 +02:00
if( operation->id == 0 || !operation->nonce_set )
Move common final checks to function Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-06-23 09:50:14 +02:00
return( PSA_ERROR_BAD_STATE );
Add missing space Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-07-14 15:54:11 +02:00
if( operation->lengths_set && ( operation->ad_remaining != 0 ||
Move common final checks to function Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-06-23 09:50:14 +02:00
operation->body_remaining != 0 ) )
return( PSA_ERROR_INVALID_ARGUMENT );
return( PSA_SUCCESS );
}
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
/* Finish encrypting a message in a multipart AEAD operation. */
psa_status_t psa_aead_finish( psa_aead_operation_t *operation,
uint8_t *ciphertext,
size_t ciphertext_size,
size_t *ciphertext_length,
uint8_t *tag,
size_t tag_size,
size_t *tag_length )
{
Add abort call to all failure points Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 20:16:09 +02:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
*ciphertext_length = 0;
Better tag size default for m-aead finish Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-06-22 18:53:45 +02:00
*tag_length = tag_size;
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
Remove overly strict final checks Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-08-16 19:20:36 +02:00
status = psa_aead_final_checks( operation );
Move common final checks to function Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-06-23 09:50:14 +02:00
if( status != PSA_SUCCESS )
Add abort call to all failure points Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 20:16:09 +02:00
goto exit;
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
Remove code duplication and fix formatting Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-06-24 19:08:54 +02:00
if( !operation->is_encrypt )
Move AEAD length checks to PSA core Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-20 18:25:06 +02:00
{
Move common final checks to function Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-06-23 09:50:14 +02:00
status = PSA_ERROR_BAD_STATE;
Move AEAD length checks to PSA core Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-20 18:25:06 +02:00
goto exit;
}
Add abort call to all failure points Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 20:16:09 +02:00
status = psa_driver_wrapper_aead_finish( operation, ciphertext,
ciphertext_size,
ciphertext_length,
tag, tag_size, tag_length );
exit:
Set tag to 'impossible' value on failure to encrypt Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-21 19:02:33 +02:00
/* In case the operation fails and the user fails to check for failure or
Improve comment on buffer clearing Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-09-19 19:34:50 +02:00
* the zero tag size, make sure the tag is set to something implausible.
* Even if the operation succeeds, make sure we clear the rest of the
* buffer to prevent potential leakage of anything previously placed in
* the same buffer.*/
Make NULL tag check more explicit Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-09-22 18:15:48 +02:00
if( tag != NULL )
Add safety for NULL tag being passed to finish Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-09-19 23:33:09 +02:00
{
if( status != PSA_SUCCESS )
memset( tag, '!', tag_size );
else if( *tag_length < tag_size )
memset( tag + *tag_length, '!', ( tag_size - *tag_length ) );
}
Set tag to 'impossible' value on failure to encrypt Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-21 19:02:33 +02:00
Add abort call to all failure points Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 20:16:09 +02:00
psa_aead_abort( operation );
return( status );
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
}
/* Finish authenticating and decrypting a message in a multipart AEAD
operation.*/
psa_status_t psa_aead_verify( psa_aead_operation_t *operation,
uint8_t *plaintext,
size_t plaintext_size,
size_t *plaintext_length,
const uint8_t *tag,
size_t tag_length )
{
Add abort call to all failure points Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 20:16:09 +02:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
*plaintext_length = 0;
Remove overly strict final checks Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-08-16 19:20:36 +02:00
status = psa_aead_final_checks( operation );
Move common final checks to function Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-06-23 09:50:14 +02:00
if( status != PSA_SUCCESS )
Seperate id checks from other state checks Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-20 15:29:20 +02:00
goto exit;
Remove code duplication and fix formatting Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-06-24 19:08:54 +02:00
if( operation->is_encrypt )
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
{
Add abort call to all failure points Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 20:16:09 +02:00
status = PSA_ERROR_BAD_STATE;
goto exit;
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
}
Add abort call to all failure points Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 20:16:09 +02:00
status = psa_driver_wrapper_aead_verify( operation, plaintext,
plaintext_size,
plaintext_length,
tag, tag_length );
exit:
psa_aead_abort( operation );
return( status );
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
}
/* Abort an AEAD operation. */
Formatting fixes for psa_crypto.c Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-05-11 23:22:42 +02:00
psa_status_t psa_aead_abort( psa_aead_operation_t *operation )
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
{
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
if( operation->id == 0 )
{
/* The object has (apparently) been initialized but it is not (yet)
* in use. It's ok to call abort on such an object, and there's
* nothing to do. */
return( PSA_SUCCESS );
}
status = psa_driver_wrapper_aead_abort( operation );
Change sizeof to variable rather than struct Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-09-22 18:12:16 +02:00
memset( operation, 0, sizeof( *operation ) );
Implement multipart AEAD PSA interface Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2021-04-20 19:10:30 +02:00
return( status );
}
Implement psa_generate_random
2018-06-19 22:00:52 +02:00
/****************************************************************/
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
/* Generators */
/****************************************************************/
Adapt macro name to meet requested criteria: MBEDTLS_PSA_BUILTIN_ALG_ANY_HKDF->BUILTIN_ALG_ANY_HKDF Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-10 12:59:51 +02:00
#if defined(BUILTIN_ALG_ANY_HKDF) || \
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
Add an EC J-PAKE KDF to transform K -> SHA256(K.X) for TLS 1.2 TLS uses it to derive the session secret. The algorithm takes a serialized point in an uncompressed form, extracts the X coordinate and computes SHA256 of it. It is only expected to work with P-256. Fixes #5978. Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-07-29 16:00:16 +02:00
defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
#define AT_LEAST_ONE_BUILTIN_KDF
Code flow and style improvements Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-05-06 17:58:36 +02:00
#endif /* At least one builtin KDF */
Adapt macro name to meet requested criteria: MBEDTLS_PSA_BUILTIN_ALG_ANY_HKDF->BUILTIN_ALG_ANY_HKDF Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-10 12:59:51 +02:00
#if defined(BUILTIN_ALG_ANY_HKDF) || \
Code flow and style improvements Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-05-06 17:58:36 +02:00
defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
static psa_status_t psa_key_derivation_start_hmac(
psa_mac_operation_t *operation,
psa_algorithm_t hash_alg,
const uint8_t *hmac_key,
size_t hmac_key_length )
{
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
psa_set_key_type( &attributes, PSA_KEY_TYPE_HMAC );
psa_set_key_bits( &attributes, PSA_BYTES_TO_BITS( hmac_key_length ) );
psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_SIGN_HASH );
Move is_sign and mac_size checking back to PSA core scope It makes sense to do the length checking in the core rather than expect each driver to deal with it themselves. This puts the onus on the core to dictate which algorithm/key combinations are valid before calling a driver. Additionally, this commit also updates the psa_mac_sign_finish function to better deal with output buffer sanitation, as per the review comments on #4247. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-05-07 14:14:37 +02:00
operation->is_sign = 1;
operation->mac_size = PSA_HASH_LENGTH( hash_alg );
Code flow and style improvements Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-05-06 17:58:36 +02:00
status = psa_driver_wrapper_mac_sign_setup( operation,
&attributes,
hmac_key, hmac_key_length,
PSA_ALG_HMAC( hash_alg ) );
psa_reset_key_attributes( &attributes );
return( status );
}
#endif /* KDF algorithms reliant on HMAC */
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
#define HKDF_STATE_INIT 0 /* no input yet */
#define HKDF_STATE_STARTED 1 /* got salt */
#define HKDF_STATE_KEYED 2 /* got key */
#define HKDF_STATE_OUTPUT 3 /* output started */
Rename generator-related internal identifiers perl -pe 's/crypto_generator/key_derivation/gi' $(git ls-files) perl -pe 's/_generator/_key_derivation/gi' $(git ls-files)
2019-05-16 16:59:18 +02:00
static psa_algorithm_t psa_key_derivation_get_kdf_alg(
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
const psa_key_derivation_operation_t *operation )
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 15:53:06 +01:00
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
if ( PSA_ALG_IS_KEY_AGREEMENT( operation->alg ) )
return( PSA_ALG_KEY_AGREEMENT_GET_KDF( operation->alg ) );
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 15:53:06 +01:00
else
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
return( operation->alg );
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 15:53:06 +01:00
}
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
psa_status_t psa_key_derivation_abort( psa_key_derivation_operation_t *operation )
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
{
psa_status_t status = PSA_SUCCESS;
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg( operation );
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 15:53:06 +01:00
if( kdf_alg == 0 )
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
{
/* The object has (apparently) been initialized but it is not
* in use. It's ok to call abort on such an object, and there's
* nothing to do. */
}
else
Adapt macro name to meet requested criteria: MBEDTLS_PSA_BUILTIN_ALG_ANY_HKDF->BUILTIN_ALG_ANY_HKDF Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-10 12:59:51 +02:00
#if defined(BUILTIN_ALG_ANY_HKDF)
Optimize code by adding PSA_ALG_IS_ANY_HKDF macro Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-02 11:37:03 +02:00
if( PSA_ALG_IS_ANY_HKDF( kdf_alg ) )
Implement HKDF
2018-07-12 17:22:21 +02:00
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
mbedtls_free( operation->ctx.hkdf.info );
Make HKDF use the generic MAC API Such that the underlying HMAC can be accelerated if such a driver is present Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-29 19:11:25 +02:00
status = psa_mac_abort( &operation->ctx.hkdf.hmac );
Implement HKDF
2018-07-12 17:22:21 +02:00
}
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
else
Adapt macro name to meet requested criteria: MBEDTLS_PSA_BUILTIN_ALG_ANY_HKDF->BUILTIN_ALG_ANY_HKDF Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-10 12:59:51 +02:00
#endif /* BUILTIN_ALG_ANY_HKDF */
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
/* TLS-1.2 PSK-to-MS KDF uses the same core as TLS-1.2 PRF */
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 15:53:06 +01:00
PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
Add implementation of TLS-1.2 PRF
2018-10-09 18:33:01 +02:00
{
Base the PSA implementation of TLS 1.2 PRF on the MAC API This means there is no longer a need to have an internal HMAC API, so it is being removed in this commit as well. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-29 19:32:25 +02:00
if( operation->ctx.tls12_prf.secret != NULL )
{
mbedtls_platform_zeroize( operation->ctx.tls12_prf.secret,
operation->ctx.tls12_prf.secret_length );
mbedtls_free( operation->ctx.tls12_prf.secret );
}
Adapt psa_key_derivation_abort to the new context
2019-06-11 11:37:28 +02:00
if( operation->ctx.tls12_prf.seed != NULL )
Add implementation of TLS-1.2 PRF
2018-10-09 18:33:01 +02:00
{
Adapt psa_key_derivation_abort to the new context
2019-06-11 11:37:28 +02:00
mbedtls_platform_zeroize( operation->ctx.tls12_prf.seed,
operation->ctx.tls12_prf.seed_length );
mbedtls_free( operation->ctx.tls12_prf.seed );
Add implementation of TLS-1.2 PRF
2018-10-09 18:33:01 +02:00
}
Dynamically allocate `A(i) + seed` buffer for TLS-1.2 PRF
2018-11-13 21:50:45 +01:00
Adapt psa_key_derivation_abort to the new context
2019-06-11 11:37:28 +02:00
if( operation->ctx.tls12_prf.label != NULL )
Dynamically allocate `A(i) + seed` buffer for TLS-1.2 PRF
2018-11-13 21:50:45 +01:00
{
Adapt psa_key_derivation_abort to the new context
2019-06-11 11:37:28 +02:00
mbedtls_platform_zeroize( operation->ctx.tls12_prf.label,
operation->ctx.tls12_prf.label_length );
mbedtls_free( operation->ctx.tls12_prf.label );
Dynamically allocate `A(i) + seed` buffer for TLS-1.2 PRF
2018-11-13 21:50:45 +01:00
}
Adapt psa_key_derivation_abort to the new context
2019-06-11 11:37:28 +02:00
Free other secret in tls12_prf context Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-04-07 14:29:56 +02:00
if( operation->ctx.tls12_prf.other_secret != NULL )
{
mbedtls_platform_zeroize( operation->ctx.tls12_prf.other_secret,
operation->ctx.tls12_prf.other_secret_length );
mbedtls_free( operation->ctx.tls12_prf.other_secret );
}
Base the PSA implementation of TLS 1.2 PRF on the MAC API This means there is no longer a need to have an internal HMAC API, so it is being removed in this commit as well. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-29 19:32:25 +02:00
status = PSA_SUCCESS;
Adapt psa_key_derivation_abort to the new context
2019-06-11 11:37:28 +02:00
/* We leave the fields Ai and output_block to be erased safely by the
* mbedtls_platform_zeroize() in the end of this function. */
Add implementation of TLS-1.2 PRF
2018-10-09 18:33:01 +02:00
}
Implement HKDF
2018-07-12 17:22:21 +02:00
else
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) ||
* defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) */
Add an EC J-PAKE KDF to transform K -> SHA256(K.X) for TLS 1.2 TLS uses it to derive the session secret. The algorithm takes a serialized point in an uncompressed form, extracts the X coordinate and computes SHA256 of it. It is only expected to work with P-256. Fixes #5978. Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-07-29 16:00:16 +02:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Remove `PSA_ALG_IS_TLS12_ECJPAKE_TO_PMS` Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-09-16 13:24:14 +02:00
if( kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS )
Add an EC J-PAKE KDF to transform K -> SHA256(K.X) for TLS 1.2 TLS uses it to derive the session secret. The algorithm takes a serialized point in an uncompressed form, extracts the X coordinate and computes SHA256 of it. It is only expected to work with P-256. Fixes #5978. Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-07-29 16:00:16 +02:00
{
mbedtls_platform_zeroize( operation->ctx.tls12_ecjpake_to_pms.data,
Improve readability and formatting Also use a sizeof instead of a constant for zeroization, as requested in review. Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-09-26 16:49:16 +02:00
sizeof( operation->ctx.tls12_ecjpake_to_pms.data ) );
Add an EC J-PAKE KDF to transform K -> SHA256(K.X) for TLS 1.2 TLS uses it to derive the session secret. The algorithm takes a serialized point in an uncompressed form, extracts the X coordinate and computes SHA256 of it. It is only expected to work with P-256. Fixes #5978. Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-07-29 16:00:16 +02:00
}
else
#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) */
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
{
status = PSA_ERROR_BAD_STATE;
}
Safely erase key material upon abort Some key derivation operation contexts (like psa_tls12_prf_key_derivation_t) directly contain buffers with parts of the derived key. Erase them safely as part of the abort.
2019-06-11 11:22:26 +02:00
mbedtls_platform_zeroize( operation, sizeof( *operation ) );
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
return( status );
}
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
psa_status_t psa_key_derivation_get_capacity(const psa_key_derivation_operation_t *operation,
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
size_t *capacity)
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
if( operation->alg == 0 )
psa: Check generator validity before read Check generator validity (i.e. that alg has been initialized) before allowing reads from the generator or allowing reads of the generator's capacity. This aligns our implementation with the documented error code behavior in our crypto.h and the PSA Crypto API.
2019-02-15 14:05:49 +01:00
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
/* This is a blank key derivation operation. */
Style fixes * return is treated as a function call * space between opening and closing parentheses * remove whiteline between assignment and checking of same variable Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-05 15:43:42 +02:00
return( PSA_ERROR_BAD_STATE );
psa: Check generator validity before read Check generator validity (i.e. that alg has been initialized) before allowing reads from the generator or allowing reads of the generator's capacity. This aligns our implementation with the documented error code behavior in our crypto.h and the PSA Crypto API.
2019-02-15 14:05:49 +01:00
}
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
*capacity = operation->capacity;
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
return( PSA_SUCCESS );
}
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
psa_status_t psa_key_derivation_set_capacity( psa_key_derivation_operation_t *operation,
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
size_t capacity )
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
if( operation->alg == 0 )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
return( PSA_ERROR_BAD_STATE );
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
if( capacity > operation->capacity )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
return( PSA_ERROR_INVALID_ARGUMENT );
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
operation->capacity = capacity;
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
return( PSA_SUCCESS );
}
Adapt macro name to meet requested criteria: MBEDTLS_PSA_BUILTIN_ALG_ANY_HKDF->BUILTIN_ALG_ANY_HKDF Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-10 12:59:51 +02:00
#if defined(BUILTIN_ALG_ANY_HKDF)
Refacor code for HKDF-Extract algorithm Solution provided by @mpg. Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-05-19 11:45:20 +02:00
/* Read some bytes from an HKDF-based operation. */
Rename generator-related internal identifiers perl -pe 's/crypto_generator/key_derivation/gi' $(git ls-files) perl -pe 's/_generator/_key_derivation/gi' $(git ls-files)
2019-05-16 16:59:18 +02:00
static psa_status_t psa_key_derivation_hkdf_read( psa_hkdf_key_derivation_t *hkdf,
PSA: Add support for HKDF-Extend and HKDF-Expand algs Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-05-10 13:53:33 +02:00
psa_algorithm_t kdf_alg,
Make HKDF use the generic MAC API Such that the underlying HMAC can be accelerated if such a driver is present Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-29 19:11:25 +02:00
uint8_t *output,
size_t output_length )
Implement HKDF
2018-07-12 17:22:21 +02:00
{
PSA: Add support for HKDF-Extend and HKDF-Expand algs Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-05-10 13:53:33 +02:00
psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( kdf_alg );
Rename output buffer size macros Rename existing support macros for output buffer sizes for PSA Crypto API 1.0.0 Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-12-18 14:23:51 +01:00
uint8_t hash_length = PSA_HASH_LENGTH( hash_alg );
Make HKDF use the generic MAC API Such that the underlying HMAC can be accelerated if such a driver is present Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-29 19:11:25 +02:00
size_t hmac_output_length;
Implement HKDF
2018-07-12 17:22:21 +02:00
psa_status_t status;
Add PSA_WANT_ALG_HKDF_EXPAND, PSA_WANT_ALG_HKDF_EXTRACT, adapt code and dependencies Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-03 14:05:07 +02:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Refacor code for HKDF-Extract algorithm Solution provided by @mpg. Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-05-19 11:45:20 +02:00
const uint8_t last_block = PSA_ALG_IS_HKDF_EXTRACT( kdf_alg ) ? 0 : 0xff;
Add PSA_WANT_ALG_HKDF_EXPAND, PSA_WANT_ALG_HKDF_EXTRACT, adapt code and dependencies Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-03 14:05:07 +02:00
#else
const uint8_t last_block = 0xff;
#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Implement HKDF
2018-07-12 17:22:21 +02:00
PSA: Add support for HKDF-Extend and HKDF-Expand algs Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-05-10 13:53:33 +02:00
if( hkdf->state < HKDF_STATE_KEYED ||
Add PSA_WANT_ALG_HKDF_EXPAND, PSA_WANT_ALG_HKDF_EXTRACT, adapt code and dependencies Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-03 14:05:07 +02:00
( !hkdf->info_set
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
&& !PSA_ALG_IS_HKDF_EXTRACT( kdf_alg )
#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
) )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
return( PSA_ERROR_BAD_STATE );
hkdf->state = HKDF_STATE_OUTPUT;
Implement HKDF
2018-07-12 17:22:21 +02:00
while( output_length != 0 )
{
/* Copy what remains of the current block */
uint8_t n = hash_length - hkdf->offset_in_block;
if( n > output_length )
n = (uint8_t) output_length;
memcpy( output, hkdf->output_block + hkdf->offset_in_block, n );
output += n;
output_length -= n;
hkdf->offset_in_block += n;
HKDF: be more robust if we reach the maximum ouptut length In psa_generator_hkdf_read, return BAD_STATE if we're trying to construct more output than the algorithm allows. This can't happen through the API due to the capacity limit, but it could potentially happen in an internal call. Also add a test case that verifies that we can set up HKDF with its maximum capacity and read up to the maximum capacity.
2018-07-17 21:06:59 +02:00
if( output_length == 0 )
Implement HKDF
2018-07-12 17:22:21 +02:00
break;
Refacor code for HKDF-Extract algorithm Solution provided by @mpg. Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-05-19 11:45:20 +02:00
/* We can't be wanting more output after the last block, otherwise
Rename generator functions to psa_key_derivation_xxx Generators are mostly about key derivation (currently: only about key derivation). "Generator" is not a commonly used term in cryptography. So favor "derivation" as terminology. Call a generator a key derivation operation structure, since it behaves like other multipart operation structures. Furthermore, the function names are not fully consistent. In this commit, I rename the functions to consistently have the prefix "psa_key_derivation_". I used the following command: perl -i -pe '%t = ( psa_crypto_generator_t => "psa_key_derivation_operation_t", psa_crypto_generator_init => "psa_key_derivation_init", psa_key_derivation_setup => "psa_key_derivation_setup", psa_key_derivation_input_key => "psa_key_derivation_input_key", psa_key_derivation_input_bytes => "psa_key_derivation_input_bytes", psa_key_agreement => "psa_key_derivation_key_agreement", psa_set_generator_capacity => "psa_key_derivation_set_capacity", psa_get_generator_capacity => "psa_key_derivation_get_capacity", psa_generator_read => "psa_key_derivation_output_bytes", psa_generate_derived_key => "psa_key_derivation_output_key", psa_generator_abort => "psa_key_derivation_abort", PSA_CRYPTO_GENERATOR_INIT => "PSA_KEY_DERIVATION_OPERATION_INIT", PSA_GENERATOR_UNBRIDLED_CAPACITY => "PSA_KEY_DERIVATION_UNLIMITED_CAPACITY", ); s/\b(@{[join("|", keys %t)]})\b/$t{$1}/ge' $(git ls-files)
2019-05-16 15:28:51 +02:00
* the capacity check in psa_key_derivation_output_bytes() would have
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
* prevented this call. It could happen only if the operation
HKDF: be more robust if we reach the maximum ouptut length In psa_generator_hkdf_read, return BAD_STATE if we're trying to construct more output than the algorithm allows. This can't happen through the API due to the capacity limit, but it could potentially happen in an internal call. Also add a test case that verifies that we can set up HKDF with its maximum capacity and read up to the maximum capacity.
2018-07-17 21:06:59 +02:00
* object was corrupted or if this function is called directly
* inside the library. */
Refacor code for HKDF-Extract algorithm Solution provided by @mpg. Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-05-19 11:45:20 +02:00
if( hkdf->block_number == last_block )
HKDF: be more robust if we reach the maximum ouptut length In psa_generator_hkdf_read, return BAD_STATE if we're trying to construct more output than the algorithm allows. This can't happen through the API due to the capacity limit, but it could potentially happen in an internal call. Also add a test case that verifies that we can set up HKDF with its maximum capacity and read up to the maximum capacity.
2018-07-17 21:06:59 +02:00
return( PSA_ERROR_BAD_STATE );
Implement HKDF
2018-07-12 17:22:21 +02:00
/* We need a new block */
++hkdf->block_number;
hkdf->offset_in_block = 0;
Make HKDF use the generic MAC API Such that the underlying HMAC can be accelerated if such a driver is present Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-29 19:11:25 +02:00
Code flow and style improvements Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-05-06 17:58:36 +02:00
status = psa_key_derivation_start_hmac( &hkdf->hmac,
hash_alg,
hkdf->prk,
hash_length );
Implement HKDF
2018-07-12 17:22:21 +02:00
if( status != PSA_SUCCESS )
return( status );
Make HKDF use the generic MAC API Such that the underlying HMAC can be accelerated if such a driver is present Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-29 19:11:25 +02:00
Implement HKDF
2018-07-12 17:22:21 +02:00
if( hkdf->block_number != 1 )
{
Make HKDF use the generic MAC API Such that the underlying HMAC can be accelerated if such a driver is present Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-29 19:11:25 +02:00
status = psa_mac_update( &hkdf->hmac,
hkdf->output_block,
hash_length );
Implement HKDF
2018-07-12 17:22:21 +02:00
if( status != PSA_SUCCESS )
return( status );
}
Make HKDF use the generic MAC API Such that the underlying HMAC can be accelerated if such a driver is present Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-29 19:11:25 +02:00
status = psa_mac_update( &hkdf->hmac,
hkdf->info,
hkdf->info_length );
Implement HKDF
2018-07-12 17:22:21 +02:00
if( status != PSA_SUCCESS )
return( status );
Make HKDF use the generic MAC API Such that the underlying HMAC can be accelerated if such a driver is present Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-29 19:11:25 +02:00
status = psa_mac_update( &hkdf->hmac,
&hkdf->block_number, 1 );
Implement HKDF
2018-07-12 17:22:21 +02:00
if( status != PSA_SUCCESS )
return( status );
Make HKDF use the generic MAC API Such that the underlying HMAC can be accelerated if such a driver is present Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-29 19:11:25 +02:00
status = psa_mac_sign_finish( &hkdf->hmac,
hkdf->output_block,
sizeof( hkdf->output_block ),
&hmac_output_length );
Implement HKDF
2018-07-12 17:22:21 +02:00
if( status != PSA_SUCCESS )
return( status );
}
return( PSA_SUCCESS );
}
Adapt macro name to meet requested criteria: MBEDTLS_PSA_BUILTIN_ALG_ANY_HKDF->BUILTIN_ALG_ANY_HKDF Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-10 12:59:51 +02:00
#endif /* BUILTIN_ALG_ANY_HKDF */
Add implementation of TLS-1.2 PRF
2018-10-09 18:33:01 +02:00
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Add stub for new tls12_prf_generate_next_block
2019-06-17 13:58:10 +02:00
static psa_status_t psa_key_derivation_tls12_prf_generate_next_block(
psa_tls12_prf_key_derivation_t *tls12_prf,
psa_algorithm_t alg )
{
psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( alg );
Rename output buffer size macros Rename existing support macros for output buffer sizes for PSA Crypto API 1.0.0 Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-12-18 14:23:51 +01:00
uint8_t hash_length = PSA_HASH_LENGTH( hash_alg );
Base the PSA implementation of TLS 1.2 PRF on the MAC API This means there is no longer a need to have an internal HMAC API, so it is being removed in this commit as well. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-29 19:32:25 +02:00
psa_mac_operation_t hmac = PSA_MAC_OPERATION_INIT;
size_t hmac_output_length;
Add tls12_prf key derivation to the new API The TLS 1.2 pseudorandom function does a lot of distinct HMAC operations with the same key. To save the battery and CPU cycles spent on calculating the paddings and hashing the inner padding, we keep the hash context in the status right after the inner padding having been hashed and clone it as needed.
2019-06-19 13:21:20 +02:00
psa_status_t status, cleanup_status;
Add implementation of TLS-1.2 PRF
2018-10-09 18:33:01 +02:00
Add stub for new tls12_prf_generate_next_block
2019-06-17 13:58:10 +02:00
/* We can't be wanting more output after block 0xff, otherwise
* the capacity check in psa_key_derivation_output_bytes() would have
* prevented this call. It could happen only if the operation
* object was corrupted or if this function is called directly
* inside the library. */
if( tls12_prf->block_number == 0xff )
Fix error code PSA_ERROR_BAD_STATE means that the function was called on a context in a bad state. This error is something that can't happen while only using the PSA API and therefore a PSA_ERROR_CORRUPTION_DETECTED is a more appropriate error code.
2019-06-25 11:15:04 +02:00
return( PSA_ERROR_CORRUPTION_DETECTED );
Add stub for new tls12_prf_generate_next_block
2019-06-17 13:58:10 +02:00
/* We need a new block */
++tls12_prf->block_number;
Add tls12_prf_read for the new API Technically we could have reused the old one for the new API, but then we had to set an extra field during setup. The new version works when all the fields that haven't been set explicitely are zero-initialised.
2019-06-19 13:10:49 +02:00
tls12_prf->left_in_block = hash_length;
Add stub for new tls12_prf_generate_next_block
2019-06-17 13:58:10 +02:00
/* Recall the definition of the TLS-1.2-PRF from RFC 5246:
*
* PRF(secret, label, seed) = P_<hash>(secret, label + seed)
*
* P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
* HMAC_hash(secret, A(2) + seed) +
* HMAC_hash(secret, A(3) + seed) + ...
*
* A(0) = seed
Add tls12_prf key derivation to the new API The TLS 1.2 pseudorandom function does a lot of distinct HMAC operations with the same key. To save the battery and CPU cycles spent on calculating the paddings and hashing the inner padding, we keep the hash context in the status right after the inner padding having been hashed and clone it as needed.
2019-06-19 13:21:20 +02:00
* A(i) = HMAC_hash(secret, A(i-1))
Add stub for new tls12_prf_generate_next_block
2019-06-17 13:58:10 +02:00
*
Add tls12_prf key derivation to the new API The TLS 1.2 pseudorandom function does a lot of distinct HMAC operations with the same key. To save the battery and CPU cycles spent on calculating the paddings and hashing the inner padding, we keep the hash context in the status right after the inner padding having been hashed and clone it as needed.
2019-06-19 13:21:20 +02:00
* The `psa_tls12_prf_key_derivation` structure saves the block
Add stub for new tls12_prf_generate_next_block
2019-06-17 13:58:10 +02:00
* `HMAC_hash(secret, A(i) + seed)` from which the output
Clarify TLS PRF algorithm description
2019-06-26 13:50:36 +02:00
* is currently extracted as `output_block` and where i is
* `block_number`.
Add stub for new tls12_prf_generate_next_block
2019-06-17 13:58:10 +02:00
*/
Code flow and style improvements Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-05-06 17:58:36 +02:00
status = psa_key_derivation_start_hmac( &hmac,
hash_alg,
tls12_prf->secret,
tls12_prf->secret_length );
Add tls12_prf key derivation to the new API The TLS 1.2 pseudorandom function does a lot of distinct HMAC operations with the same key. To save the battery and CPU cycles spent on calculating the paddings and hashing the inner padding, we keep the hash context in the status right after the inner padding having been hashed and clone it as needed.
2019-06-19 13:21:20 +02:00
if( status != PSA_SUCCESS )
goto cleanup;
/* Calculate A(i) where i = tls12_prf->block_number. */
if( tls12_prf->block_number == 1 )
{
/* A(1) = HMAC_hash(secret, A(0)), where A(0) = seed. (The RFC overloads
* the variable seed and in this instance means it in the context of the
* P_hash function, where seed = label + seed.) */
Base the PSA implementation of TLS 1.2 PRF on the MAC API This means there is no longer a need to have an internal HMAC API, so it is being removed in this commit as well. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-29 19:32:25 +02:00
status = psa_mac_update( &hmac,
tls12_prf->label,
tls12_prf->label_length );
Add tls12_prf key derivation to the new API The TLS 1.2 pseudorandom function does a lot of distinct HMAC operations with the same key. To save the battery and CPU cycles spent on calculating the paddings and hashing the inner padding, we keep the hash context in the status right after the inner padding having been hashed and clone it as needed.
2019-06-19 13:21:20 +02:00
if( status != PSA_SUCCESS )
goto cleanup;
Base the PSA implementation of TLS 1.2 PRF on the MAC API This means there is no longer a need to have an internal HMAC API, so it is being removed in this commit as well. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-29 19:32:25 +02:00
status = psa_mac_update( &hmac,
tls12_prf->seed,
tls12_prf->seed_length );
Add tls12_prf key derivation to the new API The TLS 1.2 pseudorandom function does a lot of distinct HMAC operations with the same key. To save the battery and CPU cycles spent on calculating the paddings and hashing the inner padding, we keep the hash context in the status right after the inner padding having been hashed and clone it as needed.
2019-06-19 13:21:20 +02:00
if( status != PSA_SUCCESS )
goto cleanup;
}
else
{
/* A(i) = HMAC_hash(secret, A(i-1)) */
Base the PSA implementation of TLS 1.2 PRF on the MAC API This means there is no longer a need to have an internal HMAC API, so it is being removed in this commit as well. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-29 19:32:25 +02:00
status = psa_mac_update( &hmac, tls12_prf->Ai, hash_length );
Add tls12_prf key derivation to the new API The TLS 1.2 pseudorandom function does a lot of distinct HMAC operations with the same key. To save the battery and CPU cycles spent on calculating the paddings and hashing the inner padding, we keep the hash context in the status right after the inner padding having been hashed and clone it as needed.
2019-06-19 13:21:20 +02:00
if( status != PSA_SUCCESS )
goto cleanup;
}
Base the PSA implementation of TLS 1.2 PRF on the MAC API This means there is no longer a need to have an internal HMAC API, so it is being removed in this commit as well. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-29 19:32:25 +02:00
status = psa_mac_sign_finish( &hmac,
tls12_prf->Ai, hash_length,
&hmac_output_length );
if( hmac_output_length != hash_length )
status = PSA_ERROR_CORRUPTION_DETECTED;
Add tls12_prf key derivation to the new API The TLS 1.2 pseudorandom function does a lot of distinct HMAC operations with the same key. To save the battery and CPU cycles spent on calculating the paddings and hashing the inner padding, we keep the hash context in the status right after the inner padding having been hashed and clone it as needed.
2019-06-19 13:21:20 +02:00
if( status != PSA_SUCCESS )
goto cleanup;
/* Calculate HMAC_hash(secret, A(i) + label + seed). */
Code flow and style improvements Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-05-06 17:58:36 +02:00
status = psa_key_derivation_start_hmac( &hmac,
hash_alg,
tls12_prf->secret,
tls12_prf->secret_length );
Add tls12_prf key derivation to the new API The TLS 1.2 pseudorandom function does a lot of distinct HMAC operations with the same key. To save the battery and CPU cycles spent on calculating the paddings and hashing the inner padding, we keep the hash context in the status right after the inner padding having been hashed and clone it as needed.
2019-06-19 13:21:20 +02:00
if( status != PSA_SUCCESS )
goto cleanup;
Base the PSA implementation of TLS 1.2 PRF on the MAC API This means there is no longer a need to have an internal HMAC API, so it is being removed in this commit as well. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-29 19:32:25 +02:00
status = psa_mac_update( &hmac, tls12_prf->Ai, hash_length );
Add tls12_prf key derivation to the new API The TLS 1.2 pseudorandom function does a lot of distinct HMAC operations with the same key. To save the battery and CPU cycles spent on calculating the paddings and hashing the inner padding, we keep the hash context in the status right after the inner padding having been hashed and clone it as needed.
2019-06-19 13:21:20 +02:00
if( status != PSA_SUCCESS )
goto cleanup;
Base the PSA implementation of TLS 1.2 PRF on the MAC API This means there is no longer a need to have an internal HMAC API, so it is being removed in this commit as well. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-29 19:32:25 +02:00
status = psa_mac_update( &hmac, tls12_prf->label, tls12_prf->label_length );
Add tls12_prf key derivation to the new API The TLS 1.2 pseudorandom function does a lot of distinct HMAC operations with the same key. To save the battery and CPU cycles spent on calculating the paddings and hashing the inner padding, we keep the hash context in the status right after the inner padding having been hashed and clone it as needed.
2019-06-19 13:21:20 +02:00
if( status != PSA_SUCCESS )
goto cleanup;
Base the PSA implementation of TLS 1.2 PRF on the MAC API This means there is no longer a need to have an internal HMAC API, so it is being removed in this commit as well. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-29 19:32:25 +02:00
status = psa_mac_update( &hmac, tls12_prf->seed, tls12_prf->seed_length );
Add tls12_prf key derivation to the new API The TLS 1.2 pseudorandom function does a lot of distinct HMAC operations with the same key. To save the battery and CPU cycles spent on calculating the paddings and hashing the inner padding, we keep the hash context in the status right after the inner padding having been hashed and clone it as needed.
2019-06-19 13:21:20 +02:00
if( status != PSA_SUCCESS )
goto cleanup;
Base the PSA implementation of TLS 1.2 PRF on the MAC API This means there is no longer a need to have an internal HMAC API, so it is being removed in this commit as well. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-29 19:32:25 +02:00
status = psa_mac_sign_finish( &hmac,
tls12_prf->output_block, hash_length,
&hmac_output_length );
Add tls12_prf key derivation to the new API The TLS 1.2 pseudorandom function does a lot of distinct HMAC operations with the same key. To save the battery and CPU cycles spent on calculating the paddings and hashing the inner padding, we keep the hash context in the status right after the inner padding having been hashed and clone it as needed.
2019-06-19 13:21:20 +02:00
if( status != PSA_SUCCESS )
goto cleanup;
Add stub for new tls12_prf_generate_next_block
2019-06-17 13:58:10 +02:00
cleanup:
Base the PSA implementation of TLS 1.2 PRF on the MAC API This means there is no longer a need to have an internal HMAC API, so it is being removed in this commit as well. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-29 19:32:25 +02:00
cleanup_status = psa_mac_abort( &hmac );
Add tls12_prf key derivation to the new API The TLS 1.2 pseudorandom function does a lot of distinct HMAC operations with the same key. To save the battery and CPU cycles spent on calculating the paddings and hashing the inner padding, we keep the hash context in the status right after the inner padding having been hashed and clone it as needed.
2019-06-19 13:21:20 +02:00
if( status == PSA_SUCCESS && cleanup_status != PSA_SUCCESS )
status = cleanup_status;
return( status );
Add stub for new tls12_prf_generate_next_block
2019-06-17 13:58:10 +02:00
}
Add implementation of TLS-1.2 PRF
2018-10-09 18:33:01 +02:00
Add tls12_prf_read for the new API Technically we could have reused the old one for the new API, but then we had to set an extra field during setup. The new version works when all the fields that haven't been set explicitely are zero-initialised.
2019-06-19 13:10:49 +02:00
static psa_status_t psa_key_derivation_tls12_prf_read(
psa_tls12_prf_key_derivation_t *tls12_prf,
psa_algorithm_t alg,
uint8_t *output,
size_t output_length )
{
psa_algorithm_t hash_alg = PSA_ALG_TLS12_PRF_GET_HASH( alg );
Rename output buffer size macros Rename existing support macros for output buffer sizes for PSA Crypto API 1.0.0 Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-12-18 14:23:51 +01:00
uint8_t hash_length = PSA_HASH_LENGTH( hash_alg );
Add tls12_prf_read for the new API Technically we could have reused the old one for the new API, but then we had to set an extra field during setup. The new version works when all the fields that haven't been set explicitely are zero-initialised.
2019-06-19 13:10:49 +02:00
psa_status_t status;
uint8_t offset, length;
Fix missing state check for tls12_prf output Fix PSA_ALG_TLS12_PRF and PSA_ALG_TLS12_PSK_TO_MS being too permissive about missing inputs. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-06-11 22:41:46 +02:00
switch( tls12_prf->state )
{
case PSA_TLS12_PRF_STATE_LABEL_SET:
tls12_prf->state = PSA_TLS12_PRF_STATE_OUTPUT;
break;
case PSA_TLS12_PRF_STATE_OUTPUT:
break;
default:
return( PSA_ERROR_BAD_STATE );
}
Add tls12_prf_read for the new API Technically we could have reused the old one for the new API, but then we had to set an extra field during setup. The new version works when all the fields that haven't been set explicitely are zero-initialised.
2019-06-19 13:10:49 +02:00
while( output_length != 0 )
{
/* Check if we have fully processed the current block. */
if( tls12_prf->left_in_block == 0 )
{
status = psa_key_derivation_tls12_prf_generate_next_block( tls12_prf,
alg );
if( status != PSA_SUCCESS )
return( status );
continue;
}
if( tls12_prf->left_in_block > output_length )
length = (uint8_t) output_length;
else
length = tls12_prf->left_in_block;
offset = hash_length - tls12_prf->left_in_block;
memcpy( output, tls12_prf->output_block + offset, length );
output += length;
output_length -= length;
tls12_prf->left_in_block -= length;
}
return( PSA_SUCCESS );
}
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF ||
* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Implement HKDF
2018-07-12 17:22:21 +02:00
Add an EC J-PAKE KDF to transform K -> SHA256(K.X) for TLS 1.2 TLS uses it to derive the session secret. The algorithm takes a serialized point in an uncompressed form, extracts the X coordinate and computes SHA256 of it. It is only expected to work with P-256. Fixes #5978. Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-07-29 16:00:16 +02:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
static psa_status_t psa_key_derivation_tls12_ecjpake_to_pms_read(
psa_tls12_ecjpake_to_pms_t *ecjpake,
uint8_t *output,
size_t output_length )
{
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Improve readability and formatting Also use a sizeof instead of a constant for zeroization, as requested in review. Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-09-26 16:49:16 +02:00
size_t output_size = 0;
Add an EC J-PAKE KDF to transform K -> SHA256(K.X) for TLS 1.2 TLS uses it to derive the session secret. The algorithm takes a serialized point in an uncompressed form, extracts the X coordinate and computes SHA256 of it. It is only expected to work with P-256. Fixes #5978. Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-07-29 16:00:16 +02:00
if( output_length != 32 )
return ( PSA_ERROR_INVALID_ARGUMENT );
status = psa_hash_compute( PSA_ALG_SHA_256, ecjpake->data,
PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE, output, output_length,
&output_size );
if( status != PSA_SUCCESS )
return ( status );
if( output_size != output_length )
return ( PSA_ERROR_GENERIC_ERROR );
return ( PSA_SUCCESS );
}
#endif
Improve style
2019-06-17 13:38:20 +02:00
psa_status_t psa_key_derivation_output_bytes(
psa_key_derivation_operation_t *operation,
uint8_t *output,
size_t output_length )
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
{
psa_status_t status;
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg( operation );
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
if( operation->alg == 0 )
psa: Check generator validity before read Check generator validity (i.e. that alg has been initialized) before allowing reads from the generator or allowing reads of the generator's capacity. This aligns our implementation with the documented error code behavior in our crypto.h and the PSA Crypto API.
2019-02-15 14:05:49 +01:00
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
/* This is a blank operation. */
Style fixes * return is treated as a function call * space between opening and closing parentheses * remove whiteline between assignment and checking of same variable Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-05 15:43:42 +02:00
return( PSA_ERROR_BAD_STATE );
psa: Check generator validity before read Check generator validity (i.e. that alg has been initialized) before allowing reads from the generator or allowing reads of the generator's capacity. This aligns our implementation with the documented error code behavior in our crypto.h and the PSA Crypto API.
2019-02-15 14:05:49 +01:00
}
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
if( output_length > operation->capacity )
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
operation->capacity = 0;
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
/* Go through the error path to wipe all confidential data now
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
* that the operation object is useless. */
Replace PSA error code definitions with the ones defined in PSA spec
2019-02-14 12:48:10 +01:00
status = PSA_ERROR_INSUFFICIENT_DATA;
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
goto exit;
}
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
if( output_length == 0 && operation->capacity == 0 )
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
/* Edge case: this is a finished operation, and 0 bytes
psa: Check generator validity before read Check generator validity (i.e. that alg has been initialized) before allowing reads from the generator or allowing reads of the generator's capacity. This aligns our implementation with the documented error code behavior in our crypto.h and the PSA Crypto API.
2019-02-15 14:05:49 +01:00
* were requested. The right error in this case could
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
* be either INSUFFICIENT_CAPACITY or BAD_STATE. Return
* INSUFFICIENT_CAPACITY, which is right for a finished
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
* operation, for consistency with the case when
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
* output_length > 0. */
Replace PSA error code definitions with the ones defined in PSA spec
2019-02-14 12:48:10 +01:00
return( PSA_ERROR_INSUFFICIENT_DATA );
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
}
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
operation->capacity -= output_length;
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
Adapt macro name to meet requested criteria: MBEDTLS_PSA_BUILTIN_ALG_ANY_HKDF->BUILTIN_ALG_ANY_HKDF Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-10 12:59:51 +02:00
#if defined(BUILTIN_ALG_ANY_HKDF)
Optimize code by adding PSA_ALG_IS_ANY_HKDF macro Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-02 11:37:03 +02:00
if( PSA_ALG_IS_ANY_HKDF( kdf_alg ) )
Implement HKDF
2018-07-12 17:22:21 +02:00
{
PSA: Add support for HKDF-Extend and HKDF-Expand algs Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-05-10 13:53:33 +02:00
status = psa_key_derivation_hkdf_read( &operation->ctx.hkdf, kdf_alg,
Implement HKDF
2018-07-12 17:22:21 +02:00
output, output_length );
}
Remove the deprecated PSA_ALG_SELECT_RAW option This change affects the psa_key_derivation_s structure. With the buffer removed from the union, it is empty if MBEDTLS_MD_C is not defined. We can avoid undefined behaviour by adding a new dummy field that is always present or make the whole union conditional on MBEDTLS_MD_C. In this latter case the initialiser macro has to depend on MBEDTLS_MD_C as well. Furthermore the first structure would be either psa_hkdf_key_derivation_t or psa_tls12_prf_key_derivation_t both of which are very deep and would make the initialisation macro difficult to maintain, therefore we go with the first option.
2019-06-14 12:05:39 +02:00
else
Adapt macro name to meet requested criteria: MBEDTLS_PSA_BUILTIN_ALG_ANY_HKDF->BUILTIN_ALG_ANY_HKDF Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-10 12:59:51 +02:00
#endif /* BUILTIN_ALG_ANY_HKDF */
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Remove the deprecated PSA_ALG_SELECT_RAW option This change affects the psa_key_derivation_s structure. With the buffer removed from the union, it is empty if MBEDTLS_MD_C is not defined. We can avoid undefined behaviour by adding a new dummy field that is always present or make the whole union conditional on MBEDTLS_MD_C. In this latter case the initialiser macro has to depend on MBEDTLS_MD_C as well. Furthermore the first structure would be either psa_hkdf_key_derivation_t or psa_tls12_prf_key_derivation_t both of which are very deep and would make the initialisation macro difficult to maintain, therefore we go with the first option.
2019-06-14 12:05:39 +02:00
if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
Add implementation of TLS-1.2 PRF
2018-10-09 18:33:01 +02:00
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
status = psa_key_derivation_tls12_prf_read( &operation->ctx.tls12_prf,
Base the PSA implementation of TLS 1.2 PRF on the MAC API This means there is no longer a need to have an internal HMAC API, so it is being removed in this commit as well. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-29 19:32:25 +02:00
kdf_alg, output,
output_length );
Add implementation of TLS-1.2 PRF
2018-10-09 18:33:01 +02:00
}
Implement HKDF
2018-07-12 17:22:21 +02:00
else
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF ||
* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Add an EC J-PAKE KDF to transform K -> SHA256(K.X) for TLS 1.2 TLS uses it to derive the session secret. The algorithm takes a serialized point in an uncompressed form, extracts the X coordinate and computes SHA256 of it. It is only expected to work with P-256. Fixes #5978. Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-07-29 16:00:16 +02:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Remove `PSA_ALG_IS_TLS12_ECJPAKE_TO_PMS` Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-09-16 13:24:14 +02:00
if( kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS )
Add an EC J-PAKE KDF to transform K -> SHA256(K.X) for TLS 1.2 TLS uses it to derive the session secret. The algorithm takes a serialized point in an uncompressed form, extracts the X coordinate and computes SHA256 of it. It is only expected to work with P-256. Fixes #5978. Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-07-29 16:00:16 +02:00
{
status = psa_key_derivation_tls12_ecjpake_to_pms_read(
&operation->ctx.tls12_ecjpake_to_pms, output, output_length );
}
else
#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
{
Fix unused variables in PSA core when no KDF algorithm is present Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-10 17:19:22 +01:00
(void) kdf_alg;
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
return( PSA_ERROR_BAD_STATE );
}
exit:
if( status != PSA_SUCCESS )
{
psa: Check generator validity before read Check generator validity (i.e. that alg has been initialized) before allowing reads from the generator or allowing reads of the generator's capacity. This aligns our implementation with the documented error code behavior in our crypto.h and the PSA Crypto API.
2019-02-15 14:05:49 +01:00
/* Preserve the algorithm upon errors, but clear all sensitive state.
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
* This allows us to differentiate between exhausted operations and
* blank operations, so we can return PSA_ERROR_BAD_STATE on blank
* operations. */
psa_algorithm_t alg = operation->alg;
psa_key_derivation_abort( operation );
operation->alg = alg;
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
memset( output, '!', output_length );
}
return( status );
}
Use proper conditional for software DES When converting definitions to use the new PSA defines, one erroneously was conditionalized on the WANT macro instead of on the BUILTIN macro. Signed-off-by: David Brown <david.brown@linaro.org>
2021-02-10 00:28:23 +01:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Fix psa_generator_import_key for DES In psa_generator_import_key, if generating a DES or 3DES key, set the parity bits. Add tests for deriving a DES key. Also test deriving an AES key while I'm at it.
2018-07-19 17:05:42 +02:00
static void psa_des_set_key_parity( uint8_t *data, size_t data_size )
{
if( data_size >= 8 )
mbedtls_des_key_set_parity( data );
if( data_size >= 16 )
mbedtls_des_key_set_parity( data + 8 );
if( data_size >= 24 )
mbedtls_des_key_set_parity( data + 16 );
}
Use proper conditional for software DES When converting definitions to use the new PSA defines, one erroneously was conditionalized on the WANT macro instead of on the BUILTIN macro. Signed-off-by: David Brown <david.brown@linaro.org>
2021-02-10 00:28:23 +01:00
#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */
Fix psa_generator_import_key for DES In psa_generator_import_key, if generating a DES or 3DES key, set the parity bits. Add tests for deriving a DES key. Also test deriving an AES key while I'm at it.
2018-07-19 17:05:42 +02:00
Move derivation of ECC private key to helper function and refactor code Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-15 12:38:53 +01:00
/*
Only Weierstrass curves supported Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-24 08:47:29 +01:00
* ECC keys on a Weierstrass elliptic curve require the generation
* of a private key which is an integer
Move derivation of ECC private key to helper function and refactor code Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-15 12:38:53 +01:00
* in the range [1, N - 1], where N is the boundary of the private key domain:
* N is the prime p for Diffie-Hellman, or the order of the
* curve’s base point for ECC.
*
* Let m be the bit size of N, such that 2^m > N >= 2^(m-1).
* This function generates the private key using the following process:
*
* 1. Draw a byte string of length ceiling(m/8) bytes.
* 2. If m is not a multiple of 8, set the most significant
* (8 * ceiling(m/8) - m) bits of the first byte in the string to zero.
* 3. Convert the string to integer k by decoding it as a big-endian byte string.
* 4. If k > N - 2, discard the result and return to step 1.
* 5. Output k + 1 as the private key.
*
* This method allows compliance to NIST standards, specifically the methods titled
* Key-Pair Generation by Testing Candidates in the following publications:
* - NIST Special Publication 800-56A: Recommendation for Pair-Wise Key-Establishment
* Schemes Using Discrete Logarithm Cryptography [SP800-56A] §5.6.1.1.4 for
* Diffie-Hellman keys.
*
* - [SP800-56A] §5.6.1.2.2 or FIPS Publication 186-4: Digital Signature
* Standard (DSS) [FIPS186-4] §B.4.2 for elliptic curve keys.
Code optimization - fix codding style - fix comments and descriptions - add helper function for montgomery curve - move N-2 calculation outside the loop - fix access to <data> bytes: *data[x] -> (*data)[x] Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2022-02-21 08:17:43 +01:00
*
* Note: Function allocates memory for *data buffer, so given *data should be
* always NULL.
Move derivation of ECC private key to helper function and refactor code Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-15 12:38:53 +01:00
*/
Restore build options for mbedtls_ecc_group_of_psa() and related functions Additional issue created to simplifiy usage of BUILTIN_KEY_TYPE_xxx && BUILTIN_ALG_yy macros https://github.com/ARMmbed/mbedtls/issues/5596 Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-03-04 14:41:11 +01:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
Add support for Montgomery curves Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-25 13:53:28 +01:00
static psa_status_t psa_generate_derived_ecc_key_weierstrass_helper(
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 12:53:30 +02:00
psa_key_slot_t *slot,
size_t bits,
Move derivation of ECC private key to helper function and refactor code Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-15 12:38:53 +01:00
psa_key_derivation_operation_t *operation,
psa_generate_derived_key_internal, psa_generate_derived_ecc_key_weierstrass_helper: optimize the code Perform the following optimizations: - fix used flags for conditional compilation - remove redundant N variable - move loop used to generate valid k value to helper function - fix initial value of status - fix comments Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2022-01-20 22:41:17 +01:00
uint8_t **data
)
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
{
psa_generate_derived_key_internal, psa_generate_derived_ecc_key_weierstrass_helper: optimize the code Perform the following optimizations: - fix used flags for conditional compilation - remove redundant N variable - move loop used to generate valid k value to helper function - fix initial value of status - fix comments Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2022-01-20 22:41:17 +01:00
unsigned key_out_of_range = 1;
Move derivation of ECC private key to helper function and refactor code Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-15 12:38:53 +01:00
mbedtls_mpi k;
mbedtls_mpi diff_N_2;
Code optimization - fix codding style - fix comments and descriptions - add helper function for montgomery curve - move N-2 calculation outside the loop - fix access to <data> bytes: *data[x] -> (*data)[x] Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2022-02-21 08:17:43 +01:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Clean up init values of psa crypto status and fix switch default case Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-03-01 15:13:30 +01:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
Move derivation of ECC private key to helper function and refactor code Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-15 12:38:53 +01:00
mbedtls_mpi_init( &k );
mbedtls_mpi_init( &diff_N_2 );
psa_generate_derived_ecc_key_helper: compile only when ECC is supported Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-18 13:35:00 +01:00
Move derivation of ECC private key to helper function and refactor code Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-15 12:38:53 +01:00
psa_ecc_family_t curve = PSA_KEY_TYPE_ECC_GET_FAMILY(
slot->attr.type );
mbedtls_ecp_group_id grp_id =
mbedtls_ecc_group_of_psa( curve, bits, 0 );
Remove redundant psa_generate_derived_ecc_key_weierstrass_check_config() Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-12-02 08:46:39 +01:00
if( grp_id == MBEDTLS_ECP_DP_NONE )
{
Code optimization - fix codding style - fix comments and descriptions - add helper function for montgomery curve - move N-2 calculation outside the loop - fix access to <data> bytes: *data[x] -> (*data)[x] Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2022-02-21 08:17:43 +01:00
ret = MBEDTLS_ERR_ASN1_INVALID_DATA;
Remove redundant psa_generate_derived_ecc_key_weierstrass_check_config() Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-12-02 08:46:39 +01:00
goto cleanup;
}
Move derivation of ECC private key to helper function and refactor code Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-15 12:38:53 +01:00
mbedtls_ecp_group ecp_group;
psa_generate_derived_ecc_key_helper: fix bugs found during testing Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-18 11:57:07 +01:00
mbedtls_ecp_group_init( &ecp_group );
Move derivation of ECC private key to helper function and refactor code Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-15 12:38:53 +01:00
Code optimization - fix codding style - fix comments and descriptions - add helper function for montgomery curve - move N-2 calculation outside the loop - fix access to <data> bytes: *data[x] -> (*data)[x] Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2022-02-21 08:17:43 +01:00
MBEDTLS_MPI_CHK( mbedtls_ecp_group_load( &ecp_group, grp_id ) );
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
psa_generate_derived_key_internal, psa_generate_derived_ecc_key_weierstrass_helper: optimize the code Perform the following optimizations: - fix used flags for conditional compilation - remove redundant N variable - move loop used to generate valid k value to helper function - fix initial value of status - fix comments Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2022-01-20 22:41:17 +01:00
/* N is the boundary of the private key domain (ecp_group.N). */
Move derivation of ECC private key to helper function and refactor code Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-15 12:38:53 +01:00
/* Let m be the bit size of N. */
size_t m = ecp_group.nbits;
PSA: implement key derivation for ECC keys Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-09 10:46:40 +01:00
Move derivation of ECC private key to helper function and refactor code Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-15 12:38:53 +01:00
size_t m_bytes = PSA_BITS_TO_BYTES( m );
psa_generate_derived_key_internal, psa_generate_derived_ecc_key_weierstrass_helper: optimize the code Perform the following optimizations: - fix used flags for conditional compilation - remove redundant N variable - move loop used to generate valid k value to helper function - fix initial value of status - fix comments Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2022-01-20 22:41:17 +01:00
Code optimization - fix codding style - fix comments and descriptions - add helper function for montgomery curve - move N-2 calculation outside the loop - fix access to <data> bytes: *data[x] -> (*data)[x] Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2022-02-21 08:17:43 +01:00
/* Calculate N - 2 - it will be needed later. */
MBEDTLS_MPI_CHK( mbedtls_mpi_sub_int( &diff_N_2, &ecp_group.N, 2 ) );
psa_generate_derived_key_internal, psa_generate_derived_ecc_key_weierstrass_helper: optimize the code Perform the following optimizations: - fix used flags for conditional compilation - remove redundant N variable - move loop used to generate valid k value to helper function - fix initial value of status - fix comments Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2022-01-20 22:41:17 +01:00
/* Note: This function is always called with *data == NULL and it
* allocates memory for the data buffer. */
*data = mbedtls_calloc( 1, m_bytes );
Move derivation of ECC private key to helper function and refactor code Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-15 12:38:53 +01:00
if( *data == NULL )
{
Code optimization - fix codding style - fix comments and descriptions - add helper function for montgomery curve - move N-2 calculation outside the loop - fix access to <data> bytes: *data[x] -> (*data)[x] Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2022-02-21 08:17:43 +01:00
ret = MBEDTLS_ERR_ASN1_ALLOC_FAILED;
Move derivation of ECC private key to helper function and refactor code Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-15 12:38:53 +01:00
goto cleanup;
}
PSA: implement key derivation for ECC keys Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-09 10:46:40 +01:00
psa_crypto.c, test_suite_psa_crypto.function: fix style Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-03-08 11:37:54 +01:00
while( key_out_of_range )
Move derivation of ECC private key to helper function and refactor code Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-15 12:38:53 +01:00
{
psa_generate_derived_key_internal, psa_generate_derived_ecc_key_weierstrass_helper: optimize the code Perform the following optimizations: - fix used flags for conditional compilation - remove redundant N variable - move loop used to generate valid k value to helper function - fix initial value of status - fix comments Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2022-01-20 22:41:17 +01:00
/* 1. Draw a byte string of length ceiling(m/8) bytes. */
psa_crypto.c, test_suite_psa_crypto.function: fix style Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-03-08 11:37:54 +01:00
if( ( status = psa_key_derivation_output_bytes( operation, *data, m_bytes ) ) != 0 )
psa_generate_derived_key_internal, psa_generate_derived_ecc_key_weierstrass_helper: optimize the code Perform the following optimizations: - fix used flags for conditional compilation - remove redundant N variable - move loop used to generate valid k value to helper function - fix initial value of status - fix comments Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2022-01-20 22:41:17 +01:00
goto cleanup;
PSA: implement key derivation for ECC keys Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-09 10:46:40 +01:00
psa_generate_derived_key_internal, psa_generate_derived_ecc_key_weierstrass_helper: optimize the code Perform the following optimizations: - fix used flags for conditional compilation - remove redundant N variable - move loop used to generate valid k value to helper function - fix initial value of status - fix comments Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2022-01-20 22:41:17 +01:00
/* 2. If m is not a multiple of 8 */
psa_crypto.c, test_suite_psa_crypto.function: fix style Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-03-08 11:37:54 +01:00
if( m % 8 != 0 )
psa_generate_derived_key_internal, psa_generate_derived_ecc_key_weierstrass_helper: optimize the code Perform the following optimizations: - fix used flags for conditional compilation - remove redundant N variable - move loop used to generate valid k value to helper function - fix initial value of status - fix comments Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2022-01-20 22:41:17 +01:00
{
/* Set the most significant
Code optimization - fix codding style - fix comments and descriptions - add helper function for montgomery curve - move N-2 calculation outside the loop - fix access to <data> bytes: *data[x] -> (*data)[x] Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2022-02-21 08:17:43 +01:00
* (8 * ceiling(m/8) - m) bits of the first byte in
* the string to zero.
*/
uint8_t clear_bit_mask = ( 1 << ( m % 8 ) ) - 1;
(*data)[0] &= clear_bit_mask;
psa_generate_derived_key_internal, psa_generate_derived_ecc_key_weierstrass_helper: optimize the code Perform the following optimizations: - fix used flags for conditional compilation - remove redundant N variable - move loop used to generate valid k value to helper function - fix initial value of status - fix comments Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2022-01-20 22:41:17 +01:00
}
PSA: implement key derivation for ECC keys Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-09 10:46:40 +01:00
psa_generate_derived_key_internal, psa_generate_derived_ecc_key_weierstrass_helper: optimize the code Perform the following optimizations: - fix used flags for conditional compilation - remove redundant N variable - move loop used to generate valid k value to helper function - fix initial value of status - fix comments Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2022-01-20 22:41:17 +01:00
/* 3. Convert the string to integer k by decoding it as a
* big-endian byte string.
*/
Code optimization - fix codding style - fix comments and descriptions - add helper function for montgomery curve - move N-2 calculation outside the loop - fix access to <data> bytes: *data[x] -> (*data)[x] Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2022-02-21 08:17:43 +01:00
MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &k, *data, m_bytes ) );
psa_generate_derived_key_internal, psa_generate_derived_ecc_key_weierstrass_helper: optimize the code Perform the following optimizations: - fix used flags for conditional compilation - remove redundant N variable - move loop used to generate valid k value to helper function - fix initial value of status - fix comments Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2022-01-20 22:41:17 +01:00
/* 4. If k > N - 2, discard the result and return to step 1.
* Result of comparison is returned. When it indicates error
Fix additional misspellings found by codespell Remaining hits seem to be hex data, certificates, and other miscellaneous exceptions. List generated by running codespell -w -L keypair,Keypair,KeyPair,keyPair,ciph,nd Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-04-13 20:28:52 +02:00
* then this function is called again.
psa_generate_derived_key_internal, psa_generate_derived_ecc_key_weierstrass_helper: optimize the code Perform the following optimizations: - fix used flags for conditional compilation - remove redundant N variable - move loop used to generate valid k value to helper function - fix initial value of status - fix comments Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2022-01-20 22:41:17 +01:00
*/
MBEDTLS_MPI_CHK( mbedtls_mpi_lt_mpi_ct( &diff_N_2, &k, &key_out_of_range ) );
}
PSA: implement key derivation for ECC keys Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-09 10:46:40 +01:00
Move derivation of ECC private key to helper function and refactor code Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-15 12:38:53 +01:00
/* 5. Output k + 1 as the private key. */
Code optimization - fix codding style - fix comments and descriptions - add helper function for montgomery curve - move N-2 calculation outside the loop - fix access to <data> bytes: *data[x] -> (*data)[x] Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2022-02-21 08:17:43 +01:00
MBEDTLS_MPI_CHK( mbedtls_mpi_add_int( &k, &k, 1 ) );
MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &k, *data, m_bytes ) );
Move derivation of ECC private key to helper function and refactor code Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-15 12:38:53 +01:00
cleanup:
Code optimization - fix codding style - fix comments and descriptions - add helper function for montgomery curve - move N-2 calculation outside the loop - fix access to <data> bytes: *data[x] -> (*data)[x] Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2022-02-21 08:17:43 +01:00
if( ret != 0 )
fix mbedtls/psa status code mismatch Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-12-02 09:15:20 +01:00
status = mbedtls_to_psa_error( ret );
psa_crypto.c, test_suite_psa_crypto.function: fix style Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-03-08 11:37:54 +01:00
if( status != PSA_SUCCESS ) {
Move derivation of ECC private key to helper function and refactor code Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-15 12:38:53 +01:00
mbedtls_free( *data );
*data = NULL;
}
mbedtls_mpi_free( &k );
mbedtls_mpi_free( &diff_N_2 );
fix mbedtls/psa status code mismatch Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-12-02 09:15:20 +01:00
return( status );
Move derivation of ECC private key to helper function and refactor code Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-15 12:38:53 +01:00
}
Code optimization - fix codding style - fix comments and descriptions - add helper function for montgomery curve - move N-2 calculation outside the loop - fix access to <data> bytes: *data[x] -> (*data)[x] Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2022-02-21 08:17:43 +01:00
/* ECC keys on a Montgomery elliptic curve draws a byte string whose length
* is determined by the curve, and sets the mandatory bits accordingly. That is:
*
* - Curve25519 (PSA_ECC_FAMILY_MONTGOMERY, 255 bits):
* draw a 32-byte string and process it as specified in
* Elliptic Curves for Security [RFC7748] §5.
*
* - Curve448 (PSA_ECC_FAMILY_MONTGOMERY, 448 bits):
* draw a 56-byte string and process it as specified in [RFC7748] §5.
*
* Note: Function allocates memory for *data buffer, so given *data should be
* always NULL.
*/
static psa_status_t psa_generate_derived_ecc_key_montgomery_helper(
size_t bits,
psa_key_derivation_operation_t *operation,
uint8_t **data
)
{
size_t output_length;
Clean up init values of psa crypto status and fix switch default case Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-03-01 15:13:30 +01:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Code optimization - fix codding style - fix comments and descriptions - add helper function for montgomery curve - move N-2 calculation outside the loop - fix access to <data> bytes: *data[x] -> (*data)[x] Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2022-02-21 08:17:43 +01:00
switch( bits )
{
case 255:
output_length = 32;
break;
case 448:
output_length = 56;
break;
default:
return( PSA_ERROR_INVALID_ARGUMENT );
break;
}
*data = mbedtls_calloc( 1, output_length );
if( *data == NULL )
return( PSA_ERROR_INSUFFICIENT_MEMORY );
status = psa_key_derivation_output_bytes( operation, *data, output_length );
if( status != PSA_SUCCESS )
return status;
switch( bits )
{
case 255:
(*data)[0] &= 248;
(*data)[31] &= 127;
(*data)[31] |= 64;
break;
case 448:
(*data)[0] &= 252;
(*data)[55] |= 128;
break;
default:
Clean up init values of psa crypto status and fix switch default case Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-03-01 15:13:30 +01:00
return( PSA_ERROR_CORRUPTION_DETECTED );
Code optimization - fix codding style - fix comments and descriptions - add helper function for montgomery curve - move N-2 calculation outside the loop - fix access to <data> bytes: *data[x] -> (*data)[x] Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2022-02-21 08:17:43 +01:00
break;
}
return status;
}
Restore build options for mbedtls_ecc_group_of_psa() and related functions Additional issue created to simplifiy usage of BUILTIN_KEY_TYPE_xxx && BUILTIN_ALG_yy macros https://github.com/ARMmbed/mbedtls/issues/5596 Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-03-04 14:41:11 +01:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) ||
defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) ||
defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH) */
PSA: implement key derivation for ECC keys Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-09 10:46:40 +01:00
Rename psa_generate_key() and psa_generator_import_key()
2019-05-03 16:44:28 +02:00
static psa_status_t psa_generate_derived_key_internal(
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 12:53:30 +02:00
psa_key_slot_t *slot,
size_t bits,
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
psa_key_derivation_operation_t *operation )
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
{
uint8_t *data = NULL;
size_t bytes = PSA_BITS_TO_BYTES( bits );
Sizing of key buffer for opaque keys Create a new sizing function for determining the size required for key storage based on the input key data. This is required for key imports where the key length might need to be derived from the data. Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-06-14 06:34:16 +02:00
size_t storage_size = bytes;
Clean up init values of psa crypto status and fix switch default case Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-03-01 15:13:30 +01:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
Return PSA_ERROR_INVALID_ARGUMENT for a public key, and PSA_ERROR_NOT_SUPPORTED for a type that is not handled. Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-03-01 14:22:29 +01:00
if( PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->attr.type ) )
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
return( PSA_ERROR_INVALID_ARGUMENT );
Restore build options for mbedtls_ecc_group_of_psa() and related functions Additional issue created to simplifiy usage of BUILTIN_KEY_TYPE_xxx && BUILTIN_ALG_yy macros https://github.com/ARMmbed/mbedtls/issues/5596 Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-03-04 14:41:11 +01:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
psa_crypto.c, test_suite_psa_crypto.function: fix style Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-03-08 11:37:54 +01:00
if( PSA_KEY_TYPE_IS_ECC( slot->attr.type ) )
Move derivation of ECC private key to helper function and refactor code Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-15 12:38:53 +01:00
{
Workaround for VS compiler build error The following error was reported by CI for win32/release builds: 37>Done Building Project "C:\builds\workspace\mbed-tls-pr-head_PR-5139-head\worktrees\tmp_nn5muy8\visualc\VS2010\gen_entropy.vcxproj.metaproj" (Rebuild target(s)). 67>c:\builds\workspace\mbed-tls-pr-head_pr-5139-head\worktrees\tmp_nn5muy8\library\psa_crypto.c(4840): fatal error C1001: An internal error has occurred in the compiler. [C:\builds\workspace\mbed-tls-pr-head_PR-5139-head\worktrees\tmp_nn5muy8\visualc\VS2010\key_ladder_demo.vcxproj] (compiler file 'f:\dd\vctools\compiler\utc\src\p2\main.c', line 228) To work around this problem, try simplifying or changing the program near the locations listed above. Please choose the Technical Support command on the Visual C++ Help menu, or open the Technical Support help file for more information Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2022-01-04 10:09:46 +01:00
psa_ecc_family_t curve = PSA_KEY_TYPE_ECC_GET_FAMILY( slot->attr.type );
psa_crypto.c, test_suite_psa_crypto.function: fix style Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-03-08 11:37:54 +01:00
if( PSA_ECC_FAMILY_IS_WEIERSTRASS( curve ) )
Add support for Montgomery curves Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-25 13:53:28 +01:00
{
/* Weierstrass elliptic curve */
Code optimization - fix codding style - fix comments and descriptions - add helper function for montgomery curve - move N-2 calculation outside the loop - fix access to <data> bytes: *data[x] -> (*data)[x] Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2022-02-21 08:17:43 +01:00
status = psa_generate_derived_ecc_key_weierstrass_helper( slot, bits, operation, &data );
psa_generate_derived_key_internal, psa_generate_derived_ecc_key_weierstrass_helper: optimize the code Perform the following optimizations: - fix used flags for conditional compilation - remove redundant N variable - move loop used to generate valid k value to helper function - fix initial value of status - fix comments Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2022-01-20 22:41:17 +01:00
if( status != PSA_SUCCESS )
goto exit;
Add Weierstrass curve/bits consistancy check + negative test vectors Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-26 10:54:52 +01:00
}
else
Add support for Montgomery curves Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-25 13:53:28 +01:00
{
/* Montgomery elliptic curve */
Code optimization - fix codding style - fix comments and descriptions - add helper function for montgomery curve - move N-2 calculation outside the loop - fix access to <data> bytes: *data[x] -> (*data)[x] Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2022-02-21 08:17:43 +01:00
status = psa_generate_derived_ecc_key_montgomery_helper( bits, operation, &data );
Add support for Montgomery curves Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-25 13:53:28 +01:00
if( status != PSA_SUCCESS )
goto exit;
}
psa_generate_derived_ecc_key_helper: compile only when ECC is supported Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-18 13:35:00 +01:00
} else
Restore build options for mbedtls_ecc_group_of_psa() and related functions Additional issue created to simplifiy usage of BUILTIN_KEY_TYPE_xxx && BUILTIN_ALG_yy macros https://github.com/ARMmbed/mbedtls/issues/5596 Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-03-04 14:41:11 +01:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) ||
defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) ||
defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH) */
Code optimization - fix codding style - fix comments and descriptions - add helper function for montgomery curve - move N-2 calculation outside the loop - fix access to <data> bytes: *data[x] -> (*data)[x] Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2022-02-21 08:17:43 +01:00
if( key_type_is_raw_bytes( slot->attr.type ) )
psa_generate_derived_ecc_key_helper: compile only when ECC is supported Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-18 13:35:00 +01:00
{
PSA: implement key derivation for ECC keys Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-09 10:46:40 +01:00
if( bits % 8 != 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
data = mbedtls_calloc( 1, bytes );
if( data == NULL )
return( PSA_ERROR_INSUFFICIENT_MEMORY );
status = psa_key_derivation_output_bytes( operation, data, bytes );
if( status != PSA_SUCCESS )
goto exit;
Change some conditionals of PSA to use BUILTIN Change a few conditionals in the psa library to be based on the MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES instead of the WANT macros. Future additions of HW acceleration will need to be mindful of these definitions if any of this code is needed in those instances. Signed-off-by: David Brown <david.brown@linaro.org>
2021-02-11 19:02:00 +01:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
PSA: implement key derivation for ECC keys Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-09 10:46:40 +01:00
if( slot->attr.type == PSA_KEY_TYPE_DES )
psa_des_set_key_parity( data, bytes );
Clenup conditional compilation flags. Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-03-01 14:48:05 +01:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES) */
PSA: implement key derivation for ECC keys Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-11-09 10:46:40 +01:00
}
Code optimization - fix codding style - fix comments and descriptions - add helper function for montgomery curve - move N-2 calculation outside the loop - fix access to <data> bytes: *data[x] -> (*data)[x] Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2022-02-21 08:17:43 +01:00
else
Return PSA_ERROR_INVALID_ARGUMENT for a public key, and PSA_ERROR_NOT_SUPPORTED for a type that is not handled. Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-03-01 14:22:29 +01:00
return( PSA_ERROR_NOT_SUPPORTED );
psa: import: Move key buffer allocation Move key buffer allocation from psa_import_key_into_slot() function up to the two functions calling it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 15:14:42 +01:00
psa: Call import software implementation as a driver Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 18:06:53 +01:00
slot->attr.bits = (psa_key_bits_t) bits;
psa: Change psa_import_key_into_slot() signature Change psa_import_key_into_slot() signature to the signature of an import_key driver entry point. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 15:54:54 +01:00
psa_key_attributes_t attributes = {
.core = slot->attr
};
Sizing of key buffer for opaque keys Create a new sizing function for determining the size required for key storage based on the input key data. This is required for key imports where the key length might need to be derived from the data. Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-06-14 06:34:16 +02:00
if( psa_key_lifetime_is_external( attributes.core.lifetime ) )
{
Code style improvements Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-09-08 12:06:05 +02:00
status = psa_driver_wrapper_get_key_buffer_size( &attributes,
&storage_size );
Sizing of key buffer for opaque keys Create a new sizing function for determining the size required for key storage based on the input key data. This is required for key imports where the key length might need to be derived from the data. Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-06-14 06:34:16 +02:00
if( status != PSA_SUCCESS )
goto exit;
}
status = psa_allocate_buffer_to_slot( slot, storage_size );
if( status != PSA_SUCCESS )
goto exit;
psa: Call import software implementation as a driver Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-28 18:06:53 +01:00
status = psa_driver_wrapper_import_key( &attributes,
data, bytes,
slot->key.data,
slot->key.bytes,
&slot->key.bytes, &bits );
if( bits != slot->attr.bits )
status = PSA_ERROR_INVALID_ARGUMENT;
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
exit:
mbedtls_free( data );
return( status );
}
Rename generator functions to psa_key_derivation_xxx Generators are mostly about key derivation (currently: only about key derivation). "Generator" is not a commonly used term in cryptography. So favor "derivation" as terminology. Call a generator a key derivation operation structure, since it behaves like other multipart operation structures. Furthermore, the function names are not fully consistent. In this commit, I rename the functions to consistently have the prefix "psa_key_derivation_". I used the following command: perl -i -pe '%t = ( psa_crypto_generator_t => "psa_key_derivation_operation_t", psa_crypto_generator_init => "psa_key_derivation_init", psa_key_derivation_setup => "psa_key_derivation_setup", psa_key_derivation_input_key => "psa_key_derivation_input_key", psa_key_derivation_input_bytes => "psa_key_derivation_input_bytes", psa_key_agreement => "psa_key_derivation_key_agreement", psa_set_generator_capacity => "psa_key_derivation_set_capacity", psa_get_generator_capacity => "psa_key_derivation_get_capacity", psa_generator_read => "psa_key_derivation_output_bytes", psa_generate_derived_key => "psa_key_derivation_output_key", psa_generator_abort => "psa_key_derivation_abort", PSA_CRYPTO_GENERATOR_INIT => "PSA_KEY_DERIVATION_OPERATION_INIT", PSA_GENERATOR_UNBRIDLED_CAPACITY => "PSA_KEY_DERIVATION_UNLIMITED_CAPACITY", ); s/\b(@{[join("|", keys %t)]})\b/$t{$1}/ge' $(git ls-files)
2019-05-16 15:28:51 +02:00
psa_status_t psa_key_derivation_output_key( const psa_key_attributes_t *attributes,
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
psa_key_derivation_operation_t *operation,
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 09:51:30 +02:00
mbedtls_svc_key_id_t *key )
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 12:53:30 +02:00
{
psa_status_t status;
psa_key_slot_t *slot = NULL;
Driver table entries are now mutable Since driver table entries contain the driver context, which is mutable, they can't be const anymore.
2019-07-12 23:40:35 +02:00
psa_se_drv_table_entry_t *driver = NULL;
Reject keys of size 0 Implement the prohibition on keys of size 0.
2019-09-12 19:03:13 +02:00
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 12:10:32 +01:00
*key = MBEDTLS_SVC_KEY_ID_INIT;
Reject keys of size 0 Implement the prohibition on keys of size 0.
2019-09-12 19:03:13 +02:00
/* Reject any attempt to create a zero-length key so that we don't
* risk tripping up later, e.g. on a malloc(0) that returns NULL. */
if( psa_get_key_bits( attributes ) == 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
Improve PSA error return code psa_key_derivation_output_key: prioritize BAD_STATE over NOT_PERMITTED If psa_key_derivation_output_key() is called on an operation which hasn't been set up or which has been aborted, return PSA_ERROR_BAD_STATE. Only return PSA_ERROR_NOT_PERMITTED if the operation state is ok for psa_key_derivation_input_bytes() or psa_key_derivation_output_bytes() but not ok to output a key. Ideally psa_key_derivation_output_key() would return PSA_ERROR_NOT_PERMITTED only when psa_key_derivation_output_bytes() is possible, but this is clumsier to implement. Signed-off-by: Dave Rodgman <dave.rodgman@arm.com>
2021-11-16 11:32:48 +01:00
if( operation->alg == PSA_ALG_NONE )
return( PSA_ERROR_BAD_STATE );
Key derivation: forbid output_key without input_key If none of the inputs to a key derivation is a PSA_KEY_DERIVATION_INPUT_SECRET passed with psa_key_derivation_input_key(), forbid psa_key_derivation_output_key(). It usually doesn't make sense to derive a key object if the secret isn't itself a proper key.
2019-09-24 18:21:06 +02:00
if( ! operation->can_output_key )
return( PSA_ERROR_NOT_PERMITTED );
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 12:10:32 +01:00
status = psa_start_key_creation( PSA_KEY_CREATION_DERIVE, attributes,
&slot, &driver );
SE keys: error out in key creation function that lack support
2019-07-24 13:44:30 +02:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
if( driver != NULL )
{
/* Deriving a key in a secure element is not implemented yet. */
status = PSA_ERROR_NOT_SUPPORTED;
}
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 12:53:30 +02:00
if( status == PSA_SUCCESS )
{
Rename psa_generate_key() and psa_generator_import_key()
2019-05-03 16:44:28 +02:00
status = psa_generate_derived_key_internal( slot,
Move attribute fields to a substructure Move the "core attributes" to a substructure of psa_key_attribute_t. The motivation is to be able to use the new structure psa_core_key_attributes_t internally.
2019-07-30 13:48:52 +02:00
attributes->core.bits,
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
operation );
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 12:53:30 +02:00
}
if( status == PSA_SUCCESS )
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 12:10:32 +01:00
status = psa_finish_key_creation( slot, driver, key );
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 12:53:30 +02:00
if( status != PSA_SUCCESS )
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 18:34:38 +02:00
psa_fail_key_creation( slot, driver );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 12:53:30 +02:00
return( status );
}
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
Add framework for simple key derivation New key type PSA_KEY_TYPE_DERIVE. New usage flag PSA_KEY_USAGE_DERIVE. New function psa_key_derivation. No key derivation algorithm is implemented yet. The code may not compile with -Wunused. Write some unit test code for psa_key_derivation. Most of it cannot be used yet due to the lack of a key derivation algorithm.
2018-07-12 17:17:20 +02:00
/****************************************************************/
/* Key derivation */
/****************************************************************/
Return NOT_SUPPORTED according to the API contract "retval = PSA_ERROR_NOT_SUPPORTED if alg is not supported" Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-15 12:14:32 +01:00
#if defined(AT_LEAST_ONE_BUILTIN_KDF)
Simplify is_kdf_alg_supported in psa_key_derivation_setup_kdf No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-29 21:10:00 +02:00
static int is_kdf_alg_supported( psa_algorithm_t kdf_alg )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
{
Phase 2 support for MBEDTLS_PSA_CRYPTO_CONFIG This phase adds in support for the following features being added to the list of features that can be configured in the include/psa/crypto_config.h header file using the PSA_WANT_ALG_xxx macros: ECDH, HMAC, HKDF, and RSA. These changes include changes to the PSA crypto library to use the appropriate new guards that will allow the feature to be compiled in or out either using new PSA_WANT_ALG_xxx or the previous MBEDTLS_xxx macros. For HKDF and HMAC, most of the PSA library code did not have a specific matching MBEDTLS_xxx macro for that feature, but was instead using the generic dependent MBEDTLS_MD_C macro. The ECDH and RSA features more closely aligned with a direct replacement with a similar macro. The new tests for RSA, HMAC, and HKDF would normally unset additional dependent macros, but when attempting to implement that level of testing it required removal of too many core features like MD_C, PK_C, ECP_C and other low level features. This may point to additional phases of work to complete the transition of these features to the new model. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-10-30 05:37:36 +01:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
if( PSA_ALG_IS_HKDF( kdf_alg ) )
Simplify is_kdf_alg_supported in psa_key_derivation_setup_kdf No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-29 21:10:00 +02:00
return( 1 );
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
#endif
is_kdf_alg_supported: Adapt impl to new build flags for HKDF EXTRACT/EXPAND Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-06 08:33:45 +02:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
if( PSA_ALG_IS_HKDF_EXTRACT( kdf_alg ) )
return( 1 );
#endif
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
if( PSA_ALG_IS_HKDF_EXPAND( kdf_alg ) )
Simplify is_kdf_alg_supported in psa_key_derivation_setup_kdf No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-29 21:10:00 +02:00
return( 1 );
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
#endif
#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF)
if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) )
Simplify is_kdf_alg_supported in psa_key_derivation_setup_kdf No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-29 21:10:00 +02:00
return( 1 );
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
#endif
#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
if( PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
Simplify is_kdf_alg_supported in psa_key_derivation_setup_kdf No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-29 21:10:00 +02:00
return( 1 );
Add an EC J-PAKE KDF to transform K -> SHA256(K.X) for TLS 1.2 TLS uses it to derive the session secret. The algorithm takes a serialized point in an uncompressed form, extracts the X coordinate and computes SHA256 of it. It is only expected to work with P-256. Fixes #5978. Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-07-29 16:00:16 +02:00
#endif
#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Remove `PSA_ALG_IS_TLS12_ECJPAKE_TO_PMS` Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-09-16 13:24:14 +02:00
if( kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS )
Add an EC J-PAKE KDF to transform K -> SHA256(K.X) for TLS 1.2 TLS uses it to derive the session secret. The algorithm takes a serialized point in an uncompressed form, extracts the X coordinate and computes SHA256 of it. It is only expected to work with P-256. Fixes #5978. Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-07-29 16:00:16 +02:00
return( 1 );
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
#endif
Simplify is_kdf_alg_supported in psa_key_derivation_setup_kdf No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-29 21:10:00 +02:00
return( 0 );
}
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
Make psa_key_derivation_setup return early if the hash is not supported Otherwise the systematically generated algorithm-not-supported tests complain when they try to start an operation and succeed. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-29 21:18:14 +02:00
static psa_status_t psa_hash_try_support( psa_algorithm_t alg )
{
psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT;
psa_status_t status = psa_hash_setup( &operation, alg );
psa_hash_abort( &operation );
return( status );
}
Simplify is_kdf_alg_supported in psa_key_derivation_setup_kdf No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-29 21:10:00 +02:00
static psa_status_t psa_key_derivation_setup_kdf(
psa_key_derivation_operation_t *operation,
psa_algorithm_t kdf_alg )
{
/* Make sure that operation->ctx is properly zero-initialised. (Macro
* initialisers for this union leave some bytes unspecified.) */
memset( &operation->ctx, 0, sizeof( operation->ctx ) );
/* Make sure that kdf_alg is a supported key derivation algorithm. */
if( ! is_kdf_alg_supported( kdf_alg ) )
return( PSA_ERROR_NOT_SUPPORTED );
Add an EC J-PAKE KDF to transform K -> SHA256(K.X) for TLS 1.2 TLS uses it to derive the session secret. The algorithm takes a serialized point in an uncompressed form, extracts the X coordinate and computes SHA256 of it. It is only expected to work with P-256. Fixes #5978. Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-07-29 16:00:16 +02:00
/* All currently supported key derivation algorithms (apart from
Restrict the EC J-PAKE to PMS input type to secret Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-09-16 12:22:44 +02:00
* ecjpake to pms) are based on a hash algorithm. */
Simplify is_kdf_alg_supported in psa_key_derivation_setup_kdf No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-29 21:10:00 +02:00
psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( kdf_alg );
size_t hash_size = PSA_HASH_LENGTH( hash_alg );
Remove `PSA_ALG_IS_TLS12_ECJPAKE_TO_PMS` Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-09-16 13:24:14 +02:00
if( kdf_alg != PSA_ALG_TLS12_ECJPAKE_TO_PMS )
Add an EC J-PAKE KDF to transform K -> SHA256(K.X) for TLS 1.2 TLS uses it to derive the session secret. The algorithm takes a serialized point in an uncompressed form, extracts the X coordinate and computes SHA256 of it. It is only expected to work with P-256. Fixes #5978. Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-07-29 16:00:16 +02:00
{
if( hash_size == 0 )
return( PSA_ERROR_NOT_SUPPORTED );
Make psa_key_derivation_setup return early if the hash is not supported Otherwise the systematically generated algorithm-not-supported tests complain when they try to start an operation and succeed. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-29 21:18:14 +02:00
Add an EC J-PAKE KDF to transform K -> SHA256(K.X) for TLS 1.2 TLS uses it to derive the session secret. The algorithm takes a serialized point in an uncompressed form, extracts the X coordinate and computes SHA256 of it. It is only expected to work with P-256. Fixes #5978. Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-07-29 16:00:16 +02:00
/* Make sure that hash_alg is a supported hash algorithm. Otherwise
* we might fail later, which is somewhat unfriendly and potentially
* risk-prone. */
psa_status_t status = psa_hash_try_support( hash_alg );
if( status != PSA_SUCCESS )
return( status );
}
else
{
hash_size = PSA_HASH_LENGTH( PSA_ALG_SHA_256 );
}
Make psa_key_derivation_setup return early if the hash is not supported Otherwise the systematically generated algorithm-not-supported tests complain when they try to start an operation and succeed. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-29 21:18:14 +02:00
Simplify is_kdf_alg_supported in psa_key_derivation_setup_kdf No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-29 21:10:00 +02:00
if( ( PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) ) &&
! ( hash_alg == PSA_ALG_SHA_256 || hash_alg == PSA_ALG_SHA_384 ) )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
{
Simplify is_kdf_alg_supported in psa_key_derivation_setup_kdf No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-29 21:10:00 +02:00
return( PSA_ERROR_NOT_SUPPORTED );
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
}
Add missing ifdef when calculating operation capacity Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-09-16 18:24:52 +02:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT) || \
Fix a copy-paste error - wrong macro used Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-09-26 16:50:22 +02:00
defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Add proper capacity calculation for EC J-PAKE to PMS KDF Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-09-16 13:13:00 +02:00
if( PSA_ALG_IS_HKDF_EXTRACT( kdf_alg ) ||
Remove `PSA_ALG_IS_TLS12_ECJPAKE_TO_PMS` Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-09-16 13:24:14 +02:00
( kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS ) )
PSA: Add support for HKDF-Extend and HKDF-Expand algs Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-05-10 13:53:33 +02:00
operation->capacity = hash_size;
else
Fix a copy-paste error - wrong macro used Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-09-26 16:50:22 +02:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT ||
MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */
PSA: Add support for HKDF-Extend and HKDF-Expand algs Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-05-10 13:53:33 +02:00
operation->capacity = 255 * hash_size;
Simplify is_kdf_alg_supported in psa_key_derivation_setup_kdf No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-29 21:10:00 +02:00
return( PSA_SUCCESS );
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 15:53:06 +01:00
}
Make psa_key_derivation_setup return early if the key agreement is not supported Otherwise the systematically generated algorithm-not-supported tests complain when they try to start an operation and succeed. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-29 21:34:33 +02:00
static psa_status_t psa_key_agreement_try_support( psa_algorithm_t alg )
{
#if defined(PSA_WANT_ALG_ECDH)
if( alg == PSA_ALG_ECDH )
return( PSA_SUCCESS );
#endif
(void) alg;
return( PSA_ERROR_NOT_SUPPORTED );
}
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
#endif /* AT_LEAST_ONE_BUILTIN_KDF */
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 15:53:06 +01:00
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
psa_status_t psa_key_derivation_setup( psa_key_derivation_operation_t *operation,
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 15:53:06 +01:00
psa_algorithm_t alg )
{
psa_status_t status;
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
if( operation->alg != 0 )
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 15:53:06 +01:00
return( PSA_ERROR_BAD_STATE );
Simplify the encoding of key agreement algorithms Get rid of "key selection" algorithms (of which there was only one: raw key selection). Encode key agreement by combining a raw key agreement with a KDF, rather than passing the KDF as an argument of a key agreement macro.
2019-01-18 16:44:49 +01:00
if( PSA_ALG_IS_RAW_KEY_AGREEMENT( alg ) )
return( PSA_ERROR_INVALID_ARGUMENT );
else if( PSA_ALG_IS_KEY_AGREEMENT( alg ) )
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 15:53:06 +01:00
{
Return NOT_SUPPORTED according to the API contract "retval = PSA_ERROR_NOT_SUPPORTED if alg is not supported" Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-15 12:14:32 +01:00
#if defined(AT_LEAST_ONE_BUILTIN_KDF)
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 15:53:06 +01:00
psa_algorithm_t kdf_alg = PSA_ALG_KEY_AGREEMENT_GET_KDF( alg );
Make psa_key_derivation_setup return early if the key agreement is not supported Otherwise the systematically generated algorithm-not-supported tests complain when they try to start an operation and succeed. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-29 21:34:33 +02:00
psa_algorithm_t ka_alg = PSA_ALG_KEY_AGREEMENT_GET_BASE( alg );
status = psa_key_agreement_try_support( ka_alg );
if( status != PSA_SUCCESS )
return( status );
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
status = psa_key_derivation_setup_kdf( operation, kdf_alg );
Return NOT_SUPPORTED according to the API contract "retval = PSA_ERROR_NOT_SUPPORTED if alg is not supported" Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-15 12:14:32 +01:00
#else
return( PSA_ERROR_NOT_SUPPORTED );
#endif /* AT_LEAST_ONE_BUILTIN_KDF */
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 15:53:06 +01:00
}
else if( PSA_ALG_IS_KEY_DERIVATION( alg ) )
{
Return NOT_SUPPORTED according to the API contract "retval = PSA_ERROR_NOT_SUPPORTED if alg is not supported" Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-15 12:14:32 +01:00
#if defined(AT_LEAST_ONE_BUILTIN_KDF)
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
status = psa_key_derivation_setup_kdf( operation, alg );
Return NOT_SUPPORTED according to the API contract "retval = PSA_ERROR_NOT_SUPPORTED if alg is not supported" Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-15 12:14:32 +01:00
#else
return( PSA_ERROR_NOT_SUPPORTED );
#endif /* AT_LEAST_ONE_BUILTIN_KDF */
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 15:53:06 +01:00
}
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
else
return( PSA_ERROR_INVALID_ARGUMENT );
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 15:53:06 +01:00
if( status == PSA_SUCCESS )
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
operation->alg = alg;
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 15:53:06 +01:00
return( status );
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
}
Adapt macro name to meet requested criteria: MBEDTLS_PSA_BUILTIN_ALG_ANY_HKDF->BUILTIN_ALG_ANY_HKDF Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-10 12:59:51 +02:00
#if defined(BUILTIN_ALG_ANY_HKDF)
Rename generator-related internal identifiers perl -pe 's/crypto_generator/key_derivation/gi' $(git ls-files) perl -pe 's/_generator/_key_derivation/gi' $(git ls-files)
2019-05-16 16:59:18 +02:00
static psa_status_t psa_hkdf_input( psa_hkdf_key_derivation_t *hkdf,
PSA: Add support for HKDF-Extend and HKDF-Expand algs Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-05-10 13:53:33 +02:00
psa_algorithm_t kdf_alg,
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
psa_key_derivation_step_t step,
const uint8_t *data,
size_t data_length )
{
PSA: Add support for HKDF-Extend and HKDF-Expand algs Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-05-10 13:53:33 +02:00
psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( kdf_alg );
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
psa_status_t status;
switch( step )
{
Rename PSA_KDF_STEP_xxx -> PSA_KEY_DERIVATION_INPUT_xxx More consistent with the new function names.
2019-05-16 16:05:19 +02:00
case PSA_KEY_DERIVATION_INPUT_SALT:
Add PSA_WANT_ALG_HKDF_EXPAND, PSA_WANT_ALG_HKDF_EXTRACT, adapt code and dependencies Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-03 14:05:07 +02:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
PSA: Add support for HKDF-Extend and HKDF-Expand algs Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-05-10 13:53:33 +02:00
if( PSA_ALG_IS_HKDF_EXPAND( kdf_alg ) )
return( PSA_ERROR_INVALID_ARGUMENT );
Add PSA_WANT_ALG_HKDF_EXPAND, PSA_WANT_ALG_HKDF_EXTRACT, adapt code and dependencies Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-03 14:05:07 +02:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND */
fixup! Key derivation by small input steps: proof-of-concept Simplify the logic inside a few case statements. This removes unreachable break statements.
2019-04-12 15:11:49 +02:00
if( hkdf->state != HKDF_STATE_INIT )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
return( PSA_ERROR_BAD_STATE );
Make HKDF use the generic MAC API Such that the underlying HMAC can be accelerated if such a driver is present Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-29 19:11:25 +02:00
else
{
Code flow and style improvements Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-05-06 17:58:36 +02:00
status = psa_key_derivation_start_hmac( &hkdf->hmac,
hash_alg,
data, data_length );
Make HKDF use the generic MAC API Such that the underlying HMAC can be accelerated if such a driver is present Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-29 19:11:25 +02:00
if( status != PSA_SUCCESS )
return( status );
hkdf->state = HKDF_STATE_STARTED;
return( PSA_SUCCESS );
}
Rename PSA_KDF_STEP_xxx -> PSA_KEY_DERIVATION_INPUT_xxx More consistent with the new function names.
2019-05-16 16:05:19 +02:00
case PSA_KEY_DERIVATION_INPUT_SECRET:
Add PSA_WANT_ALG_HKDF_EXPAND, PSA_WANT_ALG_HKDF_EXTRACT, adapt code and dependencies Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-03 14:05:07 +02:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
PSA: Add support for HKDF-Extend and HKDF-Expand algs Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-05-10 13:53:33 +02:00
if( PSA_ALG_IS_HKDF_EXPAND( kdf_alg ) )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
{
psa_hkdf_input: use more suitable condition and add comments Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-05-19 10:34:37 +02:00
/* We shouldn't be in different state as HKDF_EXPAND only allows
* two inputs: SECRET (this case) and INFO which does not modify
* the state. It could happen only if the hkdf
* object was corrupted. */
PSA: Add support for HKDF-Extend and HKDF-Expand algs Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-05-10 13:53:33 +02:00
if( hkdf->state != HKDF_STATE_INIT )
return( PSA_ERROR_BAD_STATE );
psa_hkdf_input: use more suitable condition and add comments Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-05-19 10:34:37 +02:00
/* Allow only input that fits expected prk size */
if( data_length != PSA_HASH_LENGTH( hash_alg ) )
PSA: Add support for HKDF-Extend and HKDF-Expand algs Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-05-10 13:53:33 +02:00
return( PSA_ERROR_INVALID_ARGUMENT );
memcpy( hkdf->prk, data, data_length );
}
else
Add PSA_WANT_ALG_HKDF_EXPAND, PSA_WANT_ALG_HKDF_EXTRACT, adapt code and dependencies Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-03 14:05:07 +02:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND */
PSA: Add support for HKDF-Extend and HKDF-Expand algs Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-05-10 13:53:33 +02:00
{
Make salt mandatory for HKDF-EXTRACT + adapt tests Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-03 16:00:25 +02:00
/* HKDF: If no salt was provided, use an empty salt.
* HKDF-EXTRACT: salt is mandatory. */
PSA: Add support for HKDF-Extend and HKDF-Expand algs Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-05-10 13:53:33 +02:00
if( hkdf->state == HKDF_STATE_INIT )
{
Make salt mandatory for HKDF-EXTRACT + adapt tests Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-03 16:00:25 +02:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
if( PSA_ALG_IS_HKDF_EXTRACT( kdf_alg ) )
return( PSA_ERROR_BAD_STATE );
#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
PSA: Add support for HKDF-Extend and HKDF-Expand algs Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-05-10 13:53:33 +02:00
status = psa_key_derivation_start_hmac( &hkdf->hmac,
hash_alg,
NULL, 0 );
if( status != PSA_SUCCESS )
return( status );
hkdf->state = HKDF_STATE_STARTED;
}
if( hkdf->state != HKDF_STATE_STARTED )
return( PSA_ERROR_BAD_STATE );
status = psa_mac_update( &hkdf->hmac,
data, data_length );
if( status != PSA_SUCCESS )
return( status );
status = psa_mac_sign_finish( &hkdf->hmac,
hkdf->prk,
sizeof( hkdf->prk ),
&data_length );
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
if( status != PSA_SUCCESS )
return( status );
}
PSA: Add support for HKDF-Extend and HKDF-Expand algs Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-05-10 13:53:33 +02:00
fixup! Key derivation by small input steps: proof-of-concept Simplify the logic inside a few case statements. This removes unreachable break statements.
2019-04-12 15:11:49 +02:00
hkdf->state = HKDF_STATE_KEYED;
Refacor code for HKDF-Extract algorithm Solution provided by @mpg. Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-05-19 11:45:20 +02:00
hkdf->block_number = 0;
Add PSA_WANT_ALG_HKDF_EXPAND, PSA_WANT_ALG_HKDF_EXTRACT, adapt code and dependencies Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-03 14:05:07 +02:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
Refacor code for HKDF-Extract algorithm Solution provided by @mpg. Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-05-19 11:45:20 +02:00
if( PSA_ALG_IS_HKDF_EXTRACT( kdf_alg ) )
{
/* The only block of output is the PRK. */
memcpy( hkdf->output_block, hkdf->prk, PSA_HASH_LENGTH( hash_alg ) );
hkdf->offset_in_block = 0;
}
else
Add PSA_WANT_ALG_HKDF_EXPAND, PSA_WANT_ALG_HKDF_EXTRACT, adapt code and dependencies Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-03 14:05:07 +02:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Refacor code for HKDF-Extract algorithm Solution provided by @mpg. Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-05-19 11:45:20 +02:00
{
/* Block 0 is empty, and the next block will be
* generated by psa_key_derivation_hkdf_read(). */
hkdf->offset_in_block = PSA_HASH_LENGTH( hash_alg );
}
fixup! Key derivation by small input steps: proof-of-concept Simplify the logic inside a few case statements. This removes unreachable break statements.
2019-04-12 15:11:49 +02:00
return( PSA_SUCCESS );
Rename PSA_KDF_STEP_xxx -> PSA_KEY_DERIVATION_INPUT_xxx More consistent with the new function names.
2019-05-16 16:05:19 +02:00
case PSA_KEY_DERIVATION_INPUT_INFO:
Add PSA_WANT_ALG_HKDF_EXPAND, PSA_WANT_ALG_HKDF_EXTRACT, adapt code and dependencies Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-03 14:05:07 +02:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT)
PSA: Add support for HKDF-Extend and HKDF-Expand algs Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-05-10 13:53:33 +02:00
if( PSA_ALG_IS_HKDF_EXTRACT( kdf_alg ) )
return( PSA_ERROR_INVALID_ARGUMENT );
Make info valid only after secret for HKDF-EXPAND + adapt tests Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-03 16:12:27 +02:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND)
if( PSA_ALG_IS_HKDF_EXPAND( kdf_alg ) &&
hkdf->state == HKDF_STATE_INIT )
return( PSA_ERROR_BAD_STATE );
Add PSA_WANT_ALG_HKDF_EXPAND, PSA_WANT_ALG_HKDF_EXTRACT, adapt code and dependencies Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-03 14:05:07 +02:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
if( hkdf->state == HKDF_STATE_OUTPUT )
return( PSA_ERROR_BAD_STATE );
if( hkdf->info_set )
return( PSA_ERROR_BAD_STATE );
hkdf->info_length = data_length;
if( data_length != 0 )
{
hkdf->info = mbedtls_calloc( 1, data_length );
if( hkdf->info == NULL )
return( PSA_ERROR_INSUFFICIENT_MEMORY );
memcpy( hkdf->info, data, data_length );
}
hkdf->info_set = 1;
return( PSA_SUCCESS );
default:
return( PSA_ERROR_INVALID_ARGUMENT );
}
}
Adapt macro name to meet requested criteria: MBEDTLS_PSA_BUILTIN_ALG_ANY_HKDF->BUILTIN_ALG_ANY_HKDF Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-10 12:59:51 +02:00
#endif /* BUILTIN_ALG_ANY_HKDF */
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
Add seed input for psa_tls12_prf_input
2019-06-13 10:05:41 +02:00
static psa_status_t psa_tls12_prf_set_seed( psa_tls12_prf_key_derivation_t *prf,
const uint8_t *data,
size_t data_length )
{
Rename unnamespaced identifiers Rename the enum constants TLS12_PRF_xxx, which are declared in a public header but not intended for use in application code, to start with MBEDTLS_PSA_. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-13 14:55:14 +01:00
if( prf->state != PSA_TLS12_PRF_STATE_INIT )
Add seed input for psa_tls12_prf_input
2019-06-13 10:05:41 +02:00
return( PSA_ERROR_BAD_STATE );
Fix zero-length seed or label in TLS 1.2 PRF The psa_tls12_prf_set_seed() and psa_tls12_prf_set_label() functions did not work on platforms where malloc(0) returns NULL. It does not affect the TLS use case but these PRFs are used in other protocols as well and might not be used the same way. For example EAP uses the TLS PRF with an empty secret. (This would not trigger the bug, but is a strong indication that it is not safe to assume that certain inputs to this function are not zero length.) The conditional block includes the memcpy() call as well to avoid passing a NULL pointer as a parameter resulting in undefined behaviour. The current tests are already using zero length label and seed, there is no need to add new test for this bug.
2019-07-04 10:11:38 +02:00
if( data_length != 0 )
{
prf->seed = mbedtls_calloc( 1, data_length );
if( prf->seed == NULL )
return( PSA_ERROR_INSUFFICIENT_MEMORY );
Add seed input for psa_tls12_prf_input
2019-06-13 10:05:41 +02:00
Fix zero-length seed or label in TLS 1.2 PRF The psa_tls12_prf_set_seed() and psa_tls12_prf_set_label() functions did not work on platforms where malloc(0) returns NULL. It does not affect the TLS use case but these PRFs are used in other protocols as well and might not be used the same way. For example EAP uses the TLS PRF with an empty secret. (This would not trigger the bug, but is a strong indication that it is not safe to assume that certain inputs to this function are not zero length.) The conditional block includes the memcpy() call as well to avoid passing a NULL pointer as a parameter resulting in undefined behaviour. The current tests are already using zero length label and seed, there is no need to add new test for this bug.
2019-07-04 10:11:38 +02:00
memcpy( prf->seed, data, data_length );
prf->seed_length = data_length;
}
Add seed input for psa_tls12_prf_input
2019-06-13 10:05:41 +02:00
Rename unnamespaced identifiers Rename the enum constants TLS12_PRF_xxx, which are declared in a public header but not intended for use in application code, to start with MBEDTLS_PSA_. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-13 14:55:14 +01:00
prf->state = PSA_TLS12_PRF_STATE_SEED_SET;
Add seed input for psa_tls12_prf_input
2019-06-13 10:05:41 +02:00
return( PSA_SUCCESS );
}
Add key import for psa_tls12_prf_input
2019-06-13 15:26:34 +02:00
static psa_status_t psa_tls12_prf_set_key( psa_tls12_prf_key_derivation_t *prf,
const uint8_t *data,
size_t data_length )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
{
psa_tls12_prf_set_key(): add PSA_TLS12_PRF_STATE_OTHER_KEY_SET as a valid state Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-04-07 14:58:33 +02:00
if( prf->state != PSA_TLS12_PRF_STATE_SEED_SET &&
prf->state != PSA_TLS12_PRF_STATE_OTHER_KEY_SET )
Add key import for psa_tls12_prf_input
2019-06-13 15:26:34 +02:00
return( PSA_ERROR_BAD_STATE );
Base the PSA implementation of TLS 1.2 PRF on the MAC API This means there is no longer a need to have an internal HMAC API, so it is being removed in this commit as well. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-29 19:32:25 +02:00
if( data_length != 0 )
{
prf->secret = mbedtls_calloc( 1, data_length );
if( prf->secret == NULL )
return( PSA_ERROR_INSUFFICIENT_MEMORY );
memcpy( prf->secret, data, data_length );
prf->secret_length = data_length;
}
Add key import for psa_tls12_prf_input
2019-06-13 15:26:34 +02:00
Rename unnamespaced identifiers Rename the enum constants TLS12_PRF_xxx, which are declared in a public header but not intended for use in application code, to start with MBEDTLS_PSA_. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-13 14:55:14 +01:00
prf->state = PSA_TLS12_PRF_STATE_KEY_SET;
Add key import for psa_tls12_prf_input
2019-06-13 15:26:34 +02:00
return( PSA_SUCCESS );
}
Add label input for psa_tls12_prf_input
2019-06-13 10:15:47 +02:00
static psa_status_t psa_tls12_prf_set_label( psa_tls12_prf_key_derivation_t *prf,
const uint8_t *data,
size_t data_length )
{
Rename unnamespaced identifiers Rename the enum constants TLS12_PRF_xxx, which are declared in a public header but not intended for use in application code, to start with MBEDTLS_PSA_. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-13 14:55:14 +01:00
if( prf->state != PSA_TLS12_PRF_STATE_KEY_SET )
Add label input for psa_tls12_prf_input
2019-06-13 10:15:47 +02:00
return( PSA_ERROR_BAD_STATE );
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
Fix zero-length seed or label in TLS 1.2 PRF The psa_tls12_prf_set_seed() and psa_tls12_prf_set_label() functions did not work on platforms where malloc(0) returns NULL. It does not affect the TLS use case but these PRFs are used in other protocols as well and might not be used the same way. For example EAP uses the TLS PRF with an empty secret. (This would not trigger the bug, but is a strong indication that it is not safe to assume that certain inputs to this function are not zero length.) The conditional block includes the memcpy() call as well to avoid passing a NULL pointer as a parameter resulting in undefined behaviour. The current tests are already using zero length label and seed, there is no need to add new test for this bug.
2019-07-04 10:11:38 +02:00
if( data_length != 0 )
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 15:53:06 +01:00
{
Fix zero-length seed or label in TLS 1.2 PRF The psa_tls12_prf_set_seed() and psa_tls12_prf_set_label() functions did not work on platforms where malloc(0) returns NULL. It does not affect the TLS use case but these PRFs are used in other protocols as well and might not be used the same way. For example EAP uses the TLS PRF with an empty secret. (This would not trigger the bug, but is a strong indication that it is not safe to assume that certain inputs to this function are not zero length.) The conditional block includes the memcpy() call as well to avoid passing a NULL pointer as a parameter resulting in undefined behaviour. The current tests are already using zero length label and seed, there is no need to add new test for this bug.
2019-07-04 10:11:38 +02:00
prf->label = mbedtls_calloc( 1, data_length );
if( prf->label == NULL )
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 15:53:06 +01:00
return( PSA_ERROR_INSUFFICIENT_MEMORY );
Add label input for psa_tls12_prf_input
2019-06-13 10:15:47 +02:00
Fix zero-length seed or label in TLS 1.2 PRF The psa_tls12_prf_set_seed() and psa_tls12_prf_set_label() functions did not work on platforms where malloc(0) returns NULL. It does not affect the TLS use case but these PRFs are used in other protocols as well and might not be used the same way. For example EAP uses the TLS PRF with an empty secret. (This would not trigger the bug, but is a strong indication that it is not safe to assume that certain inputs to this function are not zero length.) The conditional block includes the memcpy() call as well to avoid passing a NULL pointer as a parameter resulting in undefined behaviour. The current tests are already using zero length label and seed, there is no need to add new test for this bug.
2019-07-04 10:11:38 +02:00
memcpy( prf->label, data, data_length );
prf->label_length = data_length;
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 15:53:06 +01:00
}
Add label input for psa_tls12_prf_input
2019-06-13 10:15:47 +02:00
Rename unnamespaced identifiers Rename the enum constants TLS12_PRF_xxx, which are declared in a public header but not intended for use in application code, to start with MBEDTLS_PSA_. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-13 14:55:14 +01:00
prf->state = PSA_TLS12_PRF_STATE_LABEL_SET;
Add label input for psa_tls12_prf_input
2019-06-13 10:15:47 +02:00
return( PSA_SUCCESS );
}
Add stubs for psa_tls12_prf_input
2019-06-11 16:30:30 +02:00
static psa_status_t psa_tls12_prf_input( psa_tls12_prf_key_derivation_t *prf,
psa_key_derivation_step_t step,
const uint8_t *data,
size_t data_length )
{
switch( step )
{
Add seed input for psa_tls12_prf_input
2019-06-13 10:05:41 +02:00
case PSA_KEY_DERIVATION_INPUT_SEED:
return( psa_tls12_prf_set_seed( prf, data, data_length ) );
Add key import for psa_tls12_prf_input
2019-06-13 15:26:34 +02:00
case PSA_KEY_DERIVATION_INPUT_SECRET:
Base the PSA implementation of TLS 1.2 PRF on the MAC API This means there is no longer a need to have an internal HMAC API, so it is being removed in this commit as well. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-29 19:32:25 +02:00
return( psa_tls12_prf_set_key( prf, data, data_length ) );
Add label input for psa_tls12_prf_input
2019-06-13 10:15:47 +02:00
case PSA_KEY_DERIVATION_INPUT_LABEL:
return( psa_tls12_prf_set_label( prf, data, data_length ) );
Add stubs for psa_tls12_prf_input
2019-06-11 16:30:30 +02:00
default:
return( PSA_ERROR_INVALID_ARGUMENT );
}
}
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) ||
* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
static psa_status_t psa_tls12_prf_psk_to_ms_set_key(
psa_tls12_prf_key_derivation_t *prf,
const uint8_t *data,
size_t data_length )
{
psa_status_t status;
psa_tls12_prf_psk_to_ms_set_key(): add support for other secret input Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-04-07 14:17:13 +02:00
const size_t pms_len = ( prf->state == PSA_TLS12_PRF_STATE_OTHER_KEY_SET ?
4 + data_length + prf->other_secret_length :
4 + 2 * data_length );
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
Rename output buffer size macros Rename existing support macros for output buffer sizes for PSA Crypto API 1.0.0 Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-12-18 14:23:51 +01:00
if( data_length > PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE )
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
return( PSA_ERROR_INVALID_ARGUMENT );
psa_tls12_prf_psk_to_ms_set_key(): add support for other secret input Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-04-07 14:17:13 +02:00
uint8_t *pms = mbedtls_calloc( 1, pms_len );
Add null check for pms allocation Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-04-20 08:33:13 +02:00
if( pms == NULL )
return( PSA_ERROR_INSUFFICIENT_MEMORY );
psa_tls12_prf_psk_to_ms_set_key(): add support for other secret input Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-04-07 14:17:13 +02:00
uint8_t *cur = pms;
/* pure-PSK:
* Quoting RFC 4279, Section 2:
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
*
* The premaster secret is formed as follows: if the PSK is N octets
* long, concatenate a uint16 with the value N, N zero octets, a second
* uint16 with the value N, and the PSK itself.
psa_tls12_prf_psk_to_ms_set_key(): add support for other secret input Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-04-07 14:17:13 +02:00
*
* mixed-PSK:
* In a DHE-PSK, RSA-PSK, ECDHE-PSK the premaster secret is formed as
* follows: concatenate a uint16 with the length of the other secret,
* the other secret itself, uint16 with the length of PSK, and the
* PSK itself.
* For details please check:
* - RFC 4279, Section 4 for the definition of RSA-PSK,
* - RFC 4279, Section 3 for the definition of DHE-PSK,
* - RFC 5489 for the definition of ECDHE-PSK.
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
*/
Fix indentation issues Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-04-21 11:40:18 +02:00
if( prf->state == PSA_TLS12_PRF_STATE_OTHER_KEY_SET )
psa_tls12_prf_psk_to_ms_set_key(): add support for other secret input Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-04-07 14:17:13 +02:00
{
*cur++ = MBEDTLS_BYTE_1( prf->other_secret_length );
*cur++ = MBEDTLS_BYTE_0( prf->other_secret_length );
Fix indentation issues Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-04-21 11:40:18 +02:00
if( prf->other_secret_length != 0 )
Handle empty other secret when passed with input bytes Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-04-12 12:08:01 +02:00
{
memcpy( cur, prf->other_secret, prf->other_secret_length );
psa_tls12_prf_psk_to_ms_set_key: clear buffers after usage Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-04-20 08:37:43 +02:00
mbedtls_platform_zeroize( prf->other_secret, prf->other_secret_length );
Handle empty other secret when passed with input bytes Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-04-12 12:08:01 +02:00
cur += prf->other_secret_length;
}
psa_tls12_prf_psk_to_ms_set_key(): add support for other secret input Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-04-07 14:17:13 +02:00
}
else
{
*cur++ = MBEDTLS_BYTE_1( data_length );
*cur++ = MBEDTLS_BYTE_0( data_length );
memset( cur, 0, data_length );
cur += data_length;
}
Prefixed macros with MBEDTLS As per tests/scripts/check-names.sh, macros in library/ header files should be prefixed with MBEDTLS_ The macro functions in common.h where also indented to comply with the same test Signed-off-by: Joe Subbiani <joe.subbiani@arm.com>
2021-06-24 14:00:03 +02:00
*cur++ = MBEDTLS_BYTE_1( data_length );
*cur++ = MBEDTLS_BYTE_0( data_length );
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
memcpy( cur, data, data_length );
cur += data_length;
Base the PSA implementation of TLS 1.2 PRF on the MAC API This means there is no longer a need to have an internal HMAC API, so it is being removed in this commit as well. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-04-29 19:32:25 +02:00
status = psa_tls12_prf_set_key( prf, pms, cur - pms );
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
psa_tls12_prf_psk_to_ms_set_key(): add support for other secret input Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-04-07 14:17:13 +02:00
mbedtls_platform_zeroize( pms, pms_len );
mbedtls_free( pms );
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
return( status );
}
Add TLS 1.2 PSK master secret generation
2019-06-17 09:44:03 +02:00
rename: psa_tls12_prf_set_other_key->psa_tls12_prf_psk_to_ms_set_other_key and adapt code Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-04-19 13:53:28 +02:00
static psa_status_t psa_tls12_prf_psk_to_ms_set_other_key(
psa_tls12_prf_key_derivation_t *prf,
const uint8_t *data,
size_t data_length )
{
if( prf->state != PSA_TLS12_PRF_STATE_SEED_SET )
return( PSA_ERROR_BAD_STATE );
if( data_length != 0 )
{
prf->other_secret = mbedtls_calloc( 1, data_length );
if( prf->other_secret == NULL )
return( PSA_ERROR_INSUFFICIENT_MEMORY );
memcpy( prf->other_secret, data, data_length );
prf->other_secret_length = data_length;
}
else
{
prf->other_secret_length = 0;
}
prf->state = PSA_TLS12_PRF_STATE_OTHER_KEY_SET;
return( PSA_SUCCESS );
}
Add TLS 1.2 PSK master secret generation
2019-06-17 09:44:03 +02:00
static psa_status_t psa_tls12_prf_psk_to_ms_input(
psa_tls12_prf_key_derivation_t *prf,
psa_key_derivation_step_t step,
const uint8_t *data,
size_t data_length )
{
rename: psa_tls12_prf_set_other_key->psa_tls12_prf_psk_to_ms_set_other_key and adapt code Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-04-19 13:53:28 +02:00
switch( step )
Improve style
2019-06-28 14:35:36 +02:00
{
rename: psa_tls12_prf_set_other_key->psa_tls12_prf_psk_to_ms_set_other_key and adapt code Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-04-19 13:53:28 +02:00
case PSA_KEY_DERIVATION_INPUT_SECRET:
return( psa_tls12_prf_psk_to_ms_set_key( prf,
data, data_length ) );
break;
case PSA_KEY_DERIVATION_INPUT_OTHER_SECRET:
return( psa_tls12_prf_psk_to_ms_set_other_key( prf,
data,
data_length ) );
break;
default:
return( psa_tls12_prf_input( prf, step, data, data_length ) );
break;
Add TLS 1.2 PSK master secret generation
2019-06-17 09:44:03 +02:00
rename: psa_tls12_prf_set_other_key->psa_tls12_prf_psk_to_ms_set_other_key and adapt code Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-04-19 13:53:28 +02:00
}
Add TLS 1.2 PSK master secret generation
2019-06-17 09:44:03 +02:00
}
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
Add an EC J-PAKE KDF to transform K -> SHA256(K.X) for TLS 1.2 TLS uses it to derive the session secret. The algorithm takes a serialized point in an uncompressed form, extracts the X coordinate and computes SHA256 of it. It is only expected to work with P-256. Fixes #5978. Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-07-29 16:00:16 +02:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
static psa_status_t psa_tls12_ecjpake_to_pms_input(
psa_tls12_ecjpake_to_pms_t *ecjpake,
Restrict the EC J-PAKE to PMS input type to secret Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-09-16 12:22:44 +02:00
psa_key_derivation_step_t step,
Add an EC J-PAKE KDF to transform K -> SHA256(K.X) for TLS 1.2 TLS uses it to derive the session secret. The algorithm takes a serialized point in an uncompressed form, extracts the X coordinate and computes SHA256 of it. It is only expected to work with P-256. Fixes #5978. Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-07-29 16:00:16 +02:00
const uint8_t *data,
size_t data_length )
{
Restrict the EC J-PAKE to PMS input type to secret Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-09-16 12:22:44 +02:00
if( data_length != PSA_TLS12_ECJPAKE_TO_PMS_INPUT_SIZE ||
step != PSA_KEY_DERIVATION_INPUT_SECRET )
Improve readability and formatting Also use a sizeof instead of a constant for zeroization, as requested in review. Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-09-26 16:49:16 +02:00
{
Add an EC J-PAKE KDF to transform K -> SHA256(K.X) for TLS 1.2 TLS uses it to derive the session secret. The algorithm takes a serialized point in an uncompressed form, extracts the X coordinate and computes SHA256 of it. It is only expected to work with P-256. Fixes #5978. Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-07-29 16:00:16 +02:00
return( PSA_ERROR_INVALID_ARGUMENT );
Improve readability and formatting Also use a sizeof instead of a constant for zeroization, as requested in review. Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-09-26 16:49:16 +02:00
}
Add an EC J-PAKE KDF to transform K -> SHA256(K.X) for TLS 1.2 TLS uses it to derive the session secret. The algorithm takes a serialized point in an uncompressed form, extracts the X coordinate and computes SHA256 of it. It is only expected to work with P-256. Fixes #5978. Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-07-29 16:00:16 +02:00
/* Check if the passed point is in an uncompressed form */
if( data[0] != 0x04 )
return( PSA_ERROR_INVALID_ARGUMENT );
/* Only K.X has to be extracted - bytes 1 to 32 inclusive. */
memcpy( ecjpake->data, data + 1, PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE );
return( PSA_SUCCESS );
}
#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */
Use the constant PSA_KEY_TYPE_NONE rather than 0 No behavior change, just a readability improvement.
2019-09-24 16:21:10 +02:00
/** Check whether the given key type is acceptable for the given
* input step of a key derivation.
*
* Secret inputs must have the type #PSA_KEY_TYPE_DERIVE.
* Non-secret inputs must have the type #PSA_KEY_TYPE_RAW_DATA.
* Both secret and non-secret inputs can alternatively have the type
* #PSA_KEY_TYPE_NONE, which is never the type of a key object, meaning
* that the input was passed as a buffer rather than via a key object.
*/
Key derivation: allow both keys and direct inputs Allow a direct input as the SECRET input step in a key derivation, in addition to allowing DERIVE keys. This makes it easier for applications to run a key derivation where the "secret" input is obtained from somewhere else. This makes it possible for the "secret" input to be empty (keys cannot be empty), which some protocols do (for example the IV derivation in EAP-TLS). Conversely, allow a RAW_DATA key as the INFO/LABEL/SALT/SEED input to a key derivation, in addition to allowing direct inputs. This doesn't improve security, but removes a step when a personalization parameter is stored in the key store, and allows this personalization parameter to remain opaque. Add test cases that explore step/key-type-and-keyhood combinations.
2019-09-23 18:13:17 +02:00
static int psa_key_derivation_check_input_type(
psa_key_derivation_step_t step,
psa_key_type_t key_type )
{
switch( step )
{
case PSA_KEY_DERIVATION_INPUT_SECRET:
Use the constant PSA_KEY_TYPE_NONE rather than 0 No behavior change, just a readability improvement.
2019-09-24 16:21:10 +02:00
if( key_type == PSA_KEY_TYPE_DERIVE )
return( PSA_SUCCESS );
if( key_type == PSA_KEY_TYPE_NONE )
Key derivation: allow both keys and direct inputs Allow a direct input as the SECRET input step in a key derivation, in addition to allowing DERIVE keys. This makes it easier for applications to run a key derivation where the "secret" input is obtained from somewhere else. This makes it possible for the "secret" input to be empty (keys cannot be empty), which some protocols do (for example the IV derivation in EAP-TLS). Conversely, allow a RAW_DATA key as the INFO/LABEL/SALT/SEED input to a key derivation, in addition to allowing direct inputs. This doesn't improve security, but removes a step when a personalization parameter is stored in the key store, and allows this personalization parameter to remain opaque. Add test cases that explore step/key-type-and-keyhood combinations.
2019-09-23 18:13:17 +02:00
return( PSA_SUCCESS );
break;
psa_key_derivation_check_input_type(): handle PSA_KEY_DERIVATION_INPUT_OTHER_SECRET Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-04-07 15:39:01 +02:00
case PSA_KEY_DERIVATION_INPUT_OTHER_SECRET:
if( key_type == PSA_KEY_TYPE_DERIVE )
return( PSA_SUCCESS );
if( key_type == PSA_KEY_TYPE_NONE )
return( PSA_SUCCESS );
break;
Key derivation: allow both keys and direct inputs Allow a direct input as the SECRET input step in a key derivation, in addition to allowing DERIVE keys. This makes it easier for applications to run a key derivation where the "secret" input is obtained from somewhere else. This makes it possible for the "secret" input to be empty (keys cannot be empty), which some protocols do (for example the IV derivation in EAP-TLS). Conversely, allow a RAW_DATA key as the INFO/LABEL/SALT/SEED input to a key derivation, in addition to allowing direct inputs. This doesn't improve security, but removes a step when a personalization parameter is stored in the key store, and allows this personalization parameter to remain opaque. Add test cases that explore step/key-type-and-keyhood combinations.
2019-09-23 18:13:17 +02:00
case PSA_KEY_DERIVATION_INPUT_LABEL:
case PSA_KEY_DERIVATION_INPUT_SALT:
case PSA_KEY_DERIVATION_INPUT_INFO:
case PSA_KEY_DERIVATION_INPUT_SEED:
Use the constant PSA_KEY_TYPE_NONE rather than 0 No behavior change, just a readability improvement.
2019-09-24 16:21:10 +02:00
if( key_type == PSA_KEY_TYPE_RAW_DATA )
return( PSA_SUCCESS );
if( key_type == PSA_KEY_TYPE_NONE )
Key derivation: allow both keys and direct inputs Allow a direct input as the SECRET input step in a key derivation, in addition to allowing DERIVE keys. This makes it easier for applications to run a key derivation where the "secret" input is obtained from somewhere else. This makes it possible for the "secret" input to be empty (keys cannot be empty), which some protocols do (for example the IV derivation in EAP-TLS). Conversely, allow a RAW_DATA key as the INFO/LABEL/SALT/SEED input to a key derivation, in addition to allowing direct inputs. This doesn't improve security, but removes a step when a personalization parameter is stored in the key store, and allows this personalization parameter to remain opaque. Add test cases that explore step/key-type-and-keyhood combinations.
2019-09-23 18:13:17 +02:00
return( PSA_SUCCESS );
break;
}
return( PSA_ERROR_INVALID_ARGUMENT );
}
Rename psa_key_derivation_input_raw The function dispatches between all the available methods and does not just handle the raw key derivation case like the name suggests.
2019-06-12 16:54:46 +02:00
static psa_status_t psa_key_derivation_input_internal(
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
psa_key_derivation_operation_t *operation,
Improve the rules on key derivation input types Use separate step types for a KDF secret and for the private key in a key agreement. Determine which key type is allowed from the step type, independently of the KDF. Forbid raw inputs for certain steps. They definitely should be forbidden for asymmetric keys, which are structured. Also forbid them for KDF secrets: the secrets are supposed to be keys, even if they're unstructured.
2019-01-08 10:31:27 +01:00
psa_key_derivation_step_t step,
Key derivation: allow both keys and direct inputs Allow a direct input as the SECRET input step in a key derivation, in addition to allowing DERIVE keys. This makes it easier for applications to run a key derivation where the "secret" input is obtained from somewhere else. This makes it possible for the "secret" input to be empty (keys cannot be empty), which some protocols do (for example the IV derivation in EAP-TLS). Conversely, allow a RAW_DATA key as the INFO/LABEL/SALT/SEED input to a key derivation, in addition to allowing direct inputs. This doesn't improve security, but removes a step when a personalization parameter is stored in the key store, and allows this personalization parameter to remain opaque. Add test cases that explore step/key-type-and-keyhood combinations.
2019-09-23 18:13:17 +02:00
psa_key_type_t key_type,
Improve the rules on key derivation input types Use separate step types for a KDF secret and for the private key in a key agreement. Determine which key type is allowed from the step type, independently of the KDF. Forbid raw inputs for certain steps. They definitely should be forbidden for asymmetric keys, which are structured. Also forbid them for KDF secrets: the secrets are supposed to be keys, even if they're unstructured.
2019-01-08 10:31:27 +01:00
const uint8_t *data,
size_t data_length )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
{
Don't jump past a variable declaration This is valid C99 (since the variable in question is not a VLA and is not used) but not accepted by IAR 8.20.
2019-09-23 19:22:55 +02:00
psa_status_t status;
psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg( operation );
status = psa_key_derivation_check_input_type( step, key_type );
Key derivation: allow both keys and direct inputs Allow a direct input as the SECRET input step in a key derivation, in addition to allowing DERIVE keys. This makes it easier for applications to run a key derivation where the "secret" input is obtained from somewhere else. This makes it possible for the "secret" input to be empty (keys cannot be empty), which some protocols do (for example the IV derivation in EAP-TLS). Conversely, allow a RAW_DATA key as the INFO/LABEL/SALT/SEED input to a key derivation, in addition to allowing direct inputs. This doesn't improve security, but removes a step when a personalization parameter is stored in the key store, and allows this personalization parameter to remain opaque. Add test cases that explore step/key-type-and-keyhood combinations.
2019-09-23 18:13:17 +02:00
if( status != PSA_SUCCESS )
goto exit;
Adapt macro name to meet requested criteria: MBEDTLS_PSA_BUILTIN_ALG_ANY_HKDF->BUILTIN_ALG_ANY_HKDF Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-10 12:59:51 +02:00
#if defined(BUILTIN_ALG_ANY_HKDF)
Optimize code by adding PSA_ALG_IS_ANY_HKDF macro Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-02 11:37:03 +02:00
if( PSA_ALG_IS_ANY_HKDF( kdf_alg ) )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
{
PSA: Add support for HKDF-Extend and HKDF-Expand algs Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-05-10 13:53:33 +02:00
status = psa_hkdf_input( &operation->ctx.hkdf, kdf_alg,
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
step, data, data_length );
}
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
else
Adapt macro name to meet requested criteria: MBEDTLS_PSA_BUILTIN_ALG_ANY_HKDF->BUILTIN_ALG_ANY_HKDF Signed-off-by: Przemek Stekiel <przemyslaw.stekiel@mobica.com>
2022-06-10 12:59:51 +02:00
#endif /* BUILTIN_ALG_ANY_HKDF */
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF)
if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
{
Add stubs for psa_tls12_prf_input
2019-06-11 16:30:30 +02:00
status = psa_tls12_prf_input( &operation->ctx.tls12_prf,
step, data, data_length );
Add TLS 1.2 PSK master secret generation
2019-06-17 09:44:03 +02:00
}
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
else
#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF */
#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
if( PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
Add TLS 1.2 PSK master secret generation
2019-06-17 09:44:03 +02:00
{
status = psa_tls12_prf_psk_to_ms_input( &operation->ctx.tls12_prf,
step, data, data_length );
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
}
else
Updates to PSA crypto library based on review comments Moved new check_crypto_config.h file from include/psa to library directory and the file is now included from *.c instead of the crypto_config.h file. Fixed guards in PSA crypto library based on review comments for new PSA crypto config features. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-17 07:08:34 +01:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
Add an EC J-PAKE KDF to transform K -> SHA256(K.X) for TLS 1.2 TLS uses it to derive the session secret. The algorithm takes a serialized point in an uncompressed form, extracts the X coordinate and computes SHA256 of it. It is only expected to work with P-256. Fixes #5978. Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-07-29 16:00:16 +02:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS)
Remove `PSA_ALG_IS_TLS12_ECJPAKE_TO_PMS` Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-09-16 13:24:14 +02:00
if( kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS )
Add an EC J-PAKE KDF to transform K -> SHA256(K.X) for TLS 1.2 TLS uses it to derive the session secret. The algorithm takes a serialized point in an uncompressed form, extracts the X coordinate and computes SHA256 of it. It is only expected to work with P-256. Fixes #5978. Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-07-29 16:00:16 +02:00
{
status = psa_tls12_ecjpake_to_pms_input(
Restrict the EC J-PAKE to PMS input type to secret Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-09-16 12:22:44 +02:00
&operation->ctx.tls12_ecjpake_to_pms, step, data, data_length );
Add an EC J-PAKE KDF to transform K -> SHA256(K.X) for TLS 1.2 TLS uses it to derive the session secret. The algorithm takes a serialized point in an uncompressed form, extracts the X coordinate and computes SHA256 of it. It is only expected to work with P-256. Fixes #5978. Signed-off-by: Andrzej Kurek <andrzej.kurek@arm.com>
2022-07-29 16:00:16 +02:00
}
else
#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
/* This can't happen unless the operation object was not initialized */
Fix unused variables in PSA core when no KDF algorithm is present Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2021-02-10 17:19:22 +01:00
(void) data;
(void) data_length;
(void) kdf_alg;
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
return( PSA_ERROR_BAD_STATE );
}
Key derivation: allow both keys and direct inputs Allow a direct input as the SECRET input step in a key derivation, in addition to allowing DERIVE keys. This makes it easier for applications to run a key derivation where the "secret" input is obtained from somewhere else. This makes it possible for the "secret" input to be empty (keys cannot be empty), which some protocols do (for example the IV derivation in EAP-TLS). Conversely, allow a RAW_DATA key as the INFO/LABEL/SALT/SEED input to a key derivation, in addition to allowing direct inputs. This doesn't improve security, but removes a step when a personalization parameter is stored in the key store, and allows this personalization parameter to remain opaque. Add test cases that explore step/key-type-and-keyhood combinations.
2019-09-23 18:13:17 +02:00
exit:
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
if( status != PSA_SUCCESS )
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
psa_key_derivation_abort( operation );
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
return( status );
}
Style: enforce 80 column limit
2019-06-14 12:35:55 +02:00
psa_status_t psa_key_derivation_input_bytes(
psa_key_derivation_operation_t *operation,
psa_key_derivation_step_t step,
const uint8_t *data,
size_t data_length )
Improve the rules on key derivation input types Use separate step types for a KDF secret and for the private key in a key agreement. Determine which key type is allowed from the step type, independently of the KDF. Forbid raw inputs for certain steps. They definitely should be forbidden for asymmetric keys, which are structured. Also forbid them for KDF secrets: the secrets are supposed to be keys, even if they're unstructured.
2019-01-08 10:31:27 +01:00
{
Use the constant PSA_KEY_TYPE_NONE rather than 0 No behavior change, just a readability improvement.
2019-09-24 16:21:10 +02:00
return( psa_key_derivation_input_internal( operation, step,
PSA_KEY_TYPE_NONE,
Simplify psa_key_derivation_input_bytes The specific key derivation input functions support a subset of the input options and need to check it anyway. Checking it at the top level is redundant, it brings a very little value and comes with a cost in code size and maintainability.
2019-06-14 12:27:57 +02:00
data, data_length ) );
Improve the rules on key derivation input types Use separate step types for a KDF secret and for the private key in a key agreement. Determine which key type is allowed from the step type, independently of the KDF. Forbid raw inputs for certain steps. They definitely should be forbidden for asymmetric keys, which are structured. Also forbid them for KDF secrets: the secrets are supposed to be keys, even if they're unstructured.
2019-01-08 10:31:27 +01:00
}
Style: enforce 80 column limit
2019-06-14 12:35:55 +02:00
psa_status_t psa_key_derivation_input_key(
psa_key_derivation_operation_t *operation,
psa_key_derivation_step_t step,
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 09:51:30 +02:00
mbedtls_svc_key_id_t key )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
{
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
psa_key_slot_t *slot;
Key derivation: forbid output_key without input_key If none of the inputs to a key derivation is a PSA_KEY_DERIVATION_INPUT_SECRET passed with psa_key_derivation_input_key(), forbid psa_key_derivation_output_key(). It usually doesn't make sense to derive a key object if the secret isn't itself a proper key.
2019-09-24 18:21:06 +02:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
status = psa_get_and_lock_transparent_key_slot_with_policy(
key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg );
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
if( status != PSA_SUCCESS )
Consistently abort key derivation operations on input error
2019-09-23 18:17:40 +02:00
{
psa_key_derivation_abort( operation );
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
return( status );
Consistently abort key derivation operations on input error
2019-09-23 18:17:40 +02:00
}
Key derivation: forbid output_key without input_key If none of the inputs to a key derivation is a PSA_KEY_DERIVATION_INPUT_SECRET passed with psa_key_derivation_input_key(), forbid psa_key_derivation_output_key(). It usually doesn't make sense to derive a key object if the secret isn't itself a proper key.
2019-09-24 18:21:06 +02:00
/* Passing a key object as a SECRET input unlocks the permission
* to output to a key object. */
if( step == PSA_KEY_DERIVATION_INPUT_SECRET )
operation->can_output_key = 1;
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
status = psa_key_derivation_input_internal( operation,
step, slot->attr.type,
psa: se: Create key context in SE key slots In key slots containing the description of a key of a dynamically registered Secure Element (SE), store the key slot number in a key context as defined in the PSA driver interface for opaque drivers. That way transparent key data and slot numbers are , in a key slot, both stored in a dynamically allocated buffer. The `data` union in structures of type psa_key_slot_t to distinguish between the storage of transparent key data and slot numbers is consequently not necessary anymore and thus removed. This alignement of some part of the code dedicated to dynamically registered SE with the PSA driver interface specification is done to ease the support of both dynamically registered and statically defined secure elements. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 17:52:23 +01:00
slot->key.data,
slot->key.bytes );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
unlock_status = psa_unlock_key_slot( slot );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 22:59:38 +01:00
}
Add framework for simple key derivation New key type PSA_KEY_TYPE_DERIVE. New usage flag PSA_KEY_USAGE_DERIVE. New function psa_key_derivation. No key derivation algorithm is implemented yet. The code may not compile with -Wunused. Write some unit test code for psa_key_derivation. Most of it cannot be used yet due to the lack of a key derivation algorithm.
2018-07-12 17:17:20 +02:00
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 12:01:02 +02:00
/****************************************************************/
/* Key agreement */
/****************************************************************/
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 17:50:04 +01:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
Implement ECDH
2018-09-18 12:11:27 +02:00
static psa_status_t psa_key_agreement_ecdh( const uint8_t *peer_key,
size_t peer_key_length,
const mbedtls_ecp_keypair *our_key,
uint8_t *shared_secret,
size_t shared_secret_size,
size_t *shared_secret_length )
{
Initialize key pointer in ecdh to NULL Since it is being dereferenced by free on exit it should be inited to NULL. Also added a small test that would trigger the issue. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-05 16:31:39 +02:00
mbedtls_ecp_keypair *their_key = NULL;
Implement ECDH
2018-09-18 12:11:27 +02:00
mbedtls_ecdh_context ecdh;
psa: Use psa_status_t in psa_key_agreement_ecdh() Use the PSA-native status type in psa_key_agreement_ecdh() in preparation for us calling PSA functions (and not just Mbed TLS functions) and still being able to return a psa_status_t (without having to translate it to a Mbed TLS error and then back again).
2019-01-10 20:38:51 +01:00
psa_status_t status;
Rework mbedlts group id to PSA curve conversion Don't rely on the PSA curve identifier determining the key size, in preparation for removing that.
2019-12-12 16:58:00 +01:00
size_t bits = 0;
Rename ECC Family Macros According to PSA Spec Rename PSA_ECC_CURVE_xxx to PSA_ECC_FAMILY_xxx, also rename PSA_KEY_TYPE_GET_CURVE to PSA_KEY_TYPE_ECC_GET_FAMILY and rename psa_ecc_curve_t to psa_ecc_family_t. Old defines are provided in include/crypto_compat.h for backward compatibility. Signed-off-by: Paul Elliott <paul.elliott@arm.com>
2020-06-02 18:19:28 +02:00
psa_ecc_family_t curve = mbedtls_ecc_group_to_psa( our_key->grp.id, &bits );
Implement ECDH
2018-09-18 12:11:27 +02:00
mbedtls_ecdh_init( &ecdh );
psa: Rename psa_load_rsa/ecp_representation Rename psa_load_rsa/ecp_representation to mbedtls_psa_rsa/ecp_load_representation before to move them in their RSA/ECP specific PSA crypto C modules. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 14:58:33 +01:00
status = mbedtls_psa_ecp_load_representation(
PSA_KEY_TYPE_ECC_PUBLIC_KEY(curve),
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 15:44:45 +01:00
bits,
psa: Rename psa_load_rsa/ecp_representation Rename psa_load_rsa/ecp_representation to mbedtls_psa_rsa/ecp_load_representation before to move them in their RSA/ECP specific PSA crypto C modules. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 14:58:33 +01:00
peer_key,
peer_key_length,
&their_key );
psa: Use psa_status_t in psa_key_agreement_ecdh() Use the PSA-native status type in psa_key_agreement_ecdh() in preparation for us calling PSA functions (and not just Mbed TLS functions) and still being able to return a psa_status_t (without having to translate it to a Mbed TLS error and then back again).
2019-01-10 20:38:51 +01:00
if( status != PSA_SUCCESS )
ECDH: check that the keys are on the same curve In psa_key_agreement_ecdh, check that the public key is on the same curve as the private key. The underlying mbedtls API doesn't check. If the curves don't match, psa_key_agreement_ecdh is practically guaranteed to return INVALID_ARGUMENT anyway, because way the code is written, the public point is interpreted on the curve of the private point, and it is rejected because the point is not on the curve. This is why the test case "PSA key agreement setup: ECDH, raw: public key on different curve" passed even before adding this check.
2018-11-14 20:51:23 +01:00
goto exit;
psa: Use psa_status_t in psa_key_agreement_ecdh() Use the PSA-native status type in psa_key_agreement_ecdh() in preparation for us calling PSA functions (and not just Mbed TLS functions) and still being able to return a psa_status_t (without having to translate it to a Mbed TLS error and then back again).
2019-01-10 20:38:51 +01:00
status = mbedtls_to_psa_error(
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 14:30:39 +02:00
mbedtls_ecdh_get_params( &ecdh, their_key, MBEDTLS_ECDH_THEIRS ) );
psa: Use psa_status_t in psa_key_agreement_ecdh() Use the PSA-native status type in psa_key_agreement_ecdh() in preparation for us calling PSA functions (and not just Mbed TLS functions) and still being able to return a psa_status_t (without having to translate it to a Mbed TLS error and then back again).
2019-01-10 20:38:51 +01:00
if( status != PSA_SUCCESS )
Implement ECDH
2018-09-18 12:11:27 +02:00
goto exit;
psa: Use psa_status_t in psa_key_agreement_ecdh() Use the PSA-native status type in psa_key_agreement_ecdh() in preparation for us calling PSA functions (and not just Mbed TLS functions) and still being able to return a psa_status_t (without having to translate it to a Mbed TLS error and then back again).
2019-01-10 20:38:51 +01:00
status = mbedtls_to_psa_error(
mbedtls_ecdh_get_params( &ecdh, our_key, MBEDTLS_ECDH_OURS ) );
if( status != PSA_SUCCESS )
Implement ECDH
2018-09-18 12:11:27 +02:00
goto exit;
psa: Use psa_status_t in psa_key_agreement_ecdh() Use the PSA-native status type in psa_key_agreement_ecdh() in preparation for us calling PSA functions (and not just Mbed TLS functions) and still being able to return a psa_status_t (without having to translate it to a Mbed TLS error and then back again).
2019-01-10 20:38:51 +01:00
status = mbedtls_to_psa_error(
mbedtls_ecdh_calc_secret( &ecdh,
shared_secret_length,
shared_secret, shared_secret_size,
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 17:02:26 +01:00
mbedtls_psa_get_random,
Replace mbedtls_psa_random_state( ... ) by MBEDTLS_PSA_RANDOM_STATE Hide the obtention of the pointer to the RNG state behind a macro. To make it possible to use this macro in a module other than psa_crypto.c, which will happen in the future, make sure that the definition of the macro does not reference internal variables of psa_crypto.c. For this purpose, in the internal-DRBG case, export a symbol containing the address of the DRBG state. When the RNG state is a pointer a DRBG state, just keep this pointer in a variable: there's no need to store a pointer to a larger structure. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-14 14:54:06 +01:00
MBEDTLS_PSA_RANDOM_STATE ) );
Rework mbedlts group id to PSA curve conversion Don't rely on the PSA curve identifier determining the key size, in preparation for removing that.
2019-12-12 16:58:00 +01:00
if( status != PSA_SUCCESS )
goto exit;
if( PSA_BITS_TO_BYTES( bits ) != *shared_secret_length )
status = PSA_ERROR_CORRUPTION_DETECTED;
Implement ECDH
2018-09-18 12:11:27 +02:00
exit:
psa_key_agreement_ecdh: zeroize output on failure If psa_key_agreement_ecdh fails, there may be output that leaks sensitive information in the output buffer. Zeroize it. If this is due to an underlying failure in the ECDH implementation, it is currently not an issue since both the traditional Mbed TLS/Crypto implementation and Everest only write to the output buffer once every intermediate step has succeeded, but zeroizing is more robust. If this is because the recently added key size check fails, a leak could be a serious issue.
2019-12-20 14:09:55 +01:00
if( status != PSA_SUCCESS )
mbedtls_platform_zeroize( shared_secret, shared_secret_size );
Implement ECDH
2018-09-18 12:11:27 +02:00
mbedtls_ecdh_free( &ecdh );
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 14:30:39 +02:00
mbedtls_ecp_keypair_free( their_key );
Cleanup * No null-check before calling free * Close memory leak * No need for double check of privkey validity Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-30 11:36:45 +02:00
mbedtls_free( their_key );
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 14:30:39 +02:00
psa: Use psa_status_t in psa_key_agreement_ecdh() Use the PSA-native status type in psa_key_agreement_ecdh() in preparation for us calling PSA functions (and not just Mbed TLS functions) and still being able to return a psa_status_t (without having to translate it to a Mbed TLS error and then back again).
2019-01-10 20:38:51 +01:00
return( status );
Implement ECDH
2018-09-18 12:11:27 +02:00
}
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 17:50:04 +01:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_ECDH */
Implement ECDH
2018-09-18 12:11:27 +02:00
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 12:01:02 +02:00
#define PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE MBEDTLS_ECP_MAX_BYTES
Implement psa_key_agreement_raw_shared_secret Refactor: split psa_key_agreement_raw_internal out of psa_key_agreement_internal, and call it from psa_key_agreement_raw_shared_secret as well.
2019-04-11 21:23:21 +02:00
static psa_status_t psa_key_agreement_raw_internal( psa_algorithm_t alg,
psa_key_slot_t *private_key,
const uint8_t *peer_key,
size_t peer_key_length,
uint8_t *shared_secret,
size_t shared_secret_size,
size_t *shared_secret_length )
{
switch( alg )
{
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 17:50:04 +01:00
#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
Implement psa_key_agreement_raw_shared_secret Refactor: split psa_key_agreement_raw_internal out of psa_key_agreement_internal, and call it from psa_key_agreement_raw_shared_secret as well.
2019-04-11 21:23:21 +02:00
case PSA_ALG_ECDH:
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 20:06:31 +02:00
if( ! PSA_KEY_TYPE_IS_ECC_KEY_PAIR( private_key->attr.type ) )
Implement psa_key_agreement_raw_shared_secret Refactor: split psa_key_agreement_raw_internal out of psa_key_agreement_internal, and call it from psa_key_agreement_raw_shared_secret as well.
2019-04-11 21:23:21 +02:00
return( PSA_ERROR_INVALID_ARGUMENT );
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 14:30:39 +02:00
mbedtls_ecp_keypair *ecp = NULL;
psa: Rename psa_load_rsa/ecp_representation Rename psa_load_rsa/ecp_representation to mbedtls_psa_rsa/ecp_load_representation before to move them in their RSA/ECP specific PSA crypto C modules. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 14:58:33 +01:00
psa_status_t status = mbedtls_psa_ecp_load_representation(
private_key->attr.type,
ECC import: more useful choice of INVALID_ARGUMENT vs NOT_SUPPORTED Attempting to create an ECC key with a curve specification that is not valid can plausibly fail with PSA_ERROR_INVALID_ARGUMENT ("this is not a curve specification at all") or PSA_ERROR_NOT_SUPPORTED ("this may be a curve specification, but not one I support"). The choice of error is somewhat subjective. Before this commit, due to happenstance in the implementation, an attempt to use a curve that is declared in the PSA API but not implemented in Mbed TLS returned PSA_ERROR_INVALID_ARGUMENT, whereas an attempt to use a curve that Mbed TLS supports but for which support was disabled at compile-time returned PSA_ERROR_NOT_SUPPORTED. This inconsistency made it difficult to write negative tests that could work whether the curve is implemented via Mbed TLS code or via a driver. After this commit, any attempt to use parameters that are not recognized fails with NOT_SUPPORTED, whether a curve with the specified size might plausibly exist or not, because "might plausibly exist" is not something Mbed TLS can determine. To keep returning INVALID_ARGUMENT when importing an ECC key with an explicit "bits" attribute that is inconsistent with the size of the key material, this commit changes the way mbedtls_ecc_group_of_psa() works: it now works on a size in bits rather than bytes, with an extra flag indicating whether the bit-size must be exact or not. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-27 15:44:45 +01:00
private_key->attr.bits,
psa: Rename psa_load_rsa/ecp_representation Rename psa_load_rsa/ecp_representation to mbedtls_psa_rsa/ecp_load_representation before to move them in their RSA/ECP specific PSA crypto C modules. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-25 14:58:33 +01:00
private_key->key.data,
private_key->key.bytes,
&ecp );
Remove ECP internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 23:09:52 +02:00
if( status != PSA_SUCCESS )
Style fixes * return is treated as a function call * space between opening and closing parentheses * remove whiteline between assignment and checking of same variable Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-05 15:43:42 +02:00
return( status );
Remove ECP internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 23:09:52 +02:00
status = psa_key_agreement_ecdh( peer_key, peer_key_length,
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 14:30:39 +02:00
ecp,
Remove ECP internal representation from key slot Change to on-demand loading of the internal representation when required in order to call an mbed TLS cryptography API. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 23:09:52 +02:00
shared_secret, shared_secret_size,
shared_secret_length );
Update after feedback from #3492 * Allocate internal representation contexts on the heap (i.e. don't change where they're being allocated) * Unify load_xxx_representation in terms of allocation and init behaviour Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-28 14:30:39 +02:00
mbedtls_ecp_keypair_free( ecp );
mbedtls_free( ecp );
Style fixes * return is treated as a function call * space between opening and closing parentheses * remove whiteline between assignment and checking of same variable Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-05 15:43:42 +02:00
return( status );
Corrected guards in PSA library based on review comments Revised the placement of various new MBEDTLS_PSA_BUILTIN_xxx guards based on review comments. Corrected guards in psa test driver to use _ACCEL version instead of _BUILTIN version. Updated check_config_psa.h to include additional dependency checks for more algorithms. Renamed some of the new tests to be a little more clear on the purpose. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-10 17:50:04 +01:00
#endif /* MBEDTLS_PSA_BUILTIN_ALG_ECDH */
Implement psa_key_agreement_raw_shared_secret Refactor: split psa_key_agreement_raw_internal out of psa_key_agreement_internal, and call it from psa_key_agreement_raw_shared_secret as well.
2019-04-11 21:23:21 +02:00
default:
(void) private_key;
(void) peer_key;
(void) peer_key_length;
(void) shared_secret;
(void) shared_secret_size;
(void) shared_secret_length;
return( PSA_ERROR_NOT_SUPPORTED );
}
}
Rename generator functions to psa_key_derivation_xxx Generators are mostly about key derivation (currently: only about key derivation). "Generator" is not a commonly used term in cryptography. So favor "derivation" as terminology. Call a generator a key derivation operation structure, since it behaves like other multipart operation structures. Furthermore, the function names are not fully consistent. In this commit, I rename the functions to consistently have the prefix "psa_key_derivation_". I used the following command: perl -i -pe '%t = ( psa_crypto_generator_t => "psa_key_derivation_operation_t", psa_crypto_generator_init => "psa_key_derivation_init", psa_key_derivation_setup => "psa_key_derivation_setup", psa_key_derivation_input_key => "psa_key_derivation_input_key", psa_key_derivation_input_bytes => "psa_key_derivation_input_bytes", psa_key_agreement => "psa_key_derivation_key_agreement", psa_set_generator_capacity => "psa_key_derivation_set_capacity", psa_get_generator_capacity => "psa_key_derivation_get_capacity", psa_generator_read => "psa_key_derivation_output_bytes", psa_generate_derived_key => "psa_key_derivation_output_key", psa_generator_abort => "psa_key_derivation_abort", PSA_CRYPTO_GENERATOR_INIT => "PSA_KEY_DERIVATION_OPERATION_INIT", PSA_GENERATOR_UNBRIDLED_CAPACITY => "PSA_KEY_DERIVATION_UNLIMITED_CAPACITY", ); s/\b(@{[join("|", keys %t)]})\b/$t{$1}/ge' $(git ls-files)
2019-05-16 15:28:51 +02:00
/* Note that if this function fails, you must call psa_key_derivation_abort()
Add missing cleanup on failure in psa_key_agreement If psa_key_derivation_internal() fails, it's up to the caller to clean up. Do this, and add a note at the top of psa_key_derivation_internal() and its auxiliary functions. There is no non-regression test because at the moment the only way to trigger an error is a borderline low-memory condition and we don't have the means to trigger this.
2018-11-16 16:05:06 +01:00
* to potentially free embedded data structures and wipe confidential data.
*/
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
static psa_status_t psa_key_agreement_internal( psa_key_derivation_operation_t *operation,
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 15:53:06 +01:00
psa_key_derivation_step_t step,
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *private_key,
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 12:01:02 +02:00
const uint8_t *peer_key,
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 15:53:06 +01:00
size_t peer_key_length )
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 12:01:02 +02:00
{
psa_status_t status;
uint8_t shared_secret[PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE];
size_t shared_secret_length = 0;
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
psa_algorithm_t ka_alg = PSA_ALG_KEY_AGREEMENT_GET_BASE( operation->alg );
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 12:01:02 +02:00
/* Step 1: run the secret agreement algorithm to generate the shared
* secret. */
Implement psa_key_agreement_raw_shared_secret Refactor: split psa_key_agreement_raw_internal out of psa_key_agreement_internal, and call it from psa_key_agreement_raw_shared_secret as well.
2019-04-11 21:23:21 +02:00
status = psa_key_agreement_raw_internal( ka_alg,
private_key,
peer_key, peer_key_length,
Implement ECDH
2018-09-18 12:11:27 +02:00
shared_secret,
sizeof( shared_secret ),
&shared_secret_length );
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 12:01:02 +02:00
if( status != PSA_SUCCESS )
goto exit;
/* Step 2: set up the key derivation to generate key material from
Key derivation: allow both keys and direct inputs Allow a direct input as the SECRET input step in a key derivation, in addition to allowing DERIVE keys. This makes it easier for applications to run a key derivation where the "secret" input is obtained from somewhere else. This makes it possible for the "secret" input to be empty (keys cannot be empty), which some protocols do (for example the IV derivation in EAP-TLS). Conversely, allow a RAW_DATA key as the INFO/LABEL/SALT/SEED input to a key derivation, in addition to allowing direct inputs. This doesn't improve security, but removes a step when a personalization parameter is stored in the key store, and allows this personalization parameter to remain opaque. Add test cases that explore step/key-type-and-keyhood combinations.
2019-09-23 18:13:17 +02:00
* the shared secret. A shared secret is permitted wherever a key
* of type DERIVE is permitted. */
Rename psa_key_derivation_input_raw The function dispatches between all the available methods and does not just handle the raw key derivation case like the name suggests.
2019-06-12 16:54:46 +02:00
status = psa_key_derivation_input_internal( operation, step,
Key derivation: allow both keys and direct inputs Allow a direct input as the SECRET input step in a key derivation, in addition to allowing DERIVE keys. This makes it easier for applications to run a key derivation where the "secret" input is obtained from somewhere else. This makes it possible for the "secret" input to be empty (keys cannot be empty), which some protocols do (for example the IV derivation in EAP-TLS). Conversely, allow a RAW_DATA key as the INFO/LABEL/SALT/SEED input to a key derivation, in addition to allowing direct inputs. This doesn't improve security, but removes a step when a personalization parameter is stored in the key store, and allows this personalization parameter to remain opaque. Add test cases that explore step/key-type-and-keyhood combinations.
2019-09-23 18:13:17 +02:00
PSA_KEY_TYPE_DERIVE,
Rename psa_key_derivation_input_raw The function dispatches between all the available methods and does not just handle the raw key derivation case like the name suggests.
2019-06-12 16:54:46 +02:00
shared_secret,
shared_secret_length );
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 12:01:02 +02:00
exit:
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 18:14:53 +01:00
mbedtls_platform_zeroize( shared_secret, shared_secret_length );
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 12:01:02 +02:00
return( status );
}
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
psa_status_t psa_key_derivation_key_agreement( psa_key_derivation_operation_t *operation,
Wrap and reindent some lines After renaming several identifiers, re-wrap and re-indent some lines to make the code prettier.
2019-05-16 17:53:40 +02:00
psa_key_derivation_step_t step,
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 09:51:30 +02:00
mbedtls_svc_key_id_t private_key,
Wrap and reindent some lines After renaming several identifiers, re-wrap and re-indent some lines to make the code prettier.
2019-05-16 17:53:40 +02:00
const uint8_t *peer_key,
size_t peer_key_length )
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 12:01:02 +02:00
{
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *slot;
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
if( ! PSA_ALG_IS_KEY_AGREEMENT( operation->alg ) )
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 12:01:02 +02:00
return( PSA_ERROR_INVALID_ARGUMENT );
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
status = psa_get_and_lock_transparent_key_slot_with_policy(
private_key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg );
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 12:01:02 +02:00
if( status != PSA_SUCCESS )
return( status );
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
status = psa_key_agreement_internal( operation, step,
Add missing cleanup on failure in psa_key_agreement If psa_key_derivation_internal() fails, it's up to the caller to clean up. Do this, and add a note at the top of psa_key_derivation_internal() and its auxiliary functions. There is no non-regression test because at the moment the only way to trigger an error is a borderline low-memory condition and we don't have the means to trigger this.
2018-11-16 16:05:06 +01:00
slot,
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 15:53:06 +01:00
peer_key, peer_key_length );
Add missing cleanup on failure in psa_key_agreement If psa_key_derivation_internal() fails, it's up to the caller to clean up. Do this, and add a note at the top of psa_key_derivation_internal() and its auxiliary functions. There is no non-regression test because at the moment the only way to trigger an error is a borderline low-memory condition and we don't have the means to trigger this.
2018-11-16 16:05:06 +01:00
if( status != PSA_SUCCESS )
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 17:31:03 +02:00
psa_key_derivation_abort( operation );
Apply review feedback Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-10-15 17:07:12 +02:00
else
{
/* If a private key has been added as SECRET, we allow the derived
* key material to be used as a key in PSA Crypto. */
if( step == PSA_KEY_DERIVATION_INPUT_SECRET )
operation->can_output_key = 1;
}
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
unlock_status = psa_unlock_key_slot( slot );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
return( ( status == PSA_SUCCESS ) ? unlock_status : status );
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 12:01:02 +02:00
}
Shorten the name of psa_key_agreement_raw_shared_secret There is less of a risk of confusion with the KA+KDF function now.
2019-05-16 18:00:41 +02:00
psa_status_t psa_raw_key_agreement( psa_algorithm_t alg,
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 09:51:30 +02:00
mbedtls_svc_key_id_t private_key,
Shorten the name of psa_key_agreement_raw_shared_secret There is less of a risk of confusion with the KA+KDF function now.
2019-05-16 18:00:41 +02:00
const uint8_t *peer_key,
size_t peer_key_length,
uint8_t *output,
size_t output_size,
size_t *output_length )
Implement psa_key_agreement_raw_shared_secret Refactor: split psa_key_agreement_raw_internal out of psa_key_agreement_internal, and call it from psa_key_agreement_raw_shared_secret as well.
2019-04-11 21:23:21 +02:00
{
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa_key_slot_t *slot = NULL;
Implement psa_key_agreement_raw_shared_secret Refactor: split psa_key_agreement_raw_internal out of psa_key_agreement_internal, and call it from psa_key_agreement_raw_shared_secret as well.
2019-04-11 21:23:21 +02:00
if( ! PSA_ALG_IS_KEY_AGREEMENT( alg ) )
{
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
}
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
status = psa_get_and_lock_transparent_key_slot_with_policy(
private_key, &slot, PSA_KEY_USAGE_DERIVE, alg );
Implement psa_key_agreement_raw_shared_secret Refactor: split psa_key_agreement_raw_internal out of psa_key_agreement_internal, and call it from psa_key_agreement_raw_shared_secret as well.
2019-04-11 21:23:21 +02:00
if( status != PSA_SUCCESS )
goto exit;
psa_raw_key_agreement: return BUFFER_TOO_SMALL when warranted psa_raw_key_agreement() returned PSA_ERROR_INVALID_ARGUMENT instead of PSA_ERROR_BUFFER_TOO_SMALL when the output buffer was too small for ECDH, the only algorithm that is currently implemented. Make it return the correct error code. The reason for the wrong error code is that ecdh.c returns MBEDTLS_ERR_ECP_BAD_INPUT_DATA, presumably for similarith with dhm.c. It might make sense to change ecdh.c to use MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL, but dhm.c doesn't have an existing BUFFER_TOO_SMALL error. To minimize the impact of the fix, handle this in the PSA layer. Fixes #5735. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2022-04-14 00:17:15 +02:00
/* PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE() is in general an upper bound
* for the output size. The PSA specification only guarantees that this
* function works if output_size >= PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE(...),
* but it might be nice to allow smaller buffers if the output fits.
* At the time of writing this comment, with only ECDH implemented,
* PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE() is exact so the point is moot.
* If FFDH is implemented, PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE() can easily
* be exact for it as well. */
size_t expected_length =
PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE( slot->attr.type, slot->attr.bits );
if( output_size < expected_length )
{
status = PSA_ERROR_BUFFER_TOO_SMALL;
goto exit;
}
Implement psa_key_agreement_raw_shared_secret Refactor: split psa_key_agreement_raw_internal out of psa_key_agreement_internal, and call it from psa_key_agreement_raw_shared_secret as well.
2019-04-11 21:23:21 +02:00
status = psa_key_agreement_raw_internal( alg, slot,
peer_key, peer_key_length,
output, output_size,
output_length );
exit:
if( status != PSA_SUCCESS )
{
/* If an error happens and is not handled properly, the output
* may be used as a key to protect sensitive data. Arrange for such
* a key to be random, which is likely to result in decryption or
* verification errors. This is better than filling the buffer with
* some constant data such as zeros, which would result in the data
* being protected with a reproducible, easily knowable key.
*/
psa_generate_random( output, output_size );
*output_length = output_size;
}
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
unlock_status = psa_unlock_key_slot( slot );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa: Rename functions to get a key slot Rename functions to get a key slot: . to make their naming more consistent . to emphasize that those functions set a lock on the key slot they return to protect it from being wiped out and re-used while some part of the library is accessing it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 16:35:34 +01:00
return( ( status == PSA_SUCCESS ) ? unlock_status : status );
Implement psa_key_agreement_raw_shared_secret Refactor: split psa_key_agreement_raw_internal out of psa_key_agreement_internal, and call it from psa_key_agreement_raw_shared_secret as well.
2019-04-11 21:23:21 +02:00
}
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 12:01:02 +02:00
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 17:02:26 +01:00
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
/****************************************************************/
/* Random generation */
Implement psa_generate_random
2018-06-19 22:00:52 +02:00
/****************************************************************/
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 17:02:26 +01:00
/** Initialize the PSA random generator.
*/
static void mbedtls_psa_random_init( mbedtls_psa_random_context_t *rng )
{
Implement MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG Implement support for MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG. For test purposes, write an implementation that uses libc rand(). Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 18:47:18 +01:00
#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
memset( rng, 0, sizeof( *rng ) );
#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 17:02:26 +01:00
/* Set default configuration if
* mbedtls_psa_crypto_configure_entropy_sources() hasn't been called. */
if( rng->entropy_init == NULL )
rng->entropy_init = mbedtls_entropy_init;
if( rng->entropy_free == NULL )
rng->entropy_free = mbedtls_entropy_free;
rng->entropy_init( &rng->entropy );
#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \
defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES)
/* The PSA entropy injection feature depends on using NV seed as an entropy
* source. Add NV seed as an entropy source for PSA entropy injection. */
mbedtls_entropy_add_source( &rng->entropy,
mbedtls_nv_seed_poll, NULL,
MBEDTLS_ENTROPY_BLOCK_SIZE,
MBEDTLS_ENTROPY_SOURCE_STRONG );
#endif
Replace mbedtls_psa_random_state( ... ) by MBEDTLS_PSA_RANDOM_STATE Hide the obtention of the pointer to the RNG state behind a macro. To make it possible to use this macro in a module other than psa_crypto.c, which will happen in the future, make sure that the definition of the macro does not reference internal variables of psa_crypto.c. For this purpose, in the internal-DRBG case, export a symbol containing the address of the DRBG state. When the RNG state is a pointer a DRBG state, just keep this pointer in a variable: there's no need to store a pointer to a larger structure. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-14 14:54:06 +01:00
mbedtls_psa_drbg_init( MBEDTLS_PSA_RANDOM_STATE );
Implement MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG Implement support for MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG. For test purposes, write an implementation that uses libc rand(). Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 18:47:18 +01:00
#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 17:02:26 +01:00
}
/** Deinitialize the PSA random generator.
*/
static void mbedtls_psa_random_free( mbedtls_psa_random_context_t *rng )
{
Implement MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG Implement support for MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG. For test purposes, write an implementation that uses libc rand(). Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 18:47:18 +01:00
#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
memset( rng, 0, sizeof( *rng ) );
#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Replace mbedtls_psa_random_state( ... ) by MBEDTLS_PSA_RANDOM_STATE Hide the obtention of the pointer to the RNG state behind a macro. To make it possible to use this macro in a module other than psa_crypto.c, which will happen in the future, make sure that the definition of the macro does not reference internal variables of psa_crypto.c. For this purpose, in the internal-DRBG case, export a symbol containing the address of the DRBG state. When the RNG state is a pointer a DRBG state, just keep this pointer in a variable: there's no need to store a pointer to a larger structure. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-14 14:54:06 +01:00
mbedtls_psa_drbg_free( MBEDTLS_PSA_RANDOM_STATE );
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 17:02:26 +01:00
rng->entropy_free( &rng->entropy );
Implement MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG Implement support for MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG. For test purposes, write an implementation that uses libc rand(). Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 18:47:18 +01:00
#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 17:02:26 +01:00
}
/** Seed the PSA random generator.
*/
static psa_status_t mbedtls_psa_random_seed( mbedtls_psa_random_context_t *rng )
{
Implement MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG Implement support for MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG. For test purposes, write an implementation that uses libc rand(). Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 18:47:18 +01:00
#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
/* Do nothing: the external RNG seeds itself. */
(void) rng;
return( PSA_SUCCESS );
#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 17:02:26 +01:00
const unsigned char drbg_seed[] = "PSA";
Replace mbedtls_psa_random_state( ... ) by MBEDTLS_PSA_RANDOM_STATE Hide the obtention of the pointer to the RNG state behind a macro. To make it possible to use this macro in a module other than psa_crypto.c, which will happen in the future, make sure that the definition of the macro does not reference internal variables of psa_crypto.c. For this purpose, in the internal-DRBG case, export a symbol containing the address of the DRBG state. When the RNG state is a pointer a DRBG state, just keep this pointer in a variable: there's no need to store a pointer to a larger structure. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-14 14:54:06 +01:00
int ret = mbedtls_psa_drbg_seed( &rng->entropy,
drbg_seed, sizeof( drbg_seed ) - 1 );
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 17:02:26 +01:00
return mbedtls_to_psa_error( ret );
Implement MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG Implement support for MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG. For test purposes, write an implementation that uses libc rand(). Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 18:47:18 +01:00
#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 17:02:26 +01:00
}
Implement psa_generate_random
2018-06-19 22:00:52 +02:00
psa_status_t psa_generate_random( uint8_t *output,
size_t output_size )
{
Ensure the module is initialized in psa_generate_random
2018-09-06 15:24:41 +02:00
GUARD_MODULE_INITIALIZED;
Implement MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG Implement support for MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG. For test purposes, write an implementation that uses libc rand(). Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 18:47:18 +01:00
#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
size_t output_length = 0;
psa_status_t status = mbedtls_psa_external_get_random( &global_data.rng,
output, output_size,
&output_length );
if( status != PSA_SUCCESS )
return( status );
/* Breaking up a request into smaller chunks is currently not supported
* for the extrernal RNG interface. */
if( output_length != output_size )
return( PSA_ERROR_INSUFFICIENT_ENTROPY );
return( PSA_SUCCESS );
#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Simplify the chunk loop in psa_generate_random Make the code slightly more readable and slightly smaller. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-04 21:01:07 +01:00
while( output_size > 0 )
Fix psa_generate_random for >1024 bytes mbedtls_ctr_drbg_random can only return up to MBEDTLS_CTR_DRBG_MAX_REQUEST (normally 1024) bytes at a time. So if more than that is requested, call mbedtls_ctr_drbg_random in a loop.
2019-08-07 13:49:00 +02:00
{
Simplify the chunk loop in psa_generate_random Make the code slightly more readable and slightly smaller. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-04 21:01:07 +01:00
size_t request_size =
( output_size > MBEDTLS_PSA_RANDOM_MAX_REQUEST ?
MBEDTLS_PSA_RANDOM_MAX_REQUEST :
output_size );
Fix the error detection in psa_generate_random If a call to mbedtls_psa_get_random other than the last one failed, this went undetected. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-05 14:10:59 +01:00
int ret = mbedtls_psa_get_random( MBEDTLS_PSA_RANDOM_STATE,
output, request_size );
Fix psa_generate_random for >1024 bytes mbedtls_ctr_drbg_random can only return up to MBEDTLS_CTR_DRBG_MAX_REQUEST (normally 1024) bytes at a time. So if more than that is requested, call mbedtls_ctr_drbg_random in a loop.
2019-08-07 13:49:00 +02:00
if( ret != 0 )
return( mbedtls_to_psa_error( ret ) );
Simplify the chunk loop in psa_generate_random Make the code slightly more readable and slightly smaller. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-04 21:01:07 +01:00
output_size -= request_size;
output += request_size;
Fix psa_generate_random for >1024 bytes mbedtls_ctr_drbg_random can only return up to MBEDTLS_CTR_DRBG_MAX_REQUEST (normally 1024) bytes at a time. So if more than that is requested, call mbedtls_ctr_drbg_random in a loop.
2019-08-07 13:49:00 +02:00
}
Fix the error detection in psa_generate_random If a call to mbedtls_psa_get_random other than the last one failed, this went undetected. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-05 14:10:59 +01:00
return( PSA_SUCCESS );
Implement MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG Implement support for MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG. For test purposes, write an implementation that uses libc rand(). Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 18:47:18 +01:00
#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Implement psa_generate_random
2018-06-19 22:00:52 +02:00
}
Fix psa_generate_random for >1024 bytes mbedtls_ctr_drbg_random can only return up to MBEDTLS_CTR_DRBG_MAX_REQUEST (normally 1024) bytes at a time. So if more than that is requested, call mbedtls_ctr_drbg_random in a loop.
2019-08-07 13:49:00 +02:00
Make mbedtls_psa_get_random more usable outside psa_crypto.c In the external RNG case, don't make mbedtls_psa_get_random() a static inline function: this would likely result in identical instances of this function in every module that uses it. Instead, make it a single function with external linkage. In the non-external case, instead of a trivial wrapper function, make mbedtls_psa_get_random a constant pointer to whichever DRBG function is being used. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-14 15:33:44 +01:00
/* Wrapper function allowing the classic API to use the PSA RNG.
Explain the design of mbedtls_psa_get_random better Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-05 16:03:55 +01:00
*
* `mbedtls_psa_get_random(MBEDTLS_PSA_RANDOM_STATE, ...)` calls
* `psa_generate_random(...)`. The state parameter is ignored since the
* PSA API doesn't support passing an explicit state.
*
* In the non-external case, psa_generate_random() calls an
* `mbedtls_xxx_drbg_random` function which has exactly the same signature
* and semantics as mbedtls_psa_get_random(). As an optimization,
* instead of doing this back-and-forth between the PSA API and the
* classic API, psa_crypto_random_impl.h defines `mbedtls_psa_get_random`
* as a constant function pointer to `mbedtls_xxx_drbg_random`.
Make mbedtls_psa_get_random more usable outside psa_crypto.c In the external RNG case, don't make mbedtls_psa_get_random() a static inline function: this would likely result in identical instances of this function in every module that uses it. Instead, make it a single function with external linkage. In the non-external case, instead of a trivial wrapper function, make mbedtls_psa_get_random a constant pointer to whichever DRBG function is being used. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-14 15:33:44 +01:00
*/
#if defined (MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
int mbedtls_psa_get_random( void *p_rng,
unsigned char *output,
size_t output_size )
{
Explain the design of mbedtls_psa_get_random better Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-01-05 16:03:55 +01:00
/* This function takes a pointer to the RNG state because that's what
* classic mbedtls functions using an RNG expect. The PSA RNG manages
* its own state internally and doesn't let the caller access that state.
* So we just ignore the state parameter, and in practice we'll pass
* NULL. */
Make mbedtls_psa_get_random more usable outside psa_crypto.c In the external RNG case, don't make mbedtls_psa_get_random() a static inline function: this would likely result in identical instances of this function in every module that uses it. Instead, make it a single function with external linkage. In the non-external case, instead of a trivial wrapper function, make mbedtls_psa_get_random a constant pointer to whichever DRBG function is being used. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-14 15:33:44 +01:00
(void) p_rng;
psa_status_t status = psa_generate_random( output, output_size );
if( status == PSA_SUCCESS )
return( 0 );
else
return( MBEDTLS_ERR_ENTROPY_SOURCE_FAILED );
Implement psa_generate_random
2018-06-19 22:00:52 +02:00
}
Make mbedtls_psa_get_random more usable outside psa_crypto.c In the external RNG case, don't make mbedtls_psa_get_random() a static inline function: this would likely result in identical instances of this function in every module that uses it. Instead, make it a single function with external linkage. In the non-external case, instead of a trivial wrapper function, make mbedtls_psa_get_random a constant pointer to whichever DRBG function is being used. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-12-14 15:33:44 +01:00
#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
Implement psa_generate_random
2018-06-19 22:00:52 +02:00
Gate entropy injection through a dedicated configuration option Entropy injection has specific testing requirements. Therefore it should depend on a specific option.
2019-02-25 11:04:06 +01:00
#if defined(MBEDTLS_PSA_INJECT_ENTROPY)
Move entropy_poll.h to library `entropy_poll.h` is not supposed to be used by application code and is therefore being made internal. Signed-off-by: Chris Jones <christopher.jones@arm.com>
2021-03-09 20:11:19 +01:00
#include "entropy_poll.h"
Gate entropy injection through a dedicated configuration option Entropy injection has specific testing requirements. Therefore it should depend on a specific option.
2019-02-25 11:04:06 +01:00
Favor stdint.h types in implementation-specific API
2019-07-15 11:06:15 +02:00
psa_status_t mbedtls_psa_inject_entropy( const uint8_t *seed,
Add entropy injection function to psa cripto APIs
2018-11-19 10:53:02 +01:00
size_t seed_size )
{
if( global_data.initialized )
return( PSA_ERROR_NOT_PERMITTED );
Add Tests for psa crypto entropy incjection Adjust code to handle and work with MBEDTLS_ENTROPY_BLOCK_SIZE definition option
2018-11-19 10:53:55 +01:00
if( ( ( seed_size < MBEDTLS_ENTROPY_MIN_PLATFORM ) ||
( seed_size < MBEDTLS_ENTROPY_BLOCK_SIZE ) ) ||
( seed_size > MBEDTLS_ENTROPY_MAX_SEED_SIZE ) )
return( PSA_ERROR_INVALID_ARGUMENT );
Gate entropy injection through a dedicated configuration option Entropy injection has specific testing requirements. Therefore it should depend on a specific option.
2019-02-25 11:04:06 +01:00
return( mbedtls_psa_storage_inject_entropy( seed, seed_size ) );
Add entropy injection function to psa cripto APIs
2018-11-19 10:53:02 +01:00
}
Gate entropy injection through a dedicated configuration option Entropy injection has specific testing requirements. Therefore it should depend on a specific option.
2019-02-25 11:04:06 +01:00
#endif /* MBEDTLS_PSA_INJECT_ENTROPY */
Add entropy injection function to psa cripto APIs
2018-11-19 10:53:02 +01:00
psa: key generation: Use PSA_EXPORT_KEY_OUTPUT_SIZE Use PSA_EXPORT_KEY_OUTPUT_SIZE macro to compute the size of the buffer to contain the generated key instead of computing it alongside the key type and size validation. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-02-08 16:10:05 +01:00
/** Validate the key type and size for key generation
Move key buffer size computation out of psa_generate_key_internal() Preparatory commit to eventually change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. To be able to change the signature, the buffer to store the key has to be allocated before the call to psa_generate_key_internal() thus its size has to be calculed beforehand as well. This is the purpose of this commit: to move the computation of the key size in bytes out of psa_generate_key_internal(). Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-05 09:42:02 +02:00
*
psa: key generation: Use PSA_EXPORT_KEY_OUTPUT_SIZE Use PSA_EXPORT_KEY_OUTPUT_SIZE macro to compute the size of the buffer to contain the generated key instead of computing it alongside the key type and size validation. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-02-08 16:10:05 +01:00
* \param type The key type
* \param bits The number of bits of the key
Move key buffer size computation out of psa_generate_key_internal() Preparatory commit to eventually change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. To be able to change the signature, the buffer to store the key has to be allocated before the call to psa_generate_key_internal() thus its size has to be calculed beforehand as well. This is the purpose of this commit: to move the computation of the key size in bytes out of psa_generate_key_internal(). Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-05 09:42:02 +02:00
*
* \retval #PSA_SUCCESS
psa: key generation: Use PSA_EXPORT_KEY_OUTPUT_SIZE Use PSA_EXPORT_KEY_OUTPUT_SIZE macro to compute the size of the buffer to contain the generated key instead of computing it alongside the key type and size validation. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-02-08 16:10:05 +01:00
* The key type and size are valid.
Move key buffer size computation out of psa_generate_key_internal() Preparatory commit to eventually change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. To be able to change the signature, the buffer to store the key has to be allocated before the call to psa_generate_key_internal() thus its size has to be calculed beforehand as well. This is the purpose of this commit: to move the computation of the key size in bytes out of psa_generate_key_internal(). Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-05 09:42:02 +02:00
* \retval #PSA_ERROR_INVALID_ARGUMENT
* The size in bits of the key is not valid.
* \retval #PSA_ERROR_NOT_SUPPORTED
* The type and/or the size in bits of the key or the combination of
* the two is not supported.
*/
psa: key generation: Use PSA_EXPORT_KEY_OUTPUT_SIZE Use PSA_EXPORT_KEY_OUTPUT_SIZE macro to compute the size of the buffer to contain the generated key instead of computing it alongside the key type and size validation. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-02-08 16:10:05 +01:00
static psa_status_t psa_validate_key_type_and_size_for_key_generation(
psa_key_type_t type, size_t bits )
Move key buffer size computation out of psa_generate_key_internal() Preparatory commit to eventually change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. To be able to change the signature, the buffer to store the key has to be allocated before the call to psa_generate_key_internal() thus its size has to be calculed beforehand as well. This is the purpose of this commit: to move the computation of the key size in bytes out of psa_generate_key_internal(). Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-05 09:42:02 +02:00
{
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
if( key_type_is_raw_bytes( type ) )
{
Add test driver support for opaque key import -Add test driver support to import/export while wrapping keys meant to be stored in the PSA core as opaque( emulating an SE without storage ). -Export validate_unstructured_key_bit_size as psa_validate_unstructured_key_bit_size, thereby changing its scope. -Improve the import/export test cases in test_suite_psa_crypto to also cover opaque keys, thereby avoiding duplication. Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-07-06 23:20:22 +02:00
status = psa_validate_unstructured_key_bit_size( type, bits );
Move key buffer size computation out of psa_generate_key_internal() Preparatory commit to eventually change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. To be able to change the signature, the buffer to store the key has to be allocated before the call to psa_generate_key_internal() thus its size has to be calculed beforehand as well. This is the purpose of this commit: to move the computation of the key size in bytes out of psa_generate_key_internal(). Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-05 09:42:02 +02:00
if( status != PSA_SUCCESS )
return( status );
}
else
psa: Extend psa_get_key_buffer_size scope When generating transparent keys, we need to be able to compute the size of the key buffer whether the key is generated by the Mbed TLS library or by an accelerator. Thus, change the RSA/ECP MBEDTLS_PSA_BUILTIN_... compilation guards with their PSA_WANT_... counterparts. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-12-07 11:07:24 +01:00
#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR)
Move key buffer size computation out of psa_generate_key_internal() Preparatory commit to eventually change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. To be able to change the signature, the buffer to store the key has to be allocated before the call to psa_generate_key_internal() thus its size has to be calculed beforehand as well. This is the purpose of this commit: to move the computation of the key size in bytes out of psa_generate_key_internal(). Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-05 09:42:02 +02:00
if( PSA_KEY_TYPE_IS_RSA( type ) && PSA_KEY_TYPE_IS_KEY_PAIR( type ) )
{
if( bits > PSA_VENDOR_RSA_MAX_KEY_BITS )
return( PSA_ERROR_NOT_SUPPORTED );
/* Accept only byte-aligned keys, for the same reasons as
* in psa_import_rsa_key(). */
if( bits % 8 != 0 )
return( PSA_ERROR_NOT_SUPPORTED );
}
else
psa: Extend psa_get_key_buffer_size scope When generating transparent keys, we need to be able to compute the size of the key buffer whether the key is generated by the Mbed TLS library or by an accelerator. Thus, change the RSA/ECP MBEDTLS_PSA_BUILTIN_... compilation guards with their PSA_WANT_... counterparts. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-12-07 11:07:24 +01:00
#endif /* defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR) */
Move key buffer size computation out of psa_generate_key_internal() Preparatory commit to eventually change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. To be able to change the signature, the buffer to store the key has to be allocated before the call to psa_generate_key_internal() thus its size has to be calculed beforehand as well. This is the purpose of this commit: to move the computation of the key size in bytes out of psa_generate_key_internal(). Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-05 09:42:02 +02:00
psa: Extend psa_get_key_buffer_size scope When generating transparent keys, we need to be able to compute the size of the key buffer whether the key is generated by the Mbed TLS library or by an accelerator. Thus, change the RSA/ECP MBEDTLS_PSA_BUILTIN_... compilation guards with their PSA_WANT_... counterparts. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-12-07 11:07:24 +01:00
#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR)
Move key buffer size computation out of psa_generate_key_internal() Preparatory commit to eventually change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. To be able to change the signature, the buffer to store the key has to be allocated before the call to psa_generate_key_internal() thus its size has to be calculed beforehand as well. This is the purpose of this commit: to move the computation of the key size in bytes out of psa_generate_key_internal(). Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-05 09:42:02 +02:00
if( PSA_KEY_TYPE_IS_ECC( type ) && PSA_KEY_TYPE_IS_KEY_PAIR( type ) )
{
psa: Avoid empty block Avoid empty block to ease maintenance. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-02-16 09:01:16 +01:00
/* To avoid empty block, return successfully here. */
return( PSA_SUCCESS );
Move key buffer size computation out of psa_generate_key_internal() Preparatory commit to eventually change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. To be able to change the signature, the buffer to store the key has to be allocated before the call to psa_generate_key_internal() thus its size has to be calculed beforehand as well. This is the purpose of this commit: to move the computation of the key size in bytes out of psa_generate_key_internal(). Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-05 09:42:02 +02:00
}
else
psa: Extend psa_get_key_buffer_size scope When generating transparent keys, we need to be able to compute the size of the key buffer whether the key is generated by the Mbed TLS library or by an accelerator. Thus, change the RSA/ECP MBEDTLS_PSA_BUILTIN_... compilation guards with their PSA_WANT_... counterparts. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-12-07 11:07:24 +01:00
#endif /* defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR) */
Move key buffer size computation out of psa_generate_key_internal() Preparatory commit to eventually change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. To be able to change the signature, the buffer to store the key has to be allocated before the call to psa_generate_key_internal() thus its size has to be calculed beforehand as well. This is the purpose of this commit: to move the computation of the key size in bytes out of psa_generate_key_internal(). Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-05 09:42:02 +02:00
{
return( PSA_ERROR_NOT_SUPPORTED );
}
return( PSA_SUCCESS );
}
Export "internally" psa_generate_key_internal() Export psa_generate_key_internal() to make it available to the driver wrapper. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-05 10:30:40 +02:00
psa_status_t psa_generate_key_internal(
Change psa_generate_key_internal() signature Change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. That way, this function can be called by the driver wrapper when a software fallback is necessary. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-02 20:02:04 +02:00
const psa_key_attributes_t *attributes,
uint8_t *key_buffer, size_t key_buffer_size, size_t *key_buffer_length )
Implement psa_generate_random
2018-06-19 22:00:52 +02:00
{
Improve psa_generate_key_internal() Small improvements to psa_generate_key_internal() implementation: . declare only once the status local variable and initialize it to PSA_ERROR_CORRUPTION_DETECTED to improve robustness against FI attacks. . remove an unnecessary assignment. . use type local variable instead of its global variable equivalent. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-02 20:11:59 +02:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Change psa_generate_key_internal() signature Change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. That way, this function can be called by the driver wrapper when a software fallback is necessary. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-02 20:02:04 +02:00
psa_key_type_t type = attributes->core.type;
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-20 00:20:32 +02:00
Change psa_generate_key_internal() signature Change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. That way, this function can be called by the driver wrapper when a software fallback is necessary. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-02 20:02:04 +02:00
if( ( attributes->domain_parameters == NULL ) &&
( attributes->domain_parameters_size != 0 ) )
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-20 00:20:32 +02:00
return( PSA_ERROR_INVALID_ARGUMENT );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
Remove PSA_KEY_TYPE_IS_RAW_BYTES from crypto.h It isn't used to define other macros and it doesn't seem that useful for users. Remove it, we can reintroduce it if needed. Define a similar function key_type_is_raw_bytes in the implementation with a clear semantics: it's a key that's represented as a struct raw_data.
2018-06-21 14:15:31 +02:00
if( key_type_is_raw_bytes( type ) )
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-20 00:20:32 +02:00
{
Change psa_generate_key_internal() signature Change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. That way, this function can be called by the driver wrapper when a software fallback is necessary. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-02 20:02:04 +02:00
status = psa_generate_random( key_buffer, key_buffer_size );
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-20 00:20:32 +02:00
if( status != PSA_SUCCESS )
return( status );
Pull apart slot memory allocation from key validation. Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-07-24 22:04:59 +02:00
Change some conditionals of PSA to use BUILTIN Change a few conditionals in the psa library to be based on the MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES instead of the WANT macros. Future additions of HW acceleration will need to be mindful of these definitions if any of this code is needed in those instances. Signed-off-by: David Brown <david.brown@linaro.org>
2021-02-11 19:02:00 +01:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-20 00:20:32 +02:00
if( type == PSA_KEY_TYPE_DES )
Change psa_generate_key_internal() signature Change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. That way, this function can be called by the driver wrapper when a software fallback is necessary. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-02 20:02:04 +02:00
psa_des_set_key_parity( key_buffer, key_buffer_size );
Fix 2 endif comments Two endif comments didn't match the ifdef. Fix these to match. Signed-off-by: David Brown <david.brown@linaro.org>
2021-02-12 16:08:46 +01:00
#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-20 00:20:32 +02:00
}
else
psa: Support RSA signature without MBEDTLS_GENPRIME On space-constrained platforms, it is a useful configuration to be able to import/export and perform RSA key pair operations, but to exclude RSA key generation, potentially saving flash space. It is not possible to express this with the PSA_WANT_ configuration system at the present time. However, in previous versions of Mbed TLS (v2.24.0 and earlier) it was possible to configure a software PSA implementation which was capable of making RSA signatures but not capable of generating RSA keys. To do this, one unset MBEDTLS_GENPRIME. Since the addition of MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR, this expressivity was lost. Expressing that you wanted to work with RSA key pairs forced you to include the ability to generate key pairs as well. Change psa_crypto_rsa.c to only call mbedtls_rsa_gen_key() if MBEDTLS_GENPRIME is also set. This restores the configuration behavior present in Mbed TLS v2.24.0 and earlier versions. It left as a future exercise to add the ability to PSA to be able to express a desire for a software or accelerator configuration that includes RSA key pair operations, like signature, but excludes key pair generation. Without this change, linker errors will occur when attempts to call, which doesn't exist when MBEDTLS_GENPRIME is unset. psa_crypto_rsa.c.obj: in function `rsa_generate_key': psa_crypto_rsa.c:320: undefined reference to `mbedtls_rsa_gen_key' Fixes #4512 Signed-off-by: Jaeden Amero <jaeden.amero@arm.com>
2021-05-14 09:34:32 +02:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) && \
defined(MBEDTLS_GENPRIME)
Rename *KEYPAIR* to *KEY_PAIR* Be consistent with PUBLIC_KEY. perl -i -pe 's/KEYPAIR/KEY_PAIR/g' $(git ls-files)
2019-05-16 19:39:54 +02:00
if ( type == PSA_KEY_TYPE_RSA_KEY_PAIR )
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-20 00:20:32 +02:00
{
Move RSA key generation code to the PSA RSA specific C file Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-05 17:36:40 +01:00
return( mbedtls_psa_rsa_generate_key( attributes,
key_buffer,
key_buffer_size,
key_buffer_length ) );
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-20 00:20:32 +02:00
}
else
psa: Support RSA signature without MBEDTLS_GENPRIME On space-constrained platforms, it is a useful configuration to be able to import/export and perform RSA key pair operations, but to exclude RSA key generation, potentially saving flash space. It is not possible to express this with the PSA_WANT_ configuration system at the present time. However, in previous versions of Mbed TLS (v2.24.0 and earlier) it was possible to configure a software PSA implementation which was capable of making RSA signatures but not capable of generating RSA keys. To do this, one unset MBEDTLS_GENPRIME. Since the addition of MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR, this expressivity was lost. Expressing that you wanted to work with RSA key pairs forced you to include the ability to generate key pairs as well. Change psa_crypto_rsa.c to only call mbedtls_rsa_gen_key() if MBEDTLS_GENPRIME is also set. This restores the configuration behavior present in Mbed TLS v2.24.0 and earlier versions. It left as a future exercise to add the ability to PSA to be able to express a desire for a software or accelerator configuration that includes RSA key pair operations, like signature, but excludes key pair generation. Without this change, linker errors will occur when attempts to call, which doesn't exist when MBEDTLS_GENPRIME is unset. psa_crypto_rsa.c.obj: in function `rsa_generate_key': psa_crypto_rsa.c:320: undefined reference to `mbedtls_rsa_gen_key' Fixes #4512 Signed-off-by: Jaeden Amero <jaeden.amero@arm.com>
2021-05-14 09:34:32 +02:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR)
* defined(MBEDTLS_GENPRIME) */
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-20 00:20:32 +02:00
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 21:28:15 +01:00
#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR)
Rename *KEYPAIR* to *KEY_PAIR* Be consistent with PUBLIC_KEY. perl -i -pe 's/KEYPAIR/KEY_PAIR/g' $(git ls-files)
2019-05-16 19:39:54 +02:00
if ( PSA_KEY_TYPE_IS_ECC( type ) && PSA_KEY_TYPE_IS_KEY_PAIR( type ) )
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-20 00:20:32 +02:00
{
Move ECP key generation code to the PSA ECP specific C file Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-20 18:17:42 +01:00
return( mbedtls_psa_ecp_generate_key( attributes,
key_buffer,
key_buffer_size,
key_buffer_length ) );
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-20 00:20:32 +02:00
}
else
Minor updates from review comments Updated macros in config_psa.h that used ECC_xxx to use KEY_TYPE_ECC_xxx per comments from review. Implemented a check_config_psa.h to help with dependency checking of features enabled in config_psa.h. Added check_config_psa.h to visual studio project. Signed-off-by: John Durkop <john.durkop@fermatsoftware.com>
2020-11-04 21:28:15 +01:00
#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) */
Style fixes * return is treated as a function call * space between opening and closing parentheses * remove whiteline between assignment and checking of same variable Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-05 15:43:42 +02:00
{
Change psa_generate_key_internal() signature Change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. That way, this function can be called by the driver wrapper when a software fallback is necessary. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-02 20:02:04 +02:00
(void)key_buffer_length;
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-20 00:20:32 +02:00
return( PSA_ERROR_NOT_SUPPORTED );
Style fixes * return is treated as a function call * space between opening and closing parentheses * remove whiteline between assignment and checking of same variable Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
2020-08-05 15:43:42 +02:00
}
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-20 00:20:32 +02:00
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 12:53:30 +02:00
return( PSA_SUCCESS );
}
psa: Extend psa_generate_key to support persistent lifetimes
2018-11-07 17:05:30 +01:00
Rename psa_generate_random_key back to psa_generate_key generate_key is a more classical name. The longer name was only introduced to avoid confusion with getting a key from a generator, which is key derivation, but we no longer use the generator terminology so this reason no longer applies. perl -i -pe 's/psa_generate_random_key/psa_generate_key/g' $(git ls-files)
2019-05-16 19:42:05 +02:00
psa_status_t psa_generate_key( const psa_key_attributes_t *attributes,
psa: Move from key handle to key identifier Move all the PSA crypto APIs using key handles to use key identifiers but psa_key_open() and psa_key_close(). This is done without modifying any test as key handles and key identifiers are now the same. Update the library modules using PSA crypto APIs to get rid of key handles. Programs and unit tests are updated to not use key handles in subsequent commits, not in this one. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 09:51:30 +02:00
mbedtls_svc_key_id_t *key )
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 12:53:30 +02:00
{
psa_status_t status;
psa_key_slot_t *slot = NULL;
Driver table entries are now mutable Since driver table entries contain the driver context, which is mutable, they can't be const anymore.
2019-07-12 23:40:35 +02:00
psa_se_drv_table_entry_t *driver = NULL;
Move key buffer allocation out of psa_generate_key_internal() Preparatory commit to eventually change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. To be able to change the signature, the buffer to store the generated key has to be allocated before the call to psa_generate_key_internal(). This commit moves the allocation and clean-up in case of error of the buffer to store the generated key from psa_generate_key_internal() to psa_generate_key(). This has the nice benefit of factorizing the key buffer allocation and clean-up. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-05 10:02:26 +02:00
size_t key_buffer_size;
SE keys: implement and smoke-test p_generate
2019-08-06 18:36:36 +02:00
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 12:10:32 +01:00
*key = MBEDTLS_SVC_KEY_ID_INIT;
Reject keys of size 0 Implement the prohibition on keys of size 0.
2019-09-12 19:03:13 +02:00
/* Reject any attempt to create a zero-length key so that we don't
* risk tripping up later, e.g. on a malloc(0) that returns NULL. */
if( psa_get_key_bits( attributes ) == 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
psa_generate_key(): return PSA_ERROR_INVALID_ARGUMENT for public key Signed-off-by: Przemyslaw Stekiel <przemyslaw.stekiel@mobica.com>
2021-10-07 11:08:56 +02:00
/* Reject any attempt to create a public key. */
if( PSA_KEY_TYPE_IS_PUBLIC_KEY(attributes->core.type) )
return( PSA_ERROR_INVALID_ARGUMENT );
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 12:10:32 +01:00
status = psa_start_key_creation( PSA_KEY_CREATION_GENERATE, attributes,
&slot, &driver );
SE keys: implement and smoke-test p_generate
2019-08-06 18:36:36 +02:00
if( status != PSA_SUCCESS )
goto exit;
Call software implementation as a driver Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-13 08:32:21 +02:00
/* In the case of a transparent key or an opaque key stored in local
Code style improvements Signed-off-by: Archana <archana.madhavan@silabs.com>
2021-09-08 12:06:05 +02:00
* storage ( thus not in the case of generating a key in a secure element
* with storage ( MBEDTLS_PSA_CRYPTO_SE_C ) ),we have to allocate a
* buffer to hold the generated key material. */
Call software implementation as a driver Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-13 08:32:21 +02:00
if( slot->key.data == NULL )
{
if ( PSA_KEY_LIFETIME_GET_LOCATION( attributes->core.lifetime ) ==
PSA_KEY_LOCATION_LOCAL_STORAGE )
{
psa: key generation: Use PSA_EXPORT_KEY_OUTPUT_SIZE Use PSA_EXPORT_KEY_OUTPUT_SIZE macro to compute the size of the buffer to contain the generated key instead of computing it alongside the key type and size validation. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-02-08 16:10:05 +01:00
status = psa_validate_key_type_and_size_for_key_generation(
attributes->core.type, attributes->core.bits );
if( status != PSA_SUCCESS )
goto exit;
key_buffer_size = PSA_EXPORT_KEY_OUTPUT_SIZE(
attributes->core.type,
attributes->core.bits );
Call software implementation as a driver Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-13 08:32:21 +02:00
}
else
{
status = psa_driver_wrapper_get_key_buffer_size(
attributes, &key_buffer_size );
psa: key generation: Use PSA_EXPORT_KEY_OUTPUT_SIZE Use PSA_EXPORT_KEY_OUTPUT_SIZE macro to compute the size of the buffer to contain the generated key instead of computing it alongside the key type and size validation. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-02-08 16:10:05 +01:00
if( status != PSA_SUCCESS )
goto exit;
Call software implementation as a driver Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-13 08:32:21 +02:00
}
Move key buffer allocation out of psa_generate_key_internal() Preparatory commit to eventually change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. To be able to change the signature, the buffer to store the generated key has to be allocated before the call to psa_generate_key_internal(). This commit moves the allocation and clean-up in case of error of the buffer to store the generated key from psa_generate_key_internal() to psa_generate_key(). This has the nice benefit of factorizing the key buffer allocation and clean-up. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-05 10:02:26 +02:00
Call software implementation as a driver Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-13 08:32:21 +02:00
status = psa_allocate_buffer_to_slot( slot, key_buffer_size );
if( status != PSA_SUCCESS )
goto exit;
}
Move key buffer allocation out of psa_generate_key_internal() Preparatory commit to eventually change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. To be able to change the signature, the buffer to store the generated key has to be allocated before the call to psa_generate_key_internal(). This commit moves the allocation and clean-up in case of error of the buffer to store the generated key from psa_generate_key_internal() to psa_generate_key(). This has the nice benefit of factorizing the key buffer allocation and clean-up. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-05 10:02:26 +02:00
Call software implementation as a driver Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-13 08:32:21 +02:00
status = psa_driver_wrapper_generate_key( attributes,
slot->key.data, slot->key.bytes, &slot->key.bytes );
SE keys: implement and smoke-test p_generate
2019-08-06 18:36:36 +02:00
Move key buffer allocation out of psa_generate_key_internal() Preparatory commit to eventually change psa_generate_key_internal() signature to that of a PSA driver generate_key entry point. To be able to change the signature, the buffer to store the generated key has to be allocated before the call to psa_generate_key_internal(). This commit moves the allocation and clean-up in case of error of the buffer to store the generated key from psa_generate_key_internal() to psa_generate_key(). This has the nice benefit of factorizing the key buffer allocation and clean-up. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-05 10:02:26 +02:00
if( status != PSA_SUCCESS )
psa_remove_key_data_from_memory( slot );
SE keys: implement and smoke-test p_generate
2019-08-06 18:36:36 +02:00
exit:
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 12:53:30 +02:00
if( status == PSA_SUCCESS )
psa: Move key identifier return to psa_finish_key_creation() Move the return of the identifier of a created key from psa_start_key_creation() to psa_finish_key_creation(). That way in case of creation error, it is less likely to return the identifier that was temporarily assigned to the key while trying to create it. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-14 12:10:32 +01:00
status = psa_finish_key_creation( slot, driver, key );
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 12:53:30 +02:00
if( status != PSA_SUCCESS )
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 18:34:38 +02:00
psa_fail_key_creation( slot, driver );
psa: mgmt: Add key slot access counter Add key slot access counter to be able to state if a key slot containing the description of a permanent key can be reset or reset and re-used. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-22 15:24:49 +02:00
psa: Extend psa_generate_key to support persistent lifetimes
2018-11-07 17:05:30 +01:00
return( status );
Implement psa_generate_random
2018-06-19 22:00:52 +02:00
}
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
/****************************************************************/
/* Module setup */
/****************************************************************/
Implement MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG Implement support for MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG. For test purposes, write an implementation that uses libc rand(). Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 18:47:18 +01:00
#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
Add a facility to configure entropy sources Add a function to configure entropy sources. For testing only. Use it to test that the library initialization fails properly if there is no entropy source.
2018-11-20 21:59:56 +01:00
psa_status_t mbedtls_psa_crypto_configure_entropy_sources(
void (* entropy_init )( mbedtls_entropy_context *ctx ),
void (* entropy_free )( mbedtls_entropy_context *ctx ) )
{
if( global_data.rng_state != RNG_NOT_INITIALIZED )
return( PSA_ERROR_BAD_STATE );
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 17:02:26 +01:00
global_data.rng.entropy_init = entropy_init;
global_data.rng.entropy_free = entropy_free;
Add a facility to configure entropy sources Add a function to configure entropy sources. For testing only. Use it to test that the library initialization fails properly if there is no entropy source.
2018-11-20 21:59:56 +01:00
return( PSA_SUCCESS );
}
Implement MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG Implement support for MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG. For test purposes, write an implementation that uses libc rand(). Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 18:47:18 +01:00
#endif /* !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) */
Add a facility to configure entropy sources Add a function to configure entropy sources. For testing only. Use it to test that the library initialization fails properly if there is no entropy source.
2018-11-20 21:59:56 +01:00
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
void mbedtls_psa_crypto_free( void )
{
Move the key slot array to the slot management module Move the key slot array and its initialization and wiping to the slot management module. Also move the lowest-level key slot access function psa_get_key_slot and the auxiliary function for slot allocation psa_internal_allocate_key_slot to the slot management module.
2018-12-10 16:29:04 +01:00
psa_wipe_all_key_slots( );
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 21:42:52 +01:00
if( global_data.rng_state != RNG_NOT_INITIALIZED )
{
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 17:02:26 +01:00
mbedtls_psa_random_free( &global_data.rng );
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 15:48:15 +01:00
}
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 21:42:52 +01:00
/* Wipe all remaining data, including configuration.
* In particular, this sets all state indicator to the value
* indicating "uninitialized". */
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 18:14:53 +01:00
mbedtls_platform_zeroize( &global_data, sizeof( global_data ) );
psa: Add driver initialization and termination Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-04-10 16:57:30 +02:00
/* Terminate drivers */
psa_driver_wrapper_free( );
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
}
Add boilerplate to recover a transaction during init
2019-07-25 17:52:59 +02:00
#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
/** Recover a transaction that was interrupted by a power failure.
*
* This function is called during initialization, before psa_crypto_init()
* returns. If this function returns a failure status, the initialization
* fails.
*/
static psa_status_t psa_crypto_recover_transaction(
const psa_crypto_transaction_t *transaction )
{
switch( transaction->unknown.type )
{
case PSA_CRYPTO_TRANSACTION_CREATE_KEY:
case PSA_CRYPTO_TRANSACTION_DESTROY_KEY:
Make TODO comments consistent
2019-08-13 13:15:34 +02:00
/* TODO - fall through to the failure case until this
Add issue numbers for some missing parts of secure element support
2019-08-13 16:17:16 +02:00
* is implemented.
* https://github.com/ARMmbed/mbed-crypto/issues/218
*/
Add boilerplate to recover a transaction during init
2019-07-25 17:52:59 +02:00
default:
/* We found an unsupported transaction in the storage.
* We don't know what state the storage is in. Give up. */
Use PSA_ERROR_DATA_INVALID error code If the file is read correctly, but it contains data that isn't valid, the crypto storage code returns PSA_ERROR_DATA_INVALID. The PSA_ERROR_DATA_CORRUPT and PSA_ERROR_STORAGE_FAILURE error codes are replaced with PSA_ERROR_DATA_INVALID, except in the ITS subsystem. Signed-off-by: gabor-mezei-arm <gabor.mezei@arm.com>
2020-11-09 17:39:56 +01:00
return( PSA_ERROR_DATA_INVALID );
Add boilerplate to recover a transaction during init
2019-07-25 17:52:59 +02:00
}
}
#endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
psa_status_t psa_crypto_init( void )
{
Move the key slot array to the slot management module Move the key slot array and its initialization and wiping to the slot management module. Also move the lowest-level key slot access function psa_get_key_slot and the auxiliary function for slot allocation psa_internal_allocate_key_slot to the slot management module.
2018-12-10 16:29:04 +01:00
psa_status_t status;
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 21:42:52 +01:00
/* Double initialization is explicitly allowed. */
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
if( global_data.initialized != 0 )
return( PSA_SUCCESS );
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 17:02:26 +01:00
/* Initialize and seed the random generator. */
mbedtls_psa_random_init( &global_data.rng );
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 21:42:52 +01:00
global_data.rng_state = RNG_INITIALIZED;
psa_crypto: create random and drbg abstraction Create wrapper functions around calls to CTR_DRBG and around calls to entropy+DRBG. This is in preparation for allowing alternative DRBG implementations that use the Mbed TLS entropy module, or complete RNG implementations that bypass the entropy module as well. This is purely a refactoring commit. No behavior change. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2020-11-13 17:02:26 +01:00
status = mbedtls_psa_random_seed( &global_data.rng );
Move the key slot array to the slot management module Move the key slot array and its initialization and wiping to the slot management module. Also move the lowest-level key slot access function psa_get_key_slot and the auxiliary function for slot allocation psa_internal_allocate_key_slot to the slot management module.
2018-12-10 16:29:04 +01:00
if( status != PSA_SUCCESS )
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
goto exit;
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 21:42:52 +01:00
global_data.rng_state = RNG_SEEDED;
Move the key slot array to the slot management module Move the key slot array and its initialization and wiping to the slot management module. Also move the lowest-level key slot access function psa_get_key_slot and the auxiliary function for slot allocation psa_internal_allocate_key_slot to the slot management module.
2018-12-10 16:29:04 +01:00
status = psa_initialize_key_slots( );
if( status != PSA_SUCCESS )
goto exit;
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
psa: Add driver initialization and termination Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2021-04-10 16:57:30 +02:00
/* Init drivers */
status = psa_driver_wrapper_init( );
SE driver: call the p_init method during psa_crypto_init()
2019-10-01 15:22:29 +02:00
if( status != PSA_SUCCESS )
goto exit;
Transaction support: be more future-proof If there's ever a non-SE-related transaction, make sure it gets handled during init.
2019-07-24 15:56:31 +02:00
#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 19:30:34 +02:00
status = psa_crypto_load_transaction( );
if( status == PSA_SUCCESS )
{
Add boilerplate to recover a transaction during init
2019-07-25 17:52:59 +02:00
status = psa_crypto_recover_transaction( &psa_crypto_transaction );
if( status != PSA_SUCCESS )
goto exit;
status = psa_crypto_stop_transaction( );
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 19:30:34 +02:00
}
else if( status == PSA_ERROR_DOES_NOT_EXIST )
{
/* There's no transaction to complete. It's all good. */
status = PSA_SUCCESS;
}
Transaction support: be more future-proof If there's ever a non-SE-related transaction, make sure it gets handled during init.
2019-07-24 15:56:31 +02:00
#endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 19:30:34 +02:00
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 21:42:52 +01:00
/* All done. */
psa_crypto_init: set the global initialized flag
2018-03-07 14:16:44 +01:00
global_data.initialized = 1;
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
exit:
Move the key slot array to the slot management module Move the key slot array and its initialization and wiping to the slot management module. Also move the lowest-level key slot access function psa_get_key_slot and the auxiliary function for slot allocation psa_internal_allocate_key_slot to the slot management module.
2018-12-10 16:29:04 +01:00
if( status != PSA_SUCCESS )
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
mbedtls_psa_crypto_free( );
Move the key slot array to the slot management module Move the key slot array and its initialization and wiping to the slot management module. Also move the lowest-level key slot access function psa_get_key_slot and the auxiliary function for slot allocation psa_internal_allocate_key_slot to the slot management module.
2018-12-10 16:29:04 +01:00
return( status );
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
}
#endif /* MBEDTLS_PSA_CRYPTO_C */
Reference in a new issue Copy permalink