yuzu-emu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2024-11-22 22:05:42 +01:00
Code Issues Packages Projects Releases Wiki Activity
3f10812ff9
mbedtls/library/psa_crypto.c

4562 lines
151 KiB
C
Raw Normal View History

Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
/*
* PSA crypto layer on top of Mbed TLS crypto
*/
/* Copyright (C) 2018, ARM Limited, All Rights Reserved
* SPDX-License-Identifier: Apache-2.0
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may
* not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*
* This file is part of mbed TLS (https://tls.mbed.org)
*/
#if !defined(MBEDTLS_CONFIG_FILE)
#include "mbedtls/config.h"
#else
#include MBEDTLS_CONFIG_FILE
#endif
#if defined(MBEDTLS_PSA_CRYPTO_C)
Style fixes
2018-07-04 14:57:00 +02:00
/*
* In case MBEDTLS_PSA_CRYPTO_SPM is defined the code is built for SPM (Secure
* Partition Manager) integration which separate the code into two parts
* NSPE (Non-Secure Process Environment) and SPE (Secure Process Environment).
* In this mode an additional header file should be included.
*/
Modifications for psa-crypto in order to integrate with SPM Add required includes in tests and psa_crypto.c file in order to be able to compilef for the SPM solution. Some functions needed to be deprecated from psa_crypto.c since they already implemented in the SPM.
2018-07-03 12:16:15 +02:00
#if defined(MBEDTLS_PSA_CRYPTO_SPM)
Style fixes
2018-07-04 14:57:00 +02:00
/*
* PSA_CRYPTO_SECURE means that this file is compiled to the SPE side.
* some headers will be affected by this flag.
*/
Modifications for psa-crypto in order to integrate with SPM Add required includes in tests and psa_crypto.c file in order to be able to compilef for the SPM solution. Some functions needed to be deprecated from psa_crypto.c since they already implemented in the SPM.
2018-07-03 12:16:15 +02:00
#define PSA_CRYPTO_SECURE 1
#include "crypto_spe.h"
#endif
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
#include "psa/crypto.h"
Add a facility to configure entropy sources Add a function to configure entropy sources. For testing only. Use it to test that the library initialization fails properly if there is no entropy source.
2018-11-20 21:59:56 +01:00
#include "psa_crypto_invasive.h"
Implement slot allocation Implement psa_allocate_key, psa_open_key, psa_create_key, psa_close_key. Add support for keys designated to handles to psa_get_key_slot, and thereby to the whole API. Allocated and non-allocated keys can coexist. This is a temporary stage in order to transition from the use of direct slot numbers to allocated handles only. Once all the tests and sample programs have been migrated to use handles, the implementation will be simplified and made more robust with support for handles only.
2018-11-30 18:54:54 +01:00
#include "psa_crypto_slot_management.h"
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
/* Include internal declarations that are useful for implementing persistently
* stored keys. */
#include "psa_crypto_storage.h"
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
#include <stdlib.h>
#include <string.h>
#if defined(MBEDTLS_PLATFORM_C)
#include "mbedtls/platform.h"
#else
#define mbedtls_calloc calloc
#define mbedtls_free free
#endif
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
#include "mbedtls/arc4.h"
Convert ERR_ASN1 error codes to PSA This fixes the error code when psa_export_key on an asymmetric key reports that the output buffer is too small.
2018-06-21 09:35:35 +02:00
#include "mbedtls/asn1.h"
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 16:10:23 +02:00
#include "mbedtls/bignum.h"
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
#include "mbedtls/blowfish.h"
#include "mbedtls/camellia.h"
#include "mbedtls/cipher.h"
#include "mbedtls/ccm.h"
#include "mbedtls/cmac.h"
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
#include "mbedtls/ctr_drbg.h"
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
#include "mbedtls/des.h"
Implement ECDH
2018-09-18 12:11:27 +02:00
#include "mbedtls/ecdh.h"
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 18:16:59 +01:00
#include "mbedtls/ecp.h"
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
#include "mbedtls/entropy.h"
Add entropy injection function to psa cripto APIs
2018-11-19 10:53:02 +01:00
#include "mbedtls/entropy_poll.h"
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
#include "mbedtls/error.h"
#include "mbedtls/gcm.h"
#include "mbedtls/md2.h"
#include "mbedtls/md4.h"
#include "mbedtls/md5.h"
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 22:44:14 +01:00
#include "mbedtls/md.h"
#include "mbedtls/md_internal.h"
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
#include "mbedtls/pk.h"
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 18:16:59 +01:00
#include "mbedtls/pk_internal.h"
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 18:14:53 +01:00
#include "mbedtls/platform_util.h"
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
#include "mbedtls/ripemd160.h"
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 18:16:59 +01:00
#include "mbedtls/rsa.h"
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
#include "mbedtls/sha1.h"
#include "mbedtls/sha256.h"
#include "mbedtls/sha512.h"
#include "mbedtls/xtea.h"
Add entropy injection function to psa cripto APIs
2018-11-19 10:53:02 +01:00
#if ( defined(MBEDTLS_ENTROPY_NV_SEED) && defined(MBEDTLS_PSA_HAS_ITS_IO) )
#include "psa_prot_internal_storage.h"
#endif
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
Fix buffer overflow in the slot array Slots are numbered from 1, but the slot array is a C array so it's numbered from 0. Add a non-regression test.
2018-08-01 15:45:45 +02:00
#define ARRAY_LENGTH( array ) ( sizeof( array ) / sizeof( *( array ) ) )
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 21:05:37 +01:00
/* constant-time buffer comparison */
static inline int safer_memcmp( const uint8_t *a, const uint8_t *b, size_t n )
{
size_t i;
unsigned char diff = 0;
for( i = 0; i < n; i++ )
diff |= a[i] ^ b[i];
return( diff );
}
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
/****************************************************************/
/* Global data, support functions and library management */
/****************************************************************/
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 15:41:12 +02:00
typedef struct
{
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
psa_key_type_t type;
Key Policy APIs implementation
2018-03-28 00:21:33 +02:00
psa_key_policy_t policy;
initial key lifetime implementation and tests
2018-03-20 21:44:08 +01:00
psa_key_lifetime_t lifetime;
Distinguish in-memory slot number from in-storage slot identifier At the moment, the in-storage slot identifier is the in-memory slot number. But track them separately, to prepare for API changes that will let them be different (psa_open_key, psa_create_key).
2018-11-30 18:46:56 +01:00
psa_key_id_t persistent_storage_id;
Implement slot allocation Implement psa_allocate_key, psa_open_key, psa_create_key, psa_close_key. Add support for keys designated to handles to psa_get_key_slot, and thereby to the whole API. Allocated and non-allocated keys can coexist. This is a temporary stage in order to transition from the use of direct slot numbers to allocated handles only. Once all the tests and sample programs have been migrated to use handles, the implementation will be simplified and made more robust with support for handles only.
2018-11-30 18:54:54 +01:00
unsigned allocated : 1;
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 15:41:12 +02:00
union
{
struct raw_data
{
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
uint8_t *data;
size_t bytes;
} raw;
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 18:16:59 +01:00
#if defined(MBEDTLS_RSA_C)
mbedtls_rsa_context *rsa;
#endif /* MBEDTLS_RSA_C */
#if defined(MBEDTLS_ECP_C)
mbedtls_ecp_keypair *ecp;
#endif /* MBEDTLS_ECP_C */
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
} data;
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
} psa_key_slot_t;
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
Remove PSA_KEY_TYPE_IS_RAW_BYTES from crypto.h It isn't used to define other macros and it doesn't seem that useful for users. Remove it, we can reintroduce it if needed. Define a similar function key_type_is_raw_bytes in the implementation with a clear semantics: it's a key that's represented as a struct raw_data.
2018-06-21 14:15:31 +02:00
static int key_type_is_raw_bytes( psa_key_type_t type )
{
Change the bitwise encoding of key type categories There were only 5 categories (now 4). Reduce the category mask from 7 bits to 3. Combine unformatted, not-necessarily-uniform keys (HMAC, derivation) with raw data. Reintroduce a KEY_TYPE_IS_UNSTRUCTURED macro (which used to exist under the name KEY_TYPE_IS_RAW_DATA macro) for key types that don't have any structure, including both should-be-uniform keys (such as block cipher and stream cipher keys) and not-necessarily-uniform keys (such as HMAC keys and secrets for key derivation).
2018-08-10 16:03:41 +02:00
return( PSA_KEY_TYPE_IS_UNSTRUCTURED( type ) );
Remove PSA_KEY_TYPE_IS_RAW_BYTES from crypto.h It isn't used to define other macros and it doesn't seem that useful for users. Remove it, we can reintroduce it if needed. Define a similar function key_type_is_raw_bytes in the implementation with a clear semantics: it's a key that's represented as a struct raw_data.
2018-06-21 14:15:31 +02:00
}
Don't use an enum in a bit-field This isn't standard C. GCC and Clang accept it but not every compiler (e.g. Armcc 5).
2018-12-04 12:27:09 +01:00
/* Values for psa_global_data_t::rng_state */
#define RNG_NOT_INITIALIZED 0
#define RNG_INITIALIZED 1
#define RNG_SEEDED 2
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 21:42:52 +01:00
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 15:41:12 +02:00
typedef struct
{
Add a facility to configure entropy sources Add a function to configure entropy sources. For testing only. Use it to test that the library initialization fails properly if there is no entropy source.
2018-11-20 21:59:56 +01:00
void (* entropy_init )( mbedtls_entropy_context *ctx );
void (* entropy_free )( mbedtls_entropy_context *ctx );
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
mbedtls_entropy_context entropy;
mbedtls_ctr_drbg_context ctr_drbg;
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t key_slots[PSA_KEY_SLOT_COUNT];
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 21:42:52 +01:00
unsigned initialized : 1;
Don't use an enum in a bit-field This isn't standard C. GCC and Clang accept it but not every compiler (e.g. Armcc 5).
2018-12-04 12:27:09 +01:00
unsigned rng_state : 2;
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 21:42:52 +01:00
unsigned key_slots_initialized : 1;
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
} psa_global_data_t;
static psa_global_data_t global_data;
Ensure the module is initialized in psa_generate_random
2018-09-06 15:24:41 +02:00
#define GUARD_MODULE_INITIALIZED \
if( global_data.initialized == 0 ) \
return( PSA_ERROR_BAD_STATE );
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
static psa_status_t mbedtls_to_psa_error( int ret )
{
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
/* If there's both a high-level code and low-level code, dispatch on
* the high-level code. */
switch( ret < -0x7f ? - ( -ret & 0x7f80 ) : ret )
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
{
case 0:
return( PSA_SUCCESS );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
case MBEDTLS_ERR_AES_INVALID_KEY_LENGTH:
case MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH:
case MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_AES_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_ARC4_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
Convert ERR_ASN1 error codes to PSA This fixes the error code when psa_export_key on an asymmetric key reports that the output buffer is too small.
2018-06-21 09:35:35 +02:00
case MBEDTLS_ERR_ASN1_OUT_OF_DATA:
case MBEDTLS_ERR_ASN1_UNEXPECTED_TAG:
case MBEDTLS_ERR_ASN1_INVALID_LENGTH:
case MBEDTLS_ERR_ASN1_LENGTH_MISMATCH:
case MBEDTLS_ERR_ASN1_INVALID_DATA:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_ASN1_ALLOC_FAILED:
return( PSA_ERROR_INSUFFICIENT_MEMORY );
case MBEDTLS_ERR_ASN1_BUF_TOO_SMALL:
return( PSA_ERROR_BUFFER_TOO_SMALL );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
case MBEDTLS_ERR_BLOWFISH_INVALID_KEY_LENGTH:
case MBEDTLS_ERR_BLOWFISH_INVALID_INPUT_LENGTH:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_BLOWFISH_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_CAMELLIA_INVALID_KEY_LENGTH:
case MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_CAMELLIA_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_CCM_BAD_INPUT:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_CCM_AUTH_FAILED:
return( PSA_ERROR_INVALID_SIGNATURE );
case MBEDTLS_ERR_CCM_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_CIPHER_ALLOC_FAILED:
return( PSA_ERROR_INSUFFICIENT_MEMORY );
case MBEDTLS_ERR_CIPHER_INVALID_PADDING:
return( PSA_ERROR_INVALID_PADDING );
case MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED:
return( PSA_ERROR_BAD_STATE );
case MBEDTLS_ERR_CIPHER_AUTH_FAILED:
return( PSA_ERROR_INVALID_SIGNATURE );
case MBEDTLS_ERR_CIPHER_INVALID_CONTEXT:
return( PSA_ERROR_TAMPERING_DETECTED );
case MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_CMAC_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED:
return( PSA_ERROR_INSUFFICIENT_ENTROPY );
case MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG:
case MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR:
return( PSA_ERROR_INSUFFICIENT_ENTROPY );
case MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_DES_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
case MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED:
case MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE:
case MBEDTLS_ERR_ENTROPY_SOURCE_FAILED:
return( PSA_ERROR_INSUFFICIENT_ENTROPY );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
case MBEDTLS_ERR_GCM_AUTH_FAILED:
return( PSA_ERROR_INVALID_SIGNATURE );
case MBEDTLS_ERR_GCM_BAD_INPUT:
Translate GCM_BAD_INPUT to INVALID_ARGUMENT, not NOT_SUPPORTED
2018-08-21 15:07:38 +02:00
return( PSA_ERROR_INVALID_ARGUMENT );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
case MBEDTLS_ERR_GCM_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_MD2_HW_ACCEL_FAILED:
case MBEDTLS_ERR_MD4_HW_ACCEL_FAILED:
case MBEDTLS_ERR_MD5_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_MD_BAD_INPUT_DATA:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_MD_ALLOC_FAILED:
return( PSA_ERROR_INSUFFICIENT_MEMORY );
case MBEDTLS_ERR_MD_FILE_IO_ERROR:
return( PSA_ERROR_STORAGE_FAILURE );
case MBEDTLS_ERR_MD_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
Private EC key format: change to raw secret value (doc, import) Change the import/export format of private elliptic curve keys from RFC 5915 to the raw secret value. This commit updates the format specification and the import code, but not the export code.
2018-10-29 19:24:33 +01:00
case MBEDTLS_ERR_MPI_FILE_IO_ERROR:
return( PSA_ERROR_STORAGE_FAILURE );
case MBEDTLS_ERR_MPI_BAD_INPUT_DATA:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_MPI_INVALID_CHARACTER:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL:
return( PSA_ERROR_BUFFER_TOO_SMALL );
case MBEDTLS_ERR_MPI_NEGATIVE_VALUE:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_MPI_DIVISION_BY_ZERO:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_MPI_NOT_ACCEPTABLE:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_MPI_ALLOC_FAILED:
return( PSA_ERROR_INSUFFICIENT_MEMORY );
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
case MBEDTLS_ERR_PK_ALLOC_FAILED:
return( PSA_ERROR_INSUFFICIENT_MEMORY );
case MBEDTLS_ERR_PK_TYPE_MISMATCH:
case MBEDTLS_ERR_PK_BAD_INPUT_DATA:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_PK_FILE_IO_ERROR:
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
return( PSA_ERROR_STORAGE_FAILURE );
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
case MBEDTLS_ERR_PK_KEY_INVALID_VERSION:
case MBEDTLS_ERR_PK_KEY_INVALID_FORMAT:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_PK_UNKNOWN_PK_ALG:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_PK_PASSWORD_REQUIRED:
case MBEDTLS_ERR_PK_PASSWORD_MISMATCH:
return( PSA_ERROR_NOT_PERMITTED );
case MBEDTLS_ERR_PK_INVALID_PUBKEY:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_PK_INVALID_ALG:
case MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE:
case MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_PK_SIG_LEN_MISMATCH:
return( PSA_ERROR_INVALID_SIGNATURE );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 20:59:33 +01:00
case MBEDTLS_ERR_PK_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_RIPEMD160_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_RSA_BAD_INPUT_DATA:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_RSA_INVALID_PADDING:
return( PSA_ERROR_INVALID_PADDING );
case MBEDTLS_ERR_RSA_KEY_GEN_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_RSA_KEY_CHECK_FAILED:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_RSA_PUBLIC_FAILED:
case MBEDTLS_ERR_RSA_PRIVATE_FAILED:
return( PSA_ERROR_TAMPERING_DETECTED );
case MBEDTLS_ERR_RSA_VERIFY_FAILED:
return( PSA_ERROR_INVALID_SIGNATURE );
case MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE:
return( PSA_ERROR_BUFFER_TOO_SMALL );
case MBEDTLS_ERR_RSA_RNG_FAILED:
return( PSA_ERROR_INSUFFICIENT_MEMORY );
case MBEDTLS_ERR_RSA_UNSUPPORTED_OPERATION:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_RSA_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_SHA1_HW_ACCEL_FAILED:
case MBEDTLS_ERR_SHA256_HW_ACCEL_FAILED:
case MBEDTLS_ERR_SHA512_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_XTEA_INVALID_INPUT_LENGTH:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_XTEA_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 10:18:38 +02:00
case MBEDTLS_ERR_ECP_BAD_INPUT_DATA:
Added handling for MBEDTLS_ERR_ECP_XXX error codes Added handling for MBEDTLS_ERR_ECP_XXX error codes
2018-05-09 15:07:36 +02:00
case MBEDTLS_ERR_ECP_INVALID_KEY:
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 10:18:38 +02:00
return( PSA_ERROR_INVALID_ARGUMENT );
Added handling for MBEDTLS_ERR_ECP_XXX error codes Added handling for MBEDTLS_ERR_ECP_XXX error codes
2018-05-09 15:07:36 +02:00
case MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL:
return( PSA_ERROR_BUFFER_TOO_SMALL );
case MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH:
case MBEDTLS_ERR_ECP_VERIFY_FAILED:
return( PSA_ERROR_INVALID_SIGNATURE );
case MBEDTLS_ERR_ECP_ALLOC_FAILED:
return( PSA_ERROR_INSUFFICIENT_MEMORY );
case MBEDTLS_ERR_ECP_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 10:18:38 +02:00
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
default:
return( PSA_ERROR_UNKNOWN_ERROR );
}
}
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
Be more consistent about blank lines
2018-06-18 21:49:39 +02:00
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
/****************************************************************/
/* Key management */
/****************************************************************/
Add ifdef for MBEDTLS_ECP_C around ecc_group_to_psa functions These are unused if MBEDTLS_ECP_C isn't defined.
2018-07-24 16:44:51 +02:00
#if defined(MBEDTLS_ECP_C)
Check the curve of an elliptic curve key on import psa_import_key must check that the imported key data matches the expected key type. Implement the missing check for EC keys that the curve is the expected one.
2018-06-18 20:47:51 +02:00
static psa_ecc_curve_t mbedtls_ecc_group_to_psa( mbedtls_ecp_group_id grpid )
{
switch( grpid )
{
case MBEDTLS_ECP_DP_SECP192R1:
return( PSA_ECC_CURVE_SECP192R1 );
case MBEDTLS_ECP_DP_SECP224R1:
return( PSA_ECC_CURVE_SECP224R1 );
case MBEDTLS_ECP_DP_SECP256R1:
return( PSA_ECC_CURVE_SECP256R1 );
case MBEDTLS_ECP_DP_SECP384R1:
return( PSA_ECC_CURVE_SECP384R1 );
case MBEDTLS_ECP_DP_SECP521R1:
return( PSA_ECC_CURVE_SECP521R1 );
case MBEDTLS_ECP_DP_BP256R1:
return( PSA_ECC_CURVE_BRAINPOOL_P256R1 );
case MBEDTLS_ECP_DP_BP384R1:
return( PSA_ECC_CURVE_BRAINPOOL_P384R1 );
case MBEDTLS_ECP_DP_BP512R1:
return( PSA_ECC_CURVE_BRAINPOOL_P512R1 );
case MBEDTLS_ECP_DP_CURVE25519:
return( PSA_ECC_CURVE_CURVE25519 );
case MBEDTLS_ECP_DP_SECP192K1:
return( PSA_ECC_CURVE_SECP192K1 );
case MBEDTLS_ECP_DP_SECP224K1:
return( PSA_ECC_CURVE_SECP224K1 );
case MBEDTLS_ECP_DP_SECP256K1:
return( PSA_ECC_CURVE_SECP256K1 );
case MBEDTLS_ECP_DP_CURVE448:
return( PSA_ECC_CURVE_CURVE448 );
default:
return( 0 );
}
}
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-20 00:20:32 +02:00
static mbedtls_ecp_group_id mbedtls_ecc_group_of_psa( psa_ecc_curve_t curve )
{
switch( curve )
{
case PSA_ECC_CURVE_SECP192R1:
return( MBEDTLS_ECP_DP_SECP192R1 );
case PSA_ECC_CURVE_SECP224R1:
return( MBEDTLS_ECP_DP_SECP224R1 );
case PSA_ECC_CURVE_SECP256R1:
return( MBEDTLS_ECP_DP_SECP256R1 );
case PSA_ECC_CURVE_SECP384R1:
return( MBEDTLS_ECP_DP_SECP384R1 );
case PSA_ECC_CURVE_SECP521R1:
return( MBEDTLS_ECP_DP_SECP521R1 );
case PSA_ECC_CURVE_BRAINPOOL_P256R1:
return( MBEDTLS_ECP_DP_BP256R1 );
case PSA_ECC_CURVE_BRAINPOOL_P384R1:
return( MBEDTLS_ECP_DP_BP384R1 );
case PSA_ECC_CURVE_BRAINPOOL_P512R1:
return( MBEDTLS_ECP_DP_BP512R1 );
case PSA_ECC_CURVE_CURVE25519:
return( MBEDTLS_ECP_DP_CURVE25519 );
case PSA_ECC_CURVE_SECP192K1:
return( MBEDTLS_ECP_DP_SECP192K1 );
case PSA_ECC_CURVE_SECP224K1:
return( MBEDTLS_ECP_DP_SECP224K1 );
case PSA_ECC_CURVE_SECP256K1:
return( MBEDTLS_ECP_DP_SECP256K1 );
case PSA_ECC_CURVE_CURVE448:
return( MBEDTLS_ECP_DP_CURVE448 );
default:
return( MBEDTLS_ECP_DP_NONE );
}
}
Add ifdef for MBEDTLS_ECP_C around ecc_group_to_psa functions These are unused if MBEDTLS_ECP_C isn't defined.
2018-07-24 16:44:51 +02:00
#endif /* defined(MBEDTLS_ECP_C) */
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-20 00:20:32 +02:00
psa_import_key: validate symmetric key size When importing a symmetric key, validate that the key size is valid for the given key type. Non-supported key types may no longer be imported.
2018-06-19 21:31:50 +02:00
static psa_status_t prepare_raw_data_slot( psa_key_type_t type,
size_t bits,
struct raw_data *raw )
{
/* Check that the bit size is acceptable for the key type */
switch( type )
{
case PSA_KEY_TYPE_RAW_DATA:
Handle null pointers safely when used as buffers of size 0 When the size of a buffer is 0, the corresponding pointer argument may be null. In such cases, library functions must not perform arithmetic on the pointer or call standard library functions such as memset and memcpy, since that would be undefined behavior in C. Protect such cases. Refactor the storage of a 0-sized raw data object to make it store a null pointer, rather than depending on the behavior of calloc(1,0).
2018-06-28 19:31:31 +02:00
if( bits == 0 )
{
raw->bytes = 0;
raw->data = NULL;
return( PSA_SUCCESS );
}
break;
psa_import_key: validate symmetric key size When importing a symmetric key, validate that the key size is valid for the given key type. Non-supported key types may no longer be imported.
2018-06-19 21:31:50 +02:00
#if defined(MBEDTLS_MD_C)
case PSA_KEY_TYPE_HMAC:
Handle null pointers safely when used as buffers of size 0 When the size of a buffer is 0, the corresponding pointer argument may be null. In such cases, library functions must not perform arithmetic on the pointer or call standard library functions such as memset and memcpy, since that would be undefined behavior in C. Protect such cases. Refactor the storage of a 0-sized raw data object to make it store a null pointer, rather than depending on the behavior of calloc(1,0).
2018-06-28 19:31:31 +02:00
#endif
Add framework for simple key derivation New key type PSA_KEY_TYPE_DERIVE. New usage flag PSA_KEY_USAGE_DERIVE. New function psa_key_derivation. No key derivation algorithm is implemented yet. The code may not compile with -Wunused. Write some unit test code for psa_key_derivation. Most of it cannot be used yet due to the lack of a key derivation algorithm.
2018-07-12 17:17:20 +02:00
case PSA_KEY_TYPE_DERIVE:
break;
psa_import_key: validate symmetric key size When importing a symmetric key, validate that the key size is valid for the given key type. Non-supported key types may no longer be imported.
2018-06-19 21:31:50 +02:00
#if defined(MBEDTLS_AES_C)
case PSA_KEY_TYPE_AES:
if( bits != 128 && bits != 192 && bits != 256 )
return( PSA_ERROR_INVALID_ARGUMENT );
break;
#endif
#if defined(MBEDTLS_CAMELLIA_C)
case PSA_KEY_TYPE_CAMELLIA:
if( bits != 128 && bits != 192 && bits != 256 )
return( PSA_ERROR_INVALID_ARGUMENT );
break;
#endif
#if defined(MBEDTLS_DES_C)
case PSA_KEY_TYPE_DES:
if( bits != 64 && bits != 128 && bits != 192 )
return( PSA_ERROR_INVALID_ARGUMENT );
break;
#endif
#if defined(MBEDTLS_ARC4_C)
case PSA_KEY_TYPE_ARC4:
if( bits < 8 || bits > 2048 )
return( PSA_ERROR_INVALID_ARGUMENT );
break;
#endif
default:
return( PSA_ERROR_NOT_SUPPORTED );
}
Refuse non-byte-sized raw data keys Since the key size is stored in bytes, we can't have a key whose size isn't a whole number of bytes.
2018-06-21 09:32:47 +02:00
if( bits % 8 != 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
psa_import_key: validate symmetric key size When importing a symmetric key, validate that the key size is valid for the given key type. Non-supported key types may no longer be imported.
2018-06-19 21:31:50 +02:00
/* Allocate memory for the key */
raw->bytes = PSA_BITS_TO_BYTES( bits );
raw->data = mbedtls_calloc( 1, raw->bytes );
if( raw->data == NULL )
{
raw->bytes = 0;
return( PSA_ERROR_INSUFFICIENT_MEMORY );
}
return( PSA_SUCCESS );
}
psa_import_key: split RSA and ECP code into small functions No intended behavior change except that some edge cases may have swapped between INVALID_ARGUMENT and NOT_SUPPORTED.
2018-06-29 19:52:37 +02:00
#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PK_PARSE_C)
Reject non-byte-aligned RSA keys On key import and key generation, for RSA, reject key sizes that are not a multiple of 8. Such keys are not well-supported in Mbed TLS and are hardly ever used in practice. The previous commit removed support for non-byte-aligned keys at the PSA level. This commit actively rejects such keys and adds corresponding tests (test keys generated with "openssl genrsa").
2018-11-12 18:39:40 +01:00
/* Mbed TLS doesn't support non-byte-aligned key sizes (i.e. key sizes
* that are not a multiple of 8) well. For example, there is only
* mbedtls_rsa_get_len(), which returns a number of bytes, and no
* way to return the exact bit size of a key.
* To keep things simple, reject non-byte-aligned key sizes. */
static psa_status_t psa_check_rsa_key_byte_aligned(
const mbedtls_rsa_context *rsa )
{
mbedtls_mpi n;
psa_status_t status;
mbedtls_mpi_init( &n );
status = mbedtls_to_psa_error(
mbedtls_rsa_export( rsa, &n, NULL, NULL, NULL, NULL ) );
if( status == PSA_SUCCESS )
{
if( mbedtls_mpi_bitlen( &n ) % 8 != 0 )
status = PSA_ERROR_NOT_SUPPORTED;
}
mbedtls_mpi_free( &n );
return( status );
}
psa_import_key: split RSA and ECP code into small functions No intended behavior change except that some edge cases may have swapped between INVALID_ARGUMENT and NOT_SUPPORTED.
2018-06-29 19:52:37 +02:00
static psa_status_t psa_import_rsa_key( mbedtls_pk_context *pk,
mbedtls_rsa_context **p_rsa )
{
if( mbedtls_pk_get_type( pk ) != MBEDTLS_PK_RSA )
return( PSA_ERROR_INVALID_ARGUMENT );
else
{
mbedtls_rsa_context *rsa = mbedtls_pk_rsa( *pk );
Remove support for non-byte-aligned RSA keys Remove the need for an extra function mbedtls_rsa_get_bitlen. Use mbedtls_rsa_get_len, which is only correct for keys whose size is a multiple of 8. Key sizes that aren't a multiple of 8 are extremely rarely used, so in practice this is not a problematic limitation.
2018-11-12 18:37:42 +01:00
/* The size of an RSA key doesn't have to be a multiple of 8.
* Mbed TLS supports non-byte-aligned key sizes, but not well.
* For example, mbedtls_rsa_get_len() returns the key size in
* bytes, not in bits. */
size_t bits = PSA_BYTES_TO_BITS( mbedtls_rsa_get_len( rsa ) );
Reject non-byte-aligned RSA keys On key import and key generation, for RSA, reject key sizes that are not a multiple of 8. Such keys are not well-supported in Mbed TLS and are hardly ever used in practice. The previous commit removed support for non-byte-aligned keys at the PSA level. This commit actively rejects such keys and adds corresponding tests (test keys generated with "openssl genrsa").
2018-11-12 18:39:40 +01:00
psa_status_t status;
psa_import_key: split RSA and ECP code into small functions No intended behavior change except that some edge cases may have swapped between INVALID_ARGUMENT and NOT_SUPPORTED.
2018-06-29 19:52:37 +02:00
if( bits > PSA_VENDOR_RSA_MAX_KEY_BITS )
return( PSA_ERROR_NOT_SUPPORTED );
Reject non-byte-aligned RSA keys On key import and key generation, for RSA, reject key sizes that are not a multiple of 8. Such keys are not well-supported in Mbed TLS and are hardly ever used in practice. The previous commit removed support for non-byte-aligned keys at the PSA level. This commit actively rejects such keys and adds corresponding tests (test keys generated with "openssl genrsa").
2018-11-12 18:39:40 +01:00
status = psa_check_rsa_key_byte_aligned( rsa );
if( status != PSA_SUCCESS )
return( status );
psa_import_key: split RSA and ECP code into small functions No intended behavior change except that some edge cases may have swapped between INVALID_ARGUMENT and NOT_SUPPORTED.
2018-06-29 19:52:37 +02:00
*p_rsa = rsa;
return( PSA_SUCCESS );
}
}
#endif /* defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PK_PARSE_C) */
#if defined(MBEDTLS_ECP_C) && defined(MBEDTLS_PK_PARSE_C)
Private EC key format: change to raw secret value (doc, import) Change the import/export format of private elliptic curve keys from RFC 5915 to the raw secret value. This commit updates the format specification and the import code, but not the export code.
2018-10-29 19:24:33 +01:00
/* Import an elliptic curve parsed by the mbedtls pk module. */
psa_import_key: split RSA and ECP code into small functions No intended behavior change except that some edge cases may have swapped between INVALID_ARGUMENT and NOT_SUPPORTED.
2018-06-29 19:52:37 +02:00
static psa_status_t psa_import_ecp_key( psa_ecc_curve_t expected_curve,
mbedtls_pk_context *pk,
mbedtls_ecp_keypair **p_ecp )
{
if( mbedtls_pk_get_type( pk ) != MBEDTLS_PK_ECKEY )
return( PSA_ERROR_INVALID_ARGUMENT );
else
{
mbedtls_ecp_keypair *ecp = mbedtls_pk_ec( *pk );
psa_ecc_curve_t actual_curve = mbedtls_ecc_group_to_psa( ecp->grp.id );
if( actual_curve != expected_curve )
return( PSA_ERROR_INVALID_ARGUMENT );
*p_ecp = ecp;
return( PSA_SUCCESS );
}
}
#endif /* defined(MBEDTLS_ECP_C) && defined(MBEDTLS_PK_PARSE_C) */
Private EC key format: change to raw secret value (doc, import) Change the import/export format of private elliptic curve keys from RFC 5915 to the raw secret value. This commit updates the format specification and the import code, but not the export code.
2018-10-29 19:24:33 +01:00
#if defined(MBEDTLS_ECP_C)
/* Import a private key given as a byte string which is the private value
* in big-endian order. */
static psa_status_t psa_import_ec_private_key( psa_ecc_curve_t curve,
const uint8_t *data,
size_t data_length,
mbedtls_ecp_keypair **p_ecp )
{
psa_status_t status = PSA_ERROR_TAMPERING_DETECTED;
mbedtls_ecp_keypair *ecp = NULL;
mbedtls_ecp_group_id grp_id = mbedtls_ecc_group_of_psa( curve );
*p_ecp = NULL;
ecp = mbedtls_calloc( 1, sizeof( mbedtls_ecp_keypair ) );
if( ecp == NULL )
return( PSA_ERROR_INSUFFICIENT_MEMORY );
/* Load the group. */
status = mbedtls_to_psa_error(
mbedtls_ecp_group_load( &ecp->grp, grp_id ) );
if( status != PSA_SUCCESS )
goto exit;
/* Load the secret value. */
status = mbedtls_to_psa_error(
mbedtls_mpi_read_binary( &ecp->d, data, data_length ) );
if( status != PSA_SUCCESS )
goto exit;
/* Validate the private key. */
status = mbedtls_to_psa_error(
mbedtls_ecp_check_privkey( &ecp->grp, &ecp->d ) );
if( status != PSA_SUCCESS )
goto exit;
/* Calculate the public key from the private key. */
status = mbedtls_to_psa_error(
mbedtls_ecp_mul( &ecp->grp, &ecp->Q, &ecp->d, &ecp->grp.G,
mbedtls_ctr_drbg_random, &global_data.ctr_drbg ) );
if( status != PSA_SUCCESS )
goto exit;
*p_ecp = ecp;
return( PSA_SUCCESS );
exit:
if( ecp != NULL )
{
mbedtls_ecp_keypair_free( ecp );
mbedtls_free( ecp );
}
return( status );
}
#endif /* defined(MBEDTLS_ECP_C) */
Factor the common idiom psa_wipe_key_slot into a function Many places in the code called psa_remove_key_data_from_memory (which preserves metadata for the sake of failues in psa_import_key) followed by clearing the slot data. Use an auxiliary function for this.
2018-12-03 11:58:46 +01:00
/** Import key data into a slot. `slot->type` must have been set
* previously. This function assumes that the slot does not contain
* any key material yet. On failure, the slot content is unchanged. */
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
static psa_status_t psa_import_key_into_slot( psa_key_slot_t *slot,
psa: Refactor psa_import_key() Create a new function psa_import_key_into_slot() from psa_import_key(). This is common functionality that will be used both when importing a key and loading a key from persistent storage.
2018-07-13 14:18:51 +02:00
const uint8_t *data,
size_t data_length )
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
{
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
psa_status_t status = PSA_SUCCESS;
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
psa: Refactor psa_import_key() Create a new function psa_import_key_into_slot() from psa_import_key(). This is common functionality that will be used both when importing a key and loading a key from persistent storage.
2018-07-13 14:18:51 +02:00
if( key_type_is_raw_bytes( slot->type ) )
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
{
Add some comments to document some non-obvious coding choices
2018-03-07 16:41:37 +01:00
/* Ensure that a bytes-to-bit conversion won't overflow. */
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
if( data_length > SIZE_MAX / 8 )
return( PSA_ERROR_NOT_SUPPORTED );
psa: Refactor psa_import_key() Create a new function psa_import_key_into_slot() from psa_import_key(). This is common functionality that will be used both when importing a key and loading a key from persistent storage.
2018-07-13 14:18:51 +02:00
status = prepare_raw_data_slot( slot->type,
psa_import_key: validate symmetric key size When importing a symmetric key, validate that the key size is valid for the given key type. Non-supported key types may no longer be imported.
2018-06-19 21:31:50 +02:00
PSA_BYTES_TO_BITS( data_length ),
&slot->data.raw );
if( status != PSA_SUCCESS )
return( status );
Handle null pointers safely when used as buffers of size 0 When the size of a buffer is 0, the corresponding pointer argument may be null. In such cases, library functions must not perform arithmetic on the pointer or call standard library functions such as memset and memcpy, since that would be undefined behavior in C. Protect such cases. Refactor the storage of a 0-sized raw data object to make it store a null pointer, rather than depending on the behavior of calloc(1,0).
2018-06-28 19:31:31 +02:00
if( data_length != 0 )
memcpy( slot->data.raw.data, data, data_length );
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
}
else
Private EC key format: change to raw secret value (doc, import) Change the import/export format of private elliptic curve keys from RFC 5915 to the raw secret value. This commit updates the format specification and the import code, but not the export code.
2018-10-29 19:24:33 +01:00
#if defined(MBEDTLS_ECP_C)
psa: Refactor psa_import_key() Create a new function psa_import_key_into_slot() from psa_import_key(). This is common functionality that will be used both when importing a key and loading a key from persistent storage.
2018-07-13 14:18:51 +02:00
if( PSA_KEY_TYPE_IS_ECC_KEYPAIR( slot->type ) )
Private EC key format: change to raw secret value (doc, import) Change the import/export format of private elliptic curve keys from RFC 5915 to the raw secret value. This commit updates the format specification and the import code, but not the export code.
2018-10-29 19:24:33 +01:00
{
psa: Refactor psa_import_key() Create a new function psa_import_key_into_slot() from psa_import_key(). This is common functionality that will be used both when importing a key and loading a key from persistent storage.
2018-07-13 14:18:51 +02:00
status = psa_import_ec_private_key( PSA_KEY_TYPE_GET_CURVE( slot->type ),
Private EC key format: change to raw secret value (doc, import) Change the import/export format of private elliptic curve keys from RFC 5915 to the raw secret value. This commit updates the format specification and the import code, but not the export code.
2018-10-29 19:24:33 +01:00
data, data_length,
&slot->data.ecp );
if( status != PSA_SUCCESS )
return( status );
}
else
#endif /* MBEDTLS_ECP_C */
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 18:16:59 +01:00
#if defined(MBEDTLS_PK_PARSE_C)
psa: Refactor psa_import_key() Create a new function psa_import_key_into_slot() from psa_import_key(). This is common functionality that will be used both when importing a key and loading a key from persistent storage.
2018-07-13 14:18:51 +02:00
if( PSA_KEY_TYPE_IS_RSA( slot->type ) ||
PSA_KEY_TYPE_IS_ECC( slot->type ) )
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
{
int ret;
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 18:16:59 +01:00
mbedtls_pk_context pk;
mbedtls_pk_init( &pk );
psa_import_key: split RSA and ECP code into small functions No intended behavior change except that some edge cases may have swapped between INVALID_ARGUMENT and NOT_SUPPORTED.
2018-06-29 19:52:37 +02:00
/* Parse the data. */
psa: Refactor psa_import_key() Create a new function psa_import_key_into_slot() from psa_import_key(). This is common functionality that will be used both when importing a key and loading a key from persistent storage.
2018-07-13 14:18:51 +02:00
if( PSA_KEY_TYPE_IS_KEYPAIR( slot->type ) )
PSA key import: support RSA public keys Use different key types for private keys and public keys.
2018-02-03 22:43:28 +01:00
ret = mbedtls_pk_parse_key( &pk, data, data_length, NULL, 0 );
else
ret = mbedtls_pk_parse_public_key( &pk, data, data_length );
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
if( ret != 0 )
return( mbedtls_to_psa_error( ret ) );
psa_import_key: split RSA and ECP code into small functions No intended behavior change except that some edge cases may have swapped between INVALID_ARGUMENT and NOT_SUPPORTED.
2018-06-29 19:52:37 +02:00
/* We have something that the pkparse module recognizes.
* If it has the expected type and passes any type-specific
* checks, store it. */
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 18:16:59 +01:00
#if defined(MBEDTLS_RSA_C)
psa: Refactor psa_import_key() Create a new function psa_import_key_into_slot() from psa_import_key(). This is common functionality that will be used both when importing a key and loading a key from persistent storage.
2018-07-13 14:18:51 +02:00
if( PSA_KEY_TYPE_IS_RSA( slot->type ) )
psa_import_key: split RSA and ECP code into small functions No intended behavior change except that some edge cases may have swapped between INVALID_ARGUMENT and NOT_SUPPORTED.
2018-06-29 19:52:37 +02:00
status = psa_import_rsa_key( &pk, &slot->data.rsa );
else
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 18:16:59 +01:00
#endif /* MBEDTLS_RSA_C */
#if defined(MBEDTLS_ECP_C)
psa: Refactor psa_import_key() Create a new function psa_import_key_into_slot() from psa_import_key(). This is common functionality that will be used both when importing a key and loading a key from persistent storage.
2018-07-13 14:18:51 +02:00
if( PSA_KEY_TYPE_IS_ECC( slot->type ) )
status = psa_import_ecp_key( PSA_KEY_TYPE_GET_CURVE( slot->type ),
psa_import_key: split RSA and ECP code into small functions No intended behavior change except that some edge cases may have swapped between INVALID_ARGUMENT and NOT_SUPPORTED.
2018-06-29 19:52:37 +02:00
&pk, &slot->data.ecp );
else
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 18:16:59 +01:00
#endif /* MBEDTLS_ECP_C */
psa_import_key: split RSA and ECP code into small functions No intended behavior change except that some edge cases may have swapped between INVALID_ARGUMENT and NOT_SUPPORTED.
2018-06-29 19:52:37 +02:00
{
status = PSA_ERROR_NOT_SUPPORTED;
psa_import_key: fix memory leak on error Free the content of the pk object if an error occurs after the import.
2018-06-28 08:46:13 +02:00
}
psa_import_key: split RSA and ECP code into small functions No intended behavior change except that some edge cases may have swapped between INVALID_ARGUMENT and NOT_SUPPORTED.
2018-06-29 19:52:37 +02:00
psa_import_key: fix memory leak on error Free the content of the pk object if an error occurs after the import.
2018-06-28 08:46:13 +02:00
/* Free the content of the pk object only on error. On success,
* the content of the object has been stored in the slot. */
if( status != PSA_SUCCESS )
{
mbedtls_pk_free( &pk );
return( status );
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 18:16:59 +01:00
}
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
}
else
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 18:16:59 +01:00
#endif /* defined(MBEDTLS_PK_PARSE_C) */
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
{
return( PSA_ERROR_NOT_SUPPORTED );
}
psa: Refactor psa_import_key() Create a new function psa_import_key_into_slot() from psa_import_key(). This is common functionality that will be used both when importing a key and loading a key from persistent storage.
2018-07-13 14:18:51 +02:00
return( PSA_SUCCESS );
}
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
static psa_status_t psa_load_persistent_key_into_slot( psa_key_slot_t *p_slot )
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
{
psa_status_t status = PSA_SUCCESS;
uint8_t *key_data = NULL;
size_t key_data_length = 0;
Distinguish in-memory slot number from in-storage slot identifier At the moment, the in-storage slot identifier is the in-memory slot number. But track them separately, to prepare for API changes that will let them be different (psa_open_key, psa_create_key).
2018-11-30 18:46:56 +01:00
status = psa_load_persistent_key( p_slot->persistent_storage_id,
&( p_slot )->type,
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
&( p_slot )->policy, &key_data,
&key_data_length );
if( status != PSA_SUCCESS )
goto exit;
status = psa_import_key_into_slot( p_slot,
key_data, key_data_length );
exit:
psa_free_persistent_key_data( key_data, key_data_length );
return( status );
}
#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
/* Access a key slot at the given handle. The handle of a key slot is
* the index of the slot in the global slot array, plus one so that handles
* start at 1 and not 0. */
static psa_status_t psa_get_key_slot( psa_key_handle_t handle,
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t **p_slot )
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 12:21:11 +02:00
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *slot = NULL;
Implement slot allocation Implement psa_allocate_key, psa_open_key, psa_create_key, psa_close_key. Add support for keys designated to handles to psa_get_key_slot, and thereby to the whole API. Allocated and non-allocated keys can coexist. This is a temporary stage in order to transition from the use of direct slot numbers to allocated handles only. Once all the tests and sample programs have been migrated to use handles, the implementation will be simplified and made more robust with support for handles only.
2018-11-30 18:54:54 +01:00
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 12:21:11 +02:00
GUARD_MODULE_INITIALIZED;
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
/* 0 is not a valid handle under any circumstance. This
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 12:21:11 +02:00
* implementation provides slots number 1 to N where N is the
* number of available slots. */
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
if( handle == 0 || handle > ARRAY_LENGTH( global_data.key_slots ) )
return( PSA_ERROR_INVALID_HANDLE );
slot = &global_data.key_slots[handle - 1];
Implement slot allocation Implement psa_allocate_key, psa_open_key, psa_create_key, psa_close_key. Add support for keys designated to handles to psa_get_key_slot, and thereby to the whole API. Allocated and non-allocated keys can coexist. This is a temporary stage in order to transition from the use of direct slot numbers to allocated handles only. Once all the tests and sample programs have been migrated to use handles, the implementation will be simplified and made more robust with support for handles only.
2018-11-30 18:54:54 +01:00
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
/* If the slot hasn't been allocated, the handle is invalid. */
if( ! slot->allocated )
return( PSA_ERROR_INVALID_HANDLE );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
*p_slot = slot;
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 12:21:11 +02:00
return( PSA_SUCCESS );
}
/* Retrieve an empty key slot (slot with no key data, but possibly
* with some metadata such as a policy). */
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
static psa_status_t psa_get_empty_key_slot( psa_key_handle_t handle,
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t **p_slot )
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 12:21:11 +02:00
{
psa_status_t status;
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *slot = NULL;
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 12:21:11 +02:00
*p_slot = NULL;
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
status = psa_get_key_slot( handle, &slot );
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 12:21:11 +02:00
if( status != PSA_SUCCESS )
return( status );
if( slot->type != PSA_KEY_TYPE_NONE )
return( PSA_ERROR_OCCUPIED_SLOT );
*p_slot = slot;
return( status );
}
/** Retrieve a slot which must contain a key. The key must have allow all the
* usage flags set in \p usage. If \p alg is nonzero, the key must allow
* operations with this algorithm. */
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
static psa_status_t psa_get_key_from_slot( psa_key_handle_t handle,
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t **p_slot,
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 12:21:11 +02:00
psa_key_usage_t usage,
psa_algorithm_t alg )
{
psa_status_t status;
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *slot = NULL;
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 12:21:11 +02:00
*p_slot = NULL;
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
status = psa_get_key_slot( handle, &slot );
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 12:21:11 +02:00
if( status != PSA_SUCCESS )
return( status );
if( slot->type == PSA_KEY_TYPE_NONE )
return( PSA_ERROR_EMPTY_SLOT );
/* Enforce that usage policy for the key slot contains all the flags
* required by the usage parameter. There is one exception: public
* keys can always be exported, so we treat public key objects as
* if they had the export flag. */
if( PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->type ) )
usage &= ~PSA_KEY_USAGE_EXPORT;
if( ( slot->policy.usage & usage ) != usage )
return( PSA_ERROR_NOT_PERMITTED );
if( alg != 0 && ( alg != slot->policy.alg ) )
return( PSA_ERROR_NOT_PERMITTED );
*p_slot = slot;
return( PSA_SUCCESS );
}
psa: Refactor psa_import_key() Create a new function psa_import_key_into_slot() from psa_import_key(). This is common functionality that will be used both when importing a key and loading a key from persistent storage.
2018-07-13 14:18:51 +02:00
Factor the common idiom psa_wipe_key_slot into a function Many places in the code called psa_remove_key_data_from_memory (which preserves metadata for the sake of failues in psa_import_key) followed by clearing the slot data. Use an auxiliary function for this.
2018-12-03 11:58:46 +01:00
/** Wipe key data from a slot. Preserve metadata such as the policy. */
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
static psa_status_t psa_remove_key_data_from_memory( psa_key_slot_t *slot )
psa: Refactor psa_import_key() Create a new function psa_import_key_into_slot() from psa_import_key(). This is common functionality that will be used both when importing a key and loading a key from persistent storage.
2018-07-13 14:18:51 +02:00
{
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
if( slot->type == PSA_KEY_TYPE_NONE )
psa_destroy_key: return SUCCESS on an empty slot Do wipe the slot even if it doesn't contain a key, to erase any metadata.
2018-04-19 08:38:16 +02:00
{
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 15:48:15 +01:00
/* No key material to clean. */
psa_destroy_key: return SUCCESS on an empty slot Do wipe the slot even if it doesn't contain a key, to erase any metadata.
2018-04-19 08:38:16 +02:00
}
Remove PSA_KEY_TYPE_IS_RAW_BYTES from crypto.h It isn't used to define other macros and it doesn't seem that useful for users. Remove it, we can reintroduce it if needed. Define a similar function key_type_is_raw_bytes in the implementation with a clear semantics: it's a key that's represented as a struct raw_data.
2018-06-21 14:15:31 +02:00
else if( key_type_is_raw_bytes( slot->type ) )
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
{
mbedtls_free( slot->data.raw.data );
}
else
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 18:16:59 +01:00
#if defined(MBEDTLS_RSA_C)
New macro PSA_KEY_TYPE_IS_RSA
2018-06-29 19:51:51 +02:00
if( PSA_KEY_TYPE_IS_RSA( slot->type ) )
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 18:16:59 +01:00
{
mbedtls_rsa_free( slot->data.rsa );
Fix memory leak in psa_destroy_key
2018-03-07 16:42:44 +01:00
mbedtls_free( slot->data.rsa );
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 18:16:59 +01:00
}
else
#endif /* defined(MBEDTLS_RSA_C) */
#if defined(MBEDTLS_ECP_C)
if( PSA_KEY_TYPE_IS_ECC( slot->type ) )
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
{
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 18:16:59 +01:00
mbedtls_ecp_keypair_free( slot->data.ecp );
Fix memory leak in psa_destroy_key
2018-03-07 16:42:44 +01:00
mbedtls_free( slot->data.ecp );
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
}
else
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 18:16:59 +01:00
#endif /* defined(MBEDTLS_ECP_C) */
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
{
/* Shouldn't happen: the key type is not any type that we
Add some comments to document some non-obvious coding choices
2018-03-07 16:41:37 +01:00
* put in. */
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
return( PSA_ERROR_TAMPERING_DETECTED );
}
return( PSA_SUCCESS );
}
Factor the common idiom psa_wipe_key_slot into a function Many places in the code called psa_remove_key_data_from_memory (which preserves metadata for the sake of failues in psa_import_key) followed by clearing the slot data. Use an auxiliary function for this.
2018-12-03 11:58:46 +01:00
/** Completely wipe a slot in memory, including its policy.
* Persistent storage is not affected. */
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
static psa_status_t psa_wipe_key_slot( psa_key_slot_t *slot )
Factor the common idiom psa_wipe_key_slot into a function Many places in the code called psa_remove_key_data_from_memory (which preserves metadata for the sake of failues in psa_import_key) followed by clearing the slot data. Use an auxiliary function for this.
2018-12-03 11:58:46 +01:00
{
psa_status_t status = psa_remove_key_data_from_memory( slot );
/* At this point, key material and other type-specific content has
* been wiped. Clear remaining metadata. We can call memset and not
* zeroize because the metadata is not particularly sensitive. */
memset( slot, 0, sizeof( *slot ) );
return( status );
}
Implement slot allocation Implement psa_allocate_key, psa_open_key, psa_create_key, psa_close_key. Add support for keys designated to handles to psa_get_key_slot, and thereby to the whole API. Allocated and non-allocated keys can coexist. This is a temporary stage in order to transition from the use of direct slot numbers to allocated handles only. Once all the tests and sample programs have been migrated to use handles, the implementation will be simplified and made more robust with support for handles only.
2018-11-30 18:54:54 +01:00
psa_status_t psa_internal_allocate_key_slot( psa_key_handle_t *handle )
{
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
for( *handle = PSA_KEY_SLOT_COUNT; *handle != 0; --( *handle ) )
Implement slot allocation Implement psa_allocate_key, psa_open_key, psa_create_key, psa_close_key. Add support for keys designated to handles to psa_get_key_slot, and thereby to the whole API. Allocated and non-allocated keys can coexist. This is a temporary stage in order to transition from the use of direct slot numbers to allocated handles only. Once all the tests and sample programs have been migrated to use handles, the implementation will be simplified and made more robust with support for handles only.
2018-11-30 18:54:54 +01:00
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *slot = &global_data.key_slots[*handle - 1];
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
if( ! slot->allocated )
Implement slot allocation Implement psa_allocate_key, psa_open_key, psa_create_key, psa_close_key. Add support for keys designated to handles to psa_get_key_slot, and thereby to the whole API. Allocated and non-allocated keys can coexist. This is a temporary stage in order to transition from the use of direct slot numbers to allocated handles only. Once all the tests and sample programs have been migrated to use handles, the implementation will be simplified and made more robust with support for handles only.
2018-11-30 18:54:54 +01:00
{
slot->allocated = 1;
return( PSA_SUCCESS );
}
}
return( PSA_ERROR_INSUFFICIENT_MEMORY );
}
psa_status_t psa_internal_make_key_persistent( psa_key_handle_t handle,
psa_key_id_t id )
{
Fix the build without persistent storage Add missing guards on MBEDTLS_PSA_CRYPTO_STORAGE_C. Add test cases to test that psa_create_key and psa_open_key return NOT_SUPPORTED.
2018-12-03 18:19:39 +01:00
#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *slot;
Implement slot allocation Implement psa_allocate_key, psa_open_key, psa_create_key, psa_close_key. Add support for keys designated to handles to psa_get_key_slot, and thereby to the whole API. Allocated and non-allocated keys can coexist. This is a temporary stage in order to transition from the use of direct slot numbers to allocated handles only. Once all the tests and sample programs have been migrated to use handles, the implementation will be simplified and made more robust with support for handles only.
2018-11-30 18:54:54 +01:00
psa_status_t status;
/* Reject id=0 because by general library conventions, 0 is an invalid
* value wherever possible. */
if( id == 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
/* Reject high values because the file names are reserved for the
* library's internal use. */
if( id >= 0xffff0000 )
return( PSA_ERROR_INVALID_ARGUMENT );
status = psa_get_key_slot( handle, &slot );
if( status != PSA_SUCCESS )
return( status );
slot->lifetime = PSA_KEY_LIFETIME_PERSISTENT;
slot->persistent_storage_id = id;
status = psa_load_persistent_key_into_slot( slot );
return( status );
Fix the build without persistent storage Add missing guards on MBEDTLS_PSA_CRYPTO_STORAGE_C. Add test cases to test that psa_create_key and psa_open_key return NOT_SUPPORTED.
2018-12-03 18:19:39 +01:00
#else /* MBEDTLS_PSA_CRYPTO_STORAGE_C */
(void) handle;
(void) id;
return( PSA_ERROR_NOT_SUPPORTED );
#endif /* !MBEDTLS_PSA_CRYPTO_STORAGE_C */
Implement slot allocation Implement psa_allocate_key, psa_open_key, psa_create_key, psa_close_key. Add support for keys designated to handles to psa_get_key_slot, and thereby to the whole API. Allocated and non-allocated keys can coexist. This is a temporary stage in order to transition from the use of direct slot numbers to allocated handles only. Once all the tests and sample programs have been migrated to use handles, the implementation will be simplified and made more robust with support for handles only.
2018-11-30 18:54:54 +01:00
}
psa_status_t psa_internal_release_key_slot( psa_key_handle_t handle )
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *slot;
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
psa_status_t status;
status = psa_get_key_slot( handle, &slot );
if( status != PSA_SUCCESS )
return( status );
Implement slot allocation Implement psa_allocate_key, psa_open_key, psa_create_key, psa_close_key. Add support for keys designated to handles to psa_get_key_slot, and thereby to the whole API. Allocated and non-allocated keys can coexist. This is a temporary stage in order to transition from the use of direct slot numbers to allocated handles only. Once all the tests and sample programs have been migrated to use handles, the implementation will be simplified and made more robust with support for handles only.
2018-11-30 18:54:54 +01:00
if( ! slot->allocated )
return( PSA_ERROR_INVALID_HANDLE );
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
Factor the common idiom psa_wipe_key_slot into a function Many places in the code called psa_remove_key_data_from_memory (which preserves metadata for the sake of failues in psa_import_key) followed by clearing the slot data. Use an auxiliary function for this.
2018-12-03 11:58:46 +01:00
return( psa_wipe_key_slot( slot ) );
Implement slot allocation Implement psa_allocate_key, psa_open_key, psa_create_key, psa_close_key. Add support for keys designated to handles to psa_get_key_slot, and thereby to the whole API. Allocated and non-allocated keys can coexist. This is a temporary stage in order to transition from the use of direct slot numbers to allocated handles only. Once all the tests and sample programs have been migrated to use handles, the implementation will be simplified and made more robust with support for handles only.
2018-11-30 18:54:54 +01:00
}
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
psa_status_t psa_import_key( psa_key_handle_t handle,
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 15:48:15 +01:00
psa_key_type_t type,
const uint8_t *data,
size_t data_length )
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *slot;
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 15:48:15 +01:00
psa_status_t status;
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
status = psa_get_empty_key_slot( handle, &slot );
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 15:48:15 +01:00
if( status != PSA_SUCCESS )
return( status );
slot->type = type;
status = psa_import_key_into_slot( slot, data, data_length );
if( status != PSA_SUCCESS )
{
slot->type = PSA_KEY_TYPE_NONE;
return( status );
}
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
if( slot->lifetime == PSA_KEY_LIFETIME_PERSISTENT )
{
/* Store in file location */
Distinguish in-memory slot number from in-storage slot identifier At the moment, the in-storage slot identifier is the in-memory slot number. But track them separately, to prepare for API changes that will let them be different (psa_open_key, psa_create_key).
2018-11-30 18:46:56 +01:00
status = psa_save_persistent_key( slot->persistent_storage_id,
slot->type, &slot->policy, data,
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
data_length );
if( status != PSA_SUCCESS )
{
(void) psa_remove_key_data_from_memory( slot );
slot->type = PSA_KEY_TYPE_NONE;
}
}
#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
return( status );
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 15:48:15 +01:00
}
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
psa_status_t psa_destroy_key( psa_key_handle_t handle )
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 15:48:15 +01:00
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *slot;
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
psa_status_t status = PSA_SUCCESS;
psa_status_t storage_status = PSA_SUCCESS;
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 15:48:15 +01:00
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
status = psa_get_key_slot( handle, &slot );
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 15:48:15 +01:00
if( status != PSA_SUCCESS )
return( status );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
if( slot->lifetime == PSA_KEY_LIFETIME_PERSISTENT )
{
Distinguish in-memory slot number from in-storage slot identifier At the moment, the in-storage slot identifier is the in-memory slot number. But track them separately, to prepare for API changes that will let them be different (psa_open_key, psa_create_key).
2018-11-30 18:46:56 +01:00
storage_status =
psa_destroy_persistent_key( slot->persistent_storage_id );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
}
#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
Factor the common idiom psa_wipe_key_slot into a function Many places in the code called psa_remove_key_data_from_memory (which preserves metadata for the sake of failues in psa_import_key) followed by clearing the slot data. Use an auxiliary function for this.
2018-12-03 11:58:46 +01:00
status = psa_wipe_key_slot( slot );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
if( status != PSA_SUCCESS )
return( status );
return( storage_status );
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 15:48:15 +01:00
}
New internal function psa_get_key_bits Isolate the code of psa_get_key_information that calculates the bit size of a key into its own function which can be called by functions that have a key slot pointer.
2018-07-06 16:02:09 +02:00
/* Return the size of the key in the given slot, in bits. */
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
static size_t psa_get_key_bits( const psa_key_slot_t *slot )
New internal function psa_get_key_bits Isolate the code of psa_get_key_information that calculates the bit size of a key into its own function which can be called by functions that have a key slot pointer.
2018-07-06 16:02:09 +02:00
{
if( key_type_is_raw_bytes( slot->type ) )
return( slot->data.raw.bytes * 8 );
#if defined(MBEDTLS_RSA_C)
New macro PSA_KEY_TYPE_IS_RSA
2018-06-29 19:51:51 +02:00
if( PSA_KEY_TYPE_IS_RSA( slot->type ) )
Remove support for non-byte-aligned RSA keys Remove the need for an extra function mbedtls_rsa_get_bitlen. Use mbedtls_rsa_get_len, which is only correct for keys whose size is a multiple of 8. Key sizes that aren't a multiple of 8 are extremely rarely used, so in practice this is not a problematic limitation.
2018-11-12 18:37:42 +01:00
return( PSA_BYTES_TO_BITS( mbedtls_rsa_get_len( slot->data.rsa ) ) );
New internal function psa_get_key_bits Isolate the code of psa_get_key_information that calculates the bit size of a key into its own function which can be called by functions that have a key slot pointer.
2018-07-06 16:02:09 +02:00
#endif /* defined(MBEDTLS_RSA_C) */
#if defined(MBEDTLS_ECP_C)
if( PSA_KEY_TYPE_IS_ECC( slot->type ) )
return( slot->data.ecp->grp.pbits );
#endif /* defined(MBEDTLS_ECP_C) */
/* Shouldn't happen except on an empty slot. */
return( 0 );
}
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
psa_status_t psa_get_key_information( psa_key_handle_t handle,
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 15:41:12 +02:00
psa_key_type_t *type,
size_t *bits )
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *slot;
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
psa_status_t status;
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
if( type != NULL )
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
*type = 0;
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
if( bits != NULL )
*bits = 0;
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
status = psa_get_key_slot( handle, &slot );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
if( status != PSA_SUCCESS )
return( status );
New internal function psa_get_key_bits Isolate the code of psa_get_key_information that calculates the bit size of a key into its own function which can be called by functions that have a key slot pointer.
2018-07-06 16:02:09 +02:00
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
if( slot->type == PSA_KEY_TYPE_NONE )
return( PSA_ERROR_EMPTY_SLOT );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
if( type != NULL )
*type = slot->type;
New internal function psa_get_key_bits Isolate the code of psa_get_key_information that calculates the bit size of a key into its own function which can be called by functions that have a key slot pointer.
2018-07-06 16:02:09 +02:00
if( bits != NULL )
*bits = psa_get_key_bits( slot );
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
return( PSA_SUCCESS );
}
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
static psa_status_t psa_internal_export_key( psa_key_slot_t *slot,
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 15:41:12 +02:00
uint8_t *data,
size_t data_size,
size_t *data_length,
int export_public_key )
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
{
psa_export_key: Always set a valid data length Make psa_export_key() always set a valid data_length when exporting, even when there are errors. This makes the API easier to use for buggy programs (like our test code). Our test code previously used exported_length uninitialized when checking to see that the buffer returned was all zero in import_export() in the case where an error was returned from psa_export_key(). Initialize exported_length to an invalid length, and check that it gets set properly by psa_export_key(), to avoid this using export_length uninitialized. Note that the mem_is_zero() check is still valid when psa_export_key() returns an error, e.g. where exported_length is 0, as we want to check that nothing was written to the buffer on error. Out test code also previous passed NULL for the data_length parameter of psa_export_key() when it expected a failure (in key_policy_fail()). However, data_length is not allowed to be NULL, especially now that we write to data_length from psa_export_key() even when there are errors. Update the test code to not pass in a NULL data_length.
2018-06-27 18:20:43 +02:00
*data_length = 0;
Formatting improvements Avoid lines longer than 80 columns. Remove some redundant parentheses, e.g. change if( ( a == b ) && ( c == d ) ) to if( a == b && c == d ) which makes lines less long and makes the remaining parentheses more relevant. Add missing parentheses around return statements. There should be no semantic change in this commit.
2018-06-18 16:04:39 +02:00
if( export_public_key && ! PSA_KEY_TYPE_IS_ASYMMETRIC( slot->type ) )
psa_internal_export_key function for common code. create psa_internal_export_key function for common code in psa_export_key and psa_export_public_key.
2018-04-16 17:16:20 +02:00
return( PSA_ERROR_INVALID_ARGUMENT );
integrate policy key usage in export and asymmetric sign functions
2018-03-28 12:17:44 +02:00
Remove PSA_KEY_TYPE_IS_RAW_BYTES from crypto.h It isn't used to define other macros and it doesn't seem that useful for users. Remove it, we can reintroduce it if needed. Define a similar function key_type_is_raw_bytes in the implementation with a clear semantics: it's a key that's represented as a struct raw_data.
2018-06-21 14:15:31 +02:00
if( key_type_is_raw_bytes( slot->type ) )
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
{
if( slot->data.raw.bytes > data_size )
return( PSA_ERROR_BUFFER_TOO_SMALL );
psa_export_key: for raw-byte keys, zero the end of the output buffer Skip all writing to the target buffer if its size is 0, since in this case the pointer might be invalid and this would cause the calls to memcpy and memset to have undefined behavior.
2018-10-29 19:26:27 +01:00
if( data_size != 0 )
{
Handle null pointers safely when used as buffers of size 0 When the size of a buffer is 0, the corresponding pointer argument may be null. In such cases, library functions must not perform arithmetic on the pointer or call standard library functions such as memset and memcpy, since that would be undefined behavior in C. Protect such cases. Refactor the storage of a 0-sized raw data object to make it store a null pointer, rather than depending on the behavior of calloc(1,0).
2018-06-28 19:31:31 +02:00
memcpy( data, slot->data.raw.data, slot->data.raw.bytes );
psa_export_key: for raw-byte keys, zero the end of the output buffer Skip all writing to the target buffer if its size is 0, since in this case the pointer might be invalid and this would cause the calls to memcpy and memset to have undefined behavior.
2018-10-29 19:26:27 +01:00
memset( data + slot->data.raw.bytes, 0,
data_size - slot->data.raw.bytes );
}
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
*data_length = slot->data.raw.bytes;
return( PSA_SUCCESS );
}
Private EC key format: change to raw secret value (export) Change the import/export format of private elliptic curve keys from RFC 5915 to the raw secret value. This commit updates the export code.
2018-10-29 19:26:02 +01:00
#if defined(MBEDTLS_ECP_C)
if( PSA_KEY_TYPE_IS_ECC_KEYPAIR( slot->type ) && !export_public_key )
{
psa: Refactor psa_internal_export_key to use slot, rather than key When generating keys that have persistent lifetime, we will need the keys to be in the exported format to save to persistent storage. This refactoring to separate checking the slots usage from the exporting of the key data will be necessary for using psa_internal_export_key in psa_generate_key.
2018-11-07 17:00:44 +01:00
psa_status_t status;
Private EC key format: change to raw secret value (export) Change the import/export format of private elliptic curve keys from RFC 5915 to the raw secret value. This commit updates the export code.
2018-10-29 19:26:02 +01:00
size_t bytes = PSA_BITS_TO_BYTES( psa_get_key_bits( slot ) );
if( bytes > data_size )
return( PSA_ERROR_BUFFER_TOO_SMALL );
status = mbedtls_to_psa_error(
mbedtls_mpi_write_binary( &slot->data.ecp->d, data, bytes ) );
if( status != PSA_SUCCESS )
return( status );
memset( data + bytes, 0, data_size - bytes );
*data_length = bytes;
return( PSA_SUCCESS );
}
#endif
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
else
{
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 18:16:59 +01:00
#if defined(MBEDTLS_PK_WRITE_C)
New macro PSA_KEY_TYPE_IS_RSA
2018-06-29 19:51:51 +02:00
if( PSA_KEY_TYPE_IS_RSA( slot->type ) ||
psa_internal_export_key function for common code. create psa_internal_export_key function for common code in psa_export_key and psa_export_public_key.
2018-04-16 17:16:20 +02:00
PSA_KEY_TYPE_IS_ECC( slot->type ) )
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 18:16:59 +01:00
{
psa_internal_export_key function for common code. create psa_internal_export_key function for common code in psa_export_key and psa_export_public_key.
2018-04-16 17:16:20 +02:00
mbedtls_pk_context pk;
int ret;
New macro PSA_KEY_TYPE_IS_RSA
2018-06-29 19:51:51 +02:00
if( PSA_KEY_TYPE_IS_RSA( slot->type ) )
psa_internal_export_key function for common code. create psa_internal_export_key function for common code in psa_export_key and psa_export_public_key.
2018-04-16 17:16:20 +02:00
{
Add ifdefs for psa_internal_export_key function MBEDTLS_PK_WRITE_C only requires either MBEDTLS_RSA_C or MBEDTLS_ECP_C to be defined. Added wrappers to handle the cases where only one has been defined. Moved mbedtls_pk_init to be within the ifdefs, so it's only called if appropriate.
2018-07-24 17:33:30 +02:00
#if defined(MBEDTLS_RSA_C)
mbedtls_pk_init( &pk );
psa_internal_export_key function for common code. create psa_internal_export_key function for common code in psa_export_key and psa_export_public_key.
2018-04-16 17:16:20 +02:00
pk.pk_info = &mbedtls_rsa_info;
pk.pk_ctx = slot->data.rsa;
Add ifdefs for psa_internal_export_key function MBEDTLS_PK_WRITE_C only requires either MBEDTLS_RSA_C or MBEDTLS_ECP_C to be defined. Added wrappers to handle the cases where only one has been defined. Moved mbedtls_pk_init to be within the ifdefs, so it's only called if appropriate.
2018-07-24 17:33:30 +02:00
#else
return( PSA_ERROR_NOT_SUPPORTED );
#endif
psa_internal_export_key function for common code. create psa_internal_export_key function for common code in psa_export_key and psa_export_public_key.
2018-04-16 17:16:20 +02:00
}
else
{
Add ifdefs for psa_internal_export_key function MBEDTLS_PK_WRITE_C only requires either MBEDTLS_RSA_C or MBEDTLS_ECP_C to be defined. Added wrappers to handle the cases where only one has been defined. Moved mbedtls_pk_init to be within the ifdefs, so it's only called if appropriate.
2018-07-24 17:33:30 +02:00
#if defined(MBEDTLS_ECP_C)
mbedtls_pk_init( &pk );
psa_internal_export_key function for common code. create psa_internal_export_key function for common code in psa_export_key and psa_export_public_key.
2018-04-16 17:16:20 +02:00
pk.pk_info = &mbedtls_eckey_info;
pk.pk_ctx = slot->data.ecp;
Add ifdefs for psa_internal_export_key function MBEDTLS_PK_WRITE_C only requires either MBEDTLS_RSA_C or MBEDTLS_ECP_C to be defined. Added wrappers to handle the cases where only one has been defined. Moved mbedtls_pk_init to be within the ifdefs, so it's only called if appropriate.
2018-07-24 17:33:30 +02:00
#else
return( PSA_ERROR_NOT_SUPPORTED );
#endif
psa_internal_export_key function for common code. create psa_internal_export_key function for common code in psa_export_key and psa_export_public_key.
2018-04-16 17:16:20 +02:00
}
adjust indentation per Mbed TLS standards
2018-05-29 15:56:39 +02:00
if( export_public_key || PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->type ) )
psa_internal_export_key function for common code. create psa_internal_export_key function for common code in psa_export_key and psa_export_public_key.
2018-04-16 17:16:20 +02:00
ret = mbedtls_pk_write_pubkey_der( &pk, data, data_size );
fix conditions
2018-05-02 11:55:20 +02:00
else
ret = mbedtls_pk_write_key_der( &pk, data, data_size );
adjust indentation per Mbed TLS standards
2018-04-29 10:34:58 +02:00
if( ret < 0 )
psa_export_key: zero out potential garbage in the output buffer In psa_export_key, ensure that each byte of the output buffer either contains its original value, is zero, or is part of the actual output. Specifically, don't risk having partial output on error, and don't leave extra data at the end of the buffer when exporting an asymmetric key. Test that exporting to a previously zeroed buffer leaves the buffer zeroed outside the actual output if any.
2018-06-20 00:11:45 +02:00
{
Handle null pointers safely when used as buffers of size 0 When the size of a buffer is 0, the corresponding pointer argument may be null. In such cases, library functions must not perform arithmetic on the pointer or call standard library functions such as memset and memcpy, since that would be undefined behavior in C. Protect such cases. Refactor the storage of a 0-sized raw data object to make it store a null pointer, rather than depending on the behavior of calloc(1,0).
2018-06-28 19:31:31 +02:00
/* If data_size is 0 then data may be NULL and then the
* call to memset would have undefined behavior. */
if( data_size != 0 )
memset( data, 0, data_size );
psa_internal_export_key function for common code. create psa_internal_export_key function for common code in psa_export_key and psa_export_public_key.
2018-04-16 17:16:20 +02:00
return( mbedtls_to_psa_error( ret ) );
psa_export_key: zero out potential garbage in the output buffer In psa_export_key, ensure that each byte of the output buffer either contains its original value, is zero, or is part of the actual output. Specifically, don't risk having partial output on error, and don't leave extra data at the end of the buffer when exporting an asymmetric key. Test that exporting to a previously zeroed buffer leaves the buffer zeroed outside the actual output if any.
2018-06-20 00:11:45 +02:00
}
psa_export_key: fix asymmetric key in larger buffer Exporting an asymmetric key only worked if the target buffer had exactly the right size, because psa_export_key uses mbedtls_pk_write_key_der or mbedtls_pk_write_pubkey_der and these functions write to the end of the buffer, which psa_export_key did not correct for. Fix this by moving the data to the beginning of the buffer if necessary. Add non-regression tests.
2018-06-20 00:11:07 +02:00
/* The mbedtls_pk_xxx functions write to the end of the buffer.
* Move the data to the beginning and erase remaining data
* at the original location. */
if( 2 * (size_t) ret <= data_size )
{
memcpy( data, data + data_size - ret, ret );
psa_export_key: zero out potential garbage in the output buffer In psa_export_key, ensure that each byte of the output buffer either contains its original value, is zero, or is part of the actual output. Specifically, don't risk having partial output on error, and don't leave extra data at the end of the buffer when exporting an asymmetric key. Test that exporting to a previously zeroed buffer leaves the buffer zeroed outside the actual output if any.
2018-06-20 00:11:45 +02:00
memset( data + data_size - ret, 0, ret );
psa_export_key: fix asymmetric key in larger buffer Exporting an asymmetric key only worked if the target buffer had exactly the right size, because psa_export_key uses mbedtls_pk_write_key_der or mbedtls_pk_write_pubkey_der and these functions write to the end of the buffer, which psa_export_key did not correct for. Fix this by moving the data to the beginning of the buffer if necessary. Add non-regression tests.
2018-06-20 00:11:07 +02:00
}
else if( (size_t) ret < data_size )
{
memmove( data, data + data_size - ret, ret );
psa_export_key: zero out potential garbage in the output buffer In psa_export_key, ensure that each byte of the output buffer either contains its original value, is zero, or is part of the actual output. Specifically, don't risk having partial output on error, and don't leave extra data at the end of the buffer when exporting an asymmetric key. Test that exporting to a previously zeroed buffer leaves the buffer zeroed outside the actual output if any.
2018-06-20 00:11:45 +02:00
memset( data + ret, 0, data_size - ret );
psa_export_key: fix asymmetric key in larger buffer Exporting an asymmetric key only worked if the target buffer had exactly the right size, because psa_export_key uses mbedtls_pk_write_key_der or mbedtls_pk_write_pubkey_der and these functions write to the end of the buffer, which psa_export_key did not correct for. Fix this by moving the data to the beginning of the buffer if necessary. Add non-regression tests.
2018-06-20 00:11:07 +02:00
}
psa_internal_export_key function for common code. create psa_internal_export_key function for common code in psa_export_key and psa_export_public_key.
2018-04-16 17:16:20 +02:00
*data_length = ret;
return( PSA_SUCCESS );
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 18:16:59 +01:00
}
else
psa_internal_export_key function for common code. create psa_internal_export_key function for common code in psa_export_key and psa_export_public_key.
2018-04-16 17:16:20 +02:00
#endif /* defined(MBEDTLS_PK_WRITE_C) */
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 18:16:59 +01:00
{
psa_internal_export_key function for common code. create psa_internal_export_key function for common code in psa_export_key and psa_export_public_key.
2018-04-16 17:16:20 +02:00
/* This shouldn't happen in the reference implementation, but
Whitespace fixes; removed redundant parentheses No semantic change.
2018-06-04 15:08:56 +02:00
it is valid for a special-purpose implementation to omit
support for exporting certain key types. */
psa_internal_export_key function for common code. create psa_internal_export_key function for common code in psa_export_key and psa_export_public_key.
2018-04-16 17:16:20 +02:00
return( PSA_ERROR_NOT_SUPPORTED );
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 18:16:59 +01:00
}
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
}
}
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
psa_status_t psa_export_key( psa_key_handle_t handle,
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 15:41:12 +02:00
uint8_t *data,
size_t data_size,
size_t *data_length )
psa_internal_export_key function for common code. create psa_internal_export_key function for common code in psa_export_key and psa_export_public_key.
2018-04-16 17:16:20 +02:00
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *slot;
psa: Refactor psa_internal_export_key to use slot, rather than key When generating keys that have persistent lifetime, we will need the keys to be in the exported format to save to persistent storage. This refactoring to separate checking the slots usage from the exporting of the key data will be necessary for using psa_internal_export_key in psa_generate_key.
2018-11-07 17:00:44 +01:00
psa_status_t status;
/* Set the key to empty now, so that even when there are errors, we always
* set data_length to a value between 0 and data_size. On error, setting
* the key to empty is a good choice because an empty key representation is
* unlikely to be accepted anywhere. */
*data_length = 0;
/* Export requires the EXPORT flag. There is an exception for public keys,
* which don't require any flag, but psa_get_key_from_slot takes
* care of this. */
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
status = psa_get_key_from_slot( handle, &slot, PSA_KEY_USAGE_EXPORT, 0 );
psa: Refactor psa_internal_export_key to use slot, rather than key When generating keys that have persistent lifetime, we will need the keys to be in the exported format to save to persistent storage. This refactoring to separate checking the slots usage from the exporting of the key data will be necessary for using psa_internal_export_key in psa_generate_key.
2018-11-07 17:00:44 +01:00
if( status != PSA_SUCCESS )
return( status );
return( psa_internal_export_key( slot, data, data_size,
Formatting improvements Avoid lines longer than 80 columns. Remove some redundant parentheses, e.g. change if( ( a == b ) && ( c == d ) ) to if( a == b && c == d ) which makes lines less long and makes the remaining parentheses more relevant. Add missing parentheses around return statements. There should be no semantic change in this commit.
2018-06-18 16:04:39 +02:00
data_length, 0 ) );
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
}
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
psa_status_t psa_export_public_key( psa_key_handle_t handle,
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 15:41:12 +02:00
uint8_t *data,
size_t data_size,
size_t *data_length )
export public key
2018-04-03 14:30:03 +02:00
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *slot;
psa: Refactor psa_internal_export_key to use slot, rather than key When generating keys that have persistent lifetime, we will need the keys to be in the exported format to save to persistent storage. This refactoring to separate checking the slots usage from the exporting of the key data will be necessary for using psa_internal_export_key in psa_generate_key.
2018-11-07 17:00:44 +01:00
psa_status_t status;
/* Set the key to empty now, so that even when there are errors, we always
* set data_length to a value between 0 and data_size. On error, setting
* the key to empty is a good choice because an empty key representation is
* unlikely to be accepted anywhere. */
*data_length = 0;
/* Exporting a public key doesn't require a usage flag. */
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
status = psa_get_key_from_slot( handle, &slot, 0, 0 );
psa: Refactor psa_internal_export_key to use slot, rather than key When generating keys that have persistent lifetime, we will need the keys to be in the exported format to save to persistent storage. This refactoring to separate checking the slots usage from the exporting of the key data will be necessary for using psa_internal_export_key in psa_generate_key.
2018-11-07 17:00:44 +01:00
if( status != PSA_SUCCESS )
return( status );
return( psa_internal_export_key( slot, data, data_size,
Formatting improvements Avoid lines longer than 80 columns. Remove some redundant parentheses, e.g. change if( ( a == b ) && ( c == d ) ) to if( a == b && c == d ) which makes lines less long and makes the remaining parentheses more relevant. Add missing parentheses around return statements. There should be no semantic change in this commit.
2018-06-18 16:04:39 +02:00
data_length, 1 ) );
export public key
2018-04-03 14:30:03 +02:00
}
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
psa: Extend psa_generate_key to support persistent lifetimes
2018-11-07 17:05:30 +01:00
#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
static psa_status_t psa_save_generated_persistent_key( psa_key_slot_t *slot,
psa: Extend psa_generate_key to support persistent lifetimes
2018-11-07 17:05:30 +01:00
size_t bits )
{
psa_status_t status;
uint8_t *data;
size_t key_length;
size_t data_size = PSA_KEY_EXPORT_MAX_SIZE( slot->type, bits );
data = mbedtls_calloc( 1, data_size );
Check that memory allocation was successful in psa_save_generated_persistent_key
2018-11-21 15:03:21 +01:00
if( data == NULL )
return( PSA_ERROR_INSUFFICIENT_MEMORY );
psa: Extend psa_generate_key to support persistent lifetimes
2018-11-07 17:05:30 +01:00
/* Get key data in export format */
status = psa_internal_export_key( slot, data, data_size, &key_length, 0 );
if( status != PSA_SUCCESS )
{
slot->type = PSA_KEY_TYPE_NONE;
goto exit;
}
/* Store in file location */
Distinguish in-memory slot number from in-storage slot identifier At the moment, the in-storage slot identifier is the in-memory slot number. But track them separately, to prepare for API changes that will let them be different (psa_open_key, psa_create_key).
2018-11-30 18:46:56 +01:00
status = psa_save_persistent_key( slot->persistent_storage_id,
slot->type, &slot->policy,
psa: Extend psa_generate_key to support persistent lifetimes
2018-11-07 17:05:30 +01:00
data, key_length );
if( status != PSA_SUCCESS )
{
slot->type = PSA_KEY_TYPE_NONE;
}
exit:
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 18:14:53 +01:00
mbedtls_platform_zeroize( data, key_length );
psa: Extend psa_generate_key to support persistent lifetimes
2018-11-07 17:05:30 +01:00
mbedtls_free( data );
return( status );
}
#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
Be more consistent about blank lines
2018-06-18 21:49:39 +02:00
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 22:44:14 +01:00
/****************************************************************/
/* Message digests */
/****************************************************************/
Rename xxx_of_psa functions to xxx_from_psa Be consistent with how similar functions are named in Mbed TLS.
2018-03-07 16:42:59 +01:00
static const mbedtls_md_info_t *mbedtls_md_info_from_psa( psa_algorithm_t alg )
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 22:44:14 +01:00
{
switch( alg )
{
#if defined(MBEDTLS_MD2_C)
case PSA_ALG_MD2:
return( &mbedtls_md2_info );
#endif
#if defined(MBEDTLS_MD4_C)
case PSA_ALG_MD4:
return( &mbedtls_md4_info );
#endif
#if defined(MBEDTLS_MD5_C)
case PSA_ALG_MD5:
return( &mbedtls_md5_info );
#endif
#if defined(MBEDTLS_RIPEMD160_C)
case PSA_ALG_RIPEMD160:
return( &mbedtls_ripemd160_info );
#endif
#if defined(MBEDTLS_SHA1_C)
case PSA_ALG_SHA_1:
return( &mbedtls_sha1_info );
#endif
#if defined(MBEDTLS_SHA256_C)
case PSA_ALG_SHA_224:
return( &mbedtls_sha224_info );
case PSA_ALG_SHA_256:
return( &mbedtls_sha256_info );
#endif
#if defined(MBEDTLS_SHA512_C)
case PSA_ALG_SHA_384:
return( &mbedtls_sha384_info );
case PSA_ALG_SHA_512:
return( &mbedtls_sha512_info );
#endif
default:
return( NULL );
}
}
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 21:05:37 +01:00
psa_status_t psa_hash_abort( psa_hash_operation_t *operation )
{
switch( operation->alg )
{
psa_hash_abort: return PSA_SUCCESS if alg=0 Make psa_hash_abort consistent with psa_mac_abort and psa_cipher_abort. Add a comment explaining the reasoning.
2018-06-26 15:04:31 +02:00
case 0:
/* The object has (apparently) been initialized but it is not
* in use. It's ok to call abort on such an object, and there's
* nothing to do. */
break;
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 21:05:37 +01:00
#if defined(MBEDTLS_MD2_C)
case PSA_ALG_MD2:
mbedtls_md2_free( &operation->ctx.md2 );
break;
#endif
#if defined(MBEDTLS_MD4_C)
case PSA_ALG_MD4:
mbedtls_md4_free( &operation->ctx.md4 );
break;
#endif
#if defined(MBEDTLS_MD5_C)
case PSA_ALG_MD5:
mbedtls_md5_free( &operation->ctx.md5 );
break;
#endif
#if defined(MBEDTLS_RIPEMD160_C)
case PSA_ALG_RIPEMD160:
mbedtls_ripemd160_free( &operation->ctx.ripemd160 );
break;
#endif
#if defined(MBEDTLS_SHA1_C)
case PSA_ALG_SHA_1:
mbedtls_sha1_free( &operation->ctx.sha1 );
break;
#endif
#if defined(MBEDTLS_SHA256_C)
case PSA_ALG_SHA_224:
case PSA_ALG_SHA_256:
mbedtls_sha256_free( &operation->ctx.sha256 );
break;
#endif
#if defined(MBEDTLS_SHA512_C)
case PSA_ALG_SHA_384:
case PSA_ALG_SHA_512:
mbedtls_sha512_free( &operation->ctx.sha512 );
break;
#endif
default:
In abort functions, return BAD_STATE on obviously bad input psa_hash_abort, psa_mac_abort and psa_cipher_abort now return PSA_ERROR_BAD_STATE if operation->alg is obviously not valid, which can only happen due to a programming error in the caller or in the library. We can't detect all cases of calling abort on uninitialized memory but this is dirt cheap and better than nothing.
2018-06-21 16:57:07 +02:00
return( PSA_ERROR_BAD_STATE );
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 21:05:37 +01:00
}
operation->alg = 0;
return( PSA_SUCCESS );
}
Rename psa_hash_start -> psa_hash_setup Make function names for multipart operations more consistent (hash edition).
2018-07-08 19:46:38 +02:00
psa_status_t psa_hash_setup( psa_hash_operation_t *operation,
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 21:05:37 +01:00
psa_algorithm_t alg )
{
int ret;
operation->alg = 0;
switch( alg )
{
#if defined(MBEDTLS_MD2_C)
case PSA_ALG_MD2:
mbedtls_md2_init( &operation->ctx.md2 );
ret = mbedtls_md2_starts_ret( &operation->ctx.md2 );
break;
#endif
#if defined(MBEDTLS_MD4_C)
case PSA_ALG_MD4:
mbedtls_md4_init( &operation->ctx.md4 );
ret = mbedtls_md4_starts_ret( &operation->ctx.md4 );
break;
#endif
#if defined(MBEDTLS_MD5_C)
case PSA_ALG_MD5:
mbedtls_md5_init( &operation->ctx.md5 );
ret = mbedtls_md5_starts_ret( &operation->ctx.md5 );
break;
#endif
#if defined(MBEDTLS_RIPEMD160_C)
case PSA_ALG_RIPEMD160:
mbedtls_ripemd160_init( &operation->ctx.ripemd160 );
ret = mbedtls_ripemd160_starts_ret( &operation->ctx.ripemd160 );
break;
#endif
#if defined(MBEDTLS_SHA1_C)
case PSA_ALG_SHA_1:
mbedtls_sha1_init( &operation->ctx.sha1 );
ret = mbedtls_sha1_starts_ret( &operation->ctx.sha1 );
break;
#endif
#if defined(MBEDTLS_SHA256_C)
case PSA_ALG_SHA_224:
mbedtls_sha256_init( &operation->ctx.sha256 );
ret = mbedtls_sha256_starts_ret( &operation->ctx.sha256, 1 );
break;
case PSA_ALG_SHA_256:
mbedtls_sha256_init( &operation->ctx.sha256 );
ret = mbedtls_sha256_starts_ret( &operation->ctx.sha256, 0 );
break;
#endif
#if defined(MBEDTLS_SHA512_C)
case PSA_ALG_SHA_384:
mbedtls_sha512_init( &operation->ctx.sha512 );
ret = mbedtls_sha512_starts_ret( &operation->ctx.sha512, 1 );
break;
case PSA_ALG_SHA_512:
mbedtls_sha512_init( &operation->ctx.sha512 );
ret = mbedtls_sha512_starts_ret( &operation->ctx.sha512, 0 );
break;
#endif
default:
Favor INVALID_ARGUMENT over NOT_SUPPORTED for bad algorithm types In psa_hash_start, psa_mac_start and psa_cipher_setup, return PSA_ERROR_INVALID_ARGUMENT rather than PSA_ERROR_NOT_SUPPORTED when the algorithm parameter is not the right category.
2018-06-20 16:21:04 +02:00
return( PSA_ALG_IS_HASH( alg ) ?
PSA_ERROR_NOT_SUPPORTED :
PSA_ERROR_INVALID_ARGUMENT );
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 21:05:37 +01:00
}
if( ret == 0 )
operation->alg = alg;
else
psa_hash_abort( operation );
return( mbedtls_to_psa_error( ret ) );
}
psa_status_t psa_hash_update( psa_hash_operation_t *operation,
const uint8_t *input,
size_t input_length )
{
int ret;
psa_hash_update: robustify the case length=0 Don't require hash implementations to behave correctly on a zero-length input, which may have an invalid pointer.
2018-07-12 16:58:43 +02:00
/* Don't require hash implementations to behave correctly on a
* zero-length input, which may have an invalid pointer. */
if( input_length == 0 )
return( PSA_SUCCESS );
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 21:05:37 +01:00
switch( operation->alg )
{
#if defined(MBEDTLS_MD2_C)
case PSA_ALG_MD2:
ret = mbedtls_md2_update_ret( &operation->ctx.md2,
input, input_length );
break;
#endif
#if defined(MBEDTLS_MD4_C)
case PSA_ALG_MD4:
ret = mbedtls_md4_update_ret( &operation->ctx.md4,
input, input_length );
break;
#endif
#if defined(MBEDTLS_MD5_C)
case PSA_ALG_MD5:
ret = mbedtls_md5_update_ret( &operation->ctx.md5,
input, input_length );
break;
#endif
#if defined(MBEDTLS_RIPEMD160_C)
case PSA_ALG_RIPEMD160:
ret = mbedtls_ripemd160_update_ret( &operation->ctx.ripemd160,
input, input_length );
break;
#endif
#if defined(MBEDTLS_SHA1_C)
case PSA_ALG_SHA_1:
ret = mbedtls_sha1_update_ret( &operation->ctx.sha1,
input, input_length );
break;
#endif
#if defined(MBEDTLS_SHA256_C)
case PSA_ALG_SHA_224:
case PSA_ALG_SHA_256:
ret = mbedtls_sha256_update_ret( &operation->ctx.sha256,
input, input_length );
break;
#endif
#if defined(MBEDTLS_SHA512_C)
case PSA_ALG_SHA_384:
case PSA_ALG_SHA_512:
ret = mbedtls_sha512_update_ret( &operation->ctx.sha512,
input, input_length );
break;
#endif
default:
ret = MBEDTLS_ERR_MD_BAD_INPUT_DATA;
break;
}
psa_hash_update: robustify the case length=0 Don't require hash implementations to behave correctly on a zero-length input, which may have an invalid pointer.
2018-07-12 16:58:43 +02:00
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 21:05:37 +01:00
if( ret != 0 )
psa_hash_abort( operation );
return( mbedtls_to_psa_error( ret ) );
}
psa_status_t psa_hash_finish( psa_hash_operation_t *operation,
uint8_t *hash,
size_t hash_size,
size_t *hash_length )
{
Add missing calls to psa_hash_abort in hash functions
2018-08-02 12:14:17 +02:00
psa_status_t status;
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 21:05:37 +01:00
int ret;
Switch PSA_HASH_FINAL_SIZE to PSA_HASH_SIZE Make this macro work on derived algorithms as well (HMAC, hash-and-sign, etc.).
2018-04-19 08:29:59 +02:00
size_t actual_hash_length = PSA_HASH_SIZE( operation->alg );
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 21:05:37 +01:00
/* Fill the output buffer with something that isn't a valid hash
* (barring an attack on the hash and deliberately-crafted input),
* in case the caller doesn't check the return status properly. */
Fix safe output length in hash and mac finish In psa_hash_finish and psa_mac_finish_internal, set the fallback output length (which is reported on error) to the output buffer size, not to the _expected_ buffer size which could be larger.
2018-07-02 12:15:28 +02:00
*hash_length = hash_size;
Handle null pointers safely when used as buffers of size 0 When the size of a buffer is 0, the corresponding pointer argument may be null. In such cases, library functions must not perform arithmetic on the pointer or call standard library functions such as memset and memcpy, since that would be undefined behavior in C. Protect such cases. Refactor the storage of a 0-sized raw data object to make it store a null pointer, rather than depending on the behavior of calloc(1,0).
2018-06-28 19:31:31 +02:00
/* If hash_size is 0 then hash may be NULL and then the
* call to memset would have undefined behavior. */
if( hash_size != 0 )
memset( hash, '!', hash_size );
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 21:05:37 +01:00
if( hash_size < actual_hash_length )
Add missing calls to psa_hash_abort in hash functions
2018-08-02 12:14:17 +02:00
{
status = PSA_ERROR_BUFFER_TOO_SMALL;
goto exit;
}
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 21:05:37 +01:00
switch( operation->alg )
{
#if defined(MBEDTLS_MD2_C)
case PSA_ALG_MD2:
ret = mbedtls_md2_finish_ret( &operation->ctx.md2, hash );
break;
#endif
#if defined(MBEDTLS_MD4_C)
case PSA_ALG_MD4:
ret = mbedtls_md4_finish_ret( &operation->ctx.md4, hash );
break;
#endif
#if defined(MBEDTLS_MD5_C)
case PSA_ALG_MD5:
ret = mbedtls_md5_finish_ret( &operation->ctx.md5, hash );
break;
#endif
#if defined(MBEDTLS_RIPEMD160_C)
case PSA_ALG_RIPEMD160:
ret = mbedtls_ripemd160_finish_ret( &operation->ctx.ripemd160, hash );
break;
#endif
#if defined(MBEDTLS_SHA1_C)
case PSA_ALG_SHA_1:
ret = mbedtls_sha1_finish_ret( &operation->ctx.sha1, hash );
break;
#endif
#if defined(MBEDTLS_SHA256_C)
case PSA_ALG_SHA_224:
case PSA_ALG_SHA_256:
ret = mbedtls_sha256_finish_ret( &operation->ctx.sha256, hash );
break;
#endif
#if defined(MBEDTLS_SHA512_C)
case PSA_ALG_SHA_384:
case PSA_ALG_SHA_512:
ret = mbedtls_sha512_finish_ret( &operation->ctx.sha512, hash );
break;
#endif
default:
ret = MBEDTLS_ERR_MD_BAD_INPUT_DATA;
break;
}
Add missing calls to psa_hash_abort in hash functions
2018-08-02 12:14:17 +02:00
status = mbedtls_to_psa_error( ret );
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 21:05:37 +01:00
Add missing calls to psa_hash_abort in hash functions
2018-08-02 12:14:17 +02:00
exit:
if( status == PSA_SUCCESS )
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 21:05:37 +01:00
{
Fix safe output length in hash and mac finish In psa_hash_finish and psa_mac_finish_internal, set the fallback output length (which is reported on error) to the output buffer size, not to the _expected_ buffer size which could be larger.
2018-07-02 12:15:28 +02:00
*hash_length = actual_hash_length;
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 21:05:37 +01:00
return( psa_hash_abort( operation ) );
}
else
{
psa_hash_abort( operation );
Add missing calls to psa_hash_abort in hash functions
2018-08-02 12:14:17 +02:00
return( status );
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 21:05:37 +01:00
}
}
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 15:41:12 +02:00
psa_status_t psa_hash_verify( psa_hash_operation_t *operation,
const uint8_t *hash,
size_t hash_length )
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 21:05:37 +01:00
{
uint8_t actual_hash[MBEDTLS_MD_MAX_SIZE];
size_t actual_hash_length;
psa_status_t status = psa_hash_finish( operation,
actual_hash, sizeof( actual_hash ),
&actual_hash_length );
if( status != PSA_SUCCESS )
return( status );
if( actual_hash_length != hash_length )
return( PSA_ERROR_INVALID_SIGNATURE );
if( safer_memcmp( hash, actual_hash, actual_hash_length ) != 0 )
return( PSA_ERROR_INVALID_SIGNATURE );
return( PSA_SUCCESS );
}
/****************************************************************/
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
/* MAC */
/****************************************************************/
Rename xxx_of_psa functions to xxx_from_psa Be consistent with how similar functions are named in Mbed TLS.
2018-03-07 16:42:59 +01:00
static const mbedtls_cipher_info_t *mbedtls_cipher_info_from_psa(
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
psa_algorithm_t alg,
psa_key_type_t key_type,
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 15:41:12 +02:00
size_t key_bits,
change mbedtls_cipher_info_from_psa to provide cipher_id also
2018-06-03 14:04:51 +02:00
mbedtls_cipher_id_t* cipher_id )
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
{
mbedtls_cipher_mode_t mode;
change mbedtls_cipher_info_from_psa to provide cipher_id also
2018-06-03 14:04:51 +02:00
mbedtls_cipher_id_t cipher_id_tmp;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
Add support for non-default-tag-size AEAD (CCM and GCM)
2018-08-17 19:47:52 +02:00
if( PSA_ALG_IS_AEAD( alg ) )
Use a public macro for AEAD tag length variations Avoid depending on the encoding of algorithms inside psa_crypto.c.
2018-10-17 18:29:17 +02:00
alg = PSA_ALG_AEAD_WITH_TAG_LENGTH( alg, 0 );
Add support for non-default-tag-size AEAD (CCM and GCM)
2018-08-17 19:47:52 +02:00
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
if( PSA_ALG_IS_CIPHER( alg ) || PSA_ALG_IS_AEAD( alg ) )
{
space and style fixes
2018-06-17 13:41:30 +02:00
switch( alg )
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
{
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 14:02:45 +02:00
case PSA_ALG_ARC4:
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
mode = MBEDTLS_MODE_STREAM;
break;
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 14:02:45 +02:00
case PSA_ALG_CTR:
mode = MBEDTLS_MODE_CTR;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
break;
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 14:02:45 +02:00
case PSA_ALG_CFB:
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
mode = MBEDTLS_MODE_CFB;
break;
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 14:02:45 +02:00
case PSA_ALG_OFB:
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
mode = MBEDTLS_MODE_OFB;
break;
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 14:02:45 +02:00
case PSA_ALG_CBC_NO_PADDING:
mode = MBEDTLS_MODE_CBC;
break;
case PSA_ALG_CBC_PKCS7:
mode = MBEDTLS_MODE_CBC;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
break;
Use a public macro for AEAD tag length variations Avoid depending on the encoding of algorithms inside psa_crypto.c.
2018-10-17 18:29:17 +02:00
case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_CCM, 0 ):
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
mode = MBEDTLS_MODE_CCM;
break;
Use a public macro for AEAD tag length variations Avoid depending on the encoding of algorithms inside psa_crypto.c.
2018-10-17 18:29:17 +02:00
case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_GCM, 0 ):
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
mode = MBEDTLS_MODE_GCM;
break;
default:
return( NULL );
}
}
else if( alg == PSA_ALG_CMAC )
mode = MBEDTLS_MODE_ECB;
else if( alg == PSA_ALG_GMAC )
mode = MBEDTLS_MODE_GCM;
else
return( NULL );
switch( key_type )
{
case PSA_KEY_TYPE_AES:
change mbedtls_cipher_info_from_psa to provide cipher_id also
2018-06-03 14:04:51 +02:00
cipher_id_tmp = MBEDTLS_CIPHER_ID_AES;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
break;
case PSA_KEY_TYPE_DES:
Add what little was missing to fully support DES Also add what was missing in the test suite to support block ciphers with a block size that isn't 16. Fix some buggy test data that passed only due to problems with DES support in the product.
2018-06-21 09:40:04 +02:00
/* key_bits is 64 for Single-DES, 128 for two-key Triple-DES,
* and 192 for three-key Triple-DES. */
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
if( key_bits == 64 )
change mbedtls_cipher_info_from_psa to provide cipher_id also
2018-06-03 14:04:51 +02:00
cipher_id_tmp = MBEDTLS_CIPHER_ID_DES;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
else
change mbedtls_cipher_info_from_psa to provide cipher_id also
2018-06-03 14:04:51 +02:00
cipher_id_tmp = MBEDTLS_CIPHER_ID_3DES;
Add what little was missing to fully support DES Also add what was missing in the test suite to support block ciphers with a block size that isn't 16. Fix some buggy test data that passed only due to problems with DES support in the product.
2018-06-21 09:40:04 +02:00
/* mbedtls doesn't recognize two-key Triple-DES as an algorithm,
* but two-key Triple-DES is functionally three-key Triple-DES
* with K1=K3, so that's how we present it to mbedtls. */
if( key_bits == 128 )
key_bits = 192;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
break;
case PSA_KEY_TYPE_CAMELLIA:
change mbedtls_cipher_info_from_psa to provide cipher_id also
2018-06-03 14:04:51 +02:00
cipher_id_tmp = MBEDTLS_CIPHER_ID_CAMELLIA;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
break;
case PSA_KEY_TYPE_ARC4:
change mbedtls_cipher_info_from_psa to provide cipher_id also
2018-06-03 14:04:51 +02:00
cipher_id_tmp = MBEDTLS_CIPHER_ID_ARC4;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
break;
default:
return( NULL );
}
change mbedtls_cipher_info_from_psa to provide cipher_id also
2018-06-03 14:04:51 +02:00
if( cipher_id != NULL )
remove unnecessary argument to the psa_aead_unpadded_locate_tag function
2018-06-03 16:20:42 +02:00
*cipher_id = cipher_id_tmp;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
psa: Pass the number of bits with explicit types The GCM, CCM, RSA, and cipher modules inconsistently use int or unsigned int for a count of bits. The PSA Crypto API uses size_t for counting things. This causes issues on LLP64 systems where a size_t can hold more than an unsigned int. Add casts for where key_bits and bits are passed to mbedtls_* APIs.
2018-06-26 15:16:54 +02:00
return( mbedtls_cipher_info_from_values( cipher_id_tmp,
(int) key_bits, mode ) );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
}
Add some missing compilation guards Add missing checks for defined(MBEDTLS_MD_C) around types and functions that require it (HMAC, HKDF, TLS12_PRF). Add missing checks for defined(MBEDTLS_ECDSA_DETERMINISTIC) around code that calls mbedtls_ecdsa_sign_det(). Add missing checks for defined(MBEDTLS_ECDH_C) around ECDH-specific functions.
2018-11-16 16:02:56 +01:00
#if defined(MBEDTLS_MD_C)
fix spaces and add braces
2018-06-18 11:24:33 +02:00
static size_t psa_get_hash_block_size( psa_algorithm_t alg )
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 13:41:10 +02:00
{
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 15:41:12 +02:00
switch( alg )
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 13:41:10 +02:00
{
case PSA_ALG_MD2:
fix spaces and add braces
2018-06-18 11:24:33 +02:00
return( 16 );
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 13:41:10 +02:00
case PSA_ALG_MD4:
fix spaces and add braces
2018-06-18 11:24:33 +02:00
return( 64 );
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 13:41:10 +02:00
case PSA_ALG_MD5:
fix spaces and add braces
2018-06-18 11:24:33 +02:00
return( 64 );
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 13:41:10 +02:00
case PSA_ALG_RIPEMD160:
fix spaces and add braces
2018-06-18 11:24:33 +02:00
return( 64 );
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 13:41:10 +02:00
case PSA_ALG_SHA_1:
fix spaces and add braces
2018-06-18 11:24:33 +02:00
return( 64 );
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 13:41:10 +02:00
case PSA_ALG_SHA_224:
fix spaces and add braces
2018-06-18 11:24:33 +02:00
return( 64 );
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 13:41:10 +02:00
case PSA_ALG_SHA_256:
fix spaces and add braces
2018-06-18 11:24:33 +02:00
return( 64 );
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 13:41:10 +02:00
case PSA_ALG_SHA_384:
fix spaces and add braces
2018-06-18 11:24:33 +02:00
return( 128 );
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 13:41:10 +02:00
case PSA_ALG_SHA_512:
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 15:41:12 +02:00
return( 128 );
default:
return( 0 );
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 13:41:10 +02:00
}
}
Add some missing compilation guards Add missing checks for defined(MBEDTLS_MD_C) around types and functions that require it (HMAC, HKDF, TLS12_PRF). Add missing checks for defined(MBEDTLS_ECDSA_DETERMINISTIC) around code that calls mbedtls_ecdsa_sign_det(). Add missing checks for defined(MBEDTLS_ECDH_C) around ECDH-specific functions.
2018-11-16 16:02:56 +01:00
#endif /* MBEDTLS_MD_C */
remove reliance on md_info context for hash information 1. remove reliance on md_info context for hash information by decoding locally 2. remove block_size field in context as this is dynamically computed
2018-06-07 12:27:47 +02:00
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 16:05:20 +02:00
/* Initialize the MAC operation structure. Once this function has been
* called, psa_mac_abort can run and will do the right thing. */
static psa_status_t psa_mac_init( psa_mac_operation_t *operation,
psa_algorithm_t alg )
{
psa_status_t status = PSA_ERROR_NOT_SUPPORTED;
operation->alg = alg;
operation->key_set = 0;
operation->iv_set = 0;
operation->iv_required = 0;
operation->has_input = 0;
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 20:12:23 +02:00
operation->is_sign = 0;
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 16:05:20 +02:00
#if defined(MBEDTLS_CMAC_C)
if( alg == PSA_ALG_CMAC )
{
operation->iv_required = 0;
mbedtls_cipher_init( &operation->ctx.cmac );
status = PSA_SUCCESS;
}
else
#endif /* MBEDTLS_CMAC_C */
#if defined(MBEDTLS_MD_C)
if( PSA_ALG_IS_HMAC( operation->alg ) )
{
Make psa_hmac_setup_internal more standalone Call psa_hash_setup in psa_hmac_setup_internal rather than psa_mac_init. This makes it easier to use psa_hmac_setup_internal on its own (for the sake of using HMAC internally inside the library).
2018-07-12 17:07:52 +02:00
/* We'll set up the hash operation later in psa_hmac_setup_internal. */
operation->ctx.hmac.hash_ctx.alg = 0;
status = PSA_SUCCESS;
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 16:05:20 +02:00
}
else
#endif /* MBEDTLS_MD_C */
{
Favor INVALID_ARGUMENT over NOT_SUPPORTED for bad algorithm types In psa_hash_start, psa_mac_start and psa_cipher_setup, return PSA_ERROR_INVALID_ARGUMENT rather than PSA_ERROR_NOT_SUPPORTED when the algorithm parameter is not the right category.
2018-06-20 16:21:04 +02:00
if( ! PSA_ALG_IS_MAC( alg ) )
status = PSA_ERROR_INVALID_ARGUMENT;
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 16:05:20 +02:00
}
if( status != PSA_SUCCESS )
memset( operation, 0, sizeof( *operation ) );
return( status );
}
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 17:04:55 +02:00
#if defined(MBEDTLS_MD_C)
static psa_status_t psa_hmac_abort_internal( psa_hmac_internal_data *hmac )
{
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 18:14:53 +01:00
mbedtls_platform_zeroize( hmac->opad, sizeof( hmac->opad ) );
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 17:04:55 +02:00
return( psa_hash_abort( &hmac->hash_ctx ) );
}
Add implementation of TLS-1.2 PRF
2018-10-09 18:33:01 +02:00
static void psa_hmac_init_internal( psa_hmac_internal_data *hmac )
{
/* Instances of psa_hash_operation_s can be initialized by zeroization. */
memset( hmac, 0, sizeof( *hmac ) );
}
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 17:04:55 +02:00
#endif /* MBEDTLS_MD_C */
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
psa_status_t psa_mac_abort( psa_mac_operation_t *operation )
{
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
if( operation->alg == 0 )
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
{
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
/* The object has (apparently) been initialized but it is not
* in use. It's ok to call abort on such an object, and there's
* nothing to do. */
return( PSA_SUCCESS );
}
else
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
#if defined(MBEDTLS_CMAC_C)
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
if( operation->alg == PSA_ALG_CMAC )
{
mbedtls_cipher_free( &operation->ctx.cmac );
}
else
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
#endif /* MBEDTLS_CMAC_C */
#if defined(MBEDTLS_MD_C)
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
if( PSA_ALG_IS_HMAC( operation->alg ) )
{
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 17:04:55 +02:00
psa_hmac_abort_internal( &operation->ctx.hmac );
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
}
else
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
#endif /* MBEDTLS_MD_C */
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
{
/* Sanity check (shouldn't happen: operation->alg should
* always have been initialized to a valid value). */
goto bad_state;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
}
partly pr fix
2018-04-04 14:43:05 +02:00
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
operation->alg = 0;
operation->key_set = 0;
operation->iv_set = 0;
operation->iv_required = 0;
operation->has_input = 0;
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 20:12:23 +02:00
operation->is_sign = 0;
partly pr fix
2018-04-04 14:43:05 +02:00
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
return( PSA_SUCCESS );
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
bad_state:
/* If abort is called on an uninitialized object, we can't trust
* anything. Wipe the object in case it contains confidential data.
* This may result in a memory leak if a pointer gets overwritten,
* but it's too late to do anything about this. */
memset( operation, 0, sizeof( *operation ) );
return( PSA_ERROR_BAD_STATE );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
}
Fix build without CMAC Add missing guard for MBEDTLS_CMAC_C.
2018-06-19 11:57:35 +02:00
#if defined(MBEDTLS_CMAC_C)
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 20:12:23 +02:00
static int psa_cmac_setup( psa_mac_operation_t *operation,
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 17:26:17 +02:00
size_t key_bits,
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *slot,
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 17:26:17 +02:00
const mbedtls_cipher_info_t *cipher_info )
{
int ret;
operation->mac_size = cipher_info->block_size;
ret = mbedtls_cipher_setup( &operation->ctx.cmac, cipher_info );
if( ret != 0 )
return( ret );
ret = mbedtls_cipher_cmac_starts( &operation->ctx.cmac,
slot->data.raw.data,
key_bits );
return( ret );
}
Fix build without CMAC Add missing guard for MBEDTLS_CMAC_C.
2018-06-19 11:57:35 +02:00
#endif /* MBEDTLS_CMAC_C */
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 17:26:17 +02:00
Add missing #ifdef guards around psa_hmac_start
2018-06-20 16:09:38 +02:00
#if defined(MBEDTLS_MD_C)
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 17:04:55 +02:00
static psa_status_t psa_hmac_setup_internal( psa_hmac_internal_data *hmac,
const uint8_t *key,
size_t key_length,
psa_algorithm_t hash_alg )
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 17:26:17 +02:00
{
Rename hash max sizes for consistency Use "hash" throughout the library, not "md" as in Mbed TLS.
2018-06-18 22:16:43 +02:00
unsigned char ipad[PSA_HMAC_MAX_HASH_BLOCK_SIZE];
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 17:26:17 +02:00
size_t i;
HMAC: improve robustness checks on hash/block size In psa_mac_setup and psa_hmac_setup_internal, perform a sanity check on the hash size and the hash block size respectively. These sanity checks should only trigger on an incompletely or incorrectly implemented hash function. Remove the check on the block size in psa_hmac_finish_internal because at this point it has already been checked and used.
2018-07-16 00:36:29 +02:00
size_t hash_size = PSA_HASH_SIZE( hash_alg );
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 17:04:55 +02:00
size_t block_size = psa_get_hash_block_size( hash_alg );
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 17:26:17 +02:00
psa_status_t status;
HMAC: improve robustness checks on hash/block size In psa_mac_setup and psa_hmac_setup_internal, perform a sanity check on the hash size and the hash block size respectively. These sanity checks should only trigger on an incompletely or incorrectly implemented hash function. Remove the check on the block size in psa_hmac_finish_internal because at this point it has already been checked and used.
2018-07-16 00:36:29 +02:00
/* Sanity checks on block_size, to guarantee that there won't be a buffer
* overflow below. This should never trigger if the hash algorithm
* is implemented correctly. */
/* The size checks against the ipad and opad buffers cannot be written
* `block_size > sizeof( ipad ) || block_size > sizeof( hmac->opad )`
* because that triggers -Wlogical-op on GCC 7.3. */
if( block_size > sizeof( ipad ) )
return( PSA_ERROR_NOT_SUPPORTED );
if( block_size > sizeof( hmac->opad ) )
return( PSA_ERROR_NOT_SUPPORTED );
if( block_size < hash_size )
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 17:26:17 +02:00
return( PSA_ERROR_NOT_SUPPORTED );
psa_hmac_start: reduce stack usage Store the temporary key in the long-key case (where the key is first hashed) directly into ipad. This reduces the stack usage a little, at a slight cost in complexity.
2018-06-11 18:12:58 +02:00
if( key_length > block_size )
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 17:26:17 +02:00
{
psa_hmac_setup_internal: fix double call of psa_hash_setup In the common case (key no longer than the block size), psa_hash_setup was being called twice in succession. With current implementations this is just a small performance loss, but potentially with alternative implementations this could have lead to a memory leak.
2018-07-17 16:22:47 +02:00
status = psa_hash_setup( &hmac->hash_ctx, hash_alg );
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 17:26:17 +02:00
if( status != PSA_SUCCESS )
psa_hmac_setup_internal: fix double call of psa_hash_setup In the common case (key no longer than the block size), psa_hash_setup was being called twice in succession. With current implementations this is just a small performance loss, but potentially with alternative implementations this could have lead to a memory leak.
2018-07-17 16:22:47 +02:00
goto cleanup;
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 17:04:55 +02:00
status = psa_hash_update( &hmac->hash_ctx, key, key_length );
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 17:26:17 +02:00
if( status != PSA_SUCCESS )
psa_hmac_setup_internal: add some missing cleanup on failure Clean ipad if hashing the key failed.
2018-07-17 16:24:34 +02:00
goto cleanup;
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 17:04:55 +02:00
status = psa_hash_finish( &hmac->hash_ctx,
psa_hmac_start: reduce stack usage Store the temporary key in the long-key case (where the key is first hashed) directly into ipad. This reduces the stack usage a little, at a slight cost in complexity.
2018-06-11 18:12:58 +02:00
ipad, sizeof( ipad ), &key_length );
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 17:26:17 +02:00
if( status != PSA_SUCCESS )
psa_hmac_setup_internal: add some missing cleanup on failure Clean ipad if hashing the key failed.
2018-07-17 16:24:34 +02:00
goto cleanup;
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 17:26:17 +02:00
}
MAC setup: support 0-length HMAC key Avoid undefined behavior when using a 0-length HMAC key (Asan complained).
2018-07-12 17:07:03 +02:00
/* A 0-length key is not commonly used in HMAC when used as a MAC,
* but it is permitted. It is common when HMAC is used in HKDF, for
* example. Don't call `memcpy` in the 0-length because `key` could be
* an invalid pointer which would make the behavior undefined. */
else if( key_length != 0 )
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 17:04:55 +02:00
memcpy( ipad, key, key_length );
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 17:26:17 +02:00
psa_hmac_start: reduce stack usage Store the temporary key in the long-key case (where the key is first hashed) directly into ipad. This reduces the stack usage a little, at a slight cost in complexity.
2018-06-11 18:12:58 +02:00
/* ipad contains the key followed by garbage. Xor and fill with 0x36
* to create the ipad value. */
for( i = 0; i < key_length; i++ )
ipad[i] ^= 0x36;
memset( ipad + key_length, 0x36, block_size - key_length );
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 17:26:17 +02:00
psa_hmac_start: reduce stack usage Store the temporary key in the long-key case (where the key is first hashed) directly into ipad. This reduces the stack usage a little, at a slight cost in complexity.
2018-06-11 18:12:58 +02:00
/* Copy the key material from ipad to opad, flipping the requisite bits,
* and filling the rest of opad with the requisite constant. */
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 17:26:17 +02:00
for( i = 0; i < key_length; i++ )
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 17:04:55 +02:00
hmac->opad[i] = ipad[i] ^ 0x36 ^ 0x5C;
memset( hmac->opad + key_length, 0x5C, block_size - key_length );
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 17:26:17 +02:00
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 17:04:55 +02:00
status = psa_hash_setup( &hmac->hash_ctx, hash_alg );
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 17:26:17 +02:00
if( status != PSA_SUCCESS )
HMAC: clean up local variables containing key material In psa_mac_start, the hash of the key and ipad contain material that can be used to make HMAC calculations with the key, therefore they must be wiped. In psa_mac_finish_internal, tmp contains an intermediate value which could reveal the HMAC. This is definitely sensitive in the verify case, and marginally sensitive in the finish case (it isn't if the hash function is ideal, but it could make things worse if the hash function is partially broken).
2018-06-11 17:42:48 +02:00
goto cleanup;
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 17:26:17 +02:00
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 17:04:55 +02:00
status = psa_hash_update( &hmac->hash_ctx, ipad, block_size );
HMAC: clean up local variables containing key material In psa_mac_start, the hash of the key and ipad contain material that can be used to make HMAC calculations with the key, therefore they must be wiped. In psa_mac_finish_internal, tmp contains an intermediate value which could reveal the HMAC. This is definitely sensitive in the verify case, and marginally sensitive in the finish case (it isn't if the hash function is ideal, but it could make things worse if the hash function is partially broken).
2018-06-11 17:42:48 +02:00
cleanup:
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 18:14:53 +01:00
mbedtls_platform_zeroize( ipad, key_length );
HMAC: clean up local variables containing key material In psa_mac_start, the hash of the key and ipad contain material that can be used to make HMAC calculations with the key, therefore they must be wiped. In psa_mac_finish_internal, tmp contains an intermediate value which could reveal the HMAC. This is definitely sensitive in the verify case, and marginally sensitive in the finish case (it isn't if the hash function is ideal, but it could make things worse if the hash function is partially broken).
2018-06-11 17:42:48 +02:00
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 17:26:17 +02:00
return( status );
}
Add missing #ifdef guards around psa_hmac_start
2018-06-20 16:09:38 +02:00
#endif /* MBEDTLS_MD_C */
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 17:26:17 +02:00
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 20:12:23 +02:00
static psa_status_t psa_mac_setup( psa_mac_operation_t *operation,
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
psa_key_handle_t handle,
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 20:12:23 +02:00
psa_algorithm_t alg,
int is_sign )
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
{
psa_status_t status;
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *slot;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
size_t key_bits;
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 20:12:23 +02:00
psa_key_usage_t usage =
is_sign ? PSA_KEY_USAGE_SIGN : PSA_KEY_USAGE_VERIFY;
Add support for truncated MAC algorithms
2018-08-14 15:18:45 +02:00
unsigned char truncated = PSA_MAC_TRUNCATED_LENGTH( alg );
New macro PSA_ALG_FULL_LENGTH_MAC Provide a documented way of constructing the full-length MAC algorithm from a truncated version.
2018-10-17 18:28:05 +02:00
psa_algorithm_t full_length_alg = PSA_ALG_FULL_LENGTH_MAC( alg );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
Add support for truncated MAC algorithms
2018-08-14 15:18:45 +02:00
status = psa_mac_init( operation, full_length_alg );
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 16:05:20 +02:00
if( status != PSA_SUCCESS )
return( status );
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 20:12:23 +02:00
if( is_sign )
operation->is_sign = 1;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
status = psa_get_key_from_slot( handle, &slot, usage, alg );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
if( status != PSA_SUCCESS )
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
goto exit;
Don't call psa_get_key_information internally When you have a key slot pointer, read the key type directly, and call psa_get_key_bits to get the bit size.
2018-07-06 16:07:47 +02:00
key_bits = psa_get_key_bits( slot );
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
#if defined(MBEDTLS_CMAC_C)
Add support for truncated MAC algorithms
2018-08-14 15:18:45 +02:00
if( full_length_alg == PSA_ALG_CMAC )
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
{
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
const mbedtls_cipher_info_t *cipher_info =
Add support for truncated MAC algorithms
2018-08-14 15:18:45 +02:00
mbedtls_cipher_info_from_psa( full_length_alg,
slot->type, key_bits, NULL );
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
int ret;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
if( cipher_info == NULL )
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
{
status = PSA_ERROR_NOT_SUPPORTED;
goto exit;
}
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
operation->mac_size = cipher_info->block_size;
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
ret = psa_cmac_setup( operation, key_bits, slot, cipher_info );
status = mbedtls_to_psa_error( ret );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
}
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
else
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
#endif /* MBEDTLS_CMAC_C */
#if defined(MBEDTLS_MD_C)
Add support for truncated MAC algorithms
2018-08-14 15:18:45 +02:00
if( PSA_ALG_IS_HMAC( full_length_alg ) )
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
{
Rename PSA_ALG_HMAC_HASH to PSA_ALG_HMAC_GET_HASH Be consistent with other GET_HASH macros.
2018-08-22 18:25:41 +02:00
psa_algorithm_t hash_alg = PSA_ALG_HMAC_GET_HASH( alg );
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 17:04:55 +02:00
if( hash_alg == 0 )
{
status = PSA_ERROR_NOT_SUPPORTED;
goto exit;
}
HMAC: improve robustness checks on hash/block size In psa_mac_setup and psa_hmac_setup_internal, perform a sanity check on the hash size and the hash block size respectively. These sanity checks should only trigger on an incompletely or incorrectly implemented hash function. Remove the check on the block size in psa_hmac_finish_internal because at this point it has already been checked and used.
2018-07-16 00:36:29 +02:00
operation->mac_size = PSA_HASH_SIZE( hash_alg );
/* Sanity check. This shouldn't fail on a valid configuration. */
if( operation->mac_size == 0 ||
operation->mac_size > sizeof( operation->ctx.hmac.opad ) )
{
status = PSA_ERROR_NOT_SUPPORTED;
goto exit;
}
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 17:04:55 +02:00
if( slot->type != PSA_KEY_TYPE_HMAC )
{
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
}
HMAC: improve robustness checks on hash/block size In psa_mac_setup and psa_hmac_setup_internal, perform a sanity check on the hash size and the hash block size respectively. These sanity checks should only trigger on an incompletely or incorrectly implemented hash function. Remove the check on the block size in psa_hmac_finish_internal because at this point it has already been checked and used.
2018-07-16 00:36:29 +02:00
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 17:04:55 +02:00
status = psa_hmac_setup_internal( &operation->ctx.hmac,
slot->data.raw.data,
slot->data.raw.bytes,
hash_alg );
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
}
else
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
#endif /* MBEDTLS_MD_C */
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
{
psa: Unused key_bits is OK When MD or CMAC are disabled, let the compiler know that it is OK that `key_bits` is set but not used by casting `key_bits` to `(void)`.
2018-11-23 16:11:20 +01:00
(void) key_bits;
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
status = PSA_ERROR_NOT_SUPPORTED;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
}
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 17:26:17 +02:00
Add support for truncated MAC algorithms
2018-08-14 15:18:45 +02:00
if( truncated == 0 )
{
/* The "normal" case: untruncated algorithm. Nothing to do. */
}
else if( truncated < 4 )
{
Document that the minimum truncated MAC length is implementation-defined
2018-08-21 14:55:08 +02:00
/* A very short MAC is too short for security since it can be
* brute-forced. Ancient protocols with 32-bit MACs do exist,
* so we make this our minimum, even though 32 bits is still
* too small for security. */
Add support for truncated MAC algorithms
2018-08-14 15:18:45 +02:00
status = PSA_ERROR_NOT_SUPPORTED;
}
else if( truncated > operation->mac_size )
{
/* It's impossible to "truncate" to a larger length. */
status = PSA_ERROR_INVALID_ARGUMENT;
}
else
operation->mac_size = truncated;
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
exit:
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 17:26:17 +02:00
if( status != PSA_SUCCESS )
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
{
HMAC: clean up local variables containing key material In psa_mac_start, the hash of the key and ipad contain material that can be used to make HMAC calculations with the key, therefore they must be wiped. In psa_mac_finish_internal, tmp contains an intermediate value which could reveal the HMAC. This is definitely sensitive in the verify case, and marginally sensitive in the finish case (it isn't if the hash function is ideal, but it could make things worse if the hash function is partially broken).
2018-06-11 17:42:48 +02:00
psa_mac_abort( operation );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
}
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 17:26:17 +02:00
else
{
operation->key_set = 1;
}
return( status );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
}
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 20:12:23 +02:00
psa_status_t psa_mac_sign_setup( psa_mac_operation_t *operation,
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
psa_key_handle_t handle,
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 20:12:23 +02:00
psa_algorithm_t alg )
{
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
return( psa_mac_setup( operation, handle, alg, 1 ) );
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 20:12:23 +02:00
}
psa_status_t psa_mac_verify_setup( psa_mac_operation_t *operation,
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
psa_key_handle_t handle,
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 20:12:23 +02:00
psa_algorithm_t alg )
{
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
return( psa_mac_setup( operation, handle, alg, 0 ) );
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 20:12:23 +02:00
}
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
psa_status_t psa_mac_update( psa_mac_operation_t *operation,
const uint8_t *input,
size_t input_length )
{
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
psa_status_t status = PSA_ERROR_BAD_STATE;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
if( ! operation->key_set )
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
goto cleanup;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
if( operation->iv_required && ! operation->iv_set )
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
goto cleanup;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
operation->has_input = 1;
#if defined(MBEDTLS_CMAC_C)
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
if( operation->alg == PSA_ALG_CMAC )
{
int ret = mbedtls_cipher_cmac_update( &operation->ctx.cmac,
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
input, input_length );
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
status = mbedtls_to_psa_error( ret );
}
else
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
#endif /* MBEDTLS_CMAC_C */
#if defined(MBEDTLS_MD_C)
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
if( PSA_ALG_IS_HMAC( operation->alg ) )
{
status = psa_hash_update( &operation->ctx.hmac.hash_ctx, input,
input_length );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
}
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
else
#endif /* MBEDTLS_MD_C */
Commit changes to hmac to not use MD abstraction this PR is part of efforts to use "lower level" mbedTLS APIs vs "higher level" abstract APIs.
2018-06-04 15:03:32 +02:00
{
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
/* This shouldn't happen if `operation` was initialized by
* a setup function. */
status = PSA_ERROR_BAD_STATE;
Commit changes to hmac to not use MD abstraction this PR is part of efforts to use "lower level" mbedTLS APIs vs "higher level" abstract APIs.
2018-06-04 15:03:32 +02:00
}
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
cleanup:
if( status != PSA_SUCCESS )
psa_mac_abort( operation );
Formatting improvements Avoid lines longer than 80 columns. Remove some redundant parentheses, e.g. change if( ( a == b ) && ( c == d ) ) to if( a == b && c == d ) which makes lines less long and makes the remaining parentheses more relevant. Add missing parentheses around return statements. There should be no semantic change in this commit.
2018-06-18 16:04:39 +02:00
return( status );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
}
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 17:04:55 +02:00
#if defined(MBEDTLS_MD_C)
static psa_status_t psa_hmac_finish_internal( psa_hmac_internal_data *hmac,
uint8_t *mac,
size_t mac_size )
{
unsigned char tmp[MBEDTLS_MD_MAX_SIZE];
psa_algorithm_t hash_alg = hmac->hash_ctx.alg;
size_t hash_size = 0;
size_t block_size = psa_get_hash_block_size( hash_alg );
psa_status_t status;
status = psa_hash_finish( &hmac->hash_ctx, tmp, sizeof( tmp ), &hash_size );
if( status != PSA_SUCCESS )
return( status );
/* From here on, tmp needs to be wiped. */
status = psa_hash_setup( &hmac->hash_ctx, hash_alg );
if( status != PSA_SUCCESS )
goto exit;
status = psa_hash_update( &hmac->hash_ctx, hmac->opad, block_size );
if( status != PSA_SUCCESS )
goto exit;
status = psa_hash_update( &hmac->hash_ctx, tmp, hash_size );
if( status != PSA_SUCCESS )
goto exit;
Add support for truncated MAC algorithms
2018-08-14 15:18:45 +02:00
status = psa_hash_finish( &hmac->hash_ctx, tmp, sizeof( tmp ), &hash_size );
if( status != PSA_SUCCESS )
goto exit;
memcpy( mac, tmp, mac_size );
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 17:04:55 +02:00
exit:
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 18:14:53 +01:00
mbedtls_platform_zeroize( tmp, hash_size );
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 17:04:55 +02:00
return( status );
}
#endif /* MBEDTLS_MD_C */
Add static internal MAC finish function add new psa_mac_finish_internal() to be called by psa_mac_finish() and psa_mac_verify() in order to be able to check key usage separatly.
2018-04-02 17:34:15 +02:00
static psa_status_t psa_mac_finish_internal( psa_mac_operation_t *operation,
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 15:41:12 +02:00
uint8_t *mac,
Streamline cleanup logic in MAC finish Reorganize error handling code in psa_mac_finish_internal, psa_mac_sign_finish and psa_mac_verify finish to ensure that: * psa_mac_abort() is always called, on all success and error paths. * psa_mac_finish places a safe value in the output parameters on all error paths, even if abort fails.
2018-07-08 20:35:02 +02:00
size_t mac_size )
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
{
In psa_mac_finish, write a safe output even in the BAD_STATE case
2018-07-02 12:15:39 +02:00
if( ! operation->key_set )
return( PSA_ERROR_BAD_STATE );
if( operation->iv_required && ! operation->iv_set )
return( PSA_ERROR_BAD_STATE );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
if( mac_size < operation->mac_size )
return( PSA_ERROR_BUFFER_TOO_SMALL );
#if defined(MBEDTLS_CMAC_C)
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
if( operation->alg == PSA_ALG_CMAC )
{
Add support for truncated MAC algorithms
2018-08-14 15:18:45 +02:00
uint8_t tmp[PSA_MAX_BLOCK_CIPHER_BLOCK_SIZE];
int ret = mbedtls_cipher_cmac_finish( &operation->ctx.cmac, tmp );
if( ret == 0 )
Fix possible buffer overread in psa_mac_finish_internal (CMAC)
2018-08-21 14:55:49 +02:00
memcpy( mac, tmp, operation->mac_size );
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 18:14:53 +01:00
mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
return( mbedtls_to_psa_error( ret ) );
}
else
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
#endif /* MBEDTLS_CMAC_C */
#if defined(MBEDTLS_MD_C)
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
if( PSA_ALG_IS_HMAC( operation->alg ) )
{
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 17:04:55 +02:00
return( psa_hmac_finish_internal( &operation->ctx.hmac,
Add support for truncated MAC algorithms
2018-08-14 15:18:45 +02:00
mac, operation->mac_size ) );
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
}
else
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
#endif /* MBEDTLS_MD_C */
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 20:51:54 +02:00
{
/* This shouldn't happen if `operation` was initialized by
* a setup function. */
return( PSA_ERROR_BAD_STATE );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
}
}
Rename psa_mac_{finish,verify} -> psa_mac_{sign,verify}_finish Make function names for multipart operations more consistent (MAC finish edition).
2018-07-08 19:56:25 +02:00
psa_status_t psa_mac_sign_finish( psa_mac_operation_t *operation,
uint8_t *mac,
size_t mac_size,
size_t *mac_length )
Add static internal MAC finish function add new psa_mac_finish_internal() to be called by psa_mac_finish() and psa_mac_verify() in order to be able to check key usage separatly.
2018-04-02 17:34:15 +02:00
{
Streamline cleanup logic in MAC finish Reorganize error handling code in psa_mac_finish_internal, psa_mac_sign_finish and psa_mac_verify finish to ensure that: * psa_mac_abort() is always called, on all success and error paths. * psa_mac_finish places a safe value in the output parameters on all error paths, even if abort fails.
2018-07-08 20:35:02 +02:00
psa_status_t status;
/* Fill the output buffer with something that isn't a valid mac
* (barring an attack on the mac and deliberately-crafted input),
* in case the caller doesn't check the return status properly. */
*mac_length = mac_size;
/* If mac_size is 0 then mac may be NULL and then the
* call to memset would have undefined behavior. */
if( mac_size != 0 )
memset( mac, '!', mac_size );
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 20:12:23 +02:00
if( ! operation->is_sign )
{
Streamline cleanup logic in MAC finish Reorganize error handling code in psa_mac_finish_internal, psa_mac_sign_finish and psa_mac_verify finish to ensure that: * psa_mac_abort() is always called, on all success and error paths. * psa_mac_finish places a safe value in the output parameters on all error paths, even if abort fails.
2018-07-08 20:35:02 +02:00
status = PSA_ERROR_BAD_STATE;
goto cleanup;
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 20:12:23 +02:00
}
Add static internal MAC finish function add new psa_mac_finish_internal() to be called by psa_mac_finish() and psa_mac_verify() in order to be able to check key usage separatly.
2018-04-02 17:34:15 +02:00
Streamline cleanup logic in MAC finish Reorganize error handling code in psa_mac_finish_internal, psa_mac_sign_finish and psa_mac_verify finish to ensure that: * psa_mac_abort() is always called, on all success and error paths. * psa_mac_finish places a safe value in the output parameters on all error paths, even if abort fails.
2018-07-08 20:35:02 +02:00
status = psa_mac_finish_internal( operation, mac, mac_size );
cleanup:
if( status == PSA_SUCCESS )
{
status = psa_mac_abort( operation );
if( status == PSA_SUCCESS )
*mac_length = operation->mac_size;
else
memset( mac, '!', mac_size );
}
else
psa_mac_abort( operation );
return( status );
Add static internal MAC finish function add new psa_mac_finish_internal() to be called by psa_mac_finish() and psa_mac_verify() in order to be able to check key usage separatly.
2018-04-02 17:34:15 +02:00
}
Rename psa_mac_{finish,verify} -> psa_mac_{sign,verify}_finish Make function names for multipart operations more consistent (MAC finish edition).
2018-07-08 19:56:25 +02:00
psa_status_t psa_mac_verify_finish( psa_mac_operation_t *operation,
const uint8_t *mac,
size_t mac_length )
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
{
Rename MBEDTLS_xxx macros in psa_crypto.c to placate check-names.sh
2018-06-18 23:25:51 +02:00
uint8_t actual_mac[PSA_MAC_MAX_SIZE];
Add static internal MAC finish function add new psa_mac_finish_internal() to be called by psa_mac_finish() and psa_mac_verify() in order to be able to check key usage separatly.
2018-04-02 17:34:15 +02:00
psa_status_t status;
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 20:12:23 +02:00
if( operation->is_sign )
{
Streamline cleanup logic in MAC finish Reorganize error handling code in psa_mac_finish_internal, psa_mac_sign_finish and psa_mac_verify finish to ensure that: * psa_mac_abort() is always called, on all success and error paths. * psa_mac_finish places a safe value in the output parameters on all error paths, even if abort fails.
2018-07-08 20:35:02 +02:00
status = PSA_ERROR_BAD_STATE;
goto cleanup;
}
if( operation->mac_size != mac_length )
{
status = PSA_ERROR_INVALID_SIGNATURE;
goto cleanup;
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 20:12:23 +02:00
}
Add static internal MAC finish function add new psa_mac_finish_internal() to be called by psa_mac_finish() and psa_mac_verify() in order to be able to check key usage separatly.
2018-04-02 17:34:15 +02:00
status = psa_mac_finish_internal( operation,
Streamline cleanup logic in MAC finish Reorganize error handling code in psa_mac_finish_internal, psa_mac_sign_finish and psa_mac_verify finish to ensure that: * psa_mac_abort() is always called, on all success and error paths. * psa_mac_finish places a safe value in the output parameters on all error paths, even if abort fails.
2018-07-08 20:35:02 +02:00
actual_mac, sizeof( actual_mac ) );
if( safer_memcmp( mac, actual_mac, mac_length ) != 0 )
status = PSA_ERROR_INVALID_SIGNATURE;
cleanup:
if( status == PSA_SUCCESS )
status = psa_mac_abort( operation );
else
psa_mac_abort( operation );
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 18:14:53 +01:00
mbedtls_platform_zeroize( actual_mac, sizeof( actual_mac ) );
Add support for truncated MAC algorithms
2018-08-14 15:18:45 +02:00
Streamline cleanup logic in MAC finish Reorganize error handling code in psa_mac_finish_internal, psa_mac_sign_finish and psa_mac_verify finish to ensure that: * psa_mac_abort() is always called, on all success and error paths. * psa_mac_finish places a safe value in the output parameters on all error paths, even if abort fails.
2018-07-08 20:35:02 +02:00
return( status );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 10:02:12 +01:00
}
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 22:44:14 +01:00
/****************************************************************/
/* Asymmetric cryptography */
/****************************************************************/
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 15:42:46 +02:00
#if defined(MBEDTLS_RSA_C)
Rename verify_RSA_hash_input_and_get_md_type Give it a shorter name that's more in line with our naming conventions.
2018-06-08 16:34:46 +02:00
/* Decode the hash algorithm from alg and store the mbedtls encoding in
Allow RSA PSS with any input size Although RSASSA-PSS defines its input as a message to be hashed, we implement a sign-the-hash function. This function can take an input which isn't a hash, so don't restrict the size of the input, any more than Mbed TLS does. Remove a redundant check that hash_length fits in unsigned int for the sake of Mbed TLS RSA functions. Test that PSS accepts inputs of various lengths. For PKCS#1 v1.5 signature in raw mode, test the maximum input length.
2018-06-29 23:36:35 +02:00
* md_alg. Verify that the hash length is acceptable. */
Rename verify_RSA_hash_input_and_get_md_type Give it a shorter name that's more in line with our naming conventions.
2018-06-08 16:34:46 +02:00
static psa_status_t psa_rsa_decode_md_type( psa_algorithm_t alg,
size_t hash_length,
mbedtls_md_type_t *md_alg )
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 22:44:14 +01:00
{
Rename PSA_ALG_RSA_GET_HASH to PSA_ALG_SIGN_GET_HASH And don't use it for HMAC when there's a perfectly serviceable PSA_ALG_HMAC_HASH. HMAC isn't hash-and-sign.
2018-06-26 15:50:08 +02:00
psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH( alg );
Normalize whitespace to Mbed TLS standards Only whitespace changes in this commit.
2018-06-08 16:09:36 +02:00
const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa( hash_alg );
Allow RSA PSS with any input size Although RSASSA-PSS defines its input as a message to be hashed, we implement a sign-the-hash function. This function can take an input which isn't a hash, so don't restrict the size of the input, any more than Mbed TLS does. Remove a redundant check that hash_length fits in unsigned int for the sake of Mbed TLS RSA functions. Test that PSS accepts inputs of various lengths. For PKCS#1 v1.5 signature in raw mode, test the maximum input length.
2018-06-29 23:36:35 +02:00
*md_alg = mbedtls_md_get_type( md_info );
/* The Mbed TLS RSA module uses an unsigned int for hash length
* parameters. Validate that it fits so that we don't risk an
* overflow later. */
Extract common code Make code easier to maintain.
2018-06-04 15:40:31 +02:00
#if SIZE_MAX > UINT_MAX
Allow RSA PSS with any input size Although RSASSA-PSS defines its input as a message to be hashed, we implement a sign-the-hash function. This function can take an input which isn't a hash, so don't restrict the size of the input, any more than Mbed TLS does. Remove a redundant check that hash_length fits in unsigned int for the sake of Mbed TLS RSA functions. Test that PSS accepts inputs of various lengths. For PKCS#1 v1.5 signature in raw mode, test the maximum input length.
2018-06-29 23:36:35 +02:00
if( hash_length > UINT_MAX )
return( PSA_ERROR_INVALID_ARGUMENT );
Extract common code Make code easier to maintain.
2018-06-04 15:40:31 +02:00
#endif
Allow RSA PSS with any input size Although RSASSA-PSS defines its input as a message to be hashed, we implement a sign-the-hash function. This function can take an input which isn't a hash, so don't restrict the size of the input, any more than Mbed TLS does. Remove a redundant check that hash_length fits in unsigned int for the sake of Mbed TLS RSA functions. Test that PSS accepts inputs of various lengths. For PKCS#1 v1.5 signature in raw mode, test the maximum input length.
2018-06-29 23:36:35 +02:00
#if defined(MBEDTLS_PKCS1_V15)
/* For PKCS#1 v1.5 signature, if using a hash, the hash length
* must be correct. */
if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) &&
alg != PSA_ALG_RSA_PKCS1V15_SIGN_RAW )
Extract common code Make code easier to maintain.
2018-06-04 15:40:31 +02:00
{
Allow RSA PSS with any input size Although RSASSA-PSS defines its input as a message to be hashed, we implement a sign-the-hash function. This function can take an input which isn't a hash, so don't restrict the size of the input, any more than Mbed TLS does. Remove a redundant check that hash_length fits in unsigned int for the sake of Mbed TLS RSA functions. Test that PSS accepts inputs of various lengths. For PKCS#1 v1.5 signature in raw mode, test the maximum input length.
2018-06-29 23:36:35 +02:00
if( md_info == NULL )
return( PSA_ERROR_NOT_SUPPORTED );
Normalize whitespace to Mbed TLS standards Only whitespace changes in this commit.
2018-06-08 16:09:36 +02:00
if( mbedtls_md_get_size( md_info ) != hash_length )
return( PSA_ERROR_INVALID_ARGUMENT );
Allow RSA PSS with any input size Although RSASSA-PSS defines its input as a message to be hashed, we implement a sign-the-hash function. This function can take an input which isn't a hash, so don't restrict the size of the input, any more than Mbed TLS does. Remove a redundant check that hash_length fits in unsigned int for the sake of Mbed TLS RSA functions. Test that PSS accepts inputs of various lengths. For PKCS#1 v1.5 signature in raw mode, test the maximum input length.
2018-06-29 23:36:35 +02:00
}
#endif /* MBEDTLS_PKCS1_V15 */
#if defined(MBEDTLS_PKCS1_V21)
/* PSS requires a hash internally. */
if( PSA_ALG_IS_RSA_PSS( alg ) )
{
Normalize whitespace to Mbed TLS standards Only whitespace changes in this commit.
2018-06-08 16:09:36 +02:00
if( md_info == NULL )
return( PSA_ERROR_NOT_SUPPORTED );
Extract common code Make code easier to maintain.
2018-06-04 15:40:31 +02:00
}
Allow RSA PSS with any input size Although RSASSA-PSS defines its input as a message to be hashed, we implement a sign-the-hash function. This function can take an input which isn't a hash, so don't restrict the size of the input, any more than Mbed TLS does. Remove a redundant check that hash_length fits in unsigned int for the sake of Mbed TLS RSA functions. Test that PSS accepts inputs of various lengths. For PKCS#1 v1.5 signature in raw mode, test the maximum input length.
2018-06-29 23:36:35 +02:00
#endif /* MBEDTLS_PKCS1_V21 */
Normalize whitespace to Mbed TLS standards Only whitespace changes in this commit.
2018-06-08 16:09:36 +02:00
return( PSA_SUCCESS );
Extract common code Make code easier to maintain.
2018-06-04 15:40:31 +02:00
}
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 22:44:14 +01:00
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 15:42:46 +02:00
static psa_status_t psa_rsa_sign( mbedtls_rsa_context *rsa,
psa_algorithm_t alg,
const uint8_t *hash,
size_t hash_length,
uint8_t *signature,
size_t signature_size,
size_t *signature_length )
{
psa_status_t status;
int ret;
mbedtls_md_type_t md_alg;
status = psa_rsa_decode_md_type( alg, hash_length, &md_alg );
if( status != PSA_SUCCESS )
return( status );
Don't break the rsa context abstraction This would fail on alternative implementation.
2018-06-29 17:49:35 +02:00
if( signature_size < mbedtls_rsa_get_len( rsa ) )
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 15:42:46 +02:00
return( PSA_ERROR_BUFFER_TOO_SMALL );
#if defined(MBEDTLS_PKCS1_V15)
if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) )
{
mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V15,
MBEDTLS_MD_NONE );
ret = mbedtls_rsa_pkcs1_sign( rsa,
mbedtls_ctr_drbg_random,
&global_data.ctr_drbg,
MBEDTLS_RSA_PRIVATE,
psa: Pass hash_length with explicit types The RSA module uses unsigned int for hash_length. The PSA Crypto API uses size_t for hash_length. Cast hash_length to unsigned int when passed to the hash module.
2018-06-26 15:20:51 +02:00
md_alg,
(unsigned int) hash_length,
hash,
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 15:42:46 +02:00
signature );
}
else
#endif /* MBEDTLS_PKCS1_V15 */
#if defined(MBEDTLS_PKCS1_V21)
if( PSA_ALG_IS_RSA_PSS( alg ) )
{
mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg );
ret = mbedtls_rsa_rsassa_pss_sign( rsa,
mbedtls_ctr_drbg_random,
&global_data.ctr_drbg,
MBEDTLS_RSA_PRIVATE,
Allow RSA PSS with any input size Although RSASSA-PSS defines its input as a message to be hashed, we implement a sign-the-hash function. This function can take an input which isn't a hash, so don't restrict the size of the input, any more than Mbed TLS does. Remove a redundant check that hash_length fits in unsigned int for the sake of Mbed TLS RSA functions. Test that PSS accepts inputs of various lengths. For PKCS#1 v1.5 signature in raw mode, test the maximum input length.
2018-06-29 23:36:35 +02:00
MBEDTLS_MD_NONE,
psa: Pass hash_length with explicit types The RSA module uses unsigned int for hash_length. The PSA Crypto API uses size_t for hash_length. Cast hash_length to unsigned int when passed to the hash module.
2018-06-26 15:20:51 +02:00
(unsigned int) hash_length,
hash,
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 15:42:46 +02:00
signature );
}
else
#endif /* MBEDTLS_PKCS1_V21 */
{
return( PSA_ERROR_INVALID_ARGUMENT );
}
if( ret == 0 )
Don't break the rsa context abstraction This would fail on alternative implementation.
2018-06-29 17:49:35 +02:00
*signature_length = mbedtls_rsa_get_len( rsa );
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 15:42:46 +02:00
return( mbedtls_to_psa_error( ret ) );
}
static psa_status_t psa_rsa_verify( mbedtls_rsa_context *rsa,
psa_algorithm_t alg,
const uint8_t *hash,
size_t hash_length,
const uint8_t *signature,
size_t signature_length )
{
psa_status_t status;
int ret;
mbedtls_md_type_t md_alg;
status = psa_rsa_decode_md_type( alg, hash_length, &md_alg );
if( status != PSA_SUCCESS )
return( status );
Don't break the rsa context abstraction This would fail on alternative implementation.
2018-06-29 17:49:35 +02:00
if( signature_length < mbedtls_rsa_get_len( rsa ) )
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 15:42:46 +02:00
return( PSA_ERROR_BUFFER_TOO_SMALL );
#if defined(MBEDTLS_PKCS1_V15)
if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) )
{
mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V15,
MBEDTLS_MD_NONE );
ret = mbedtls_rsa_pkcs1_verify( rsa,
mbedtls_ctr_drbg_random,
&global_data.ctr_drbg,
MBEDTLS_RSA_PUBLIC,
md_alg,
psa: Pass hash_length with explicit types The RSA module uses unsigned int for hash_length. The PSA Crypto API uses size_t for hash_length. Cast hash_length to unsigned int when passed to the hash module.
2018-06-26 15:20:51 +02:00
(unsigned int) hash_length,
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 15:42:46 +02:00
hash,
signature );
}
else
#endif /* MBEDTLS_PKCS1_V15 */
#if defined(MBEDTLS_PKCS1_V21)
if( PSA_ALG_IS_RSA_PSS( alg ) )
{
mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg );
ret = mbedtls_rsa_rsassa_pss_verify( rsa,
mbedtls_ctr_drbg_random,
&global_data.ctr_drbg,
MBEDTLS_RSA_PUBLIC,
Allow RSA PSS with any input size Although RSASSA-PSS defines its input as a message to be hashed, we implement a sign-the-hash function. This function can take an input which isn't a hash, so don't restrict the size of the input, any more than Mbed TLS does. Remove a redundant check that hash_length fits in unsigned int for the sake of Mbed TLS RSA functions. Test that PSS accepts inputs of various lengths. For PKCS#1 v1.5 signature in raw mode, test the maximum input length.
2018-06-29 23:36:35 +02:00
MBEDTLS_MD_NONE,
psa: Pass hash_length with explicit types The RSA module uses unsigned int for hash_length. The PSA Crypto API uses size_t for hash_length. Cast hash_length to unsigned int when passed to the hash module.
2018-06-26 15:20:51 +02:00
(unsigned int) hash_length,
hash,
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 15:42:46 +02:00
signature );
}
else
#endif /* MBEDTLS_PKCS1_V21 */
{
return( PSA_ERROR_INVALID_ARGUMENT );
}
RSA verification: don't report an invalid padding error Mbed TLS distinguishes "invalid padding" from "valid padding but the rest of the signature is invalid". This has little use in practice and PSA doesn't report this distinction. We just report "invalid signature".
2018-09-13 20:37:48 +02:00
/* Mbed TLS distinguishes "invalid padding" from "valid padding but
* the rest of the signature is invalid". This has little use in
* practice and PSA doesn't report this distinction. */
if( ret == MBEDTLS_ERR_RSA_INVALID_PADDING )
return( PSA_ERROR_INVALID_SIGNATURE );
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 15:42:46 +02:00
return( mbedtls_to_psa_error( ret ) );
}
#endif /* MBEDTLS_RSA_C */
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 16:10:23 +02:00
#if defined(MBEDTLS_ECDSA_C)
/* `ecp` cannot be const because `ecp->grp` needs to be non-const
* for mbedtls_ecdsa_sign() and mbedtls_ecdsa_sign_det()
* (even though these functions don't modify it). */
static psa_status_t psa_ecdsa_sign( mbedtls_ecp_keypair *ecp,
psa_algorithm_t alg,
const uint8_t *hash,
size_t hash_length,
uint8_t *signature,
size_t signature_size,
size_t *signature_length )
{
int ret;
mbedtls_mpi r, s;
Change ECDSA signature representation to r||s Change the representation of an ECDSA signature from the ASN.1 DER encoding used in TLS and X.509, to the concatenation of r and s in big-endian order with a fixed size. A fixed size helps memory and buffer management and this representation is generally easier to use for anything that doesn't require the ASN.1 representation. This is the same representation as PKCS#11 (Cryptoki) except that PKCS#11 allows r and s to be truncated (both to the same length), which complicates the implementation and negates the advantage of a fixed-size representation.
2018-06-28 13:56:01 +02:00
size_t curve_bytes = PSA_BITS_TO_BYTES( ecp->grp.pbits );
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 16:10:23 +02:00
mbedtls_mpi_init( &r );
mbedtls_mpi_init( &s );
Change ECDSA signature representation to r||s Change the representation of an ECDSA signature from the ASN.1 DER encoding used in TLS and X.509, to the concatenation of r and s in big-endian order with a fixed size. A fixed size helps memory and buffer management and this representation is generally easier to use for anything that doesn't require the ASN.1 representation. This is the same representation as PKCS#11 (Cryptoki) except that PKCS#11 allows r and s to be truncated (both to the same length), which complicates the implementation and negates the advantage of a fixed-size representation.
2018-06-28 13:56:01 +02:00
if( signature_size < 2 * curve_bytes )
{
ret = MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL;
goto cleanup;
}
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 16:10:23 +02:00
Add some missing compilation guards Add missing checks for defined(MBEDTLS_MD_C) around types and functions that require it (HMAC, HKDF, TLS12_PRF). Add missing checks for defined(MBEDTLS_ECDSA_DETERMINISTIC) around code that calls mbedtls_ecdsa_sign_det(). Add missing checks for defined(MBEDTLS_ECDH_C) around ECDH-specific functions.
2018-11-16 16:02:56 +01:00
#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 16:10:23 +02:00
if( PSA_ALG_DSA_IS_DETERMINISTIC( alg ) )
{
psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH( alg );
const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa( hash_alg );
mbedtls_md_type_t md_alg = mbedtls_md_get_type( md_info );
MBEDTLS_MPI_CHK( mbedtls_ecdsa_sign_det( &ecp->grp, &r, &s, &ecp->d,
hash, hash_length,
md_alg ) );
}
else
Add some missing compilation guards Add missing checks for defined(MBEDTLS_MD_C) around types and functions that require it (HMAC, HKDF, TLS12_PRF). Add missing checks for defined(MBEDTLS_ECDSA_DETERMINISTIC) around code that calls mbedtls_ecdsa_sign_det(). Add missing checks for defined(MBEDTLS_ECDH_C) around ECDH-specific functions.
2018-11-16 16:02:56 +01:00
#endif /* MBEDTLS_ECDSA_DETERMINISTIC */
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 16:10:23 +02:00
{
Add some missing compilation guards Add missing checks for defined(MBEDTLS_MD_C) around types and functions that require it (HMAC, HKDF, TLS12_PRF). Add missing checks for defined(MBEDTLS_ECDSA_DETERMINISTIC) around code that calls mbedtls_ecdsa_sign_det(). Add missing checks for defined(MBEDTLS_ECDH_C) around ECDH-specific functions.
2018-11-16 16:02:56 +01:00
(void) alg;
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 16:10:23 +02:00
MBEDTLS_MPI_CHK( mbedtls_ecdsa_sign( &ecp->grp, &r, &s, &ecp->d,
hash, hash_length,
mbedtls_ctr_drbg_random,
&global_data.ctr_drbg ) );
}
Change ECDSA signature representation to r||s Change the representation of an ECDSA signature from the ASN.1 DER encoding used in TLS and X.509, to the concatenation of r and s in big-endian order with a fixed size. A fixed size helps memory and buffer management and this representation is generally easier to use for anything that doesn't require the ASN.1 representation. This is the same representation as PKCS#11 (Cryptoki) except that PKCS#11 allows r and s to be truncated (both to the same length), which complicates the implementation and negates the advantage of a fixed-size representation.
2018-06-28 13:56:01 +02:00
MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &r,
signature,
curve_bytes ) );
MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &s,
signature + curve_bytes,
curve_bytes ) );
cleanup:
mbedtls_mpi_free( &r );
mbedtls_mpi_free( &s );
if( ret == 0 )
*signature_length = 2 * curve_bytes;
return( mbedtls_to_psa_error( ret ) );
}
static psa_status_t psa_ecdsa_verify( mbedtls_ecp_keypair *ecp,
const uint8_t *hash,
size_t hash_length,
const uint8_t *signature,
size_t signature_length )
{
int ret;
mbedtls_mpi r, s;
size_t curve_bytes = PSA_BITS_TO_BYTES( ecp->grp.pbits );
mbedtls_mpi_init( &r );
mbedtls_mpi_init( &s );
if( signature_length != 2 * curve_bytes )
return( PSA_ERROR_INVALID_SIGNATURE );
MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &r,
signature,
curve_bytes ) );
MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &s,
signature + curve_bytes,
curve_bytes ) );
ret = mbedtls_ecdsa_verify( &ecp->grp, hash, hash_length,
&ecp->Q, &r, &s );
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 16:10:23 +02:00
cleanup:
mbedtls_mpi_free( &r );
mbedtls_mpi_free( &s );
return( mbedtls_to_psa_error( ret ) );
}
#endif /* MBEDTLS_ECDSA_C */
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
psa_status_t psa_asymmetric_sign( psa_key_handle_t handle,
Normalize whitespace to Mbed TLS standards Only whitespace changes in this commit.
2018-06-08 16:09:36 +02:00
psa_algorithm_t alg,
const uint8_t *hash,
size_t hash_length,
uint8_t *signature,
size_t signature_size,
size_t *signature_length )
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 22:44:14 +01:00
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *slot;
psa_asymmetric_sign: consistently fill unused output with '!' Fill the unused part of the output buffer with '!', for consistency with hash and mac. On error, set the output length to the output buffer size and fill the output buffer with '!', again for consistency with hash and mac. This way an invalid output is more visible in a memory dump. Restructure the error paths so that there is a single place where the unused part of the output buffer is filled. Also remove a redundant initialization of *signature_length to 0.
2018-06-28 12:21:19 +02:00
psa_status_t status;
*signature_length = signature_size;
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
status = psa_get_key_from_slot( handle, &slot, PSA_KEY_USAGE_SIGN, alg );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
if( status != PSA_SUCCESS )
psa_asymmetric_sign: consistently fill unused output with '!' Fill the unused part of the output buffer with '!', for consistency with hash and mac. On error, set the output length to the output buffer size and fill the output buffer with '!', again for consistency with hash and mac. This way an invalid output is more visible in a memory dump. Restructure the error paths so that there is a single place where the unused part of the output buffer is filled. Also remove a redundant initialization of *signature_length to 0.
2018-06-28 12:21:19 +02:00
goto exit;
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 22:44:14 +01:00
if( ! PSA_KEY_TYPE_IS_KEYPAIR( slot->type ) )
psa_asymmetric_sign: consistently fill unused output with '!' Fill the unused part of the output buffer with '!', for consistency with hash and mac. On error, set the output length to the output buffer size and fill the output buffer with '!', again for consistency with hash and mac. This way an invalid output is more visible in a memory dump. Restructure the error paths so that there is a single place where the unused part of the output buffer is filled. Also remove a redundant initialization of *signature_length to 0.
2018-06-28 12:21:19 +02:00
{
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
}
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 22:44:14 +01:00
#if defined(MBEDTLS_RSA_C)
if( slot->type == PSA_KEY_TYPE_RSA_KEYPAIR )
{
psa_asymmetric_sign: consistently fill unused output with '!' Fill the unused part of the output buffer with '!', for consistency with hash and mac. On error, set the output length to the output buffer size and fill the output buffer with '!', again for consistency with hash and mac. This way an invalid output is more visible in a memory dump. Restructure the error paths so that there is a single place where the unused part of the output buffer is filled. Also remove a redundant initialization of *signature_length to 0.
2018-06-28 12:21:19 +02:00
status = psa_rsa_sign( slot->data.rsa,
alg,
hash, hash_length,
signature, signature_size,
signature_length );
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 22:44:14 +01:00
}
else
#endif /* defined(MBEDTLS_RSA_C) */
#if defined(MBEDTLS_ECP_C)
if( PSA_KEY_TYPE_IS_ECC( slot->type ) )
{
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 16:10:23 +02:00
#if defined(MBEDTLS_ECDSA_C)
Add some missing compilation guards Add missing checks for defined(MBEDTLS_MD_C) around types and functions that require it (HMAC, HKDF, TLS12_PRF). Add missing checks for defined(MBEDTLS_ECDSA_DETERMINISTIC) around code that calls mbedtls_ecdsa_sign_det(). Add missing checks for defined(MBEDTLS_ECDH_C) around ECDH-specific functions.
2018-11-16 16:02:56 +01:00
if(
#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
PSA_ALG_IS_ECDSA( alg )
#else
PSA_ALG_IS_RANDOMIZED_ECDSA( alg )
#endif
)
psa_asymmetric_sign: consistently fill unused output with '!' Fill the unused part of the output buffer with '!', for consistency with hash and mac. On error, set the output length to the output buffer size and fill the output buffer with '!', again for consistency with hash and mac. This way an invalid output is more visible in a memory dump. Restructure the error paths so that there is a single place where the unused part of the output buffer is filled. Also remove a redundant initialization of *signature_length to 0.
2018-06-28 12:21:19 +02:00
status = psa_ecdsa_sign( slot->data.ecp,
alg,
hash, hash_length,
signature, signature_size,
signature_length );
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 16:10:23 +02:00
else
#endif /* defined(MBEDTLS_ECDSA_C) */
{
psa_asymmetric_sign: consistently fill unused output with '!' Fill the unused part of the output buffer with '!', for consistency with hash and mac. On error, set the output length to the output buffer size and fill the output buffer with '!', again for consistency with hash and mac. This way an invalid output is more visible in a memory dump. Restructure the error paths so that there is a single place where the unused part of the output buffer is filled. Also remove a redundant initialization of *signature_length to 0.
2018-06-28 12:21:19 +02:00
status = PSA_ERROR_INVALID_ARGUMENT;
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 16:10:23 +02:00
}
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 10:18:38 +02:00
}
else
#endif /* defined(MBEDTLS_ECP_C) */
{
psa_asymmetric_sign: consistently fill unused output with '!' Fill the unused part of the output buffer with '!', for consistency with hash and mac. On error, set the output length to the output buffer size and fill the output buffer with '!', again for consistency with hash and mac. This way an invalid output is more visible in a memory dump. Restructure the error paths so that there is a single place where the unused part of the output buffer is filled. Also remove a redundant initialization of *signature_length to 0.
2018-06-28 12:21:19 +02:00
status = PSA_ERROR_NOT_SUPPORTED;
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 22:44:14 +01:00
}
psa_asymmetric_sign: consistently fill unused output with '!' Fill the unused part of the output buffer with '!', for consistency with hash and mac. On error, set the output length to the output buffer size and fill the output buffer with '!', again for consistency with hash and mac. This way an invalid output is more visible in a memory dump. Restructure the error paths so that there is a single place where the unused part of the output buffer is filled. Also remove a redundant initialization of *signature_length to 0.
2018-06-28 12:21:19 +02:00
exit:
/* Fill the unused part of the output buffer (the whole buffer on error,
* the trailing part on success) with something that isn't a valid mac
* (barring an attack on the mac and deliberately-crafted input),
* in case the caller doesn't check the return status properly. */
if( status == PSA_SUCCESS )
memset( signature + *signature_length, '!',
signature_size - *signature_length );
Handle null pointers safely when used as buffers of size 0 When the size of a buffer is 0, the corresponding pointer argument may be null. In such cases, library functions must not perform arithmetic on the pointer or call standard library functions such as memset and memcpy, since that would be undefined behavior in C. Protect such cases. Refactor the storage of a 0-sized raw data object to make it store a null pointer, rather than depending on the behavior of calloc(1,0).
2018-06-28 19:31:31 +02:00
else if( signature_size != 0 )
psa_asymmetric_sign: consistently fill unused output with '!' Fill the unused part of the output buffer with '!', for consistency with hash and mac. On error, set the output length to the output buffer size and fill the output buffer with '!', again for consistency with hash and mac. This way an invalid output is more visible in a memory dump. Restructure the error paths so that there is a single place where the unused part of the output buffer is filled. Also remove a redundant initialization of *signature_length to 0.
2018-06-28 12:21:19 +02:00
memset( signature, '!', signature_size );
Handle null pointers safely when used as buffers of size 0 When the size of a buffer is 0, the corresponding pointer argument may be null. In such cases, library functions must not perform arithmetic on the pointer or call standard library functions such as memset and memcpy, since that would be undefined behavior in C. Protect such cases. Refactor the storage of a 0-sized raw data object to make it store a null pointer, rather than depending on the behavior of calloc(1,0).
2018-06-28 19:31:31 +02:00
/* If signature_size is 0 then we have nothing to do. We must not call
* memset because signature may be NULL in this case. */
psa_asymmetric_sign: consistently fill unused output with '!' Fill the unused part of the output buffer with '!', for consistency with hash and mac. On error, set the output length to the output buffer size and fill the output buffer with '!', again for consistency with hash and mac. This way an invalid output is more visible in a memory dump. Restructure the error paths so that there is a single place where the unused part of the output buffer is filled. Also remove a redundant initialization of *signature_length to 0.
2018-06-28 12:21:19 +02:00
return( status );
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 10:18:38 +02:00
}
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
psa_status_t psa_asymmetric_verify( psa_key_handle_t handle,
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 10:18:38 +02:00
psa_algorithm_t alg,
const uint8_t *hash,
size_t hash_length,
Add missing const for signature parameter of psa_asymmetric_verify
2018-06-27 14:58:41 +02:00
const uint8_t *signature,
Fix parameter name signature_size for psa_asymmetric_verify It should have been signature_length, following our conventions.
2018-06-27 18:19:40 +02:00
size_t signature_length )
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 10:18:38 +02:00
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *slot;
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
psa_status_t status;
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 15:42:46 +02:00
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
status = psa_get_key_from_slot( handle, &slot, PSA_KEY_USAGE_VERIFY, alg );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
if( status != PSA_SUCCESS )
return( status );
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 10:18:38 +02:00
Normalize whitespace to Mbed TLS standards Only whitespace changes in this commit.
2018-06-08 16:09:36 +02:00
#if defined(MBEDTLS_RSA_C)
New macro PSA_KEY_TYPE_IS_RSA
2018-06-29 19:51:51 +02:00
if( PSA_KEY_TYPE_IS_RSA( slot->type ) )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 22:16:26 +02:00
{
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 15:42:46 +02:00
return( psa_rsa_verify( slot->data.rsa,
alg,
hash, hash_length,
signature, signature_length ) );
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 22:16:26 +02:00
}
else
#endif /* defined(MBEDTLS_RSA_C) */
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 10:18:38 +02:00
#if defined(MBEDTLS_ECP_C)
if( PSA_KEY_TYPE_IS_ECC( slot->type ) )
{
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 16:10:23 +02:00
#if defined(MBEDTLS_ECDSA_C)
if( PSA_ALG_IS_ECDSA( alg ) )
Change ECDSA signature representation to r||s Change the representation of an ECDSA signature from the ASN.1 DER encoding used in TLS and X.509, to the concatenation of r and s in big-endian order with a fixed size. A fixed size helps memory and buffer management and this representation is generally easier to use for anything that doesn't require the ASN.1 representation. This is the same representation as PKCS#11 (Cryptoki) except that PKCS#11 allows r and s to be truncated (both to the same length), which complicates the implementation and negates the advantage of a fixed-size representation.
2018-06-28 13:56:01 +02:00
return( psa_ecdsa_verify( slot->data.ecp,
hash, hash_length,
signature, signature_length ) );
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 16:10:23 +02:00
else
#endif /* defined(MBEDTLS_ECDSA_C) */
{
return( PSA_ERROR_INVALID_ARGUMENT );
}
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 10:18:38 +02:00
}
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 22:44:14 +01:00
else
#endif /* defined(MBEDTLS_ECP_C) */
{
return( PSA_ERROR_NOT_SUPPORTED );
}
}
Implement OAEP Implement RSAES-OAEP encryption and decryption. Test it to the same level as PKCS#1 v1.5.
2018-06-30 00:21:29 +02:00
#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PKCS1_V21)
static void psa_rsa_oaep_set_padding_mode( psa_algorithm_t alg,
mbedtls_rsa_context *rsa )
{
psa_algorithm_t hash_alg = PSA_ALG_RSA_OAEP_GET_HASH( alg );
const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa( hash_alg );
mbedtls_md_type_t md_alg = mbedtls_md_get_type( md_info );
mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg );
}
#endif /* defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PKCS1_V21) */
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
psa_status_t psa_asymmetric_encrypt( psa_key_handle_t handle,
Normalize whitespace to Mbed TLS standards Only whitespace changes in this commit.
2018-06-08 16:09:36 +02:00
psa_algorithm_t alg,
const uint8_t *input,
size_t input_length,
const uint8_t *salt,
size_t salt_length,
uint8_t *output,
size_t output_size,
size_t *output_length )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 22:16:26 +02:00
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *slot;
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
psa_status_t status;
Add handling for (sometimes) unused parameters
2018-07-24 16:34:10 +02:00
(void) input;
(void) input_length;
(void) salt;
(void) output;
(void) output_size;
Set output length to safe value
2018-06-04 15:43:12 +02:00
*output_length = 0;
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 22:16:26 +02:00
psa_asymmetric_{encrypt,decrypt}: reject salt when not allowed In psa_asymmetric_encrypt and psa_asymmetric_decrypt, if the algorithm does not use a salt, require the salt to be empty.
2018-06-30 19:04:35 +02:00
if( ! PSA_ALG_IS_RSA_OAEP( alg ) && salt_length != 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
status = psa_get_key_from_slot( handle, &slot, PSA_KEY_USAGE_ENCRYPT, alg );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
if( status != PSA_SUCCESS )
return( status );
In psa_asymmetric_encrypt, allow public keys The code was accepting key pairs only, even though encryption doesn't require the private key.
2018-06-29 19:17:49 +02:00
if( ! ( PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->type ) ||
PSA_KEY_TYPE_IS_KEYPAIR( slot->type ) ) )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 22:16:26 +02:00
return( PSA_ERROR_INVALID_ARGUMENT );
#if defined(MBEDTLS_RSA_C)
New macro PSA_KEY_TYPE_IS_RSA
2018-06-29 19:51:51 +02:00
if( PSA_KEY_TYPE_IS_RSA( slot->type ) )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 22:16:26 +02:00
{
mbedtls_rsa_context *rsa = slot->data.rsa;
int ret;
Don't break the rsa context abstraction This would fail on alternative implementation.
2018-06-29 17:49:35 +02:00
if( output_size < mbedtls_rsa_get_len( rsa ) )
Normalize whitespace to Mbed TLS standards Only whitespace changes in this commit.
2018-06-08 16:09:36 +02:00
return( PSA_ERROR_INVALID_ARGUMENT );
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 22:16:26 +02:00
#if defined(MBEDTLS_PKCS1_V15)
Finish renaming around PSA_ALG_IS_RSA_PKCS1V15 Now the code compiles. Some OAEP and PSS macros may still need to be fixed.
2018-05-31 13:16:08 +02:00
if( alg == PSA_ALG_RSA_PKCS1V15_CRYPT )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 22:16:26 +02:00
{
Normalize whitespace to Mbed TLS standards Only whitespace changes in this commit.
2018-06-08 16:09:36 +02:00
ret = mbedtls_rsa_pkcs1_encrypt( rsa,
mbedtls_ctr_drbg_random,
&global_data.ctr_drbg,
MBEDTLS_RSA_PUBLIC,
input_length,
input,
output );
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 22:16:26 +02:00
}
else
#endif /* MBEDTLS_PKCS1_V15 */
#if defined(MBEDTLS_PKCS1_V21)
Sort out RSA mechanisms * PSS needs to be parametrized by a hash. * Don't use `_MGF1` in the names of macros for OAEP and PSS. No one ever uses anything else. * Add brief documentation for the RSA signature mechanisms.
2018-06-26 15:53:48 +02:00
if( PSA_ALG_IS_RSA_OAEP( alg ) )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 22:16:26 +02:00
{
Implement OAEP Implement RSAES-OAEP encryption and decryption. Test it to the same level as PKCS#1 v1.5.
2018-06-30 00:21:29 +02:00
psa_rsa_oaep_set_padding_mode( alg, rsa );
ret = mbedtls_rsa_rsaes_oaep_encrypt( rsa,
mbedtls_ctr_drbg_random,
&global_data.ctr_drbg,
MBEDTLS_RSA_PUBLIC,
salt, salt_length,
input_length,
input,
output );
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 22:16:26 +02:00
}
else
#endif /* MBEDTLS_PKCS1_V21 */
{
return( PSA_ERROR_INVALID_ARGUMENT );
}
if( ret == 0 )
Don't break the rsa context abstraction This would fail on alternative implementation.
2018-06-29 17:49:35 +02:00
*output_length = mbedtls_rsa_get_len( rsa );
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 22:16:26 +02:00
return( mbedtls_to_psa_error( ret ) );
}
else
Remove ECC boilerplate in asymmetric encrypt/decrypt We don't have any encryption algorithm using ECC keys at the moment.
2018-06-08 17:44:47 +02:00
#endif /* defined(MBEDTLS_RSA_C) */
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 22:16:26 +02:00
{
return( PSA_ERROR_NOT_SUPPORTED );
}
Remove trailing whitespace Only horizontal whitespace changes in this commit.
2018-05-31 13:25:48 +02:00
}
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
psa_status_t psa_asymmetric_decrypt( psa_key_handle_t handle,
Normalize whitespace to Mbed TLS standards Only whitespace changes in this commit.
2018-06-08 16:09:36 +02:00
psa_algorithm_t alg,
const uint8_t *input,
size_t input_length,
const uint8_t *salt,
size_t salt_length,
uint8_t *output,
size_t output_size,
size_t *output_length )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 22:16:26 +02:00
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *slot;
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
psa_status_t status;
Add handling for (sometimes) unused parameters
2018-07-24 16:34:10 +02:00
(void) input;
(void) input_length;
(void) salt;
(void) output;
(void) output_size;
Set output length to safe value
2018-06-04 15:43:12 +02:00
*output_length = 0;
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 22:16:26 +02:00
psa_asymmetric_{encrypt,decrypt}: reject salt when not allowed In psa_asymmetric_encrypt and psa_asymmetric_decrypt, if the algorithm does not use a salt, require the salt to be empty.
2018-06-30 19:04:35 +02:00
if( ! PSA_ALG_IS_RSA_OAEP( alg ) && salt_length != 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
status = psa_get_key_from_slot( handle, &slot, PSA_KEY_USAGE_DECRYPT, alg );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
if( status != PSA_SUCCESS )
return( status );
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 22:16:26 +02:00
if( ! PSA_KEY_TYPE_IS_KEYPAIR( slot->type ) )
return( PSA_ERROR_INVALID_ARGUMENT );
#if defined(MBEDTLS_RSA_C)
if( slot->type == PSA_KEY_TYPE_RSA_KEYPAIR )
{
mbedtls_rsa_context *rsa = slot->data.rsa;
int ret;
Don't break the rsa context abstraction This would fail on alternative implementation.
2018-06-29 17:49:35 +02:00
if( input_length != mbedtls_rsa_get_len( rsa ) )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 22:16:26 +02:00
return( PSA_ERROR_INVALID_ARGUMENT );
#if defined(MBEDTLS_PKCS1_V15)
Finish renaming around PSA_ALG_IS_RSA_PKCS1V15 Now the code compiles. Some OAEP and PSS macros may still need to be fixed.
2018-05-31 13:16:08 +02:00
if( alg == PSA_ALG_RSA_PKCS1V15_CRYPT )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 22:16:26 +02:00
{
Normalize whitespace to Mbed TLS standards Only whitespace changes in this commit.
2018-06-08 16:09:36 +02:00
ret = mbedtls_rsa_pkcs1_decrypt( rsa,
mbedtls_ctr_drbg_random,
&global_data.ctr_drbg,
MBEDTLS_RSA_PRIVATE,
output_length,
input,
output,
output_size );
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 22:16:26 +02:00
}
else
#endif /* MBEDTLS_PKCS1_V15 */
#if defined(MBEDTLS_PKCS1_V21)
Sort out RSA mechanisms * PSS needs to be parametrized by a hash. * Don't use `_MGF1` in the names of macros for OAEP and PSS. No one ever uses anything else. * Add brief documentation for the RSA signature mechanisms.
2018-06-26 15:53:48 +02:00
if( PSA_ALG_IS_RSA_OAEP( alg ) )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 22:16:26 +02:00
{
Implement OAEP Implement RSAES-OAEP encryption and decryption. Test it to the same level as PKCS#1 v1.5.
2018-06-30 00:21:29 +02:00
psa_rsa_oaep_set_padding_mode( alg, rsa );
ret = mbedtls_rsa_rsaes_oaep_decrypt( rsa,
mbedtls_ctr_drbg_random,
&global_data.ctr_drbg,
MBEDTLS_RSA_PRIVATE,
salt, salt_length,
output_length,
input,
output,
output_size );
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 22:16:26 +02:00
}
else
#endif /* MBEDTLS_PKCS1_V21 */
{
return( PSA_ERROR_INVALID_ARGUMENT );
}
Remove duplicate / unneeded code 1. remove duplicate function introduced by re-base 2. remove unneeded code
2018-06-04 15:36:15 +02:00
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 22:16:26 +02:00
return( mbedtls_to_psa_error( ret ) );
}
else
Remove ECC boilerplate in asymmetric encrypt/decrypt We don't have any encryption algorithm using ECC keys at the moment.
2018-06-08 17:44:47 +02:00
#endif /* defined(MBEDTLS_RSA_C) */
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 22:16:26 +02:00
{
return( PSA_ERROR_NOT_SUPPORTED );
}
Remove trailing whitespace Only horizontal whitespace changes in this commit.
2018-05-31 13:25:48 +02:00
}
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 22:44:14 +01:00
Be more consistent about blank lines
2018-06-18 21:49:39 +02:00
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
/****************************************************************/
/* Symmetric cryptography */
/****************************************************************/
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 16:05:20 +02:00
/* Initialize the cipher operation structure. Once this function has been
* called, psa_cipher_abort can run and will do the right thing. */
static psa_status_t psa_cipher_init( psa_cipher_operation_t *operation,
psa_algorithm_t alg )
{
Favor INVALID_ARGUMENT over NOT_SUPPORTED for bad algorithm types In psa_hash_start, psa_mac_start and psa_cipher_setup, return PSA_ERROR_INVALID_ARGUMENT rather than PSA_ERROR_NOT_SUPPORTED when the algorithm parameter is not the right category.
2018-06-20 16:21:04 +02:00
if( ! PSA_ALG_IS_CIPHER( alg ) )
{
memset( operation, 0, sizeof( *operation ) );
return( PSA_ERROR_INVALID_ARGUMENT );
}
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 16:05:20 +02:00
operation->alg = alg;
operation->key_set = 0;
operation->iv_set = 0;
operation->iv_required = 1;
operation->iv_size = 0;
operation->block_size = 0;
mbedtls_cipher_init( &operation->ctx.cipher );
return( PSA_SUCCESS );
}
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 16:22:46 +02:00
static psa_status_t psa_cipher_setup( psa_cipher_operation_t *operation,
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
psa_key_handle_t handle,
Wrap lines to 80 columns
2018-06-04 16:23:10 +02:00
psa_algorithm_t alg,
mbedtls_operation_t cipher_operation )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
{
int ret = MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE;
psa_status_t status;
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *slot;
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
size_t key_bits;
const mbedtls_cipher_info_t *cipher_info = NULL;
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
psa_key_usage_t usage = ( cipher_operation == MBEDTLS_ENCRYPT ?
PSA_KEY_USAGE_ENCRYPT :
PSA_KEY_USAGE_DECRYPT );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 16:05:20 +02:00
status = psa_cipher_init( operation, alg );
if( status != PSA_SUCCESS )
return( status );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
status = psa_get_key_from_slot( handle, &slot, usage, alg);
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
if( status != PSA_SUCCESS )
return( status );
Don't call psa_get_key_information internally When you have a key slot pointer, read the key type directly, and call psa_get_key_bits to get the bit size.
2018-07-06 16:07:47 +02:00
key_bits = psa_get_key_bits( slot );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
Don't call psa_get_key_information internally When you have a key slot pointer, read the key type directly, and call psa_get_key_bits to get the bit size.
2018-07-06 16:07:47 +02:00
cipher_info = mbedtls_cipher_info_from_psa( alg, slot->type, key_bits, NULL );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
if( cipher_info == NULL )
return( PSA_ERROR_NOT_SUPPORTED );
ret = mbedtls_cipher_setup( &operation->ctx.cipher, cipher_info );
partly pr fix
2018-04-04 14:43:05 +02:00
if( ret != 0 )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
{
psa_cipher_abort( operation );
return( mbedtls_to_psa_error( ret ) );
}
Add what little was missing to fully support DES Also add what was missing in the test suite to support block ciphers with a block size that isn't 16. Fix some buggy test data that passed only due to problems with DES support in the product.
2018-06-21 09:40:04 +02:00
#if defined(MBEDTLS_DES_C)
Don't call psa_get_key_information internally When you have a key slot pointer, read the key type directly, and call psa_get_key_bits to get the bit size.
2018-07-06 16:07:47 +02:00
if( slot->type == PSA_KEY_TYPE_DES && key_bits == 128 )
Add what little was missing to fully support DES Also add what was missing in the test suite to support block ciphers with a block size that isn't 16. Fix some buggy test data that passed only due to problems with DES support in the product.
2018-06-21 09:40:04 +02:00
{
/* Two-key Triple-DES is 3-key Triple-DES with K1=K3 */
unsigned char keys[24];
memcpy( keys, slot->data.raw.data, 16 );
memcpy( keys + 16, slot->data.raw.data, 8 );
ret = mbedtls_cipher_setkey( &operation->ctx.cipher,
keys,
192, cipher_operation );
}
else
#endif
{
ret = mbedtls_cipher_setkey( &operation->ctx.cipher,
slot->data.raw.data,
psa: Pass the number of bits with explicit types The GCM, CCM, RSA, and cipher modules inconsistently use int or unsigned int for a count of bits. The PSA Crypto API uses size_t for counting things. This causes issues on LLP64 systems where a size_t can hold more than an unsigned int. Add casts for where key_bits and bits are passed to mbedtls_* APIs.
2018-06-26 15:16:54 +02:00
(int) key_bits, cipher_operation );
Add what little was missing to fully support DES Also add what was missing in the test suite to support block ciphers with a block size that isn't 16. Fix some buggy test data that passed only due to problems with DES support in the product.
2018-06-21 09:40:04 +02:00
}
partly pr fix
2018-04-04 14:43:05 +02:00
if( ret != 0 )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
{
psa_cipher_abort( operation );
return( mbedtls_to_psa_error( ret ) );
}
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 12:57:31 +01:00
#if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING)
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 14:02:45 +02:00
switch( alg )
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 12:57:31 +01:00
{
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 14:02:45 +02:00
case PSA_ALG_CBC_NO_PADDING:
ret = mbedtls_cipher_set_padding_mode( &operation->ctx.cipher,
MBEDTLS_PADDING_NONE );
break;
case PSA_ALG_CBC_PKCS7:
ret = mbedtls_cipher_set_padding_mode( &operation->ctx.cipher,
MBEDTLS_PADDING_PKCS7 );
break;
default:
/* The algorithm doesn't involve padding. */
ret = 0;
break;
}
if( ret != 0 )
{
psa_cipher_abort( operation );
return( mbedtls_to_psa_error( ret ) );
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 12:57:31 +01:00
}
#endif //MBEDTLS_CIPHER_MODE_WITH_PADDING
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
operation->key_set = 1;
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 14:02:45 +02:00
operation->block_size = ( PSA_ALG_IS_STREAM_CIPHER( alg ) ? 1 :
PSA_BLOCK_CIPHER_BLOCK_SIZE( slot->type ) );
if( alg & PSA_ALG_CIPHER_FROM_BLOCK_FLAG )
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 12:57:31 +01:00
{
Don't call psa_get_key_information internally When you have a key slot pointer, read the key type directly, and call psa_get_key_bits to get the bit size.
2018-07-06 16:07:47 +02:00
operation->iv_size = PSA_BLOCK_CIPHER_BLOCK_SIZE( slot->type );
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 12:57:31 +01:00
}
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
adjust indentation per Mbed TLS standards
2018-05-31 13:07:14 +02:00
return( PSA_SUCCESS );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
}
Rename psa cipher functions to psa_cipher_xxx Make function names for multipart operations more consistent (cipher edition). Rename symmetric cipher multipart operation functions so that they all start with psa_cipher_: * psa_encrypt_setup -> psa_cipher_encrypt_setup * psa_decrypt_setup -> psa_cipher_decrypt_setup * psa_encrypt_set_iv -> psa_cipher_set_iv * psa_encrypt_generate_iv -> psa_cipher_generate_iv
2018-07-08 21:39:34 +02:00
psa_status_t psa_cipher_encrypt_setup( psa_cipher_operation_t *operation,
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
psa_key_handle_t handle,
Rename psa cipher functions to psa_cipher_xxx Make function names for multipart operations more consistent (cipher edition). Rename symmetric cipher multipart operation functions so that they all start with psa_cipher_: * psa_encrypt_setup -> psa_cipher_encrypt_setup * psa_decrypt_setup -> psa_cipher_decrypt_setup * psa_encrypt_set_iv -> psa_cipher_set_iv * psa_encrypt_generate_iv -> psa_cipher_generate_iv
2018-07-08 21:39:34 +02:00
psa_algorithm_t alg )
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 12:57:31 +01:00
{
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
return( psa_cipher_setup( operation, handle, alg, MBEDTLS_ENCRYPT ) );
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 12:57:31 +01:00
}
Rename psa cipher functions to psa_cipher_xxx Make function names for multipart operations more consistent (cipher edition). Rename symmetric cipher multipart operation functions so that they all start with psa_cipher_: * psa_encrypt_setup -> psa_cipher_encrypt_setup * psa_decrypt_setup -> psa_cipher_decrypt_setup * psa_encrypt_set_iv -> psa_cipher_set_iv * psa_encrypt_generate_iv -> psa_cipher_generate_iv
2018-07-08 21:39:34 +02:00
psa_status_t psa_cipher_decrypt_setup( psa_cipher_operation_t *operation,
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
psa_key_handle_t handle,
Rename psa cipher functions to psa_cipher_xxx Make function names for multipart operations more consistent (cipher edition). Rename symmetric cipher multipart operation functions so that they all start with psa_cipher_: * psa_encrypt_setup -> psa_cipher_encrypt_setup * psa_decrypt_setup -> psa_cipher_decrypt_setup * psa_encrypt_set_iv -> psa_cipher_set_iv * psa_encrypt_generate_iv -> psa_cipher_generate_iv
2018-07-08 21:39:34 +02:00
psa_algorithm_t alg )
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 12:57:31 +01:00
{
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
return( psa_cipher_setup( operation, handle, alg, MBEDTLS_DECRYPT ) );
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 12:57:31 +01:00
}
Rename psa cipher functions to psa_cipher_xxx Make function names for multipart operations more consistent (cipher edition). Rename symmetric cipher multipart operation functions so that they all start with psa_cipher_: * psa_encrypt_setup -> psa_cipher_encrypt_setup * psa_decrypt_setup -> psa_cipher_decrypt_setup * psa_encrypt_set_iv -> psa_cipher_set_iv * psa_encrypt_generate_iv -> psa_cipher_generate_iv
2018-07-08 21:39:34 +02:00
psa_status_t psa_cipher_generate_iv( psa_cipher_operation_t *operation,
unsigned char *iv,
size_t iv_size,
size_t *iv_length )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
{
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 12:56:32 +02:00
psa_status_t status;
int ret;
Formatting improvements Avoid lines longer than 80 columns. Remove some redundant parentheses, e.g. change if( ( a == b ) && ( c == d ) ) to if( a == b && c == d ) which makes lines less long and makes the remaining parentheses more relevant. Add missing parentheses around return statements. There should be no semantic change in this commit.
2018-06-18 16:04:39 +02:00
if( operation->iv_set || ! operation->iv_required )
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 12:56:32 +02:00
{
status = PSA_ERROR_BAD_STATE;
goto exit;
}
partly pr fix
2018-04-04 14:43:05 +02:00
if( iv_size < operation->iv_size )
{
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 12:56:32 +02:00
status = PSA_ERROR_BUFFER_TOO_SMALL;
partly pr fix
2018-04-04 14:43:05 +02:00
goto exit;
}
Wrap lines to 80 columns
2018-06-04 16:23:10 +02:00
ret = mbedtls_ctr_drbg_random( &global_data.ctr_drbg,
iv, operation->iv_size );
partly pr fix
2018-04-04 14:43:05 +02:00
if( ret != 0 )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
{
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 12:56:32 +02:00
status = mbedtls_to_psa_error( ret );
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 16:22:46 +02:00
goto exit;
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
}
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 16:22:46 +02:00
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 12:57:31 +01:00
*iv_length = operation->iv_size;
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 12:56:32 +02:00
status = psa_cipher_set_iv( operation, iv, *iv_length );
partly pr fix
2018-04-04 14:43:05 +02:00
adjust indentation per Mbed TLS standards
2018-05-31 13:07:14 +02:00
exit:
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 12:56:32 +02:00
if( status != PSA_SUCCESS )
adjust indentation per Mbed TLS standards
2018-05-31 13:07:14 +02:00
psa_cipher_abort( operation );
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 12:56:32 +02:00
return( status );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
}
Rename psa cipher functions to psa_cipher_xxx Make function names for multipart operations more consistent (cipher edition). Rename symmetric cipher multipart operation functions so that they all start with psa_cipher_: * psa_encrypt_setup -> psa_cipher_encrypt_setup * psa_decrypt_setup -> psa_cipher_decrypt_setup * psa_encrypt_set_iv -> psa_cipher_set_iv * psa_encrypt_generate_iv -> psa_cipher_generate_iv
2018-07-08 21:39:34 +02:00
psa_status_t psa_cipher_set_iv( psa_cipher_operation_t *operation,
const unsigned char *iv,
size_t iv_length )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
{
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 12:56:32 +02:00
psa_status_t status;
int ret;
Formatting improvements Avoid lines longer than 80 columns. Remove some redundant parentheses, e.g. change if( ( a == b ) && ( c == d ) ) to if( a == b && c == d ) which makes lines less long and makes the remaining parentheses more relevant. Add missing parentheses around return statements. There should be no semantic change in this commit.
2018-06-18 16:04:39 +02:00
if( operation->iv_set || ! operation->iv_required )
add missing call to psa_cipher_abort in cipher_setup func + iv_length check in cipher_set_iv func
2018-04-22 19:23:16 +02:00
{
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 12:56:32 +02:00
status = PSA_ERROR_BAD_STATE;
goto exit;
add missing call to psa_cipher_abort in cipher_setup func + iv_length check in cipher_set_iv func
2018-04-22 19:23:16 +02:00
}
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 12:56:32 +02:00
if( iv_length != operation->iv_size )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
{
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 12:56:32 +02:00
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
}
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 12:56:32 +02:00
ret = mbedtls_cipher_set_iv( &operation->ctx.cipher, iv, iv_length );
status = mbedtls_to_psa_error( ret );
exit:
if( status == PSA_SUCCESS )
operation->iv_set = 1;
else
psa_cipher_abort( operation );
return( status );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
}
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 16:22:46 +02:00
psa_status_t psa_cipher_update( psa_cipher_operation_t *operation,
const uint8_t *input,
size_t input_length,
unsigned char *output,
size_t output_size,
size_t *output_length )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
{
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 12:56:32 +02:00
psa_status_t status;
int ret;
Refactor some argument checks for readability No intended behavior change.
2018-06-04 17:17:16 +02:00
size_t expected_output_size;
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 14:02:45 +02:00
if( ! PSA_ALG_IS_STREAM_CIPHER( operation->alg ) )
Refactor some argument checks for readability No intended behavior change.
2018-06-04 17:17:16 +02:00
{
/* Take the unprocessed partial block left over from previous
* update calls, if any, plus the input to this call. Remove
* the last partial block, if any. You get the data that will be
* output in this call. */
expected_output_size =
( operation->ctx.cipher.unprocessed_len + input_length )
/ operation->block_size * operation->block_size;
}
else
{
expected_output_size = input_length;
}
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 12:56:32 +02:00
Refactor some argument checks for readability No intended behavior change.
2018-06-04 17:17:16 +02:00
if( output_size < expected_output_size )
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 12:56:32 +02:00
{
status = PSA_ERROR_BUFFER_TOO_SMALL;
goto exit;
}
warnings fixes
2018-03-12 17:16:40 +01:00
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
ret = mbedtls_cipher_update( &operation->ctx.cipher, input,
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 16:22:46 +02:00
input_length, output, output_length );
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 12:56:32 +02:00
status = mbedtls_to_psa_error( ret );
exit:
if( status != PSA_SUCCESS )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
psa_cipher_abort( operation );
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 12:56:32 +02:00
return( status );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
}
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 16:22:46 +02:00
psa_status_t psa_cipher_finish( psa_cipher_operation_t *operation,
uint8_t *output,
size_t output_size,
size_t *output_length )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
{
Fix memory leak in psa_cipher_finish()
2018-07-09 17:04:51 +02:00
psa_status_t status = PSA_ERROR_UNKNOWN_ERROR;
int cipher_ret = MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE;
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 16:22:46 +02:00
uint8_t temp_output_buffer[MBEDTLS_MAX_BLOCK_LENGTH];
fix missing check on output_size in psa_cipher_finish func
2018-04-22 19:19:20 +02:00
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
if( ! operation->key_set )
abort operation before return + fix error checks
2018-06-05 10:40:02 +02:00
{
Fix memory leak in psa_cipher_finish()
2018-07-09 17:04:51 +02:00
status = PSA_ERROR_BAD_STATE;
goto error;
abort operation before return + fix error checks
2018-06-05 10:40:02 +02:00
}
adjust indentation per Mbed TLS standards
2018-05-29 15:25:04 +02:00
if( operation->iv_required && ! operation->iv_set )
abort operation before return + fix error checks
2018-06-05 10:40:02 +02:00
{
Fix memory leak in psa_cipher_finish()
2018-07-09 17:04:51 +02:00
status = PSA_ERROR_BAD_STATE;
goto error;
abort operation before return + fix error checks
2018-06-05 10:40:02 +02:00
}
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 14:02:45 +02:00
Whitespace normalization No semantic change.
2018-06-06 15:12:32 +02:00
if( operation->ctx.cipher.operation == MBEDTLS_ENCRYPT &&
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 14:02:45 +02:00
operation->alg == PSA_ALG_CBC_NO_PADDING &&
operation->ctx.cipher.unprocessed_len != 0 )
fix missing check on output_size in psa_cipher_finish func
2018-04-22 19:19:20 +02:00
{
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 14:02:45 +02:00
status = PSA_ERROR_INVALID_ARGUMENT;
Fix memory leak in psa_cipher_finish()
2018-07-09 17:04:51 +02:00
goto error;
delete decrypt checks + fix memcpy& return value
2018-04-30 14:45:34 +02:00
}
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
Fix memory leak in psa_cipher_finish()
2018-07-09 17:04:51 +02:00
cipher_ret = mbedtls_cipher_finish( &operation->ctx.cipher,
temp_output_buffer,
output_length );
if( cipher_ret != 0 )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
{
Fix memory leak in psa_cipher_finish()
2018-07-09 17:04:51 +02:00
status = mbedtls_to_psa_error( cipher_ret );
goto error;
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
}
Fix memory leak in psa_cipher_finish()
2018-07-09 17:04:51 +02:00
Handle null pointers safely when used as buffers of size 0 When the size of a buffer is 0, the corresponding pointer argument may be null. In such cases, library functions must not perform arithmetic on the pointer or call standard library functions such as memset and memcpy, since that would be undefined behavior in C. Protect such cases. Refactor the storage of a 0-sized raw data object to make it store a null pointer, rather than depending on the behavior of calloc(1,0).
2018-06-28 19:31:31 +02:00
if( *output_length == 0 )
Fix memory leak in psa_cipher_finish()
2018-07-09 17:04:51 +02:00
; /* Nothing to copy. Note that output may be NULL in this case. */
Handle null pointers safely when used as buffers of size 0 When the size of a buffer is 0, the corresponding pointer argument may be null. In such cases, library functions must not perform arithmetic on the pointer or call standard library functions such as memset and memcpy, since that would be undefined behavior in C. Protect such cases. Refactor the storage of a 0-sized raw data object to make it store a null pointer, rather than depending on the behavior of calloc(1,0).
2018-06-28 19:31:31 +02:00
else if( output_size >= *output_length )
delete decrypt checks + fix memcpy& return value
2018-04-30 14:45:34 +02:00
memcpy( output, temp_output_buffer, *output_length );
else
{
Fix memory leak in psa_cipher_finish()
2018-07-09 17:04:51 +02:00
status = PSA_ERROR_BUFFER_TOO_SMALL;
goto error;
delete decrypt checks + fix memcpy& return value
2018-04-30 14:45:34 +02:00
}
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 18:14:53 +01:00
mbedtls_platform_zeroize( temp_output_buffer, sizeof( temp_output_buffer ) );
Fix memory leak in psa_cipher_finish()
2018-07-09 17:04:51 +02:00
status = psa_cipher_abort( operation );
return( status );
error:
*output_length = 0;
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 18:14:53 +01:00
mbedtls_platform_zeroize( temp_output_buffer, sizeof( temp_output_buffer ) );
Fix memory leak in psa_cipher_finish()
2018-07-09 17:04:51 +02:00
(void) psa_cipher_abort( operation );
return( status );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
}
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 16:22:46 +02:00
psa_status_t psa_cipher_abort( psa_cipher_operation_t *operation )
{
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 16:05:20 +02:00
if( operation->alg == 0 )
psa_hash_abort: return PSA_SUCCESS if alg=0 Make psa_hash_abort consistent with psa_mac_abort and psa_cipher_abort. Add a comment explaining the reasoning.
2018-06-26 15:04:31 +02:00
{
/* The object has (apparently) been initialized but it is not
* in use. It's ok to call abort on such an object, and there's
* nothing to do. */
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 16:05:20 +02:00
return( PSA_SUCCESS );
psa_hash_abort: return PSA_SUCCESS if alg=0 Make psa_hash_abort consistent with psa_mac_abort and psa_cipher_abort. Add a comment explaining the reasoning.
2018-06-26 15:04:31 +02:00
}
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 16:05:20 +02:00
In abort functions, return BAD_STATE on obviously bad input psa_hash_abort, psa_mac_abort and psa_cipher_abort now return PSA_ERROR_BAD_STATE if operation->alg is obviously not valid, which can only happen due to a programming error in the caller or in the library. We can't detect all cases of calling abort on uninitialized memory but this is dirt cheap and better than nothing.
2018-06-21 16:57:07 +02:00
/* Sanity check (shouldn't happen: operation->alg should
* always have been initialized to a valid value). */
if( ! PSA_ALG_IS_CIPHER( operation->alg ) )
return( PSA_ERROR_BAD_STATE );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
mbedtls_cipher_free( &operation->ctx.cipher );
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 16:22:46 +02:00
partly pr fix
2018-04-04 14:43:05 +02:00
operation->alg = 0;
add iv_required field to psa_cipher_operation_s and fix relevant functions
2018-04-30 11:31:04 +02:00
operation->key_set = 0;
operation->iv_set = 0;
operation->iv_size = 0;
partly pr fix
2018-04-04 14:43:05 +02:00
operation->block_size = 0;
add iv_required field to psa_cipher_operation_s and fix relevant functions
2018-04-30 11:31:04 +02:00
operation->iv_required = 0;
partly pr fix
2018-04-04 14:43:05 +02:00
adjust indentation per Mbed TLS standards
2018-05-31 13:07:14 +02:00
return( PSA_SUCCESS );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 14:59:30 +01:00
}
Merge remote-tracking branch 'psa/pr/13' into feature-psa Conflicts: library/psa_crypto.c tests/suites/test_suite_psa_crypto.data tests/suites/test_suite_psa_crypto.function All the conflicts are concurrent additions where the order doesn't matter. I put the code from feature-psa (key policy) before the code from PR #13 (key lifetime).
2018-04-30 17:06:50 +02:00
Be more consistent about blank lines
2018-06-18 21:49:39 +02:00
Key Policy APIs implementation
2018-03-28 00:21:33 +02:00
/****************************************************************/
/* Key Policy */
/****************************************************************/
Style fixes
2018-07-04 14:57:00 +02:00
Modifications for psa-crypto in order to integrate with SPM Add required includes in tests and psa_crypto.c file in order to be able to compilef for the SPM solution. Some functions needed to be deprecated from psa_crypto.c since they already implemented in the SPM.
2018-07-03 12:16:15 +02:00
#if !defined(MBEDTLS_PSA_CRYPTO_SPM)
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 15:41:12 +02:00
void psa_key_policy_init( psa_key_policy_t *policy )
Key Policy APIs implementation
2018-03-28 00:21:33 +02:00
{
Change sizeof(type) to sizeof(variable)
2018-06-18 16:07:14 +02:00
memset( policy, 0, sizeof( *policy ) );
Key Policy APIs implementation
2018-03-28 00:21:33 +02:00
}
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 15:41:12 +02:00
void psa_key_policy_set_usage( psa_key_policy_t *policy,
psa_key_usage_t usage,
psa_algorithm_t alg )
Key Policy APIs implementation
2018-03-28 00:21:33 +02:00
{
add new test scenarios
2018-03-28 14:14:59 +02:00
policy->usage = usage;
policy->alg = alg;
Key Policy APIs implementation
2018-03-28 00:21:33 +02:00
}
Add missing const on policy_get_xxx function parameter
2018-07-12 00:54:56 +02:00
psa_key_usage_t psa_key_policy_get_usage( const psa_key_policy_t *policy )
Key Policy APIs implementation
2018-03-28 00:21:33 +02:00
{
Add static internal MAC finish function add new psa_mac_finish_internal() to be called by psa_mac_finish() and psa_mac_verify() in order to be able to check key usage separatly.
2018-04-02 17:34:15 +02:00
return( policy->usage );
Key Policy APIs implementation
2018-03-28 00:21:33 +02:00
}
Add missing const on policy_get_xxx function parameter
2018-07-12 00:54:56 +02:00
psa_algorithm_t psa_key_policy_get_algorithm( const psa_key_policy_t *policy )
Key Policy APIs implementation
2018-03-28 00:21:33 +02:00
{
Add static internal MAC finish function add new psa_mac_finish_internal() to be called by psa_mac_finish() and psa_mac_verify() in order to be able to check key usage separatly.
2018-04-02 17:34:15 +02:00
return( policy->alg );
Key Policy APIs implementation
2018-03-28 00:21:33 +02:00
}
Modifications for psa-crypto in order to integrate with SPM Add required includes in tests and psa_crypto.c file in order to be able to compilef for the SPM solution. Some functions needed to be deprecated from psa_crypto.c since they already implemented in the SPM.
2018-07-03 12:16:15 +02:00
#endif /* !defined(MBEDTLS_PSA_CRYPTO_SPM) */
Style fixes
2018-07-04 14:57:00 +02:00
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
psa_status_t psa_set_key_policy( psa_key_handle_t handle,
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 15:41:12 +02:00
const psa_key_policy_t *policy )
Key Policy APIs implementation
2018-03-28 00:21:33 +02:00
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *slot;
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
psa_status_t status;
Key Policy APIs implementation
2018-03-28 00:21:33 +02:00
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
if( policy == NULL )
Key Policy APIs implementation
2018-03-28 00:21:33 +02:00
return( PSA_ERROR_INVALID_ARGUMENT );
Remove trailing whitespace Only horizontal whitespace changes in this commit.
2018-05-31 13:25:48 +02:00
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
status = psa_get_empty_key_slot( handle, &slot );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
if( status != PSA_SUCCESS )
return( status );
Key Policy APIs implementation
2018-03-28 00:21:33 +02:00
Formatting improvements Avoid lines longer than 80 columns. Remove some redundant parentheses, e.g. change if( ( a == b ) && ( c == d ) ) to if( a == b && c == d ) which makes lines less long and makes the remaining parentheses more relevant. Add missing parentheses around return statements. There should be no semantic change in this commit.
2018-06-18 16:04:39 +02:00
if( ( policy->usage & ~( PSA_KEY_USAGE_EXPORT |
PSA_KEY_USAGE_ENCRYPT |
PSA_KEY_USAGE_DECRYPT |
PSA_KEY_USAGE_SIGN |
Add framework for simple key derivation New key type PSA_KEY_TYPE_DERIVE. New usage flag PSA_KEY_USAGE_DERIVE. New function psa_key_derivation. No key derivation algorithm is implemented yet. The code may not compile with -Wunused. Write some unit test code for psa_key_derivation. Most of it cannot be used yet due to the lack of a key derivation algorithm.
2018-07-12 17:17:20 +02:00
PSA_KEY_USAGE_VERIFY |
PSA_KEY_USAGE_DERIVE ) ) != 0 )
Remove usage of PSA_ERROR_INVALID_KEY_POLICY use PSA_ERROR_INVALID_ARGUMENT instead of INVALID_KEY_POLICY error
2018-04-16 13:38:57 +02:00
return( PSA_ERROR_INVALID_ARGUMENT );
Key Policy APIs implementation
2018-03-28 00:21:33 +02:00
Add static internal MAC finish function add new psa_mac_finish_internal() to be called by psa_mac_finish() and psa_mac_verify() in order to be able to check key usage separatly.
2018-04-02 17:34:15 +02:00
slot->policy = *policy;
Key Policy APIs implementation
2018-03-28 00:21:33 +02:00
return( PSA_SUCCESS );
}
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
psa_status_t psa_get_key_policy( psa_key_handle_t handle,
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 15:41:12 +02:00
psa_key_policy_t *policy )
Key Policy APIs implementation
2018-03-28 00:21:33 +02:00
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *slot;
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
psa_status_t status;
Key Policy APIs implementation
2018-03-28 00:21:33 +02:00
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
if( policy == NULL )
Key Policy APIs implementation
2018-03-28 00:21:33 +02:00
return( PSA_ERROR_INVALID_ARGUMENT );
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
status = psa_get_key_slot( handle, &slot );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
if( status != PSA_SUCCESS )
return( status );
Remove trailing whitespace Only horizontal whitespace changes in this commit.
2018-05-31 13:25:48 +02:00
Add static internal MAC finish function add new psa_mac_finish_internal() to be called by psa_mac_finish() and psa_mac_verify() in order to be able to check key usage separatly.
2018-04-02 17:34:15 +02:00
*policy = slot->policy;
Key Policy APIs implementation
2018-03-28 00:21:33 +02:00
return( PSA_SUCCESS );
}
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 22:44:14 +01:00
Merge remote-tracking branch 'psa/pr/13' into feature-psa Conflicts: library/psa_crypto.c tests/suites/test_suite_psa_crypto.data tests/suites/test_suite_psa_crypto.function All the conflicts are concurrent additions where the order doesn't matter. I put the code from feature-psa (key policy) before the code from PR #13 (key lifetime).
2018-04-30 17:06:50 +02:00
initial key lifetime implementation and tests
2018-03-20 21:44:08 +01:00
/****************************************************************/
/* Key Lifetime */
/****************************************************************/
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
psa_status_t psa_get_key_lifetime( psa_key_handle_t handle,
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 15:41:12 +02:00
psa_key_lifetime_t *lifetime )
initial key lifetime implementation and tests
2018-03-20 21:44:08 +01:00
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *slot;
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
psa_status_t status;
initial key lifetime implementation and tests
2018-03-20 21:44:08 +01:00
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
status = psa_get_key_slot( handle, &slot );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
if( status != PSA_SUCCESS )
return( status );
Remove trailing whitespace Only horizontal whitespace changes in this commit.
2018-05-31 13:25:48 +02:00
initial key lifetime implementation and tests
2018-03-20 21:44:08 +01:00
*lifetime = slot->lifetime;
return( PSA_SUCCESS );
}
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 22:44:14 +01:00
Be more consistent about blank lines
2018-06-18 21:49:39 +02:00
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 23:53:03 +02:00
/****************************************************************/
/* AEAD */
/****************************************************************/
Be more consistent about blank lines
2018-06-18 21:49:39 +02:00
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
typedef struct
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *slot;
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
const mbedtls_cipher_info_t *cipher_info;
union
{
#if defined(MBEDTLS_CCM_C)
mbedtls_ccm_context ccm;
#endif /* MBEDTLS_CCM_C */
#if defined(MBEDTLS_GCM_C)
mbedtls_gcm_context gcm;
#endif /* MBEDTLS_GCM_C */
} ctx;
Add support for non-default-tag-size AEAD (CCM and GCM)
2018-08-17 19:47:52 +02:00
psa_algorithm_t core_alg;
uint8_t full_tag_length;
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
uint8_t tag_length;
} aead_operation_t;
Fix memory leak with AEAD with non-default tag lengths When freeing the key context, choose the context format based on the base algorithm value stored in the operation object.
2018-08-21 16:38:05 +02:00
static void psa_aead_abort( aead_operation_t *operation )
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
{
Fix memory leak with AEAD with non-default tag lengths When freeing the key context, choose the context format based on the base algorithm value stored in the operation object.
2018-08-21 16:38:05 +02:00
switch( operation->core_alg )
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
{
#if defined(MBEDTLS_CCM_C)
case PSA_ALG_CCM:
mbedtls_ccm_free( &operation->ctx.ccm );
break;
#endif /* MBEDTLS_CCM_C */
Add missing compilation guards for GCM and CCM Add missing compilation guards that broke the build if either GCM or CCM was not defined. Add missing guards on test cases that require GCM or CBC. The build and tests now pass for any subset of {MBEDTLS_CCM_C, MBEDTLS_GCM_C}. There are still unused variables warnings if neither is defined.
2018-11-28 17:30:58 +01:00
#if defined(MBEDTLS_GCM_C)
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
case PSA_ALG_GCM:
mbedtls_gcm_free( &operation->ctx.gcm );
break;
#endif /* MBEDTLS_GCM_C */
}
}
static psa_status_t psa_aead_setup( aead_operation_t *operation,
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
psa_key_handle_t handle,
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
psa_key_usage_t usage,
psa_algorithm_t alg )
{
psa_status_t status;
size_t key_bits;
mbedtls_cipher_id_t cipher_id;
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
status = psa_get_key_from_slot( handle, &operation->slot, usage, alg );
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
if( status != PSA_SUCCESS )
return( status );
key_bits = psa_get_key_bits( operation->slot );
operation->cipher_info =
mbedtls_cipher_info_from_psa( alg, operation->slot->type, key_bits,
&cipher_id );
if( operation->cipher_info == NULL )
return( PSA_ERROR_NOT_SUPPORTED );
Add support for non-default-tag-size AEAD (CCM and GCM)
2018-08-17 19:47:52 +02:00
switch( PSA_ALG_AEAD_WITH_TAG_LENGTH( alg, 0 ) )
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
{
#if defined(MBEDTLS_CCM_C)
Add support for non-default-tag-size AEAD (CCM and GCM)
2018-08-17 19:47:52 +02:00
case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_CCM, 0 ):
operation->core_alg = PSA_ALG_CCM;
operation->full_tag_length = 16;
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
if( PSA_BLOCK_CIPHER_BLOCK_SIZE( operation->slot->type ) != 16 )
return( PSA_ERROR_INVALID_ARGUMENT );
mbedtls_ccm_init( &operation->ctx.ccm );
status = mbedtls_to_psa_error(
mbedtls_ccm_setkey( &operation->ctx.ccm, cipher_id,
operation->slot->data.raw.data,
(unsigned int) key_bits ) );
if( status != 0 )
goto cleanup;
break;
#endif /* MBEDTLS_CCM_C */
#if defined(MBEDTLS_GCM_C)
Add support for non-default-tag-size AEAD (CCM and GCM)
2018-08-17 19:47:52 +02:00
case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_GCM, 0 ):
operation->core_alg = PSA_ALG_GCM;
operation->full_tag_length = 16;
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
if( PSA_BLOCK_CIPHER_BLOCK_SIZE( operation->slot->type ) != 16 )
return( PSA_ERROR_INVALID_ARGUMENT );
mbedtls_gcm_init( &operation->ctx.gcm );
status = mbedtls_to_psa_error(
mbedtls_gcm_setkey( &operation->ctx.gcm, cipher_id,
operation->slot->data.raw.data,
(unsigned int) key_bits ) );
break;
#endif /* MBEDTLS_GCM_C */
default:
return( PSA_ERROR_NOT_SUPPORTED );
}
Add support for non-default-tag-size AEAD (CCM and GCM)
2018-08-17 19:47:52 +02:00
if( PSA_AEAD_TAG_LENGTH( alg ) > operation->full_tag_length )
{
status = PSA_ERROR_INVALID_ARGUMENT;
goto cleanup;
}
operation->tag_length = PSA_AEAD_TAG_LENGTH( alg );
/* CCM allows the following tag lengths: 4, 6, 8, 10, 12, 14, 16.
* GCM allows the following tag lengths: 4, 8, 12, 13, 14, 15, 16.
* In both cases, mbedtls_xxx will validate the tag length below. */
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
return( PSA_SUCCESS );
cleanup:
Fix memory leak with AEAD with non-default tag lengths When freeing the key context, choose the context format based on the base algorithm value stored in the operation object.
2018-08-21 16:38:05 +02:00
psa_aead_abort( operation );
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
return( status );
}
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
psa_status_t psa_aead_encrypt( psa_key_handle_t handle,
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 23:53:03 +02:00
psa_algorithm_t alg,
const uint8_t *nonce,
size_t nonce_length,
const uint8_t *additional_data,
size_t additional_data_length,
const uint8_t *plaintext,
size_t plaintext_length,
uint8_t *ciphertext,
size_t ciphertext_size,
size_t *ciphertext_length )
{
psa_status_t status;
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
aead_operation_t operation;
write the tag directly on the ciphertext buffer.
2018-06-03 16:19:55 +02:00
uint8_t *tag;
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 15:41:12 +02:00
set output length to zero to cover output length in error case
2018-06-03 14:05:47 +02:00
*ciphertext_length = 0;
fix condition over key type
2018-05-09 13:58:32 +02:00
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
status = psa_aead_setup( &operation, handle, PSA_KEY_USAGE_ENCRYPT, alg );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
if( status != PSA_SUCCESS )
return( status );
add Key and Algorithm validation
2018-05-09 11:24:42 +02:00
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
/* For all currently supported modes, the tag is at the end of the
* ciphertext. */
if( ciphertext_size < ( plaintext_length + operation.tag_length ) )
{
status = PSA_ERROR_BUFFER_TOO_SMALL;
goto exit;
}
tag = ciphertext + plaintext_length;
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 23:53:03 +02:00
Add missing compilation guards for GCM and CCM Add missing compilation guards that broke the build if either GCM or CCM was not defined. Add missing guards on test cases that require GCM or CBC. The build and tests now pass for any subset of {MBEDTLS_CCM_C, MBEDTLS_GCM_C}. There are still unused variables warnings if neither is defined.
2018-11-28 17:30:58 +01:00
#if defined(MBEDTLS_GCM_C)
Add support for non-default-tag-size AEAD (CCM and GCM)
2018-08-17 19:47:52 +02:00
if( operation.core_alg == PSA_ALG_GCM )
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 23:53:03 +02:00
{
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
status = mbedtls_to_psa_error(
mbedtls_gcm_crypt_and_tag( &operation.ctx.gcm,
MBEDTLS_GCM_ENCRYPT,
plaintext_length,
nonce, nonce_length,
additional_data, additional_data_length,
plaintext, ciphertext,
operation.tag_length, tag ) );
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 23:53:03 +02:00
}
Add missing compilation guards for GCM and CCM Add missing compilation guards that broke the build if either GCM or CCM was not defined. Add missing guards on test cases that require GCM or CBC. The build and tests now pass for any subset of {MBEDTLS_CCM_C, MBEDTLS_GCM_C}. There are still unused variables warnings if neither is defined.
2018-11-28 17:30:58 +01:00
else
#endif /* MBEDTLS_GCM_C */
#if defined(MBEDTLS_CCM_C)
if( operation.core_alg == PSA_ALG_CCM )
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 23:53:03 +02:00
{
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
status = mbedtls_to_psa_error(
mbedtls_ccm_encrypt_and_tag( &operation.ctx.ccm,
plaintext_length,
nonce, nonce_length,
additional_data,
additional_data_length,
plaintext, ciphertext,
tag, operation.tag_length ) );
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 23:53:03 +02:00
}
return invalid argument for unsupported algorithms
2018-05-09 14:40:09 +02:00
else
Add missing compilation guards for GCM and CCM Add missing compilation guards that broke the build if either GCM or CCM was not defined. Add missing guards on test cases that require GCM or CBC. The build and tests now pass for any subset of {MBEDTLS_CCM_C, MBEDTLS_GCM_C}. There are still unused variables warnings if neither is defined.
2018-11-28 17:30:58 +01:00
#endif /* MBEDTLS_CCM_C */
return invalid argument for unsupported algorithms
2018-05-09 14:40:09 +02:00
{
return NOT_SUPPORTED instead of INVLID_ARGUMENT
2018-06-03 14:07:38 +02:00
return( PSA_ERROR_NOT_SUPPORTED );
return invalid argument for unsupported algorithms
2018-05-09 14:40:09 +02:00
}
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 15:41:12 +02:00
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
if( status != PSA_SUCCESS && ciphertext_size != 0 )
memset( ciphertext, 0, ciphertext_size );
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 15:41:12 +02:00
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
exit:
Fix memory leak with AEAD with non-default tag lengths When freeing the key context, choose the context format based on the base algorithm value stored in the operation object.
2018-08-21 16:38:05 +02:00
psa_aead_abort( &operation );
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
if( status == PSA_SUCCESS )
*ciphertext_length = plaintext_length + operation.tag_length;
return( status );
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 23:53:03 +02:00
}
Fix psa_aead_decrypt to read the tag at the end of the ciphertext
2018-06-01 19:23:52 +02:00
/* Locate the tag in a ciphertext buffer containing the encrypted data
* followed by the tag. Return the length of the part preceding the tag in
* *plaintext_length. This is the size of the plaintext in modes where
* the encrypted data has the same size as the plaintext, such as
* CCM and GCM. */
static psa_status_t psa_aead_unpadded_locate_tag( size_t tag_length,
const uint8_t *ciphertext,
size_t ciphertext_length,
size_t plaintext_size,
const uint8_t **p_tag )
{
size_t payload_length;
if( tag_length > ciphertext_length )
return( PSA_ERROR_INVALID_ARGUMENT );
payload_length = ciphertext_length - tag_length;
if( payload_length > plaintext_size )
return( PSA_ERROR_BUFFER_TOO_SMALL );
*p_tag = ciphertext + payload_length;
return( PSA_SUCCESS );
}
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
psa_status_t psa_aead_decrypt( psa_key_handle_t handle,
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 23:53:03 +02:00
psa_algorithm_t alg,
const uint8_t *nonce,
size_t nonce_length,
const uint8_t *additional_data,
size_t additional_data_length,
const uint8_t *ciphertext,
size_t ciphertext_length,
uint8_t *plaintext,
size_t plaintext_size,
size_t *plaintext_length )
{
psa_status_t status;
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
aead_operation_t operation;
const uint8_t *tag = NULL;
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 15:41:12 +02:00
Fix psa_aead_decrypt to read the tag at the end of the ciphertext
2018-06-01 19:23:52 +02:00
*plaintext_length = 0;
Fix parameter validation
2018-04-26 11:07:35 +02:00
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
status = psa_aead_setup( &operation, handle, PSA_KEY_USAGE_DECRYPT, alg );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
if( status != PSA_SUCCESS )
return( status );
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 23:53:03 +02:00
Add missing compilation guards for GCM and CCM Add missing compilation guards that broke the build if either GCM or CCM was not defined. Add missing guards on test cases that require GCM or CBC. The build and tests now pass for any subset of {MBEDTLS_CCM_C, MBEDTLS_GCM_C}. There are still unused variables warnings if neither is defined.
2018-11-28 17:30:58 +01:00
#if defined(MBEDTLS_GCM_C)
Add support for non-default-tag-size AEAD (CCM and GCM)
2018-08-17 19:47:52 +02:00
if( operation.core_alg == PSA_ALG_GCM )
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 23:53:03 +02:00
{
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
status = psa_aead_unpadded_locate_tag( operation.tag_length,
Fix psa_aead_decrypt to read the tag at the end of the ciphertext
2018-06-01 19:23:52 +02:00
ciphertext, ciphertext_length,
remove unnecessary argument to the psa_aead_unpadded_locate_tag function
2018-06-03 16:20:42 +02:00
plaintext_size, &tag );
Fix psa_aead_decrypt to read the tag at the end of the ciphertext
2018-06-01 19:23:52 +02:00
if( status != PSA_SUCCESS )
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
goto exit;
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 23:53:03 +02:00
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
status = mbedtls_to_psa_error(
mbedtls_gcm_auth_decrypt( &operation.ctx.gcm,
ciphertext_length - operation.tag_length,
nonce, nonce_length,
additional_data,
additional_data_length,
tag, operation.tag_length,
ciphertext, plaintext ) );
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 23:53:03 +02:00
}
Add missing compilation guards for GCM and CCM Add missing compilation guards that broke the build if either GCM or CCM was not defined. Add missing guards on test cases that require GCM or CBC. The build and tests now pass for any subset of {MBEDTLS_CCM_C, MBEDTLS_GCM_C}. There are still unused variables warnings if neither is defined.
2018-11-28 17:30:58 +01:00
else
#endif /* MBEDTLS_GCM_C */
#if defined(MBEDTLS_CCM_C)
if( operation.core_alg == PSA_ALG_CCM )
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 23:53:03 +02:00
{
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
status = psa_aead_unpadded_locate_tag( operation.tag_length,
fix code offsets after rebase
2018-06-03 13:28:24 +02:00
ciphertext, ciphertext_length,
remove unnecessary argument to the psa_aead_unpadded_locate_tag function
2018-06-03 16:20:42 +02:00
plaintext_size, &tag );
fix code offsets after rebase
2018-06-03 13:28:24 +02:00
if( status != PSA_SUCCESS )
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
goto exit;
fix code offsets after rebase
2018-06-03 13:28:24 +02:00
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
status = mbedtls_to_psa_error(
mbedtls_ccm_auth_decrypt( &operation.ctx.ccm,
ciphertext_length - operation.tag_length,
nonce, nonce_length,
additional_data,
additional_data_length,
ciphertext, plaintext,
tag, operation.tag_length ) );
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 23:53:03 +02:00
}
add else for not supported algorithm
2018-06-01 13:39:53 +02:00
else
Add missing compilation guards for GCM and CCM Add missing compilation guards that broke the build if either GCM or CCM was not defined. Add missing guards on test cases that require GCM or CBC. The build and tests now pass for any subset of {MBEDTLS_CCM_C, MBEDTLS_GCM_C}. There are still unused variables warnings if neither is defined.
2018-11-28 17:30:58 +01:00
#endif /* MBEDTLS_CCM_C */
add else for not supported algorithm
2018-06-01 13:39:53 +02:00
{
return NOT_SUPPORTED instead of INVLID_ARGUMENT
2018-06-03 14:07:38 +02:00
return( PSA_ERROR_NOT_SUPPORTED );
add else for not supported algorithm
2018-06-01 13:39:53 +02:00
}
Whitespace fixes Changed indentation to match Mbed TLS style. Wrapped some lines to 80 columns.
2018-06-01 16:28:30 +02:00
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
if( status != PSA_SUCCESS && plaintext_size != 0 )
memset( plaintext, 0, plaintext_size );
remove unnecessary argument to the psa_aead_unpadded_locate_tag function
2018-06-03 16:20:42 +02:00
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
exit:
Fix memory leak with AEAD with non-default tag lengths When freeing the key context, choose the context format based on the base algorithm value stored in the operation object.
2018-08-21 16:38:05 +02:00
psa_aead_abort( &operation );
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 18:11:56 +02:00
if( status == PSA_SUCCESS )
*plaintext_length = ciphertext_length - operation.tag_length;
return( status );
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 23:53:03 +02:00
}
Merge remote-tracking branch 'psa/pr/13' into feature-psa Conflicts: library/psa_crypto.c tests/suites/test_suite_psa_crypto.data tests/suites/test_suite_psa_crypto.function All the conflicts are concurrent additions where the order doesn't matter. I put the code from feature-psa (key policy) before the code from PR #13 (key lifetime).
2018-04-30 17:06:50 +02:00
Be more consistent about blank lines
2018-06-18 21:49:39 +02:00
Implement psa_generate_random
2018-06-19 22:00:52 +02:00
/****************************************************************/
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
/* Generators */
/****************************************************************/
psa_status_t psa_generator_abort( psa_crypto_generator_t *generator )
{
psa_status_t status = PSA_SUCCESS;
if( generator->alg == 0 )
{
/* The object has (apparently) been initialized but it is not
* in use. It's ok to call abort on such an object, and there's
* nothing to do. */
}
else
Implement PSA_ALG_SELECT_RAW
2018-09-18 12:05:44 +02:00
if( generator->alg == PSA_ALG_SELECT_RAW )
{
if( generator->ctx.buffer.data != NULL )
{
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 18:14:53 +01:00
mbedtls_platform_zeroize( generator->ctx.buffer.data,
Implement PSA_ALG_SELECT_RAW
2018-09-18 12:05:44 +02:00
generator->ctx.buffer.size );
mbedtls_free( generator->ctx.buffer.data );
}
}
else
Implement HKDF
2018-07-12 17:22:21 +02:00
#if defined(MBEDTLS_MD_C)
if( PSA_ALG_IS_HKDF( generator->alg ) )
{
mbedtls_free( generator->ctx.hkdf.info );
status = psa_hmac_abort_internal( &generator->ctx.hkdf.hmac );
}
Add implementation of TLS-1.2 PSK-to-MS key derivation
2018-11-16 12:35:34 +01:00
else if( PSA_ALG_IS_TLS12_PRF( generator->alg ) ||
/* TLS-1.2 PSK-to-MS KDF uses the same generator as TLS-1.2 PRF */
PSA_ALG_IS_TLS12_PSK_TO_MS( generator->alg ) )
Add implementation of TLS-1.2 PRF
2018-10-09 18:33:01 +02:00
{
if( generator->ctx.tls12_prf.key != NULL )
{
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 18:14:53 +01:00
mbedtls_platform_zeroize( generator->ctx.tls12_prf.key,
Add implementation of TLS-1.2 PRF
2018-10-09 18:33:01 +02:00
generator->ctx.tls12_prf.key_len );
mbedtls_free( generator->ctx.tls12_prf.key );
}
Dynamically allocate `A(i) + seed` buffer for TLS-1.2 PRF
2018-11-13 21:50:45 +01:00
if( generator->ctx.tls12_prf.Ai_with_seed != NULL )
{
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 18:14:53 +01:00
mbedtls_platform_zeroize( generator->ctx.tls12_prf.Ai_with_seed,
Dynamically allocate `A(i) + seed` buffer for TLS-1.2 PRF
2018-11-13 21:50:45 +01:00
generator->ctx.tls12_prf.Ai_with_seed_len );
mbedtls_free( generator->ctx.tls12_prf.Ai_with_seed );
}
Add implementation of TLS-1.2 PRF
2018-10-09 18:33:01 +02:00
}
Implement HKDF
2018-07-12 17:22:21 +02:00
else
#endif /* MBEDTLS_MD_C */
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
{
status = PSA_ERROR_BAD_STATE;
}
memset( generator, 0, sizeof( *generator ) );
return( status );
}
psa_status_t psa_get_generator_capacity(const psa_crypto_generator_t *generator,
size_t *capacity)
{
*capacity = generator->capacity;
return( PSA_SUCCESS );
}
Implement HKDF
2018-07-12 17:22:21 +02:00
#if defined(MBEDTLS_MD_C)
/* Read some bytes from an HKDF-based generator. This performs a chunk
* of the expand phase of the HKDF algorithm. */
static psa_status_t psa_generator_hkdf_read( psa_hkdf_generator_t *hkdf,
psa_algorithm_t hash_alg,
uint8_t *output,
size_t output_length )
{
uint8_t hash_length = PSA_HASH_SIZE( hash_alg );
psa_status_t status;
while( output_length != 0 )
{
/* Copy what remains of the current block */
uint8_t n = hash_length - hkdf->offset_in_block;
if( n > output_length )
n = (uint8_t) output_length;
memcpy( output, hkdf->output_block + hkdf->offset_in_block, n );
output += n;
output_length -= n;
hkdf->offset_in_block += n;
HKDF: be more robust if we reach the maximum ouptut length In psa_generator_hkdf_read, return BAD_STATE if we're trying to construct more output than the algorithm allows. This can't happen through the API due to the capacity limit, but it could potentially happen in an internal call. Also add a test case that verifies that we can set up HKDF with its maximum capacity and read up to the maximum capacity.
2018-07-17 21:06:59 +02:00
if( output_length == 0 )
Implement HKDF
2018-07-12 17:22:21 +02:00
break;
HKDF: be more robust if we reach the maximum ouptut length In psa_generator_hkdf_read, return BAD_STATE if we're trying to construct more output than the algorithm allows. This can't happen through the API due to the capacity limit, but it could potentially happen in an internal call. Also add a test case that verifies that we can set up HKDF with its maximum capacity and read up to the maximum capacity.
2018-07-17 21:06:59 +02:00
/* We can't be wanting more output after block 0xff, otherwise
* the capacity check in psa_generator_read() would have
* prevented this call. It could happen only if the generator
* object was corrupted or if this function is called directly
* inside the library. */
if( hkdf->block_number == 0xff )
return( PSA_ERROR_BAD_STATE );
Implement HKDF
2018-07-12 17:22:21 +02:00
/* We need a new block */
++hkdf->block_number;
hkdf->offset_in_block = 0;
status = psa_hmac_setup_internal( &hkdf->hmac,
hkdf->prk, hash_length,
hash_alg );
if( status != PSA_SUCCESS )
return( status );
if( hkdf->block_number != 1 )
{
status = psa_hash_update( &hkdf->hmac.hash_ctx,
hkdf->output_block,
hash_length );
if( status != PSA_SUCCESS )
return( status );
}
status = psa_hash_update( &hkdf->hmac.hash_ctx,
hkdf->info,
hkdf->info_length );
if( status != PSA_SUCCESS )
return( status );
status = psa_hash_update( &hkdf->hmac.hash_ctx,
&hkdf->block_number, 1 );
if( status != PSA_SUCCESS )
return( status );
status = psa_hmac_finish_internal( &hkdf->hmac,
hkdf->output_block,
sizeof( hkdf->output_block ) );
if( status != PSA_SUCCESS )
return( status );
}
return( PSA_SUCCESS );
}
Add implementation of TLS-1.2 PRF
2018-10-09 18:33:01 +02:00
static psa_status_t psa_generator_tls12_prf_generate_next_block(
psa_tls12_prf_generator_t *tls12_prf,
psa_algorithm_t alg )
{
psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( alg );
uint8_t hash_length = PSA_HASH_SIZE( hash_alg );
psa_hmac_internal_data hmac;
psa_status_t status, cleanup_status;
Simplify psa_generator_tls12_prf_generate_next_block()
2018-11-13 21:56:14 +01:00
unsigned char *Ai;
size_t Ai_len;
Add implementation of TLS-1.2 PRF
2018-10-09 18:33:01 +02:00
/* We can't be wanting more output after block 0xff, otherwise
* the capacity check in psa_generator_read() would have
* prevented this call. It could happen only if the generator
* object was corrupted or if this function is called directly
* inside the library. */
if( tls12_prf->block_number == 0xff )
return( PSA_ERROR_BAD_STATE );
/* We need a new block */
++tls12_prf->block_number;
tls12_prf->offset_in_block = 0;
/* Recall the definition of the TLS-1.2-PRF from RFC 5246:
*
* PRF(secret, label, seed) = P_<hash>(secret, label + seed)
*
* P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
* HMAC_hash(secret, A(2) + seed) +
* HMAC_hash(secret, A(3) + seed) + ...
*
* A(0) = seed
* A(i) = HMAC_hash( secret, A(i-1) )
*
* The `psa_tls12_prf_generator` structures saves the block
* `HMAC_hash(secret, A(i) + seed)` from which the output
* is currently extracted as `output_block`, while
* `A(i) + seed` is stored in `Ai_with_seed`.
*
* Generating a new block means recalculating `Ai_with_seed`
* from the A(i)-part of it, and afterwards recalculating
* `output_block`.
*
* A(0) is computed at setup time.
*
*/
psa_hmac_init_internal( &hmac );
/* We must distinguish the calculation of A(1) from those
* of A(2) and higher, because A(0)=seed has a different
* length than the other A(i). */
if( tls12_prf->block_number == 1 )
{
Simplify psa_generator_tls12_prf_generate_next_block()
2018-11-13 21:56:14 +01:00
Ai = tls12_prf->Ai_with_seed + hash_length;
Ai_len = tls12_prf->Ai_with_seed_len - hash_length;
Add implementation of TLS-1.2 PRF
2018-10-09 18:33:01 +02:00
}
else
{
Simplify psa_generator_tls12_prf_generate_next_block()
2018-11-13 21:56:14 +01:00
Ai = tls12_prf->Ai_with_seed;
Ai_len = hash_length;
}
Add implementation of TLS-1.2 PRF
2018-10-09 18:33:01 +02:00
Simplify psa_generator_tls12_prf_generate_next_block()
2018-11-13 21:56:14 +01:00
/* Compute A(i+1) = HMAC_hash(secret, A(i)) */
status = psa_hmac_setup_internal( &hmac,
tls12_prf->key,
tls12_prf->key_len,
hash_alg );
if( status != PSA_SUCCESS )
goto cleanup;
Add implementation of TLS-1.2 PRF
2018-10-09 18:33:01 +02:00
Simplify psa_generator_tls12_prf_generate_next_block()
2018-11-13 21:56:14 +01:00
status = psa_hash_update( &hmac.hash_ctx,
Ai, Ai_len );
if( status != PSA_SUCCESS )
goto cleanup;
status = psa_hmac_finish_internal( &hmac,
tls12_prf->Ai_with_seed,
hash_length );
if( status != PSA_SUCCESS )
goto cleanup;
Add implementation of TLS-1.2 PRF
2018-10-09 18:33:01 +02:00
/* Compute the next block `HMAC_hash(secret, A(i+1) + seed)`. */
status = psa_hmac_setup_internal( &hmac,
tls12_prf->key,
tls12_prf->key_len,
hash_alg );
if( status != PSA_SUCCESS )
goto cleanup;
status = psa_hash_update( &hmac.hash_ctx,
tls12_prf->Ai_with_seed,
Dynamically allocate `A(i) + seed` buffer for TLS-1.2 PRF
2018-11-13 21:50:45 +01:00
tls12_prf->Ai_with_seed_len );
Add implementation of TLS-1.2 PRF
2018-10-09 18:33:01 +02:00
if( status != PSA_SUCCESS )
goto cleanup;
status = psa_hmac_finish_internal( &hmac,
tls12_prf->output_block,
hash_length );
if( status != PSA_SUCCESS )
goto cleanup;
cleanup:
cleanup_status = psa_hmac_abort_internal( &hmac );
if( status == PSA_SUCCESS && cleanup_status != PSA_SUCCESS )
status = cleanup_status;
return( status );
}
/* Read some bytes from an TLS-1.2-PRF-based generator.
* See Section 5 of RFC 5246. */
static psa_status_t psa_generator_tls12_prf_read(
psa_tls12_prf_generator_t *tls12_prf,
psa_algorithm_t alg,
uint8_t *output,
size_t output_length )
{
psa_algorithm_t hash_alg = PSA_ALG_TLS12_PRF_GET_HASH( alg );
uint8_t hash_length = PSA_HASH_SIZE( hash_alg );
psa_status_t status;
while( output_length != 0 )
{
/* Copy what remains of the current block */
uint8_t n = hash_length - tls12_prf->offset_in_block;
/* Check if we have fully processed the current block. */
if( n == 0 )
{
status = psa_generator_tls12_prf_generate_next_block( tls12_prf,
alg );
if( status != PSA_SUCCESS )
return( status );
continue;
}
if( n > output_length )
n = (uint8_t) output_length;
memcpy( output, tls12_prf->output_block + tls12_prf->offset_in_block,
n );
output += n;
output_length -= n;
tls12_prf->offset_in_block += n;
}
return( PSA_SUCCESS );
}
Implement HKDF
2018-07-12 17:22:21 +02:00
#endif /* MBEDTLS_MD_C */
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
psa_status_t psa_generator_read( psa_crypto_generator_t *generator,
uint8_t *output,
size_t output_length )
{
psa_status_t status;
if( output_length > generator->capacity )
{
generator->capacity = 0;
/* Go through the error path to wipe all confidential data now
* that the generator object is useless. */
status = PSA_ERROR_INSUFFICIENT_CAPACITY;
goto exit;
}
if( output_length == 0 &&
generator->capacity == 0 && generator->alg == 0 )
{
/* Edge case: this is a blank or finished generator, and 0
* bytes were requested. The right error in this case could
* be either INSUFFICIENT_CAPACITY or BAD_STATE. Return
* INSUFFICIENT_CAPACITY, which is right for a finished
* generator, for consistency with the case when
* output_length > 0. */
return( PSA_ERROR_INSUFFICIENT_CAPACITY );
}
generator->capacity -= output_length;
Implement PSA_ALG_SELECT_RAW
2018-09-18 12:05:44 +02:00
if( generator->alg == PSA_ALG_SELECT_RAW )
{
Document that key agreement produces a maximum-capacity generator
2018-10-25 22:22:31 +02:00
/* Initially, the capacity of a selection generator is always
* the size of the buffer, i.e. `generator->ctx.buffer.size`,
* abbreviated in this comment as `size`. When the remaining
* capacity is `c`, the next bytes to serve start `c` bytes
* from the end of the buffer, i.e. `size - c` from the
* beginning of the buffer. Since `generator->capacity` was just
* decremented above, we need to serve the bytes from
* `size - generator->capacity - output_length` to
* `size - generator->capacity`. */
Implement PSA_ALG_SELECT_RAW
2018-09-18 12:05:44 +02:00
size_t offset =
generator->ctx.buffer.size - generator->capacity - output_length;
memcpy( output, generator->ctx.buffer.data + offset, output_length );
status = PSA_SUCCESS;
}
else
Implement HKDF
2018-07-12 17:22:21 +02:00
#if defined(MBEDTLS_MD_C)
if( PSA_ALG_IS_HKDF( generator->alg ) )
{
psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( generator->alg );
status = psa_generator_hkdf_read( &generator->ctx.hkdf, hash_alg,
output, output_length );
}
Add implementation of TLS-1.2 PSK-to-MS key derivation
2018-11-16 12:35:34 +01:00
else if( PSA_ALG_IS_TLS12_PRF( generator->alg ) ||
PSA_ALG_IS_TLS12_PSK_TO_MS( generator->alg ) )
Add implementation of TLS-1.2 PRF
2018-10-09 18:33:01 +02:00
{
status = psa_generator_tls12_prf_read( &generator->ctx.tls12_prf,
generator->alg, output,
output_length );
}
Implement HKDF
2018-07-12 17:22:21 +02:00
else
#endif /* MBEDTLS_MD_C */
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
{
return( PSA_ERROR_BAD_STATE );
}
exit:
if( status != PSA_SUCCESS )
{
psa_generator_abort( generator );
memset( output, '!', output_length );
}
return( status );
}
Fix psa_generator_import_key for DES In psa_generator_import_key, if generating a DES or 3DES key, set the parity bits. Add tests for deriving a DES key. Also test deriving an AES key while I'm at it.
2018-07-19 17:05:42 +02:00
#if defined(MBEDTLS_DES_C)
static void psa_des_set_key_parity( uint8_t *data, size_t data_size )
{
if( data_size >= 8 )
mbedtls_des_key_set_parity( data );
if( data_size >= 16 )
mbedtls_des_key_set_parity( data + 8 );
if( data_size >= 24 )
mbedtls_des_key_set_parity( data + 16 );
}
#endif /* MBEDTLS_DES_C */
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
psa_status_t psa_generator_import_key( psa_key_handle_t handle,
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
psa_key_type_t type,
size_t bits,
psa_crypto_generator_t *generator )
{
uint8_t *data = NULL;
size_t bytes = PSA_BITS_TO_BYTES( bits );
psa_status_t status;
if( ! key_type_is_raw_bytes( type ) )
return( PSA_ERROR_INVALID_ARGUMENT );
if( bits % 8 != 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
data = mbedtls_calloc( 1, bytes );
if( data == NULL )
return( PSA_ERROR_INSUFFICIENT_MEMORY );
status = psa_generator_read( generator, data, bytes );
if( status != PSA_SUCCESS )
goto exit;
Fix psa_generator_import_key for DES In psa_generator_import_key, if generating a DES or 3DES key, set the parity bits. Add tests for deriving a DES key. Also test deriving an AES key while I'm at it.
2018-07-19 17:05:42 +02:00
#if defined(MBEDTLS_DES_C)
if( type == PSA_KEY_TYPE_DES )
psa_des_set_key_parity( data, bytes );
#endif /* MBEDTLS_DES_C */
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
status = psa_import_key( handle, type, data, bytes );
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
exit:
mbedtls_free( data );
return( status );
}
Add framework for simple key derivation New key type PSA_KEY_TYPE_DERIVE. New usage flag PSA_KEY_USAGE_DERIVE. New function psa_key_derivation. No key derivation algorithm is implemented yet. The code may not compile with -Wunused. Write some unit test code for psa_key_derivation. Most of it cannot be used yet due to the lack of a key derivation algorithm.
2018-07-12 17:17:20 +02:00
/****************************************************************/
/* Key derivation */
/****************************************************************/
Add some missing compilation guards Add missing checks for defined(MBEDTLS_MD_C) around types and functions that require it (HMAC, HKDF, TLS12_PRF). Add missing checks for defined(MBEDTLS_ECDSA_DETERMINISTIC) around code that calls mbedtls_ecdsa_sign_det(). Add missing checks for defined(MBEDTLS_ECDH_C) around ECDH-specific functions.
2018-11-16 16:02:56 +01:00
#if defined(MBEDTLS_MD_C)
Implement HKDF
2018-07-12 17:22:21 +02:00
/* Set up an HKDF-based generator. This is exactly the extract phase
Add missing cleanup on failure in psa_key_agreement If psa_key_derivation_internal() fails, it's up to the caller to clean up. Do this, and add a note at the top of psa_key_derivation_internal() and its auxiliary functions. There is no non-regression test because at the moment the only way to trigger an error is a borderline low-memory condition and we don't have the means to trigger this.
2018-11-16 16:05:06 +01:00
* of the HKDF algorithm.
*
* Note that if this function fails, you must call psa_generator_abort()
* to potentially free embedded data structures and wipe confidential data.
*/
Implement HKDF
2018-07-12 17:22:21 +02:00
static psa_status_t psa_generator_hkdf_setup( psa_hkdf_generator_t *hkdf,
Split off psa_key_derivation_internal Refactor psa_key_derivation to prepare for key agreement algorithms which need to plug into key derivation after argument validation.
2018-09-18 12:03:52 +02:00
const uint8_t *secret,
size_t secret_length,
Implement HKDF
2018-07-12 17:22:21 +02:00
psa_algorithm_t hash_alg,
const uint8_t *salt,
size_t salt_length,
const uint8_t *label,
size_t label_length )
{
psa_status_t status;
status = psa_hmac_setup_internal( &hkdf->hmac,
salt, salt_length,
Rename PSA_ALG_HMAC_HASH to PSA_ALG_HMAC_GET_HASH Be consistent with other GET_HASH macros.
2018-08-22 18:25:41 +02:00
PSA_ALG_HMAC_GET_HASH( hash_alg ) );
Implement HKDF
2018-07-12 17:22:21 +02:00
if( status != PSA_SUCCESS )
return( status );
Split off psa_key_derivation_internal Refactor psa_key_derivation to prepare for key agreement algorithms which need to plug into key derivation after argument validation.
2018-09-18 12:03:52 +02:00
status = psa_hash_update( &hkdf->hmac.hash_ctx, secret, secret_length );
Implement HKDF
2018-07-12 17:22:21 +02:00
if( status != PSA_SUCCESS )
return( status );
status = psa_hmac_finish_internal( &hkdf->hmac,
hkdf->prk,
sizeof( hkdf->prk ) );
if( status != PSA_SUCCESS )
return( status );
hkdf->offset_in_block = PSA_HASH_SIZE( hash_alg );
hkdf->block_number = 0;
hkdf->info_length = label_length;
if( label_length != 0 )
{
hkdf->info = mbedtls_calloc( 1, label_length );
if( hkdf->info == NULL )
return( PSA_ERROR_INSUFFICIENT_MEMORY );
memcpy( hkdf->info, label, label_length );
}
return( PSA_SUCCESS );
}
Add some missing compilation guards Add missing checks for defined(MBEDTLS_MD_C) around types and functions that require it (HMAC, HKDF, TLS12_PRF). Add missing checks for defined(MBEDTLS_ECDSA_DETERMINISTIC) around code that calls mbedtls_ecdsa_sign_det(). Add missing checks for defined(MBEDTLS_ECDH_C) around ECDH-specific functions.
2018-11-16 16:02:56 +01:00
#endif /* MBEDTLS_MD_C */
Implement HKDF
2018-07-12 17:22:21 +02:00
Add some missing compilation guards Add missing checks for defined(MBEDTLS_MD_C) around types and functions that require it (HMAC, HKDF, TLS12_PRF). Add missing checks for defined(MBEDTLS_ECDSA_DETERMINISTIC) around code that calls mbedtls_ecdsa_sign_det(). Add missing checks for defined(MBEDTLS_ECDH_C) around ECDH-specific functions.
2018-11-16 16:02:56 +01:00
#if defined(MBEDTLS_MD_C)
Add missing cleanup on failure in psa_key_agreement If psa_key_derivation_internal() fails, it's up to the caller to clean up. Do this, and add a note at the top of psa_key_derivation_internal() and its auxiliary functions. There is no non-regression test because at the moment the only way to trigger an error is a borderline low-memory condition and we don't have the means to trigger this.
2018-11-16 16:05:06 +01:00
/* Set up a TLS-1.2-prf-based generator (see RFC 5246, Section 5).
*
* Note that if this function fails, you must call psa_generator_abort()
* to potentially free embedded data structures and wipe confidential data.
*/
Add implementation of TLS-1.2 PRF
2018-10-09 18:33:01 +02:00
static psa_status_t psa_generator_tls12_prf_setup(
psa_tls12_prf_generator_t *tls12_prf,
const unsigned char *key,
size_t key_len,
psa_algorithm_t hash_alg,
const uint8_t *salt,
size_t salt_length,
const uint8_t *label,
size_t label_length )
{
uint8_t hash_length = PSA_HASH_SIZE( hash_alg );
Dynamically allocate `A(i) + seed` buffer for TLS-1.2 PRF
2018-11-13 21:50:45 +01:00
size_t Ai_with_seed_len = hash_length + salt_length + label_length;
int overflow;
Add implementation of TLS-1.2 PRF
2018-10-09 18:33:01 +02:00
tls12_prf->key = mbedtls_calloc( 1, key_len );
if( tls12_prf->key == NULL )
return( PSA_ERROR_INSUFFICIENT_MEMORY );
tls12_prf->key_len = key_len;
memcpy( tls12_prf->key, key, key_len );
Dynamically allocate `A(i) + seed` buffer for TLS-1.2 PRF
2018-11-13 21:50:45 +01:00
overflow = ( salt_length + label_length < salt_length ) ||
( salt_length + label_length + hash_length < hash_length );
if( overflow )
return( PSA_ERROR_INVALID_ARGUMENT );
tls12_prf->Ai_with_seed = mbedtls_calloc( 1, Ai_with_seed_len );
if( tls12_prf->Ai_with_seed == NULL )
return( PSA_ERROR_INSUFFICIENT_MEMORY );
tls12_prf->Ai_with_seed_len = Ai_with_seed_len;
Add implementation of TLS-1.2 PRF
2018-10-09 18:33:01 +02:00
/* Write `label + seed' at the end of the `A(i) + seed` buffer,
* leaving the initial `hash_length` bytes unspecified for now. */
Don't call memcpy() with 0-length arguments The standard prohibits calling memcpy() with NULL pointer arguments, even if the size argument is 0. The TLS-1.2 PRF generator setup function previously called memcpy() with the label and salt as the source, even if they were of length 0, as exercised by the derive_key_policy test case in the PSA crypto test suite. This commit adds guards around the memcpy() calls so that they are only executed of salt or label have positive length, respectively.
2018-11-15 10:53:57 +01:00
if( label_length != 0 )
{
memcpy( tls12_prf->Ai_with_seed + hash_length,
label, label_length );
}
if( salt_length != 0 )
{
memcpy( tls12_prf->Ai_with_seed + hash_length + label_length,
salt, salt_length );
}
Add implementation of TLS-1.2 PRF
2018-10-09 18:33:01 +02:00
/* The first block gets generated when
* psa_generator_read() is called. */
tls12_prf->block_number = 0;
tls12_prf->offset_in_block = hash_length;
return( PSA_SUCCESS );
}
Add implementation of TLS-1.2 PSK-to-MS key derivation
2018-11-16 12:35:34 +01:00
/* Set up a TLS-1.2-PSK-to-MS-based generator. */
static psa_status_t psa_generator_tls12_psk_to_ms_setup(
psa_tls12_prf_generator_t *tls12_prf,
const unsigned char *psk,
size_t psk_len,
psa_algorithm_t hash_alg,
const uint8_t *salt,
size_t salt_length,
const uint8_t *label,
size_t label_length )
{
psa_status_t status;
unsigned char pms[ 4 + 2 * PSA_ALG_TLS12_PSK_TO_MS_MAX_PSK_LEN ];
if( psk_len > PSA_ALG_TLS12_PSK_TO_MS_MAX_PSK_LEN )
return( PSA_ERROR_INVALID_ARGUMENT );
/* Quoting RFC 4279, Section 2:
*
* The premaster secret is formed as follows: if the PSK is N octets
* long, concatenate a uint16 with the value N, N zero octets, a second
* uint16 with the value N, and the PSK itself.
*/
pms[0] = ( psk_len >> 8 ) & 0xff;
pms[1] = ( psk_len >> 0 ) & 0xff;
memset( pms + 2, 0, psk_len );
pms[2 + psk_len + 0] = pms[0];
pms[2 + psk_len + 1] = pms[1];
memcpy( pms + 4 + psk_len, psk, psk_len );
status = psa_generator_tls12_prf_setup( tls12_prf,
pms, 4 + 2 * psk_len,
hash_alg,
salt, salt_length,
label, label_length );
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 18:14:53 +01:00
mbedtls_platform_zeroize( pms, sizeof( pms ) );
Add implementation of TLS-1.2 PSK-to-MS key derivation
2018-11-16 12:35:34 +01:00
return( status );
}
Add some missing compilation guards Add missing checks for defined(MBEDTLS_MD_C) around types and functions that require it (HMAC, HKDF, TLS12_PRF). Add missing checks for defined(MBEDTLS_ECDSA_DETERMINISTIC) around code that calls mbedtls_ecdsa_sign_det(). Add missing checks for defined(MBEDTLS_ECDH_C) around ECDH-specific functions.
2018-11-16 16:02:56 +01:00
#endif /* MBEDTLS_MD_C */
Add implementation of TLS-1.2 PRF
2018-10-09 18:33:01 +02:00
Add missing cleanup on failure in psa_key_agreement If psa_key_derivation_internal() fails, it's up to the caller to clean up. Do this, and add a note at the top of psa_key_derivation_internal() and its auxiliary functions. There is no non-regression test because at the moment the only way to trigger an error is a borderline low-memory condition and we don't have the means to trigger this.
2018-11-16 16:05:06 +01:00
/* Note that if this function fails, you must call psa_generator_abort()
* to potentially free embedded data structures and wipe confidential data.
*/
Split off psa_key_derivation_internal Refactor psa_key_derivation to prepare for key agreement algorithms which need to plug into key derivation after argument validation.
2018-09-18 12:03:52 +02:00
static psa_status_t psa_key_derivation_internal(
psa_crypto_generator_t *generator,
const uint8_t *secret, size_t secret_length,
psa_algorithm_t alg,
const uint8_t *salt, size_t salt_length,
const uint8_t *label, size_t label_length,
size_t capacity )
Add framework for simple key derivation New key type PSA_KEY_TYPE_DERIVE. New usage flag PSA_KEY_USAGE_DERIVE. New function psa_key_derivation. No key derivation algorithm is implemented yet. The code may not compile with -Wunused. Write some unit test code for psa_key_derivation. Most of it cannot be used yet due to the lack of a key derivation algorithm.
2018-07-12 17:17:20 +02:00
{
psa_status_t status;
Split off psa_key_derivation_internal Refactor psa_key_derivation to prepare for key agreement algorithms which need to plug into key derivation after argument validation.
2018-09-18 12:03:52 +02:00
size_t max_capacity;
Add framework for simple key derivation New key type PSA_KEY_TYPE_DERIVE. New usage flag PSA_KEY_USAGE_DERIVE. New function psa_key_derivation. No key derivation algorithm is implemented yet. The code may not compile with -Wunused. Write some unit test code for psa_key_derivation. Most of it cannot be used yet due to the lack of a key derivation algorithm.
2018-07-12 17:17:20 +02:00
Split off psa_key_derivation_internal Refactor psa_key_derivation to prepare for key agreement algorithms which need to plug into key derivation after argument validation.
2018-09-18 12:03:52 +02:00
/* Set generator->alg even on failure so that abort knows what to do. */
generator->alg = alg;
Add framework for simple key derivation New key type PSA_KEY_TYPE_DERIVE. New usage flag PSA_KEY_USAGE_DERIVE. New function psa_key_derivation. No key derivation algorithm is implemented yet. The code may not compile with -Wunused. Write some unit test code for psa_key_derivation. Most of it cannot be used yet due to the lack of a key derivation algorithm.
2018-07-12 17:17:20 +02:00
Implement PSA_ALG_SELECT_RAW
2018-09-18 12:05:44 +02:00
if( alg == PSA_ALG_SELECT_RAW )
{
Add some missing compilation guards Add missing checks for defined(MBEDTLS_MD_C) around types and functions that require it (HMAC, HKDF, TLS12_PRF). Add missing checks for defined(MBEDTLS_ECDSA_DETERMINISTIC) around code that calls mbedtls_ecdsa_sign_det(). Add missing checks for defined(MBEDTLS_ECDH_C) around ECDH-specific functions.
2018-11-16 16:02:56 +01:00
(void) salt;
Implement PSA_ALG_SELECT_RAW
2018-09-18 12:05:44 +02:00
if( salt_length != 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
Add some missing compilation guards Add missing checks for defined(MBEDTLS_MD_C) around types and functions that require it (HMAC, HKDF, TLS12_PRF). Add missing checks for defined(MBEDTLS_ECDSA_DETERMINISTIC) around code that calls mbedtls_ecdsa_sign_det(). Add missing checks for defined(MBEDTLS_ECDH_C) around ECDH-specific functions.
2018-11-16 16:02:56 +01:00
(void) label;
Implement PSA_ALG_SELECT_RAW
2018-09-18 12:05:44 +02:00
if( label_length != 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
generator->ctx.buffer.data = mbedtls_calloc( 1, secret_length );
if( generator->ctx.buffer.data == NULL )
return( PSA_ERROR_INSUFFICIENT_MEMORY );
memcpy( generator->ctx.buffer.data, secret, secret_length );
generator->ctx.buffer.size = secret_length;
max_capacity = secret_length;
status = PSA_SUCCESS;
}
else
Implement HKDF
2018-07-12 17:22:21 +02:00
#if defined(MBEDTLS_MD_C)
if( PSA_ALG_IS_HKDF( alg ) )
{
psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( alg );
size_t hash_size = PSA_HASH_SIZE( hash_alg );
if( hash_size == 0 )
return( PSA_ERROR_NOT_SUPPORTED );
Split off psa_key_derivation_internal Refactor psa_key_derivation to prepare for key agreement algorithms which need to plug into key derivation after argument validation.
2018-09-18 12:03:52 +02:00
max_capacity = 255 * hash_size;
Implement HKDF
2018-07-12 17:22:21 +02:00
status = psa_generator_hkdf_setup( &generator->ctx.hkdf,
Split off psa_key_derivation_internal Refactor psa_key_derivation to prepare for key agreement algorithms which need to plug into key derivation after argument validation.
2018-09-18 12:03:52 +02:00
secret, secret_length,
Implement HKDF
2018-07-12 17:22:21 +02:00
hash_alg,
salt, salt_length,
label, label_length );
}
Add implementation of TLS-1.2 PSK-to-MS key derivation
2018-11-16 12:35:34 +01:00
/* TLS-1.2 PRF and TLS-1.2 PSK-to-MS are very similar, so share code. */
else if( PSA_ALG_IS_TLS12_PRF( alg ) ||
PSA_ALG_IS_TLS12_PSK_TO_MS( alg ) )
Add implementation of TLS-1.2 PRF
2018-10-09 18:33:01 +02:00
{
psa_algorithm_t hash_alg = PSA_ALG_TLS12_PRF_GET_HASH( alg );
size_t hash_size = PSA_HASH_SIZE( hash_alg );
/* TLS-1.2 PRF supports only SHA-256 and SHA-384. */
if( hash_alg != PSA_ALG_SHA_256 &&
hash_alg != PSA_ALG_SHA_384 )
{
return( PSA_ERROR_NOT_SUPPORTED );
}
max_capacity = 255 * hash_size;
Add implementation of TLS-1.2 PSK-to-MS key derivation
2018-11-16 12:35:34 +01:00
if( PSA_ALG_IS_TLS12_PRF( alg ) )
{
status = psa_generator_tls12_prf_setup( &generator->ctx.tls12_prf,
secret, secret_length,
hash_alg, salt, salt_length,
label, label_length );
}
else
{
status = psa_generator_tls12_psk_to_ms_setup(
&generator->ctx.tls12_prf,
secret, secret_length,
hash_alg, salt, salt_length,
label, label_length );
}
Add implementation of TLS-1.2 PRF
2018-10-09 18:33:01 +02:00
}
Implement HKDF
2018-07-12 17:22:21 +02:00
else
#endif
Add framework for simple key derivation New key type PSA_KEY_TYPE_DERIVE. New usage flag PSA_KEY_USAGE_DERIVE. New function psa_key_derivation. No key derivation algorithm is implemented yet. The code may not compile with -Wunused. Write some unit test code for psa_key_derivation. Most of it cannot be used yet due to the lack of a key derivation algorithm.
2018-07-12 17:17:20 +02:00
{
return( PSA_ERROR_NOT_SUPPORTED );
}
Split off psa_key_derivation_internal Refactor psa_key_derivation to prepare for key agreement algorithms which need to plug into key derivation after argument validation.
2018-09-18 12:03:52 +02:00
if( status != PSA_SUCCESS )
return( status );
if( capacity <= max_capacity )
Add framework for simple key derivation New key type PSA_KEY_TYPE_DERIVE. New usage flag PSA_KEY_USAGE_DERIVE. New function psa_key_derivation. No key derivation algorithm is implemented yet. The code may not compile with -Wunused. Write some unit test code for psa_key_derivation. Most of it cannot be used yet due to the lack of a key derivation algorithm.
2018-07-12 17:17:20 +02:00
generator->capacity = capacity;
Support key derivation with non-predefined capacity psa_key_derivation requires the caller to specify a maximum capacity. This commit adds a special value that indicates that the maximum capacity should be the maximum supported by the algorithm. This is currently meant only for selection algorithms used on the shared secret produced by a key agreement.
2018-09-18 12:06:11 +02:00
else if( capacity == PSA_GENERATOR_UNBRIDLED_CAPACITY )
generator->capacity = max_capacity;
Add framework for simple key derivation New key type PSA_KEY_TYPE_DERIVE. New usage flag PSA_KEY_USAGE_DERIVE. New function psa_key_derivation. No key derivation algorithm is implemented yet. The code may not compile with -Wunused. Write some unit test code for psa_key_derivation. Most of it cannot be used yet due to the lack of a key derivation algorithm.
2018-07-12 17:17:20 +02:00
else
Split off psa_key_derivation_internal Refactor psa_key_derivation to prepare for key agreement algorithms which need to plug into key derivation after argument validation.
2018-09-18 12:03:52 +02:00
return( PSA_ERROR_INVALID_ARGUMENT );
return( PSA_SUCCESS );
}
psa_status_t psa_key_derivation( psa_crypto_generator_t *generator,
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
psa_key_handle_t handle,
Split off psa_key_derivation_internal Refactor psa_key_derivation to prepare for key agreement algorithms which need to plug into key derivation after argument validation.
2018-09-18 12:03:52 +02:00
psa_algorithm_t alg,
const uint8_t *salt,
size_t salt_length,
const uint8_t *label,
size_t label_length,
size_t capacity )
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *slot;
Split off psa_key_derivation_internal Refactor psa_key_derivation to prepare for key agreement algorithms which need to plug into key derivation after argument validation.
2018-09-18 12:03:52 +02:00
psa_status_t status;
if( generator->alg != 0 )
return( PSA_ERROR_BAD_STATE );
/* Make sure that alg is a key derivation algorithm. This prevents
* key selection algorithms, which psa_key_derivation_internal
* accepts for the sake of key agreement. */
if( ! PSA_ALG_IS_KEY_DERIVATION( alg ) )
return( PSA_ERROR_INVALID_ARGUMENT );
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
status = psa_get_key_from_slot( handle, &slot, PSA_KEY_USAGE_DERIVE, alg );
Split off psa_key_derivation_internal Refactor psa_key_derivation to prepare for key agreement algorithms which need to plug into key derivation after argument validation.
2018-09-18 12:03:52 +02:00
if( status != PSA_SUCCESS )
return( status );
if( slot->type != PSA_KEY_TYPE_DERIVE )
return( PSA_ERROR_INVALID_ARGUMENT );
status = psa_key_derivation_internal( generator,
slot->data.raw.data,
slot->data.raw.bytes,
alg,
salt, salt_length,
label, label_length,
capacity );
if( status != PSA_SUCCESS )
Add framework for simple key derivation New key type PSA_KEY_TYPE_DERIVE. New usage flag PSA_KEY_USAGE_DERIVE. New function psa_key_derivation. No key derivation algorithm is implemented yet. The code may not compile with -Wunused. Write some unit test code for psa_key_derivation. Most of it cannot be used yet due to the lack of a key derivation algorithm.
2018-07-12 17:17:20 +02:00
psa_generator_abort( generator );
return( status );
}
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 12:01:02 +02:00
/****************************************************************/
/* Key agreement */
/****************************************************************/
Add some missing compilation guards Add missing checks for defined(MBEDTLS_MD_C) around types and functions that require it (HMAC, HKDF, TLS12_PRF). Add missing checks for defined(MBEDTLS_ECDSA_DETERMINISTIC) around code that calls mbedtls_ecdsa_sign_det(). Add missing checks for defined(MBEDTLS_ECDH_C) around ECDH-specific functions.
2018-11-16 16:02:56 +01:00
#if defined(MBEDTLS_ECDH_C)
Implement ECDH
2018-09-18 12:11:27 +02:00
static psa_status_t psa_key_agreement_ecdh( const uint8_t *peer_key,
size_t peer_key_length,
const mbedtls_ecp_keypair *our_key,
uint8_t *shared_secret,
size_t shared_secret_size,
size_t *shared_secret_length )
{
mbedtls_pk_context pk;
mbedtls_ecp_keypair *their_key = NULL;
mbedtls_ecdh_context ecdh;
int ret;
mbedtls_ecdh_init( &ecdh );
mbedtls_pk_init( &pk );
ret = mbedtls_pk_parse_public_key( &pk, peer_key, peer_key_length );
if( ret != 0 )
goto exit;
Allow ECDH-only public key in ECDH In ECDH key agreement, allow a public key with the OID id-ECDH, not just a public key with the OID id-ecPublicKey. Public keys with the OID id-ECDH are not permitted by psa_import_key, at least for now. There would be no way to use the key for a key agreement operation anyway in the current API.
2018-10-25 23:07:25 +02:00
switch( mbedtls_pk_get_type( &pk ) )
Implement ECDH
2018-09-18 12:11:27 +02:00
{
Allow ECDH-only public key in ECDH In ECDH key agreement, allow a public key with the OID id-ECDH, not just a public key with the OID id-ecPublicKey. Public keys with the OID id-ECDH are not permitted by psa_import_key, at least for now. There would be no way to use the key for a key agreement operation anyway in the current API.
2018-10-25 23:07:25 +02:00
case MBEDTLS_PK_ECKEY:
case MBEDTLS_PK_ECKEY_DH:
break;
default:
ret = MBEDTLS_ERR_ECP_INVALID_KEY;
goto exit;
Implement ECDH
2018-09-18 12:11:27 +02:00
}
their_key = mbedtls_pk_ec( pk );
ECDH: check that the keys are on the same curve In psa_key_agreement_ecdh, check that the public key is on the same curve as the private key. The underlying mbedtls API doesn't check. If the curves don't match, psa_key_agreement_ecdh is practically guaranteed to return INVALID_ARGUMENT anyway, because way the code is written, the public point is interpreted on the curve of the private point, and it is rejected because the point is not on the curve. This is why the test case "PSA key agreement setup: ECDH, raw: public key on different curve" passed even before adding this check.
2018-11-14 20:51:23 +01:00
if( their_key->grp.id != our_key->grp.id )
{
ret = MBEDTLS_ERR_ECP_INVALID_KEY;
goto exit;
}
Implement ECDH
2018-09-18 12:11:27 +02:00
ret = mbedtls_ecdh_get_params( &ecdh, their_key, MBEDTLS_ECDH_THEIRS );
if( ret != 0 )
goto exit;
ret = mbedtls_ecdh_get_params( &ecdh, our_key, MBEDTLS_ECDH_OURS );
if( ret != 0 )
goto exit;
ret = mbedtls_ecdh_calc_secret( &ecdh,
shared_secret_length,
shared_secret, shared_secret_size,
mbedtls_ctr_drbg_random,
&global_data.ctr_drbg );
exit:
mbedtls_pk_free( &pk );
mbedtls_ecdh_free( &ecdh );
return( mbedtls_to_psa_error( ret ) );
}
Add some missing compilation guards Add missing checks for defined(MBEDTLS_MD_C) around types and functions that require it (HMAC, HKDF, TLS12_PRF). Add missing checks for defined(MBEDTLS_ECDSA_DETERMINISTIC) around code that calls mbedtls_ecdsa_sign_det(). Add missing checks for defined(MBEDTLS_ECDH_C) around ECDH-specific functions.
2018-11-16 16:02:56 +01:00
#endif /* MBEDTLS_ECDH_C */
Implement ECDH
2018-09-18 12:11:27 +02:00
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 12:01:02 +02:00
#define PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE MBEDTLS_ECP_MAX_BYTES
Add missing cleanup on failure in psa_key_agreement If psa_key_derivation_internal() fails, it's up to the caller to clean up. Do this, and add a note at the top of psa_key_derivation_internal() and its auxiliary functions. There is no non-regression test because at the moment the only way to trigger an error is a borderline low-memory condition and we don't have the means to trigger this.
2018-11-16 16:05:06 +01:00
/* Note that if this function fails, you must call psa_generator_abort()
* to potentially free embedded data structures and wipe confidential data.
*/
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 12:01:02 +02:00
static psa_status_t psa_key_agreement_internal( psa_crypto_generator_t *generator,
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *private_key,
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 12:01:02 +02:00
const uint8_t *peer_key,
size_t peer_key_length,
psa_algorithm_t alg )
{
psa_status_t status;
uint8_t shared_secret[PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE];
size_t shared_secret_length = 0;
/* Step 1: run the secret agreement algorithm to generate the shared
* secret. */
switch( PSA_ALG_KEY_AGREEMENT_GET_BASE( alg ) )
{
Implement ECDH
2018-09-18 12:11:27 +02:00
#if defined(MBEDTLS_ECDH_C)
case PSA_ALG_ECDH_BASE:
if( ! PSA_KEY_TYPE_IS_ECC_KEYPAIR( private_key->type ) )
return( PSA_ERROR_INVALID_ARGUMENT );
status = psa_key_agreement_ecdh( peer_key, peer_key_length,
private_key->data.ecp,
shared_secret,
sizeof( shared_secret ),
&shared_secret_length );
break;
#endif /* MBEDTLS_ECDH_C */
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 12:01:02 +02:00
default:
Fix unused variables warning if MBEDTLS_ECDH_C is off depends-pkalgs.pl passes.
2018-11-16 16:43:31 +01:00
(void) private_key;
(void) peer_key;
(void) peer_key_length;
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 12:01:02 +02:00
return( PSA_ERROR_NOT_SUPPORTED );
}
if( status != PSA_SUCCESS )
goto exit;
/* Step 2: set up the key derivation to generate key material from
* the shared secret. */
status = psa_key_derivation_internal( generator,
shared_secret, shared_secret_length,
PSA_ALG_KEY_AGREEMENT_GET_KDF( alg ),
NULL, 0, NULL, 0,
PSA_GENERATOR_UNBRIDLED_CAPACITY );
exit:
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 18:14:53 +01:00
mbedtls_platform_zeroize( shared_secret, shared_secret_length );
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 12:01:02 +02:00
return( status );
}
psa_status_t psa_key_agreement( psa_crypto_generator_t *generator,
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
psa_key_handle_t private_key,
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 12:01:02 +02:00
const uint8_t *peer_key,
size_t peer_key_length,
psa_algorithm_t alg )
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *slot;
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 12:01:02 +02:00
psa_status_t status;
if( ! PSA_ALG_IS_KEY_AGREEMENT( alg ) )
return( PSA_ERROR_INVALID_ARGUMENT );
status = psa_get_key_from_slot( private_key, &slot,
PSA_KEY_USAGE_DERIVE, alg );
if( status != PSA_SUCCESS )
return( status );
Add missing cleanup on failure in psa_key_agreement If psa_key_derivation_internal() fails, it's up to the caller to clean up. Do this, and add a note at the top of psa_key_derivation_internal() and its auxiliary functions. There is no non-regression test because at the moment the only way to trigger an error is a borderline low-memory condition and we don't have the means to trigger this.
2018-11-16 16:05:06 +01:00
status = psa_key_agreement_internal( generator,
slot,
peer_key, peer_key_length,
alg );
if( status != PSA_SUCCESS )
psa_generator_abort( generator );
return( status );
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 12:01:02 +02:00
}
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 17:12:33 +02:00
/****************************************************************/
/* Random generation */
Implement psa_generate_random
2018-06-19 22:00:52 +02:00
/****************************************************************/
psa_status_t psa_generate_random( uint8_t *output,
size_t output_size )
{
Ensure the module is initialized in psa_generate_random
2018-09-06 15:24:41 +02:00
int ret;
GUARD_MODULE_INITIALIZED;
ret = mbedtls_ctr_drbg_random( &global_data.ctr_drbg, output, output_size );
Implement psa_generate_random
2018-06-19 22:00:52 +02:00
return( mbedtls_to_psa_error( ret ) );
}
Add entropy injection function to psa cripto APIs
2018-11-19 10:53:02 +01:00
#if ( defined(MBEDTLS_ENTROPY_NV_SEED) && defined(MBEDTLS_PSA_HAS_ITS_IO) )
Adjust psa entropy inject tests to take as minimum seed size the maximum of MBEDTLS_ENTROPY_MIN_PLATFORM and MBEDTLS_ENTROPY_BLOCK_SIZE
2018-11-20 15:51:49 +01:00
/* Support function for error conversion between psa_its error codes to psa crypto */
static psa_status_t its_to_psa_error( psa_its_status_t ret )
{
switch( ret )
{
case PSA_ITS_SUCCESS:
return( PSA_SUCCESS );
case PSA_ITS_ERROR_KEY_NOT_FOUND:
return( PSA_ERROR_EMPTY_SLOT );
case PSA_ITS_ERROR_STORAGE_FAILURE:
return( PSA_ERROR_STORAGE_FAILURE );
case PSA_ITS_ERROR_INSUFFICIENT_SPACE:
return( PSA_ERROR_INSUFFICIENT_STORAGE );
case PSA_ITS_ERROR_INVALID_KEY:
case PSA_PS_ERROR_OFFSET_INVALID:
case PSA_ITS_ERROR_INCORRECT_SIZE:
case PSA_ITS_ERROR_BAD_POINTER:
return( PSA_ERROR_INVALID_ARGUMENT );
case PSA_ITS_ERROR_FLAGS_NOT_SUPPORTED:
return( PSA_ERROR_NOT_SUPPORTED );
case PSA_ITS_ERROR_WRITE_ONCE:
return( PSA_ERROR_OCCUPIED_SLOT );
default:
return( PSA_ERROR_UNKNOWN_ERROR );
}
}
Add entropy injection function to psa cripto APIs
2018-11-19 10:53:02 +01:00
psa_status_t mbedtls_psa_inject_entropy( const unsigned char *seed,
size_t seed_size )
{
psa_status_t status;
Adjust psa entropy inject tests to take as minimum seed size the maximum of MBEDTLS_ENTROPY_MIN_PLATFORM and MBEDTLS_ENTROPY_BLOCK_SIZE
2018-11-20 15:51:49 +01:00
psa_its_status_t its_status;
Add entropy injection function to psa cripto APIs
2018-11-19 10:53:02 +01:00
struct psa_its_info_t p_info;
if( global_data.initialized )
return( PSA_ERROR_NOT_PERMITTED );
Add Tests for psa crypto entropy incjection Adjust code to handle and work with MBEDTLS_ENTROPY_BLOCK_SIZE definition option
2018-11-19 10:53:55 +01:00
if( ( ( seed_size < MBEDTLS_ENTROPY_MIN_PLATFORM ) ||
( seed_size < MBEDTLS_ENTROPY_BLOCK_SIZE ) ) ||
( seed_size > MBEDTLS_ENTROPY_MAX_SEED_SIZE ) )
return( PSA_ERROR_INVALID_ARGUMENT );
change MBEDTLS_RANDOM_SEED_ITS define to be PSA_CRYPTO_ITS_RANDOM_SEED_UID
2018-11-21 16:31:07 +01:00
its_status = psa_its_get_info( PSA_CRYPTO_ITS_RANDOM_SEED_UID, &p_info );
Adjust psa entropy inject tests to take as minimum seed size the maximum of MBEDTLS_ENTROPY_MIN_PLATFORM and MBEDTLS_ENTROPY_BLOCK_SIZE
2018-11-20 15:51:49 +01:00
status = its_to_psa_error( its_status );
if( PSA_ITS_ERROR_KEY_NOT_FOUND == its_status ) /* No seed exists */
Add entropy injection function to psa cripto APIs
2018-11-19 10:53:02 +01:00
{
change MBEDTLS_RANDOM_SEED_ITS define to be PSA_CRYPTO_ITS_RANDOM_SEED_UID
2018-11-21 16:31:07 +01:00
its_status = psa_its_set( PSA_CRYPTO_ITS_RANDOM_SEED_UID, seed_size, seed, 0 );
Adjust psa entropy inject tests to take as minimum seed size the maximum of MBEDTLS_ENTROPY_MIN_PLATFORM and MBEDTLS_ENTROPY_BLOCK_SIZE
2018-11-20 15:51:49 +01:00
status = its_to_psa_error( its_status );
Add entropy injection function to psa cripto APIs
2018-11-19 10:53:02 +01:00
}
Adjust psa entropy inject tests to take as minimum seed size the maximum of MBEDTLS_ENTROPY_MIN_PLATFORM and MBEDTLS_ENTROPY_BLOCK_SIZE
2018-11-20 15:51:49 +01:00
else if( PSA_ITS_SUCCESS == its_status )
Add entropy injection function to psa cripto APIs
2018-11-19 10:53:02 +01:00
{
/* You should not be here. Seed needs to be injected only once */
status = PSA_ERROR_NOT_PERMITTED;
}
return( status );
}
#endif
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
psa_status_t psa_generate_key( psa_key_handle_t handle,
Implement psa_generate_random
2018-06-19 22:00:52 +02:00
psa_key_type_t type,
size_t bits,
generate_key: rename \p parameters to \p extra \p parameters is a confusing name for a function parameter. Rename it to \p extra.
2018-07-12 01:14:59 +02:00
const void *extra,
size_t extra_size )
Implement psa_generate_random
2018-06-19 22:00:52 +02:00
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *slot;
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
psa_status_t status;
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-20 00:20:32 +02:00
generate_key: rename \p parameters to \p extra \p parameters is a confusing name for a function parameter. Rename it to \p extra.
2018-07-12 01:14:59 +02:00
if( extra == NULL && extra_size != 0 )
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-20 00:20:32 +02:00
return( PSA_ERROR_INVALID_ARGUMENT );
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
status = psa_get_empty_key_slot( handle, &slot );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
if( status != PSA_SUCCESS )
return( status );
Remove PSA_KEY_TYPE_IS_RAW_BYTES from crypto.h It isn't used to define other macros and it doesn't seem that useful for users. Remove it, we can reintroduce it if needed. Define a similar function key_type_is_raw_bytes in the implementation with a clear semantics: it's a key that's represented as a struct raw_data.
2018-06-21 14:15:31 +02:00
if( key_type_is_raw_bytes( type ) )
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-20 00:20:32 +02:00
{
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 17:01:38 +02:00
status = prepare_raw_data_slot( type, bits, &slot->data.raw );
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-20 00:20:32 +02:00
if( status != PSA_SUCCESS )
return( status );
status = psa_generate_random( slot->data.raw.data,
slot->data.raw.bytes );
if( status != PSA_SUCCESS )
{
mbedtls_free( slot->data.raw.data );
return( status );
}
#if defined(MBEDTLS_DES_C)
if( type == PSA_KEY_TYPE_DES )
Fix psa_generator_import_key for DES In psa_generator_import_key, if generating a DES or 3DES key, set the parity bits. Add tests for deriving a DES key. Also test deriving an AES key while I'm at it.
2018-07-19 17:05:42 +02:00
psa_des_set_key_parity( slot->data.raw.data,
slot->data.raw.bytes );
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-20 00:20:32 +02:00
#endif /* MBEDTLS_DES_C */
}
else
#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_GENPRIME)
if ( type == PSA_KEY_TYPE_RSA_KEYPAIR )
{
mbedtls_rsa_context *rsa;
int ret;
int exponent = 65537;
Define max sizes for MAC and signatures This requires defining a maximum RSA key size, since the RSA key size is the signature size. Enforce the maximum RSA key size when importing or generating a key.
2018-06-27 22:55:52 +02:00
if( bits > PSA_VENDOR_RSA_MAX_KEY_BITS )
return( PSA_ERROR_NOT_SUPPORTED );
Reject non-byte-aligned RSA keys On key import and key generation, for RSA, reject key sizes that are not a multiple of 8. Such keys are not well-supported in Mbed TLS and are hardly ever used in practice. The previous commit removed support for non-byte-aligned keys at the PSA level. This commit actively rejects such keys and adds corresponding tests (test keys generated with "openssl genrsa").
2018-11-12 18:39:40 +01:00
/* Accept only byte-aligned keys, for the same reasons as
* in psa_import_rsa_key(). */
if( bits % 8 != 0 )
return( PSA_ERROR_NOT_SUPPORTED );
generate_key: rename \p parameters to \p extra \p parameters is a confusing name for a function parameter. Rename it to \p extra.
2018-07-12 01:14:59 +02:00
if( extra != NULL )
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-20 00:20:32 +02:00
{
generate_key: define a structure type for RSA extra parameters
2018-07-12 01:24:09 +02:00
const psa_generate_key_extra_rsa *p = extra;
generate_key: rename \p parameters to \p extra \p parameters is a confusing name for a function parameter. Rename it to \p extra.
2018-07-12 01:14:59 +02:00
if( extra_size != sizeof( *p ) )
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-20 00:20:32 +02:00
return( PSA_ERROR_INVALID_ARGUMENT );
generate_key: define a structure type for RSA extra parameters
2018-07-12 01:24:09 +02:00
#if INT_MAX < 0xffffffff
/* Check that the uint32_t value passed by the caller fits
* in the range supported by this implementation. */
if( p->e > INT_MAX )
return( PSA_ERROR_NOT_SUPPORTED );
#endif
exponent = p->e;
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-20 00:20:32 +02:00
}
rsa = mbedtls_calloc( 1, sizeof( *rsa ) );
if( rsa == NULL )
return( PSA_ERROR_INSUFFICIENT_MEMORY );
mbedtls_rsa_init( rsa, MBEDTLS_RSA_PKCS_V15, MBEDTLS_MD_NONE );
ret = mbedtls_rsa_gen_key( rsa,
mbedtls_ctr_drbg_random,
&global_data.ctr_drbg,
psa: Pass the number of bits with explicit types The GCM, CCM, RSA, and cipher modules inconsistently use int or unsigned int for a count of bits. The PSA Crypto API uses size_t for counting things. This causes issues on LLP64 systems where a size_t can hold more than an unsigned int. Add casts for where key_bits and bits are passed to mbedtls_* APIs.
2018-06-26 15:16:54 +02:00
(unsigned int) bits,
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-20 00:20:32 +02:00
exponent );
if( ret != 0 )
{
mbedtls_rsa_free( rsa );
mbedtls_free( rsa );
return( mbedtls_to_psa_error( ret ) );
}
slot->data.rsa = rsa;
}
else
#endif /* MBEDTLS_RSA_C && MBEDTLS_GENPRIME */
#if defined(MBEDTLS_ECP_C)
if ( PSA_KEY_TYPE_IS_ECC( type ) && PSA_KEY_TYPE_IS_KEYPAIR( type ) )
{
psa_ecc_curve_t curve = PSA_KEY_TYPE_GET_CURVE( type );
mbedtls_ecp_group_id grp_id = mbedtls_ecc_group_of_psa( curve );
const mbedtls_ecp_curve_info *curve_info =
mbedtls_ecp_curve_info_from_grp_id( grp_id );
mbedtls_ecp_keypair *ecp;
int ret;
generate_key: rename \p parameters to \p extra \p parameters is a confusing name for a function parameter. Rename it to \p extra.
2018-07-12 01:14:59 +02:00
if( extra != NULL )
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-20 00:20:32 +02:00
return( PSA_ERROR_NOT_SUPPORTED );
if( grp_id == MBEDTLS_ECP_DP_NONE || curve_info == NULL )
return( PSA_ERROR_NOT_SUPPORTED );
if( curve_info->bit_size != bits )
return( PSA_ERROR_INVALID_ARGUMENT );
ecp = mbedtls_calloc( 1, sizeof( *ecp ) );
if( ecp == NULL )
return( PSA_ERROR_INSUFFICIENT_MEMORY );
mbedtls_ecp_keypair_init( ecp );
ret = mbedtls_ecp_gen_key( grp_id, ecp,
mbedtls_ctr_drbg_random,
&global_data.ctr_drbg );
if( ret != 0 )
{
mbedtls_ecp_keypair_free( ecp );
mbedtls_free( ecp );
return( mbedtls_to_psa_error( ret ) );
}
slot->data.ecp = ecp;
}
else
#endif /* MBEDTLS_ECP_C */
return( PSA_ERROR_NOT_SUPPORTED );
slot->type = type;
psa: Extend psa_generate_key to support persistent lifetimes
2018-11-07 17:05:30 +01:00
#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
if( slot->lifetime == PSA_KEY_LIFETIME_PERSISTENT )
{
Distinguish in-memory slot number from in-storage slot identifier At the moment, the in-storage slot identifier is the in-memory slot number. But track them separately, to prepare for API changes that will let them be different (psa_open_key, psa_create_key).
2018-11-30 18:46:56 +01:00
return( psa_save_generated_persistent_key( slot, bits ) );
psa: Extend psa_generate_key to support persistent lifetimes
2018-11-07 17:05:30 +01:00
}
#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
return( status );
Implement psa_generate_random
2018-06-19 22:00:52 +02:00
}
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 13:16:24 +01:00
/****************************************************************/
/* Module setup */
/****************************************************************/
Add a facility to configure entropy sources Add a function to configure entropy sources. For testing only. Use it to test that the library initialization fails properly if there is no entropy source.
2018-11-20 21:59:56 +01:00
psa_status_t mbedtls_psa_crypto_configure_entropy_sources(
void (* entropy_init )( mbedtls_entropy_context *ctx ),
void (* entropy_free )( mbedtls_entropy_context *ctx ) )
{
if( global_data.rng_state != RNG_NOT_INITIALIZED )
return( PSA_ERROR_BAD_STATE );
global_data.entropy_init = entropy_init;
global_data.entropy_free = entropy_free;
return( PSA_SUCCESS );
}
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
void mbedtls_psa_crypto_free( void )
{
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 21:42:52 +01:00
if( global_data.key_slots_initialized )
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 15:48:15 +01:00
{
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 18:08:14 +01:00
psa_key_handle_t key;
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 21:42:52 +01:00
for( key = 1; key <= PSA_KEY_SLOT_COUNT; key++ )
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 17:12:32 +01:00
psa_key_slot_t *slot = &global_data.key_slots[key - 1];
Factor the common idiom psa_wipe_key_slot into a function Many places in the code called psa_remove_key_data_from_memory (which preserves metadata for the sake of failues in psa_import_key) followed by clearing the slot data. Use an auxiliary function for this.
2018-12-03 11:58:46 +01:00
(void) psa_wipe_key_slot( slot );
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 21:42:52 +01:00
}
}
if( global_data.rng_state != RNG_NOT_INITIALIZED )
{
mbedtls_ctr_drbg_free( &global_data.ctr_drbg );
Add a facility to configure entropy sources Add a function to configure entropy sources. For testing only. Use it to test that the library initialization fails properly if there is no entropy source.
2018-11-20 21:59:56 +01:00
global_data.entropy_free( &global_data.entropy );
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 15:48:15 +01:00
}
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 21:42:52 +01:00
/* Wipe all remaining data, including configuration.
* In particular, this sets all state indicator to the value
* indicating "uninitialized". */
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 18:14:53 +01:00
mbedtls_platform_zeroize( &global_data, sizeof( global_data ) );
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
}
psa_status_t psa_crypto_init( void )
{
int ret;
const unsigned char drbg_seed[] = "PSA";
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 21:42:52 +01:00
/* Double initialization is explicitly allowed. */
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
if( global_data.initialized != 0 )
return( PSA_SUCCESS );
Add a facility to configure entropy sources Add a function to configure entropy sources. For testing only. Use it to test that the library initialization fails properly if there is no entropy source.
2018-11-20 21:59:56 +01:00
/* Set default configuration if
* mbedtls_psa_crypto_configure_entropy_sources() hasn't been called. */
if( global_data.entropy_init == NULL )
global_data.entropy_init = mbedtls_entropy_init;
if( global_data.entropy_free == NULL )
global_data.entropy_free = mbedtls_entropy_free;
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 21:42:52 +01:00
/* Initialize the random generator. */
Add a facility to configure entropy sources Add a function to configure entropy sources. For testing only. Use it to test that the library initialization fails properly if there is no entropy source.
2018-11-20 21:59:56 +01:00
global_data.entropy_init( &global_data.entropy );
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
mbedtls_ctr_drbg_init( &global_data.ctr_drbg );
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 21:42:52 +01:00
global_data.rng_state = RNG_INITIALIZED;
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
ret = mbedtls_ctr_drbg_seed( &global_data.ctr_drbg,
mbedtls_entropy_func,
&global_data.entropy,
drbg_seed, sizeof( drbg_seed ) - 1 );
if( ret != 0 )
goto exit;
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 21:42:52 +01:00
global_data.rng_state = RNG_SEEDED;
/* Initialize the key slots. Zero-initialization has made all key
Remove a comment that is no longer applicable
2018-12-07 18:12:28 +01:00
* slots empty, so there is nothing to do. */
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 21:42:52 +01:00
global_data.key_slots_initialized = 1;
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 21:42:52 +01:00
/* All done. */
psa_crypto_init: set the global initialized flag
2018-03-07 14:16:44 +01:00
global_data.initialized = 1;
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 23:32:46 +01:00
exit:
if( ret != 0 )
mbedtls_psa_crypto_free( );
return( mbedtls_to_psa_error( ret ) );
}
#endif /* MBEDTLS_PSA_CRYPTO_C */
Reference in New Issue Copy Permalink