From 1e58235d8b9c7481096227454ede04ebfb597e64 Mon Sep 17 00:00:00 2001 From: Steven Cooreman Date: Thu, 18 Feb 2021 17:24:37 +0100 Subject: [PATCH] Dispatch hashing calls through the driver wrapper layer Signed-off-by: Steven Cooreman --- library/psa_crypto.c | 73 +++------ library/psa_crypto_driver_wrappers.c | 217 ++++++++++++++++++++++++++- library/psa_crypto_driver_wrappers.h | 33 ++++ library/psa_crypto_hash.h | 12 ++ 4 files changed, 280 insertions(+), 55 deletions(-) diff --git a/library/psa_crypto.c b/library/psa_crypto.c index f2c8415f2..4824b45a3 100644 --- a/library/psa_crypto.c +++ b/library/psa_crypto.c @@ -33,7 +33,6 @@ #include "psa_crypto_invasive.h" #include "psa_crypto_driver_wrappers.h" #include "psa_crypto_ecp.h" -#include "psa_crypto_hash.h" #include "psa_crypto_rsa.h" #include "psa_crypto_ecp.h" #if defined(MBEDTLS_PSA_CRYPTO_SE_C) @@ -2198,20 +2197,7 @@ const mbedtls_md_info_t *mbedtls_md_info_from_psa( psa_algorithm_t alg ) psa_status_t psa_hash_abort( psa_hash_operation_t *operation ) { if( operation != NULL ) - { - if( operation->ctx.ctx != NULL ) - { - psa_status_t status = mbedtls_psa_hash_abort( operation->ctx.ctx ); - mbedtls_free( operation->ctx.ctx ); - operation->ctx.ctx = NULL; - return( status ); - } - else - { - // Multiple consequent calls to abort return success - return( PSA_SUCCESS ); - } - } + return( psa_driver_wrapper_hash_abort( &operation->ctx ) ); else return( PSA_ERROR_INVALID_ARGUMENT ); } @@ -2219,20 +2205,10 @@ psa_status_t psa_hash_abort( psa_hash_operation_t *operation ) psa_status_t psa_hash_setup( psa_hash_operation_t *operation, psa_algorithm_t alg ) { - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - if( operation == NULL || !PSA_ALG_IS_HASH( alg ) ) return( PSA_ERROR_INVALID_ARGUMENT ); - /* A context must be freshly initialized before it can be set up. */ - if( operation->ctx.ctx != NULL ) - return( PSA_ERROR_BAD_STATE ); - - operation->ctx.ctx = mbedtls_calloc( 1, sizeof(mbedtls_psa_hash_operation_t) ); - status = mbedtls_psa_hash_setup( operation->ctx.ctx, alg ); - if( status != PSA_SUCCESS ) - psa_hash_abort( operation ); - return( status ); + return( psa_driver_wrapper_hash_setup( &operation->ctx, alg ) ); } psa_status_t psa_hash_update( psa_hash_operation_t *operation, @@ -2241,14 +2217,9 @@ psa_status_t psa_hash_update( psa_hash_operation_t *operation, { if( operation == NULL ) return( PSA_ERROR_INVALID_ARGUMENT ); - if( operation->ctx.ctx == NULL ) - return( PSA_ERROR_BAD_STATE ); - psa_status_t status = mbedtls_psa_hash_update( operation->ctx.ctx, - input, input_length ); - if( status != PSA_SUCCESS ) - psa_hash_abort( operation ); - return( status ); + return( psa_driver_wrapper_hash_update( &operation->ctx, + input, input_length ) ); } psa_status_t psa_hash_finish( psa_hash_operation_t *operation, @@ -2258,11 +2229,10 @@ psa_status_t psa_hash_finish( psa_hash_operation_t *operation, { if( operation == NULL ) return( PSA_ERROR_INVALID_ARGUMENT ); - if( operation->ctx.ctx == NULL ) - return( PSA_ERROR_BAD_STATE ); - psa_status_t status = mbedtls_psa_hash_finish( operation->ctx.ctx, - hash, hash_size, hash_length ); + psa_status_t status = psa_driver_wrapper_hash_finish( + &operation->ctx, + hash, hash_size, hash_length ); psa_hash_abort( operation ); return( status ); } @@ -2271,11 +2241,15 @@ psa_status_t psa_hash_verify( psa_hash_operation_t *operation, const uint8_t *hash, size_t hash_length ) { + if( operation == NULL ) + return( PSA_ERROR_INVALID_ARGUMENT ); + uint8_t actual_hash[MBEDTLS_MD_MAX_SIZE]; size_t actual_hash_length; - psa_status_t status = psa_hash_finish( operation, - actual_hash, sizeof( actual_hash ), - &actual_hash_length ); + psa_status_t status = psa_driver_wrapper_hash_finish( + &operation->ctx, + actual_hash, sizeof( actual_hash ), + &actual_hash_length ); if( status != PSA_SUCCESS ) return( status ); if( actual_hash_length != hash_length ) @@ -2290,8 +2264,8 @@ psa_status_t psa_hash_compute( psa_algorithm_t alg, uint8_t *hash, size_t hash_size, size_t *hash_length ) { - return( mbedtls_psa_hash_compute( alg, input, input_length, - hash, hash_size, hash_length ) ); + return( psa_driver_wrapper_hash_compute( alg, input, input_length, + hash, hash_size, hash_length ) ); } psa_status_t psa_hash_compare( psa_algorithm_t alg, @@ -2300,9 +2274,10 @@ psa_status_t psa_hash_compare( psa_algorithm_t alg, { uint8_t actual_hash[MBEDTLS_MD_MAX_SIZE]; size_t actual_hash_length; - psa_status_t status = psa_hash_compute( alg, input, input_length, - actual_hash, sizeof(actual_hash), - &actual_hash_length ); + psa_status_t status = psa_driver_wrapper_hash_compute( + alg, input, input_length, + actual_hash, sizeof(actual_hash), + &actual_hash_length ); if( status != PSA_SUCCESS ) return( status ); if( actual_hash_length != hash_length ) @@ -2317,13 +2292,9 @@ psa_status_t psa_hash_clone( const psa_hash_operation_t *source_operation, { if( source_operation == NULL || target_operation == NULL ) return( PSA_ERROR_INVALID_ARGUMENT ); - if( source_operation->ctx.ctx == NULL ) - return( PSA_ERROR_BAD_STATE ); - if( target_operation->ctx.ctx != NULL ) - return( PSA_ERROR_BAD_STATE ); - target_operation->ctx.ctx = mbedtls_calloc(1, sizeof(mbedtls_psa_hash_operation_t)); - return( mbedtls_psa_hash_clone( source_operation->ctx.ctx, target_operation->ctx.ctx ) ); + return( psa_driver_wrapper_hash_clone( &source_operation->ctx, + &target_operation->ctx ) ); } diff --git a/library/psa_crypto_driver_wrappers.c b/library/psa_crypto_driver_wrappers.c index 6cf23cef9..72077acd3 100644 --- a/library/psa_crypto_driver_wrappers.c +++ b/library/psa_crypto_driver_wrappers.c @@ -38,14 +38,17 @@ /* Repeat above block for each JSON-declared driver during autogeneration */ -/* Auto-generated values depending on which drivers are registered. ID 0 is - * reserved for unallocated operations. */ +/* Auto-generated values depending on which drivers are registered. + * ID 0 is reserved for unallocated operations. + * ID 1 is reserved for the Mbed TLS software driver. */ #if defined(PSA_CRYPTO_DRIVER_TEST) -#define PSA_CRYPTO_TRANSPARENT_TEST_DRIVER_ID (1) -#define PSA_CRYPTO_OPAQUE_TEST_DRIVER_ID (2) +#define PSA_CRYPTO_TRANSPARENT_TEST_DRIVER_ID (2) +#define PSA_CRYPTO_OPAQUE_TEST_DRIVER_ID (3) #endif /* PSA_CRYPTO_DRIVER_TEST */ #endif /* MBEDTLS_PSA_CRYPTO_DRIVERS */ +#define PSA_CRYPTO_MBED_TLS_DRIVER_ID (1) + /* Support the 'old' SE interface when asked to */ #if defined(MBEDTLS_PSA_CRYPTO_SE_C) /* PSA_CRYPTO_DRIVER_PRESENT is defined when either a new-style or old-style @@ -56,6 +59,9 @@ #include "psa_crypto_se.h" #endif +/* Include software fallback when present */ +#include "psa_crypto_hash.h" + /* Start delegation functions */ psa_status_t psa_driver_wrapper_sign_hash( const psa_key_attributes_t *attributes, @@ -1066,4 +1072,207 @@ psa_status_t psa_driver_wrapper_cipher_abort( #endif /* PSA_CRYPTO_DRIVER_PRESENT */ } +/* + * Hashing functions + */ +psa_status_t psa_driver_wrapper_hash_compute( + psa_algorithm_t alg, + const uint8_t *input, + size_t input_length, + uint8_t *hash, + size_t hash_size, + size_t *hash_length) +{ + psa_status_t status = PSA_ERROR_NOT_SUPPORTED; + + /* Try accelerators first */ + + /* If software fallback is compiled in, try fallback */ +#if defined(MBEDTLS_PSA_BUILTIN_HASH) + status = mbedtls_psa_hash_compute( alg, input, input_length, + hash, hash_size, hash_length ); + if( status != PSA_ERROR_NOT_SUPPORTED ) + return( status ); +#endif + if( status == PSA_ERROR_NOT_SUPPORTED ) + { + (void) alg; + (void) input; + (void) input_length; + (void) hash; + (void) hash_size; + (void) hash_length; + + return( PSA_ERROR_NOT_SUPPORTED ); + } + return( status ); +} + +psa_status_t psa_driver_wrapper_hash_setup( + psa_operation_driver_context_t *operation, + psa_algorithm_t alg ) +{ + psa_status_t status = PSA_ERROR_NOT_SUPPORTED; + + /* A context must be freshly initialized before it can be set up. */ + if( operation->id != 0 || operation->ctx != NULL ) + return( PSA_ERROR_BAD_STATE ); + + /* Try setup on accelerators first */ + + /* If software fallback is compiled in, try fallback */ +#if defined(MBEDTLS_PSA_BUILTIN_HASH) + operation->ctx = mbedtls_calloc( 1, sizeof(mbedtls_psa_hash_operation_t) ); + status = mbedtls_psa_hash_setup( operation->ctx, alg ); + if( status == PSA_SUCCESS ) + { + operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; + } + else + { + mbedtls_free( operation->ctx ); + operation->ctx = NULL; + operation->id = 0; + } + + if( status != PSA_ERROR_NOT_SUPPORTED ) + return( status ); +#endif + /* Nothing left to try if we fall through here */ + (void) status; + (void) operation; + (void) alg; + return( PSA_ERROR_NOT_SUPPORTED ); +} + +psa_status_t psa_driver_wrapper_hash_clone( + const psa_operation_driver_context_t *source_operation, + psa_operation_driver_context_t *target_operation ) +{ + psa_status_t status = PSA_ERROR_NOT_SUPPORTED; + + if( source_operation->ctx == NULL || source_operation->id == 0 ) + return( PSA_ERROR_BAD_STATE ); + if( target_operation->ctx != NULL || target_operation->id != 0 ) + return( PSA_ERROR_BAD_STATE ); + + switch( source_operation->id ) + { +#if defined(MBEDTLS_PSA_BUILTIN_HASH) + case PSA_CRYPTO_MBED_TLS_DRIVER_ID: + target_operation->ctx = mbedtls_calloc( 1, sizeof(mbedtls_psa_hash_operation_t) ); + if( target_operation->ctx == NULL ) + { + status = PSA_ERROR_INSUFFICIENT_MEMORY; + break; + } + target_operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; + status = mbedtls_psa_hash_clone( source_operation->ctx, + target_operation->ctx ); + break; +#endif + default: + (void) status; + (void) source_operation; + (void) target_operation; + return( PSA_ERROR_BAD_STATE ); + } + + if( status != PSA_SUCCESS ) + psa_driver_wrapper_hash_abort( target_operation ); + return( status ); +} + +psa_status_t psa_driver_wrapper_hash_update( + psa_operation_driver_context_t *operation, + const uint8_t *input, + size_t input_length ) +{ + psa_status_t status = PSA_ERROR_NOT_SUPPORTED; + + if( operation->ctx == NULL || operation->id == 0 ) + return( PSA_ERROR_BAD_STATE ); + + switch( operation->id ) + { +#if defined(MBEDTLS_PSA_BUILTIN_HASH) + case PSA_CRYPTO_MBED_TLS_DRIVER_ID: + status = mbedtls_psa_hash_update( operation->ctx, + input, input_length ); + break; +#endif + default: + (void) status; + (void) operation; + (void) input; + (void) input_length; + return( PSA_ERROR_BAD_STATE ); + } + + if( status != PSA_SUCCESS ) + psa_driver_wrapper_hash_abort( operation ); + return( status ); +} + +psa_status_t psa_driver_wrapper_hash_finish( + psa_operation_driver_context_t *operation, + uint8_t *hash, + size_t hash_size, + size_t *hash_length ) +{ + psa_status_t status = PSA_ERROR_NOT_SUPPORTED; + + if( operation->ctx == NULL || operation->id == 0 ) + return( PSA_ERROR_BAD_STATE ); + + switch( operation->id ) + { +#if defined(MBEDTLS_PSA_BUILTIN_HASH) + case PSA_CRYPTO_MBED_TLS_DRIVER_ID: + status = mbedtls_psa_hash_finish( operation->ctx, + hash, hash_size, hash_length ); + break; +#endif + default: + (void) status; + (void) operation; + (void) hash; + (void) hash_size; + (void) hash_length; + return( PSA_ERROR_BAD_STATE ); + } + + psa_driver_wrapper_hash_abort( operation ); + return( status ); +} + +psa_status_t psa_driver_wrapper_hash_abort( + psa_operation_driver_context_t *operation ) +{ + psa_status_t status = PSA_ERROR_NOT_SUPPORTED; + + switch( operation->id ) + { + case 0: + if( operation->ctx == NULL ) + return( PSA_SUCCESS ); + else + return( PSA_ERROR_BAD_STATE ); +#if defined(MBEDTLS_PSA_BUILTIN_HASH) + case PSA_CRYPTO_MBED_TLS_DRIVER_ID: + if( operation->ctx != NULL ) + { + status = mbedtls_psa_hash_abort( operation->ctx ); + mbedtls_free( operation->ctx ); + operation->ctx = NULL; + } + operation->id = 0; + return( PSA_SUCCESS ); +#endif + default: + (void) status; + return( PSA_ERROR_BAD_STATE ); + } +} + /* End of automatically generated file. */ diff --git a/library/psa_crypto_driver_wrappers.h b/library/psa_crypto_driver_wrappers.h index 22d22d61c..1190a0e1b 100644 --- a/library/psa_crypto_driver_wrappers.h +++ b/library/psa_crypto_driver_wrappers.h @@ -127,6 +127,39 @@ psa_status_t psa_driver_wrapper_cipher_finish( psa_status_t psa_driver_wrapper_cipher_abort( psa_operation_driver_context_t *operation ); +/* + * Hashing functions + */ +psa_status_t psa_driver_wrapper_hash_compute( + psa_algorithm_t alg, + const uint8_t *input, + size_t input_length, + uint8_t *hash, + size_t hash_size, + size_t *hash_length); + +psa_status_t psa_driver_wrapper_hash_setup( + psa_operation_driver_context_t *operation, + psa_algorithm_t alg ); + +psa_status_t psa_driver_wrapper_hash_clone( + const psa_operation_driver_context_t *source_operation, + psa_operation_driver_context_t *target_operation ); + +psa_status_t psa_driver_wrapper_hash_update( + psa_operation_driver_context_t *operation, + const uint8_t *input, + size_t input_length ); + +psa_status_t psa_driver_wrapper_hash_finish( + psa_operation_driver_context_t *operation, + uint8_t *hash, + size_t hash_size, + size_t *hash_length ); + +psa_status_t psa_driver_wrapper_hash_abort( + psa_operation_driver_context_t *operation ); + #endif /* PSA_CRYPTO_DRIVER_WRAPPERS_H */ /* End of automatically generated file. */ diff --git a/library/psa_crypto_hash.h b/library/psa_crypto_hash.h index 42a8183b3..0181b4e16 100644 --- a/library/psa_crypto_hash.h +++ b/library/psa_crypto_hash.h @@ -30,6 +30,18 @@ #include "mbedtls/sha256.h" #include "mbedtls/sha512.h" +#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD2) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_MD4) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_MD5) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_1) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_224) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_256) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_384) || \ + defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_512) +#define MBEDTLS_PSA_BUILTIN_HASH +#endif + typedef struct { psa_algorithm_t alg;