NCBI C++ ToolKit
psa_crypto.c
Go to the documentation of this file.

Go to the SVN repository for this file.

1 /*
2  * PSA crypto layer on top of Mbed TLS crypto
3  */
4 /*
5  * Copyright The Mbed TLS Contributors
6  * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
7  */
8 
9 #include "common.h"
10 
11 #if defined(MBEDTLS_PSA_CRYPTO_C)
12 
13 #if defined(MBEDTLS_PSA_CRYPTO_CONFIG)
14 #include "check_crypto_config.h"
15 #endif
16 
17 #include "psa/crypto.h"
18 
19 #include "psa_crypto_cipher.h"
20 #include "psa_crypto_core.h"
21 #include "psa_crypto_invasive.h"
23 #include "psa_crypto_ecp.h"
24 #include "psa_crypto_hash.h"
25 #include "psa_crypto_mac.h"
26 #include "psa_crypto_rsa.h"
27 #include "psa_crypto_ecp.h"
28 #if defined(MBEDTLS_PSA_CRYPTO_SE_C)
29 #include "psa_crypto_se.h"
30 #endif
32 /* Include internal declarations that are useful for implementing persistently
33  * stored keys. */
34 #include "psa_crypto_storage.h"
35 
36 #include "psa_crypto_random_impl.h"
37 
38 #include <stdlib.h>
39 #include <string.h>
40 #include "mbedtls/platform.h"
41 
42 #include "mbedtls/aes.h"
43 #include "mbedtls/arc4.h"
44 #include "mbedtls/asn1.h"
45 #include "mbedtls/asn1write.h"
46 #include "mbedtls/bignum.h"
47 #include "mbedtls/blowfish.h"
48 #include "mbedtls/camellia.h"
49 #include "mbedtls/chacha20.h"
50 #include "mbedtls/chachapoly.h"
51 #include "mbedtls/cipher.h"
52 #include "mbedtls/ccm.h"
53 #include "mbedtls/cmac.h"
54 #include "mbedtls/des.h"
55 #include "mbedtls/ecdh.h"
56 #include "mbedtls/ecp.h"
57 #include "mbedtls/entropy.h"
58 #include "mbedtls/error.h"
59 #include "mbedtls/gcm.h"
60 #include "mbedtls/md2.h"
61 #include "mbedtls/md4.h"
62 #include "mbedtls/md5.h"
63 #include "mbedtls/md.h"
64 #include "mbedtls/md_internal.h"
65 #include "mbedtls/pk.h"
66 #include "mbedtls/pk_internal.h"
67 #include "mbedtls/platform_util.h"
68 #include "mbedtls/error.h"
69 #include "mbedtls/ripemd160.h"
70 #include "mbedtls/rsa.h"
71 #include "mbedtls/sha1.h"
72 #include "mbedtls/sha256.h"
73 #include "mbedtls/sha512.h"
74 #include "mbedtls/xtea.h"
75 
76 #define ARRAY_LENGTH(array) (sizeof(array) / sizeof(*(array)))
77 
78 /****************************************************************/
79 /* Global data, support functions and library management */
80 /****************************************************************/
81 
83 {
85 }
86 
87 /* Values for psa_global_data_t::rng_state */
88 #define RNG_NOT_INITIALIZED 0
89 #define RNG_INITIALIZED 1
90 #define RNG_SEEDED 2
91 
92 typedef struct {
93  unsigned initialized : 1;
94  unsigned rng_state : 2;
97 
99 
100 #if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
101 mbedtls_psa_drbg_context_t *const mbedtls_psa_random_state =
103 #endif
104 
105 #define GUARD_MODULE_INITIALIZED \
106  if (global_data.initialized == 0) \
107  return PSA_ERROR_BAD_STATE;
108 
109 #if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
110 
111 /* Declare a local copy of an input buffer and a variable that will be used
112  * to store a pointer to the start of the buffer.
113  *
114  * Note: This macro must be called before any operations which may jump to
115  * the exit label, so that the local input copy object is safe to be freed.
116  *
117  * Assumptions:
118  * - input is the name of a pointer to the buffer to be copied
119  * - The name LOCAL_INPUT_COPY_OF_input is unused in the current scope
120  * - input_copy_name is a name that is unused in the current scope
121  */
122 #define LOCAL_INPUT_DECLARE(input, input_copy_name) \
123  psa_crypto_local_input_t LOCAL_INPUT_COPY_OF_##input = PSA_CRYPTO_LOCAL_INPUT_INIT; \
124  const uint8_t *input_copy_name = NULL;
125 
126 /* Allocate a copy of the buffer input and set the pointer input_copy to
127  * point to the start of the copy.
128  *
129  * Assumptions:
130  * - psa_status_t status exists
131  * - An exit label is declared
132  * - input is the name of a pointer to the buffer to be copied
133  * - LOCAL_INPUT_DECLARE(input, input_copy) has previously been called
134  */
135 #define LOCAL_INPUT_ALLOC(input, length, input_copy) \
136  status = psa_crypto_local_input_alloc(input, length, \
137  &LOCAL_INPUT_COPY_OF_##input); \
138  if (status != PSA_SUCCESS) { \
139  goto exit; \
140  } \
141  input_copy = LOCAL_INPUT_COPY_OF_##input.buffer;
142 
143 /* Free the local input copy allocated previously by LOCAL_INPUT_ALLOC()
144  *
145  * Assumptions:
146  * - input_copy is the name of the input copy pointer set by LOCAL_INPUT_ALLOC()
147  * - input is the name of the original buffer that was copied
148  */
149 #define LOCAL_INPUT_FREE(input, input_copy) \
150  input_copy = NULL; \
151  psa_crypto_local_input_free(&LOCAL_INPUT_COPY_OF_##input);
152 
153 /* Declare a local copy of an output buffer and a variable that will be used
154  * to store a pointer to the start of the buffer.
155  *
156  * Note: This macro must be called before any operations which may jump to
157  * the exit label, so that the local output copy object is safe to be freed.
158  *
159  * Assumptions:
160  * - output is the name of a pointer to the buffer to be copied
161  * - The name LOCAL_OUTPUT_COPY_OF_output is unused in the current scope
162  * - output_copy_name is a name that is unused in the current scope
163  */
164 #define LOCAL_OUTPUT_DECLARE(output, output_copy_name) \
165  psa_crypto_local_output_t LOCAL_OUTPUT_COPY_OF_##output = PSA_CRYPTO_LOCAL_OUTPUT_INIT; \
166  uint8_t *output_copy_name = NULL;
167 
168 /* Allocate a copy of the buffer output and set the pointer output_copy to
169  * point to the start of the copy.
170  *
171  * Assumptions:
172  * - psa_status_t status exists
173  * - An exit label is declared
174  * - output is the name of a pointer to the buffer to be copied
175  * - LOCAL_OUTPUT_DECLARE(output, output_copy) has previously been called
176  */
177 #define LOCAL_OUTPUT_ALLOC(output, length, output_copy) \
178  status = psa_crypto_local_output_alloc(output, length, \
179  &LOCAL_OUTPUT_COPY_OF_##output); \
180  if (status != PSA_SUCCESS) { \
181  goto exit; \
182  } \
183  output_copy = LOCAL_OUTPUT_COPY_OF_##output.buffer;
184 
185 /* Free the local output copy allocated previously by LOCAL_OUTPUT_ALLOC()
186  * after first copying back its contents to the original buffer.
187  *
188  * Assumptions:
189  * - psa_status_t status exists
190  * - output_copy is the name of the output copy pointer set by LOCAL_OUTPUT_ALLOC()
191  * - output is the name of the original buffer that was copied
192  */
193 #define LOCAL_OUTPUT_FREE(output, output_copy) \
194  output_copy = NULL; \
195  do { \
196  psa_status_t local_output_status; \
197  local_output_status = psa_crypto_local_output_free(&LOCAL_OUTPUT_COPY_OF_##output); \
198  if (local_output_status != PSA_SUCCESS) { \
199  /* Since this error case is an internal error, it's more serious than \
200  * any existing error code and so it's fine to overwrite the existing \
201  * status. */ \
202  status = local_output_status; \
203  } \
204  } while (0)
205 #else /* !MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS */
206 #define LOCAL_INPUT_DECLARE(input, input_copy_name) \
207  const uint8_t *input_copy_name = NULL;
208 #define LOCAL_INPUT_ALLOC(input, length, input_copy) \
209  input_copy = input;
210 #define LOCAL_INPUT_FREE(input, input_copy) \
211  input_copy = NULL;
212 #define LOCAL_OUTPUT_DECLARE(output, output_copy_name) \
213  uint8_t *output_copy_name = NULL;
214 #define LOCAL_OUTPUT_ALLOC(output, length, output_copy) \
215  output_copy = output;
216 #define LOCAL_OUTPUT_FREE(output, output_copy) \
217  output_copy = NULL;
218 #endif /* !MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS */
219 
221 {
222  /* Mbed TLS error codes can combine a high-level error code and a
223  * low-level error code. The low-level error usually reflects the
224  * root cause better, so dispatch on that preferably. */
225  int low_level_ret = -(-ret & 0x007f);
226  switch (low_level_ret != 0 ? low_level_ret : ret) {
227  case 0:
228  return PSA_SUCCESS;
229 
236 
239 
250 
251 #if defined(MBEDTLS_ERR_BLOWFISH_BAD_INPUT_DATA)
253 #elif defined(MBEDTLS_ERR_BLOWFISH_INVALID_KEY_LENGTH)
255 #endif
260 
261 #if defined(MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA)
263 #elif defined(MBEDTLS_ERR_CAMELLIA_INVALID_KEY_LENGTH)
265 #endif
270 
277 
280 
282  return PSA_ERROR_BAD_STATE;
285 
302 
305 
306 #if !(defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) || \
307  defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE))
308  /* Only check CTR_DRBG error codes if underlying mbedtls_xxx
309  * functions are passed a CTR_DRBG instance. */
317 #endif
318 
323 
328 
335 
336 #if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) && \
337  defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE)
338  /* Only check HMAC_DRBG error codes if underlying mbedtls_xxx
339  * functions are passed a HMAC_DRBG instance. */
347 #endif
348 
353 
364 
381 
407 
412 
415 
437 
442 
447 
464 
467 
468  default:
470  }
471 }
472 
473 
474 
475 
476 /****************************************************************/
477 /* Key management */
478 /****************************************************************/
479 
480 #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
481  defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) || \
482  defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
483  defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) || \
484  defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
486  size_t bits,
487  int bits_is_sloppy)
488 {
489  switch (curve) {
491  switch (bits) {
492 #if defined(PSA_WANT_ECC_SECP_R1_192)
493  case 192:
495 #endif
496 #if defined(PSA_WANT_ECC_SECP_R1_224)
497  case 224:
499 #endif
500 #if defined(PSA_WANT_ECC_SECP_R1_256)
501  case 256:
503 #endif
504 #if defined(PSA_WANT_ECC_SECP_R1_384)
505  case 384:
507 #endif
508 #if defined(PSA_WANT_ECC_SECP_R1_521)
509  case 521:
511  case 528:
512  if (bits_is_sloppy) {
514  }
515  break;
516 #endif
517  }
518  break;
519 
521  switch (bits) {
522 #if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_256)
523  case 256:
524  return MBEDTLS_ECP_DP_BP256R1;
525 #endif
526 #if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_384)
527  case 384:
528  return MBEDTLS_ECP_DP_BP384R1;
529 #endif
530 #if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_512)
531  case 512:
532  return MBEDTLS_ECP_DP_BP512R1;
533 #endif
534  }
535  break;
536 
538  switch (bits) {
539 #if defined(PSA_WANT_ECC_MONTGOMERY_255)
540  case 255:
542  case 256:
543  if (bits_is_sloppy) {
545  }
546  break;
547 #endif
548 #if defined(PSA_WANT_ECC_MONTGOMERY_448)
549  case 448:
551 #endif
552  }
553  break;
554 
556  switch (bits) {
557 #if defined(PSA_WANT_ECC_SECP_K1_192)
558  case 192:
560 #endif
561 #if defined(PSA_WANT_ECC_SECP_K1_224)
562  case 224:
564 #endif
565 #if defined(PSA_WANT_ECC_SECP_K1_256)
566  case 256:
568 #endif
569  }
570  break;
571  }
572 
573  (void) bits_is_sloppy;
574  return MBEDTLS_ECP_DP_NONE;
575 }
576 #endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
577  defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) ||
578  defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
579  defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) ||
580  defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH) */
581 
583  size_t bits)
584 {
585  /* Check that the bit size is acceptable for the key type */
586  switch (type) {
588  case PSA_KEY_TYPE_HMAC:
589  case PSA_KEY_TYPE_DERIVE:
590  break;
591 #if defined(PSA_WANT_KEY_TYPE_AES)
592  case PSA_KEY_TYPE_AES:
593  if (bits != 128 && bits != 192 && bits != 256) {
595  }
596  break;
597 #endif
598 #if defined(PSA_WANT_KEY_TYPE_ARIA)
599  case PSA_KEY_TYPE_ARIA:
600  if (bits != 128 && bits != 192 && bits != 256) {
602  }
603  break;
604 #endif
605 #if defined(PSA_WANT_KEY_TYPE_CAMELLIA)
607  if (bits != 128 && bits != 192 && bits != 256) {
609  }
610  break;
611 #endif
612 #if defined(PSA_WANT_KEY_TYPE_DES)
613  case PSA_KEY_TYPE_DES:
614  if (bits != 64 && bits != 128 && bits != 192) {
616  }
617  break;
618 #endif
619 #if defined(PSA_WANT_KEY_TYPE_ARC4)
620  case PSA_KEY_TYPE_ARC4:
621  if (bits < 8 || bits > 2048) {
623  }
624  break;
625 #endif
626 #if defined(PSA_WANT_KEY_TYPE_CHACHA20)
628  if (bits != 256) {
630  }
631  break;
632 #endif
633  default:
635  }
636  if (bits % 8 != 0) {
638  }
639 
640  return PSA_SUCCESS;
641 }
642 
643 /** Check whether a given key type is valid for use with a given MAC algorithm
644  *
645  * Upon successful return of this function, the behavior of #PSA_MAC_LENGTH
646  * when called with the validated \p algorithm and \p key_type is well-defined.
647  *
648  * \param[in] algorithm The specific MAC algorithm (can be wildcard).
649  * \param[in] key_type The key type of the key to be used with the
650  * \p algorithm.
651  *
652  * \retval #PSA_SUCCESS
653  * The \p key_type is valid for use with the \p algorithm
654  * \retval #PSA_ERROR_INVALID_ARGUMENT
655  * The \p key_type is not valid for use with the \p algorithm
656  */
658  psa_algorithm_t algorithm,
659  psa_key_type_t key_type)
660 {
661  if (PSA_ALG_IS_HMAC(algorithm)) {
662  if (key_type == PSA_KEY_TYPE_HMAC) {
663  return PSA_SUCCESS;
664  }
665  }
666 
667  if (PSA_ALG_IS_BLOCK_CIPHER_MAC(algorithm)) {
668  /* Check that we're calling PSA_BLOCK_CIPHER_BLOCK_LENGTH with a cipher
669  * key. */
670  if ((key_type & PSA_KEY_TYPE_CATEGORY_MASK) ==
672  /* PSA_BLOCK_CIPHER_BLOCK_LENGTH returns 1 for stream ciphers and
673  * the block length (larger than 1) for block ciphers. */
674  if (PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type) > 1) {
675  return PSA_SUCCESS;
676  }
677  }
678  }
679 
681 }
682 
684  size_t buffer_length)
685 {
686  if (slot->key.data != NULL) {
688  }
689 
690  slot->key.data = mbedtls_calloc(1, buffer_length);
691  if (slot->key.data == NULL) {
693  }
694 
695  slot->key.bytes = buffer_length;
696  return PSA_SUCCESS;
697 }
698 
700  const uint8_t *data,
701  size_t data_length)
702 {
704  data_length);
705  if (status != PSA_SUCCESS) {
706  return status;
707  }
708 
709  memcpy(slot->key.data, data, data_length);
710  return PSA_SUCCESS;
711 }
712 
715  const uint8_t *data, size_t data_length,
716  uint8_t *key_buffer, size_t key_buffer_size,
717  size_t *key_buffer_length, size_t *bits)
718 {
721 
722  /* zero-length keys are never supported. */
723  if (data_length == 0) {
725  }
726 
728  *bits = PSA_BYTES_TO_BITS(data_length);
729 
730  /* Ensure that the bytes-to-bits conversion hasn't overflown. */
731  if (data_length > SIZE_MAX / 8) {
733  }
734 
735  /* Enforce a size limit, and in particular ensure that the bit
736  * size fits in its representation type. */
737  if ((*bits) > PSA_MAX_KEY_BITS) {
739  }
740 
741  status = validate_unstructured_key_bit_size(type, *bits);
742  if (status != PSA_SUCCESS) {
743  return status;
744  }
745 
746  /* Copy the key material. */
747  memcpy(key_buffer, data, data_length);
748  *key_buffer_length = data_length;
749  (void) key_buffer_size;
750 
751  return PSA_SUCCESS;
752  } else if (PSA_KEY_TYPE_IS_ASYMMETRIC(type)) {
753 #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
754  defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)
755  if (PSA_KEY_TYPE_IS_ECC(type)) {
757  data, data_length,
758  key_buffer, key_buffer_size,
759  key_buffer_length,
760  bits);
761  }
762 #endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
763  * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
764 #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
765  defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
766  if (PSA_KEY_TYPE_IS_RSA(type)) {
768  data, data_length,
769  key_buffer, key_buffer_size,
770  key_buffer_length,
771  bits);
772  }
773 #endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
774  * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
775  }
776 
778 }
779 
780 /** Calculate the intersection of two algorithm usage policies.
781  *
782  * Return 0 (which allows no operation) on incompatibility.
783  */
785  psa_key_type_t key_type,
786  psa_algorithm_t alg1,
787  psa_algorithm_t alg2)
788 {
789  /* Common case: both sides actually specify the same policy. */
790  if (alg1 == alg2) {
791  return alg1;
792  }
793  /* If the policies are from the same hash-and-sign family, check
794  * if one is a wildcard. If so the other has the specific algorithm. */
795  if (PSA_ALG_IS_SIGN_HASH(alg1) &&
796  PSA_ALG_IS_SIGN_HASH(alg2) &&
797  (alg1 & ~PSA_ALG_HASH_MASK) == (alg2 & ~PSA_ALG_HASH_MASK)) {
799  return alg2;
800  }
802  return alg1;
803  }
804  }
805  /* If the policies are from the same AEAD family, check whether
806  * one of them is a minimum-tag-length wildcard. Calculate the most
807  * restrictive tag length. */
808  if (PSA_ALG_IS_AEAD(alg1) && PSA_ALG_IS_AEAD(alg2) &&
811  size_t alg1_len = PSA_ALG_AEAD_GET_TAG_LENGTH(alg1);
812  size_t alg2_len = PSA_ALG_AEAD_GET_TAG_LENGTH(alg2);
813  size_t restricted_len = alg1_len > alg2_len ? alg1_len : alg2_len;
814 
815  /* If both are wildcards, return most restrictive wildcard */
816  if (((alg1 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
817  ((alg2 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0)) {
819  alg1, restricted_len);
820  }
821  /* If only one is a wildcard, return specific algorithm if compatible. */
822  if (((alg1 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
823  (alg1_len <= alg2_len)) {
824  return alg2;
825  }
826  if (((alg2 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
827  (alg2_len <= alg1_len)) {
828  return alg1;
829  }
830  }
831  /* If the policies are from the same MAC family, check whether one
832  * of them is a minimum-MAC-length policy. Calculate the most
833  * restrictive tag length. */
834  if (PSA_ALG_IS_MAC(alg1) && PSA_ALG_IS_MAC(alg2) &&
835  (PSA_ALG_FULL_LENGTH_MAC(alg1) ==
836  PSA_ALG_FULL_LENGTH_MAC(alg2))) {
837  /* Validate the combination of key type and algorithm. Since the base
838  * algorithm of alg1 and alg2 are the same, we only need this once. */
839  if (PSA_SUCCESS != psa_mac_key_can_do(alg1, key_type)) {
840  return 0;
841  }
842 
843  /* Get the (exact or at-least) output lengths for both sides of the
844  * requested intersection. None of the currently supported algorithms
845  * have an output length dependent on the actual key size, so setting it
846  * to a bogus value of 0 is currently OK.
847  *
848  * Note that for at-least-this-length wildcard algorithms, the output
849  * length is set to the shortest allowed length, which allows us to
850  * calculate the most restrictive tag length for the intersection. */
851  size_t alg1_len = PSA_MAC_LENGTH(key_type, 0, alg1);
852  size_t alg2_len = PSA_MAC_LENGTH(key_type, 0, alg2);
853  size_t restricted_len = alg1_len > alg2_len ? alg1_len : alg2_len;
854 
855  /* If both are wildcards, return most restrictive wildcard */
856  if (((alg1 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) &&
857  ((alg2 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0)) {
858  return PSA_ALG_AT_LEAST_THIS_LENGTH_MAC(alg1, restricted_len);
859  }
860 
861  /* If only one is an at-least-this-length policy, the intersection would
862  * be the other (fixed-length) policy as long as said fixed length is
863  * equal to or larger than the shortest allowed length. */
864  if ((alg1 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) {
865  return (alg1_len <= alg2_len) ? alg2 : 0;
866  }
867  if ((alg2 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) {
868  return (alg2_len <= alg1_len) ? alg1 : 0;
869  }
870 
871  /* If none of them are wildcards, check whether they define the same tag
872  * length. This is still possible here when one is default-length and
873  * the other specific-length. Ensure to always return the
874  * specific-length version for the intersection. */
875  if (alg1_len == alg2_len) {
876  return PSA_ALG_TRUNCATED_MAC(alg1, alg1_len);
877  }
878  }
879  /* If the policies are incompatible, allow nothing. */
880  return 0;
881 }
882 
883 static int psa_key_algorithm_permits(psa_key_type_t key_type,
884  psa_algorithm_t policy_alg,
885  psa_algorithm_t requested_alg)
886 {
887  /* Common case: the policy only allows requested_alg. */
888  if (requested_alg == policy_alg) {
889  return 1;
890  }
891  /* If policy_alg is a hash-and-sign with a wildcard for the hash,
892  * and requested_alg is the same hash-and-sign family with any hash,
893  * then requested_alg is compliant with policy_alg. */
894  if (PSA_ALG_IS_SIGN_HASH(requested_alg) &&
895  PSA_ALG_SIGN_GET_HASH(policy_alg) == PSA_ALG_ANY_HASH) {
896  return (policy_alg & ~PSA_ALG_HASH_MASK) ==
897  (requested_alg & ~PSA_ALG_HASH_MASK);
898  }
899  /* If policy_alg is a wildcard AEAD algorithm of the same base as
900  * the requested algorithm, check the requested tag length to be
901  * equal-length or longer than the wildcard-specified length. */
902  if (PSA_ALG_IS_AEAD(policy_alg) &&
903  PSA_ALG_IS_AEAD(requested_alg) &&
904  (PSA_ALG_AEAD_WITH_SHORTENED_TAG(policy_alg, 0) ==
905  PSA_ALG_AEAD_WITH_SHORTENED_TAG(requested_alg, 0)) &&
906  ((policy_alg & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0)) {
907  return PSA_ALG_AEAD_GET_TAG_LENGTH(policy_alg) <=
908  PSA_ALG_AEAD_GET_TAG_LENGTH(requested_alg);
909  }
910  /* If policy_alg is a MAC algorithm of the same base as the requested
911  * algorithm, check whether their MAC lengths are compatible. */
912  if (PSA_ALG_IS_MAC(policy_alg) &&
913  PSA_ALG_IS_MAC(requested_alg) &&
914  (PSA_ALG_FULL_LENGTH_MAC(policy_alg) ==
915  PSA_ALG_FULL_LENGTH_MAC(requested_alg))) {
916  /* Validate the combination of key type and algorithm. Since the policy
917  * and requested algorithms are the same, we only need this once. */
918  if (PSA_SUCCESS != psa_mac_key_can_do(policy_alg, key_type)) {
919  return 0;
920  }
921 
922  /* Get both the requested output length for the algorithm which is to be
923  * verified, and the default output length for the base algorithm.
924  * Note that none of the currently supported algorithms have an output
925  * length dependent on actual key size, so setting it to a bogus value
926  * of 0 is currently OK. */
927  size_t requested_output_length = PSA_MAC_LENGTH(
928  key_type, 0, requested_alg);
929  size_t default_output_length = PSA_MAC_LENGTH(
930  key_type, 0,
931  PSA_ALG_FULL_LENGTH_MAC(requested_alg));
932 
933  /* If the policy is default-length, only allow an algorithm with
934  * a declared exact-length matching the default. */
935  if (PSA_MAC_TRUNCATED_LENGTH(policy_alg) == 0) {
936  return requested_output_length == default_output_length;
937  }
938 
939  /* If the requested algorithm is default-length, allow it if the policy
940  * length exactly matches the default length. */
941  if (PSA_MAC_TRUNCATED_LENGTH(requested_alg) == 0 &&
942  PSA_MAC_TRUNCATED_LENGTH(policy_alg) == default_output_length) {
943  return 1;
944  }
945 
946  /* If policy_alg is an at-least-this-length wildcard MAC algorithm,
947  * check for the requested MAC length to be equal to or longer than the
948  * minimum allowed length. */
949  if ((policy_alg & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) {
950  return PSA_MAC_TRUNCATED_LENGTH(policy_alg) <=
951  requested_output_length;
952  }
953  }
954  /* If policy_alg is a generic key agreement operation, then using it for
955  * a key derivation with that key agreement should also be allowed. This
956  * behaviour is expected to be defined in a future specification version. */
957  if (PSA_ALG_IS_RAW_KEY_AGREEMENT(policy_alg) &&
958  PSA_ALG_IS_KEY_AGREEMENT(requested_alg)) {
959  return PSA_ALG_KEY_AGREEMENT_GET_BASE(requested_alg) ==
960  policy_alg;
961  }
962  /* If it isn't explicitly permitted, it's forbidden. */
963  return 0;
964 }
965 
966 /** Test whether a policy permits an algorithm.
967  *
968  * The caller must test usage flags separately.
969  *
970  * \note This function requires providing the key type for which the policy is
971  * being validated, since some algorithm policy definitions (e.g. MAC)
972  * have different properties depending on what kind of cipher it is
973  * combined with.
974  *
975  * \retval PSA_SUCCESS When \p alg is a specific algorithm
976  * allowed by the \p policy.
977  * \retval PSA_ERROR_INVALID_ARGUMENT When \p alg is not a specific algorithm
978  * \retval PSA_ERROR_NOT_PERMITTED When \p alg is a specific algorithm, but
979  * the \p policy does not allow it.
980  */
982  psa_key_type_t key_type,
983  psa_algorithm_t alg)
984 {
985  /* '0' is not a valid algorithm */
986  if (alg == 0) {
988  }
989 
990  /* A requested algorithm cannot be a wildcard. */
991  if (PSA_ALG_IS_WILDCARD(alg)) {
993  }
994 
995  if (psa_key_algorithm_permits(key_type, policy->alg, alg) ||
996  psa_key_algorithm_permits(key_type, policy->alg2, alg)) {
997  return PSA_SUCCESS;
998  } else {
1000  }
1001 }
1002 
1003 /** Restrict a key policy based on a constraint.
1004  *
1005  * \note This function requires providing the key type for which the policy is
1006  * being restricted, since some algorithm policy definitions (e.g. MAC)
1007  * have different properties depending on what kind of cipher it is
1008  * combined with.
1009  *
1010  * \param[in] key_type The key type for which to restrict the policy
1011  * \param[in,out] policy The policy to restrict.
1012  * \param[in] constraint The policy constraint to apply.
1013  *
1014  * \retval #PSA_SUCCESS
1015  * \c *policy contains the intersection of the original value of
1016  * \c *policy and \c *constraint.
1017  * \retval #PSA_ERROR_INVALID_ARGUMENT
1018  * \c key_type, \c *policy and \c *constraint are incompatible.
1019  * \c *policy is unchanged.
1020  */
1022  psa_key_type_t key_type,
1023  psa_key_policy_t *policy,
1024  const psa_key_policy_t *constraint)
1025 {
1026  psa_algorithm_t intersection_alg =
1027  psa_key_policy_algorithm_intersection(key_type, policy->alg,
1028  constraint->alg);
1029  psa_algorithm_t intersection_alg2 =
1030  psa_key_policy_algorithm_intersection(key_type, policy->alg2,
1031  constraint->alg2);
1032  if (intersection_alg == 0 && policy->alg != 0 && constraint->alg != 0) {
1034  }
1035  if (intersection_alg2 == 0 && policy->alg2 != 0 && constraint->alg2 != 0) {
1037  }
1038  policy->usage &= constraint->usage;
1039  policy->alg = intersection_alg;
1040  policy->alg2 = intersection_alg2;
1041  return PSA_SUCCESS;
1042 }
1043 
1044 /** Get the description of a key given its identifier and policy constraints
1045  * and lock it.
1046  *
1047  * The key must have allow all the usage flags set in \p usage. If \p alg is
1048  * nonzero, the key must allow operations with this algorithm. If \p alg is
1049  * zero, the algorithm is not checked.
1050  *
1051  * In case of a persistent key, the function loads the description of the key
1052  * into a key slot if not already done.
1053  *
1054  * On success, the returned key slot is locked. It is the responsibility of
1055  * the caller to unlock the key slot when it does not access it anymore.
1056  */
1059  psa_key_slot_t **p_slot,
1061  psa_algorithm_t alg)
1062 {
1064  psa_key_slot_t *slot;
1065 
1066  status = psa_get_and_lock_key_slot(key, p_slot);
1067  if (status != PSA_SUCCESS) {
1068  return status;
1069  }
1070  slot = *p_slot;
1071 
1072  /* Enforce that usage policy for the key slot contains all the flags
1073  * required by the usage parameter. There is one exception: public
1074  * keys can always be exported, so we treat public key objects as
1075  * if they had the export flag. */
1076  if (PSA_KEY_TYPE_IS_PUBLIC_KEY(slot->attr.type)) {
1078  }
1079 
1080  if ((slot->attr.policy.usage & usage) != usage) {
1081  status = PSA_ERROR_NOT_PERMITTED;
1082  goto error;
1083  }
1084 
1085  /* Enforce that the usage policy permits the requested algorithm. */
1086  if (alg != 0) {
1087  status = psa_key_policy_permits(&slot->attr.policy,
1088  slot->attr.type,
1089  alg);
1090  if (status != PSA_SUCCESS) {
1091  goto error;
1092  }
1093  }
1094 
1095  return PSA_SUCCESS;
1096 
1097 error:
1098  *p_slot = NULL;
1099  psa_unlock_key_slot(slot);
1100 
1101  return status;
1102 }
1103 
1104 /** Get a key slot containing a transparent key and lock it.
1105  *
1106  * A transparent key is a key for which the key material is directly
1107  * available, as opposed to a key in a secure element and/or to be used
1108  * by a secure element.
1109  *
1110  * This is a temporary function that may be used instead of
1111  * psa_get_and_lock_key_slot_with_policy() when there is no opaque key support
1112  * for a cryptographic operation.
1113  *
1114  * On success, the returned key slot is locked. It is the responsibility of the
1115  * caller to unlock the key slot when it does not access it anymore.
1116  */
1119  psa_key_slot_t **p_slot,
1121  psa_algorithm_t alg)
1122 {
1124  usage, alg);
1125  if (status != PSA_SUCCESS) {
1126  return status;
1127  }
1128 
1129  if (psa_key_lifetime_is_external((*p_slot)->attr.lifetime)) {
1130  psa_unlock_key_slot(*p_slot);
1131  *p_slot = NULL;
1132  return PSA_ERROR_NOT_SUPPORTED;
1133  }
1134 
1135  return PSA_SUCCESS;
1137 
1139 {
1140  /* Data pointer will always be either a valid pointer or NULL in an
1141  * initialized slot, so we can just free it. */
1142  if (slot->key.data != NULL) {
1143  mbedtls_platform_zeroize(slot->key.data, slot->key.bytes);
1144  }
1145 
1146  mbedtls_free(slot->key.data);
1147  slot->key.data = NULL;
1148  slot->key.bytes = 0;
1149 
1150  return PSA_SUCCESS;
1151 }
1152 
1153 /** Completely wipe a slot in memory, including its policy.
1154  * Persistent storage is not affected. */
1156 {
1158 
1159  /*
1160  * As the return error code may not be handled in case of multiple errors,
1161  * do our best to report an unexpected lock counter: if available
1162  * call MBEDTLS_PARAM_FAILED that may terminate execution (if called as
1163  * part of the execution of a test suite this will stop the test suite
1164  * execution).
1165  */
1166  if (slot->lock_count != 1) {
1167 #ifdef MBEDTLS_CHECK_PARAMS
1168  MBEDTLS_PARAM_FAILED(slot->lock_count == 1);
1169 #endif
1171  }
1172 
1173  /* Multipart operations may still be using the key. This is safe
1174  * because all multipart operation objects are independent from
1175  * the key slot: if they need to access the key after the setup
1176  * phase, they have a copy of the key. Note that this means that
1177  * key material can linger until all operations are completed. */
1178  /* At this point, key material and other type-specific content has
1179  * been wiped. Clear remaining metadata. We can call memset and not
1180  * zeroize because the metadata is not particularly sensitive. */
1181  memset(slot, 0, sizeof(*slot));
1182  return status;
1184 
1186 {
1187  psa_key_slot_t *slot;
1188  psa_status_t status; /* status of the last operation */
1189  psa_status_t overall_status = PSA_SUCCESS;
1190 #if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1191  psa_se_drv_table_entry_t *driver;
1192 #endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1193 
1195  return PSA_SUCCESS;
1196  }
1197 
1198  /*
1199  * Get the description of the key in a key slot. In case of a persistent
1200  * key, this will load the key description from persistent memory if not
1201  * done yet. We cannot avoid this loading as without it we don't know if
1202  * the key is operated by an SE or not and this information is needed by
1203  * the current implementation.
1204  */
1205  status = psa_get_and_lock_key_slot(key, &slot);
1206  if (status != PSA_SUCCESS) {
1207  return status;
1208  }
1209 
1210  /*
1211  * If the key slot containing the key description is under access by the
1212  * library (apart from the present access), the key cannot be destroyed
1213  * yet. For the time being, just return in error. Eventually (to be
1214  * implemented), the key should be destroyed when all accesses have
1215  * stopped.
1216  */
1217  if (slot->lock_count > 1) {
1218  psa_unlock_key_slot(slot);
1219  return PSA_ERROR_GENERIC_ERROR;
1220  }
1221 
1223  /* Refuse the destruction of a read-only key (which may or may not work
1224  * if we attempt it, depending on whether the key is merely read-only
1225  * by policy or actually physically read-only).
1226  * Just do the best we can, which is to wipe the copy in memory
1227  * (done in this function's cleanup code). */
1228  overall_status = PSA_ERROR_NOT_PERMITTED;
1229  goto exit;
1230  }
1231 
1232 #if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1233  driver = psa_get_se_driver_entry(slot->attr.lifetime);
1234  if (driver != NULL) {
1235  /* For a key in a secure element, we need to do three things:
1236  * remove the key file in internal storage, destroy the
1237  * key inside the secure element, and update the driver's
1238  * persistent data. Start a transaction that will encompass these
1239  * three actions. */
1240  psa_crypto_prepare_transaction(PSA_CRYPTO_TRANSACTION_DESTROY_KEY);
1241  psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
1242  psa_crypto_transaction.key.slot = psa_key_slot_get_slot_number(slot);
1243  psa_crypto_transaction.key.id = slot->attr.id;
1244  status = psa_crypto_save_transaction();
1245  if (status != PSA_SUCCESS) {
1246  (void) psa_crypto_stop_transaction();
1247  /* We should still try to destroy the key in the secure
1248  * element and the key metadata in storage. This is especially
1249  * important if the error is that the storage is full.
1250  * But how to do it exactly without risking an inconsistent
1251  * state after a reset?
1252  * https://github.com/ARMmbed/mbed-crypto/issues/215
1253  */
1254  overall_status = status;
1255  goto exit;
1256  }
1257 
1258  status = psa_destroy_se_key(driver,
1259  psa_key_slot_get_slot_number(slot));
1260  if (overall_status == PSA_SUCCESS) {
1261  overall_status = status;
1262  }
1263  }
1264 #endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1265 
1266 #if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
1268  status = psa_destroy_persistent_key(slot->attr.id);
1269  if (overall_status == PSA_SUCCESS) {
1270  overall_status = status;
1271  }
1272 
1273  /* TODO: other slots may have a copy of the same key. We should
1274  * invalidate them.
1275  * https://github.com/ARMmbed/mbed-crypto/issues/214
1276  */
1277  }
1278 #endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
1279 
1280 #if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1281  if (driver != NULL) {
1282  status = psa_save_se_persistent_data(driver);
1283  if (overall_status == PSA_SUCCESS) {
1284  overall_status = status;
1285  }
1286  status = psa_crypto_stop_transaction();
1287  if (overall_status == PSA_SUCCESS) {
1288  overall_status = status;
1289  }
1290  }
1291 #endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1292 
1293 exit:
1294  status = psa_wipe_key_slot(slot);
1295  /* Prioritize CORRUPTION_DETECTED from wiping over a storage error */
1296  if (status != PSA_SUCCESS) {
1297  overall_status = status;
1298  }
1299  return overall_status;
1300 }
1301 
1302 #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
1303  defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
1304 static psa_status_t psa_get_rsa_public_exponent(
1305  const mbedtls_rsa_context *rsa,
1307 {
1308  mbedtls_mpi mpi;
1310  uint8_t *buffer = NULL;
1311  size_t buflen;
1313 
1314  ret = mbedtls_rsa_export(rsa, NULL, NULL, NULL, NULL, &mpi);
1315  if (ret != 0) {
1316  goto exit;
1317  }
1318  if (mbedtls_mpi_cmp_int(&mpi, 65537) == 0) {
1319  /* It's the default value, which is reported as an empty string,
1320  * so there's nothing to do. */
1321  goto exit;
1322  }
1323 
1324  buflen = mbedtls_mpi_size(&mpi);
1325  buffer = mbedtls_calloc(1, buflen);
1326  if (buffer == NULL) {
1328  goto exit;
1329  }
1330  ret = mbedtls_mpi_write_binary(&mpi, buffer, buflen);
1331  if (ret != 0) {
1332  goto exit;
1333  }
1334  attributes->domain_parameters = buffer;
1335  attributes->domain_parameters_size = buflen;
1336 
1337 exit:
1339  if (ret != 0) {
1341  }
1342  return mbedtls_to_psa_error(ret);
1343 }
1344 #endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
1345  * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
1346 
1347 /** Retrieve all the publicly-accessible attributes of a key.
1348  */
1351 {
1354  psa_key_slot_t *slot;
1355 
1357 
1358  status = psa_get_and_lock_key_slot_with_policy(key, &slot, 0, 0);
1359  if (status != PSA_SUCCESS) {
1360  return status;
1361  }
1362 
1363  attributes->core = slot->attr;
1366 
1367 #if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1368  if (psa_get_se_driver_entry(slot->attr.lifetime) != NULL) {
1369  psa_set_key_slot_number(attributes,
1370  psa_key_slot_get_slot_number(slot));
1371  }
1372 #endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1373 
1374  switch (slot->attr.type) {
1375 #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
1376  defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
1379  /* TODO: reporting the public exponent for opaque keys
1380  * is not yet implemented.
1381  * https://github.com/ARMmbed/mbed-crypto/issues/216
1382  */
1384  mbedtls_rsa_context *rsa = NULL;
1385 
1387  slot->attr.type,
1388  slot->key.data,
1389  slot->key.bytes,
1390  &rsa);
1391  if (status != PSA_SUCCESS) {
1392  break;
1393  }
1394 
1395  status = psa_get_rsa_public_exponent(rsa,
1396  attributes);
1397  mbedtls_rsa_free(rsa);
1398  mbedtls_free(rsa);
1399  }
1400  break;
1401 #endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
1402  * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
1403  default:
1404  /* Nothing else to do. */
1405  break;
1406  }
1407 
1408  if (status != PSA_SUCCESS) {
1410  }
1411 
1412  unlock_status = psa_unlock_key_slot(slot);
1413 
1414  return (status == PSA_SUCCESS) ? unlock_status : status;
1415 }
1416 
1417 #if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1418 psa_status_t psa_get_key_slot_number(
1420  psa_key_slot_number_t *slot_number)
1421 {
1422  if (attributes->core.flags & MBEDTLS_PSA_KA_FLAG_HAS_SLOT_NUMBER) {
1423  *slot_number = attributes->slot_number;
1424  return PSA_SUCCESS;
1425  } else {
1427  }
1428 }
1429 #endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1430 
1431 static psa_status_t psa_export_key_buffer_internal(const uint8_t *key_buffer,
1432  size_t key_buffer_size,
1433  uint8_t *data,
1434  size_t data_size,
1435  size_t *data_length)
1436 {
1437  if (key_buffer_size > data_size) {
1439  }
1440  memcpy(data, key_buffer, key_buffer_size);
1441  memset(data + key_buffer_size, 0,
1442  data_size - key_buffer_size);
1443  *data_length = key_buffer_size;
1444  return PSA_SUCCESS;
1446 
1449  const uint8_t *key_buffer, size_t key_buffer_size,
1450  uint8_t *data, size_t data_size, size_t *data_length)
1451 {
1453 
1454  if (key_type_is_raw_bytes(type) ||
1458  key_buffer, key_buffer_size,
1459  data, data_size, data_length);
1460  } else {
1461  /* This shouldn't happen in the reference implementation, but
1462  it is valid for a special-purpose implementation to omit
1463  support for exporting certain key types. */
1464  return PSA_ERROR_NOT_SUPPORTED;
1465  }
1467 
1469  uint8_t *data_external,
1470  size_t data_size,
1471  size_t *data_length)
1472 {
1475  psa_key_slot_t *slot;
1476  LOCAL_OUTPUT_DECLARE(data_external, data);
1477  /* Reject a zero-length output buffer now, since this can never be a
1478  * valid key representation. This way we know that data must be a valid
1479  * pointer and we can do things like memset(data, ..., data_size). */
1480  if (data_size == 0) {
1482  }
1483 
1484  /* Set the key to empty now, so that even when there are errors, we always
1485  * set data_length to a value between 0 and data_size. On error, setting
1486  * the key to empty is a good choice because an empty key representation is
1487  * unlikely to be accepted anywhere. */
1488  *data_length = 0;
1489 
1490  /* Export requires the EXPORT flag. There is an exception for public keys,
1491  * which don't require any flag, but
1492  * psa_get_and_lock_key_slot_with_policy() takes care of this.
1493  */
1496  if (status != PSA_SUCCESS) {
1497  return status;
1498  }
1499 
1500  LOCAL_OUTPUT_ALLOC(data_external, data_size, data);
1501 
1503  .core = slot->attr
1504  };
1506  slot->key.data, slot->key.bytes,
1507  data, data_size, data_length);
1508 
1509 #if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
1510 exit:
1511 #endif
1512  unlock_status = psa_unlock_key_slot(slot);
1513 
1514  LOCAL_OUTPUT_FREE(data_external, data);
1515  return (status == PSA_SUCCESS) ? unlock_status : status;
1517 
1520  const uint8_t *key_buffer,
1521  size_t key_buffer_size,
1522  uint8_t *data,
1523  size_t data_size,
1524  size_t *data_length)
1525 {
1527 
1530  /* Exporting public -> public */
1532  key_buffer, key_buffer_size,
1533  data, data_size, data_length);
1534  }
1535 
1536  if (PSA_KEY_TYPE_IS_RSA(type)) {
1537 #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
1538  defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
1540  key_buffer,
1541  key_buffer_size,
1542  data,
1543  data_size,
1544  data_length);
1545 #else
1546  /* We don't know how to convert a private RSA key to public. */
1547  return PSA_ERROR_NOT_SUPPORTED;
1548 #endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
1549  * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
1550  } else {
1551 #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) || \
1552  defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)
1554  key_buffer,
1555  key_buffer_size,
1556  data,
1557  data_size,
1558  data_length);
1559 #else
1560  /* We don't know how to convert a private ECC key to public */
1561  return PSA_ERROR_NOT_SUPPORTED;
1562 #endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR) ||
1563  * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */
1564  }
1565  } else {
1566  /* This shouldn't happen in the reference implementation, but
1567  it is valid for a special-purpose implementation to omit
1568  support for exporting certain key types. */
1569  return PSA_ERROR_NOT_SUPPORTED;
1570  }
1572 
1574  uint8_t *data_external,
1575  size_t data_size,
1576  size_t *data_length)
1577 {
1581  psa_key_slot_t *slot;
1582  LOCAL_OUTPUT_DECLARE(data_external, data);
1583 
1584  /* Reject a zero-length output buffer now, since this can never be a
1585  * valid key representation. This way we know that data must be a valid
1586  * pointer and we can do things like memset(data, ..., data_size). */
1587  if (data_size == 0) {
1589  }
1590 
1591  /* Set the key to empty now, so that even when there are errors, we always
1592  * set data_length to a value between 0 and data_size. On error, setting
1593  * the key to empty is a good choice because an empty key representation is
1594  * unlikely to be accepted anywhere. */
1595  *data_length = 0;
1596 
1597  /* Exporting a public key doesn't require a usage flag. */
1598  status = psa_get_and_lock_key_slot_with_policy(key, &slot, 0, 0);
1599  if (status != PSA_SUCCESS) {
1600  return status;
1601  }
1602 
1603  LOCAL_OUTPUT_ALLOC(data_external, data_size, data);
1604 
1605  if (!PSA_KEY_TYPE_IS_ASYMMETRIC(slot->attr.type)) {
1606  status = PSA_ERROR_INVALID_ARGUMENT;
1607  goto exit;
1608  }
1609 
1611  .core = slot->attr
1612  };
1614  &attributes, slot->key.data, slot->key.bytes,
1615  data, data_size, data_length);
1616 
1617 exit:
1618  unlock_status = psa_unlock_key_slot(slot);
1619 
1620  LOCAL_OUTPUT_FREE(data_external, data);
1621  return (status == PSA_SUCCESS) ? unlock_status : status;
1622 }
1623 
1625  "One or more key attribute flag is listed as both external-only and dual-use")
1627  "One or more key attribute flag is listed as both internal-only and dual-use")
1629  "One or more key attribute flag is listed as both internal-only and external-only")
1630 
1631 /** Validate that a key policy is internally well-formed.
1632  *
1633  * This function only rejects invalid policies. It does not validate the
1634  * consistency of the policy with respect to other attributes of the key
1635  * such as the key type.
1636  */
1638 {
1639  if ((policy->usage & ~(PSA_KEY_USAGE_EXPORT |
1647  PSA_KEY_USAGE_DERIVE)) != 0) {
1649  }
1650 
1651  return PSA_SUCCESS;
1652 }
1653 
1654 /** Validate the internal consistency of key attributes.
1655  *
1656  * This function only rejects invalid attribute values. If does not
1657  * validate the consistency of the attributes with any key data that may
1658  * be involved in the creation of the key.
1659  *
1660  * Call this function early in the key creation process.
1661  *
1662  * \param[in] attributes Key attributes for the new key.
1663  * \param[out] p_drv On any return, the driver for the key, if any.
1664  * NULL for a transparent key.
1665  *
1666  */
1669  psa_se_drv_table_entry_t **p_drv)
1670 {
1674 
1675  status = psa_validate_key_location(lifetime, p_drv);
1676  if (status != PSA_SUCCESS) {
1677  return status;
1678  }
1679 
1680  status = psa_validate_key_persistence(lifetime);
1681  if (status != PSA_SUCCESS) {
1682  return status;
1683  }
1684 
1685  if (PSA_KEY_LIFETIME_IS_VOLATILE(lifetime)) {
1686  if (MBEDTLS_SVC_KEY_ID_GET_KEY_ID(key) != 0) {
1688  }
1689  } else {
1692  }
1693  }
1694 
1695  status = psa_validate_key_policy(&attributes->core.policy);
1696  if (status != PSA_SUCCESS) {
1697  return status;
1698  }
1699 
1700  /* Refuse to create overly large keys.
1701  * Note that this doesn't trigger on import if the attributes don't
1702  * explicitly specify a size (so psa_get_key_bits returns 0), so
1703  * psa_import_key() needs its own checks. */
1705  return PSA_ERROR_NOT_SUPPORTED;
1706  }
1707 
1708  /* Reject invalid flags. These should not be reachable through the API. */
1709  if (attributes->core.flags & ~(MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY |
1712  }
1713 
1714  return PSA_SUCCESS;
1715 }
1716 
1717 /** Prepare a key slot to receive key material.
1718  *
1719  * This function allocates a key slot and sets its metadata.
1720  *
1721  * If this function fails, call psa_fail_key_creation().
1722  *
1723  * This function is intended to be used as follows:
1724  * -# Call psa_start_key_creation() to allocate a key slot, prepare
1725  * it with the specified attributes, and in case of a volatile key assign it
1726  * a volatile key identifier.
1727  * -# Populate the slot with the key material.
1728  * -# Call psa_finish_key_creation() to finalize the creation of the slot.
1729  * In case of failure at any step, stop the sequence and call
1730  * psa_fail_key_creation().
1731  *
1732  * On success, the key slot is locked. It is the responsibility of the caller
1733  * to unlock the key slot when it does not access it anymore.
1734  *
1735  * \param method An identification of the calling function.
1736  * \param[in] attributes Key attributes for the new key.
1737  * \param[out] p_slot On success, a pointer to the prepared slot.
1738  * \param[out] p_drv On any return, the driver for the key, if any.
1739  * NULL for a transparent key.
1740  *
1741  * \retval #PSA_SUCCESS
1742  * The key slot is ready to receive key material.
1743  * \return If this function fails, the key slot is an invalid state.
1744  * You must call psa_fail_key_creation() to wipe and free the slot.
1745  */
1749  psa_key_slot_t **p_slot,
1750  psa_se_drv_table_entry_t **p_drv)
1751 {
1752  psa_status_t status;
1753  psa_key_id_t volatile_key_id;
1754  psa_key_slot_t *slot;
1755 
1756  (void) method;
1757  *p_drv = NULL;
1758 
1759  status = psa_validate_key_attributes(attributes, p_drv);
1760  if (status != PSA_SUCCESS) {
1761  return status;
1762  }
1763 
1764  status = psa_get_empty_key_slot(&volatile_key_id, p_slot);
1765  if (status != PSA_SUCCESS) {
1766  return status;
1767  }
1768  slot = *p_slot;
1769 
1770  /* We're storing the declared bit-size of the key. It's up to each
1771  * creation mechanism to verify that this information is correct.
1772  * It's automatically correct for mechanisms that use the bit-size as
1773  * an input (generate, device) but not for those where the bit-size
1774  * is optional (import, copy). In case of a volatile key, assign it the
1775  * volatile key identifier associated to the slot returned to contain its
1776  * definition. */
1777 
1778  slot->attr = attributes->core;
1780 #if !defined(MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER)
1781  slot->attr.id = volatile_key_id;
1782 #else
1783  slot->attr.id.key_id = volatile_key_id;
1784 #endif
1785  }
1786 
1787  /* Erase external-only flags from the internal copy. To access
1788  * external-only flags, query `attributes`. Thanks to the check
1789  * in psa_validate_key_attributes(), this leaves the dual-use
1790  * flags and any internal flag that psa_get_empty_key_slot()
1791  * may have set. */
1793 
1794 #if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1795  /* For a key in a secure element, we need to do three things
1796  * when creating or registering a persistent key:
1797  * create the key file in internal storage, create the
1798  * key inside the secure element, and update the driver's
1799  * persistent data. This is done by starting a transaction that will
1800  * encompass these three actions.
1801  * For registering a volatile key, we just need to find an appropriate
1802  * slot number inside the SE. Since the key is designated volatile, creating
1803  * a transaction is not required. */
1804  /* The first thing to do is to find a slot number for the new key.
1805  * We save the slot number in persistent storage as part of the
1806  * transaction data. It will be needed to recover if the power
1807  * fails during the key creation process, to clean up on the secure
1808  * element side after restarting. Obtaining a slot number from the
1809  * secure element driver updates its persistent state, but we do not yet
1810  * save the driver's persistent state, so that if the power fails,
1811  * we can roll back to a state where the key doesn't exist. */
1812  if (*p_drv != NULL) {
1813  psa_key_slot_number_t slot_number;
1814  status = psa_find_se_slot_for_key(attributes, method, *p_drv,
1815  &slot_number);
1816  if (status != PSA_SUCCESS) {
1817  return status;
1818  }
1819 
1820  if (!PSA_KEY_LIFETIME_IS_VOLATILE(attributes->core.lifetime)) {
1821  psa_crypto_prepare_transaction(PSA_CRYPTO_TRANSACTION_CREATE_KEY);
1822  psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
1823  psa_crypto_transaction.key.slot = slot_number;
1824  psa_crypto_transaction.key.id = slot->attr.id;
1825  status = psa_crypto_save_transaction();
1826  if (status != PSA_SUCCESS) {
1827  (void) psa_crypto_stop_transaction();
1828  return status;
1829  }
1830  }
1831 
1833  slot, (uint8_t *) (&slot_number), sizeof(slot_number));
1834  }
1835 
1836  if (*p_drv == NULL && method == PSA_KEY_CREATION_REGISTER) {
1837  /* Key registration only makes sense with a secure element. */
1839  }
1840 #endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1841 
1842  return PSA_SUCCESS;
1843 }
1844 
1845 /** Finalize the creation of a key once its key material has been set.
1846  *
1847  * This entails writing the key to persistent storage.
1848  *
1849  * If this function fails, call psa_fail_key_creation().
1850  * See the documentation of psa_start_key_creation() for the intended use
1851  * of this function.
1852  *
1853  * If the finalization succeeds, the function unlocks the key slot (it was
1854  * locked by psa_start_key_creation()) and the key slot cannot be accessed
1855  * anymore as part of the key creation process.
1856  *
1857  * \param[in,out] slot Pointer to the slot with key material.
1858  * \param[in] driver The secure element driver for the key,
1859  * or NULL for a transparent key.
1860  * \param[out] key On success, identifier of the key. Note that the
1861  * key identifier is also stored in the key slot.
1862  *
1863  * \retval #PSA_SUCCESS
1864  * The key was successfully created.
1865  * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription
1866  * \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription
1867  * \retval #PSA_ERROR_ALREADY_EXISTS \emptydescription
1868  * \retval #PSA_ERROR_DATA_INVALID \emptydescription
1869  * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription
1870  * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription
1871  *
1872  * \return If this function fails, the key slot is an invalid state.
1873  * You must call psa_fail_key_creation() to wipe and free the slot.
1874  */
1876  psa_key_slot_t *slot,
1877  psa_se_drv_table_entry_t *driver,
1879 {
1880  psa_status_t status = PSA_SUCCESS;
1881  (void) slot;
1882  (void) driver;
1883 
1884 #if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
1886 #if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1887  if (driver != NULL) {
1889  psa_key_slot_number_t slot_number =
1890  psa_key_slot_get_slot_number(slot);
1891 
1892  MBEDTLS_STATIC_ASSERT(sizeof(slot_number) ==
1893  sizeof(data.slot_number),
1894  "Slot number size does not match psa_se_key_data_storage_t");
1895 
1896  memcpy(&data.slot_number, &slot_number, sizeof(slot_number));
1897  status = psa_save_persistent_key(&slot->attr,
1898  (uint8_t *) &data,
1899  sizeof(data));
1900  } else
1901 #endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1902  {
1903  /* Key material is saved in export representation in the slot, so
1904  * just pass the slot buffer for storage. */
1905  status = psa_save_persistent_key(&slot->attr,
1906  slot->key.data,
1907  slot->key.bytes);
1908  }
1909  }
1910 #endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
1911 
1912 #if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1913  /* Finish the transaction for a key creation. This does not
1914  * happen when registering an existing key. Detect this case
1915  * by checking whether a transaction is in progress (actual
1916  * creation of a persistent key in a secure element requires a transaction,
1917  * but registration or volatile key creation doesn't use one). */
1918  if (driver != NULL &&
1919  psa_crypto_transaction.unknown.type == PSA_CRYPTO_TRANSACTION_CREATE_KEY) {
1920  status = psa_save_se_persistent_data(driver);
1921  if (status != PSA_SUCCESS) {
1923  return status;
1924  }
1925  status = psa_crypto_stop_transaction();
1926  }
1927 #endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1928 
1929  if (status == PSA_SUCCESS) {
1930  *key = slot->attr.id;
1931  status = psa_unlock_key_slot(slot);
1932  if (status != PSA_SUCCESS) {
1934  }
1935  }
1936 
1937  return status;
1938 }
1939 
1940 /** Abort the creation of a key.
1941  *
1942  * You may call this function after calling psa_start_key_creation(),
1943  * or after psa_finish_key_creation() fails. In other circumstances, this
1944  * function may not clean up persistent storage.
1945  * See the documentation of psa_start_key_creation() for the intended use
1946  * of this function.
1947  *
1948  * \param[in,out] slot Pointer to the slot with key material.
1949  * \param[in] driver The secure element driver for the key,
1950  * or NULL for a transparent key.
1951  */
1952 static void psa_fail_key_creation(psa_key_slot_t *slot,
1953  psa_se_drv_table_entry_t *driver)
1954 {
1955  (void) driver;
1956 
1957  if (slot == NULL) {
1958  return;
1959  }
1960 
1961 #if defined(MBEDTLS_PSA_CRYPTO_SE_C)
1962  /* TODO: If the key has already been created in the secure
1963  * element, and the failure happened later (when saving metadata
1964  * to internal storage), we need to destroy the key in the secure
1965  * element.
1966  * https://github.com/ARMmbed/mbed-crypto/issues/217
1967  */
1968 
1969  /* Abort the ongoing transaction if any (there may not be one if
1970  * the creation process failed before starting one, or if the
1971  * key creation is a registration of a key in a secure element).
1972  * Earlier functions must already have done what it takes to undo any
1973  * partial creation. All that's left is to update the transaction data
1974  * itself. */
1975  (void) psa_crypto_stop_transaction();
1976 #endif /* MBEDTLS_PSA_CRYPTO_SE_C */
1977 
1978  psa_wipe_key_slot(slot);
1979 }
1980 
1981 /** Validate optional attributes during key creation.
1982  *
1983  * Some key attributes are optional during key creation. If they are
1984  * specified in the attributes structure, check that they are consistent
1985  * with the data in the slot.
1986  *
1987  * This function should be called near the end of key creation, after
1988  * the slot in memory is fully populated but before saving persistent data.
1989  */
1991  const psa_key_slot_t *slot,
1993 {
1994  if (attributes->core.type != 0) {
1995  if (attributes->core.type != slot->attr.type) {
1997  }
1998  }
1999 
2000  if (attributes->domain_parameters_size != 0) {
2001 #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) || \
2002  defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY)
2003  if (PSA_KEY_TYPE_IS_RSA(slot->attr.type)) {
2004  mbedtls_rsa_context *rsa = NULL;
2005  mbedtls_mpi actual, required;
2007 
2009  slot->attr.type,
2010  slot->key.data,
2011  slot->key.bytes,
2012  &rsa);
2013  if (status != PSA_SUCCESS) {
2014  return status;
2015  }
2016 
2017  mbedtls_mpi_init(&actual);
2018  mbedtls_mpi_init(&required);
2019  ret = mbedtls_rsa_export(rsa,
2020  NULL, NULL, NULL, NULL, &actual);
2021  mbedtls_rsa_free(rsa);
2022  mbedtls_free(rsa);
2023  if (ret != 0) {
2024  goto rsa_exit;
2025  }
2026  ret = mbedtls_mpi_read_binary(&required,
2027  attributes->domain_parameters,
2028  attributes->domain_parameters_size);
2029  if (ret != 0) {
2030  goto rsa_exit;
2031  }
2032  if (mbedtls_mpi_cmp_mpi(&actual, &required) != 0) {
2034  }
2035 rsa_exit:
2036  mbedtls_mpi_free(&actual);
2037  mbedtls_mpi_free(&required);
2038  if (ret != 0) {
2039  return mbedtls_to_psa_error(ret);
2040  }
2041  } else
2042 #endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR) ||
2043  * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */
2044  {
2046  }
2047  }
2048 
2049  if (attributes->core.bits != 0) {
2050  if (attributes->core.bits != slot->attr.bits) {
2052  }
2053  }
2054 
2055  return PSA_SUCCESS;
2057 
2059  const uint8_t *data_external,
2060  size_t data_length,
2062 {
2063  psa_status_t status;
2064  LOCAL_INPUT_DECLARE(data_external, data);
2065  psa_key_slot_t *slot = NULL;
2066  psa_se_drv_table_entry_t *driver = NULL;
2067  size_t bits;
2068 
2070 
2071  /* Reject zero-length symmetric keys (including raw data key objects).
2072  * This also rejects any key which might be encoded as an empty string,
2073  * which is never valid. */
2074  if (data_length == 0) {
2076  }
2077 
2078  LOCAL_INPUT_ALLOC(data_external, data_length, data);
2079 
2081  &slot, &driver);
2082  if (status != PSA_SUCCESS) {
2083  goto exit;
2084  }
2085 
2086  /* In the case of a transparent key or an opaque key stored in local
2087  * storage (thus not in the case of generating a key in a secure element
2088  * or cryptoprocessor with storage), we have to allocate a buffer to
2089  * hold the generated key material. */
2090  if (slot->key.data == NULL) {
2091  status = psa_allocate_buffer_to_slot(slot, data_length);
2092  if (status != PSA_SUCCESS) {
2093  goto exit;
2094  }
2095  }
2096 
2097  bits = slot->attr.bits;
2099  data, data_length,
2100  slot->key.data,
2101  slot->key.bytes,
2102  &slot->key.bytes, &bits);
2103  if (status != PSA_SUCCESS) {
2104  goto exit;
2105  }
2106 
2107  if (slot->attr.bits == 0) {
2108  slot->attr.bits = (psa_key_bits_t) bits;
2109  } else if (bits != slot->attr.bits) {
2110  status = PSA_ERROR_INVALID_ARGUMENT;
2111  goto exit;
2112  }
2113 
2115  if (status != PSA_SUCCESS) {
2116  goto exit;
2117  }
2118 
2119  status = psa_finish_key_creation(slot, driver, key);
2120 exit:
2121  LOCAL_INPUT_FREE(data_external, data);
2122  if (status != PSA_SUCCESS) {
2123  psa_fail_key_creation(slot, driver);
2124  }
2125 
2126  return status;
2127 }
2128 
2129 #if defined(MBEDTLS_PSA_CRYPTO_SE_C)
2130 psa_status_t mbedtls_psa_register_se_key(
2132 {
2133  psa_status_t status;
2134  psa_key_slot_t *slot = NULL;
2135  psa_se_drv_table_entry_t *driver = NULL;
2137 
2138  /* Leaving attributes unspecified is not currently supported.
2139  * It could make sense to query the key type and size from the
2140  * secure element, but not all secure elements support this
2141  * and the driver HAL doesn't currently support it. */
2143  return PSA_ERROR_NOT_SUPPORTED;
2144  }
2145  if (psa_get_key_bits(attributes) == 0) {
2146  return PSA_ERROR_NOT_SUPPORTED;
2147  }
2148 
2150  &slot, &driver);
2151  if (status != PSA_SUCCESS) {
2152  goto exit;
2153  }
2154 
2155  status = psa_finish_key_creation(slot, driver, &key);
2156 
2157 exit:
2158  if (status != PSA_SUCCESS) {
2159  psa_fail_key_creation(slot, driver);
2160  }
2161 
2162  /* Registration doesn't keep the key in RAM. */
2163  psa_close_key(key);
2164  return status;
2165 }
2166 #endif /* MBEDTLS_PSA_CRYPTO_SE_C */
2167 
2169  psa_key_slot_t *target)
2170 {
2172  source->key.data,
2173  source->key.bytes);
2174  if (status != PSA_SUCCESS) {
2175  return status;
2176  }
2177 
2178  target->attr.type = source->attr.type;
2179  target->attr.bits = source->attr.bits;
2180 
2181  return PSA_SUCCESS;
2183 
2185  const psa_key_attributes_t *specified_attributes,
2186  mbedtls_svc_key_id_t *target_key)
2187 {
2190  psa_key_slot_t *source_slot = NULL;
2191  psa_key_slot_t *target_slot = NULL;
2192  psa_key_attributes_t actual_attributes = *specified_attributes;
2193  psa_se_drv_table_entry_t *driver = NULL;
2194 
2195  *target_key = MBEDTLS_SVC_KEY_ID_INIT;
2196 
2198  source_key, &source_slot, PSA_KEY_USAGE_COPY, 0);
2199  if (status != PSA_SUCCESS) {
2200  goto exit;
2201  }
2202 
2203  status = psa_validate_optional_attributes(source_slot,
2204  specified_attributes);
2205  if (status != PSA_SUCCESS) {
2206  goto exit;
2207  }
2208 
2209  status = psa_restrict_key_policy(source_slot->attr.type,
2210  &actual_attributes.core.policy,
2211  &source_slot->attr.policy);
2212  if (status != PSA_SUCCESS) {
2213  goto exit;
2214  }
2215 
2216  status = psa_start_key_creation(PSA_KEY_CREATION_COPY, &actual_attributes,
2217  &target_slot, &driver);
2218  if (status != PSA_SUCCESS) {
2219  goto exit;
2220  }
2221 
2222 #if defined(MBEDTLS_PSA_CRYPTO_SE_C)
2223  if (driver != NULL) {
2224  /* Copying to a secure element is not implemented yet. */
2225  status = PSA_ERROR_NOT_SUPPORTED;
2226  goto exit;
2227  }
2228 #endif /* MBEDTLS_PSA_CRYPTO_SE_C */
2229 
2230  if (psa_key_lifetime_is_external(actual_attributes.core.lifetime)) {
2231  /*
2232  * Copying through an opaque driver is not implemented yet, consider
2233  * a lifetime with an external location as an invalid parameter for
2234  * now.
2235  */
2236  status = PSA_ERROR_INVALID_ARGUMENT;
2237  goto exit;
2238  }
2239 
2240  status = psa_copy_key_material(source_slot, target_slot);
2241  if (status != PSA_SUCCESS) {
2242  goto exit;
2243  }
2244 
2245  status = psa_finish_key_creation(target_slot, driver, target_key);
2246 exit:
2247  if (status != PSA_SUCCESS) {
2248  psa_fail_key_creation(target_slot, driver);
2249  }
2250 
2251  unlock_status = psa_unlock_key_slot(source_slot);
2252 
2253  return (status == PSA_SUCCESS) ? unlock_status : status;
2254 }
2255 
2256 
2257 
2258 /****************************************************************/
2259 /* Message digests */
2260 /****************************************************************/
2261 
2263 {
2264  /* Aborting a non-active operation is allowed */
2265  if (operation->id == 0) {
2266  return PSA_SUCCESS;
2267  }
2268 
2270  operation->id = 0;
2271 
2272  return status;
2274 
2276  psa_algorithm_t alg)
2277 {
2279 
2280  /* A context must be freshly initialized before it can be set up. */
2281  if (operation->id != 0) {
2282  status = PSA_ERROR_BAD_STATE;
2283  goto exit;
2284  }
2285 
2286  if (!PSA_ALG_IS_HASH(alg)) {
2287  status = PSA_ERROR_INVALID_ARGUMENT;
2288  goto exit;
2289  }
2290 
2291  /* Ensure all of the context is zeroized, since PSA_HASH_OPERATION_INIT only
2292  * directly zeroes the int-sized dummy member of the context union. */
2293  memset(&operation->ctx, 0, sizeof(operation->ctx));
2294 
2296 
2297 exit:
2298  if (status != PSA_SUCCESS) {
2300  }
2301 
2302  return status;
2304 
2306  const uint8_t *input_external,
2307  size_t input_length)
2308 {
2310  LOCAL_INPUT_DECLARE(input_external, input);
2311 
2312  if (operation->id == 0) {
2313  status = PSA_ERROR_BAD_STATE;
2314  goto exit;
2315  }
2316 
2317  /* Don't require hash implementations to behave correctly on a
2318  * zero-length input, which may have an invalid pointer. */
2319  if (input_length == 0) {
2320  return PSA_SUCCESS;
2321  }
2322 
2323  LOCAL_INPUT_ALLOC(input_external, input_length, input);
2324  status = psa_driver_wrapper_hash_update(operation, input, input_length);
2325 
2326 exit:
2327  if (status != PSA_SUCCESS) {
2329  }
2330 
2331  LOCAL_INPUT_FREE(input_external, input);
2332  return status;
2334 
2336  uint8_t *hash,
2337  size_t hash_size,
2338  size_t *hash_length)
2339 {
2341 
2342  *hash_length = 0;
2343  if (operation->id == 0) {
2344  return PSA_ERROR_BAD_STATE;
2345  }
2346 
2348  operation, hash, hash_size, hash_length);
2350 
2351  return status;
2353 
2355  uint8_t *hash_external,
2356  size_t hash_size,
2357  size_t *hash_length)
2358 {
2360  LOCAL_OUTPUT_DECLARE(hash_external, hash);
2361 
2362  LOCAL_OUTPUT_ALLOC(hash_external, hash_size, hash);
2363  status = psa_hash_finish_internal(operation, hash, hash_size, hash_length);
2364 
2365 #if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
2366 exit:
2367 #endif
2368  LOCAL_OUTPUT_FREE(hash_external, hash);
2369  return status;
2371 
2373  const uint8_t *hash_external,
2374  size_t hash_length)
2375 {
2376  uint8_t actual_hash[PSA_HASH_MAX_SIZE];
2377  size_t actual_hash_length;
2379  LOCAL_INPUT_DECLARE(hash_external, hash);
2380 
2381  status = psa_hash_finish_internal(
2382  operation,
2383  actual_hash, sizeof(actual_hash),
2384  &actual_hash_length);
2385 
2386  if (status != PSA_SUCCESS) {
2387  goto exit;
2388  }
2389 
2390  if (actual_hash_length != hash_length) {
2391  status = PSA_ERROR_INVALID_SIGNATURE;
2392  goto exit;
2393  }
2394 
2395  LOCAL_INPUT_ALLOC(hash_external, hash_length, hash);
2396  if (mbedtls_psa_safer_memcmp(hash, actual_hash, actual_hash_length) != 0) {
2397  status = PSA_ERROR_INVALID_SIGNATURE;
2398  }
2399 
2400 exit:
2401  mbedtls_platform_zeroize(actual_hash, sizeof(actual_hash));
2402  if (status != PSA_SUCCESS) {
2404  }
2405  LOCAL_INPUT_FREE(hash_external, hash);
2406  return status;
2408 
2410  const uint8_t *input_external, size_t input_length,
2411  uint8_t *hash_external, size_t hash_size,
2412  size_t *hash_length)
2413 {
2415  LOCAL_INPUT_DECLARE(input_external, input);
2416  LOCAL_OUTPUT_DECLARE(hash_external, hash);
2417 
2418  *hash_length = 0;
2419  if (!PSA_ALG_IS_HASH(alg)) {
2421  }
2422 
2423  LOCAL_INPUT_ALLOC(input_external, input_length, input);
2424  LOCAL_OUTPUT_ALLOC(hash_external, hash_size, hash);
2425  status = psa_driver_wrapper_hash_compute(alg, input, input_length,
2426  hash, hash_size, hash_length);
2427 
2428 #if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
2429 exit:
2430 #endif
2431  LOCAL_INPUT_FREE(input_external, input);
2432  LOCAL_OUTPUT_FREE(hash_external, hash);
2433  return status;
2435 
2437  const uint8_t *input_external, size_t input_length,
2438  const uint8_t *hash_external, size_t hash_length)
2439 {
2440  uint8_t actual_hash[PSA_HASH_MAX_SIZE];
2441  size_t actual_hash_length;
2443 
2444  LOCAL_INPUT_DECLARE(input_external, input);
2445  LOCAL_INPUT_DECLARE(hash_external, hash);
2446 
2447  if (!PSA_ALG_IS_HASH(alg)) {
2448  status = PSA_ERROR_INVALID_ARGUMENT;
2449  return status;
2450  }
2451 
2452  LOCAL_INPUT_ALLOC(input_external, input_length, input);
2454  alg, input, input_length,
2455  actual_hash, sizeof(actual_hash),
2456  &actual_hash_length);
2457  if (status != PSA_SUCCESS) {
2458  goto exit;
2459  }
2460  if (actual_hash_length != hash_length) {
2461  status = PSA_ERROR_INVALID_SIGNATURE;
2462  goto exit;
2463  }
2464 
2465  LOCAL_INPUT_ALLOC(hash_external, hash_length, hash);
2466  if (mbedtls_psa_safer_memcmp(hash, actual_hash, actual_hash_length) != 0) {
2467  status = PSA_ERROR_INVALID_SIGNATURE;
2468  }
2469 
2470 exit:
2471  mbedtls_platform_zeroize(actual_hash, sizeof(actual_hash));
2472 
2473  LOCAL_INPUT_FREE(input_external, input);
2474  LOCAL_INPUT_FREE(hash_external, hash);
2475 
2476  return status;
2478 
2479 psa_status_t psa_hash_clone(const psa_hash_operation_t *source_operation,
2480  psa_hash_operation_t *target_operation)
2481 {
2482  if (source_operation->id == 0 ||
2483  target_operation->id != 0) {
2484  return PSA_ERROR_BAD_STATE;
2485  }
2486 
2487  psa_status_t status = psa_driver_wrapper_hash_clone(source_operation,
2488  target_operation);
2489  if (status != PSA_SUCCESS) {
2490  psa_hash_abort(target_operation);
2491  }
2492 
2493  return status;
2494 }
2495 
2496 
2497 /****************************************************************/
2498 /* MAC */
2499 /****************************************************************/
2500 
2502 {
2503  /* Aborting a non-active operation is allowed */
2504  if (operation->id == 0) {
2505  return PSA_SUCCESS;
2506  }
2507 
2509  operation->mac_size = 0;
2510  operation->is_sign = 0;
2511  operation->id = 0;
2512 
2513  return status;
2515 
2517  psa_algorithm_t alg,
2519  uint8_t *mac_size)
2520 {
2523  size_t key_bits = psa_get_key_bits(attributes);
2524 
2525  if (!PSA_ALG_IS_MAC(alg)) {
2527  }
2528 
2529  /* Validate the combination of key type and algorithm */
2530  status = psa_mac_key_can_do(alg, key_type);
2531  if (status != PSA_SUCCESS) {
2532  return status;
2533  }
2534 
2535  /* Get the output length for the algorithm and key combination */
2536  *mac_size = PSA_MAC_LENGTH(key_type, key_bits, alg);
2537 
2538  if (*mac_size < 4) {
2539  /* A very short MAC is too short for security since it can be
2540  * brute-forced. Ancient protocols with 32-bit MACs do exist,
2541  * so we make this our minimum, even though 32 bits is still
2542  * too small for security. */
2543  return PSA_ERROR_NOT_SUPPORTED;
2544  }
2545 
2546  if (*mac_size > PSA_MAC_LENGTH(key_type, key_bits,
2547  PSA_ALG_FULL_LENGTH_MAC(alg))) {
2548  /* It's impossible to "truncate" to a larger length than the full length
2549  * of the algorithm. */
2551  }
2552 
2553  if (*mac_size > PSA_MAC_MAX_SIZE) {
2554  /* PSA_MAC_LENGTH returns the correct length even for a MAC algorithm
2555  * that is disabled in the compile-time configuration. The result can
2556  * therefore be larger than PSA_MAC_MAX_SIZE, which does take the
2557  * configuration into account. In this case, force a return of
2558  * PSA_ERROR_NOT_SUPPORTED here. Otherwise psa_mac_verify(), or
2559  * psa_mac_compute(mac_size=PSA_MAC_MAX_SIZE), would return
2560  * PSA_ERROR_BUFFER_TOO_SMALL for an unsupported algorithm whose MAC size
2561  * is larger than PSA_MAC_MAX_SIZE, which is misleading and which breaks
2562  * systematically generated tests. */
2563  return PSA_ERROR_NOT_SUPPORTED;
2564  }
2565 
2566  return PSA_SUCCESS;
2568 
2571  psa_algorithm_t alg,
2572  int is_sign)
2573 {
2577  psa_key_slot_t *slot = NULL;
2578 
2579  /* A context must be freshly initialized before it can be set up. */
2580  if (operation->id != 0) {
2581  status = PSA_ERROR_BAD_STATE;
2582  goto exit;
2583  }
2584 
2586  key,
2587  &slot,
2589  alg);
2590  if (status != PSA_SUCCESS) {
2591  goto exit;
2592  }
2593 
2595  .core = slot->attr
2596  };
2597 
2599  &operation->mac_size);
2600  if (status != PSA_SUCCESS) {
2601  goto exit;
2602  }
2603 
2604  operation->is_sign = is_sign;
2605  /* Dispatch the MAC setup call with validated input */
2606  if (is_sign) {
2608  &attributes,
2609  slot->key.data,
2610  slot->key.bytes,
2611  alg);
2612  } else {
2614  &attributes,
2615  slot->key.data,
2616  slot->key.bytes,
2617  alg);
2618  }
2619 
2620 exit:
2621  if (status != PSA_SUCCESS) {
2623  }
2624 
2625  unlock_status = psa_unlock_key_slot(slot);
2626 
2627  return (status == PSA_SUCCESS) ? unlock_status : status;
2629 
2632  psa_algorithm_t alg)
2633 {
2634  return psa_mac_setup(operation, key, alg, 1);
2636 
2639  psa_algorithm_t alg)
2640 {
2641  return psa_mac_setup(operation, key, alg, 0);
2643 
2645  const uint8_t *input_external,
2646  size_t input_length)
2647 {
2649  LOCAL_INPUT_DECLARE(input_external, input);
2650 
2651  if (operation->id == 0) {
2652  status = PSA_ERROR_BAD_STATE;
2653  return status;
2654  }
2655 
2656  /* Don't require hash implementations to behave correctly on a
2657  * zero-length input, which may have an invalid pointer. */
2658  if (input_length == 0) {
2659  status = PSA_SUCCESS;
2660  return status;
2661  }
2662 
2663  LOCAL_INPUT_ALLOC(input_external, input_length, input);
2664  status = psa_driver_wrapper_mac_update(operation, input, input_length);
2665 
2666  if (status != PSA_SUCCESS) {
2668  }
2669 
2670 #if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
2671 exit:
2672 #endif
2673  LOCAL_INPUT_FREE(input_external, input);
2674 
2675  return status;
2677 
2679  uint8_t *mac_external,
2680  size_t mac_size,
2681  size_t *mac_length)
2682 {
2685  LOCAL_OUTPUT_DECLARE(mac_external, mac);
2686  LOCAL_OUTPUT_ALLOC(mac_external, mac_size, mac);
2687 
2688  if (operation->id == 0) {
2689  status = PSA_ERROR_BAD_STATE;
2690  goto exit;
2691  }
2692 
2693  if (!operation->is_sign) {
2694  status = PSA_ERROR_BAD_STATE;
2695  goto exit;
2696  }
2697 
2698  /* Sanity check. This will guarantee that mac_size != 0 (and so mac != NULL)
2699  * once all the error checks are done. */
2700  if (operation->mac_size == 0) {
2701  status = PSA_ERROR_BAD_STATE;
2702  goto exit;
2703  }
2704 
2705  if (mac_size < operation->mac_size) {
2706  status = PSA_ERROR_BUFFER_TOO_SMALL;
2707  goto exit;
2708  }
2709 
2711  mac, operation->mac_size,
2712  mac_length);
2713 
2714 exit:
2715  /* In case of success, set the potential excess room in the output buffer
2716  * to an invalid value, to avoid potentially leaking a longer MAC.
2717  * In case of error, set the output length and content to a safe default,
2718  * such that in case the caller misses an error check, the output would be
2719  * an unachievable MAC.
2720  */
2721  if (status != PSA_SUCCESS) {
2722  *mac_length = mac_size;
2723  operation->mac_size = 0;
2724  }
2725 
2726  if ((mac != NULL) && (mac_size > operation->mac_size)) {
2727  memset(&mac[operation->mac_size], '!',
2728  mac_size - operation->mac_size);
2729  }
2730 
2731  abort_status = psa_mac_abort(operation);
2732  LOCAL_OUTPUT_FREE(mac_external, mac);
2733 
2734  return status == PSA_SUCCESS ? abort_status : status;
2736 
2738  const uint8_t *mac_external,
2739  size_t mac_length)
2740 {
2743  LOCAL_INPUT_DECLARE(mac_external, mac);
2744 
2745  if (operation->id == 0) {
2746  status = PSA_ERROR_BAD_STATE;
2747  goto exit;
2748  }
2749 
2750  if (operation->is_sign) {
2751  status = PSA_ERROR_BAD_STATE;
2752  goto exit;
2753  }
2754 
2755  if (operation->mac_size != mac_length) {
2756  status = PSA_ERROR_INVALID_SIGNATURE;
2757  goto exit;
2758  }
2759 
2760  LOCAL_INPUT_ALLOC(mac_external, mac_length, mac);
2762  mac, mac_length);
2763 
2764 exit:
2765  abort_status = psa_mac_abort(operation);
2766  LOCAL_INPUT_FREE(mac_external, mac);
2767 
2768  return status == PSA_SUCCESS ? abort_status : status;
2770 
2772  psa_algorithm_t alg,
2773  const uint8_t *input,
2774  size_t input_length,
2775  uint8_t *mac,
2776  size_t mac_size,
2777  size_t *mac_length,
2778  int is_sign)
2779 {
2783  psa_key_slot_t *slot;
2784  uint8_t operation_mac_size = 0;
2785 
2787  key,
2788  &slot,
2790  alg);
2791  if (status != PSA_SUCCESS) {
2792  goto exit;
2793  }
2794 
2796  .core = slot->attr
2797  };
2798 
2800  &operation_mac_size);
2801  if (status != PSA_SUCCESS) {
2802  goto exit;
2803  }
2804 
2805  if (mac_size < operation_mac_size) {
2806  status = PSA_ERROR_BUFFER_TOO_SMALL;
2807  goto exit;
2808  }
2809 
2811  &attributes,
2812  slot->key.data, slot->key.bytes,
2813  alg,
2814  input, input_length,
2815  mac, operation_mac_size, mac_length);
2816 
2817 exit:
2818  /* In case of success, set the potential excess room in the output buffer
2819  * to an invalid value, to avoid potentially leaking a longer MAC.
2820  * In case of error, set the output length and content to a safe default,
2821  * such that in case the caller misses an error check, the output would be
2822  * an unachievable MAC.
2823  */
2824  if (status != PSA_SUCCESS) {
2825  *mac_length = mac_size;
2826  operation_mac_size = 0;
2827  }
2828  if (mac_size > operation_mac_size) {
2829  memset(&mac[operation_mac_size], '!', mac_size - operation_mac_size);
2830  }
2831 
2832  unlock_status = psa_unlock_key_slot(slot);
2833 
2834  return (status == PSA_SUCCESS) ? unlock_status : status;
2836 
2838  psa_algorithm_t alg,
2839  const uint8_t *input_external,
2840  size_t input_length,
2841  uint8_t *mac_external,
2842  size_t mac_size,
2843  size_t *mac_length)
2844 {
2846  LOCAL_INPUT_DECLARE(input_external, input);
2847  LOCAL_OUTPUT_DECLARE(mac_external, mac);
2848 
2849  LOCAL_INPUT_ALLOC(input_external, input_length, input);
2850  LOCAL_OUTPUT_ALLOC(mac_external, mac_size, mac);
2851  status = psa_mac_compute_internal(key, alg,
2852  input, input_length,
2853  mac, mac_size, mac_length, 1);
2854 
2855 #if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
2856 exit:
2857 #endif
2858  LOCAL_INPUT_FREE(input_external, input);
2859  LOCAL_OUTPUT_FREE(mac_external, mac);
2860 
2861  return status;
2863 
2865  psa_algorithm_t alg,
2866  const uint8_t *input_external,
2867  size_t input_length,
2868  const uint8_t *mac_external,
2869  size_t mac_length)
2870 {
2872  uint8_t actual_mac[PSA_MAC_MAX_SIZE];
2873  size_t actual_mac_length;
2874  LOCAL_INPUT_DECLARE(input_external, input);
2875  LOCAL_INPUT_DECLARE(mac_external, mac);
2876 
2877  LOCAL_INPUT_ALLOC(input_external, input_length, input);
2878  status = psa_mac_compute_internal(key, alg,
2879  input, input_length,
2880  actual_mac, sizeof(actual_mac),
2881  &actual_mac_length, 0);
2882  if (status != PSA_SUCCESS) {
2883  goto exit;
2884  }
2885 
2886  if (mac_length != actual_mac_length) {
2887  status = PSA_ERROR_INVALID_SIGNATURE;
2888  goto exit;
2889  }
2890 
2891  LOCAL_INPUT_ALLOC(mac_external, mac_length, mac);
2892  if (mbedtls_psa_safer_memcmp(mac, actual_mac, actual_mac_length) != 0) {
2893  status = PSA_ERROR_INVALID_SIGNATURE;
2894  goto exit;
2895  }
2896 
2897 exit:
2898  mbedtls_platform_zeroize(actual_mac, sizeof(actual_mac));
2899  LOCAL_INPUT_FREE(input_external, input);
2900  LOCAL_INPUT_FREE(mac_external, mac);
2901 
2902  return status;
2903 }
2904 
2905 /****************************************************************/
2906 /* Asymmetric cryptography */
2907 /****************************************************************/
2908 
2909 static psa_status_t psa_sign_verify_check_alg(int input_is_message,
2910  psa_algorithm_t alg)
2911 {
2912  if (input_is_message) {
2913  if (!PSA_ALG_IS_SIGN_MESSAGE(alg)) {
2915  }
2916 
2917  if (PSA_ALG_IS_SIGN_HASH(alg)) {
2920  }
2921  }
2922  } else {
2923  if (!PSA_ALG_IS_SIGN_HASH(alg)) {
2925  }
2926  }
2927 
2928  return PSA_SUCCESS;
2930 
2932  int input_is_message,
2933  psa_algorithm_t alg,
2934  const uint8_t *input,
2935  size_t input_length,
2936  uint8_t *signature,
2937  size_t signature_size,
2938  size_t *signature_length)
2939 {
2943  psa_key_slot_t *slot;
2944 
2945  *signature_length = 0;
2946 
2947  status = psa_sign_verify_check_alg(input_is_message, alg);
2948  if (status != PSA_SUCCESS) {
2949  return status;
2950  }
2951 
2952  /* Immediately reject a zero-length signature buffer. This guarantees
2953  * that signature must be a valid pointer. (On the other hand, the input
2954  * buffer can in principle be empty since it doesn't actually have
2955  * to be a hash.) */
2956  if (signature_size == 0) {
2958  }
2959 
2961  key, &slot,
2962  input_is_message ? PSA_KEY_USAGE_SIGN_MESSAGE :
2964  alg);
2965 
2966  if (status != PSA_SUCCESS) {
2967  goto exit;
2968  }
2969 
2970  if (!PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type)) {
2971  status = PSA_ERROR_INVALID_ARGUMENT;
2972  goto exit;
2973  }
2974 
2976  .core = slot->attr
2977  };
2978 
2979  if (input_is_message) {
2981  &attributes, slot->key.data, slot->key.bytes,
2982  alg, input, input_length,
2983  signature, signature_size, signature_length);
2984  } else {
2985 
2987  &attributes, slot->key.data, slot->key.bytes,
2988  alg, input, input_length,
2989  signature, signature_size, signature_length);
2990  }
2991 
2992 
2993 exit:
2994  /* Fill the unused part of the output buffer (the whole buffer on error,
2995  * the trailing part on success) with something that isn't a valid signature
2996  * (barring an attack on the signature and deliberately-crafted input),
2997  * in case the caller doesn't check the return status properly. */
2998  if (status == PSA_SUCCESS) {
2999  memset(signature + *signature_length, '!',
3000  signature_size - *signature_length);
3001  } else {
3002  memset(signature, '!', signature_size);
3003  }
3004  /* If signature_size is 0 then we have nothing to do. We must not call
3005  * memset because signature may be NULL in this case. */
3006 
3007  unlock_status = psa_unlock_key_slot(slot);
3008 
3009  return (status == PSA_SUCCESS) ? unlock_status : status;
3011 
3013  int input_is_message,
3014  psa_algorithm_t alg,
3015  const uint8_t *input,
3016  size_t input_length,
3017  const uint8_t *signature,
3018  size_t signature_length)
3019 {
3022  psa_key_slot_t *slot;
3023 
3024  status = psa_sign_verify_check_alg(input_is_message, alg);
3025  if (status != PSA_SUCCESS) {
3026  return status;
3027  }
3028 
3030  key, &slot,
3031  input_is_message ? PSA_KEY_USAGE_VERIFY_MESSAGE :
3033  alg);
3034 
3035  if (status != PSA_SUCCESS) {
3036  return status;
3037  }
3038 
3040  .core = slot->attr
3041  };
3042 
3043  if (input_is_message) {
3045  &attributes, slot->key.data, slot->key.bytes,
3046  alg, input, input_length,
3047  signature, signature_length);
3048  } else {
3050  &attributes, slot->key.data, slot->key.bytes,
3051  alg, input, input_length,
3052  signature, signature_length);
3053  }
3054 
3055  unlock_status = psa_unlock_key_slot(slot);
3056 
3057  return (status == PSA_SUCCESS) ? unlock_status : status;
3058 
3060 
3063  const uint8_t *key_buffer,
3064  size_t key_buffer_size,
3065  psa_algorithm_t alg,
3066  const uint8_t *input,
3067  size_t input_length,
3068  uint8_t *signature,
3069  size_t signature_size,
3070  size_t *signature_length)
3071 {
3073 
3074  if (PSA_ALG_IS_SIGN_HASH(alg)) {
3075  size_t hash_length;
3077 
3079  PSA_ALG_SIGN_GET_HASH(alg),
3080  input, input_length,
3081  hash, sizeof(hash), &hash_length);
3082 
3083  if (status != PSA_SUCCESS) {
3084  return status;
3085  }
3086 
3088  attributes, key_buffer, key_buffer_size,
3089  alg, hash, hash_length,
3090  signature, signature_size, signature_length);
3091  }
3092 
3093  return PSA_ERROR_NOT_SUPPORTED;
3095 
3097  psa_algorithm_t alg,
3098  const uint8_t *input_external,
3099  size_t input_length,
3100  uint8_t *signature_external,
3101  size_t signature_size,
3102  size_t *signature_length)
3103 {
3105  LOCAL_INPUT_DECLARE(input_external, input);
3106  LOCAL_OUTPUT_DECLARE(signature_external, signature);
3107 
3108  LOCAL_INPUT_ALLOC(input_external, input_length, input);
3109  LOCAL_OUTPUT_ALLOC(signature_external, signature_size, signature);
3110  status = psa_sign_internal(key, 1, alg, input, input_length, signature,
3111  signature_size, signature_length);
3112 
3113 #if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
3114 exit:
3115 #endif
3116  LOCAL_INPUT_FREE(input_external, input);
3117  LOCAL_OUTPUT_FREE(signature_external, signature);
3118  return status;
3120 
3123  const uint8_t *key_buffer,
3124  size_t key_buffer_size,
3125  psa_algorithm_t alg,
3126  const uint8_t *input,
3127  size_t input_length,
3128  const uint8_t *signature,
3129  size_t signature_length)
3130 {
3132 
3133  if (PSA_ALG_IS_SIGN_HASH(alg)) {
3134  size_t hash_length;
3136 
3138  PSA_ALG_SIGN_GET_HASH(alg),
3139  input, input_length,
3140  hash, sizeof(hash), &hash_length);
3141 
3142  if (status != PSA_SUCCESS) {
3143  return status;
3144  }
3145 
3147  attributes, key_buffer, key_buffer_size,
3148  alg, hash, hash_length,
3149  signature, signature_length);
3150  }
3151 
3152  return PSA_ERROR_NOT_SUPPORTED;
3154 
3156  psa_algorithm_t alg,
3157  const uint8_t *input_external,
3158  size_t input_length,
3159  const uint8_t *signature_external,
3160  size_t signature_length)
3161 {
3163  LOCAL_INPUT_DECLARE(input_external, input);
3164  LOCAL_INPUT_DECLARE(signature_external, signature);
3165 
3166  LOCAL_INPUT_ALLOC(input_external, input_length, input);
3167  LOCAL_INPUT_ALLOC(signature_external, signature_length, signature);
3168  status = psa_verify_internal(key, 1, alg, input, input_length, signature,
3169  signature_length);
3170 
3171 #if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
3172 exit:
3173 #endif
3174  LOCAL_INPUT_FREE(input_external, input);
3175  LOCAL_INPUT_FREE(signature_external, signature);
3176 
3177  return status;
3179 
3182  const uint8_t *key_buffer, size_t key_buffer_size,
3183  psa_algorithm_t alg, const uint8_t *hash, size_t hash_length,
3184  uint8_t *signature, size_t signature_size, size_t *signature_length)
3185 {
3186  if (attributes->core.type == PSA_KEY_TYPE_RSA_KEY_PAIR) {
3187  if (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) ||
3188  PSA_ALG_IS_RSA_PSS(alg)) {
3189 #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
3190  defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
3192  attributes,
3193  key_buffer, key_buffer_size,
3194  alg, hash, hash_length,
3195  signature, signature_size, signature_length);
3196 #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
3197  * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
3198  } else {
3200  }
3201  } else if (PSA_KEY_TYPE_IS_ECC(attributes->core.type)) {
3202  if (PSA_ALG_IS_ECDSA(alg)) {
3203 #if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3204  defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
3206  attributes,
3207  key_buffer, key_buffer_size,
3208  alg, hash, hash_length,
3209  signature, signature_size, signature_length);
3210 #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3211  * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
3212  } else {
3214  }
3215  }
3216 
3217  (void) key_buffer;
3218  (void) key_buffer_size;
3219  (void) hash;
3220  (void) hash_length;
3221  (void) signature;
3222  (void) signature_size;
3223  (void) signature_length;
3224 
3225  return PSA_ERROR_NOT_SUPPORTED;
3227 
3229  psa_algorithm_t alg,
3230  const uint8_t *hash_external,
3231  size_t hash_length,
3232  uint8_t *signature_external,
3233  size_t signature_size,
3234  size_t *signature_length)
3235 {
3237  LOCAL_INPUT_DECLARE(hash_external, hash);
3238  LOCAL_OUTPUT_DECLARE(signature_external, signature);
3239 
3240  LOCAL_INPUT_ALLOC(hash_external, hash_length, hash);
3241  LOCAL_OUTPUT_ALLOC(signature_external, signature_size, signature);
3242  status = psa_sign_internal(key, 0, alg, hash, hash_length, signature,
3243  signature_size, signature_length);
3244 
3245 #if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
3246 exit:
3247 #endif
3248  LOCAL_INPUT_FREE(hash_external, hash);
3249  LOCAL_OUTPUT_FREE(signature_external, signature);
3250 
3251  return status;
3253 
3256  const uint8_t *key_buffer, size_t key_buffer_size,
3257  psa_algorithm_t alg, const uint8_t *hash, size_t hash_length,
3258  const uint8_t *signature, size_t signature_length)
3259 {
3260  if (PSA_KEY_TYPE_IS_RSA(attributes->core.type)) {
3261  if (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) ||
3262  PSA_ALG_IS_RSA_PSS(alg)) {
3263 #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \
3264  defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS)
3266  attributes,
3267  key_buffer, key_buffer_size,
3268  alg, hash, hash_length,
3269  signature, signature_length);
3270 #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) ||
3271  * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */
3272  } else {
3274  }
3275  } else if (PSA_KEY_TYPE_IS_ECC(attributes->core.type)) {
3276  if (PSA_ALG_IS_ECDSA(alg)) {
3277 #if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \
3278  defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)
3280  attributes,
3281  key_buffer, key_buffer_size,
3282  alg, hash, hash_length,
3283  signature, signature_length);
3284 #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) ||
3285  * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */
3286  } else {
3288  }
3289  }
3290 
3291  (void) key_buffer;
3292  (void) key_buffer_size;
3293  (void) hash;
3294  (void) hash_length;
3295  (void) signature;
3296  (void) signature_length;
3297 
3298  return PSA_ERROR_NOT_SUPPORTED;
3300 
3302  psa_algorithm_t alg,
3303  const uint8_t *hash_external,
3304  size_t hash_length,
3305  const uint8_t *signature_external,
3306  size_t signature_length)
3307 {
3309  LOCAL_INPUT_DECLARE(hash_external, hash);
3310  LOCAL_INPUT_DECLARE(signature_external, signature);
3311 
3312  LOCAL_INPUT_ALLOC(hash_external, hash_length, hash);
3313  LOCAL_INPUT_ALLOC(signature_external, signature_length, signature);
3314  status = psa_verify_internal(key, 0, alg, hash, hash_length, signature,
3315  signature_length);
3316 
3317 #if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
3318 exit:
3319 #endif
3320  LOCAL_INPUT_FREE(hash_external, hash);
3321  LOCAL_INPUT_FREE(signature_external, signature);
3322 
3323  return status;
3324 }
3325 
3326 #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
3327 static void psa_rsa_oaep_set_padding_mode(psa_algorithm_t alg,
3328  mbedtls_rsa_context *rsa)
3329 {
3331  const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa(hash_alg);
3332  mbedtls_md_type_t md_alg = mbedtls_md_get_type(md_info);
3334 }
3335 #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */
3336 
3338  psa_algorithm_t alg,
3339  const uint8_t *input_external,
3340  size_t input_length,
3341  const uint8_t *salt_external,
3342  size_t salt_length,
3343  uint8_t *output_external,
3344  size_t output_size,
3345  size_t *output_length)
3346 {
3349  psa_key_slot_t *slot;
3350  LOCAL_INPUT_DECLARE(input_external, input);
3351  LOCAL_INPUT_DECLARE(salt_external, salt);
3352  LOCAL_OUTPUT_DECLARE(output_external, output);
3353 
3354  (void) input;
3355  (void) input_length;
3356  (void) salt;
3357  (void) output;
3358  (void) output_size;
3359 
3360  *output_length = 0;
3361 
3362  if (!PSA_ALG_IS_RSA_OAEP(alg) && salt_length != 0) {
3364  }
3365 
3367  key, &slot, PSA_KEY_USAGE_ENCRYPT, alg);
3368  if (status != PSA_SUCCESS) {
3369  return status;
3370  }
3371  if (!(PSA_KEY_TYPE_IS_PUBLIC_KEY(slot->attr.type) ||
3373  status = PSA_ERROR_INVALID_ARGUMENT;
3374  goto exit;
3375  }
3376 
3377  if (PSA_KEY_TYPE_IS_RSA(slot->attr.type)) {
3378 #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \
3379  defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
3380  mbedtls_rsa_context *rsa = NULL;
3382  slot->key.data,
3383  slot->key.bytes,
3384  &rsa);
3385  if (status != PSA_SUCCESS) {
3386  goto rsa_exit;
3387  }
3388 
3389  if (output_size < mbedtls_rsa_get_len(rsa)) {
3390  status = PSA_ERROR_BUFFER_TOO_SMALL;
3391  goto rsa_exit;
3392  }
3393 #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) ||
3394  * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */
3395  LOCAL_INPUT_ALLOC(input_external, input_length, input);
3396  LOCAL_INPUT_ALLOC(salt_external, salt_length, salt);
3397  LOCAL_OUTPUT_ALLOC(output_external, output_size, output);
3398  if (alg == PSA_ALG_RSA_PKCS1V15_CRYPT) {
3399 #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT)
3400  status = mbedtls_to_psa_error(
3405  input_length,
3406  input,
3407  output));
3408 #else
3409  status = PSA_ERROR_NOT_SUPPORTED;
3410 #endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT */
3411  } else
3412  if (PSA_ALG_IS_RSA_OAEP(alg)) {
3413 #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
3414  psa_rsa_oaep_set_padding_mode(alg, rsa);
3415  status = mbedtls_to_psa_error(
3420  salt, salt_length,
3421  input_length,
3422  input,
3423  output));
3424 #else
3425  status = PSA_ERROR_NOT_SUPPORTED;
3426 #endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP */
3427  } else {
3428  status = PSA_ERROR_INVALID_ARGUMENT;
3429  }
3430 #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \
3431  defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
3432 rsa_exit:
3433  if (status == PSA_SUCCESS) {
3434  *output_length = mbedtls_rsa_get_len(rsa);
3435  }
3436 
3437  mbedtls_rsa_free(rsa);
3438  mbedtls_free(rsa);
3439 #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) ||
3440  * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */
3441  } else {
3442  status = PSA_ERROR_NOT_SUPPORTED;
3443  }
3444 
3445 exit:
3446  unlock_status = psa_unlock_key_slot(slot);
3447 
3448  LOCAL_INPUT_FREE(input_external, input);
3449  LOCAL_INPUT_FREE(salt_external, salt);
3450  LOCAL_OUTPUT_FREE(output_external, output);
3451 
3452  return (status == PSA_SUCCESS) ? unlock_status : status;
3454 
3456  psa_algorithm_t alg,
3457  const uint8_t *input_external,
3458  size_t input_length,
3459  const uint8_t *salt_external,
3460  size_t salt_length,
3461  uint8_t *output_external,
3462  size_t output_size,
3463  size_t *output_length)
3464 {
3467  psa_key_slot_t *slot;
3468  LOCAL_INPUT_DECLARE(input_external, input);
3469  LOCAL_INPUT_DECLARE(salt_external, salt);
3470  LOCAL_OUTPUT_DECLARE(output_external, output);
3471 
3472  (void) input;
3473  (void) input_length;
3474  (void) salt;
3475  (void) output;
3476  (void) output_size;
3477 
3478  *output_length = 0;
3479 
3480  if (!PSA_ALG_IS_RSA_OAEP(alg) && salt_length != 0) {
3482  }
3483 
3485  key, &slot, PSA_KEY_USAGE_DECRYPT, alg);
3486  if (status != PSA_SUCCESS) {
3487  return status;
3488  }
3489  if (!PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type)) {
3490  status = PSA_ERROR_INVALID_ARGUMENT;
3491  goto exit;
3492  }
3493 
3494  if (slot->attr.type == PSA_KEY_TYPE_RSA_KEY_PAIR) {
3495 #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \
3496  defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
3497  mbedtls_rsa_context *rsa = NULL;
3499  slot->key.data,
3500  slot->key.bytes,
3501  &rsa);
3502  if (status != PSA_SUCCESS) {
3503  goto exit;
3504  }
3505 
3506  if (input_length != mbedtls_rsa_get_len(rsa)) {
3507  status = PSA_ERROR_INVALID_ARGUMENT;
3508  goto rsa_exit;
3509  }
3510 #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) ||
3511  * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */
3512  LOCAL_INPUT_ALLOC(input_external, input_length, input);
3513  LOCAL_INPUT_ALLOC(salt_external, salt_length, salt);
3514  LOCAL_OUTPUT_ALLOC(output_external, output_size, output);
3515  if (alg == PSA_ALG_RSA_PKCS1V15_CRYPT) {
3516 #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT)
3517  status = mbedtls_to_psa_error(
3522  output_length,
3523  input,
3524  output,
3525  output_size));
3526 #else
3527  status = PSA_ERROR_NOT_SUPPORTED;
3528 #endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT */
3529  } else
3530  if (PSA_ALG_IS_RSA_OAEP(alg)) {
3531 #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
3532  psa_rsa_oaep_set_padding_mode(alg, rsa);
3533  status = mbedtls_to_psa_error(
3538  salt, salt_length,
3539  output_length,
3540  input,
3541  output,
3542  output_size));
3543 #else
3544  status = PSA_ERROR_NOT_SUPPORTED;
3545 #endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP */
3546  } else {
3547  status = PSA_ERROR_INVALID_ARGUMENT;
3548  }
3549 
3550 #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \
3551  defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP)
3552 rsa_exit:
3553  mbedtls_rsa_free(rsa);
3554  mbedtls_free(rsa);
3555 #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) ||
3556  * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */
3557  } else {
3558  status = PSA_ERROR_NOT_SUPPORTED;
3559  }
3560 
3561 exit:
3562  unlock_status = psa_unlock_key_slot(slot);
3563 
3564  LOCAL_INPUT_FREE(input_external, input);
3565  LOCAL_INPUT_FREE(salt_external, salt);
3566  LOCAL_OUTPUT_FREE(output_external, output);
3567 
3568  return (status == PSA_SUCCESS) ? unlock_status : status;
3570 
3572  size_t output_size)
3573 {
3575 
3576  psa_status_t status;
3577 
3578 #if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG)
3579 
3580  size_t output_length = 0;
3581  status = mbedtls_psa_external_get_random(&global_data.rng,
3582  output, output_size,
3583  &output_length);
3584  if (status != PSA_SUCCESS) {
3585  goto exit;
3586  }
3587  /* Breaking up a request into smaller chunks is currently not supported
3588  * for the external RNG interface. */
3589  if (output_length != output_size) {
3591  goto exit;
3592  }
3593  status = PSA_SUCCESS;
3594 
3595 #else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
3596 
3597  while (output_size > 0) {
3598  size_t request_size =
3599  (output_size > MBEDTLS_PSA_RANDOM_MAX_REQUEST ?
3600  MBEDTLS_PSA_RANDOM_MAX_REQUEST :
3601  output_size);
3603  output, request_size);
3604  if (ret != 0) {
3605  status = mbedtls_to_psa_error(ret);
3606  goto exit;
3607  }
3608  output_size -= request_size;
3609  output += request_size;
3610  }
3611  status = PSA_SUCCESS;
3612 #endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */
3613 
3614 exit:
3615  return status;
3616 }
3617 
3618 
3619 /****************************************************************/
3620 /* Symmetric cryptography */
3621 /****************************************************************/
3622 
3625  psa_algorithm_t alg,
3626  mbedtls_operation_t cipher_operation)
3627 {
3631  psa_key_slot_t *slot = NULL;
3632  psa_key_usage_t usage = (cipher_operation == MBEDTLS_ENCRYPT ?
3635 
3636  /* A context must be freshly initialized before it can be set up. */
3637  if (operation->id != 0) {
3638  status = PSA_ERROR_BAD_STATE;
3639  goto exit;
3640  }
3641 
3642  if (!PSA_ALG_IS_CIPHER(alg)) {
3643  status = PSA_ERROR_INVALID_ARGUMENT;
3644  goto exit;
3645  }
3646 
3647  status = psa_get_and_lock_key_slot_with_policy(key, &slot, usage, alg);
3648  if (status != PSA_SUCCESS) {
3649  goto exit;
3650  }
3651 
3652  /* Initialize the operation struct members, except for id. The id member
3653  * is used to indicate to psa_cipher_abort that there are resources to free,
3654  * so we only set it (in the driver wrapper) after resources have been
3655  * allocated/initialized. */
3656  operation->iv_set = 0;
3657  if (alg == PSA_ALG_ECB_NO_PADDING) {
3658  operation->iv_required = 0;
3659  } else if (slot->attr.type == PSA_KEY_TYPE_ARC4) {
3660  operation->iv_required = 0;
3661  } else {
3662  operation->iv_required = 1;
3663  }
3664  operation->default_iv_length = PSA_CIPHER_IV_LENGTH(slot->attr.type, alg);
3665 
3667  .core = slot->attr
3668  };
3669 
3670  /* Try doing the operation through a driver before using software fallback. */
3671  if (cipher_operation == MBEDTLS_ENCRYPT) {
3673  &attributes,
3674  slot->key.data,
3675  slot->key.bytes,
3676  alg);
3677  } else {
3679  &attributes,
3680  slot->key.data,
3681  slot->key.bytes,
3682  alg);
3683  }
3684 
3685 exit:
3686  if (status != PSA_SUCCESS) {
3688  }
3689 
3690  unlock_status = psa_unlock_key_slot(slot);
3691 
3692  return (status == PSA_SUCCESS) ? unlock_status : status;
3694 
3697  psa_algorithm_t alg)
3698 {
3701 
3704  psa_algorithm_t alg)
3705 {
3708 
3710  uint8_t *iv_external,
3711  size_t iv_size,
3712  size_t *iv_length)
3713 {
3715  size_t default_iv_length = 0;
3716 
3717  LOCAL_OUTPUT_DECLARE(iv_external, iv);
3718 
3719  if (operation->id == 0) {
3720  status = PSA_ERROR_BAD_STATE;
3721  goto exit;
3722  }
3723 
3724  if (operation->iv_set || !operation->iv_required) {
3725  status = PSA_ERROR_BAD_STATE;
3726  goto exit;
3727  }
3728 
3729  default_iv_length = operation->default_iv_length;
3730  if (iv_size < default_iv_length) {
3731  status = PSA_ERROR_BUFFER_TOO_SMALL;
3732  goto exit;
3733  }
3734 
3735  if (default_iv_length > PSA_CIPHER_IV_MAX_SIZE) {
3736  status = PSA_ERROR_GENERIC_ERROR;
3737  goto exit;
3738  }
3739 
3740  LOCAL_OUTPUT_ALLOC(iv_external, default_iv_length, iv);
3741 
3742  status = psa_generate_random_internal(iv, default_iv_length);
3743  if (status != PSA_SUCCESS) {
3744  goto exit;
3745  }
3746 
3748  iv, default_iv_length);
3749 
3750 exit:
3751  if (status == PSA_SUCCESS) {
3752  *iv_length = default_iv_length;
3753  operation->iv_set = 1;
3754  } else {
3755  *iv_length = 0;
3757  if (iv != NULL) {
3758  mbedtls_platform_zeroize(iv, default_iv_length);
3759  }
3760  }
3761 
3762  LOCAL_OUTPUT_FREE(iv_external, iv);
3763  return status;
3765 
3767  const uint8_t *iv_external,
3768  size_t iv_length)
3769 {
3771 
3772  LOCAL_INPUT_DECLARE(iv_external, iv);
3773 
3774  if (operation->id == 0) {
3775  status = PSA_ERROR_BAD_STATE;
3776  goto exit;
3777  }
3778 
3779  if (operation->iv_set || !operation->iv_required) {
3780  status = PSA_ERROR_BAD_STATE;
3781  goto exit;
3782  }
3783 
3784  if (iv_length > PSA_CIPHER_IV_MAX_SIZE) {
3785  status = PSA_ERROR_INVALID_ARGUMENT;
3786  goto exit;
3787  }
3788 
3789  LOCAL_INPUT_ALLOC(iv_external, iv_length, iv);
3790 
3792  iv,
3793  iv_length);
3794 
3795 exit:
3796  if (status == PSA_SUCCESS) {
3797  operation->iv_set = 1;
3798  } else {
3800  }
3801 
3802  LOCAL_INPUT_FREE(iv_external, iv);
3803 
3804  return status;
3806 
3808  const uint8_t *input_external,
3809  size_t input_length,
3810  uint8_t *output_external,
3811  size_t output_size,
3812  size_t *output_length)
3813 {
3815 
3816  LOCAL_INPUT_DECLARE(input_external, input);
3817  LOCAL_OUTPUT_DECLARE(output_external, output);
3818 
3819  if (operation->id == 0) {
3820  status = PSA_ERROR_BAD_STATE;
3821  goto exit;
3822  }
3823 
3824  if (operation->iv_required && !operation->iv_set) {
3825  status = PSA_ERROR_BAD_STATE;
3826  goto exit;
3827  }
3828 
3829  LOCAL_INPUT_ALLOC(input_external, input_length, input);
3830  LOCAL_OUTPUT_ALLOC(output_external, output_size, output);
3831 
3833  input,
3834  input_length,
3835  output,
3836  output_size,
3837  output_length);
3838 
3839 exit:
3840  if (status != PSA_SUCCESS) {
3842  }
3843 
3844  LOCAL_INPUT_FREE(input_external, input);
3845  LOCAL_OUTPUT_FREE(output_external, output);
3846 
3847  return status;
3849 
3851  uint8_t *output_external,
3852  size_t output_size,
3853  size_t *output_length)
3854 {
3856 
3857  LOCAL_OUTPUT_DECLARE(output_external, output);
3858 
3859  if (operation->id == 0) {
3860  status = PSA_ERROR_BAD_STATE;
3861  goto exit;
3862  }
3863 
3864  if (operation->iv_required && !operation->iv_set) {
3865  status = PSA_ERROR_BAD_STATE;
3866  goto exit;
3867  }
3868 
3869  LOCAL_OUTPUT_ALLOC(output_external, output_size, output);
3870 
3872  output,
3873  output_size,
3874  output_length);
3875 
3876 exit:
3877  if (status == PSA_SUCCESS) {
3878  status = psa_cipher_abort(operation);
3879  } else {
3880  *output_length = 0;
3881  (void) psa_cipher_abort(operation);
3882  }
3883 
3884  LOCAL_OUTPUT_FREE(output_external, output);
3885 
3886  return status;
3888 
3890 {
3891  if (operation->id == 0) {
3892  /* The object has (apparently) been initialized but it is not (yet)
3893  * in use. It's ok to call abort on such an object, and there's
3894  * nothing to do. */
3895  return PSA_SUCCESS;
3896  }
3897 
3899 
3900  operation->id = 0;
3901  operation->iv_set = 0;
3902  operation->iv_required = 0;
3903 
3904  return PSA_SUCCESS;
3906 
3908  psa_algorithm_t alg,
3909  const uint8_t *input_external,
3910  size_t input_length,
3911  uint8_t *output_external,
3912  size_t output_size,
3913  size_t *output_length)
3914 {
3918  psa_key_slot_t *slot = NULL;
3919  uint8_t local_iv[PSA_CIPHER_IV_MAX_SIZE];
3920  size_t default_iv_length = 0;
3921 
3922  LOCAL_INPUT_DECLARE(input_external, input);
3923  LOCAL_OUTPUT_DECLARE(output_external, output);
3924 
3925  if (!PSA_ALG_IS_CIPHER(alg)) {
3926  status = PSA_ERROR_INVALID_ARGUMENT;
3927  goto exit;
3928  }
3929 
3932  alg);
3933  if (status != PSA_SUCCESS) {
3934  goto exit;
3935  }
3936 
3938  .core = slot->attr
3939  };
3940 
3941  default_iv_length = PSA_CIPHER_IV_LENGTH(slot->attr.type, alg);
3942  if (default_iv_length > PSA_CIPHER_IV_MAX_SIZE) {
3943  status = PSA_ERROR_GENERIC_ERROR;
3944  goto exit;
3945  }
3946 
3947  if (default_iv_length > 0) {
3948  if (output_size < default_iv_length) {
3949  status = PSA_ERROR_BUFFER_TOO_SMALL;
3950  goto exit;
3951  }
3952 
3953  status = psa_generate_random_internal(local_iv, default_iv_length);
3954  if (status != PSA_SUCCESS) {
3955  goto exit;
3956  }
3957  }
3958 
3959  LOCAL_INPUT_ALLOC(input_external, input_length, input);
3960  LOCAL_OUTPUT_ALLOC(output_external, output_size, output);
3961 
3963  &attributes, slot->key.data, slot->key.bytes,
3964  alg, local_iv, default_iv_length, input, input_length,
3965  mbedtls_buffer_offset(output, default_iv_length),
3966  output_size - default_iv_length, output_length);
3967 
3968 exit:
3969  unlock_status = psa_unlock_key_slot(slot);
3970  if (status == PSA_SUCCESS) {
3971  status = unlock_status;
3972  }
3973 
3974  if (status == PSA_SUCCESS) {
3975  if (default_iv_length > 0) {
3976  memcpy(output, local_iv, default_iv_length);
3977  }
3978  *output_length += default_iv_length;
3979  } else {
3980  *output_length = 0;
3981  }
3982 
3983  LOCAL_INPUT_FREE(input_external, input);
3984  LOCAL_OUTPUT_FREE(output_external, output);
3985 
3986  return status;
3988 
3990  psa_algorithm_t alg,
3991  const uint8_t *input_external,
3992  size_t input_length,
3993  uint8_t *output_external,
3994  size_t output_size,
3995  size_t *output_length)
3996 {
4000  psa_key_slot_t *slot = NULL;
4001 
4002  LOCAL_INPUT_DECLARE(input_external, input);
4003  LOCAL_OUTPUT_DECLARE(output_external, output);
4004 
4005  if (!PSA_ALG_IS_CIPHER(alg)) {
4006  status = PSA_ERROR_INVALID_ARGUMENT;
4007  goto exit;
4008  }
4009 
4012  alg);
4013  if (status != PSA_SUCCESS) {
4014  goto exit;
4015  }
4016 
4018  .core = slot->attr
4019  };
4020 
4021  if (input_length < PSA_CIPHER_IV_LENGTH(slot->attr.type, alg)) {
4022  status = PSA_ERROR_INVALID_ARGUMENT;
4023  goto exit;
4024  }
4025 
4026  LOCAL_INPUT_ALLOC(input_external, input_length, input);
4027  LOCAL_OUTPUT_ALLOC(output_external, output_size, output);
4028 
4030  &attributes, slot->key.data, slot->key.bytes,
4031  alg, input, input_length,
4032  output, output_size, output_length);
4033 
4034 exit:
4035  unlock_status = psa_unlock_key_slot(slot);
4036  if (status == PSA_SUCCESS) {
4037  status = unlock_status;
4038  }
4039 
4040  if (status != PSA_SUCCESS) {
4041  *output_length = 0;
4042  }
4043 
4044  LOCAL_INPUT_FREE(input_external, input);
4045  LOCAL_OUTPUT_FREE(output_external, output);
4046 
4047  return status;
4048 }
4049 
4050 
4051 /****************************************************************/
4052 /* AEAD */
4053 /****************************************************************/
4054 
4056  psa_algorithm_t alg,
4057  const uint8_t *nonce_external,
4058  size_t nonce_length,
4059  const uint8_t *additional_data_external,
4060  size_t additional_data_length,
4061  const uint8_t *plaintext_external,
4062  size_t plaintext_length,
4063  uint8_t *ciphertext_external,
4064  size_t ciphertext_size,
4065  size_t *ciphertext_length)
4066 {
4068  psa_key_slot_t *slot;
4069 
4070  LOCAL_INPUT_DECLARE(nonce_external, nonce);
4071  LOCAL_INPUT_DECLARE(additional_data_external, additional_data);
4072  LOCAL_INPUT_DECLARE(plaintext_external, plaintext);
4073  LOCAL_OUTPUT_DECLARE(ciphertext_external, ciphertext);
4074 
4075  *ciphertext_length = 0;
4076 
4077  if (!PSA_ALG_IS_AEAD(alg) || PSA_ALG_IS_WILDCARD(alg)) {
4078  return PSA_ERROR_NOT_SUPPORTED;
4079  }
4080 
4082  key, &slot, PSA_KEY_USAGE_ENCRYPT, alg);
4083  if (status != PSA_SUCCESS) {
4084  return status;
4085  }
4086 
4088  .core = slot->attr
4089  };
4090 
4091  LOCAL_INPUT_ALLOC(nonce_external, nonce_length, nonce);
4092  LOCAL_INPUT_ALLOC(additional_data_external, additional_data_length, additional_data);
4093  LOCAL_INPUT_ALLOC(plaintext_external, plaintext_length, plaintext);
4094  LOCAL_OUTPUT_ALLOC(ciphertext_external, ciphertext_size, ciphertext);
4095 
4097  &attributes, slot->key.data, slot->key.bytes,
4098  alg,
4099  nonce, nonce_length,
4100  additional_data, additional_data_length,
4101  plaintext, plaintext_length,
4102  ciphertext, ciphertext_size, ciphertext_length);
4103 
4104  if (status != PSA_SUCCESS && ciphertext_size != 0) {
4105  memset(ciphertext, 0, ciphertext_size);
4106  }
4107 
4108 /* Exit label is only used for buffer copying, prevent unused warnings. */
4109 #if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
4110 exit:
4111 #endif
4112  LOCAL_INPUT_FREE(nonce_external, nonce);
4113  LOCAL_INPUT_FREE(additional_data_external, additional_data);
4114  LOCAL_INPUT_FREE(plaintext_external, plaintext);
4115  LOCAL_OUTPUT_FREE(ciphertext_external, ciphertext);
4116 
4117  psa_unlock_key_slot(slot);
4118 
4119  return status;
4121 
4123  psa_algorithm_t alg,
4124  const uint8_t *nonce_external,
4125  size_t nonce_length,
4126  const uint8_t *additional_data_external,
4127  size_t additional_data_length,
4128  const uint8_t *ciphertext_external,
4129  size_t ciphertext_length,
4130  uint8_t *plaintext_external,
4131  size_t plaintext_size,
4132  size_t *plaintext_length)
4133 {
4135  psa_key_slot_t *slot;
4136 
4137  LOCAL_INPUT_DECLARE(nonce_external, nonce);
4138  LOCAL_INPUT_DECLARE(additional_data_external, additional_data);
4139  LOCAL_INPUT_DECLARE(ciphertext_external, ciphertext);
4140  LOCAL_OUTPUT_DECLARE(plaintext_external, plaintext);
4141 
4142  *plaintext_length = 0;
4143 
4144  if (!PSA_ALG_IS_AEAD(alg) || PSA_ALG_IS_WILDCARD(alg)) {
4145  return PSA_ERROR_NOT_SUPPORTED;
4146  }
4147 
4149  key, &slot, PSA_KEY_USAGE_DECRYPT, alg);
4150  if (status != PSA_SUCCESS) {
4151  return status;
4152  }
4153 
4155  .core = slot->attr
4156  };
4157 
4158  LOCAL_INPUT_ALLOC(nonce_external, nonce_length, nonce);
4159  LOCAL_INPUT_ALLOC(additional_data_external, additional_data_length,
4160  additional_data);
4161  LOCAL_INPUT_ALLOC(ciphertext_external, ciphertext_length, ciphertext);
4162  LOCAL_OUTPUT_ALLOC(plaintext_external, plaintext_size, plaintext);
4163 
4165  &attributes, slot->key.data, slot->key.bytes,
4166  alg,
4167  nonce, nonce_length,
4168  additional_data, additional_data_length,
4169  ciphertext, ciphertext_length,
4170  plaintext, plaintext_size, plaintext_length);
4171 
4172  if (status != PSA_SUCCESS && plaintext_size != 0) {
4173  memset(plaintext, 0, plaintext_size);
4174  }
4175 
4176 /* Exit label is only used for buffer copying, prevent unused warnings. */
4177 #if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
4178 exit:
4179 #endif
4180  LOCAL_INPUT_FREE(nonce_external, nonce);
4181  LOCAL_INPUT_FREE(additional_data_external, additional_data);
4182  LOCAL_INPUT_FREE(ciphertext_external, ciphertext);
4183  LOCAL_OUTPUT_FREE(plaintext_external, plaintext);
4184 
4185  psa_unlock_key_slot(slot);
4186 
4187  return status;
4188 }
4189 
4190 /****************************************************************/
4191 /* Generators */
4192 /****************************************************************/
4193 
4194 #if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF) || \
4195  defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
4196  defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
4197 #define AT_LEAST_ONE_BUILTIN_KDF
4198 #endif /* At least one builtin KDF */
4199 
4200 #if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF) || \
4201  defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
4202  defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
4203 static psa_status_t psa_key_derivation_start_hmac(
4205  psa_algorithm_t hash_alg,
4206  const uint8_t *hmac_key,
4207  size_t hmac_key_length)
4208 {
4212  psa_set_key_bits(&attributes, PSA_BYTES_TO_BITS(hmac_key_length));
4214 
4215  operation->is_sign = 1;
4216  operation->mac_size = PSA_HASH_LENGTH(hash_alg);
4217 
4219  &attributes,
4220  hmac_key, hmac_key_length,
4221  PSA_ALG_HMAC(hash_alg));
4222 
4224  return status;
4225 }
4226 #endif /* KDF algorithms reliant on HMAC */
4228 #define HKDF_STATE_INIT 0 /* no input yet */
4229 #define HKDF_STATE_STARTED 1 /* got salt */
4230 #define HKDF_STATE_KEYED 2 /* got key */
4231 #define HKDF_STATE_OUTPUT 3 /* output started */
4232 
4235 {
4236  if (PSA_ALG_IS_KEY_AGREEMENT(operation->alg)) {
4238  } else {
4239  return operation->alg;
4240  }
4242 
4244 {
4245  psa_status_t status = PSA_SUCCESS;
4247  if (kdf_alg == 0) {
4248  /* The object has (apparently) been initialized but it is not
4249  * in use. It's ok to call abort on such an object, and there's
4250  * nothing to do. */
4251  } else
4252 #if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
4253  if (PSA_ALG_IS_HKDF(kdf_alg)) {
4254  mbedtls_free(operation->ctx.hkdf.info);
4255  status = psa_mac_abort(&operation->ctx.hkdf.hmac);
4256  } else
4257 #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF */
4258 #if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
4259  defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
4260  if (PSA_ALG_IS_TLS12_PRF(kdf_alg) ||
4261  /* TLS-1.2 PSK-to-MS KDF uses the same core as TLS-1.2 PRF */
4262  PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
4263  if (operation->ctx.tls12_prf.secret != NULL) {
4264  mbedtls_platform_zeroize(operation->ctx.tls12_prf.secret,
4265  operation->ctx.tls12_prf.secret_length);
4266  mbedtls_free(operation->ctx.tls12_prf.secret);
4267  }
4268 
4269  if (operation->ctx.tls12_prf.seed != NULL) {
4270  mbedtls_platform_zeroize(operation->ctx.tls12_prf.seed,
4271  operation->ctx.tls12_prf.seed_length);
4272  mbedtls_free(operation->ctx.tls12_prf.seed);
4273  }
4274 
4275  if (operation->ctx.tls12_prf.label != NULL) {
4276  mbedtls_platform_zeroize(operation->ctx.tls12_prf.label,
4277  operation->ctx.tls12_prf.label_length);
4278  mbedtls_free(operation->ctx.tls12_prf.label);
4279  }
4280 
4281  status = PSA_SUCCESS;
4282 
4283  /* We leave the fields Ai and output_block to be erased safely by the
4284  * mbedtls_platform_zeroize() in the end of this function. */
4285  } else
4286 #endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) ||
4287  * defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) */
4288  {
4289  status = PSA_ERROR_BAD_STATE;
4290  }
4292  return status;
4294 
4296  size_t *capacity)
4297 {
4298  if (operation->alg == 0) {
4299  /* This is a blank key derivation operation. */
4300  return PSA_ERROR_BAD_STATE;
4301  }
4302 
4303  *capacity = operation->capacity;
4304  return PSA_SUCCESS;
4306 
4308  size_t capacity)
4309 {
4310  if (operation->alg == 0) {
4311  return PSA_ERROR_BAD_STATE;
4312  }
4313  if (capacity > operation->capacity) {
4315  }
4316  operation->capacity = capacity;
4317  return PSA_SUCCESS;
4318 }
4319 
4320 #if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
4321 /* Read some bytes from an HKDF-based operation. This performs a chunk
4322  * of the expand phase of the HKDF algorithm. */
4323 static psa_status_t psa_key_derivation_hkdf_read(psa_hkdf_key_derivation_t *hkdf,
4324  psa_algorithm_t hash_alg,
4325  uint8_t *output,
4326  size_t output_length)
4327 {
4328  uint8_t hash_length = PSA_HASH_LENGTH(hash_alg);
4329  size_t hmac_output_length;
4330  psa_status_t status;
4331 
4332  if (hkdf->state < HKDF_STATE_KEYED || !hkdf->info_set) {
4333  return PSA_ERROR_BAD_STATE;
4334  }
4335  hkdf->state = HKDF_STATE_OUTPUT;
4336 
4337  while (output_length != 0) {
4338  /* Copy what remains of the current block */
4339  uint8_t n = hash_length - hkdf->offset_in_block;
4340  if (n > output_length) {
4341  n = (uint8_t) output_length;
4342  }
4343  memcpy(output, hkdf->output_block + hkdf->offset_in_block, n);
4344  output += n;
4345  output_length -= n;
4346  hkdf->offset_in_block += n;
4347  if (output_length == 0) {
4348  break;
4349  }
4350  /* We can't be wanting more output after block 0xff, otherwise
4351  * the capacity check in psa_key_derivation_output_bytes() would have
4352  * prevented this call. It could happen only if the operation
4353  * object was corrupted or if this function is called directly
4354  * inside the library. */
4355  if (hkdf->block_number == 0xff) {
4356  return PSA_ERROR_BAD_STATE;
4357  }
4358 
4359  /* We need a new block */
4360  ++hkdf->block_number;
4361  hkdf->offset_in_block = 0;
4362 
4363  status = psa_key_derivation_start_hmac(&hkdf->hmac,
4364  hash_alg,
4365  hkdf->prk,
4366  hash_length);
4367  if (status != PSA_SUCCESS) {
4368  return status;
4369  }
4370 
4371  if (hkdf->block_number != 1) {
4372  status = psa_mac_update(&hkdf->hmac,
4373  hkdf->output_block,
4374  hash_length);
4375  if (status != PSA_SUCCESS) {
4376  return status;
4377  }
4378  }
4379  status = psa_mac_update(&hkdf->hmac,
4380  hkdf->info,
4381  hkdf->info_length);
4382  if (status != PSA_SUCCESS) {
4383  return status;
4384  }
4385  status = psa_mac_update(&hkdf->hmac,
4386  &hkdf->block_number, 1);
4387  if (status != PSA_SUCCESS) {
4388  return status;
4389  }
4390  status = psa_mac_sign_finish(&hkdf->hmac,
4391  hkdf->output_block,
4392  sizeof(hkdf->output_block),
4393  &hmac_output_length);
4394  if (status != PSA_SUCCESS) {
4395  return status;
4396  }
4397  }
4398 
4399  return PSA_SUCCESS;
4400 }
4401 #endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF */
4402 
4403 #if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
4404  defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
4405 static psa_status_t psa_key_derivation_tls12_prf_generate_next_block(
4406  psa_tls12_prf_key_derivation_t *tls12_prf,
4407  psa_algorithm_t alg)
4408 {
4409  psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(alg);
4410  uint8_t hash_length = PSA_HASH_LENGTH(hash_alg);
4412  size_t hmac_output_length;
4413  psa_status_t status, cleanup_status;
4414 
4415  /* We can't be wanting more output after block 0xff, otherwise
4416  * the capacity check in psa_key_derivation_output_bytes() would have
4417  * prevented this call. It could happen only if the operation
4418  * object was corrupted or if this function is called directly
4419  * inside the library. */
4420  if (tls12_prf->block_number == 0xff) {
4422  }
4423 
4424  /* We need a new block */
4425  ++tls12_prf->block_number;
4426  tls12_prf->left_in_block = hash_length;
4427 
4428  /* Recall the definition of the TLS-1.2-PRF from RFC 5246:
4429  *
4430  * PRF(secret, label, seed) = P_<hash>(secret, label + seed)
4431  *
4432  * P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
4433  * HMAC_hash(secret, A(2) + seed) +
4434  * HMAC_hash(secret, A(3) + seed) + ...
4435  *
4436  * A(0) = seed
4437  * A(i) = HMAC_hash(secret, A(i-1))
4438  *
4439  * The `psa_tls12_prf_key_derivation` structure saves the block
4440  * `HMAC_hash(secret, A(i) + seed)` from which the output
4441  * is currently extracted as `output_block` and where i is
4442  * `block_number`.
4443  */
4444 
4445  status = psa_key_derivation_start_hmac(&hmac,
4446  hash_alg,
4447  tls12_prf->secret,
4448  tls12_prf->secret_length);
4449  if (status != PSA_SUCCESS) {
4450  goto cleanup;
4451  }
4452 
4453  /* Calculate A(i) where i = tls12_prf->block_number. */
4454  if (tls12_prf->block_number == 1) {
4455  /* A(1) = HMAC_hash(secret, A(0)), where A(0) = seed. (The RFC overloads
4456  * the variable seed and in this instance means it in the context of the
4457  * P_hash function, where seed = label + seed.) */
4458  status = psa_mac_update(&hmac,
4459  tls12_prf->label,
4460  tls12_prf->label_length);
4461  if (status != PSA_SUCCESS) {
4462  goto cleanup;
4463  }
4464  status = psa_mac_update(&hmac,
4465  tls12_prf->seed,
4466  tls12_prf->seed_length);
4467  if (status != PSA_SUCCESS) {
4468  goto cleanup;
4469  }
4470  } else {
4471  /* A(i) = HMAC_hash(secret, A(i-1)) */
4472  status = psa_mac_update(&hmac, tls12_prf->Ai, hash_length);
4473  if (status != PSA_SUCCESS) {
4474  goto cleanup;
4475  }
4476  }
4477 
4478  status = psa_mac_sign_finish(&hmac,
4479  tls12_prf->Ai, hash_length,
4480  &hmac_output_length);
4481  if (hmac_output_length != hash_length) {
4483  }
4484  if (status != PSA_SUCCESS) {
4485  goto cleanup;
4486  }
4487 
4488  /* Calculate HMAC_hash(secret, A(i) + label + seed). */
4489  status = psa_key_derivation_start_hmac(&hmac,
4490  hash_alg,
4491  tls12_prf->secret,
4492  tls12_prf->secret_length);
4493  if (status != PSA_SUCCESS) {
4494  goto cleanup;
4495  }
4496  status = psa_mac_update(&hmac, tls12_prf->Ai, hash_length);
4497  if (status != PSA_SUCCESS) {
4498  goto cleanup;
4499  }
4500  status = psa_mac_update(&hmac, tls12_prf->label, tls12_prf->label_length);
4501  if (status != PSA_SUCCESS) {
4502  goto cleanup;
4503  }
4504  status = psa_mac_update(&hmac, tls12_prf->seed, tls12_prf->seed_length);
4505  if (status != PSA_SUCCESS) {
4506  goto cleanup;
4507  }
4508  status = psa_mac_sign_finish(&hmac,
4509  tls12_prf->output_block, hash_length,
4510  &hmac_output_length);
4511  if (status != PSA_SUCCESS) {
4512  goto cleanup;
4513  }
4514 
4515 
4516 cleanup:
4517  cleanup_status = psa_mac_abort(&hmac);
4518  if (status == PSA_SUCCESS && cleanup_status != PSA_SUCCESS) {
4519  status = cleanup_status;
4520  }
4521 
4522  return status;
4523 }
4524 
4525 static psa_status_t psa_key_derivation_tls12_prf_read(
4526  psa_tls12_prf_key_derivation_t *tls12_prf,
4527  psa_algorithm_t alg,
4528  uint8_t *output,
4529  size_t output_length)
4530 {
4532  uint8_t hash_length = PSA_HASH_LENGTH(hash_alg);
4533  psa_status_t status;
4534  uint8_t offset, length;
4535 
4536  switch (tls12_prf->state) {
4537  case PSA_TLS12_PRF_STATE_LABEL_SET:
4538  tls12_prf->state = PSA_TLS12_PRF_STATE_OUTPUT;
4539  break;
4540  case PSA_TLS12_PRF_STATE_OUTPUT:
4541  break;
4542  default:
4543  return PSA_ERROR_BAD_STATE;
4544  }
4545 
4546  while (output_length != 0) {
4547  /* Check if we have fully processed the current block. */
4548  if (tls12_prf->left_in_block == 0) {
4549  status = psa_key_derivation_tls12_prf_generate_next_block(tls12_prf,
4550  alg);
4551  if (status != PSA_SUCCESS) {
4552  return status;
4553  }
4554 
4555  continue;
4556  }
4557 
4558  if (tls12_prf->left_in_block > output_length) {
4559  length = (uint8_t) output_length;
4560  } else {
4561  length = tls12_prf->left_in_block;
4562  }
4563 
4564  offset = hash_length - tls12_prf->left_in_block;
4565  memcpy(output, tls12_prf->output_block + offset, length);
4566  output += length;
4567  output_length -= length;
4568  tls12_prf->left_in_block -= length;
4569  }
4570 
4571  return PSA_SUCCESS;
4572 }
4573 #endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF ||
4574  * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
4575 
4578  uint8_t *output_external,
4579  size_t output_length)
4580 {
4581  psa_status_t status;
4582  LOCAL_OUTPUT_DECLARE(output_external, output);
4583 
4585 
4586  if (operation->alg == 0) {
4587  /* This is a blank operation. */
4588  return PSA_ERROR_BAD_STATE;
4589  }
4590 
4591  if (output_length == 0 && operation->capacity == 0) {
4592  /* Edge case: this is a finished operation, and 0 bytes
4593  * were requested. The right error in this case could
4594  * be either INSUFFICIENT_CAPACITY or BAD_STATE. Return
4595  * INSUFFICIENT_CAPACITY, which is right for a finished
4596  * operation, for consistency with the case when
4597  * output_length > 0. */
4599  }
4600 
4601  LOCAL_OUTPUT_ALLOC(output_external, output_length, output);
4602  if (output_length > operation->capacity) {
4603  operation->capacity = 0;
4604  /* Go through the error path to wipe all confidential data now
4605  * that the operation object is useless. */
4606  status = PSA_ERROR_INSUFFICIENT_DATA;
4607  goto exit;
4608  }
4609  operation->capacity -= output_length;
4610 
4611 #if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
4612  if (PSA_ALG_IS_HKDF(kdf_alg)) {
4613  psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(kdf_alg);
4614  status = psa_key_derivation_hkdf_read(&operation->ctx.hkdf, hash_alg,
4615  output, output_length);
4616  } else
4617 #endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF */
4618 #if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
4619  defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
4620  if (PSA_ALG_IS_TLS12_PRF(kdf_alg) ||
4621  PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
4622  status = psa_key_derivation_tls12_prf_read(&operation->ctx.tls12_prf,
4623  kdf_alg, output,
4624  output_length);
4625  } else
4626 #endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF ||
4627  * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
4628  {
4629  (void) kdf_alg;
4630  status = PSA_ERROR_BAD_STATE;
4631  LOCAL_OUTPUT_FREE(output_external, output);
4632 
4633  return status;
4634  }
4635 
4636 exit:
4637  if (status != PSA_SUCCESS) {
4638  /* Preserve the algorithm upon errors, but clear all sensitive state.
4639  * This allows us to differentiate between exhausted operations and
4640  * blank operations, so we can return PSA_ERROR_BAD_STATE on blank
4641  * operations. */
4642  psa_algorithm_t alg = operation->alg;
4644  operation->alg = alg;
4645  if (output != NULL) {
4646  memset(output, '!', output_length);
4647  }
4648  }
4649 
4650  LOCAL_OUTPUT_FREE(output_external, output);
4651  return status;
4652 }
4653 
4654 #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
4655 static void psa_des_set_key_parity(uint8_t *data, size_t data_size)
4656 {
4657  if (data_size >= 8) {
4659  }
4660  if (data_size >= 16) {
4662  }
4663  if (data_size >= 24) {
4665  }
4666 }
4667 #endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */
4668 
4670  psa_key_slot_t *slot,
4671  size_t bits,
4673 {
4674  uint8_t *data = NULL;
4675  size_t bytes = PSA_BITS_TO_BYTES(bits);
4676  psa_status_t status;
4678 
4679  if (!key_type_is_raw_bytes(slot->attr.type)) {
4681  }
4682  if (bits % 8 != 0) {
4684  }
4685  data = mbedtls_calloc(1, bytes);
4686  if (data == NULL) {
4688  }
4689 
4691  if (status != PSA_SUCCESS) {
4692  goto exit;
4693  }
4694 #if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES)
4695  if (slot->attr.type == PSA_KEY_TYPE_DES) {
4696  psa_des_set_key_parity(data, bytes);
4697  }
4698 #endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */
4699 
4700  status = psa_allocate_buffer_to_slot(slot, bytes);
4701  if (status != PSA_SUCCESS) {
4702  goto exit;
4703  }
4704 
4705  slot->attr.bits = (psa_key_bits_t) bits;
4707  .core = slot->attr
4708  };
4709 
4711  data, bytes,
4712  slot->key.data,
4713  slot->key.bytes,
4714  &slot->key.bytes, &bits);
4715  if (bits != slot->attr.bits) {
4716  status = PSA_ERROR_INVALID_ARGUMENT;
4717  }
4718 
4719 exit:
4720  mbedtls_free(data);
4721  return status;
4723 
4727 {
4728  psa_status_t status;
4729  psa_key_slot_t *slot = NULL;
4730  psa_se_drv_table_entry_t *driver = NULL;
4731 
4733 
4734  /* Reject any attempt to create a zero-length key so that we don't
4735  * risk tripping up later, e.g. on a malloc(0) that returns NULL. */
4736  if (psa_get_key_bits(attributes) == 0) {
4738  }
4739 
4740  if (operation->alg == PSA_ALG_NONE) {
4741  return PSA_ERROR_BAD_STATE;
4742  }
4743 
4744  if (!operation->can_output_key) {
4745  return PSA_ERROR_NOT_PERMITTED;
4746  }
4747 
4749  &slot, &driver);
4750 #if defined(MBEDTLS_PSA_CRYPTO_SE_C)
4751  if (driver != NULL) {
4752  /* Deriving a key in a secure element is not implemented yet. */
4753  status = PSA_ERROR_NOT_SUPPORTED;
4754  }
4755 #endif /* MBEDTLS_PSA_CRYPTO_SE_C */
4756  if (status == PSA_SUCCESS) {
4757  status = psa_generate_derived_key_internal(slot,
4758  attributes->core.bits,
4759  operation);
4760  }
4761  if (status == PSA_SUCCESS) {
4762  status = psa_finish_key_creation(slot, driver, key);
4763  }
4764  if (status != PSA_SUCCESS) {
4765  psa_fail_key_creation(slot, driver);
4766  }
4767 
4768  return status;
4769 }
4770 
4771 
4772 
4773 /****************************************************************/
4774 /* Key derivation */
4775 /****************************************************************/
4776 
4777 #if defined(AT_LEAST_ONE_BUILTIN_KDF)
4778 static int is_kdf_alg_supported(psa_algorithm_t kdf_alg)
4779 {
4780 #if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
4781  if (PSA_ALG_IS_HKDF(kdf_alg)) {
4782  return 1;
4783  }
4784 #endif
4785 #if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF)
4786  if (PSA_ALG_IS_TLS12_PRF(kdf_alg)) {
4787  return 1;
4788  }
4789 #endif
4790 #if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
4791  if (PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
4792  return 1;
4793  }
4794 #endif
4795  return 0;
4796 }
4797 
4798 static psa_status_t psa_hash_try_support(psa_algorithm_t alg)
4799 {
4801  psa_status_t status = psa_hash_setup(&operation, alg);
4803  return status;
4804 }
4805 
4806 static psa_status_t psa_key_derivation_set_maximum_capacity(
4808  psa_algorithm_t kdf_alg)
4809 {
4810  psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(kdf_alg);
4811  size_t hash_size = PSA_HASH_LENGTH(hash_alg);
4812  if (hash_size == 0) {
4813  return PSA_ERROR_NOT_SUPPORTED;
4814  }
4815 
4816  /* Make sure that hash_alg is a supported hash algorithm. Otherwise
4817  * we might fail later, which is somewhat unfriendly and potentially
4818  * risk-prone. */
4819  psa_status_t status = psa_hash_try_support(hash_alg);
4820  if (status != PSA_SUCCESS) {
4821  return status;
4822  }
4823 
4824 #if defined(PSA_WANT_ALG_HKDF)
4825  if (PSA_ALG_IS_HKDF(kdf_alg)) {
4826  operation->capacity = 255 * hash_size;
4827  } else
4828 #endif
4829 #if defined(PSA_WANT_ALG_TLS12_PRF)
4830  if (PSA_ALG_IS_TLS12_PRF(kdf_alg) &&
4831  (hash_alg == PSA_ALG_SHA_256 || hash_alg == PSA_ALG_SHA_384)) {
4832  operation->capacity = SIZE_MAX;
4833  } else
4834 #endif
4835 #if defined(PSA_WANT_ALG_TLS12_PSK_TO_MS)
4836  if (PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg) &&
4837  (hash_alg == PSA_ALG_SHA_256 || hash_alg == PSA_ALG_SHA_384)) {
4838  /* Master Secret is always 48 bytes
4839  * https://datatracker.ietf.org/doc/html/rfc5246.html#section-8.1 */
4840  operation->capacity = 48U;
4841  } else
4842 #endif
4843  {
4844  (void) hash_size;
4845  status = PSA_ERROR_NOT_SUPPORTED;
4846  }
4847  return status;
4848 }
4849 
4850 
4851 static psa_status_t psa_key_derivation_setup_kdf(
4853  psa_algorithm_t kdf_alg)
4854 {
4855  /* Make sure that operation->ctx is properly zero-initialised. (Macro
4856  * initialisers for this union leave some bytes unspecified.) */
4857  memset(&operation->ctx, 0, sizeof(operation->ctx));
4858  /* Make sure that kdf_alg is a supported key derivation algorithm. */
4859  if (!is_kdf_alg_supported(kdf_alg)) {
4860  return PSA_ERROR_NOT_SUPPORTED;
4861  }
4862 
4863  psa_status_t status = psa_key_derivation_set_maximum_capacity(operation,
4864  kdf_alg);
4865  return status;
4866 }
4867 
4868 static psa_status_t psa_key_agreement_try_support(psa_algorithm_t alg)
4869 {
4870 #if defined(PSA_WANT_ALG_ECDH)
4871  if (alg == PSA_ALG_ECDH) {
4872  return PSA_SUCCESS;
4873  }
4874 #endif
4875  (void) alg;
4876  return PSA_ERROR_NOT_SUPPORTED;
4877 }
4878 #endif /* AT_LEAST_ONE_BUILTIN_KDF */
4879 
4881  psa_algorithm_t alg)
4882 {
4883  psa_status_t status;
4884 
4885  if (operation->alg != 0) {
4886  return PSA_ERROR_BAD_STATE;
4887  }
4888 
4889  if (PSA_ALG_IS_RAW_KEY_AGREEMENT(alg)) {
4891  } else if (PSA_ALG_IS_KEY_AGREEMENT(alg)) {
4892 #if defined(AT_LEAST_ONE_BUILTIN_KDF)
4895  status = psa_key_agreement_try_support(ka_alg);
4896  if (status != PSA_SUCCESS) {
4897  return status;
4898  }
4899  status = psa_key_derivation_setup_kdf(operation, kdf_alg);
4900 #else
4901  return PSA_ERROR_NOT_SUPPORTED;
4902 #endif /* AT_LEAST_ONE_BUILTIN_KDF */
4903  } else if (PSA_ALG_IS_KEY_DERIVATION(alg)) {
4904 #if defined(AT_LEAST_ONE_BUILTIN_KDF)
4905  status = psa_key_derivation_setup_kdf(operation, alg);
4906 #else
4907  return PSA_ERROR_NOT_SUPPORTED;
4908 #endif /* AT_LEAST_ONE_BUILTIN_KDF */
4909  } else {
4911  }
4912 
4913  if (status == PSA_SUCCESS) {
4914  operation->alg = alg;
4915  }
4916  return status;
4917 }
4918 
4919 #if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
4920 static psa_status_t psa_hkdf_input(psa_hkdf_key_derivation_t *hkdf,
4921  psa_algorithm_t hash_alg,
4923  const uint8_t *data,
4924  size_t data_length)
4925 {
4926  psa_status_t status;
4927  switch (step) {
4929  if (hkdf->state != HKDF_STATE_INIT) {
4930  return PSA_ERROR_BAD_STATE;
4931  } else {
4932  status = psa_key_derivation_start_hmac(&hkdf->hmac,
4933  hash_alg,
4934  data, data_length);
4935  if (status != PSA_SUCCESS) {
4936  return status;
4937  }
4938  hkdf->state = HKDF_STATE_STARTED;
4939  return PSA_SUCCESS;
4940  }
4942  /* If no salt was provided, use an empty salt. */
4943  if (hkdf->state == HKDF_STATE_INIT) {
4944  status = psa_key_derivation_start_hmac(&hkdf->hmac,
4945  hash_alg,
4946  NULL, 0);
4947  if (status != PSA_SUCCESS) {
4948  return status;
4949  }
4950  hkdf->state = HKDF_STATE_STARTED;
4951  }
4952  if (hkdf->state != HKDF_STATE_STARTED) {
4953  return PSA_ERROR_BAD_STATE;
4954  }
4955  status = psa_mac_update(&hkdf->hmac,
4956  data, data_length);
4957  if (status != PSA_SUCCESS) {
4958  return status;
4959  }
4960  status = psa_mac_sign_finish(&hkdf->hmac,
4961  hkdf->prk,
4962  sizeof(hkdf->prk),
4963  &data_length);
4964  if (status != PSA_SUCCESS) {
4965  return status;
4966  }
4967  hkdf->offset_in_block = PSA_HASH_LENGTH(hash_alg);
4968  hkdf->block_number = 0;
4969  hkdf->state = HKDF_STATE_KEYED;
4970  return PSA_SUCCESS;
4972  if (hkdf->state == HKDF_STATE_OUTPUT) {
4973  return PSA_ERROR_BAD_STATE;
4974  }
4975  if (hkdf->info_set) {
4976  return PSA_ERROR_BAD_STATE;
4977  }
4978  hkdf->info_length = data_length;
4979  if (data_length != 0) {
4980  hkdf->info = mbedtls_calloc(1, data_length);
4981  if (hkdf->info == NULL) {
4983  }
4984  memcpy(hkdf->info, data, data_length);
4985  }
4986  hkdf->info_set = 1;
4987  return PSA_SUCCESS;
4988  default:
4990  }
4991 }
4992 #endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF */
4993 
4994 #if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \
4995  defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
4996 static psa_status_t psa_tls12_prf_set_seed(psa_tls12_prf_key_derivation_t *prf,
4997  const uint8_t *data,
4998  size_t data_length)
4999 {
5000  if (prf->state != PSA_TLS12_PRF_STATE_INIT) {
5001  return PSA_ERROR_BAD_STATE;
5002  }
5003 
5004  if (data_length != 0) {
5005  prf->seed = mbedtls_calloc(1, data_length);
5006  if (prf->seed == NULL) {
5008  }
5009 
5010  memcpy(prf->seed, data, data_length);
5011  prf->seed_length = data_length;
5012  }
5013 
5014  prf->state = PSA_TLS12_PRF_STATE_SEED_SET;
5015 
5016  return PSA_SUCCESS;
5017 }
5018 
5019 static psa_status_t psa_tls12_prf_set_key(psa_tls12_prf_key_derivation_t *prf,
5020  const uint8_t *data,
5021  size_t data_length)
5022 {
5023  if (prf->state != PSA_TLS12_PRF_STATE_SEED_SET) {
5024  return PSA_ERROR_BAD_STATE;
5025  }
5026 
5027  if (data_length != 0) {
5028  prf->secret = mbedtls_calloc(1, data_length);
5029  if (prf->secret == NULL) {
5031  }
5032 
5033  memcpy(prf->secret, data, data_length);
5034  prf->secret_length = data_length;
5035  }
5036 
5037  prf->state = PSA_TLS12_PRF_STATE_KEY_SET;
5038 
5039  return PSA_SUCCESS;
5040 }
5041 
5042 static psa_status_t psa_tls12_prf_set_label(psa_tls12_prf_key_derivation_t *prf,
5043  const uint8_t *data,
5044  size_t data_length)
5045 {
5046  if (prf->state != PSA_TLS12_PRF_STATE_KEY_SET) {
5047  return PSA_ERROR_BAD_STATE;
5048  }
5049 
5050  if (data_length != 0) {
5051  prf->label = mbedtls_calloc(1, data_length);
5052  if (prf->label == NULL) {
5054  }
5055 
5056  memcpy(prf->label, data, data_length);
5057  prf->label_length = data_length;
5058  }
5059 
5060  prf->state = PSA_TLS12_PRF_STATE_LABEL_SET;
5061 
5062  return PSA_SUCCESS;
5063 }
5064 
5065 static psa_status_t psa_tls12_prf_input(psa_tls12_prf_key_derivation_t *prf,
5067  const uint8_t *data,
5068  size_t data_length)
5069 {
5070  switch (step) {
5072  return psa_tls12_prf_set_seed(prf, data, data_length);
5074  return psa_tls12_prf_set_key(prf, data, data_length);
5076  return psa_tls12_prf_set_label(prf, data, data_length);
5077  default:
5079  }
5080 }
5081 #endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) ||
5082  * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
5083 
5084 #if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
5085 static psa_status_t psa_tls12_prf_psk_to_ms_set_key(
5086  psa_tls12_prf_key_derivation_t *prf,
5087  const uint8_t *data,
5088  size_t data_length)
5089 {
5090  psa_status_t status;
5092  uint8_t *cur = pms;
5093 
5094  if (data_length > PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE) {
5096  }
5097 
5098  /* Quoting RFC 4279, Section 2:
5099  *
5100  * The premaster secret is formed as follows: if the PSK is N octets
5101  * long, concatenate a uint16 with the value N, N zero octets, a second
5102  * uint16 with the value N, and the PSK itself.
5103  */
5104 
5105  *cur++ = MBEDTLS_BYTE_1(data_length);
5106  *cur++ = MBEDTLS_BYTE_0(data_length);
5107  memset(cur, 0, data_length);
5108  cur += data_length;
5109  *cur++ = pms[0];
5110  *cur++ = pms[1];
5111  memcpy(cur, data, data_length);
5112  cur += data_length;
5113 
5114  status = psa_tls12_prf_set_key(prf, pms, cur - pms);
5115 
5116  mbedtls_platform_zeroize(pms, sizeof(pms));
5117  return status;
5118 }
5119 
5120 static psa_status_t psa_tls12_prf_psk_to_ms_input(
5121  psa_tls12_prf_key_derivation_t *prf,
5123  const uint8_t *data,
5124  size_t data_length)
5125 {
5126  if (step == PSA_KEY_DERIVATION_INPUT_SECRET) {
5127  return psa_tls12_prf_psk_to_ms_set_key(prf,
5128  data, data_length);
5129  }
5130 
5131  return psa_tls12_prf_input(prf, step, data, data_length);
5132 }
5133 #endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
5134 
5135 /** Check whether the given key type is acceptable for the given
5136  * input step of a key derivation.
5137  *
5138  * Secret inputs must have the type #PSA_KEY_TYPE_DERIVE.
5139  * Non-secret inputs must have the type #PSA_KEY_TYPE_RAW_DATA.
5140  * Both secret and non-secret inputs can alternatively have the type
5141  * #PSA_KEY_TYPE_NONE, which is never the type of a key object, meaning
5142  * that the input was passed as a buffer rather than via a key object.
5143  */
5146  psa_key_type_t key_type)
5147 {
5148  switch (step) {
5150  if (key_type == PSA_KEY_TYPE_DERIVE) {
5151  return PSA_SUCCESS;
5152  }
5153  if (key_type == PSA_KEY_TYPE_NONE) {
5154  return PSA_SUCCESS;
5155  }
5156  break;
5161  if (key_type == PSA_KEY_TYPE_RAW_DATA) {
5162  return PSA_SUCCESS;
5163  }
5164  if (key_type == PSA_KEY_TYPE_NONE) {
5165  return PSA_SUCCESS;
5166  }
5167  break;
5168  }
5171 
5175  psa_key_type_t key_type,
5176  const uint8_t *data,
5177  size_t data_length)
5178 {
5179  psa_status_t status;
5181 
5182  status = psa_key_derivation_check_input_type(step, key_type);
5183  if (status != PSA_SUCCESS) {
5184  goto exit;
5185  }
5186 
5187 #if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF)
5188  if (PSA_ALG_IS_HKDF(kdf_alg)) {
5189  status = psa_hkdf_input(&operation->ctx.hkdf,
5190  PSA_ALG_HKDF_GET_HASH(kdf_alg),
5191  step, data, data_length);
5192  } else
5193 #endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF */
5194 #if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF)
5195  if (PSA_ALG_IS_TLS12_PRF(kdf_alg)) {
5196  status = psa_tls12_prf_input(&operation->ctx.tls12_prf,
5197  step, data, data_length);
5198  } else
5199 #endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF */
5200 #if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS)
5201  if (PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) {
5202  status = psa_tls12_prf_psk_to_ms_input(&operation->ctx.tls12_prf,
5203  step, data, data_length);
5204  } else
5205 #endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */
5206  {
5207  /* This can't happen unless the operation object was not initialized */
5208  (void) data;
5209  (void) data_length;
5210  (void) kdf_alg;
5211  return PSA_ERROR_BAD_STATE;
5212  }
5213 
5214 exit:
5215  if (status != PSA_SUCCESS) {
5217  }
5218  return status;
5220 
5224  const uint8_t *data_external,
5225  size_t data_length)
5226 {
5228  LOCAL_INPUT_DECLARE(data_external, data);
5229 
5230  LOCAL_INPUT_ALLOC(data_external, data_length, data);
5231 
5234  data, data_length);
5235 #if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
5236 exit:
5237 #endif
5238  LOCAL_INPUT_FREE(data_external, data);
5239  return status;
5241 
5246 {
5249  psa_key_slot_t *slot;
5250 
5252  key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg);
5253  if (status != PSA_SUCCESS) {
5255  return status;
5256  }
5257 
5258  /* Passing a key object as a SECRET input unlocks the permission
5259  * to output to a key object. */
5260  if (step == PSA_KEY_DERIVATION_INPUT_SECRET) {
5261  operation->can_output_key = 1;
5262  }
5263 
5265  step, slot->attr.type,
5266  slot->key.data,
5267  slot->key.bytes);
5268 
5269  unlock_status = psa_unlock_key_slot(slot);
5270 
5271  return (status == PSA_SUCCESS) ? unlock_status : status;
5272 }
5273 
5274 
5275 
5276 /****************************************************************/
5277 /* Key agreement */
5278 /****************************************************************/
5279 
5280 #if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
5281 static psa_status_t psa_key_agreement_ecdh(const uint8_t *peer_key,
5282  size_t peer_key_length,
5283  const mbedtls_ecp_keypair *our_key,
5284  uint8_t *shared_secret,
5285  size_t shared_secret_size,
5286  size_t *shared_secret_length)
5287 {
5288  mbedtls_ecp_keypair *their_key = NULL;
5289  mbedtls_ecdh_context ecdh;
5290  psa_status_t status;
5291  size_t bits = 0;
5292  psa_ecc_family_t curve = mbedtls_ecc_group_to_psa(our_key->grp.id, &bits);
5293  mbedtls_ecdh_init(&ecdh);
5294 
5297  bits,
5298  peer_key,
5299  peer_key_length,
5300  &their_key);
5301  if (status != PSA_SUCCESS) {
5302  goto exit;
5303  }
5304 
5305  status = mbedtls_to_psa_error(
5306  mbedtls_ecdh_get_params(&ecdh, their_key, MBEDTLS_ECDH_THEIRS));
5307  if (status != PSA_SUCCESS) {
5308  goto exit;
5309  }
5310  status = mbedtls_to_psa_error(
5311  mbedtls_ecdh_get_params(&ecdh, our_key, MBEDTLS_ECDH_OURS));
5312  if (status != PSA_SUCCESS) {
5313  goto exit;
5314  }
5315 
5316  status = mbedtls_to_psa_error(
5318  shared_secret_length,
5319  shared_secret, shared_secret_size,
5322  if (status != PSA_SUCCESS) {
5323  goto exit;
5324  }
5325  if (PSA_BITS_TO_BYTES(bits) != *shared_secret_length) {
5327  }
5328 
5329 exit:
5330  if (status != PSA_SUCCESS) {
5331  mbedtls_platform_zeroize(shared_secret, shared_secret_size);
5332  }
5333  mbedtls_ecdh_free(&ecdh);
5334  mbedtls_ecp_keypair_free(their_key);
5335  mbedtls_free(their_key);
5336 
5337  return status;
5338 }
5339 #endif /* MBEDTLS_PSA_BUILTIN_ALG_ECDH */
5340 
5341 #define PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE MBEDTLS_ECP_MAX_BYTES
5342 
5344  psa_key_slot_t *private_key,
5345  const uint8_t *peer_key,
5346  size_t peer_key_length,
5347  uint8_t *shared_secret,
5348  size_t shared_secret_size,
5349  size_t *shared_secret_length)
5350 {
5351  mbedtls_ecp_keypair *ecp = NULL;
5352  psa_status_t status;
5353 
5354  switch (alg) {
5355 #if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH)
5356  case PSA_ALG_ECDH:
5357  if (!PSA_KEY_TYPE_IS_ECC_KEY_PAIR(private_key->attr.type)) {
5359  }
5361  private_key->attr.type,
5362  private_key->attr.bits,
5363  private_key->key.data,
5364  private_key->key.bytes,
5365  &ecp);
5366  if (status != PSA_SUCCESS) {
5367  return status;
5368  }
5369  status = psa_key_agreement_ecdh(peer_key, peer_key_length,
5370  ecp,
5371  shared_secret, shared_secret_size,
5372  shared_secret_length);
5374  mbedtls_free(ecp);
5375  return status;
5376 #endif /* MBEDTLS_PSA_BUILTIN_ALG_ECDH */
5377  default:
5378  (void) ecp;
5379  (void) status;
5380  (void) private_key;
5381  (void) peer_key;
5382  (void) peer_key_length;
5383  (void) shared_secret;
5384  (void) shared_secret_size;
5385  (void) shared_secret_length;
5386  return PSA_ERROR_NOT_SUPPORTED;
5387  }
5388 }
5389 
5390 /* Note that if this function fails, you must call psa_key_derivation_abort()
5391  * to potentially free embedded data structures and wipe confidential data.
5392  */
5395  psa_key_slot_t *private_key,
5396  const uint8_t *peer_key,
5397  size_t peer_key_length)
5398 {
5399  psa_status_t status;
5401  size_t shared_secret_length = 0;
5403 
5404  /* Step 1: run the secret agreement algorithm to generate the shared
5405  * secret. */
5406  status = psa_key_agreement_raw_internal(ka_alg,
5407  private_key,
5408  peer_key, peer_key_length,
5409  shared_secret,
5410  sizeof(shared_secret),
5411  &shared_secret_length);
5412  if (status != PSA_SUCCESS) {
5413  goto exit;
5414  }
5415 
5416  /* Step 2: set up the key derivation to generate key material from
5417  * the shared secret. A shared secret is permitted wherever a key
5418  * of type DERIVE is permitted. */
5421  shared_secret,
5422  shared_secret_length);
5423 exit:
5424  mbedtls_platform_zeroize(shared_secret, shared_secret_length);
5425  return status;
5427 
5430  mbedtls_svc_key_id_t private_key,
5431  const uint8_t *peer_key_external,
5432  size_t peer_key_length)
5433 {
5436  psa_key_slot_t *slot;
5437  LOCAL_INPUT_DECLARE(peer_key_external, peer_key);
5438 
5439  if (!PSA_ALG_IS_KEY_AGREEMENT(operation->alg)) {
5441  }
5443  private_key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg);
5444  if (status != PSA_SUCCESS) {
5445  return status;
5446  }
5447 
5448  LOCAL_INPUT_ALLOC(peer_key_external, peer_key_length, peer_key);
5449  status = psa_key_agreement_internal(operation, step,
5450  slot,
5451  peer_key, peer_key_length);
5452 
5453 #if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS)
5454 exit:
5455 #endif
5456  if (status != PSA_SUCCESS) {
5458  } else {
5459  /* If a private key has been added as SECRET, we allow the derived
5460  * key material to be used as a key in PSA Crypto. */
5461  if (step == PSA_KEY_DERIVATION_INPUT_SECRET) {
5462  operation->can_output_key = 1;
5463  }
5464  }
5465 
5466  unlock_status = psa_unlock_key_slot(slot);
5467 
5468  LOCAL_INPUT_FREE(peer_key_external, peer_key);
5469  return (status == PSA_SUCCESS) ? unlock_status : status;
5471 
5473  mbedtls_svc_key_id_t private_key,
5474  const uint8_t *peer_key_external,
5475  size_t peer_key_length,
5476  uint8_t *output_external,
5477  size_t output_size,
5478  size_t *output_length)
5479 {
5482  psa_key_slot_t *slot = NULL;
5483  size_t expected_length;
5484  LOCAL_INPUT_DECLARE(peer_key_external, peer_key);
5485  LOCAL_OUTPUT_DECLARE(output_external, output);
5486  LOCAL_OUTPUT_ALLOC(output_external, output_size, output);
5487