AuroraMiddleware/mbedtls
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
663ee2019a
mbedtls/library/psa_crypto.c

5728 lines
196 KiB
C
Raw Normal View History

Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
/*
* PSA crypto layer on top of Mbed TLS crypto
*/
/* Copyright (C) 2018, ARM Limited, All Rights Reserved
* SPDX-License-Identifier: Apache-2.0
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may
* not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*
* This file is part of mbed TLS (https://tls.mbed.org)
*/
#if !defined(MBEDTLS_CONFIG_FILE)
#include "mbedtls/config.h"
#else
#include MBEDTLS_CONFIG_FILE
#endif
#if defined(MBEDTLS_PSA_CRYPTO_C)
Modifications for psa-crypto in order to integrate with SPM Add required includes in tests and psa_crypto.c file in order to be able to compilef for the SPM solution. Some functions needed to be deprecated from psa_crypto.c since they already implemented in the SPM.
2018-07-03 10:16:15 +00:00
Add common header for crypto service integration
2019-02-14 08:28:02 +00:00
#include "psa_crypto_service_integration.h"
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
#include "psa/crypto.h"
Expose the PSA key slot structure to internal modules Move psa_key_slot_t to a new header psa_crypto_core.h, to prepare for moving the responsibility for some fields to psa_crypto_slot_management.c.
2018-12-07 17:24:41 +00:00
#include "psa_crypto_core.h"
Add a facility to configure entropy sources Add a function to configure entropy sources. For testing only. Use it to test that the library initialization fails properly if there is no entropy source.
2018-11-20 20:59:56 +00:00
#include "psa_crypto_invasive.h"
Gate secure element support by a separate config option Secure element support has its own source file, and in addition requires many hooks in other files. This is a nontrivial amount of code, so make it optional (but default on).
2019-06-26 09:24:49 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Unregister drivers on library deinitialization
2019-06-24 12:34:43 +00:00
#include "psa_crypto_se.h"
Gate secure element support by a separate config option Secure element support has its own source file, and in addition requires many hooks in other files. This is a nontrivial amount of code, so make it optional (but default on).
2019-06-26 09:24:49 +00:00
#endif
Implement slot allocation Implement psa_allocate_key, psa_open_key, psa_create_key, psa_close_key. Add support for keys designated to handles to psa_get_key_slot, and thereby to the whole API. Allocated and non-allocated keys can coexist. This is a temporary stage in order to transition from the use of direct slot numbers to allocated handles only. Once all the tests and sample programs have been migrated to use handles, the implementation will be simplified and made more robust with support for handles only.
2018-11-30 17:54:54 +00:00
#include "psa_crypto_slot_management.h"
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 16:27:26 +00:00
/* Include internal declarations that are useful for implementing persistently
* stored keys. */
#include "psa_crypto_storage.h"
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 19:32:04 +00:00
#include <assert.h>
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
#include <stdlib.h>
#include <string.h>
#include "mbedtls/platform.h"
Always include platform.h for MBEDTLS_ERR_PLATFORM_xxx Recognize MBEDTLS_ERR_PLATFORM_xxx in mbedtls_to_psa_error().
2019-05-06 13:26:23 +00:00
#if !defined(MBEDTLS_PLATFORM_C)
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
#define mbedtls_calloc calloc
#define mbedtls_free free
#endif
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
#include "mbedtls/arc4.h"
Convert ERR_ASN1 error codes to PSA This fixes the error code when psa_export_key on an asymmetric key reports that the output buffer is too small.
2018-06-21 07:35:35 +00:00
#include "mbedtls/asn1.h"
psa: Simplify RSA public key format Remove pkcs-1 and rsaEncryption front matter from RSA public keys. Move code that was shared between RSA and other key types (like EC keys) to be used only with non-RSA keys.
2019-01-10 10:23:21 +00:00
#include "mbedtls/asn1write.h"
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
#include "mbedtls/bignum.h"
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
#include "mbedtls/blowfish.h"
#include "mbedtls/camellia.h"
Implement ChaCha20 and ChaCha20-Poly1305 Smoke tests: test data for ChaCha20 calculated with PyCryptodome; test vector from RFC 7539 for ChaCha20-Poly1305.
2019-05-06 13:25:00 +00:00
#include "mbedtls/chacha20.h"
#include "mbedtls/chachapoly.h"
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
#include "mbedtls/cipher.h"
#include "mbedtls/ccm.h"
#include "mbedtls/cmac.h"
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
#include "mbedtls/ctr_drbg.h"
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
#include "mbedtls/des.h"
Implement ECDH
2018-09-18 10:11:27 +00:00
#include "mbedtls/ecdh.h"
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 17:16:59 +00:00
#include "mbedtls/ecp.h"
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
#include "mbedtls/entropy.h"
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
#include "mbedtls/error.h"
#include "mbedtls/gcm.h"
#include "mbedtls/md2.h"
#include "mbedtls/md4.h"
#include "mbedtls/md5.h"
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
#include "mbedtls/md.h"
#include "mbedtls/md_internal.h"
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
#include "mbedtls/pk.h"
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 17:16:59 +00:00
#include "mbedtls/pk_internal.h"
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 17:14:53 +00:00
#include "mbedtls/platform_util.h"
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
#include "mbedtls/error.h"
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
#include "mbedtls/ripemd160.h"
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 17:16:59 +00:00
#include "mbedtls/rsa.h"
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
#include "mbedtls/sha1.h"
#include "mbedtls/sha256.h"
#include "mbedtls/sha512.h"
#include "mbedtls/xtea.h"
Fix buffer overflow in the slot array Slots are numbered from 1, but the slot array is a C array so it's numbered from 0. Add a non-regression test.
2018-08-01 13:45:45 +00:00
#define ARRAY_LENGTH( array ) ( sizeof( array ) / sizeof( *( array ) ) )
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
/* constant-time buffer comparison */
static inline int safer_memcmp( const uint8_t *a, const uint8_t *b, size_t n )
{
size_t i;
unsigned char diff = 0;
for( i = 0; i < n; i++ )
diff |= a[i] ^ b[i];
return( diff );
}
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
/****************************************************************/
/* Global data, support functions and library management */
/****************************************************************/
Remove PSA_KEY_TYPE_IS_RAW_BYTES from crypto.h It isn't used to define other macros and it doesn't seem that useful for users. Remove it, we can reintroduce it if needed. Define a similar function key_type_is_raw_bytes in the implementation with a clear semantics: it's a key that's represented as a struct raw_data.
2018-06-21 12:15:31 +00:00
static int key_type_is_raw_bytes( psa_key_type_t type )
{
Change the bitwise encoding of key type categories There were only 5 categories (now 4). Reduce the category mask from 7 bits to 3. Combine unformatted, not-necessarily-uniform keys (HMAC, derivation) with raw data. Reintroduce a KEY_TYPE_IS_UNSTRUCTURED macro (which used to exist under the name KEY_TYPE_IS_RAW_DATA macro) for key types that don't have any structure, including both should-be-uniform keys (such as block cipher and stream cipher keys) and not-necessarily-uniform keys (such as HMAC keys and secrets for key derivation).
2018-08-10 14:03:41 +00:00
return( PSA_KEY_TYPE_IS_UNSTRUCTURED( type ) );
Remove PSA_KEY_TYPE_IS_RAW_BYTES from crypto.h It isn't used to define other macros and it doesn't seem that useful for users. Remove it, we can reintroduce it if needed. Define a similar function key_type_is_raw_bytes in the implementation with a clear semantics: it's a key that's represented as a struct raw_data.
2018-06-21 12:15:31 +00:00
}
Don't use an enum in a bit-field This isn't standard C. GCC and Clang accept it but not every compiler (e.g. Armcc 5).
2018-12-04 11:27:09 +00:00
/* Values for psa_global_data_t::rng_state */
#define RNG_NOT_INITIALIZED 0
#define RNG_INITIALIZED 1
#define RNG_SEEDED 2
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 20:42:52 +00:00
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 13:41:12 +00:00
typedef struct
{
Add a facility to configure entropy sources Add a function to configure entropy sources. For testing only. Use it to test that the library initialization fails properly if there is no entropy source.
2018-11-20 20:59:56 +00:00
void (* entropy_init )( mbedtls_entropy_context *ctx );
void (* entropy_free )( mbedtls_entropy_context *ctx );
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
mbedtls_entropy_context entropy;
mbedtls_ctr_drbg_context ctr_drbg;
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 20:42:52 +00:00
unsigned initialized : 1;
Don't use an enum in a bit-field This isn't standard C. GCC and Clang accept it but not every compiler (e.g. Armcc 5).
2018-12-04 11:27:09 +00:00
unsigned rng_state : 2;
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
} psa_global_data_t;
static psa_global_data_t global_data;
Ensure the module is initialized in psa_generate_random
2018-09-06 13:24:41 +00:00
#define GUARD_MODULE_INITIALIZED \
if( global_data.initialized == 0 ) \
return( PSA_ERROR_BAD_STATE );
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
static psa_status_t mbedtls_to_psa_error( int ret )
{
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
/* If there's both a high-level code and low-level code, dispatch on
* the high-level code. */
switch( ret < -0x7f ? - ( -ret & 0x7f80 ) : ret )
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
{
case 0:
return( PSA_SUCCESS );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
case MBEDTLS_ERR_AES_INVALID_KEY_LENGTH:
case MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH:
case MBEDTLS_ERR_AES_FEATURE_UNAVAILABLE:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_AES_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_ARC4_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
Convert ERR_ASN1 error codes to PSA This fixes the error code when psa_export_key on an asymmetric key reports that the output buffer is too small.
2018-06-21 07:35:35 +00:00
case MBEDTLS_ERR_ASN1_OUT_OF_DATA:
case MBEDTLS_ERR_ASN1_UNEXPECTED_TAG:
case MBEDTLS_ERR_ASN1_INVALID_LENGTH:
case MBEDTLS_ERR_ASN1_LENGTH_MISMATCH:
case MBEDTLS_ERR_ASN1_INVALID_DATA:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_ASN1_ALLOC_FAILED:
return( PSA_ERROR_INSUFFICIENT_MEMORY );
case MBEDTLS_ERR_ASN1_BUF_TOO_SMALL:
return( PSA_ERROR_BUFFER_TOO_SMALL );
psa: Be compatible with deprecated constants In case the new constants aren't available yet in Mbed TLS, continue to use the deprecated constants if they are available.
2019-02-20 13:57:28 +00:00
#if defined(MBEDTLS_ERR_BLOWFISH_BAD_INPUT_DATA)
psa: Use new generic error codes Mbed TLS has deprecated a few module specific error codes in favor of more general-purpose or cross-module error codes. Use these new error codes instead of the deprecated error codes.
2019-02-11 12:21:12 +00:00
case MBEDTLS_ERR_BLOWFISH_BAD_INPUT_DATA:
psa: Be compatible with deprecated constants In case the new constants aren't available yet in Mbed TLS, continue to use the deprecated constants if they are available.
2019-02-20 13:57:28 +00:00
#elif defined(MBEDTLS_ERR_BLOWFISH_INVALID_KEY_LENGTH)
case MBEDTLS_ERR_BLOWFISH_INVALID_KEY_LENGTH:
#endif
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
case MBEDTLS_ERR_BLOWFISH_INVALID_INPUT_LENGTH:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_BLOWFISH_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
psa: Be compatible with deprecated constants In case the new constants aren't available yet in Mbed TLS, continue to use the deprecated constants if they are available.
2019-02-20 13:57:28 +00:00
#if defined(MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA)
psa: Use new generic error codes Mbed TLS has deprecated a few module specific error codes in favor of more general-purpose or cross-module error codes. Use these new error codes instead of the deprecated error codes.
2019-02-11 12:21:12 +00:00
case MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA:
psa: Be compatible with deprecated constants In case the new constants aren't available yet in Mbed TLS, continue to use the deprecated constants if they are available.
2019-02-20 13:57:28 +00:00
#elif defined(MBEDTLS_ERR_CAMELLIA_INVALID_KEY_LENGTH)
case MBEDTLS_ERR_CAMELLIA_INVALID_KEY_LENGTH:
#endif
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
case MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_CAMELLIA_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_CCM_BAD_INPUT:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_CCM_AUTH_FAILED:
return( PSA_ERROR_INVALID_SIGNATURE );
case MBEDTLS_ERR_CCM_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
Implement ChaCha20 and ChaCha20-Poly1305 Smoke tests: test data for ChaCha20 calculated with PyCryptodome; test vector from RFC 7539 for ChaCha20-Poly1305.
2019-05-06 13:25:00 +00:00
case MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_CHACHAPOLY_BAD_STATE:
return( PSA_ERROR_BAD_STATE );
case MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED:
return( PSA_ERROR_INVALID_SIGNATURE );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
case MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_CIPHER_ALLOC_FAILED:
return( PSA_ERROR_INSUFFICIENT_MEMORY );
case MBEDTLS_ERR_CIPHER_INVALID_PADDING:
return( PSA_ERROR_INVALID_PADDING );
case MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED:
return( PSA_ERROR_BAD_STATE );
case MBEDTLS_ERR_CIPHER_AUTH_FAILED:
return( PSA_ERROR_INVALID_SIGNATURE );
case MBEDTLS_ERR_CIPHER_INVALID_CONTEXT:
Rename PSA_ERROR_TAMPERING_DETECTED to ..._CORRUPTION_DETECTED “Tampering detected” was misleading because in the real world it can also arise due to a software bug. “Corruption detected” is neutral and more precisely reflects what can trigger the error. perl -i -pe 's/PSA_ERROR_TAMPERING_DETECTED/PSA_ERROR_CORRUPTION_DETECTED/gi' $(git ls-files)
2019-05-16 19:35:18 +00:00
return( PSA_ERROR_CORRUPTION_DETECTED );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
case MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_CMAC_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED:
return( PSA_ERROR_INSUFFICIENT_ENTROPY );
case MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG:
case MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR:
return( PSA_ERROR_INSUFFICIENT_ENTROPY );
case MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_DES_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
case MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED:
case MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE:
case MBEDTLS_ERR_ENTROPY_SOURCE_FAILED:
return( PSA_ERROR_INSUFFICIENT_ENTROPY );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
case MBEDTLS_ERR_GCM_AUTH_FAILED:
return( PSA_ERROR_INVALID_SIGNATURE );
case MBEDTLS_ERR_GCM_BAD_INPUT:
Translate GCM_BAD_INPUT to INVALID_ARGUMENT, not NOT_SUPPORTED
2018-08-21 13:07:38 +00:00
return( PSA_ERROR_INVALID_ARGUMENT );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
case MBEDTLS_ERR_GCM_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_MD2_HW_ACCEL_FAILED:
case MBEDTLS_ERR_MD4_HW_ACCEL_FAILED:
case MBEDTLS_ERR_MD5_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_MD_BAD_INPUT_DATA:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_MD_ALLOC_FAILED:
return( PSA_ERROR_INSUFFICIENT_MEMORY );
case MBEDTLS_ERR_MD_FILE_IO_ERROR:
return( PSA_ERROR_STORAGE_FAILURE );
case MBEDTLS_ERR_MD_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
Private EC key format: change to raw secret value (doc, import) Change the import/export format of private elliptic curve keys from RFC 5915 to the raw secret value. This commit updates the format specification and the import code, but not the export code.
2018-10-29 18:24:33 +00:00
case MBEDTLS_ERR_MPI_FILE_IO_ERROR:
return( PSA_ERROR_STORAGE_FAILURE );
case MBEDTLS_ERR_MPI_BAD_INPUT_DATA:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_MPI_INVALID_CHARACTER:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL:
return( PSA_ERROR_BUFFER_TOO_SMALL );
case MBEDTLS_ERR_MPI_NEGATIVE_VALUE:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_MPI_DIVISION_BY_ZERO:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_MPI_NOT_ACCEPTABLE:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_MPI_ALLOC_FAILED:
return( PSA_ERROR_INSUFFICIENT_MEMORY );
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
case MBEDTLS_ERR_PK_ALLOC_FAILED:
return( PSA_ERROR_INSUFFICIENT_MEMORY );
case MBEDTLS_ERR_PK_TYPE_MISMATCH:
case MBEDTLS_ERR_PK_BAD_INPUT_DATA:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_PK_FILE_IO_ERROR:
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
return( PSA_ERROR_STORAGE_FAILURE );
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
case MBEDTLS_ERR_PK_KEY_INVALID_VERSION:
case MBEDTLS_ERR_PK_KEY_INVALID_FORMAT:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_PK_UNKNOWN_PK_ALG:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_PK_PASSWORD_REQUIRED:
case MBEDTLS_ERR_PK_PASSWORD_MISMATCH:
return( PSA_ERROR_NOT_PERMITTED );
case MBEDTLS_ERR_PK_INVALID_PUBKEY:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_PK_INVALID_ALG:
case MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE:
case MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_PK_SIG_LEN_MISMATCH:
return( PSA_ERROR_INVALID_SIGNATURE );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
case MBEDTLS_ERR_PK_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
Always include platform.h for MBEDTLS_ERR_PLATFORM_xxx Recognize MBEDTLS_ERR_PLATFORM_xxx in mbedtls_to_psa_error().
2019-05-06 13:26:23 +00:00
case MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED:
return( PSA_ERROR_NOT_SUPPORTED );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
case MBEDTLS_ERR_RIPEMD160_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_RSA_BAD_INPUT_DATA:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_RSA_INVALID_PADDING:
return( PSA_ERROR_INVALID_PADDING );
case MBEDTLS_ERR_RSA_KEY_GEN_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_RSA_KEY_CHECK_FAILED:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_RSA_PUBLIC_FAILED:
case MBEDTLS_ERR_RSA_PRIVATE_FAILED:
Rename PSA_ERROR_TAMPERING_DETECTED to ..._CORRUPTION_DETECTED “Tampering detected” was misleading because in the real world it can also arise due to a software bug. “Corruption detected” is neutral and more precisely reflects what can trigger the error. perl -i -pe 's/PSA_ERROR_TAMPERING_DETECTED/PSA_ERROR_CORRUPTION_DETECTED/gi' $(git ls-files)
2019-05-16 19:35:18 +00:00
return( PSA_ERROR_CORRUPTION_DETECTED );
Greatly expanded mbedtls_to_psa_error It now covers most cryptography algorithm modules (missing: bignum, DHM, everything ECC, HMAC_DRBG).
2018-02-07 19:59:33 +00:00
case MBEDTLS_ERR_RSA_VERIFY_FAILED:
return( PSA_ERROR_INVALID_SIGNATURE );
case MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE:
return( PSA_ERROR_BUFFER_TOO_SMALL );
case MBEDTLS_ERR_RSA_RNG_FAILED:
return( PSA_ERROR_INSUFFICIENT_MEMORY );
case MBEDTLS_ERR_RSA_UNSUPPORTED_OPERATION:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_RSA_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_SHA1_HW_ACCEL_FAILED:
case MBEDTLS_ERR_SHA256_HW_ACCEL_FAILED:
case MBEDTLS_ERR_SHA512_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
case MBEDTLS_ERR_XTEA_INVALID_INPUT_LENGTH:
return( PSA_ERROR_INVALID_ARGUMENT );
case MBEDTLS_ERR_XTEA_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 08:18:38 +00:00
case MBEDTLS_ERR_ECP_BAD_INPUT_DATA:
Added handling for MBEDTLS_ERR_ECP_XXX error codes Added handling for MBEDTLS_ERR_ECP_XXX error codes
2018-05-09 13:07:36 +00:00
case MBEDTLS_ERR_ECP_INVALID_KEY:
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 08:18:38 +00:00
return( PSA_ERROR_INVALID_ARGUMENT );
Added handling for MBEDTLS_ERR_ECP_XXX error codes Added handling for MBEDTLS_ERR_ECP_XXX error codes
2018-05-09 13:07:36 +00:00
case MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL:
return( PSA_ERROR_BUFFER_TOO_SMALL );
case MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE:
return( PSA_ERROR_NOT_SUPPORTED );
case MBEDTLS_ERR_ECP_SIG_LEN_MISMATCH:
case MBEDTLS_ERR_ECP_VERIFY_FAILED:
return( PSA_ERROR_INVALID_SIGNATURE );
case MBEDTLS_ERR_ECP_ALLOC_FAILED:
return( PSA_ERROR_INSUFFICIENT_MEMORY );
case MBEDTLS_ERR_ECP_HW_ACCEL_FAILED:
return( PSA_ERROR_HARDWARE_FAILURE );
Map the new Mbed TLS error value in PSA
2019-11-22 12:48:59 +00:00
case MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED:
return( PSA_ERROR_CORRUPTION_DETECTED );
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 08:18:38 +00:00
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
default:
Replace PSA error code definitions with the ones defined in PSA spec
2019-02-14 11:48:10 +00:00
return( PSA_ERROR_GENERIC_ERROR );
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
}
}
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 15:01:38 +00:00
Be more consistent about blank lines
2018-06-18 19:49:39 +00:00
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
/****************************************************************/
/* Key management */
/****************************************************************/
SE keys: store the slot number in the memory slot
2019-07-12 21:44:37 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
static inline int psa_key_slot_is_external( const psa_key_slot_t *slot )
{
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
return( psa_key_lifetime_is_external( slot->attr.lifetime ) );
SE keys: store the slot number in the memory slot
2019-07-12 21:44:37 +00:00
}
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Add ifdef for MBEDTLS_ECP_C around ecc_group_to_psa functions These are unused if MBEDTLS_ECP_C isn't defined.
2018-07-24 14:44:51 +00:00
#if defined(MBEDTLS_ECP_C)
Check the curve of an elliptic curve key on import psa_import_key must check that the imported key data matches the expected key type. Implement the missing check for EC keys that the curve is the expected one.
2018-06-18 18:47:51 +00:00
static psa_ecc_curve_t mbedtls_ecc_group_to_psa( mbedtls_ecp_group_id grpid )
{
switch( grpid )
{
case MBEDTLS_ECP_DP_SECP192R1:
return( PSA_ECC_CURVE_SECP192R1 );
case MBEDTLS_ECP_DP_SECP224R1:
return( PSA_ECC_CURVE_SECP224R1 );
case MBEDTLS_ECP_DP_SECP256R1:
return( PSA_ECC_CURVE_SECP256R1 );
case MBEDTLS_ECP_DP_SECP384R1:
return( PSA_ECC_CURVE_SECP384R1 );
case MBEDTLS_ECP_DP_SECP521R1:
return( PSA_ECC_CURVE_SECP521R1 );
case MBEDTLS_ECP_DP_BP256R1:
return( PSA_ECC_CURVE_BRAINPOOL_P256R1 );
case MBEDTLS_ECP_DP_BP384R1:
return( PSA_ECC_CURVE_BRAINPOOL_P384R1 );
case MBEDTLS_ECP_DP_BP512R1:
return( PSA_ECC_CURVE_BRAINPOOL_P512R1 );
case MBEDTLS_ECP_DP_CURVE25519:
return( PSA_ECC_CURVE_CURVE25519 );
case MBEDTLS_ECP_DP_SECP192K1:
return( PSA_ECC_CURVE_SECP192K1 );
case MBEDTLS_ECP_DP_SECP224K1:
return( PSA_ECC_CURVE_SECP224K1 );
case MBEDTLS_ECP_DP_SECP256K1:
return( PSA_ECC_CURVE_SECP256K1 );
case MBEDTLS_ECP_DP_CURVE448:
return( PSA_ECC_CURVE_CURVE448 );
default:
return( 0 );
}
}
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-19 22:20:32 +00:00
static mbedtls_ecp_group_id mbedtls_ecc_group_of_psa( psa_ecc_curve_t curve )
{
switch( curve )
{
case PSA_ECC_CURVE_SECP192R1:
return( MBEDTLS_ECP_DP_SECP192R1 );
case PSA_ECC_CURVE_SECP224R1:
return( MBEDTLS_ECP_DP_SECP224R1 );
case PSA_ECC_CURVE_SECP256R1:
return( MBEDTLS_ECP_DP_SECP256R1 );
case PSA_ECC_CURVE_SECP384R1:
return( MBEDTLS_ECP_DP_SECP384R1 );
case PSA_ECC_CURVE_SECP521R1:
return( MBEDTLS_ECP_DP_SECP521R1 );
case PSA_ECC_CURVE_BRAINPOOL_P256R1:
return( MBEDTLS_ECP_DP_BP256R1 );
case PSA_ECC_CURVE_BRAINPOOL_P384R1:
return( MBEDTLS_ECP_DP_BP384R1 );
case PSA_ECC_CURVE_BRAINPOOL_P512R1:
return( MBEDTLS_ECP_DP_BP512R1 );
case PSA_ECC_CURVE_CURVE25519:
return( MBEDTLS_ECP_DP_CURVE25519 );
case PSA_ECC_CURVE_SECP192K1:
return( MBEDTLS_ECP_DP_SECP192K1 );
case PSA_ECC_CURVE_SECP224K1:
return( MBEDTLS_ECP_DP_SECP224K1 );
case PSA_ECC_CURVE_SECP256K1:
return( MBEDTLS_ECP_DP_SECP256K1 );
case PSA_ECC_CURVE_CURVE448:
return( MBEDTLS_ECP_DP_CURVE448 );
default:
return( MBEDTLS_ECP_DP_NONE );
}
}
Add ifdef for MBEDTLS_ECP_C around ecc_group_to_psa functions These are unused if MBEDTLS_ECP_C isn't defined.
2018-07-24 14:44:51 +00:00
#endif /* defined(MBEDTLS_ECP_C) */
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-19 22:20:32 +00:00
psa_import_key: validate symmetric key size When importing a symmetric key, validate that the key size is valid for the given key type. Non-supported key types may no longer be imported.
2018-06-19 19:31:50 +00:00
static psa_status_t prepare_raw_data_slot( psa_key_type_t type,
size_t bits,
struct raw_data *raw )
{
/* Check that the bit size is acceptable for the key type */
switch( type )
{
case PSA_KEY_TYPE_RAW_DATA:
#if defined(MBEDTLS_MD_C)
case PSA_KEY_TYPE_HMAC:
Handle null pointers safely when used as buffers of size 0 When the size of a buffer is 0, the corresponding pointer argument may be null. In such cases, library functions must not perform arithmetic on the pointer or call standard library functions such as memset and memcpy, since that would be undefined behavior in C. Protect such cases. Refactor the storage of a 0-sized raw data object to make it store a null pointer, rather than depending on the behavior of calloc(1,0).
2018-06-28 17:31:31 +00:00
#endif
Add framework for simple key derivation New key type PSA_KEY_TYPE_DERIVE. New usage flag PSA_KEY_USAGE_DERIVE. New function psa_key_derivation. No key derivation algorithm is implemented yet. The code may not compile with -Wunused. Write some unit test code for psa_key_derivation. Most of it cannot be used yet due to the lack of a key derivation algorithm.
2018-07-12 15:17:20 +00:00
case PSA_KEY_TYPE_DERIVE:
break;
psa_import_key: validate symmetric key size When importing a symmetric key, validate that the key size is valid for the given key type. Non-supported key types may no longer be imported.
2018-06-19 19:31:50 +00:00
#if defined(MBEDTLS_AES_C)
case PSA_KEY_TYPE_AES:
if( bits != 128 && bits != 192 && bits != 256 )
return( PSA_ERROR_INVALID_ARGUMENT );
break;
#endif
#if defined(MBEDTLS_CAMELLIA_C)
case PSA_KEY_TYPE_CAMELLIA:
if( bits != 128 && bits != 192 && bits != 256 )
return( PSA_ERROR_INVALID_ARGUMENT );
break;
#endif
#if defined(MBEDTLS_DES_C)
case PSA_KEY_TYPE_DES:
if( bits != 64 && bits != 128 && bits != 192 )
return( PSA_ERROR_INVALID_ARGUMENT );
break;
#endif
#if defined(MBEDTLS_ARC4_C)
case PSA_KEY_TYPE_ARC4:
if( bits < 8 || bits > 2048 )
return( PSA_ERROR_INVALID_ARGUMENT );
break;
Implement ChaCha20 and ChaCha20-Poly1305 Smoke tests: test data for ChaCha20 calculated with PyCryptodome; test vector from RFC 7539 for ChaCha20-Poly1305.
2019-05-06 13:25:00 +00:00
#endif
#if defined(MBEDTLS_CHACHA20_C)
case PSA_KEY_TYPE_CHACHA20:
if( bits != 256 )
return( PSA_ERROR_INVALID_ARGUMENT );
break;
psa_import_key: validate symmetric key size When importing a symmetric key, validate that the key size is valid for the given key type. Non-supported key types may no longer be imported.
2018-06-19 19:31:50 +00:00
#endif
default:
return( PSA_ERROR_NOT_SUPPORTED );
}
Refuse non-byte-sized raw data keys Since the key size is stored in bytes, we can't have a key whose size isn't a whole number of bytes.
2018-06-21 07:32:47 +00:00
if( bits % 8 != 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
psa_import_key: validate symmetric key size When importing a symmetric key, validate that the key size is valid for the given key type. Non-supported key types may no longer be imported.
2018-06-19 19:31:50 +00:00
/* Allocate memory for the key */
raw->bytes = PSA_BITS_TO_BYTES( bits );
raw->data = mbedtls_calloc( 1, raw->bytes );
if( raw->data == NULL )
{
raw->bytes = 0;
return( PSA_ERROR_INSUFFICIENT_MEMORY );
}
return( PSA_SUCCESS );
}
psa_import_key: split RSA and ECP code into small functions No intended behavior change except that some edge cases may have swapped between INVALID_ARGUMENT and NOT_SUPPORTED.
2018-06-29 17:52:37 +00:00
#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PK_PARSE_C)
Reject non-byte-aligned RSA keys On key import and key generation, for RSA, reject key sizes that are not a multiple of 8. Such keys are not well-supported in Mbed TLS and are hardly ever used in practice. The previous commit removed support for non-byte-aligned keys at the PSA level. This commit actively rejects such keys and adds corresponding tests (test keys generated with "openssl genrsa").
2018-11-12 17:39:40 +00:00
/* Mbed TLS doesn't support non-byte-aligned key sizes (i.e. key sizes
* that are not a multiple of 8) well. For example, there is only
* mbedtls_rsa_get_len(), which returns a number of bytes, and no
* way to return the exact bit size of a key.
* To keep things simple, reject non-byte-aligned key sizes. */
static psa_status_t psa_check_rsa_key_byte_aligned(
const mbedtls_rsa_context *rsa )
{
mbedtls_mpi n;
psa_status_t status;
mbedtls_mpi_init( &n );
status = mbedtls_to_psa_error(
mbedtls_rsa_export( rsa, &n, NULL, NULL, NULL, NULL ) );
if( status == PSA_SUCCESS )
{
if( mbedtls_mpi_bitlen( &n ) % 8 != 0 )
status = PSA_ERROR_NOT_SUPPORTED;
}
mbedtls_mpi_free( &n );
return( status );
}
psa: Refactor psa_import_rsa_key() pk-using code Move pk-using code to inside psa_import_rsa_key(). This aligns the shape of psa_import_rsa_key() to match that of psa_import_ec_private_key() and psa_import_ec_public_key().
2019-01-11 17:53:05 +00:00
static psa_status_t psa_import_rsa_key( psa_key_type_t type,
const uint8_t *data,
size_t data_length,
psa_import_key: split RSA and ECP code into small functions No intended behavior change except that some edge cases may have swapped between INVALID_ARGUMENT and NOT_SUPPORTED.
2018-06-29 17:52:37 +00:00
mbedtls_rsa_context **p_rsa )
{
psa: Refactor psa_import_rsa_key() pk-using code Move pk-using code to inside psa_import_rsa_key(). This aligns the shape of psa_import_rsa_key() to match that of psa_import_ec_private_key() and psa_import_ec_public_key().
2019-01-11 17:53:05 +00:00
psa_status_t status;
mbedtls_pk_context pk;
mbedtls_rsa_context *rsa;
size_t bits;
mbedtls_pk_init( &pk );
/* Parse the data. */
Rename *KEYPAIR* to *KEY_PAIR* Be consistent with PUBLIC_KEY. perl -i -pe 's/KEYPAIR/KEY_PAIR/g' $(git ls-files)
2019-05-16 17:39:54 +00:00
if( PSA_KEY_TYPE_IS_KEY_PAIR( type ) )
psa: Refactor psa_import_rsa_key() pk-using code Move pk-using code to inside psa_import_rsa_key(). This aligns the shape of psa_import_rsa_key() to match that of psa_import_ec_private_key() and psa_import_ec_public_key().
2019-01-11 17:53:05 +00:00
status = mbedtls_to_psa_error(
mbedtls_pk_parse_key( &pk, data, data_length, NULL, 0 ) );
psa_import_key: split RSA and ECP code into small functions No intended behavior change except that some edge cases may have swapped between INVALID_ARGUMENT and NOT_SUPPORTED.
2018-06-29 17:52:37 +00:00
else
psa: Refactor psa_import_rsa_key() pk-using code Move pk-using code to inside psa_import_rsa_key(). This aligns the shape of psa_import_rsa_key() to match that of psa_import_ec_private_key() and psa_import_ec_public_key().
2019-01-11 17:53:05 +00:00
status = mbedtls_to_psa_error(
mbedtls_pk_parse_public_key( &pk, data, data_length ) );
if( status != PSA_SUCCESS )
goto exit;
/* We have something that the pkparse module recognizes. If it is a
* valid RSA key, store it. */
if( mbedtls_pk_get_type( &pk ) != MBEDTLS_PK_RSA )
psa_import_key: split RSA and ECP code into small functions No intended behavior change except that some edge cases may have swapped between INVALID_ARGUMENT and NOT_SUPPORTED.
2018-06-29 17:52:37 +00:00
{
psa: Refactor psa_import_rsa_key() pk-using code Move pk-using code to inside psa_import_rsa_key(). This aligns the shape of psa_import_rsa_key() to match that of psa_import_ec_private_key() and psa_import_ec_public_key().
2019-01-11 17:53:05 +00:00
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
psa_import_key: split RSA and ECP code into small functions No intended behavior change except that some edge cases may have swapped between INVALID_ARGUMENT and NOT_SUPPORTED.
2018-06-29 17:52:37 +00:00
}
psa: Refactor psa_import_rsa_key() pk-using code Move pk-using code to inside psa_import_rsa_key(). This aligns the shape of psa_import_rsa_key() to match that of psa_import_ec_private_key() and psa_import_ec_public_key().
2019-01-11 17:53:05 +00:00
rsa = mbedtls_pk_rsa( pk );
/* The size of an RSA key doesn't have to be a multiple of 8. Mbed TLS
* supports non-byte-aligned key sizes, but not well. For example,
* mbedtls_rsa_get_len() returns the key size in bytes, not in bits. */
bits = PSA_BYTES_TO_BITS( mbedtls_rsa_get_len( rsa ) );
if( bits > PSA_VENDOR_RSA_MAX_KEY_BITS )
{
status = PSA_ERROR_NOT_SUPPORTED;
goto exit;
}
status = psa_check_rsa_key_byte_aligned( rsa );
exit:
/* Free the content of the pk object only on error. */
if( status != PSA_SUCCESS )
{
mbedtls_pk_free( &pk );
return( status );
psa_import_key: split RSA and ECP code into small functions No intended behavior change except that some edge cases may have swapped between INVALID_ARGUMENT and NOT_SUPPORTED.
2018-06-29 17:52:37 +00:00
}
psa: Refactor psa_import_rsa_key() pk-using code Move pk-using code to inside psa_import_rsa_key(). This aligns the shape of psa_import_rsa_key() to match that of psa_import_ec_private_key() and psa_import_ec_public_key().
2019-01-11 17:53:05 +00:00
/* On success, store the content of the object in the RSA context. */
*p_rsa = rsa;
return( PSA_SUCCESS );
psa_import_key: split RSA and ECP code into small functions No intended behavior change except that some edge cases may have swapped between INVALID_ARGUMENT and NOT_SUPPORTED.
2018-06-29 17:52:37 +00:00
}
#endif /* defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PK_PARSE_C) */
psa: Simplify EC public key format Remove front matter from our EC key format, to make it just the contents of an ECPoint as defined by SEC1 section 2.3.3. As a consequence of the simplification, remove the restriction on not being able to use an ECDH key with ECDSA. There is no longer any OID specified when importing a key, so we can't reject importing of an ECDH key for the purpose of ECDSA based on the OID.
2019-01-10 11:42:27 +00:00
#if defined(MBEDTLS_ECP_C)
Factor common code of psa_import_ec_{public,private}_key
2019-12-02 19:49:42 +00:00
static psa_status_t psa_prepare_import_ec_key( psa_ecc_curve_t curve,
mbedtls_ecp_keypair **p_ecp )
{
mbedtls_ecp_group_id grp_id = MBEDTLS_ECP_DP_NONE;
*p_ecp = mbedtls_calloc( 1, sizeof( mbedtls_ecp_keypair ) );
if( *p_ecp == NULL )
return( PSA_ERROR_INSUFFICIENT_MEMORY );
mbedtls_ecp_keypair_init( *p_ecp );
/* Load the group. */
grp_id = mbedtls_ecc_group_of_psa( curve );
return( mbedtls_to_psa_error(
mbedtls_ecp_group_load( &( *p_ecp )->grp, grp_id ) ) );
}
psa: Simplify EC public key format Remove front matter from our EC key format, to make it just the contents of an ECPoint as defined by SEC1 section 2.3.3. As a consequence of the simplification, remove the restriction on not being able to use an ECDH key with ECDSA. There is no longer any OID specified when importing a key, so we can't reject importing of an ECDH key for the purpose of ECDSA based on the OID.
2019-01-10 11:42:27 +00:00
/* Import a public key given as the uncompressed representation defined by SEC1
* 2.3.3 as the content of an ECPoint. */
static psa_status_t psa_import_ec_public_key( psa_ecc_curve_t curve,
const uint8_t *data,
size_t data_length,
mbedtls_ecp_keypair **p_ecp )
psa_import_key: split RSA and ECP code into small functions No intended behavior change except that some edge cases may have swapped between INVALID_ARGUMENT and NOT_SUPPORTED.
2018-06-29 17:52:37 +00:00
{
Rename PSA_ERROR_TAMPERING_DETECTED to ..._CORRUPTION_DETECTED “Tampering detected” was misleading because in the real world it can also arise due to a software bug. “Corruption detected” is neutral and more precisely reflects what can trigger the error. perl -i -pe 's/PSA_ERROR_TAMPERING_DETECTED/PSA_ERROR_CORRUPTION_DETECTED/gi' $(git ls-files)
2019-05-16 19:35:18 +00:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa: Simplify EC public key format Remove front matter from our EC key format, to make it just the contents of an ECPoint as defined by SEC1 section 2.3.3. As a consequence of the simplification, remove the restriction on not being able to use an ECDH key with ECDSA. There is no longer any OID specified when importing a key, so we can't reject importing of an ECDH key for the purpose of ECDSA based on the OID.
2019-01-10 11:42:27 +00:00
mbedtls_ecp_keypair *ecp = NULL;
Factor common code of psa_import_ec_{public,private}_key
2019-12-02 19:49:42 +00:00
status = psa_prepare_import_ec_key( curve, &ecp );
psa: Simplify EC public key format Remove front matter from our EC key format, to make it just the contents of an ECPoint as defined by SEC1 section 2.3.3. As a consequence of the simplification, remove the restriction on not being able to use an ECDH key with ECDSA. There is no longer any OID specified when importing a key, so we can't reject importing of an ECDH key for the purpose of ECDSA based on the OID.
2019-01-10 11:42:27 +00:00
if( status != PSA_SUCCESS )
goto exit;
Factor common code of psa_import_ec_{public,private}_key
2019-12-02 19:49:42 +00:00
psa: Simplify EC public key format Remove front matter from our EC key format, to make it just the contents of an ECPoint as defined by SEC1 section 2.3.3. As a consequence of the simplification, remove the restriction on not being able to use an ECDH key with ECDSA. There is no longer any OID specified when importing a key, so we can't reject importing of an ECDH key for the purpose of ECDSA based on the OID.
2019-01-10 11:42:27 +00:00
/* Load the public value. */
status = mbedtls_to_psa_error(
mbedtls_ecp_point_read_binary( &ecp->grp, &ecp->Q,
data, data_length ) );
if( status != PSA_SUCCESS )
goto exit;
/* Check that the point is on the curve. */
status = mbedtls_to_psa_error(
mbedtls_ecp_check_pubkey( &ecp->grp, &ecp->Q ) );
if( status != PSA_SUCCESS )
goto exit;
*p_ecp = ecp;
return( PSA_SUCCESS );
exit:
if( ecp != NULL )
psa_import_key: split RSA and ECP code into small functions No intended behavior change except that some edge cases may have swapped between INVALID_ARGUMENT and NOT_SUPPORTED.
2018-06-29 17:52:37 +00:00
{
psa: Simplify EC public key format Remove front matter from our EC key format, to make it just the contents of an ECPoint as defined by SEC1 section 2.3.3. As a consequence of the simplification, remove the restriction on not being able to use an ECDH key with ECDSA. There is no longer any OID specified when importing a key, so we can't reject importing of an ECDH key for the purpose of ECDSA based on the OID.
2019-01-10 11:42:27 +00:00
mbedtls_ecp_keypair_free( ecp );
mbedtls_free( ecp );
psa_import_key: split RSA and ECP code into small functions No intended behavior change except that some edge cases may have swapped between INVALID_ARGUMENT and NOT_SUPPORTED.
2018-06-29 17:52:37 +00:00
}
psa: Simplify EC public key format Remove front matter from our EC key format, to make it just the contents of an ECPoint as defined by SEC1 section 2.3.3. As a consequence of the simplification, remove the restriction on not being able to use an ECDH key with ECDSA. There is no longer any OID specified when importing a key, so we can't reject importing of an ECDH key for the purpose of ECDSA based on the OID.
2019-01-10 11:42:27 +00:00
return( status );
psa_import_key: split RSA and ECP code into small functions No intended behavior change except that some edge cases may have swapped between INVALID_ARGUMENT and NOT_SUPPORTED.
2018-06-29 17:52:37 +00:00
}
Private EC key format: change to raw secret value (doc, import) Change the import/export format of private elliptic curve keys from RFC 5915 to the raw secret value. This commit updates the format specification and the import code, but not the export code.
2018-10-29 18:24:33 +00:00
/* Import a private key given as a byte string which is the private value
* in big-endian order. */
static psa_status_t psa_import_ec_private_key( psa_ecc_curve_t curve,
const uint8_t *data,
size_t data_length,
mbedtls_ecp_keypair **p_ecp )
{
Rename PSA_ERROR_TAMPERING_DETECTED to ..._CORRUPTION_DETECTED “Tampering detected” was misleading because in the real world it can also arise due to a software bug. “Corruption detected” is neutral and more precisely reflects what can trigger the error. perl -i -pe 's/PSA_ERROR_TAMPERING_DETECTED/PSA_ERROR_CORRUPTION_DETECTED/gi' $(git ls-files)
2019-05-16 19:35:18 +00:00
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
Private EC key format: change to raw secret value (doc, import) Change the import/export format of private elliptic curve keys from RFC 5915 to the raw secret value. This commit updates the format specification and the import code, but not the export code.
2018-10-29 18:24:33 +00:00
mbedtls_ecp_keypair *ecp = NULL;
EC key pair import: check the buffer size When importing a private elliptic curve key, require the input to have exactly the right size. RFC 5915 requires the right size (you aren't allowed to omit leading zeros). A different buffer size likely means that something is wrong, e.g. a mismatch between the declared key type and the actual data.
2019-05-13 12:21:57 +00:00
if( PSA_BITS_TO_BYTES( PSA_ECC_CURVE_BITS( curve ) ) != data_length )
return( PSA_ERROR_INVALID_ARGUMENT );
Factor common code of psa_import_ec_{public,private}_key
2019-12-02 19:49:42 +00:00
status = psa_prepare_import_ec_key( curve, &ecp );
Private EC key format: change to raw secret value (doc, import) Change the import/export format of private elliptic curve keys from RFC 5915 to the raw secret value. This commit updates the format specification and the import code, but not the export code.
2018-10-29 18:24:33 +00:00
if( status != PSA_SUCCESS )
goto exit;
Factor common code of psa_import_ec_{public,private}_key
2019-12-02 19:49:42 +00:00
Private EC key format: change to raw secret value (doc, import) Change the import/export format of private elliptic curve keys from RFC 5915 to the raw secret value. This commit updates the format specification and the import code, but not the export code.
2018-10-29 18:24:33 +00:00
/* Load the secret value. */
status = mbedtls_to_psa_error(
mbedtls_mpi_read_binary( &ecp->d, data, data_length ) );
if( status != PSA_SUCCESS )
goto exit;
/* Validate the private key. */
status = mbedtls_to_psa_error(
mbedtls_ecp_check_privkey( &ecp->grp, &ecp->d ) );
if( status != PSA_SUCCESS )
goto exit;
/* Calculate the public key from the private key. */
status = mbedtls_to_psa_error(
mbedtls_ecp_mul( &ecp->grp, &ecp->Q, &ecp->d, &ecp->grp.G,
mbedtls_ctr_drbg_random, &global_data.ctr_drbg ) );
if( status != PSA_SUCCESS )
goto exit;
*p_ecp = ecp;
return( PSA_SUCCESS );
exit:
if( ecp != NULL )
{
mbedtls_ecp_keypair_free( ecp );
mbedtls_free( ecp );
}
return( status );
}
#endif /* defined(MBEDTLS_ECP_C) */
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 19:32:04 +00:00
/** Return the size of the key in the given slot, in bits.
*
* \param[in] slot A key slot.
*
* \return The key size in bits, read from the metadata in the slot.
*/
static inline size_t psa_get_key_slot_bits( const psa_key_slot_t *slot )
{
return( slot->attr.bits );
}
/** Calculate the size of the key in the given slot, in bits.
*
* \param[in] slot A key slot containing a transparent key.
*
* \return The key size in bits, calculated from the key data.
*/
Make psa_calculate_key_bits return psa_key_bits_t This is cleaner and solves a complaint from MSVC about truncation from size_t to psa_key_bits_t.
2019-07-31 16:55:00 +00:00
static psa_key_bits_t psa_calculate_key_bits( const psa_key_slot_t *slot )
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 19:32:04 +00:00
{
Make psa_calculate_key_bits return psa_key_bits_t This is cleaner and solves a complaint from MSVC about truncation from size_t to psa_key_bits_t.
2019-07-31 16:55:00 +00:00
size_t bits = 0; /* return 0 on an empty slot */
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 19:32:04 +00:00
if( key_type_is_raw_bytes( slot->attr.type ) )
Make psa_calculate_key_bits return psa_key_bits_t This is cleaner and solves a complaint from MSVC about truncation from size_t to psa_key_bits_t.
2019-07-31 16:55:00 +00:00
bits = PSA_BYTES_TO_BITS( slot->data.raw.bytes );
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 19:32:04 +00:00
#if defined(MBEDTLS_RSA_C)
Make psa_calculate_key_bits return psa_key_bits_t This is cleaner and solves a complaint from MSVC about truncation from size_t to psa_key_bits_t.
2019-07-31 16:55:00 +00:00
else if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
bits = PSA_BYTES_TO_BITS( mbedtls_rsa_get_len( slot->data.rsa ) );
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 19:32:04 +00:00
#endif /* defined(MBEDTLS_RSA_C) */
#if defined(MBEDTLS_ECP_C)
Make psa_calculate_key_bits return psa_key_bits_t This is cleaner and solves a complaint from MSVC about truncation from size_t to psa_key_bits_t.
2019-07-31 16:55:00 +00:00
else if( PSA_KEY_TYPE_IS_ECC( slot->attr.type ) )
bits = slot->data.ecp->grp.pbits;
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 19:32:04 +00:00
#endif /* defined(MBEDTLS_ECP_C) */
Make psa_calculate_key_bits return psa_key_bits_t This is cleaner and solves a complaint from MSVC about truncation from size_t to psa_key_bits_t.
2019-07-31 16:55:00 +00:00
/* We know that the size fits in psa_key_bits_t thanks to checks
* when the key was created. */
return( (psa_key_bits_t) bits );
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 19:32:04 +00:00
}
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
/** Import key data into a slot. `slot->attr.type` must have been set
Factor the common idiom psa_wipe_key_slot into a function Many places in the code called psa_remove_key_data_from_memory (which preserves metadata for the sake of failues in psa_import_key) followed by clearing the slot data. Use an auxiliary function for this.
2018-12-03 10:58:46 +00:00
* previously. This function assumes that the slot does not contain
* any key material yet. On failure, the slot content is unchanged. */
Move more slot management functions to the proper module Move psa_load_persistent_key_into_slot, psa_internal_make_key_persistent and psa_internal_release_key_slot to the slot management module. Expose psa_import_key_into_slot from the core. After this commit, there are no longer any functions declared in psa_crypto_slot_management.h and defined in psa_crypto.c. There are still function calls in both directions between psa_crypto.c and psa_crypto_slot_management.c.
2018-12-10 15:48:53 +00:00
psa_status_t psa_import_key_into_slot( psa_key_slot_t *slot,
const uint8_t *data,
size_t data_length )
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
{
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 15:01:38 +00:00
psa_status_t status = PSA_SUCCESS;
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( key_type_is_raw_bytes( slot->attr.type ) )
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
{
Limit keys to 65528 bits 65528 bits is more than any reasonable key until we start supporting post-quantum cryptography. This limit is chosen to allow bit-sizes to be stored in 16 bits, with 65535 left to indicate an invalid value. It's a whole number of bytes, which facilitates some calculations, in particular allowing a key of exactly PSA_CRYPTO_MAX_STORAGE_SIZE to be created but not one bit more. As a resource usage limit, this is arguably too large, but that's out of scope of the current commit. Test that key import, generation and derivation reject overly large sizes.
2019-07-30 15:26:54 +00:00
size_t bit_size = PSA_BYTES_TO_BITS( data_length );
Correct some comments
2019-08-07 08:59:45 +00:00
/* Ensure that the bytes-to-bit conversion didn't overflow. */
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
if( data_length > SIZE_MAX / 8 )
return( PSA_ERROR_NOT_SUPPORTED );
Correct some comments
2019-08-07 08:59:45 +00:00
/* Enforce a size limit, and in particular ensure that the bit
* size fits in its representation type. */
Limit keys to 65528 bits 65528 bits is more than any reasonable key until we start supporting post-quantum cryptography. This limit is chosen to allow bit-sizes to be stored in 16 bits, with 65535 left to indicate an invalid value. It's a whole number of bytes, which facilitates some calculations, in particular allowing a key of exactly PSA_CRYPTO_MAX_STORAGE_SIZE to be created but not one bit more. As a resource usage limit, this is arguably too large, but that's out of scope of the current commit. Test that key import, generation and derivation reject overly large sizes.
2019-07-30 15:26:54 +00:00
if( bit_size > PSA_MAX_KEY_BITS )
return( PSA_ERROR_NOT_SUPPORTED );
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
status = prepare_raw_data_slot( slot->attr.type, bit_size,
psa_import_key: validate symmetric key size When importing a symmetric key, validate that the key size is valid for the given key type. Non-supported key types may no longer be imported.
2018-06-19 19:31:50 +00:00
&slot->data.raw );
if( status != PSA_SUCCESS )
return( status );
Handle null pointers safely when used as buffers of size 0 When the size of a buffer is 0, the corresponding pointer argument may be null. In such cases, library functions must not perform arithmetic on the pointer or call standard library functions such as memset and memcpy, since that would be undefined behavior in C. Protect such cases. Refactor the storage of a 0-sized raw data object to make it store a null pointer, rather than depending on the behavior of calloc(1,0).
2018-06-28 17:31:31 +00:00
if( data_length != 0 )
memcpy( slot->data.raw.data, data, data_length );
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
}
else
Private EC key format: change to raw secret value (doc, import) Change the import/export format of private elliptic curve keys from RFC 5915 to the raw secret value. This commit updates the format specification and the import code, but not the export code.
2018-10-29 18:24:33 +00:00
#if defined(MBEDTLS_ECP_C)
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( PSA_KEY_TYPE_IS_ECC_KEY_PAIR( slot->attr.type ) )
Private EC key format: change to raw secret value (doc, import) Change the import/export format of private elliptic curve keys from RFC 5915 to the raw secret value. This commit updates the format specification and the import code, but not the export code.
2018-10-29 18:24:33 +00:00
{
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
status = psa_import_ec_private_key( PSA_KEY_TYPE_GET_CURVE( slot->attr.type ),
Private EC key format: change to raw secret value (doc, import) Change the import/export format of private elliptic curve keys from RFC 5915 to the raw secret value. This commit updates the format specification and the import code, but not the export code.
2018-10-29 18:24:33 +00:00
data, data_length,
&slot->data.ecp );
}
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
else if( PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY( slot->attr.type ) )
psa: Simplify EC public key format Remove front matter from our EC key format, to make it just the contents of an ECPoint as defined by SEC1 section 2.3.3. As a consequence of the simplification, remove the restriction on not being able to use an ECDH key with ECDSA. There is no longer any OID specified when importing a key, so we can't reject importing of an ECDH key for the purpose of ECDSA based on the OID.
2019-01-10 11:42:27 +00:00
{
status = psa_import_ec_public_key(
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
PSA_KEY_TYPE_GET_CURVE( slot->attr.type ),
psa: Simplify EC public key format Remove front matter from our EC key format, to make it just the contents of an ECPoint as defined by SEC1 section 2.3.3. As a consequence of the simplification, remove the restriction on not being able to use an ECDH key with ECDSA. There is no longer any OID specified when importing a key, so we can't reject importing of an ECDH key for the purpose of ECDSA based on the OID.
2019-01-10 11:42:27 +00:00
data, data_length,
&slot->data.ecp );
Private EC key format: change to raw secret value (doc, import) Change the import/export format of private elliptic curve keys from RFC 5915 to the raw secret value. This commit updates the format specification and the import code, but not the export code.
2018-10-29 18:24:33 +00:00
}
else
#endif /* MBEDTLS_ECP_C */
psa: Simplify EC public key format Remove front matter from our EC key format, to make it just the contents of an ECPoint as defined by SEC1 section 2.3.3. As a consequence of the simplification, remove the restriction on not being able to use an ECDH key with ECDSA. There is no longer any OID specified when importing a key, so we can't reject importing of an ECDH key for the purpose of ECDSA based on the OID.
2019-01-10 11:42:27 +00:00
#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PK_PARSE_C)
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
{
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
status = psa_import_rsa_key( slot->attr.type,
psa: Refactor psa_import_rsa_key() pk-using code Move pk-using code to inside psa_import_rsa_key(). This aligns the shape of psa_import_rsa_key() to match that of psa_import_ec_private_key() and psa_import_ec_public_key().
2019-01-11 17:53:05 +00:00
data, data_length,
&slot->data.rsa );
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
}
else
psa: Simplify EC public key format Remove front matter from our EC key format, to make it just the contents of an ECPoint as defined by SEC1 section 2.3.3. As a consequence of the simplification, remove the restriction on not being able to use an ECDH key with ECDSA. There is no longer any OID specified when importing a key, so we can't reject importing of an ECDH key for the purpose of ECDSA based on the OID.
2019-01-10 11:42:27 +00:00
#endif /* defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PK_PARSE_C) */
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
{
return( PSA_ERROR_NOT_SUPPORTED );
}
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 10:21:11 +00:00
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 19:32:04 +00:00
if( status == PSA_SUCCESS )
{
/* Write the actual key size to the slot.
* psa_start_key_creation() wrote the size declared by the
* caller, which may be 0 (meaning unspecified) or wrong. */
slot->attr.bits = psa_calculate_key_bits( slot );
}
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 10:21:11 +00:00
return( status );
}
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
/** Calculate the intersection of two algorithm usage policies.
*
* Return 0 (which allows no operation) on incompatibility.
*/
static psa_algorithm_t psa_key_policy_algorithm_intersection(
psa_algorithm_t alg1,
psa_algorithm_t alg2 )
{
Minor documentation improvements
2019-05-22 09:45:59 +00:00
/* Common case: both sides actually specify the same policy. */
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
if( alg1 == alg2 )
return( alg1 );
/* If the policies are from the same hash-and-sign family, check
* if one is a wildcard. If so the other has the specific algorithm. */
if( PSA_ALG_IS_HASH_AND_SIGN( alg1 ) &&
PSA_ALG_IS_HASH_AND_SIGN( alg2 ) &&
( alg1 & ~PSA_ALG_HASH_MASK ) == ( alg2 & ~PSA_ALG_HASH_MASK ) )
{
if( PSA_ALG_SIGN_GET_HASH( alg1 ) == PSA_ALG_ANY_HASH )
return( alg2 );
if( PSA_ALG_SIGN_GET_HASH( alg2 ) == PSA_ALG_ANY_HASH )
return( alg1 );
}
/* If the policies are incompatible, allow nothing. */
return( 0 );
}
Keys may allow a second algorithm Add a second permitted algorithm to key policies. This commit includes smoke tests that do not cover psa_copy_key.
2019-05-10 17:33:38 +00:00
static int psa_key_algorithm_permits( psa_algorithm_t policy_alg,
psa_algorithm_t requested_alg )
Add a hash wildcard value for hash-and-sign algorithm You can use PSA_ALG_ANY_HASH to build the algorithm value for a hash-and-sign algorithm in a policy. Then the policy allows usage with this hash-and-sign family with any hash. Test that PSA_ALG_ANY_HASH-based policies allow a specific hash, but not a different hash-and-sign family. Test that PSA_ALG_ANY_HASH is not valid for operations, only in policies.
2019-01-14 15:06:39 +00:00
{
Minor documentation improvements
2019-05-22 09:45:59 +00:00
/* Common case: the policy only allows requested_alg. */
Keys may allow a second algorithm Add a second permitted algorithm to key policies. This commit includes smoke tests that do not cover psa_copy_key.
2019-05-10 17:33:38 +00:00
if( requested_alg == policy_alg )
Add a hash wildcard value for hash-and-sign algorithm You can use PSA_ALG_ANY_HASH to build the algorithm value for a hash-and-sign algorithm in a policy. Then the policy allows usage with this hash-and-sign family with any hash. Test that PSA_ALG_ANY_HASH-based policies allow a specific hash, but not a different hash-and-sign family. Test that PSA_ALG_ANY_HASH is not valid for operations, only in policies.
2019-01-14 15:06:39 +00:00
return( 1 );
Keys may allow a second algorithm Add a second permitted algorithm to key policies. This commit includes smoke tests that do not cover psa_copy_key.
2019-05-10 17:33:38 +00:00
/* If policy_alg is a hash-and-sign with a wildcard for the hash,
Minor documentation improvements
2019-05-22 09:45:59 +00:00
* and requested_alg is the same hash-and-sign family with any hash,
* then requested_alg is compliant with policy_alg. */
Keys may allow a second algorithm Add a second permitted algorithm to key policies. This commit includes smoke tests that do not cover psa_copy_key.
2019-05-10 17:33:38 +00:00
if( PSA_ALG_IS_HASH_AND_SIGN( requested_alg ) &&
PSA_ALG_SIGN_GET_HASH( policy_alg ) == PSA_ALG_ANY_HASH )
Add a hash wildcard value for hash-and-sign algorithm You can use PSA_ALG_ANY_HASH to build the algorithm value for a hash-and-sign algorithm in a policy. Then the policy allows usage with this hash-and-sign family with any hash. Test that PSA_ALG_ANY_HASH-based policies allow a specific hash, but not a different hash-and-sign family. Test that PSA_ALG_ANY_HASH is not valid for operations, only in policies.
2019-01-14 15:06:39 +00:00
{
Keys may allow a second algorithm Add a second permitted algorithm to key policies. This commit includes smoke tests that do not cover psa_copy_key.
2019-05-10 17:33:38 +00:00
return( ( policy_alg & ~PSA_ALG_HASH_MASK ) ==
( requested_alg & ~PSA_ALG_HASH_MASK ) );
Add a hash wildcard value for hash-and-sign algorithm You can use PSA_ALG_ANY_HASH to build the algorithm value for a hash-and-sign algorithm in a policy. Then the policy allows usage with this hash-and-sign family with any hash. Test that PSA_ALG_ANY_HASH-based policies allow a specific hash, but not a different hash-and-sign family. Test that PSA_ALG_ANY_HASH is not valid for operations, only in policies.
2019-01-14 15:06:39 +00:00
}
/* If it isn't permitted, it's forbidden. */
return( 0 );
}
Keys may allow a second algorithm Add a second permitted algorithm to key policies. This commit includes smoke tests that do not cover psa_copy_key.
2019-05-10 17:33:38 +00:00
/** Test whether a policy permits an algorithm.
*
* The caller must test usage flags separately.
*/
static int psa_key_policy_permits( const psa_key_policy_t *policy,
psa_algorithm_t alg )
{
return( psa_key_algorithm_permits( policy->alg, alg ) ||
psa_key_algorithm_permits( policy->alg2, alg ) );
}
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
/** Restrict a key policy based on a constraint.
*
* \param[in,out] policy The policy to restrict.
* \param[in] constraint The policy constraint to apply.
*
* \retval #PSA_SUCCESS
* \c *policy contains the intersection of the original value of
* \c *policy and \c *constraint.
* \retval #PSA_ERROR_INVALID_ARGUMENT
* \c *policy and \c *constraint are incompatible.
* \c *policy is unchanged.
*/
static psa_status_t psa_restrict_key_policy(
psa_key_policy_t *policy,
const psa_key_policy_t *constraint )
{
psa_algorithm_t intersection_alg =
psa_key_policy_algorithm_intersection( policy->alg, constraint->alg );
Keys may allow a second algorithm Add a second permitted algorithm to key policies. This commit includes smoke tests that do not cover psa_copy_key.
2019-05-10 17:33:38 +00:00
psa_algorithm_t intersection_alg2 =
psa_key_policy_algorithm_intersection( policy->alg2, constraint->alg2 );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
if( intersection_alg == 0 && policy->alg != 0 && constraint->alg != 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
Keys may allow a second algorithm Add a second permitted algorithm to key policies. This commit includes smoke tests that do not cover psa_copy_key.
2019-05-10 17:33:38 +00:00
if( intersection_alg2 == 0 && policy->alg2 != 0 && constraint->alg2 != 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
policy->usage &= constraint->usage;
policy->alg = intersection_alg;
Keys may allow a second algorithm Add a second permitted algorithm to key policies. This commit includes smoke tests that do not cover psa_copy_key.
2019-05-10 17:33:38 +00:00
policy->alg2 = intersection_alg2;
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
return( PSA_SUCCESS );
}
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 10:21:11 +00:00
/** Retrieve a slot which must contain a key. The key must have allow all the
* usage flags set in \p usage. If \p alg is nonzero, the key must allow
* operations with this algorithm. */
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 17:08:14 +00:00
static psa_status_t psa_get_key_from_slot( psa_key_handle_t handle,
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 16:12:32 +00:00
psa_key_slot_t **p_slot,
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 10:21:11 +00:00
psa_key_usage_t usage,
psa_algorithm_t alg )
{
psa_status_t status;
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 16:12:32 +00:00
psa_key_slot_t *slot = NULL;
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 10:21:11 +00:00
*p_slot = NULL;
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 17:08:14 +00:00
status = psa_get_key_slot( handle, &slot );
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 10:21:11 +00:00
if( status != PSA_SUCCESS )
return( status );
/* Enforce that usage policy for the key slot contains all the flags
* required by the usage parameter. There is one exception: public
* keys can always be exported, so we treat public key objects as
* if they had the export flag. */
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->attr.type ) )
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 10:21:11 +00:00
usage &= ~PSA_KEY_USAGE_EXPORT;
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( ( slot->attr.policy.usage & usage ) != usage )
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 10:21:11 +00:00
return( PSA_ERROR_NOT_PERMITTED );
Add a hash wildcard value for hash-and-sign algorithm You can use PSA_ALG_ANY_HASH to build the algorithm value for a hash-and-sign algorithm in a policy. Then the policy allows usage with this hash-and-sign family with any hash. Test that PSA_ALG_ANY_HASH-based policies allow a specific hash, but not a different hash-and-sign family. Test that PSA_ALG_ANY_HASH is not valid for operations, only in policies.
2019-01-14 15:06:39 +00:00
/* Enforce that the usage policy permits the requested algortihm. */
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( alg != 0 && ! psa_key_policy_permits( &slot->attr.policy, alg ) )
psa: Move get_key_slot functions Move the psa_get_key_slot and related static functions as they will need to call psa_import_key_into_slot() for persistent keys.
2018-07-16 10:21:11 +00:00
return( PSA_ERROR_NOT_PERMITTED );
*p_slot = slot;
return( PSA_SUCCESS );
}
psa: Refactor psa_import_key() Create a new function psa_import_key_into_slot() from psa_import_key(). This is common functionality that will be used both when importing a key and loading a key from persistent storage.
2018-07-13 12:18:51 +00:00
SE keys: ensure that functions that lack support properly error out Introduce a new function psa_get_transparent_key which returns NOT_SUPPORTED if the key is in a secure element. Use this function in functions that don't support keys in a secure element. After this commit, all functions that access a key slot directly via psa_get_key_slot or psa_get_key_from_slot rather than via psa_get_transparent_key have at least enough support for secure elements not to crash or otherwise cause undefined behavior. Lesser bad behavior such as wrong results or resource leakage is still possible in error cases.
2019-07-24 11:30:31 +00:00
/** Retrieve a slot which must contain a transparent key.
*
* A transparent key is a key for which the key material is directly
* available, as opposed to a key in a secure element.
*
Improve comments
2019-07-25 09:32:45 +00:00
* This is a temporary function to use instead of psa_get_key_from_slot()
* until secure element support is fully implemented.
SE keys: ensure that functions that lack support properly error out Introduce a new function psa_get_transparent_key which returns NOT_SUPPORTED if the key is in a secure element. Use this function in functions that don't support keys in a secure element. After this commit, all functions that access a key slot directly via psa_get_key_slot or psa_get_key_from_slot rather than via psa_get_transparent_key have at least enough support for secure elements not to crash or otherwise cause undefined behavior. Lesser bad behavior such as wrong results or resource leakage is still possible in error cases.
2019-07-24 11:30:31 +00:00
*/
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
static psa_status_t psa_get_transparent_key( psa_key_handle_t handle,
psa_key_slot_t **p_slot,
psa_key_usage_t usage,
psa_algorithm_t alg )
{
psa_status_t status = psa_get_key_from_slot( handle, p_slot, usage, alg );
if( status != PSA_SUCCESS )
return( status );
psa_key_slot_is_external exists. Use it.
2019-07-25 09:31:23 +00:00
if( psa_key_slot_is_external( *p_slot ) )
SE keys: ensure that functions that lack support properly error out Introduce a new function psa_get_transparent_key which returns NOT_SUPPORTED if the key is in a secure element. Use this function in functions that don't support keys in a secure element. After this commit, all functions that access a key slot directly via psa_get_key_slot or psa_get_key_from_slot rather than via psa_get_transparent_key have at least enough support for secure elements not to crash or otherwise cause undefined behavior. Lesser bad behavior such as wrong results or resource leakage is still possible in error cases.
2019-07-24 11:30:31 +00:00
{
*p_slot = NULL;
return( PSA_ERROR_NOT_SUPPORTED );
}
return( PSA_SUCCESS );
}
#else /* MBEDTLS_PSA_CRYPTO_SE_C */
/* With no secure element support, all keys are transparent. */
#define psa_get_transparent_key( handle, p_slot, usage, alg ) \
psa_get_key_from_slot( handle, p_slot, usage, alg )
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Factor the common idiom psa_wipe_key_slot into a function Many places in the code called psa_remove_key_data_from_memory (which preserves metadata for the sake of failues in psa_import_key) followed by clearing the slot data. Use an auxiliary function for this.
2018-12-03 10:58:46 +00:00
/** Wipe key data from a slot. Preserve metadata such as the policy. */
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 16:12:32 +00:00
static psa_status_t psa_remove_key_data_from_memory( psa_key_slot_t *slot )
psa: Refactor psa_import_key() Create a new function psa_import_key_into_slot() from psa_import_key(). This is common functionality that will be used both when importing a key and loading a key from persistent storage.
2018-07-13 12:18:51 +00:00
{
SE keys: store the slot number in the memory slot
2019-07-12 21:44:37 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
if( psa_key_slot_is_external( slot ) )
{
/* No key material to clean. */
}
else
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( slot->attr.type == PSA_KEY_TYPE_NONE )
psa_destroy_key: return SUCCESS on an empty slot Do wipe the slot even if it doesn't contain a key, to erase any metadata.
2018-04-19 06:38:16 +00:00
{
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 14:48:15 +00:00
/* No key material to clean. */
psa_destroy_key: return SUCCESS on an empty slot Do wipe the slot even if it doesn't contain a key, to erase any metadata.
2018-04-19 06:38:16 +00:00
}
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
else if( key_type_is_raw_bytes( slot->attr.type ) )
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
{
mbedtls_free( slot->data.raw.data );
}
else
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 17:16:59 +00:00
#if defined(MBEDTLS_RSA_C)
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 17:16:59 +00:00
{
mbedtls_rsa_free( slot->data.rsa );
Fix memory leak in psa_destroy_key
2018-03-07 15:42:44 +00:00
mbedtls_free( slot->data.rsa );
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 17:16:59 +00:00
}
else
#endif /* defined(MBEDTLS_RSA_C) */
#if defined(MBEDTLS_ECP_C)
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( PSA_KEY_TYPE_IS_ECC( slot->attr.type ) )
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
{
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 17:16:59 +00:00
mbedtls_ecp_keypair_free( slot->data.ecp );
Fix memory leak in psa_destroy_key
2018-03-07 15:42:44 +00:00
mbedtls_free( slot->data.ecp );
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
}
else
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 17:16:59 +00:00
#endif /* defined(MBEDTLS_ECP_C) */
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
{
/* Shouldn't happen: the key type is not any type that we
Add some comments to document some non-obvious coding choices
2018-03-07 15:41:37 +00:00
* put in. */
Rename PSA_ERROR_TAMPERING_DETECTED to ..._CORRUPTION_DETECTED “Tampering detected” was misleading because in the real world it can also arise due to a software bug. “Corruption detected” is neutral and more precisely reflects what can trigger the error. perl -i -pe 's/PSA_ERROR_TAMPERING_DETECTED/PSA_ERROR_CORRUPTION_DETECTED/gi' $(git ls-files)
2019-05-16 19:35:18 +00:00
return( PSA_ERROR_CORRUPTION_DETECTED );
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
}
return( PSA_SUCCESS );
}
Factor the common idiom psa_wipe_key_slot into a function Many places in the code called psa_remove_key_data_from_memory (which preserves metadata for the sake of failues in psa_import_key) followed by clearing the slot data. Use an auxiliary function for this.
2018-12-03 10:58:46 +00:00
/** Completely wipe a slot in memory, including its policy.
* Persistent storage is not affected. */
Move the key slot array to the slot management module Move the key slot array and its initialization and wiping to the slot management module. Also move the lowest-level key slot access function psa_get_key_slot and the auxiliary function for slot allocation psa_internal_allocate_key_slot to the slot management module.
2018-12-10 15:29:04 +00:00
psa_status_t psa_wipe_key_slot( psa_key_slot_t *slot )
Factor the common idiom psa_wipe_key_slot into a function Many places in the code called psa_remove_key_data_from_memory (which preserves metadata for the sake of failues in psa_import_key) followed by clearing the slot data. Use an auxiliary function for this.
2018-12-03 10:58:46 +00:00
{
psa_status_t status = psa_remove_key_data_from_memory( slot );
Document better what wiping a key slot does not do When a key slot is wiped, a copy of the key material may remain in operations. This is undesirable, but does not violate the safety of the code. Tracked in https://github.com/ARMmbed/mbed-crypto/issues/86
2019-08-13 13:01:08 +00:00
/* Multipart operations may still be using the key. This is safe
* because all multipart operation objects are independent from
* the key slot: if they need to access the key after the setup
* phase, they have a copy of the key. Note that this means that
* key material can linger until all operations are completed. */
Factor the common idiom psa_wipe_key_slot into a function Many places in the code called psa_remove_key_data_from_memory (which preserves metadata for the sake of failues in psa_import_key) followed by clearing the slot data. Use an auxiliary function for this.
2018-12-03 10:58:46 +00:00
/* At this point, key material and other type-specific content has
* been wiped. Clear remaining metadata. We can call memset and not
* zeroize because the metadata is not particularly sensitive. */
memset( slot, 0, sizeof( *slot ) );
return( status );
}
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 17:08:14 +00:00
psa_status_t psa_destroy_key( psa_key_handle_t handle )
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 14:48:15 +00:00
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 16:12:32 +00:00
psa_key_slot_t *slot;
Clean up status code handling inside psa_destroy_key Adopt a simple method for tracking whether there was a failure: each fallible operation sets overall_status, unless overall_status is already non-successful. Thus in case of multiple failures, the function always reports whatever failed first. This may not always be the right thing, but it's simple. This revealed a bug whereby if the only failure was the call to psa_destroy_se_key(), i.e. if the driver reported a failure or if the driver lacked support for destroying keys, psa_destroy_key() would ignore that failure. For a key in a secure element, if creating a transaction file fails, don't touch storage, but close the key in memory. This may not be right, but it's no wronger than it was before. Tracked in https://github.com/ARMmbed/mbed-crypto/issues/215
2019-08-13 13:58:36 +00:00
psa_status_t status; /* status of the last operation */
psa_status_t overall_status = PSA_SUCCESS;
SE keys: support destroy When destroying a key in a secure element, call the driver's destroy method and update the driver's persistent data in storage.
2019-07-12 21:46:38 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
psa_se_drv_table_entry_t *driver;
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 14:48:15 +00:00
Make psa_close_key(0) and psa_destroy_key(0) succeed
2019-10-08 13:48:25 +00:00
if( handle == 0 )
return( PSA_SUCCESS );
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 17:08:14 +00:00
status = psa_get_key_slot( handle, &slot );
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 14:48:15 +00:00
if( status != PSA_SUCCESS )
return( status );
SE keys: support destroy When destroying a key in a secure element, call the driver's destroy method and update the driver's persistent data in storage.
2019-07-12 21:46:38 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
driver = psa_get_se_driver_entry( slot->attr.lifetime );
SE keys: support destroy When destroying a key in a secure element, call the driver's destroy method and update the driver's persistent data in storage.
2019-07-12 21:46:38 +00:00
if( driver != NULL )
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 17:30:34 +00:00
{
Improve comments
2019-07-25 09:32:45 +00:00
/* For a key in a secure element, we need to do three things:
* remove the key file in internal storage, destroy the
* key inside the secure element, and update the driver's
* persistent data. Start a transaction that will encompass these
* three actions. */
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 17:30:34 +00:00
psa_crypto_prepare_transaction( PSA_CRYPTO_TRANSACTION_DESTROY_KEY );
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 17:30:34 +00:00
psa_crypto_transaction.key.slot = slot->data.se.slot_number;
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
psa_crypto_transaction.key.id = slot->attr.id;
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 17:30:34 +00:00
status = psa_crypto_save_transaction( );
if( status != PSA_SUCCESS )
{
If starting a transaction fails, wipe the transaction data Nothing has been saved to disk yet, but there is stale data in psa_crypto_transaction. This stale data should not be reused, but do wipe it to reduce the risk of it mattering somehow in the future.
2019-07-25 16:02:52 +00:00
(void) psa_crypto_stop_transaction( );
Clean up status code handling inside psa_destroy_key Adopt a simple method for tracking whether there was a failure: each fallible operation sets overall_status, unless overall_status is already non-successful. Thus in case of multiple failures, the function always reports whatever failed first. This may not always be the right thing, but it's simple. This revealed a bug whereby if the only failure was the call to psa_destroy_se_key(), i.e. if the driver reported a failure or if the driver lacked support for destroying keys, psa_destroy_key() would ignore that failure. For a key in a secure element, if creating a transaction file fails, don't touch storage, but close the key in memory. This may not be right, but it's no wronger than it was before. Tracked in https://github.com/ARMmbed/mbed-crypto/issues/215
2019-08-13 13:58:36 +00:00
/* We should still try to destroy the key in the secure
* element and the key metadata in storage. This is especially
* important if the error is that the storage is full.
* But how to do it exactly without risking an inconsistent
* state after a reset?
* https://github.com/ARMmbed/mbed-crypto/issues/215
*/
overall_status = status;
goto exit;
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 17:30:34 +00:00
}
SE keys: support destroy When destroying a key in a secure element, call the driver's destroy method and update the driver's persistent data in storage.
2019-07-12 21:46:38 +00:00
status = psa_destroy_se_key( driver, slot->data.se.slot_number );
Clean up status code handling inside psa_destroy_key Adopt a simple method for tracking whether there was a failure: each fallible operation sets overall_status, unless overall_status is already non-successful. Thus in case of multiple failures, the function always reports whatever failed first. This may not always be the right thing, but it's simple. This revealed a bug whereby if the only failure was the call to psa_destroy_se_key(), i.e. if the driver reported a failure or if the driver lacked support for destroying keys, psa_destroy_key() would ignore that failure. For a key in a secure element, if creating a transaction file fails, don't touch storage, but close the key in memory. This may not be right, but it's no wronger than it was before. Tracked in https://github.com/ARMmbed/mbed-crypto/issues/215
2019-08-13 13:58:36 +00:00
if( overall_status == PSA_SUCCESS )
overall_status = status;
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 17:30:34 +00:00
}
SE keys: support destroy When destroying a key in a secure element, call the driver's destroy method and update the driver's persistent data in storage.
2019-07-12 21:46:38 +00:00
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 14:48:15 +00:00
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 16:27:26 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
SE keys: make psa_destroy_key remove the key from storage
2019-08-13 13:11:49 +00:00
if( slot->attr.lifetime != PSA_KEY_LIFETIME_VOLATILE )
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 14:48:15 +00:00
{
Clean up status code handling inside psa_destroy_key Adopt a simple method for tracking whether there was a failure: each fallible operation sets overall_status, unless overall_status is already non-successful. Thus in case of multiple failures, the function always reports whatever failed first. This may not always be the right thing, but it's simple. This revealed a bug whereby if the only failure was the call to psa_destroy_se_key(), i.e. if the driver reported a failure or if the driver lacked support for destroying keys, psa_destroy_key() would ignore that failure. For a key in a secure element, if creating a transaction file fails, don't touch storage, but close the key in memory. This may not be right, but it's no wronger than it was before. Tracked in https://github.com/ARMmbed/mbed-crypto/issues/215
2019-08-13 13:58:36 +00:00
status = psa_destroy_persistent_key( slot->attr.id );
if( overall_status == PSA_SUCCESS )
overall_status = status;
Note about destroying a key with other open handles https://github.com/ARMmbed/mbed-crypto/issues/214
2019-08-13 13:14:20 +00:00
/* TODO: other slots may have a copy of the same key. We should
* invalidate them.
* https://github.com/ARMmbed/mbed-crypto/issues/214
*/
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 14:48:15 +00:00
}
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 16:27:26 +00:00
#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 14:48:15 +00:00
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 17:30:34 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
if( driver != NULL )
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 16:27:26 +00:00
{
Bug fix: save the driver's persistent data in destroy_key
2019-07-25 09:31:48 +00:00
status = psa_save_se_persistent_data( driver );
Clean up status code handling inside psa_destroy_key Adopt a simple method for tracking whether there was a failure: each fallible operation sets overall_status, unless overall_status is already non-successful. Thus in case of multiple failures, the function always reports whatever failed first. This may not always be the right thing, but it's simple. This revealed a bug whereby if the only failure was the call to psa_destroy_se_key(), i.e. if the driver reported a failure or if the driver lacked support for destroying keys, psa_destroy_key() would ignore that failure. For a key in a secure element, if creating a transaction file fails, don't touch storage, but close the key in memory. This may not be right, but it's no wronger than it was before. Tracked in https://github.com/ARMmbed/mbed-crypto/issues/215
2019-08-13 13:58:36 +00:00
if( overall_status == PSA_SUCCESS )
overall_status = status;
status = psa_crypto_stop_transaction( );
if( overall_status == PSA_SUCCESS )
overall_status = status;
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 16:27:26 +00:00
}
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 17:30:34 +00:00
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 16:27:26 +00:00
Clean up status code handling inside psa_destroy_key Adopt a simple method for tracking whether there was a failure: each fallible operation sets overall_status, unless overall_status is already non-successful. Thus in case of multiple failures, the function always reports whatever failed first. This may not always be the right thing, but it's simple. This revealed a bug whereby if the only failure was the call to psa_destroy_se_key(), i.e. if the driver reported a failure or if the driver lacked support for destroying keys, psa_destroy_key() would ignore that failure. For a key in a secure element, if creating a transaction file fails, don't touch storage, but close the key in memory. This may not be right, but it's no wronger than it was before. Tracked in https://github.com/ARMmbed/mbed-crypto/issues/215
2019-08-13 13:58:36 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
exit:
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Factor the common idiom psa_wipe_key_slot into a function Many places in the code called psa_remove_key_data_from_memory (which preserves metadata for the sake of failues in psa_import_key) followed by clearing the slot data. Use an auxiliary function for this.
2018-12-03 10:58:46 +00:00
status = psa_wipe_key_slot( slot );
Clean up status code handling inside psa_destroy_key Adopt a simple method for tracking whether there was a failure: each fallible operation sets overall_status, unless overall_status is already non-successful. Thus in case of multiple failures, the function always reports whatever failed first. This may not always be the right thing, but it's simple. This revealed a bug whereby if the only failure was the call to psa_destroy_se_key(), i.e. if the driver reported a failure or if the driver lacked support for destroying keys, psa_destroy_key() would ignore that failure. For a key in a secure element, if creating a transaction file fails, don't touch storage, but close the key in memory. This may not be right, but it's no wronger than it was before. Tracked in https://github.com/ARMmbed/mbed-crypto/issues/215
2019-08-13 13:58:36 +00:00
/* Prioritize CORRUPTION_DETECTED from wiping over a storage error */
if( overall_status == PSA_SUCCESS )
overall_status = status;
return( overall_status );
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 14:48:15 +00:00
}
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 19:44:46 +00:00
void psa_reset_key_attributes( psa_key_attributes_t *attributes )
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 14:48:15 +00:00
{
Switch psa_{get,set}_domain_parameters to attributes Change psa_get_domain_parameters() and psa_set_domain_parameters() to access a psa_key_attributes_t structure rather than a key handle. In psa_get_key_attributes(), treat the RSA public exponent as a domain parameter and read it out. This is in preparation for removing the `extra` parameter of psa_generate_key() and setting the RSA public exponent for key generation via domain parameters. In this commit, the default public exponent 65537 is not treated specially, which allows us to verify that test code that should be calling psa_reset_key_attributes() after retrieving the attributes of an RSA key is doing so properly (if it wasn't, there would be a memory leak), even if the test data happens to use an RSA key with the default public exponent.
2019-04-26 14:06:02 +00:00
mbedtls_free( attributes->domain_parameters );
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 19:44:46 +00:00
memset( attributes, 0, sizeof( *attributes ) );
}
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 14:48:15 +00:00
Switch psa_{get,set}_domain_parameters to attributes Change psa_get_domain_parameters() and psa_set_domain_parameters() to access a psa_key_attributes_t structure rather than a key handle. In psa_get_key_attributes(), treat the RSA public exponent as a domain parameter and read it out. This is in preparation for removing the `extra` parameter of psa_generate_key() and setting the RSA public exponent for key generation via domain parameters. In this commit, the default public exponent 65537 is not treated specially, which allows us to verify that test code that should be calling psa_reset_key_attributes() after retrieving the attributes of an RSA key is doing so properly (if it wasn't, there would be a memory leak), even if the test data happens to use an RSA key with the default public exponent.
2019-04-26 14:06:02 +00:00
psa_status_t psa_set_key_domain_parameters( psa_key_attributes_t *attributes,
psa_key_type_t type,
const uint8_t *data,
size_t data_length )
{
uint8_t *copy = NULL;
if( data_length != 0 )
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 16:27:26 +00:00
{
Switch psa_{get,set}_domain_parameters to attributes Change psa_get_domain_parameters() and psa_set_domain_parameters() to access a psa_key_attributes_t structure rather than a key handle. In psa_get_key_attributes(), treat the RSA public exponent as a domain parameter and read it out. This is in preparation for removing the `extra` parameter of psa_generate_key() and setting the RSA public exponent for key generation via domain parameters. In this commit, the default public exponent 65537 is not treated specially, which allows us to verify that test code that should be calling psa_reset_key_attributes() after retrieving the attributes of an RSA key is doing so properly (if it wasn't, there would be a memory leak), even if the test data happens to use an RSA key with the default public exponent.
2019-04-26 14:06:02 +00:00
copy = mbedtls_calloc( 1, data_length );
if( copy == NULL )
return( PSA_ERROR_INSUFFICIENT_MEMORY );
memcpy( copy, data, data_length );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 16:27:26 +00:00
}
Switch psa_{get,set}_domain_parameters to attributes Change psa_get_domain_parameters() and psa_set_domain_parameters() to access a psa_key_attributes_t structure rather than a key handle. In psa_get_key_attributes(), treat the RSA public exponent as a domain parameter and read it out. This is in preparation for removing the `extra` parameter of psa_generate_key() and setting the RSA public exponent for key generation via domain parameters. In this commit, the default public exponent 65537 is not treated specially, which allows us to verify that test code that should be calling psa_reset_key_attributes() after retrieving the attributes of an RSA key is doing so properly (if it wasn't, there would be a memory leak), even if the test data happens to use an RSA key with the default public exponent.
2019-04-26 14:06:02 +00:00
/* After this point, this function is guaranteed to succeed, so it
* can start modifying `*attributes`. */
if( attributes->domain_parameters != NULL )
{
mbedtls_free( attributes->domain_parameters );
attributes->domain_parameters = NULL;
attributes->domain_parameters_size = 0;
}
attributes->domain_parameters = copy;
attributes->domain_parameters_size = data_length;
Move attribute fields to a substructure Move the "core attributes" to a substructure of psa_key_attribute_t. The motivation is to be able to use the new structure psa_core_key_attributes_t internally.
2019-07-30 11:48:52 +00:00
attributes->core.type = type;
Switch psa_{get,set}_domain_parameters to attributes Change psa_get_domain_parameters() and psa_set_domain_parameters() to access a psa_key_attributes_t structure rather than a key handle. In psa_get_key_attributes(), treat the RSA public exponent as a domain parameter and read it out. This is in preparation for removing the `extra` parameter of psa_generate_key() and setting the RSA public exponent for key generation via domain parameters. In this commit, the default public exponent 65537 is not treated specially, which allows us to verify that test code that should be calling psa_reset_key_attributes() after retrieving the attributes of an RSA key is doing so properly (if it wasn't, there would be a memory leak), even if the test data happens to use an RSA key with the default public exponent.
2019-04-26 14:06:02 +00:00
return( PSA_SUCCESS );
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 14:48:15 +00:00
}
Switch psa_{get,set}_domain_parameters to attributes Change psa_get_domain_parameters() and psa_set_domain_parameters() to access a psa_key_attributes_t structure rather than a key handle. In psa_get_key_attributes(), treat the RSA public exponent as a domain parameter and read it out. This is in preparation for removing the `extra` parameter of psa_generate_key() and setting the RSA public exponent for key generation via domain parameters. In this commit, the default public exponent 65537 is not treated specially, which allows us to verify that test code that should be calling psa_reset_key_attributes() after retrieving the attributes of an RSA key is doing so properly (if it wasn't, there would be a memory leak), even if the test data happens to use an RSA key with the default public exponent.
2019-04-26 14:06:02 +00:00
psa_status_t psa_get_key_domain_parameters(
const psa_key_attributes_t *attributes,
uint8_t *data, size_t data_size, size_t *data_length )
New internal function psa_get_key_bits Isolate the code of psa_get_key_information that calculates the bit size of a key into its own function which can be called by functions that have a key slot pointer.
2018-07-06 14:02:09 +00:00
{
Switch psa_{get,set}_domain_parameters to attributes Change psa_get_domain_parameters() and psa_set_domain_parameters() to access a psa_key_attributes_t structure rather than a key handle. In psa_get_key_attributes(), treat the RSA public exponent as a domain parameter and read it out. This is in preparation for removing the `extra` parameter of psa_generate_key() and setting the RSA public exponent for key generation via domain parameters. In this commit, the default public exponent 65537 is not treated specially, which allows us to verify that test code that should be calling psa_reset_key_attributes() after retrieving the attributes of an RSA key is doing so properly (if it wasn't, there would be a memory leak), even if the test data happens to use an RSA key with the default public exponent.
2019-04-26 14:06:02 +00:00
if( attributes->domain_parameters_size > data_size )
return( PSA_ERROR_BUFFER_TOO_SMALL );
*data_length = attributes->domain_parameters_size;
if( attributes->domain_parameters_size != 0 )
memcpy( data, attributes->domain_parameters,
attributes->domain_parameters_size );
return( PSA_SUCCESS );
}
New internal function psa_get_key_bits Isolate the code of psa_get_key_information that calculates the bit size of a key into its own function which can be called by functions that have a key slot pointer.
2018-07-06 14:02:09 +00:00
#if defined(MBEDTLS_RSA_C)
Switch psa_{get,set}_domain_parameters to attributes Change psa_get_domain_parameters() and psa_set_domain_parameters() to access a psa_key_attributes_t structure rather than a key handle. In psa_get_key_attributes(), treat the RSA public exponent as a domain parameter and read it out. This is in preparation for removing the `extra` parameter of psa_generate_key() and setting the RSA public exponent for key generation via domain parameters. In this commit, the default public exponent 65537 is not treated specially, which allows us to verify that test code that should be calling psa_reset_key_attributes() after retrieving the attributes of an RSA key is doing so properly (if it wasn't, there would be a memory leak), even if the test data happens to use an RSA key with the default public exponent.
2019-04-26 14:06:02 +00:00
static psa_status_t psa_get_rsa_public_exponent(
const mbedtls_rsa_context *rsa,
psa_key_attributes_t *attributes )
{
mbedtls_mpi mpi;
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Switch psa_{get,set}_domain_parameters to attributes Change psa_get_domain_parameters() and psa_set_domain_parameters() to access a psa_key_attributes_t structure rather than a key handle. In psa_get_key_attributes(), treat the RSA public exponent as a domain parameter and read it out. This is in preparation for removing the `extra` parameter of psa_generate_key() and setting the RSA public exponent for key generation via domain parameters. In this commit, the default public exponent 65537 is not treated specially, which allows us to verify that test code that should be calling psa_reset_key_attributes() after retrieving the attributes of an RSA key is doing so properly (if it wasn't, there would be a memory leak), even if the test data happens to use an RSA key with the default public exponent.
2019-04-26 14:06:02 +00:00
uint8_t *buffer = NULL;
size_t buflen;
mbedtls_mpi_init( &mpi );
ret = mbedtls_rsa_export( rsa, NULL, NULL, NULL, NULL, &mpi );
if( ret != 0 )
goto exit;
psa_get_domain_parameters: for RSA, if e=65537, output an empty string
2019-04-26 15:37:21 +00:00
if( mbedtls_mpi_cmp_int( &mpi, 65537 ) == 0 )
{
/* It's the default value, which is reported as an empty string,
* so there's nothing to do. */
goto exit;
}
Switch psa_{get,set}_domain_parameters to attributes Change psa_get_domain_parameters() and psa_set_domain_parameters() to access a psa_key_attributes_t structure rather than a key handle. In psa_get_key_attributes(), treat the RSA public exponent as a domain parameter and read it out. This is in preparation for removing the `extra` parameter of psa_generate_key() and setting the RSA public exponent for key generation via domain parameters. In this commit, the default public exponent 65537 is not treated specially, which allows us to verify that test code that should be calling psa_reset_key_attributes() after retrieving the attributes of an RSA key is doing so properly (if it wasn't, there would be a memory leak), even if the test data happens to use an RSA key with the default public exponent.
2019-04-26 14:06:02 +00:00
buflen = mbedtls_mpi_size( &mpi );
buffer = mbedtls_calloc( 1, buflen );
if( buffer == NULL )
{
ret = MBEDTLS_ERR_MPI_ALLOC_FAILED;
goto exit;
}
ret = mbedtls_mpi_write_binary( &mpi, buffer, buflen );
if( ret != 0 )
goto exit;
attributes->domain_parameters = buffer;
attributes->domain_parameters_size = buflen;
exit:
mbedtls_mpi_free( &mpi );
if( ret != 0 )
mbedtls_free( buffer );
return( mbedtls_to_psa_error( ret ) );
New internal function psa_get_key_bits Isolate the code of psa_get_key_information that calculates the bit size of a key into its own function which can be called by functions that have a key slot pointer.
2018-07-06 14:02:09 +00:00
}
Switch psa_{get,set}_domain_parameters to attributes Change psa_get_domain_parameters() and psa_set_domain_parameters() to access a psa_key_attributes_t structure rather than a key handle. In psa_get_key_attributes(), treat the RSA public exponent as a domain parameter and read it out. This is in preparation for removing the `extra` parameter of psa_generate_key() and setting the RSA public exponent for key generation via domain parameters. In this commit, the default public exponent 65537 is not treated specially, which allows us to verify that test code that should be calling psa_reset_key_attributes() after retrieving the attributes of an RSA key is doing so properly (if it wasn't, there would be a memory leak), even if the test data happens to use an RSA key with the default public exponent.
2019-04-26 14:06:02 +00:00
#endif /* MBEDTLS_RSA_C */
New internal function psa_get_key_bits Isolate the code of psa_get_key_information that calculates the bit size of a key into its own function which can be called by functions that have a key slot pointer.
2018-07-06 14:02:09 +00:00
Use a key attribute structure in the internal storage interface Pass information via a key attribute structure rather than as separate parameters to psa_crypto_storage functions. This makes it easier to maintain the code when the metadata of a key evolves. This has negligible impact on code size (+4B with "gcc -Os" on x86_64).
2019-07-23 09:58:03 +00:00
/** Retrieve all the publicly-accessible attributes of a key.
*/
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 19:44:46 +00:00
psa_status_t psa_get_key_attributes( psa_key_handle_t handle,
psa_key_attributes_t *attributes )
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 16:12:32 +00:00
psa_key_slot_t *slot;
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 15:01:38 +00:00
psa_status_t status;
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 19:44:46 +00:00
psa_reset_key_attributes( attributes );
SE keys: implement and test psa_get_key_attributes
2019-07-24 17:09:30 +00:00
status = psa_get_key_from_slot( handle, &slot, 0, 0 );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 15:01:38 +00:00
if( status != PSA_SUCCESS )
return( status );
New internal function psa_get_key_bits Isolate the code of psa_get_key_information that calculates the bit size of a key into its own function which can be called by functions that have a key slot pointer.
2018-07-06 14:02:09 +00:00
Take advantage of psa_core_key_attributes_t internally #2 Key creation and psa_get_key_attributes
2019-07-31 12:15:34 +00:00
attributes->core = slot->attr;
Add slot_number attribute Add a slot_number field to psa_key_attributes_t and getter/setter functions. Since slot numbers can have the value 0, indicate the presence of the field via a separate flag. In psa_get_key_attributes(), report the slot number if the key is in a secure element. When creating a key, for now, applications cannot choose a slot number. A subsequent commit will add this capability in the secure element HAL.
2019-08-02 18:15:51 +00:00
attributes->core.flags &= ( MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY |
MBEDTLS_PSA_KA_MASK_DUAL_USE );
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
if( psa_key_slot_is_external( slot ) )
psa_set_key_slot_number( attributes, slot->data.se.slot_number );
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Switch psa_{get,set}_domain_parameters to attributes Change psa_get_domain_parameters() and psa_set_domain_parameters() to access a psa_key_attributes_t structure rather than a key handle. In psa_get_key_attributes(), treat the RSA public exponent as a domain parameter and read it out. This is in preparation for removing the `extra` parameter of psa_generate_key() and setting the RSA public exponent for key generation via domain parameters. In this commit, the default public exponent 65537 is not treated specially, which allows us to verify that test code that should be calling psa_reset_key_attributes() after retrieving the attributes of an RSA key is doing so properly (if it wasn't, there would be a memory leak), even if the test data happens to use an RSA key with the default public exponent.
2019-04-26 14:06:02 +00:00
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
switch( slot->attr.type )
Switch psa_{get,set}_domain_parameters to attributes Change psa_get_domain_parameters() and psa_set_domain_parameters() to access a psa_key_attributes_t structure rather than a key handle. In psa_get_key_attributes(), treat the RSA public exponent as a domain parameter and read it out. This is in preparation for removing the `extra` parameter of psa_generate_key() and setting the RSA public exponent for key generation via domain parameters. In this commit, the default public exponent 65537 is not treated specially, which allows us to verify that test code that should be calling psa_reset_key_attributes() after retrieving the attributes of an RSA key is doing so properly (if it wasn't, there would be a memory leak), even if the test data happens to use an RSA key with the default public exponent.
2019-04-26 14:06:02 +00:00
{
#if defined(MBEDTLS_RSA_C)
Rename *KEYPAIR* to *KEY_PAIR* Be consistent with PUBLIC_KEY. perl -i -pe 's/KEYPAIR/KEY_PAIR/g' $(git ls-files)
2019-05-16 17:39:54 +00:00
case PSA_KEY_TYPE_RSA_KEY_PAIR:
Switch psa_{get,set}_domain_parameters to attributes Change psa_get_domain_parameters() and psa_set_domain_parameters() to access a psa_key_attributes_t structure rather than a key handle. In psa_get_key_attributes(), treat the RSA public exponent as a domain parameter and read it out. This is in preparation for removing the `extra` parameter of psa_generate_key() and setting the RSA public exponent for key generation via domain parameters. In this commit, the default public exponent 65537 is not treated specially, which allows us to verify that test code that should be calling psa_reset_key_attributes() after retrieving the attributes of an RSA key is doing so properly (if it wasn't, there would be a memory leak), even if the test data happens to use an RSA key with the default public exponent.
2019-04-26 14:06:02 +00:00
case PSA_KEY_TYPE_RSA_PUBLIC_KEY:
SE keys: implement and test psa_get_key_attributes
2019-07-24 17:09:30 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Make TODO comments consistent
2019-08-13 11:15:34 +00:00
/* TODO: reporting the public exponent for opaque keys
Add issue numbers for some missing parts of secure element support
2019-08-13 14:17:16 +00:00
* is not yet implemented.
* https://github.com/ARMmbed/mbed-crypto/issues/216
*/
Add slot_number attribute Add a slot_number field to psa_key_attributes_t and getter/setter functions. Since slot numbers can have the value 0, indicate the presence of the field via a separate flag. In psa_get_key_attributes(), report the slot number if the key is in a secure element. When creating a key, for now, applications cannot choose a slot number. A subsequent commit will add this capability in the secure element HAL.
2019-08-02 18:15:51 +00:00
if( psa_key_slot_is_external( slot ) )
SE keys: implement and test psa_get_key_attributes
2019-07-24 17:09:30 +00:00
break;
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Switch psa_{get,set}_domain_parameters to attributes Change psa_get_domain_parameters() and psa_set_domain_parameters() to access a psa_key_attributes_t structure rather than a key handle. In psa_get_key_attributes(), treat the RSA public exponent as a domain parameter and read it out. This is in preparation for removing the `extra` parameter of psa_generate_key() and setting the RSA public exponent for key generation via domain parameters. In this commit, the default public exponent 65537 is not treated specially, which allows us to verify that test code that should be calling psa_reset_key_attributes() after retrieving the attributes of an RSA key is doing so properly (if it wasn't, there would be a memory leak), even if the test data happens to use an RSA key with the default public exponent.
2019-04-26 14:06:02 +00:00
status = psa_get_rsa_public_exponent( slot->data.rsa, attributes );
break;
SE keys: implement and test psa_get_key_attributes
2019-07-24 17:09:30 +00:00
#endif /* MBEDTLS_RSA_C */
Switch psa_{get,set}_domain_parameters to attributes Change psa_get_domain_parameters() and psa_set_domain_parameters() to access a psa_key_attributes_t structure rather than a key handle. In psa_get_key_attributes(), treat the RSA public exponent as a domain parameter and read it out. This is in preparation for removing the `extra` parameter of psa_generate_key() and setting the RSA public exponent for key generation via domain parameters. In this commit, the default public exponent 65537 is not treated specially, which allows us to verify that test code that should be calling psa_reset_key_attributes() after retrieving the attributes of an RSA key is doing so properly (if it wasn't, there would be a memory leak), even if the test data happens to use an RSA key with the default public exponent.
2019-04-26 14:06:02 +00:00
default:
/* Nothing else to do. */
break;
}
if( status != PSA_SUCCESS )
psa_reset_key_attributes( attributes );
return( status );
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
}
Add slot_number attribute Add a slot_number field to psa_key_attributes_t and getter/setter functions. Since slot numbers can have the value 0, indicate the presence of the field via a separate flag. In psa_get_key_attributes(), report the slot number if the key is in a secure element. When creating a key, for now, applications cannot choose a slot number. A subsequent commit will add this capability in the secure element HAL.
2019-08-02 18:15:51 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
psa_status_t psa_get_key_slot_number(
const psa_key_attributes_t *attributes,
psa_key_slot_number_t *slot_number )
{
if( attributes->core.flags & MBEDTLS_PSA_KA_FLAG_HAS_SLOT_NUMBER )
{
*slot_number = attributes->slot_number;
return( PSA_SUCCESS );
}
else
return( PSA_ERROR_INVALID_ARGUMENT );
}
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
psa: Simplify EC public key format Remove front matter from our EC key format, to make it just the contents of an ECPoint as defined by SEC1 section 2.3.3. As a consequence of the simplification, remove the restriction on not being able to use an ECDH key with ECDSA. There is no longer any OID specified when importing a key, so we can't reject importing of an ECDH key for the purpose of ECDSA based on the OID.
2019-01-10 11:42:27 +00:00
#if defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECP_C)
psa: Simplify RSA public key format Remove pkcs-1 and rsaEncryption front matter from RSA public keys. Move code that was shared between RSA and other key types (like EC keys) to be used only with non-RSA keys.
2019-01-10 10:23:21 +00:00
static int pk_write_pubkey_simple( mbedtls_pk_context *key,
unsigned char *buf, size_t size )
{
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
psa: Simplify RSA public key format Remove pkcs-1 and rsaEncryption front matter from RSA public keys. Move code that was shared between RSA and other key types (like EC keys) to be used only with non-RSA keys.
2019-01-10 10:23:21 +00:00
unsigned char *c;
size_t len = 0;
c = buf + size;
MBEDTLS_ASN1_CHK_ADD( len, mbedtls_pk_write_pubkey( &c, buf, key ) );
return( (int) len );
}
psa: Simplify EC public key format Remove front matter from our EC key format, to make it just the contents of an ECPoint as defined by SEC1 section 2.3.3. As a consequence of the simplification, remove the restriction on not being able to use an ECDH key with ECDSA. There is no longer any OID specified when importing a key, so we can't reject importing of an ECDH key for the purpose of ECDSA based on the OID.
2019-01-10 11:42:27 +00:00
#endif /* defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECP_C) */
psa: Simplify RSA public key format Remove pkcs-1 and rsaEncryption front matter from RSA public keys. Move code that was shared between RSA and other key types (like EC keys) to be used only with non-RSA keys.
2019-01-10 10:23:21 +00:00
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
static psa_status_t psa_internal_export_key( const psa_key_slot_t *slot,
uint8_t *data,
size_t data_size,
size_t *data_length,
int export_public_key )
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
{
SE keys: support import and export
2019-07-12 21:47:28 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
const psa_drv_se_t *drv;
psa_drv_se_context_t *drv_context;
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
psa_export_key: Always set a valid data length Make psa_export_key() always set a valid data_length when exporting, even when there are errors. This makes the API easier to use for buggy programs (like our test code). Our test code previously used exported_length uninitialized when checking to see that the buffer returned was all zero in import_export() in the case where an error was returned from psa_export_key(). Initialize exported_length to an invalid length, and check that it gets set properly by psa_export_key(), to avoid this using export_length uninitialized. Note that the mem_is_zero() check is still valid when psa_export_key() returns an error, e.g. where exported_length is 0, as we want to check that nothing was written to the buffer on error. Out test code also previous passed NULL for the data_length parameter of psa_export_key() when it expected a failure (in key_policy_fail()). However, data_length is not allowed to be NULL, especially now that we write to data_length from psa_export_key() even when there are errors. Update the test code to not pass in a NULL data_length.
2018-06-27 16:20:43 +00:00
*data_length = 0;
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( export_public_key && ! PSA_KEY_TYPE_IS_ASYMMETRIC( slot->attr.type ) )
psa_internal_export_key function for common code. create psa_internal_export_key function for common code in psa_export_key and psa_export_public_key.
2018-04-16 15:16:20 +00:00
return( PSA_ERROR_INVALID_ARGUMENT );
integrate policy key usage in export and asymmetric sign functions
2018-03-28 10:17:44 +00:00
Remove special handling for zero-length keys Zero-length keys are rejected at creation time, so we don't need any special handling internally. When exporting a key, we do need to take care of the case where the output buffer is empty, but this is easy: an empty output buffer is never valid.
2019-09-12 17:20:29 +00:00
/* Reject a zero-length output buffer now, since this can never be a
* valid key representation. This way we know that data must be a valid
* pointer and we can do things like memset(data, ..., data_size). */
if( data_size == 0 )
return( PSA_ERROR_BUFFER_TOO_SMALL );
SE keys: support import and export
2019-07-12 21:47:28 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( psa_get_se_driver( slot->attr.lifetime, &drv, &drv_context ) )
SE keys: support import and export
2019-07-12 21:47:28 +00:00
{
psa_drv_se_export_key_t method;
if( drv->key_management == NULL )
return( PSA_ERROR_NOT_SUPPORTED );
method = ( export_public_key ?
drv->key_management->p_export_public :
drv->key_management->p_export );
if( method == NULL )
return( PSA_ERROR_NOT_SUPPORTED );
Don't explicitly dereference function pointers Be stylistically consistent.
2019-07-25 09:34:33 +00:00
return( method( drv_context,
slot->data.se.slot_number,
data, data_size, data_length ) );
SE keys: support import and export
2019-07-12 21:47:28 +00:00
}
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( key_type_is_raw_bytes( slot->attr.type ) )
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
{
if( slot->data.raw.bytes > data_size )
return( PSA_ERROR_BUFFER_TOO_SMALL );
Remove special handling for zero-length keys Zero-length keys are rejected at creation time, so we don't need any special handling internally. When exporting a key, we do need to take care of the case where the output buffer is empty, but this is easy: an empty output buffer is never valid.
2019-09-12 17:20:29 +00:00
memcpy( data, slot->data.raw.data, slot->data.raw.bytes );
memset( data + slot->data.raw.bytes, 0,
data_size - slot->data.raw.bytes );
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
*data_length = slot->data.raw.bytes;
return( PSA_SUCCESS );
}
Private EC key format: change to raw secret value (export) Change the import/export format of private elliptic curve keys from RFC 5915 to the raw secret value. This commit updates the export code.
2018-10-29 18:26:02 +00:00
#if defined(MBEDTLS_ECP_C)
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( PSA_KEY_TYPE_IS_ECC_KEY_PAIR( slot->attr.type ) && !export_public_key )
Private EC key format: change to raw secret value (export) Change the import/export format of private elliptic curve keys from RFC 5915 to the raw secret value. This commit updates the export code.
2018-10-29 18:26:02 +00:00
{
psa: Refactor psa_internal_export_key to use slot, rather than key When generating keys that have persistent lifetime, we will need the keys to be in the exported format to save to persistent storage. This refactoring to separate checking the slots usage from the exporting of the key data will be necessary for using psa_internal_export_key in psa_generate_key.
2018-11-07 16:00:44 +00:00
psa_status_t status;
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 19:32:04 +00:00
size_t bytes = PSA_BITS_TO_BYTES( slot->attr.bits );
Private EC key format: change to raw secret value (export) Change the import/export format of private elliptic curve keys from RFC 5915 to the raw secret value. This commit updates the export code.
2018-10-29 18:26:02 +00:00
if( bytes > data_size )
return( PSA_ERROR_BUFFER_TOO_SMALL );
status = mbedtls_to_psa_error(
mbedtls_mpi_write_binary( &slot->data.ecp->d, data, bytes ) );
if( status != PSA_SUCCESS )
return( status );
memset( data + bytes, 0, data_size - bytes );
*data_length = bytes;
return( PSA_SUCCESS );
}
#endif
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
else
{
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 17:16:59 +00:00
#if defined(MBEDTLS_PK_WRITE_C)
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) ||
PSA_KEY_TYPE_IS_ECC( slot->attr.type ) )
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 17:16:59 +00:00
{
psa_internal_export_key function for common code. create psa_internal_export_key function for common code in psa_export_key and psa_export_public_key.
2018-04-16 15:16:20 +00:00
mbedtls_pk_context pk;
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
psa_internal_export_key function for common code. create psa_internal_export_key function for common code in psa_export_key and psa_export_public_key.
2018-04-16 15:16:20 +00:00
{
Add ifdefs for psa_internal_export_key function MBEDTLS_PK_WRITE_C only requires either MBEDTLS_RSA_C or MBEDTLS_ECP_C to be defined. Added wrappers to handle the cases where only one has been defined. Moved mbedtls_pk_init to be within the ifdefs, so it's only called if appropriate.
2018-07-24 15:33:30 +00:00
#if defined(MBEDTLS_RSA_C)
mbedtls_pk_init( &pk );
psa_internal_export_key function for common code. create psa_internal_export_key function for common code in psa_export_key and psa_export_public_key.
2018-04-16 15:16:20 +00:00
pk.pk_info = &mbedtls_rsa_info;
pk.pk_ctx = slot->data.rsa;
Add ifdefs for psa_internal_export_key function MBEDTLS_PK_WRITE_C only requires either MBEDTLS_RSA_C or MBEDTLS_ECP_C to be defined. Added wrappers to handle the cases where only one has been defined. Moved mbedtls_pk_init to be within the ifdefs, so it's only called if appropriate.
2018-07-24 15:33:30 +00:00
#else
return( PSA_ERROR_NOT_SUPPORTED );
#endif
psa_internal_export_key function for common code. create psa_internal_export_key function for common code in psa_export_key and psa_export_public_key.
2018-04-16 15:16:20 +00:00
}
else
{
Add ifdefs for psa_internal_export_key function MBEDTLS_PK_WRITE_C only requires either MBEDTLS_RSA_C or MBEDTLS_ECP_C to be defined. Added wrappers to handle the cases where only one has been defined. Moved mbedtls_pk_init to be within the ifdefs, so it's only called if appropriate.
2018-07-24 15:33:30 +00:00
#if defined(MBEDTLS_ECP_C)
mbedtls_pk_init( &pk );
psa_internal_export_key function for common code. create psa_internal_export_key function for common code in psa_export_key and psa_export_public_key.
2018-04-16 15:16:20 +00:00
pk.pk_info = &mbedtls_eckey_info;
pk.pk_ctx = slot->data.ecp;
Add ifdefs for psa_internal_export_key function MBEDTLS_PK_WRITE_C only requires either MBEDTLS_RSA_C or MBEDTLS_ECP_C to be defined. Added wrappers to handle the cases where only one has been defined. Moved mbedtls_pk_init to be within the ifdefs, so it's only called if appropriate.
2018-07-24 15:33:30 +00:00
#else
return( PSA_ERROR_NOT_SUPPORTED );
#endif
psa_internal_export_key function for common code. create psa_internal_export_key function for common code in psa_export_key and psa_export_public_key.
2018-04-16 15:16:20 +00:00
}
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( export_public_key || PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->attr.type ) )
psa: Simplify RSA public key format Remove pkcs-1 and rsaEncryption front matter from RSA public keys. Move code that was shared between RSA and other key types (like EC keys) to be used only with non-RSA keys.
2019-01-10 10:23:21 +00:00
{
psa: Simplify EC public key format Remove front matter from our EC key format, to make it just the contents of an ECPoint as defined by SEC1 section 2.3.3. As a consequence of the simplification, remove the restriction on not being able to use an ECDH key with ECDSA. There is no longer any OID specified when importing a key, so we can't reject importing of an ECDH key for the purpose of ECDSA based on the OID.
2019-01-10 11:42:27 +00:00
ret = pk_write_pubkey_simple( &pk, data, data_size );
psa: Simplify RSA public key format Remove pkcs-1 and rsaEncryption front matter from RSA public keys. Move code that was shared between RSA and other key types (like EC keys) to be used only with non-RSA keys.
2019-01-10 10:23:21 +00:00
}
fix conditions
2018-05-02 09:55:20 +00:00
else
psa: Simplify RSA public key format Remove pkcs-1 and rsaEncryption front matter from RSA public keys. Move code that was shared between RSA and other key types (like EC keys) to be used only with non-RSA keys.
2019-01-10 10:23:21 +00:00
{
fix conditions
2018-05-02 09:55:20 +00:00
ret = mbedtls_pk_write_key_der( &pk, data, data_size );
psa: Simplify RSA public key format Remove pkcs-1 and rsaEncryption front matter from RSA public keys. Move code that was shared between RSA and other key types (like EC keys) to be used only with non-RSA keys.
2019-01-10 10:23:21 +00:00
}
adjust indentation per Mbed TLS standards
2018-04-29 08:34:58 +00:00
if( ret < 0 )
psa_export_key: zero out potential garbage in the output buffer In psa_export_key, ensure that each byte of the output buffer either contains its original value, is zero, or is part of the actual output. Specifically, don't risk having partial output on error, and don't leave extra data at the end of the buffer when exporting an asymmetric key. Test that exporting to a previously zeroed buffer leaves the buffer zeroed outside the actual output if any.
2018-06-19 22:11:45 +00:00
{
Remove special handling for zero-length keys Zero-length keys are rejected at creation time, so we don't need any special handling internally. When exporting a key, we do need to take care of the case where the output buffer is empty, but this is easy: an empty output buffer is never valid.
2019-09-12 17:20:29 +00:00
memset( data, 0, data_size );
psa_internal_export_key function for common code. create psa_internal_export_key function for common code in psa_export_key and psa_export_public_key.
2018-04-16 15:16:20 +00:00
return( mbedtls_to_psa_error( ret ) );
psa_export_key: zero out potential garbage in the output buffer In psa_export_key, ensure that each byte of the output buffer either contains its original value, is zero, or is part of the actual output. Specifically, don't risk having partial output on error, and don't leave extra data at the end of the buffer when exporting an asymmetric key. Test that exporting to a previously zeroed buffer leaves the buffer zeroed outside the actual output if any.
2018-06-19 22:11:45 +00:00
}
psa_export_key: fix asymmetric key in larger buffer Exporting an asymmetric key only worked if the target buffer had exactly the right size, because psa_export_key uses mbedtls_pk_write_key_der or mbedtls_pk_write_pubkey_der and these functions write to the end of the buffer, which psa_export_key did not correct for. Fix this by moving the data to the beginning of the buffer if necessary. Add non-regression tests.
2018-06-19 22:11:07 +00:00
/* The mbedtls_pk_xxx functions write to the end of the buffer.
* Move the data to the beginning and erase remaining data
* at the original location. */
if( 2 * (size_t) ret <= data_size )
{
memcpy( data, data + data_size - ret, ret );
psa_export_key: zero out potential garbage in the output buffer In psa_export_key, ensure that each byte of the output buffer either contains its original value, is zero, or is part of the actual output. Specifically, don't risk having partial output on error, and don't leave extra data at the end of the buffer when exporting an asymmetric key. Test that exporting to a previously zeroed buffer leaves the buffer zeroed outside the actual output if any.
2018-06-19 22:11:45 +00:00
memset( data + data_size - ret, 0, ret );
psa_export_key: fix asymmetric key in larger buffer Exporting an asymmetric key only worked if the target buffer had exactly the right size, because psa_export_key uses mbedtls_pk_write_key_der or mbedtls_pk_write_pubkey_der and these functions write to the end of the buffer, which psa_export_key did not correct for. Fix this by moving the data to the beginning of the buffer if necessary. Add non-regression tests.
2018-06-19 22:11:07 +00:00
}
else if( (size_t) ret < data_size )
{
memmove( data, data + data_size - ret, ret );
psa_export_key: zero out potential garbage in the output buffer In psa_export_key, ensure that each byte of the output buffer either contains its original value, is zero, or is part of the actual output. Specifically, don't risk having partial output on error, and don't leave extra data at the end of the buffer when exporting an asymmetric key. Test that exporting to a previously zeroed buffer leaves the buffer zeroed outside the actual output if any.
2018-06-19 22:11:45 +00:00
memset( data + ret, 0, data_size - ret );
psa_export_key: fix asymmetric key in larger buffer Exporting an asymmetric key only worked if the target buffer had exactly the right size, because psa_export_key uses mbedtls_pk_write_key_der or mbedtls_pk_write_pubkey_der and these functions write to the end of the buffer, which psa_export_key did not correct for. Fix this by moving the data to the beginning of the buffer if necessary. Add non-regression tests.
2018-06-19 22:11:07 +00:00
}
psa_internal_export_key function for common code. create psa_internal_export_key function for common code in psa_export_key and psa_export_public_key.
2018-04-16 15:16:20 +00:00
*data_length = ret;
return( PSA_SUCCESS );
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 17:16:59 +00:00
}
else
psa_internal_export_key function for common code. create psa_internal_export_key function for common code in psa_export_key and psa_export_public_key.
2018-04-16 15:16:20 +00:00
#endif /* defined(MBEDTLS_PK_WRITE_C) */
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 17:16:59 +00:00
{
psa_internal_export_key function for common code. create psa_internal_export_key function for common code in psa_export_key and psa_export_public_key.
2018-04-16 15:16:20 +00:00
/* This shouldn't happen in the reference implementation, but
Whitespace fixes; removed redundant parentheses No semantic change.
2018-06-04 13:08:56 +00:00
it is valid for a special-purpose implementation to omit
support for exporting certain key types. */
psa_internal_export_key function for common code. create psa_internal_export_key function for common code in psa_export_key and psa_export_public_key.
2018-04-16 15:16:20 +00:00
return( PSA_ERROR_NOT_SUPPORTED );
PSA RSA key import: don't rely on pk so much Don't use the pk module except as required for pkparse/pkwrite. The PSA crypto layer is meant to work alongside pk, not on top of it. Fix the compile-time dependencies on RSA/ECP handling in psa_export_key, psa_destroy_key and psa_get_key_information.
2018-01-28 17:16:59 +00:00
}
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
}
}
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 17:08:14 +00:00
psa_status_t psa_export_key( psa_key_handle_t handle,
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 13:41:12 +00:00
uint8_t *data,
size_t data_size,
size_t *data_length )
psa_internal_export_key function for common code. create psa_internal_export_key function for common code in psa_export_key and psa_export_public_key.
2018-04-16 15:16:20 +00:00
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 16:12:32 +00:00
psa_key_slot_t *slot;
psa: Refactor psa_internal_export_key to use slot, rather than key When generating keys that have persistent lifetime, we will need the keys to be in the exported format to save to persistent storage. This refactoring to separate checking the slots usage from the exporting of the key data will be necessary for using psa_internal_export_key in psa_generate_key.
2018-11-07 16:00:44 +00:00
psa_status_t status;
/* Set the key to empty now, so that even when there are errors, we always
* set data_length to a value between 0 and data_size. On error, setting
* the key to empty is a good choice because an empty key representation is
* unlikely to be accepted anywhere. */
*data_length = 0;
/* Export requires the EXPORT flag. There is an exception for public keys,
* which don't require any flag, but psa_get_key_from_slot takes
* care of this. */
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 17:08:14 +00:00
status = psa_get_key_from_slot( handle, &slot, PSA_KEY_USAGE_EXPORT, 0 );
psa: Refactor psa_internal_export_key to use slot, rather than key When generating keys that have persistent lifetime, we will need the keys to be in the exported format to save to persistent storage. This refactoring to separate checking the slots usage from the exporting of the key data will be necessary for using psa_internal_export_key in psa_generate_key.
2018-11-07 16:00:44 +00:00
if( status != PSA_SUCCESS )
return( status );
return( psa_internal_export_key( slot, data, data_size,
Formatting improvements Avoid lines longer than 80 columns. Remove some redundant parentheses, e.g. change if( ( a == b ) && ( c == d ) ) to if( a == b && c == d ) which makes lines less long and makes the remaining parentheses more relevant. Add missing parentheses around return statements. There should be no semantic change in this commit.
2018-06-18 14:04:39 +00:00
data_length, 0 ) );
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
}
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 17:08:14 +00:00
psa_status_t psa_export_public_key( psa_key_handle_t handle,
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 13:41:12 +00:00
uint8_t *data,
size_t data_size,
size_t *data_length )
export public key
2018-04-03 12:30:03 +00:00
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 16:12:32 +00:00
psa_key_slot_t *slot;
psa: Refactor psa_internal_export_key to use slot, rather than key When generating keys that have persistent lifetime, we will need the keys to be in the exported format to save to persistent storage. This refactoring to separate checking the slots usage from the exporting of the key data will be necessary for using psa_internal_export_key in psa_generate_key.
2018-11-07 16:00:44 +00:00
psa_status_t status;
/* Set the key to empty now, so that even when there are errors, we always
* set data_length to a value between 0 and data_size. On error, setting
* the key to empty is a good choice because an empty key representation is
* unlikely to be accepted anywhere. */
*data_length = 0;
/* Exporting a public key doesn't require a usage flag. */
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 17:08:14 +00:00
status = psa_get_key_from_slot( handle, &slot, 0, 0 );
psa: Refactor psa_internal_export_key to use slot, rather than key When generating keys that have persistent lifetime, we will need the keys to be in the exported format to save to persistent storage. This refactoring to separate checking the slots usage from the exporting of the key data will be necessary for using psa_internal_export_key in psa_generate_key.
2018-11-07 16:00:44 +00:00
if( status != PSA_SUCCESS )
return( status );
return( psa_internal_export_key( slot, data, data_size,
Formatting improvements Avoid lines longer than 80 columns. Remove some redundant parentheses, e.g. change if( ( a == b ) && ( c == d ) ) to if( a == b && c == d ) which makes lines less long and makes the remaining parentheses more relevant. Add missing parentheses around return statements. There should be no semantic change in this commit.
2018-06-18 14:04:39 +00:00
data_length, 1 ) );
export public key
2018-04-03 12:30:03 +00:00
}
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
Add infrastructure for key attribute flags Add infrastructure for internal, external and dual-use flags, with a compile-time check (if static_assert is available) to ensure that the same numerical value doesn't get declared for two different purposes in crypto_struct.h (external or dual-use) and psa_crypto_core.h (internal).
2019-08-02 17:19:39 +00:00
#if defined(static_assert)
static_assert( ( MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE ) == 0,
"One or more key attribute flag is listed as both external-only and dual-use" );
Rename internal macro to pass check-names.sh check-names.sh rejects MBEDTLS_XXX identifiers that are not defined in a public header.
2019-08-05 15:32:13 +00:00
static_assert( ( PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_DUAL_USE ) == 0,
Fix copypasta
2019-08-07 16:19:46 +00:00
"One or more key attribute flag is listed as both internal-only and dual-use" );
Rename internal macro to pass check-names.sh check-names.sh rejects MBEDTLS_XXX identifiers that are not defined in a public header.
2019-08-05 15:32:13 +00:00
static_assert( ( PSA_KA_MASK_INTERNAL_ONLY & MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY ) == 0,
Add infrastructure for key attribute flags Add infrastructure for internal, external and dual-use flags, with a compile-time check (if static_assert is available) to ensure that the same numerical value doesn't get declared for two different purposes in crypto_struct.h (external or dual-use) and psa_crypto_core.h (internal).
2019-08-02 17:19:39 +00:00
"One or more key attribute flag is listed as both internal-only and external-only" );
#endif
More refactoring: consolidate attribute validation Consolidate attribute validation at the beginning of key creation into a single function. Improve comments.
2019-07-31 15:21:46 +00:00
/** Validate that a key policy is internally well-formed.
*
* This function only rejects invalid policies. It does not validate the
* consistency of the policy with respect to other attributes of the key
* such as the key type.
*/
static psa_status_t psa_validate_key_policy( const psa_key_policy_t *policy )
psa: Extend psa_generate_key to support persistent lifetimes
2018-11-07 16:05:30 +00:00
{
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
if( ( policy->usage & ~( PSA_KEY_USAGE_EXPORT |
New usage flag PSA_KEY_USAGE_COPY Document the new flag and allow its use.
2019-05-14 12:24:28 +00:00
PSA_KEY_USAGE_COPY |
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
PSA_KEY_USAGE_ENCRYPT |
PSA_KEY_USAGE_DECRYPT |
Rename some signature-related identifiers Rename some macros and functions related to signature which are changing as part of the addition of psa_sign_message and psa_verify_message. perl -i -pe '%t = ( PSA_KEY_USAGE_SIGN => PSA_KEY_USAGE_SIGN_HASH, PSA_KEY_USAGE_VERIFY => PSA_KEY_USAGE_VERIFY_HASH, PSA_ASYMMETRIC_SIGNATURE_MAX_SIZE => PSA_SIGNATURE_MAX_SIZE, PSA_ASYMMETRIC_SIGN_OUTPUT_SIZE => PSA_SIGN_OUTPUT_SIZE, psa_asymmetric_sign => psa_sign_hash, psa_asymmetric_verify => psa_verify_hash, ); s/\b(@{[join("|", keys %t)]})\b/$t{$1}/ge' $(git ls-files . ':!:**/crypto_compat.h')
2019-11-26 16:01:59 +00:00
PSA_KEY_USAGE_SIGN_HASH |
PSA_KEY_USAGE_VERIFY_HASH |
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
PSA_KEY_USAGE_DERIVE ) ) != 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
return( PSA_SUCCESS );
psa: Extend psa_generate_key to support persistent lifetimes
2018-11-07 16:05:30 +00:00
}
More refactoring: consolidate attribute validation Consolidate attribute validation at the beginning of key creation into a single function. Improve comments.
2019-07-31 15:21:46 +00:00
/** Validate the internal consistency of key attributes.
*
* This function only rejects invalid attribute values. If does not
* validate the consistency of the attributes with any key data that may
* be involved in the creation of the key.
*
* Call this function early in the key creation process.
*
* \param[in] attributes Key attributes for the new key.
* \param[out] p_drv On any return, the driver for the key, if any.
* NULL for a transparent key.
*
*/
static psa_status_t psa_validate_key_attributes(
const psa_key_attributes_t *attributes,
psa_se_drv_table_entry_t **p_drv )
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
{
psa_status_t status;
More refactoring: consolidate attribute validation Consolidate attribute validation at the beginning of key creation into a single function. Improve comments.
2019-07-31 15:21:46 +00:00
if( attributes->core.lifetime != PSA_KEY_LIFETIME_VOLATILE )
{
status = psa_validate_persistent_key_parameters(
attributes->core.lifetime, attributes->core.id,
p_drv, 1 );
if( status != PSA_SUCCESS )
return( status );
}
status = psa_validate_key_policy( &attributes->core.policy );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
if( status != PSA_SUCCESS )
More refactoring: consolidate attribute validation Consolidate attribute validation at the beginning of key creation into a single function. Improve comments.
2019-07-31 15:21:46 +00:00
return( status );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
More refactoring: consolidate attribute validation Consolidate attribute validation at the beginning of key creation into a single function. Improve comments.
2019-07-31 15:21:46 +00:00
/* Refuse to create overly large keys.
* Note that this doesn't trigger on import if the attributes don't
* explicitly specify a size (so psa_get_key_bits returns 0), so
* psa_import_key() needs its own checks. */
if( psa_get_key_bits( attributes ) > PSA_MAX_KEY_BITS )
return( PSA_ERROR_NOT_SUPPORTED );
Add infrastructure for key attribute flags Add infrastructure for internal, external and dual-use flags, with a compile-time check (if static_assert is available) to ensure that the same numerical value doesn't get declared for two different purposes in crypto_struct.h (external or dual-use) and psa_crypto_core.h (internal).
2019-08-02 17:19:39 +00:00
/* Reject invalid flags. These should not be reachable through the API. */
if( attributes->core.flags & ~ ( MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY |
MBEDTLS_PSA_KA_MASK_DUAL_USE ) )
return( PSA_ERROR_INVALID_ARGUMENT );
More refactoring: consolidate attribute validation Consolidate attribute validation at the beginning of key creation into a single function. Improve comments.
2019-07-31 15:21:46 +00:00
return( PSA_SUCCESS );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
}
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
/** Prepare a key slot to receive key material.
*
* This function allocates a key slot and sets its metadata.
*
* If this function fails, call psa_fail_key_creation().
*
Document the key creation flow (start, variable, finish, and fail)
2019-04-28 09:37:03 +00:00
* This function is intended to be used as follows:
* -# Call psa_start_key_creation() to allocate a key slot, prepare
* it with the specified attributes, and assign it a handle.
* -# Populate the slot with the key material.
* -# Call psa_finish_key_creation() to finalize the creation of the slot.
* In case of failure at any step, stop the sequence and call
* psa_fail_key_creation().
*
psa_start_key_creation: take the method as a parameter Let psa_start_key_creation know what type of key creation this is. This will be used at least for key registration in a secure element, which is a peculiar kind of creation since it uses existing key material.
2019-07-15 20:02:14 +00:00
* \param method An identification of the calling function.
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
* \param[in] attributes Key attributes for the new key.
* \param[out] handle On success, a handle for the allocated slot.
* \param[out] p_slot On success, a pointer to the prepared slot.
* \param[out] p_drv On any return, the driver for the key, if any.
* NULL for a transparent key.
Document the key creation flow (start, variable, finish, and fail)
2019-04-28 09:37:03 +00:00
*
* \retval #PSA_SUCCESS
* The key slot is ready to receive key material.
* \return If this function fails, the key slot is an invalid state.
* You must call psa_fail_key_creation() to wipe and free the slot.
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
*/
static psa_status_t psa_start_key_creation(
psa_start_key_creation: take the method as a parameter Let psa_start_key_creation know what type of key creation this is. This will be used at least for key registration in a secure element, which is a peculiar kind of creation since it uses existing key material.
2019-07-15 20:02:14 +00:00
psa_key_creation_method_t method,
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
const psa_key_attributes_t *attributes,
psa_key_handle_t *handle,
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
psa_key_slot_t **p_slot,
Driver table entries are now mutable Since driver table entries contain the driver context, which is mutable, they can't be const anymore.
2019-07-12 21:40:35 +00:00
psa_se_drv_table_entry_t **p_drv )
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
{
psa_status_t status;
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
psa_key_slot_t *slot;
psa_start_key_creation: take the method as a parameter Let psa_start_key_creation know what type of key creation this is. This will be used at least for key registration in a secure element, which is a peculiar kind of creation since it uses existing key material.
2019-07-15 20:02:14 +00:00
(void) method;
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
*p_drv = NULL;
More refactoring: consolidate attribute validation Consolidate attribute validation at the beginning of key creation into a single function. Improve comments.
2019-07-31 15:21:46 +00:00
status = psa_validate_key_attributes( attributes, p_drv );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
if( status != PSA_SUCCESS )
return( status );
Rename psa_internal_allocate_key_slot to psa_get_empty_key_slot This function no longer modifies anything, so it doesn't actually allocate the slot. Now, it just returns the empty key slot, and it's up to the caller to cause the slot to be in use (or not).
2019-08-07 16:19:59 +00:00
status = psa_get_empty_key_slot( handle, p_slot );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
if( status != PSA_SUCCESS )
return( status );
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
slot = *p_slot;
Take advantage of psa_core_key_attributes_t internally #2 Key creation and psa_get_key_attributes
2019-07-31 12:15:34 +00:00
/* We're storing the declared bit-size of the key. It's up to each
* creation mechanism to verify that this information is correct.
* It's automatically correct for mechanisms that use the bit-size as
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 19:32:04 +00:00
* an input (generate, device) but not for those where the bit-size
* is optional (import, copy). */
Take advantage of psa_core_key_attributes_t internally #2 Key creation and psa_get_key_attributes
2019-07-31 12:15:34 +00:00
slot->attr = attributes->core;
Limit keys to 65528 bits 65528 bits is more than any reasonable key until we start supporting post-quantum cryptography. This limit is chosen to allow bit-sizes to be stored in 16 bits, with 65535 left to indicate an invalid value. It's a whole number of bytes, which facilitates some calculations, in particular allowing a key of exactly PSA_CRYPTO_MAX_STORAGE_SIZE to be created but not one bit more. As a resource usage limit, this is arguably too large, but that's out of scope of the current commit. Test that key import, generation and derivation reject overly large sizes.
2019-07-30 15:26:54 +00:00
Add infrastructure for key attribute flags Add infrastructure for internal, external and dual-use flags, with a compile-time check (if static_assert is available) to ensure that the same numerical value doesn't get declared for two different purposes in crypto_struct.h (external or dual-use) and psa_crypto_core.h (internal).
2019-08-02 17:19:39 +00:00
/* Erase external-only flags from the internal copy. To access
Fix erasure of external flags This didn't break anything now, but would have broken things once we start to add internal flags.
2019-08-07 13:42:14 +00:00
* external-only flags, query `attributes`. Thanks to the check
* in psa_validate_key_attributes(), this leaves the dual-use
Rename psa_internal_allocate_key_slot to psa_get_empty_key_slot This function no longer modifies anything, so it doesn't actually allocate the slot. Now, it just returns the empty key slot, and it's up to the caller to cause the slot to be in use (or not).
2019-08-07 16:19:59 +00:00
* flags and any internal flag that psa_get_empty_key_slot()
Fix erasure of external flags This didn't break anything now, but would have broken things once we start to add internal flags.
2019-08-07 13:42:14 +00:00
* may have set. */
slot->attr.flags &= ~MBEDTLS_PSA_KA_MASK_EXTERNAL_ONLY;
Add infrastructure for key attribute flags Add infrastructure for internal, external and dual-use flags, with a compile-time check (if static_assert is available) to ensure that the same numerical value doesn't get declared for two different purposes in crypto_struct.h (external or dual-use) and psa_crypto_core.h (internal).
2019-08-02 17:19:39 +00:00
SE keys: allocate a slot before creating the key
2019-07-12 21:46:04 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
New function mbedtls_psa_register_se_key Register an existing key in a secure element. Minimal implementation that doesn't call any driver method and just lets the application declare whatever it wants.
2019-08-05 13:55:54 +00:00
/* For a key in a secure element, we need to do three things
SE support: Use a transaction when registering a key When registering a key in a secure element, go through the transaction mechanism. This makes the code simpler, at the expense of a few extra storage operations. Given that registering a key is typically very rare over the lifetime of a device, this is an acceptable loss. Drivers must now have a p_validate_slot_number method, otherwise registering a key is not possible. This reduces the risk that due to a mistake during the integration of a device, an application might claim a slot in a way that is not supported by the driver.
2019-10-01 12:18:35 +00:00
* when creating or registering a key:
Improve comments
2019-07-25 09:32:45 +00:00
* create the key file in internal storage, create the
* key inside the secure element, and update the driver's
* persistent data. Start a transaction that will encompass these
* three actions. */
/* The first thing to do is to find a slot number for the new key.
* We save the slot number in persistent storage as part of the
* transaction data. It will be needed to recover if the power
* fails during the key creation process, to clean up on the secure
* element side after restarting. Obtaining a slot number from the
* secure element driver updates its persistent state, but we do not yet
* save the driver's persistent state, so that if the power fails,
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 17:30:34 +00:00
* we can roll back to a state where the key doesn't exist. */
SE support: Use a transaction when registering a key When registering a key in a secure element, go through the transaction mechanism. This makes the code simpler, at the expense of a few extra storage operations. Given that registering a key is typically very rare over the lifetime of a device, this is an acceptable loss. Drivers must now have a p_validate_slot_number method, otherwise registering a key is not possible. This reduces the risk that due to a mistake during the integration of a device, an application might claim a slot in a way that is not supported by the driver.
2019-10-01 12:18:35 +00:00
if( *p_drv != NULL )
SE keys: allocate a slot before creating the key
2019-07-12 21:46:04 +00:00
{
Pass the key creation method to drivers Pass the key creation method (import/generate/derive/copy) to the driver methods to allocate or validate a slot number. This allows drivers to enforce policies such as "this key slot can only be used for keys generated inside the secure element".
2019-08-05 14:44:14 +00:00
status = psa_find_se_slot_for_key( attributes, method, *p_drv,
SE keys: allocate a slot before creating the key
2019-07-12 21:46:04 +00:00
&slot->data.se.slot_number );
if( status != PSA_SUCCESS )
return( status );
Bug fix: don't start a transaction for non-SE keys
2019-07-25 15:38:34 +00:00
psa_crypto_prepare_transaction( PSA_CRYPTO_TRANSACTION_CREATE_KEY );
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
Bug fix: don't start a transaction for non-SE keys
2019-07-25 15:38:34 +00:00
psa_crypto_transaction.key.slot = slot->data.se.slot_number;
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
psa_crypto_transaction.key.id = slot->attr.id;
Bug fix: don't start a transaction for non-SE keys
2019-07-25 15:38:34 +00:00
status = psa_crypto_save_transaction( );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
if( status != PSA_SUCCESS )
If starting a transaction fails, wipe the transaction data Nothing has been saved to disk yet, but there is stale data in psa_crypto_transaction. This stale data should not be reused, but do wipe it to reduce the risk of it mattering somehow in the future.
2019-07-25 16:02:52 +00:00
{
(void) psa_crypto_stop_transaction( );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
return( status );
If starting a transaction fails, wipe the transaction data Nothing has been saved to disk yet, but there is stale data in psa_crypto_transaction. This stale data should not be reused, but do wipe it to reduce the risk of it mattering somehow in the future.
2019-07-25 16:02:52 +00:00
}
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
}
SE support: Use a transaction when registering a key When registering a key in a secure element, go through the transaction mechanism. This makes the code simpler, at the expense of a few extra storage operations. Given that registering a key is typically very rare over the lifetime of a device, this is an acceptable loss. Drivers must now have a p_validate_slot_number method, otherwise registering a key is not possible. This reduces the risk that due to a mistake during the integration of a device, an application might claim a slot in a way that is not supported by the driver.
2019-10-01 12:18:35 +00:00
if( *p_drv == NULL && method == PSA_KEY_CREATION_REGISTER )
{
/* Key registration only makes sense with a secure element. */
return( PSA_ERROR_INVALID_ARGUMENT );
}
SE keys: allocate a slot before creating the key
2019-07-12 21:46:04 +00:00
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
return( status );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
}
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
/** Finalize the creation of a key once its key material has been set.
*
* This entails writing the key to persistent storage.
*
* If this function fails, call psa_fail_key_creation().
Document the key creation flow (start, variable, finish, and fail)
2019-04-28 09:37:03 +00:00
* See the documentation of psa_start_key_creation() for the intended use
* of this function.
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
*
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
* \param[in,out] slot Pointer to the slot with key material.
* \param[in] driver The secure element driver for the key,
* or NULL for a transparent key.
Document the key creation flow (start, variable, finish, and fail)
2019-04-28 09:37:03 +00:00
*
* \retval #PSA_SUCCESS
* The key was successfully created. The handle is now valid.
* \return If this function fails, the key slot is an invalid state.
* You must call psa_fail_key_creation() to wipe and free the slot.
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
*/
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
static psa_status_t psa_finish_key_creation(
psa_key_slot_t *slot,
Driver table entries are now mutable Since driver table entries contain the driver context, which is mutable, they can't be const anymore.
2019-07-12 21:40:35 +00:00
psa_se_drv_table_entry_t *driver )
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
{
psa_status_t status = PSA_SUCCESS;
Fix build errors with MBEDTLS_PSA_CRYPTO_STORAGE_C disabled
2019-04-25 11:47:40 +00:00
(void) slot;
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
(void) driver;
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( slot->attr.lifetime != PSA_KEY_LIFETIME_VOLATILE )
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
{
SE keys: implement persistent storage For a key in a secure element, persist the key slot. This is implemented in the nominal case. Failures may not be handled properly.
2019-07-23 14:13:14 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
if( driver != NULL )
{
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 19:32:04 +00:00
psa_se_key_data_storage_t data;
#if defined(static_assert)
static_assert( sizeof( slot->data.se.slot_number ) ==
sizeof( data.slot_number ),
"Slot number size does not match psa_se_key_data_storage_t" );
static_assert( sizeof( slot->attr.bits ) == sizeof( data.bits ),
"Bit-size size does not match psa_se_key_data_storage_t" );
#endif
memcpy( &data.slot_number, &slot->data.se.slot_number,
sizeof( slot->data.se.slot_number ) );
memcpy( &data.bits, &slot->attr.bits,
sizeof( slot->attr.bits ) );
Take advantage of psa_core_key_attributes_t internally #2 Key creation and psa_get_key_attributes
2019-07-31 12:15:34 +00:00
status = psa_save_persistent_key( &slot->attr,
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 19:32:04 +00:00
(uint8_t*) &data,
sizeof( data ) );
SE keys: implement persistent storage For a key in a secure element, persist the key slot. This is implemented in the nominal case. Failures may not be handled properly.
2019-07-23 14:13:14 +00:00
}
else
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
{
SE keys: save the bit size in storage For a key in a secure element, save the bit size alongside the slot number. This is a quick-and-dirty implementation where the storage format depends on sizeof(size_t), which is fragile. This should be replaced by a more robust implementation before going into production.
2019-07-24 18:27:59 +00:00
size_t buffer_size =
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
PSA_KEY_EXPORT_MAX_SIZE( slot->attr.type,
Take advantage of psa_core_key_attributes_t internally #2 Key creation and psa_get_key_attributes
2019-07-31 12:15:34 +00:00
slot->attr.bits );
SE keys: save the bit size in storage For a key in a secure element, save the bit size alongside the slot number. This is a quick-and-dirty implementation where the storage format depends on sizeof(size_t), which is fragile. This should be replaced by a more robust implementation before going into production.
2019-07-24 18:27:59 +00:00
uint8_t *buffer = mbedtls_calloc( 1, buffer_size );
size_t length = 0;
Remove special handling for zero-length keys Zero-length keys are rejected at creation time, so we don't need any special handling internally. When exporting a key, we do need to take care of the case where the output buffer is empty, but this is easy: an empty output buffer is never valid.
2019-09-12 17:20:29 +00:00
if( buffer == NULL )
SE keys: implement persistent storage For a key in a secure element, persist the key slot. This is implemented in the nominal case. Failures may not be handled properly.
2019-07-23 14:13:14 +00:00
return( PSA_ERROR_INSUFFICIENT_MEMORY );
status = psa_internal_export_key( slot,
buffer, buffer_size, &length,
0 );
SE keys: save the bit size in storage For a key in a secure element, save the bit size alongside the slot number. This is a quick-and-dirty implementation where the storage format depends on sizeof(size_t), which is fragile. This should be replaced by a more robust implementation before going into production.
2019-07-24 18:27:59 +00:00
if( status == PSA_SUCCESS )
Take advantage of psa_core_key_attributes_t internally #2 Key creation and psa_get_key_attributes
2019-07-31 12:15:34 +00:00
status = psa_save_persistent_key( &slot->attr,
Switch storage functions over to psa_core_key_attributes_t
2019-07-30 18:22:33 +00:00
buffer, length );
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
Remove special handling for zero-length keys Zero-length keys are rejected at creation time, so we don't need any special handling internally. When exporting a key, we do need to take care of the case where the output buffer is empty, but this is easy: an empty output buffer is never valid.
2019-09-12 17:20:29 +00:00
mbedtls_platform_zeroize( buffer, buffer_size );
SE keys: implement persistent storage For a key in a secure element, persist the key slot. This is implemented in the nominal case. Failures may not be handled properly.
2019-07-23 14:13:14 +00:00
mbedtls_free( buffer );
}
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
}
#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
SE keys: allocate a slot before creating the key
2019-07-12 21:46:04 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
New function mbedtls_psa_register_se_key Register an existing key in a secure element. Minimal implementation that doesn't call any driver method and just lets the application declare whatever it wants.
2019-08-05 13:55:54 +00:00
/* Finish the transaction for a key creation. This does not
* happen when registering an existing key. Detect this case
* by checking whether a transaction is in progress (actual
* creation of a key in a secure element requires a transaction,
* but registration doesn't use one). */
if( driver != NULL &&
psa_crypto_transaction.unknown.type == PSA_CRYPTO_TRANSACTION_CREATE_KEY )
SE keys: allocate a slot before creating the key
2019-07-12 21:46:04 +00:00
{
status = psa_save_se_persistent_data( driver );
if( status != PSA_SUCCESS )
{
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
psa_destroy_persistent_key( slot->attr.id );
SE keys: allocate a slot before creating the key
2019-07-12 21:46:04 +00:00
return( status );
}
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 17:30:34 +00:00
status = psa_crypto_stop_transaction( );
if( status != PSA_SUCCESS )
return( status );
SE keys: allocate a slot before creating the key
2019-07-12 21:46:04 +00:00
}
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
return( status );
}
/** Abort the creation of a key.
*
* You may call this function after calling psa_start_key_creation(),
* or after psa_finish_key_creation() fails. In other circumstances, this
* function may not clean up persistent storage.
Document the key creation flow (start, variable, finish, and fail)
2019-04-28 09:37:03 +00:00
* See the documentation of psa_start_key_creation() for the intended use
* of this function.
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
*
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
* \param[in,out] slot Pointer to the slot with key material.
* \param[in] driver The secure element driver for the key,
* or NULL for a transparent key.
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
*/
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
static void psa_fail_key_creation( psa_key_slot_t *slot,
Driver table entries are now mutable Since driver table entries contain the driver context, which is mutable, they can't be const anymore.
2019-07-12 21:40:35 +00:00
psa_se_drv_table_entry_t *driver )
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
{
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
(void) driver;
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
if( slot == NULL )
return;
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Make TODO comments consistent
2019-08-13 11:15:34 +00:00
/* TODO: If the key has already been created in the secure
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
* element, and the failure happened later (when saving metadata
* to internal storage), we need to destroy the key in the secure
Add issue numbers for some missing parts of secure element support
2019-08-13 14:17:16 +00:00
* element.
* https://github.com/ARMmbed/mbed-crypto/issues/217
*/
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 17:30:34 +00:00
New function mbedtls_psa_register_se_key Register an existing key in a secure element. Minimal implementation that doesn't call any driver method and just lets the application declare whatever it wants.
2019-08-05 13:55:54 +00:00
/* Abort the ongoing transaction if any (there may not be one if
* the creation process failed before starting one, or if the
* key creation is a registration of a key in a secure element).
* Earlier functions must already have done what it takes to undo any
* partial creation. All that's left is to update the transaction data
* itself. */
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 17:30:34 +00:00
(void) psa_crypto_stop_transaction( );
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
psa_wipe_key_slot( slot );
}
More refactoring: consolidate attribute validation Consolidate attribute validation at the beginning of key creation into a single function. Improve comments.
2019-07-31 15:21:46 +00:00
/** Validate optional attributes during key creation.
*
* Some key attributes are optional during key creation. If they are
* specified in the attributes structure, check that they are consistent
* with the data in the slot.
*
* This function should be called near the end of key creation, after
* the slot in memory is fully populated but before saving persistent data.
*/
static psa_status_t psa_validate_optional_attributes(
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 14:57:15 +00:00
const psa_key_slot_t *slot,
const psa_key_attributes_t *attributes )
{
Move attribute fields to a substructure Move the "core attributes" to a substructure of psa_key_attribute_t. The motivation is to be able to use the new structure psa_core_key_attributes_t internally.
2019-07-30 11:48:52 +00:00
if( attributes->core.type != 0 )
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 14:57:15 +00:00
{
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( attributes->core.type != slot->attr.type )
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 14:57:15 +00:00
return( PSA_ERROR_INVALID_ARGUMENT );
}
if( attributes->domain_parameters_size != 0 )
{
#if defined(MBEDTLS_RSA_C)
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 14:57:15 +00:00
{
mbedtls_mpi actual, required;
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 14:57:15 +00:00
mbedtls_mpi_init( &actual );
mbedtls_mpi_init( &required );
ret = mbedtls_rsa_export( slot->data.rsa,
NULL, NULL, NULL, NULL, &actual );
if( ret != 0 )
goto rsa_exit;
ret = mbedtls_mpi_read_binary( &required,
attributes->domain_parameters,
attributes->domain_parameters_size );
if( ret != 0 )
goto rsa_exit;
if( mbedtls_mpi_cmp_mpi( &actual, &required ) != 0 )
ret = MBEDTLS_ERR_RSA_BAD_INPUT_DATA;
rsa_exit:
mbedtls_mpi_free( &actual );
mbedtls_mpi_free( &required );
if( ret != 0)
return( mbedtls_to_psa_error( ret ) );
}
else
#endif
{
return( PSA_ERROR_INVALID_ARGUMENT );
}
}
Move attribute fields to a substructure Move the "core attributes" to a substructure of psa_key_attribute_t. The motivation is to be able to use the new structure psa_core_key_attributes_t internally.
2019-07-30 11:48:52 +00:00
if( attributes->core.bits != 0 )
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 14:57:15 +00:00
{
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 19:32:04 +00:00
if( attributes->core.bits != slot->attr.bits )
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 14:57:15 +00:00
return( PSA_ERROR_INVALID_ARGUMENT );
}
return( PSA_SUCCESS );
}
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
psa_status_t psa_import_key( const psa_key_attributes_t *attributes,
const uint8_t *data,
Put handle parameter last: psa_import_key In psa_import_key, change the order of parameters to pass the pointer where the newly created handle will be stored last. This is consistent with most other library functions that put inputs before outputs.
2019-05-15 18:15:10 +00:00
size_t data_length,
psa_key_handle_t *handle )
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
{
psa_status_t status;
psa_key_slot_t *slot = NULL;
Driver table entries are now mutable Since driver table entries contain the driver context, which is mutable, they can't be const anymore.
2019-07-12 21:40:35 +00:00
psa_se_drv_table_entry_t *driver = NULL;
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 14:57:15 +00:00
Reject keys of size 0 Implement the prohibition on keys of size 0.
2019-09-12 17:03:13 +00:00
/* Reject zero-length symmetric keys (including raw data key objects).
* This also rejects any key which might be encoded as an empty string,
* which is never valid. */
if( data_length == 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
psa_start_key_creation: take the method as a parameter Let psa_start_key_creation know what type of key creation this is. This will be used at least for key registration in a secure element, which is a peculiar kind of creation since it uses existing key material.
2019-07-15 20:02:14 +00:00
status = psa_start_key_creation( PSA_KEY_CREATION_IMPORT, attributes,
handle, &slot, &driver );
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 14:57:15 +00:00
if( status != PSA_SUCCESS )
goto exit;
SE keys: support import and export
2019-07-12 21:47:28 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
if( driver != NULL )
{
const psa_drv_se_t *drv = psa_get_se_driver_methods( driver );
Initialize key bits to max size + 1 in psa_import_key In psa_import_key, the key bits value was uninitialized before calling the secure element driver import function. There is a potential issue if the driver returns PSA_SUCCESS without setting the key bits. This shouldn't happen, but shouldn't be discounted either, so we initialize the key bits to an invalid issue.
2019-08-20 08:50:14 +00:00
/* The driver should set the number of key bits, however in
* case it doesn't, we initialize bits to an invalid value. */
size_t bits = PSA_MAX_KEY_BITS + 1;
SE keys: support import and export
2019-07-12 21:47:28 +00:00
if( drv->key_management == NULL ||
drv->key_management->p_import == NULL )
{
status = PSA_ERROR_NOT_SUPPORTED;
goto exit;
}
status = drv->key_management->p_import(
psa_get_se_driver_context( driver ),
Update import_key and generate_key SE methods to the current API The methods to import and generate a key in a secure element drivers were written for an earlier version of the application-side interface. Now that there is a psa_key_attributes_t structure that combines all key metadata including its lifetime (location), type, size, policy and extra type-specific data (domain parameters), pass that to drivers instead of separate arguments for each piece of metadata. This makes the interface less cluttered. Update parameter names and descriptions to follow general conventions. Document the public-key output on key generation more precisely. Explain that it is optional in a driver, and when a driver would implement it. Declare that it is optional in the core, too (which means that a crypto core might not support drivers for secure elements that do need this feature). Update the implementation and the tests accordingly.
2019-08-06 15:32:04 +00:00
slot->data.se.slot_number, attributes, data, data_length,
Store the key size in the slot in memory There is now a field for the key size in the key slot in memory. Use it. This makes psa_get_key_attributes() marginally faster at the expense of memory that is available anyway in the current memory layout (16 bits for the size, 16 bits for flags). That's not the goal, though: the goal is to simplify the code, in particular to make it more uniform between transparent keys (whose size can be recomputed) and keys in secure elements (whose size cannot be recomputed). For keys in a secure element, the bit size is now saved by serializing the type psa_key_bits_t (which is an alias for uint16_t) rather than size_t.
2019-07-30 19:32:04 +00:00
&bits );
if( status != PSA_SUCCESS )
goto exit;
if( bits > PSA_MAX_KEY_BITS )
{
status = PSA_ERROR_NOT_SUPPORTED;
goto exit;
}
slot->attr.bits = (psa_key_bits_t) bits;
SE keys: support import and export
2019-07-12 21:47:28 +00:00
}
else
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
{
status = psa_import_key_into_slot( slot, data, data_length );
if( status != PSA_SUCCESS )
goto exit;
}
More refactoring: consolidate attribute validation Consolidate attribute validation at the beginning of key creation into a single function. Improve comments.
2019-07-31 15:21:46 +00:00
status = psa_validate_optional_attributes( slot, attributes );
SE driver: report the bit size on key import Add a parameter to the key import method of a secure element driver to make it report the key size in bits. This is necessary (otherwise the core has no idea what the bit-size is), and making import report it is easier than adding a separate method (for other key creation methods, this information is an input, not an output).
2019-07-24 18:25:59 +00:00
if( status != PSA_SUCCESS )
goto exit;
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 14:57:15 +00:00
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
status = psa_finish_key_creation( slot, driver );
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 14:57:15 +00:00
exit:
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
if( status != PSA_SUCCESS )
{
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
psa_fail_key_creation( slot, driver );
Implement atomic-creation psa_import_key Implement the new, attribute-based psa_import_key and some basic functions to access psa_key_attributes_t. Replace psa_import_key_to_handle by psa_import_key in a few test functions. This commit does not handle persistence attributes yet.
2019-04-17 13:05:45 +00:00
*handle = 0;
}
return( status );
}
New function mbedtls_psa_register_se_key Register an existing key in a secure element. Minimal implementation that doesn't call any driver method and just lets the application declare whatever it wants.
2019-08-05 13:55:54 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
psa_status_t mbedtls_psa_register_se_key(
const psa_key_attributes_t *attributes )
{
psa_status_t status;
psa_key_slot_t *slot = NULL;
psa_se_drv_table_entry_t *driver = NULL;
psa_key_handle_t handle = 0;
/* Leaving attributes unspecified is not currently supported.
* It could make sense to query the key type and size from the
* secure element, but not all secure elements support this
* and the driver HAL doesn't currently support it. */
if( psa_get_key_type( attributes ) == PSA_KEY_TYPE_NONE )
return( PSA_ERROR_NOT_SUPPORTED );
if( psa_get_key_bits( attributes ) == 0 )
return( PSA_ERROR_NOT_SUPPORTED );
status = psa_start_key_creation( PSA_KEY_CREATION_REGISTER, attributes,
&handle, &slot, &driver );
if( status != PSA_SUCCESS )
goto exit;
status = psa_finish_key_creation( slot, driver );
exit:
if( status != PSA_SUCCESS )
{
psa_fail_key_creation( slot, driver );
}
/* Registration doesn't keep the key in RAM. */
psa_close_key( handle );
return( status );
}
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
static psa_status_t psa_copy_key_material( const psa_key_slot_t *source,
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 19:44:46 +00:00
psa_key_slot_t *target )
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
{
psa_status_t status;
uint8_t *buffer = NULL;
size_t buffer_size = 0;
size_t length;
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
buffer_size = PSA_KEY_EXPORT_MAX_SIZE( source->attr.type,
Implement missing attributes setters and getters
2019-04-18 10:53:01 +00:00
psa_get_key_slot_bits( source ) );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
buffer = mbedtls_calloc( 1, buffer_size );
Remove special handling for zero-length keys Zero-length keys are rejected at creation time, so we don't need any special handling internally. When exporting a key, we do need to take care of the case where the output buffer is empty, but this is easy: an empty output buffer is never valid.
2019-09-12 17:20:29 +00:00
if( buffer == NULL )
Fix memory leak in psa_copy_key
2019-01-23 09:55:43 +00:00
return( PSA_ERROR_INSUFFICIENT_MEMORY );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
status = psa_internal_export_key( source, buffer, buffer_size, &length, 0 );
if( status != PSA_SUCCESS )
goto exit;
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
target->attr.type = source->attr.type;
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 19:44:46 +00:00
status = psa_import_key_into_slot( target, buffer, length );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
exit:
Remove special handling for zero-length keys Zero-length keys are rejected at creation time, so we don't need any special handling internally. When exporting a key, we do need to take care of the case where the output buffer is empty, but this is easy: an empty output buffer is never valid.
2019-09-12 17:20:29 +00:00
mbedtls_platform_zeroize( buffer, buffer_size );
Fix memory leak in psa_copy_key
2019-01-23 09:55:43 +00:00
mbedtls_free( buffer );
New function psa_copy_key Copy a key from one slot to another. Implemented and smoke-tested.
2019-01-19 12:40:11 +00:00
return( status );
}
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 19:44:46 +00:00
psa_status_t psa_copy_key( psa_key_handle_t source_handle,
const psa_key_attributes_t *specified_attributes,
psa_key_handle_t *target_handle )
{
psa_status_t status;
psa_key_slot_t *source_slot = NULL;
psa_key_slot_t *target_slot = NULL;
psa_key_attributes_t actual_attributes = *specified_attributes;
Driver table entries are now mutable Since driver table entries contain the driver context, which is mutable, they can't be const anymore.
2019-07-12 21:40:35 +00:00
psa_se_drv_table_entry_t *driver = NULL;
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 19:44:46 +00:00
SE keys: ensure that functions that lack support properly error out Introduce a new function psa_get_transparent_key which returns NOT_SUPPORTED if the key is in a secure element. Use this function in functions that don't support keys in a secure element. After this commit, all functions that access a key slot directly via psa_get_key_slot or psa_get_key_from_slot rather than via psa_get_transparent_key have at least enough support for secure elements not to crash or otherwise cause undefined behavior. Lesser bad behavior such as wrong results or resource leakage is still possible in error cases.
2019-07-24 11:30:31 +00:00
status = psa_get_transparent_key( source_handle, &source_slot,
Fix indentation
2019-07-25 08:51:03 +00:00
PSA_KEY_USAGE_COPY, 0 );
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 19:44:46 +00:00
if( status != PSA_SUCCESS )
goto exit;
More refactoring: consolidate attribute validation Consolidate attribute validation at the beginning of key creation into a single function. Improve comments.
2019-07-31 15:21:46 +00:00
status = psa_validate_optional_attributes( source_slot,
specified_attributes );
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 14:57:15 +00:00
if( status != PSA_SUCCESS )
goto exit;
Move attribute fields to a substructure Move the "core attributes" to a substructure of psa_key_attribute_t. The motivation is to be able to use the new structure psa_core_key_attributes_t internally.
2019-07-30 11:48:52 +00:00
status = psa_restrict_key_policy( &actual_attributes.core.policy,
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
&source_slot->attr.policy );
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 19:44:46 +00:00
if( status != PSA_SUCCESS )
goto exit;
psa_start_key_creation: take the method as a parameter Let psa_start_key_creation know what type of key creation this is. This will be used at least for key registration in a secure element, which is a peculiar kind of creation since it uses existing key material.
2019-07-15 20:02:14 +00:00
status = psa_start_key_creation( PSA_KEY_CREATION_COPY,
&actual_attributes,
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
target_handle, &target_slot, &driver );
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 19:44:46 +00:00
if( status != PSA_SUCCESS )
goto exit;
SE keys: error out in key creation function that lack support
2019-07-24 11:44:30 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
if( driver != NULL )
{
/* Copying to a secure element is not implemented yet. */
status = PSA_ERROR_NOT_SUPPORTED;
goto exit;
}
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 19:44:46 +00:00
status = psa_copy_key_material( source_slot, target_slot );
Check unused attributes in import and copy In psa_import_key and psa_copy_key, some information comes from the key data (input buffer or source key) rather than from the attributes: key size for import, key size and type and domain parameters for copy. If an unused attribute is nonzero in the attribute structure, check that it matches the correct value. This protects against application errors.
2019-05-03 14:57:15 +00:00
if( status != PSA_SUCCESS )
goto exit;
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 19:44:46 +00:00
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
status = psa_finish_key_creation( target_slot, driver );
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 19:44:46 +00:00
exit:
if( status != PSA_SUCCESS )
{
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
psa_fail_key_creation( target_slot, driver );
Implement psa_get_key_attributes Implement attribute querying. Test attribute getters and setters. Use psa_get_key_attributes instead of the deprecated functions psa_get_key_policy or psa_get_key_information in most tests.
2019-04-18 19:44:46 +00:00
*target_handle = 0;
}
return( status );
}
Be more consistent about blank lines
2018-06-18 19:49:39 +00:00
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
/****************************************************************/
/* Message digests */
/****************************************************************/
Fixed -Wunused warnings when building without asymmetric crypto
2019-10-10 18:36:12 +00:00
#if defined(MBEDTLS_RSA_C) || defined(MBEDTLS_ECDSA_DETERMINISTIC)
Rename xxx_of_psa functions to xxx_from_psa Be consistent with how similar functions are named in Mbed TLS.
2018-03-07 15:42:59 +00:00
static const mbedtls_md_info_t *mbedtls_md_info_from_psa( psa_algorithm_t alg )
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
{
switch( alg )
{
#if defined(MBEDTLS_MD2_C)
case PSA_ALG_MD2:
return( &mbedtls_md2_info );
#endif
#if defined(MBEDTLS_MD4_C)
case PSA_ALG_MD4:
return( &mbedtls_md4_info );
#endif
#if defined(MBEDTLS_MD5_C)
case PSA_ALG_MD5:
return( &mbedtls_md5_info );
#endif
#if defined(MBEDTLS_RIPEMD160_C)
case PSA_ALG_RIPEMD160:
return( &mbedtls_ripemd160_info );
#endif
#if defined(MBEDTLS_SHA1_C)
case PSA_ALG_SHA_1:
return( &mbedtls_sha1_info );
#endif
#if defined(MBEDTLS_SHA256_C)
case PSA_ALG_SHA_224:
return( &mbedtls_sha224_info );
case PSA_ALG_SHA_256:
return( &mbedtls_sha256_info );
#endif
#if defined(MBEDTLS_SHA512_C)
Implement NO_SHA384 in MD layer and PSA
2019-07-17 14:28:21 +00:00
#if !defined(MBEDTLS_SHA512_NO_SHA384)
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
case PSA_ALG_SHA_384:
return( &mbedtls_sha384_info );
Implement NO_SHA384 in MD layer and PSA
2019-07-17 14:28:21 +00:00
#endif
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
case PSA_ALG_SHA_512:
return( &mbedtls_sha512_info );
#endif
default:
return( NULL );
}
}
Fixed -Wunused warnings when building without asymmetric crypto
2019-10-10 18:36:12 +00:00
#endif
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
psa_status_t psa_hash_abort( psa_hash_operation_t *operation )
{
switch( operation->alg )
{
psa_hash_abort: return PSA_SUCCESS if alg=0 Make psa_hash_abort consistent with psa_mac_abort and psa_cipher_abort. Add a comment explaining the reasoning.
2018-06-26 13:04:31 +00:00
case 0:
/* The object has (apparently) been initialized but it is not
* in use. It's ok to call abort on such an object, and there's
* nothing to do. */
break;
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
#if defined(MBEDTLS_MD2_C)
case PSA_ALG_MD2:
mbedtls_md2_free( &operation->ctx.md2 );
break;
#endif
#if defined(MBEDTLS_MD4_C)
case PSA_ALG_MD4:
mbedtls_md4_free( &operation->ctx.md4 );
break;
#endif
#if defined(MBEDTLS_MD5_C)
case PSA_ALG_MD5:
mbedtls_md5_free( &operation->ctx.md5 );
break;
#endif
#if defined(MBEDTLS_RIPEMD160_C)
case PSA_ALG_RIPEMD160:
mbedtls_ripemd160_free( &operation->ctx.ripemd160 );
break;
#endif
#if defined(MBEDTLS_SHA1_C)
case PSA_ALG_SHA_1:
mbedtls_sha1_free( &operation->ctx.sha1 );
break;
#endif
#if defined(MBEDTLS_SHA256_C)
case PSA_ALG_SHA_224:
case PSA_ALG_SHA_256:
mbedtls_sha256_free( &operation->ctx.sha256 );
break;
#endif
#if defined(MBEDTLS_SHA512_C)
case PSA_ALG_SHA_384:
case PSA_ALG_SHA_512:
mbedtls_sha512_free( &operation->ctx.sha512 );
break;
#endif
default:
In abort functions, return BAD_STATE on obviously bad input psa_hash_abort, psa_mac_abort and psa_cipher_abort now return PSA_ERROR_BAD_STATE if operation->alg is obviously not valid, which can only happen due to a programming error in the caller or in the library. We can't detect all cases of calling abort on uninitialized memory but this is dirt cheap and better than nothing.
2018-06-21 14:57:07 +00:00
return( PSA_ERROR_BAD_STATE );
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
}
operation->alg = 0;
return( PSA_SUCCESS );
}
Rename psa_hash_start -> psa_hash_setup Make function names for multipart operations more consistent (hash edition).
2018-07-08 17:46:38 +00:00
psa_status_t psa_hash_setup( psa_hash_operation_t *operation,
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
psa_algorithm_t alg )
{
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
psa: Disallow repeated setup Calling psa_*_setup() twice on a MAC, cipher, or hash context should result in a PSA_ERROR_BAD_STATE error because the operation has already been set up. Fixes #10
2019-02-19 09:25:10 +00:00
/* A context must be freshly initialized before it can be set up. */
if( operation->alg != 0 )
{
return( PSA_ERROR_BAD_STATE );
}
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
switch( alg )
{
#if defined(MBEDTLS_MD2_C)
case PSA_ALG_MD2:
mbedtls_md2_init( &operation->ctx.md2 );
ret = mbedtls_md2_starts_ret( &operation->ctx.md2 );
break;
#endif
#if defined(MBEDTLS_MD4_C)
case PSA_ALG_MD4:
mbedtls_md4_init( &operation->ctx.md4 );
ret = mbedtls_md4_starts_ret( &operation->ctx.md4 );
break;
#endif
#if defined(MBEDTLS_MD5_C)
case PSA_ALG_MD5:
mbedtls_md5_init( &operation->ctx.md5 );
ret = mbedtls_md5_starts_ret( &operation->ctx.md5 );
break;
#endif
#if defined(MBEDTLS_RIPEMD160_C)
case PSA_ALG_RIPEMD160:
mbedtls_ripemd160_init( &operation->ctx.ripemd160 );
ret = mbedtls_ripemd160_starts_ret( &operation->ctx.ripemd160 );
break;
#endif
#if defined(MBEDTLS_SHA1_C)
case PSA_ALG_SHA_1:
mbedtls_sha1_init( &operation->ctx.sha1 );
ret = mbedtls_sha1_starts_ret( &operation->ctx.sha1 );
break;
#endif
#if defined(MBEDTLS_SHA256_C)
case PSA_ALG_SHA_224:
mbedtls_sha256_init( &operation->ctx.sha256 );
ret = mbedtls_sha256_starts_ret( &operation->ctx.sha256, 1 );
break;
case PSA_ALG_SHA_256:
mbedtls_sha256_init( &operation->ctx.sha256 );
ret = mbedtls_sha256_starts_ret( &operation->ctx.sha256, 0 );
break;
#endif
#if defined(MBEDTLS_SHA512_C)
case PSA_ALG_SHA_384:
mbedtls_sha512_init( &operation->ctx.sha512 );
ret = mbedtls_sha512_starts_ret( &operation->ctx.sha512, 1 );
break;
case PSA_ALG_SHA_512:
mbedtls_sha512_init( &operation->ctx.sha512 );
ret = mbedtls_sha512_starts_ret( &operation->ctx.sha512, 0 );
break;
#endif
default:
Favor INVALID_ARGUMENT over NOT_SUPPORTED for bad algorithm types In psa_hash_start, psa_mac_start and psa_cipher_setup, return PSA_ERROR_INVALID_ARGUMENT rather than PSA_ERROR_NOT_SUPPORTED when the algorithm parameter is not the right category.
2018-06-20 14:21:04 +00:00
return( PSA_ALG_IS_HASH( alg ) ?
PSA_ERROR_NOT_SUPPORTED :
PSA_ERROR_INVALID_ARGUMENT );
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
}
if( ret == 0 )
operation->alg = alg;
else
psa_hash_abort( operation );
return( mbedtls_to_psa_error( ret ) );
}
psa_status_t psa_hash_update( psa_hash_operation_t *operation,
const uint8_t *input,
size_t input_length )
{
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
psa_hash_update: robustify the case length=0 Don't require hash implementations to behave correctly on a zero-length input, which may have an invalid pointer.
2018-07-12 14:58:43 +00:00
/* Don't require hash implementations to behave correctly on a
* zero-length input, which may have an invalid pointer. */
if( input_length == 0 )
return( PSA_SUCCESS );
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
switch( operation->alg )
{
#if defined(MBEDTLS_MD2_C)
case PSA_ALG_MD2:
ret = mbedtls_md2_update_ret( &operation->ctx.md2,
input, input_length );
break;
#endif
#if defined(MBEDTLS_MD4_C)
case PSA_ALG_MD4:
ret = mbedtls_md4_update_ret( &operation->ctx.md4,
input, input_length );
break;
#endif
#if defined(MBEDTLS_MD5_C)
case PSA_ALG_MD5:
ret = mbedtls_md5_update_ret( &operation->ctx.md5,
input, input_length );
break;
#endif
#if defined(MBEDTLS_RIPEMD160_C)
case PSA_ALG_RIPEMD160:
ret = mbedtls_ripemd160_update_ret( &operation->ctx.ripemd160,
input, input_length );
break;
#endif
#if defined(MBEDTLS_SHA1_C)
case PSA_ALG_SHA_1:
ret = mbedtls_sha1_update_ret( &operation->ctx.sha1,
input, input_length );
break;
#endif
#if defined(MBEDTLS_SHA256_C)
case PSA_ALG_SHA_224:
case PSA_ALG_SHA_256:
ret = mbedtls_sha256_update_ret( &operation->ctx.sha256,
input, input_length );
break;
#endif
#if defined(MBEDTLS_SHA512_C)
case PSA_ALG_SHA_384:
case PSA_ALG_SHA_512:
ret = mbedtls_sha512_update_ret( &operation->ctx.sha512,
input, input_length );
break;
#endif
default:
psa: Disallow use of invalid hash contexts If a hash context has not been set up, fail with PSA_ERROR_BAD_STATE as documented in crypto.h and the PSA Crypto specification.
2019-02-15 13:52:25 +00:00
return( PSA_ERROR_BAD_STATE );
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
}
psa_hash_update: robustify the case length=0 Don't require hash implementations to behave correctly on a zero-length input, which may have an invalid pointer.
2018-07-12 14:58:43 +00:00
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
if( ret != 0 )
psa_hash_abort( operation );
return( mbedtls_to_psa_error( ret ) );
}
psa_status_t psa_hash_finish( psa_hash_operation_t *operation,
uint8_t *hash,
size_t hash_size,
size_t *hash_length )
{
Add missing calls to psa_hash_abort in hash functions
2018-08-02 10:14:17 +00:00
psa_status_t status;
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Switch PSA_HASH_FINAL_SIZE to PSA_HASH_SIZE Make this macro work on derived algorithms as well (HMAC, hash-and-sign, etc.).
2018-04-19 06:29:59 +00:00
size_t actual_hash_length = PSA_HASH_SIZE( operation->alg );
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
/* Fill the output buffer with something that isn't a valid hash
* (barring an attack on the hash and deliberately-crafted input),
* in case the caller doesn't check the return status properly. */
Fix safe output length in hash and mac finish In psa_hash_finish and psa_mac_finish_internal, set the fallback output length (which is reported on error) to the output buffer size, not to the _expected_ buffer size which could be larger.
2018-07-02 10:15:28 +00:00
*hash_length = hash_size;
Handle null pointers safely when used as buffers of size 0 When the size of a buffer is 0, the corresponding pointer argument may be null. In such cases, library functions must not perform arithmetic on the pointer or call standard library functions such as memset and memcpy, since that would be undefined behavior in C. Protect such cases. Refactor the storage of a 0-sized raw data object to make it store a null pointer, rather than depending on the behavior of calloc(1,0).
2018-06-28 17:31:31 +00:00
/* If hash_size is 0 then hash may be NULL and then the
* call to memset would have undefined behavior. */
if( hash_size != 0 )
memset( hash, '!', hash_size );
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
if( hash_size < actual_hash_length )
Add missing calls to psa_hash_abort in hash functions
2018-08-02 10:14:17 +00:00
{
status = PSA_ERROR_BUFFER_TOO_SMALL;
goto exit;
}
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
switch( operation->alg )
{
#if defined(MBEDTLS_MD2_C)
case PSA_ALG_MD2:
ret = mbedtls_md2_finish_ret( &operation->ctx.md2, hash );
break;
#endif
#if defined(MBEDTLS_MD4_C)
case PSA_ALG_MD4:
ret = mbedtls_md4_finish_ret( &operation->ctx.md4, hash );
break;
#endif
#if defined(MBEDTLS_MD5_C)
case PSA_ALG_MD5:
ret = mbedtls_md5_finish_ret( &operation->ctx.md5, hash );
break;
#endif
#if defined(MBEDTLS_RIPEMD160_C)
case PSA_ALG_RIPEMD160:
ret = mbedtls_ripemd160_finish_ret( &operation->ctx.ripemd160, hash );
break;
#endif
#if defined(MBEDTLS_SHA1_C)
case PSA_ALG_SHA_1:
ret = mbedtls_sha1_finish_ret( &operation->ctx.sha1, hash );
break;
#endif
#if defined(MBEDTLS_SHA256_C)
case PSA_ALG_SHA_224:
case PSA_ALG_SHA_256:
ret = mbedtls_sha256_finish_ret( &operation->ctx.sha256, hash );
break;
#endif
#if defined(MBEDTLS_SHA512_C)
case PSA_ALG_SHA_384:
case PSA_ALG_SHA_512:
ret = mbedtls_sha512_finish_ret( &operation->ctx.sha512, hash );
break;
#endif
default:
psa: Disallow use of invalid hash contexts If a hash context has not been set up, fail with PSA_ERROR_BAD_STATE as documented in crypto.h and the PSA Crypto specification.
2019-02-15 13:52:25 +00:00
return( PSA_ERROR_BAD_STATE );
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
}
Add missing calls to psa_hash_abort in hash functions
2018-08-02 10:14:17 +00:00
status = mbedtls_to_psa_error( ret );
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
Add missing calls to psa_hash_abort in hash functions
2018-08-02 10:14:17 +00:00
exit:
if( status == PSA_SUCCESS )
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
{
Fix safe output length in hash and mac finish In psa_hash_finish and psa_mac_finish_internal, set the fallback output length (which is reported on error) to the output buffer size, not to the _expected_ buffer size which could be larger.
2018-07-02 10:15:28 +00:00
*hash_length = actual_hash_length;
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
return( psa_hash_abort( operation ) );
}
else
{
psa_hash_abort( operation );
Add missing calls to psa_hash_abort in hash functions
2018-08-02 10:14:17 +00:00
return( status );
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
}
}
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 13:41:12 +00:00
psa_status_t psa_hash_verify( psa_hash_operation_t *operation,
const uint8_t *hash,
size_t hash_length )
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
{
uint8_t actual_hash[MBEDTLS_MD_MAX_SIZE];
size_t actual_hash_length;
psa_status_t status = psa_hash_finish( operation,
actual_hash, sizeof( actual_hash ),
&actual_hash_length );
if( status != PSA_SUCCESS )
return( status );
if( actual_hash_length != hash_length )
return( PSA_ERROR_INVALID_SIGNATURE );
if( safer_memcmp( hash, actual_hash, actual_hash_length ) != 0 )
return( PSA_ERROR_INVALID_SIGNATURE );
return( PSA_SUCCESS );
}
Style fix
2019-01-22 16:56:16 +00:00
psa_status_t psa_hash_clone( const psa_hash_operation_t *source_operation,
psa_hash_operation_t *target_operation )
New function psa_hash_clone Clone a hash operation. Test good cases as part as multipart tests. Add new test functions for the state machine.
2019-01-19 11:03:41 +00:00
{
if( target_operation->alg != 0 )
return( PSA_ERROR_BAD_STATE );
switch( source_operation->alg )
{
case 0:
return( PSA_ERROR_BAD_STATE );
#if defined(MBEDTLS_MD2_C)
case PSA_ALG_MD2:
mbedtls_md2_clone( &target_operation->ctx.md2,
&source_operation->ctx.md2 );
break;
#endif
#if defined(MBEDTLS_MD4_C)
case PSA_ALG_MD4:
mbedtls_md4_clone( &target_operation->ctx.md4,
&source_operation->ctx.md4 );
break;
#endif
#if defined(MBEDTLS_MD5_C)
case PSA_ALG_MD5:
mbedtls_md5_clone( &target_operation->ctx.md5,
&source_operation->ctx.md5 );
break;
#endif
#if defined(MBEDTLS_RIPEMD160_C)
case PSA_ALG_RIPEMD160:
mbedtls_ripemd160_clone( &target_operation->ctx.ripemd160,
&source_operation->ctx.ripemd160 );
break;
#endif
#if defined(MBEDTLS_SHA1_C)
case PSA_ALG_SHA_1:
mbedtls_sha1_clone( &target_operation->ctx.sha1,
&source_operation->ctx.sha1 );
break;
#endif
#if defined(MBEDTLS_SHA256_C)
case PSA_ALG_SHA_224:
case PSA_ALG_SHA_256:
mbedtls_sha256_clone( &target_operation->ctx.sha256,
&source_operation->ctx.sha256 );
break;
#endif
#if defined(MBEDTLS_SHA512_C)
case PSA_ALG_SHA_384:
case PSA_ALG_SHA_512:
mbedtls_sha512_clone( &target_operation->ctx.sha512,
&source_operation->ctx.sha512 );
break;
#endif
default:
return( PSA_ERROR_NOT_SUPPORTED );
}
target_operation->alg = source_operation->alg;
return( PSA_SUCCESS );
}
Implement hash functions New header file crypto_struct.h. The main file crypto.sh declares structures which are implementation-defined. These structures must be defined in crypto_struct.h, which is included at the end so that the structures can use types defined in crypto.h. Implement psa_hash_start, psa_hash_update and psa_hash_final. This should work for all hash algorithms supported by Mbed TLS, but has only been smoke-tested for SHA-256, and only in the nominal case.
2018-02-07 20:05:37 +00:00
/****************************************************************/
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
/* MAC */
/****************************************************************/
Rename xxx_of_psa functions to xxx_from_psa Be consistent with how similar functions are named in Mbed TLS.
2018-03-07 15:42:59 +00:00
static const mbedtls_cipher_info_t *mbedtls_cipher_info_from_psa(
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
psa_algorithm_t alg,
psa_key_type_t key_type,
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 13:41:12 +00:00
size_t key_bits,
change mbedtls_cipher_info_from_psa to provide cipher_id also
2018-06-03 12:04:51 +00:00
mbedtls_cipher_id_t* cipher_id )
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
{
mbedtls_cipher_mode_t mode;
change mbedtls_cipher_info_from_psa to provide cipher_id also
2018-06-03 12:04:51 +00:00
mbedtls_cipher_id_t cipher_id_tmp;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
Add support for non-default-tag-size AEAD (CCM and GCM)
2018-08-17 17:47:52 +00:00
if( PSA_ALG_IS_AEAD( alg ) )
Use a public macro for AEAD tag length variations Avoid depending on the encoding of algorithms inside psa_crypto.c.
2018-10-17 16:29:17 +00:00
alg = PSA_ALG_AEAD_WITH_TAG_LENGTH( alg, 0 );
Add support for non-default-tag-size AEAD (CCM and GCM)
2018-08-17 17:47:52 +00:00
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
if( PSA_ALG_IS_CIPHER( alg ) || PSA_ALG_IS_AEAD( alg ) )
{
space and style fixes
2018-06-17 11:41:30 +00:00
switch( alg )
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
{
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 12:02:45 +00:00
case PSA_ALG_ARC4:
Implement ChaCha20 and ChaCha20-Poly1305 Smoke tests: test data for ChaCha20 calculated with PyCryptodome; test vector from RFC 7539 for ChaCha20-Poly1305.
2019-05-06 13:25:00 +00:00
case PSA_ALG_CHACHA20:
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
mode = MBEDTLS_MODE_STREAM;
break;
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 12:02:45 +00:00
case PSA_ALG_CTR:
mode = MBEDTLS_MODE_CTR;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
break;
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 12:02:45 +00:00
case PSA_ALG_CFB:
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
mode = MBEDTLS_MODE_CFB;
break;
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 12:02:45 +00:00
case PSA_ALG_OFB:
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
mode = MBEDTLS_MODE_OFB;
break;
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 12:02:45 +00:00
case PSA_ALG_CBC_NO_PADDING:
mode = MBEDTLS_MODE_CBC;
break;
case PSA_ALG_CBC_PKCS7:
mode = MBEDTLS_MODE_CBC;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
break;
Use a public macro for AEAD tag length variations Avoid depending on the encoding of algorithms inside psa_crypto.c.
2018-10-17 16:29:17 +00:00
case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_CCM, 0 ):
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
mode = MBEDTLS_MODE_CCM;
break;
Use a public macro for AEAD tag length variations Avoid depending on the encoding of algorithms inside psa_crypto.c.
2018-10-17 16:29:17 +00:00
case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_GCM, 0 ):
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
mode = MBEDTLS_MODE_GCM;
break;
Implement ChaCha20 and ChaCha20-Poly1305 Smoke tests: test data for ChaCha20 calculated with PyCryptodome; test vector from RFC 7539 for ChaCha20-Poly1305.
2019-05-06 13:25:00 +00:00
case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_CHACHA20_POLY1305, 0 ):
mode = MBEDTLS_MODE_CHACHAPOLY;
break;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
default:
return( NULL );
}
}
else if( alg == PSA_ALG_CMAC )
mode = MBEDTLS_MODE_ECB;
else
return( NULL );
switch( key_type )
{
case PSA_KEY_TYPE_AES:
change mbedtls_cipher_info_from_psa to provide cipher_id also
2018-06-03 12:04:51 +00:00
cipher_id_tmp = MBEDTLS_CIPHER_ID_AES;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
break;
case PSA_KEY_TYPE_DES:
Add what little was missing to fully support DES Also add what was missing in the test suite to support block ciphers with a block size that isn't 16. Fix some buggy test data that passed only due to problems with DES support in the product.
2018-06-21 07:40:04 +00:00
/* key_bits is 64 for Single-DES, 128 for two-key Triple-DES,
* and 192 for three-key Triple-DES. */
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
if( key_bits == 64 )
change mbedtls_cipher_info_from_psa to provide cipher_id also
2018-06-03 12:04:51 +00:00
cipher_id_tmp = MBEDTLS_CIPHER_ID_DES;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
else
change mbedtls_cipher_info_from_psa to provide cipher_id also
2018-06-03 12:04:51 +00:00
cipher_id_tmp = MBEDTLS_CIPHER_ID_3DES;
Add what little was missing to fully support DES Also add what was missing in the test suite to support block ciphers with a block size that isn't 16. Fix some buggy test data that passed only due to problems with DES support in the product.
2018-06-21 07:40:04 +00:00
/* mbedtls doesn't recognize two-key Triple-DES as an algorithm,
* but two-key Triple-DES is functionally three-key Triple-DES
* with K1=K3, so that's how we present it to mbedtls. */
if( key_bits == 128 )
key_bits = 192;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
break;
case PSA_KEY_TYPE_CAMELLIA:
change mbedtls_cipher_info_from_psa to provide cipher_id also
2018-06-03 12:04:51 +00:00
cipher_id_tmp = MBEDTLS_CIPHER_ID_CAMELLIA;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
break;
case PSA_KEY_TYPE_ARC4:
change mbedtls_cipher_info_from_psa to provide cipher_id also
2018-06-03 12:04:51 +00:00
cipher_id_tmp = MBEDTLS_CIPHER_ID_ARC4;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
break;
Implement ChaCha20 and ChaCha20-Poly1305 Smoke tests: test data for ChaCha20 calculated with PyCryptodome; test vector from RFC 7539 for ChaCha20-Poly1305.
2019-05-06 13:25:00 +00:00
case PSA_KEY_TYPE_CHACHA20:
cipher_id_tmp = MBEDTLS_CIPHER_ID_CHACHA20;
break;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
default:
return( NULL );
}
change mbedtls_cipher_info_from_psa to provide cipher_id also
2018-06-03 12:04:51 +00:00
if( cipher_id != NULL )
remove unnecessary argument to the psa_aead_unpadded_locate_tag function
2018-06-03 14:20:42 +00:00
*cipher_id = cipher_id_tmp;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
psa: Pass the number of bits with explicit types The GCM, CCM, RSA, and cipher modules inconsistently use int or unsigned int for a count of bits. The PSA Crypto API uses size_t for counting things. This causes issues on LLP64 systems where a size_t can hold more than an unsigned int. Add casts for where key_bits and bits are passed to mbedtls_* APIs.
2018-06-26 13:16:54 +00:00
return( mbedtls_cipher_info_from_values( cipher_id_tmp,
(int) key_bits, mode ) );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
}
Add some missing compilation guards Add missing checks for defined(MBEDTLS_MD_C) around types and functions that require it (HMAC, HKDF, TLS12_PRF). Add missing checks for defined(MBEDTLS_ECDSA_DETERMINISTIC) around code that calls mbedtls_ecdsa_sign_det(). Add missing checks for defined(MBEDTLS_ECDH_C) around ECDH-specific functions.
2018-11-16 15:02:56 +00:00
#if defined(MBEDTLS_MD_C)
fix spaces and add braces
2018-06-18 09:24:33 +00:00
static size_t psa_get_hash_block_size( psa_algorithm_t alg )
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 11:41:10 +00:00
{
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 13:41:12 +00:00
switch( alg )
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 11:41:10 +00:00
{
case PSA_ALG_MD2:
fix spaces and add braces
2018-06-18 09:24:33 +00:00
return( 16 );
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 11:41:10 +00:00
case PSA_ALG_MD4:
fix spaces and add braces
2018-06-18 09:24:33 +00:00
return( 64 );
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 11:41:10 +00:00
case PSA_ALG_MD5:
fix spaces and add braces
2018-06-18 09:24:33 +00:00
return( 64 );
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 11:41:10 +00:00
case PSA_ALG_RIPEMD160:
fix spaces and add braces
2018-06-18 09:24:33 +00:00
return( 64 );
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 11:41:10 +00:00
case PSA_ALG_SHA_1:
fix spaces and add braces
2018-06-18 09:24:33 +00:00
return( 64 );
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 11:41:10 +00:00
case PSA_ALG_SHA_224:
fix spaces and add braces
2018-06-18 09:24:33 +00:00
return( 64 );
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 11:41:10 +00:00
case PSA_ALG_SHA_256:
fix spaces and add braces
2018-06-18 09:24:33 +00:00
return( 64 );
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 11:41:10 +00:00
case PSA_ALG_SHA_384:
fix spaces and add braces
2018-06-18 09:24:33 +00:00
return( 128 );
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 11:41:10 +00:00
case PSA_ALG_SHA_512:
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 13:41:12 +00:00
return( 128 );
default:
return( 0 );
change macro PSA_HASH_BLOCK_SIZE to function psa_get_hash_block_size
2018-06-17 11:41:10 +00:00
}
}
Add some missing compilation guards Add missing checks for defined(MBEDTLS_MD_C) around types and functions that require it (HMAC, HKDF, TLS12_PRF). Add missing checks for defined(MBEDTLS_ECDSA_DETERMINISTIC) around code that calls mbedtls_ecdsa_sign_det(). Add missing checks for defined(MBEDTLS_ECDH_C) around ECDH-specific functions.
2018-11-16 15:02:56 +00:00
#endif /* MBEDTLS_MD_C */
remove reliance on md_info context for hash information 1. remove reliance on md_info context for hash information by decoding locally 2. remove block_size field in context as this is dynamically computed
2018-06-07 10:27:47 +00:00
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 14:05:20 +00:00
/* Initialize the MAC operation structure. Once this function has been
* called, psa_mac_abort can run and will do the right thing. */
static psa_status_t psa_mac_init( psa_mac_operation_t *operation,
psa_algorithm_t alg )
{
psa_status_t status = PSA_ERROR_NOT_SUPPORTED;
operation->alg = alg;
operation->key_set = 0;
operation->iv_set = 0;
operation->iv_required = 0;
operation->has_input = 0;
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 18:12:23 +00:00
operation->is_sign = 0;
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 14:05:20 +00:00
#if defined(MBEDTLS_CMAC_C)
if( alg == PSA_ALG_CMAC )
{
operation->iv_required = 0;
mbedtls_cipher_init( &operation->ctx.cmac );
status = PSA_SUCCESS;
}
else
#endif /* MBEDTLS_CMAC_C */
#if defined(MBEDTLS_MD_C)
if( PSA_ALG_IS_HMAC( operation->alg ) )
{
Make psa_hmac_setup_internal more standalone Call psa_hash_setup in psa_hmac_setup_internal rather than psa_mac_init. This makes it easier to use psa_hmac_setup_internal on its own (for the sake of using HMAC internally inside the library).
2018-07-12 15:07:52 +00:00
/* We'll set up the hash operation later in psa_hmac_setup_internal. */
operation->ctx.hmac.hash_ctx.alg = 0;
status = PSA_SUCCESS;
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 14:05:20 +00:00
}
else
#endif /* MBEDTLS_MD_C */
{
Favor INVALID_ARGUMENT over NOT_SUPPORTED for bad algorithm types In psa_hash_start, psa_mac_start and psa_cipher_setup, return PSA_ERROR_INVALID_ARGUMENT rather than PSA_ERROR_NOT_SUPPORTED when the algorithm parameter is not the right category.
2018-06-20 14:21:04 +00:00
if( ! PSA_ALG_IS_MAC( alg ) )
status = PSA_ERROR_INVALID_ARGUMENT;
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 14:05:20 +00:00
}
if( status != PSA_SUCCESS )
memset( operation, 0, sizeof( *operation ) );
return( status );
}
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
#if defined(MBEDTLS_MD_C)
static psa_status_t psa_hmac_abort_internal( psa_hmac_internal_data *hmac )
{
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 17:14:53 +00:00
mbedtls_platform_zeroize( hmac->opad, sizeof( hmac->opad ) );
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
return( psa_hash_abort( &hmac->hash_ctx ) );
}
#endif /* MBEDTLS_MD_C */
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
psa_status_t psa_mac_abort( psa_mac_operation_t *operation )
{
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
if( operation->alg == 0 )
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
{
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
/* The object has (apparently) been initialized but it is not
* in use. It's ok to call abort on such an object, and there's
* nothing to do. */
return( PSA_SUCCESS );
}
else
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
#if defined(MBEDTLS_CMAC_C)
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
if( operation->alg == PSA_ALG_CMAC )
{
mbedtls_cipher_free( &operation->ctx.cmac );
}
else
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
#endif /* MBEDTLS_CMAC_C */
#if defined(MBEDTLS_MD_C)
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
if( PSA_ALG_IS_HMAC( operation->alg ) )
{
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
psa_hmac_abort_internal( &operation->ctx.hmac );
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
}
else
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
#endif /* MBEDTLS_MD_C */
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
{
/* Sanity check (shouldn't happen: operation->alg should
* always have been initialized to a valid value). */
goto bad_state;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
}
partly pr fix
2018-04-04 12:43:05 +00:00
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
operation->alg = 0;
operation->key_set = 0;
operation->iv_set = 0;
operation->iv_required = 0;
operation->has_input = 0;
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 18:12:23 +00:00
operation->is_sign = 0;
partly pr fix
2018-04-04 12:43:05 +00:00
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
return( PSA_SUCCESS );
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
bad_state:
/* If abort is called on an uninitialized object, we can't trust
* anything. Wipe the object in case it contains confidential data.
* This may result in a memory leak if a pointer gets overwritten,
* but it's too late to do anything about this. */
memset( operation, 0, sizeof( *operation ) );
return( PSA_ERROR_BAD_STATE );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
}
Fix build without CMAC Add missing guard for MBEDTLS_CMAC_C.
2018-06-19 09:57:35 +00:00
#if defined(MBEDTLS_CMAC_C)
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 18:12:23 +00:00
static int psa_cmac_setup( psa_mac_operation_t *operation,
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
size_t key_bits,
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 16:12:32 +00:00
psa_key_slot_t *slot,
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
const mbedtls_cipher_info_t *cipher_info )
{
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
operation->mac_size = cipher_info->block_size;
ret = mbedtls_cipher_setup( &operation->ctx.cmac, cipher_info );
if( ret != 0 )
return( ret );
ret = mbedtls_cipher_cmac_starts( &operation->ctx.cmac,
slot->data.raw.data,
key_bits );
return( ret );
}
Fix build without CMAC Add missing guard for MBEDTLS_CMAC_C.
2018-06-19 09:57:35 +00:00
#endif /* MBEDTLS_CMAC_C */
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
Add missing #ifdef guards around psa_hmac_start
2018-06-20 14:09:38 +00:00
#if defined(MBEDTLS_MD_C)
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
static psa_status_t psa_hmac_setup_internal( psa_hmac_internal_data *hmac,
const uint8_t *key,
size_t key_length,
psa_algorithm_t hash_alg )
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
{
Favor stdint.h types in internal types Use uint8_t for PSA buffers. Keep unsigned char for generic libc buffers and for mbedtls buffers.
2019-07-15 09:06:38 +00:00
uint8_t ipad[PSA_HMAC_MAX_HASH_BLOCK_SIZE];
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
size_t i;
HMAC: improve robustness checks on hash/block size In psa_mac_setup and psa_hmac_setup_internal, perform a sanity check on the hash size and the hash block size respectively. These sanity checks should only trigger on an incompletely or incorrectly implemented hash function. Remove the check on the block size in psa_hmac_finish_internal because at this point it has already been checked and used.
2018-07-15 22:36:29 +00:00
size_t hash_size = PSA_HASH_SIZE( hash_alg );
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
size_t block_size = psa_get_hash_block_size( hash_alg );
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
psa_status_t status;
HMAC: improve robustness checks on hash/block size In psa_mac_setup and psa_hmac_setup_internal, perform a sanity check on the hash size and the hash block size respectively. These sanity checks should only trigger on an incompletely or incorrectly implemented hash function. Remove the check on the block size in psa_hmac_finish_internal because at this point it has already been checked and used.
2018-07-15 22:36:29 +00:00
/* Sanity checks on block_size, to guarantee that there won't be a buffer
* overflow below. This should never trigger if the hash algorithm
* is implemented correctly. */
/* The size checks against the ipad and opad buffers cannot be written
* `block_size > sizeof( ipad ) || block_size > sizeof( hmac->opad )`
* because that triggers -Wlogical-op on GCC 7.3. */
if( block_size > sizeof( ipad ) )
return( PSA_ERROR_NOT_SUPPORTED );
if( block_size > sizeof( hmac->opad ) )
return( PSA_ERROR_NOT_SUPPORTED );
if( block_size < hash_size )
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
return( PSA_ERROR_NOT_SUPPORTED );
psa_hmac_start: reduce stack usage Store the temporary key in the long-key case (where the key is first hashed) directly into ipad. This reduces the stack usage a little, at a slight cost in complexity.
2018-06-11 16:12:58 +00:00
if( key_length > block_size )
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
{
psa_hmac_setup_internal: fix double call of psa_hash_setup In the common case (key no longer than the block size), psa_hash_setup was being called twice in succession. With current implementations this is just a small performance loss, but potentially with alternative implementations this could have lead to a memory leak.
2018-07-17 14:22:47 +00:00
status = psa_hash_setup( &hmac->hash_ctx, hash_alg );
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
if( status != PSA_SUCCESS )
psa_hmac_setup_internal: fix double call of psa_hash_setup In the common case (key no longer than the block size), psa_hash_setup was being called twice in succession. With current implementations this is just a small performance loss, but potentially with alternative implementations this could have lead to a memory leak.
2018-07-17 14:22:47 +00:00
goto cleanup;
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
status = psa_hash_update( &hmac->hash_ctx, key, key_length );
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
if( status != PSA_SUCCESS )
psa_hmac_setup_internal: add some missing cleanup on failure Clean ipad if hashing the key failed.
2018-07-17 14:24:34 +00:00
goto cleanup;
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
status = psa_hash_finish( &hmac->hash_ctx,
psa_hmac_start: reduce stack usage Store the temporary key in the long-key case (where the key is first hashed) directly into ipad. This reduces the stack usage a little, at a slight cost in complexity.
2018-06-11 16:12:58 +00:00
ipad, sizeof( ipad ), &key_length );
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
if( status != PSA_SUCCESS )
psa_hmac_setup_internal: add some missing cleanup on failure Clean ipad if hashing the key failed.
2018-07-17 14:24:34 +00:00
goto cleanup;
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
}
MAC setup: support 0-length HMAC key Avoid undefined behavior when using a 0-length HMAC key (Asan complained).
2018-07-12 15:07:03 +00:00
/* A 0-length key is not commonly used in HMAC when used as a MAC,
* but it is permitted. It is common when HMAC is used in HKDF, for
* example. Don't call `memcpy` in the 0-length because `key` could be
* an invalid pointer which would make the behavior undefined. */
else if( key_length != 0 )
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
memcpy( ipad, key, key_length );
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
psa_hmac_start: reduce stack usage Store the temporary key in the long-key case (where the key is first hashed) directly into ipad. This reduces the stack usage a little, at a slight cost in complexity.
2018-06-11 16:12:58 +00:00
/* ipad contains the key followed by garbage. Xor and fill with 0x36
* to create the ipad value. */
for( i = 0; i < key_length; i++ )
ipad[i] ^= 0x36;
memset( ipad + key_length, 0x36, block_size - key_length );
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
psa_hmac_start: reduce stack usage Store the temporary key in the long-key case (where the key is first hashed) directly into ipad. This reduces the stack usage a little, at a slight cost in complexity.
2018-06-11 16:12:58 +00:00
/* Copy the key material from ipad to opad, flipping the requisite bits,
* and filling the rest of opad with the requisite constant. */
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
for( i = 0; i < key_length; i++ )
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
hmac->opad[i] = ipad[i] ^ 0x36 ^ 0x5C;
memset( hmac->opad + key_length, 0x5C, block_size - key_length );
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
status = psa_hash_setup( &hmac->hash_ctx, hash_alg );
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
if( status != PSA_SUCCESS )
HMAC: clean up local variables containing key material In psa_mac_start, the hash of the key and ipad contain material that can be used to make HMAC calculations with the key, therefore they must be wiped. In psa_mac_finish_internal, tmp contains an intermediate value which could reveal the HMAC. This is definitely sensitive in the verify case, and marginally sensitive in the finish case (it isn't if the hash function is ideal, but it could make things worse if the hash function is partially broken).
2018-06-11 15:42:48 +00:00
goto cleanup;
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
status = psa_hash_update( &hmac->hash_ctx, ipad, block_size );
HMAC: clean up local variables containing key material In psa_mac_start, the hash of the key and ipad contain material that can be used to make HMAC calculations with the key, therefore they must be wiped. In psa_mac_finish_internal, tmp contains an intermediate value which could reveal the HMAC. This is definitely sensitive in the verify case, and marginally sensitive in the finish case (it isn't if the hash function is ideal, but it could make things worse if the hash function is partially broken).
2018-06-11 15:42:48 +00:00
cleanup:
Fix a buffer overflow in hmac_setup_internal At the end of `psa_hmac_setup_internal()`, the ipad is cleared. However, the size that was given to clear was `key_len` which is larger than the size of `ipad`.
2019-09-10 12:21:37 +00:00
mbedtls_platform_zeroize( ipad, sizeof(ipad) );
HMAC: clean up local variables containing key material In psa_mac_start, the hash of the key and ipad contain material that can be used to make HMAC calculations with the key, therefore they must be wiped. In psa_mac_finish_internal, tmp contains an intermediate value which could reveal the HMAC. This is definitely sensitive in the verify case, and marginally sensitive in the finish case (it isn't if the hash function is ideal, but it could make things worse if the hash function is partially broken).
2018-06-11 15:42:48 +00:00
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
return( status );
}
Add missing #ifdef guards around psa_hmac_start
2018-06-20 14:09:38 +00:00
#endif /* MBEDTLS_MD_C */
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 18:12:23 +00:00
static psa_status_t psa_mac_setup( psa_mac_operation_t *operation,
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 17:08:14 +00:00
psa_key_handle_t handle,
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 18:12:23 +00:00
psa_algorithm_t alg,
int is_sign )
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
{
psa_status_t status;
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 16:12:32 +00:00
psa_key_slot_t *slot;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
size_t key_bits;
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 18:12:23 +00:00
psa_key_usage_t usage =
Rename some signature-related identifiers Rename some macros and functions related to signature which are changing as part of the addition of psa_sign_message and psa_verify_message. perl -i -pe '%t = ( PSA_KEY_USAGE_SIGN => PSA_KEY_USAGE_SIGN_HASH, PSA_KEY_USAGE_VERIFY => PSA_KEY_USAGE_VERIFY_HASH, PSA_ASYMMETRIC_SIGNATURE_MAX_SIZE => PSA_SIGNATURE_MAX_SIZE, PSA_ASYMMETRIC_SIGN_OUTPUT_SIZE => PSA_SIGN_OUTPUT_SIZE, psa_asymmetric_sign => psa_sign_hash, psa_asymmetric_verify => psa_verify_hash, ); s/\b(@{[join("|", keys %t)]})\b/$t{$1}/ge' $(git ls-files . ':!:**/crypto_compat.h')
2019-11-26 16:01:59 +00:00
is_sign ? PSA_KEY_USAGE_SIGN_HASH : PSA_KEY_USAGE_VERIFY_HASH;
Favor stdint.h types in internal types Use uint8_t for PSA buffers. Keep unsigned char for generic libc buffers and for mbedtls buffers.
2019-07-15 09:06:38 +00:00
uint8_t truncated = PSA_MAC_TRUNCATED_LENGTH( alg );
New macro PSA_ALG_FULL_LENGTH_MAC Provide a documented way of constructing the full-length MAC algorithm from a truncated version.
2018-10-17 16:28:05 +00:00
psa_algorithm_t full_length_alg = PSA_ALG_FULL_LENGTH_MAC( alg );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
psa: Disallow repeated setup Calling psa_*_setup() twice on a MAC, cipher, or hash context should result in a PSA_ERROR_BAD_STATE error because the operation has already been set up. Fixes #10
2019-02-19 09:25:10 +00:00
/* A context must be freshly initialized before it can be set up. */
if( operation->alg != 0 )
{
return( PSA_ERROR_BAD_STATE );
}
Add support for truncated MAC algorithms
2018-08-14 13:18:45 +00:00
status = psa_mac_init( operation, full_length_alg );
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 14:05:20 +00:00
if( status != PSA_SUCCESS )
return( status );
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 18:12:23 +00:00
if( is_sign )
operation->is_sign = 1;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
SE keys: ensure that functions that lack support properly error out Introduce a new function psa_get_transparent_key which returns NOT_SUPPORTED if the key is in a secure element. Use this function in functions that don't support keys in a secure element. After this commit, all functions that access a key slot directly via psa_get_key_slot or psa_get_key_from_slot rather than via psa_get_transparent_key have at least enough support for secure elements not to crash or otherwise cause undefined behavior. Lesser bad behavior such as wrong results or resource leakage is still possible in error cases.
2019-07-24 11:30:31 +00:00
status = psa_get_transparent_key( handle, &slot, usage, alg );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 15:01:38 +00:00
if( status != PSA_SUCCESS )
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
goto exit;
Implement missing attributes setters and getters
2019-04-18 10:53:01 +00:00
key_bits = psa_get_key_slot_bits( slot );
Don't call psa_get_key_information internally When you have a key slot pointer, read the key type directly, and call psa_get_key_bits to get the bit size.
2018-07-06 14:07:47 +00:00
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
#if defined(MBEDTLS_CMAC_C)
Add support for truncated MAC algorithms
2018-08-14 13:18:45 +00:00
if( full_length_alg == PSA_ALG_CMAC )
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
{
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
const mbedtls_cipher_info_t *cipher_info =
Add support for truncated MAC algorithms
2018-08-14 13:18:45 +00:00
mbedtls_cipher_info_from_psa( full_length_alg,
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
slot->attr.type, key_bits, NULL );
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
if( cipher_info == NULL )
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
{
status = PSA_ERROR_NOT_SUPPORTED;
goto exit;
}
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
operation->mac_size = cipher_info->block_size;
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
ret = psa_cmac_setup( operation, key_bits, slot, cipher_info );
status = mbedtls_to_psa_error( ret );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
}
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
else
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
#endif /* MBEDTLS_CMAC_C */
#if defined(MBEDTLS_MD_C)
Add support for truncated MAC algorithms
2018-08-14 13:18:45 +00:00
if( PSA_ALG_IS_HMAC( full_length_alg ) )
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
{
Rename PSA_ALG_HMAC_HASH to PSA_ALG_HMAC_GET_HASH Be consistent with other GET_HASH macros.
2018-08-22 16:25:41 +00:00
psa_algorithm_t hash_alg = PSA_ALG_HMAC_GET_HASH( alg );
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
if( hash_alg == 0 )
{
status = PSA_ERROR_NOT_SUPPORTED;
goto exit;
}
HMAC: improve robustness checks on hash/block size In psa_mac_setup and psa_hmac_setup_internal, perform a sanity check on the hash size and the hash block size respectively. These sanity checks should only trigger on an incompletely or incorrectly implemented hash function. Remove the check on the block size in psa_hmac_finish_internal because at this point it has already been checked and used.
2018-07-15 22:36:29 +00:00
operation->mac_size = PSA_HASH_SIZE( hash_alg );
/* Sanity check. This shouldn't fail on a valid configuration. */
if( operation->mac_size == 0 ||
operation->mac_size > sizeof( operation->ctx.hmac.opad ) )
{
status = PSA_ERROR_NOT_SUPPORTED;
goto exit;
}
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( slot->attr.type != PSA_KEY_TYPE_HMAC )
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
{
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
}
HMAC: improve robustness checks on hash/block size In psa_mac_setup and psa_hmac_setup_internal, perform a sanity check on the hash size and the hash block size respectively. These sanity checks should only trigger on an incompletely or incorrectly implemented hash function. Remove the check on the block size in psa_hmac_finish_internal because at this point it has already been checked and used.
2018-07-15 22:36:29 +00:00
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
status = psa_hmac_setup_internal( &operation->ctx.hmac,
slot->data.raw.data,
slot->data.raw.bytes,
hash_alg );
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
}
else
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
#endif /* MBEDTLS_MD_C */
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
{
psa: Unused key_bits is OK When MD or CMAC are disabled, let the compiler know that it is OK that `key_bits` is set but not used by casting `key_bits` to `(void)`.
2018-11-23 15:11:20 +00:00
(void) key_bits;
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
status = PSA_ERROR_NOT_SUPPORTED;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
}
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
Add support for truncated MAC algorithms
2018-08-14 13:18:45 +00:00
if( truncated == 0 )
{
/* The "normal" case: untruncated algorithm. Nothing to do. */
}
else if( truncated < 4 )
{
Document that the minimum truncated MAC length is implementation-defined
2018-08-21 12:55:08 +00:00
/* A very short MAC is too short for security since it can be
* brute-forced. Ancient protocols with 32-bit MACs do exist,
* so we make this our minimum, even though 32 bits is still
* too small for security. */
Add support for truncated MAC algorithms
2018-08-14 13:18:45 +00:00
status = PSA_ERROR_NOT_SUPPORTED;
}
else if( truncated > operation->mac_size )
{
/* It's impossible to "truncate" to a larger length. */
status = PSA_ERROR_INVALID_ARGUMENT;
}
else
operation->mac_size = truncated;
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
exit:
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
if( status != PSA_SUCCESS )
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
{
HMAC: clean up local variables containing key material In psa_mac_start, the hash of the key and ipad contain material that can be used to make HMAC calculations with the key, therefore they must be wiped. In psa_mac_finish_internal, tmp contains an intermediate value which could reveal the HMAC. This is definitely sensitive in the verify case, and marginally sensitive in the finish case (it isn't if the hash function is ideal, but it could make things worse if the hash function is partially broken).
2018-06-11 15:42:48 +00:00
psa_mac_abort( operation );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
}
Split out CMAC and HMAC code into auxiliary functions Split algorithm-specific code out of psa_mac_start. This makes the function easier to read. The behavior is mostly unchanged. In a few cases, errors before setting a key trigger a context wipe where they didn't. This is a marginal performance loss but only cases that are an error in caller code.
2018-06-11 15:26:17 +00:00
else
{
operation->key_set = 1;
}
return( status );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
}
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 18:12:23 +00:00
psa_status_t psa_mac_sign_setup( psa_mac_operation_t *operation,
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 17:08:14 +00:00
psa_key_handle_t handle,
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 18:12:23 +00:00
psa_algorithm_t alg )
{
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 17:08:14 +00:00
return( psa_mac_setup( operation, handle, alg, 1 ) );
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 18:12:23 +00:00
}
psa_status_t psa_mac_verify_setup( psa_mac_operation_t *operation,
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 17:08:14 +00:00
psa_key_handle_t handle,
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 18:12:23 +00:00
psa_algorithm_t alg )
{
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 17:08:14 +00:00
return( psa_mac_setup( operation, handle, alg, 0 ) );
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 18:12:23 +00:00
}
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
psa_status_t psa_mac_update( psa_mac_operation_t *operation,
const uint8_t *input,
size_t input_length )
{
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
psa_status_t status = PSA_ERROR_BAD_STATE;
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
if( ! operation->key_set )
psa: Don't abort when operations are invalid In places where we detect a context is in a bad state and there is no sensitive data to clear, simply return PSA_ERROR_BAD_STATE and don't abort on behalf of the application. The application will choose what to do when it gets a bad state error. The motivation for this change is that an application should decide what to do when it misuses the API and encounters a PSA_ERROR_BAD_STATE error. The library should not attempt to abort on behalf of the application, as that may not be the correct thing to do in all circumstances.
2019-02-20 15:37:15 +00:00
return( PSA_ERROR_BAD_STATE );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
if( operation->iv_required && ! operation->iv_set )
psa: Don't abort when operations are invalid In places where we detect a context is in a bad state and there is no sensitive data to clear, simply return PSA_ERROR_BAD_STATE and don't abort on behalf of the application. The application will choose what to do when it gets a bad state error. The motivation for this change is that an application should decide what to do when it misuses the API and encounters a PSA_ERROR_BAD_STATE error. The library should not attempt to abort on behalf of the application, as that may not be the correct thing to do in all circumstances.
2019-02-20 15:37:15 +00:00
return( PSA_ERROR_BAD_STATE );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
operation->has_input = 1;
#if defined(MBEDTLS_CMAC_C)
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
if( operation->alg == PSA_ALG_CMAC )
{
int ret = mbedtls_cipher_cmac_update( &operation->ctx.cmac,
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
input, input_length );
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
status = mbedtls_to_psa_error( ret );
}
else
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
#endif /* MBEDTLS_CMAC_C */
#if defined(MBEDTLS_MD_C)
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
if( PSA_ALG_IS_HMAC( operation->alg ) )
{
status = psa_hash_update( &operation->ctx.hmac.hash_ctx, input,
input_length );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
}
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
else
#endif /* MBEDTLS_MD_C */
Commit changes to hmac to not use MD abstraction this PR is part of efforts to use "lower level" mbedTLS APIs vs "higher level" abstract APIs.
2018-06-04 13:03:32 +00:00
{
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
/* This shouldn't happen if `operation` was initialized by
* a setup function. */
psa: Don't abort when operations are invalid In places where we detect a context is in a bad state and there is no sensitive data to clear, simply return PSA_ERROR_BAD_STATE and don't abort on behalf of the application. The application will choose what to do when it gets a bad state error. The motivation for this change is that an application should decide what to do when it misuses the API and encounters a PSA_ERROR_BAD_STATE error. The library should not attempt to abort on behalf of the application, as that may not be the correct thing to do in all circumstances.
2019-02-20 15:37:15 +00:00
return( PSA_ERROR_BAD_STATE );
Commit changes to hmac to not use MD abstraction this PR is part of efforts to use "lower level" mbedTLS APIs vs "higher level" abstract APIs.
2018-06-04 13:03:32 +00:00
}
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
if( status != PSA_SUCCESS )
psa_mac_abort( operation );
Formatting improvements Avoid lines longer than 80 columns. Remove some redundant parentheses, e.g. change if( ( a == b ) && ( c == d ) ) to if( a == b && c == d ) which makes lines less long and makes the remaining parentheses more relevant. Add missing parentheses around return statements. There should be no semantic change in this commit.
2018-06-18 14:04:39 +00:00
return( status );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
}
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
#if defined(MBEDTLS_MD_C)
static psa_status_t psa_hmac_finish_internal( psa_hmac_internal_data *hmac,
uint8_t *mac,
size_t mac_size )
{
Favor stdint.h types in internal types Use uint8_t for PSA buffers. Keep unsigned char for generic libc buffers and for mbedtls buffers.
2019-07-15 09:06:38 +00:00
uint8_t tmp[MBEDTLS_MD_MAX_SIZE];
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
psa_algorithm_t hash_alg = hmac->hash_ctx.alg;
size_t hash_size = 0;
size_t block_size = psa_get_hash_block_size( hash_alg );
psa_status_t status;
status = psa_hash_finish( &hmac->hash_ctx, tmp, sizeof( tmp ), &hash_size );
if( status != PSA_SUCCESS )
return( status );
/* From here on, tmp needs to be wiped. */
status = psa_hash_setup( &hmac->hash_ctx, hash_alg );
if( status != PSA_SUCCESS )
goto exit;
status = psa_hash_update( &hmac->hash_ctx, hmac->opad, block_size );
if( status != PSA_SUCCESS )
goto exit;
status = psa_hash_update( &hmac->hash_ctx, tmp, hash_size );
if( status != PSA_SUCCESS )
goto exit;
Add support for truncated MAC algorithms
2018-08-14 13:18:45 +00:00
status = psa_hash_finish( &hmac->hash_ctx, tmp, sizeof( tmp ), &hash_size );
if( status != PSA_SUCCESS )
goto exit;
memcpy( mac, tmp, mac_size );
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
exit:
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 17:14:53 +00:00
mbedtls_platform_zeroize( tmp, hash_size );
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
return( status );
}
#endif /* MBEDTLS_MD_C */
Add static internal MAC finish function add new psa_mac_finish_internal() to be called by psa_mac_finish() and psa_mac_verify() in order to be able to check key usage separatly.
2018-04-02 15:34:15 +00:00
static psa_status_t psa_mac_finish_internal( psa_mac_operation_t *operation,
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 13:41:12 +00:00
uint8_t *mac,
Streamline cleanup logic in MAC finish Reorganize error handling code in psa_mac_finish_internal, psa_mac_sign_finish and psa_mac_verify finish to ensure that: * psa_mac_abort() is always called, on all success and error paths. * psa_mac_finish places a safe value in the output parameters on all error paths, even if abort fails.
2018-07-08 18:35:02 +00:00
size_t mac_size )
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
{
In psa_mac_finish, write a safe output even in the BAD_STATE case
2018-07-02 10:15:39 +00:00
if( ! operation->key_set )
return( PSA_ERROR_BAD_STATE );
if( operation->iv_required && ! operation->iv_set )
return( PSA_ERROR_BAD_STATE );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
if( mac_size < operation->mac_size )
return( PSA_ERROR_BUFFER_TOO_SMALL );
#if defined(MBEDTLS_CMAC_C)
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
if( operation->alg == PSA_ALG_CMAC )
{
Add support for truncated MAC algorithms
2018-08-14 13:18:45 +00:00
uint8_t tmp[PSA_MAX_BLOCK_CIPHER_BLOCK_SIZE];
int ret = mbedtls_cipher_cmac_finish( &operation->ctx.cmac, tmp );
if( ret == 0 )
Fix possible buffer overread in psa_mac_finish_internal (CMAC)
2018-08-21 12:55:49 +00:00
memcpy( mac, tmp, operation->mac_size );
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 17:14:53 +00:00
mbedtls_platform_zeroize( tmp, sizeof( tmp ) );
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
return( mbedtls_to_psa_error( ret ) );
}
else
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
#endif /* MBEDTLS_CMAC_C */
#if defined(MBEDTLS_MD_C)
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
if( PSA_ALG_IS_HMAC( operation->alg ) )
{
Isolate HMAC code into its own functions Create internal functions for HMAC operations. This prepares for two things: separating crypto-sensitive code from argument decoding and validation, and using HMAC for other purposes than a MAC inside the library (e.g. HMAC_DRBG, HKDF). No intended observable behavior change in this commit.
2018-07-12 15:04:55 +00:00
return( psa_hmac_finish_internal( &operation->ctx.hmac,
Add support for truncated MAC algorithms
2018-08-14 13:18:45 +00:00
mac, operation->mac_size ) );
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
}
else
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
#endif /* MBEDTLS_MD_C */
Simplify algorithm checking logic in MAC functions Use if-else-if chains rather than switch because many blocks apply to a class of algoritmhs rather than a single algorithm or a fixed set of algorithms. Call abort on more error paths that were missed earlier.
2018-07-08 18:51:54 +00:00
{
/* This shouldn't happen if `operation` was initialized by
* a setup function. */
return( PSA_ERROR_BAD_STATE );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
}
}
Rename psa_mac_{finish,verify} -> psa_mac_{sign,verify}_finish Make function names for multipart operations more consistent (MAC finish edition).
2018-07-08 17:56:25 +00:00
psa_status_t psa_mac_sign_finish( psa_mac_operation_t *operation,
uint8_t *mac,
size_t mac_size,
size_t *mac_length )
Add static internal MAC finish function add new psa_mac_finish_internal() to be called by psa_mac_finish() and psa_mac_verify() in order to be able to check key usage separatly.
2018-04-02 15:34:15 +00:00
{
Streamline cleanup logic in MAC finish Reorganize error handling code in psa_mac_finish_internal, psa_mac_sign_finish and psa_mac_verify finish to ensure that: * psa_mac_abort() is always called, on all success and error paths. * psa_mac_finish places a safe value in the output parameters on all error paths, even if abort fails.
2018-07-08 18:35:02 +00:00
psa_status_t status;
psa: Disallow use of invalid MAC contexts Ensure that when doing MAC operations out of order, PSA_ERROR_BAD_STATE is returned as documented in crypto.h and the PSA Crypto specification.
2019-02-15 14:05:35 +00:00
if( operation->alg == 0 )
{
return( PSA_ERROR_BAD_STATE );
}
Streamline cleanup logic in MAC finish Reorganize error handling code in psa_mac_finish_internal, psa_mac_sign_finish and psa_mac_verify finish to ensure that: * psa_mac_abort() is always called, on all success and error paths. * psa_mac_finish places a safe value in the output parameters on all error paths, even if abort fails.
2018-07-08 18:35:02 +00:00
/* Fill the output buffer with something that isn't a valid mac
* (barring an attack on the mac and deliberately-crafted input),
* in case the caller doesn't check the return status properly. */
*mac_length = mac_size;
/* If mac_size is 0 then mac may be NULL and then the
* call to memset would have undefined behavior. */
if( mac_size != 0 )
memset( mac, '!', mac_size );
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 18:12:23 +00:00
if( ! operation->is_sign )
{
psa: Don't abort when operations are invalid In places where we detect a context is in a bad state and there is no sensitive data to clear, simply return PSA_ERROR_BAD_STATE and don't abort on behalf of the application. The application will choose what to do when it gets a bad state error. The motivation for this change is that an application should decide what to do when it misuses the API and encounters a PSA_ERROR_BAD_STATE error. The library should not attempt to abort on behalf of the application, as that may not be the correct thing to do in all circumstances.
2019-02-20 15:37:15 +00:00
return( PSA_ERROR_BAD_STATE );
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 18:12:23 +00:00
}
Add static internal MAC finish function add new psa_mac_finish_internal() to be called by psa_mac_finish() and psa_mac_verify() in order to be able to check key usage separatly.
2018-04-02 15:34:15 +00:00
Streamline cleanup logic in MAC finish Reorganize error handling code in psa_mac_finish_internal, psa_mac_sign_finish and psa_mac_verify finish to ensure that: * psa_mac_abort() is always called, on all success and error paths. * psa_mac_finish places a safe value in the output parameters on all error paths, even if abort fails.
2018-07-08 18:35:02 +00:00
status = psa_mac_finish_internal( operation, mac, mac_size );
if( status == PSA_SUCCESS )
{
status = psa_mac_abort( operation );
if( status == PSA_SUCCESS )
*mac_length = operation->mac_size;
else
memset( mac, '!', mac_size );
}
else
psa_mac_abort( operation );
return( status );
Add static internal MAC finish function add new psa_mac_finish_internal() to be called by psa_mac_finish() and psa_mac_verify() in order to be able to check key usage separatly.
2018-04-02 15:34:15 +00:00
}
Rename psa_mac_{finish,verify} -> psa_mac_{sign,verify}_finish Make function names for multipart operations more consistent (MAC finish edition).
2018-07-08 17:56:25 +00:00
psa_status_t psa_mac_verify_finish( psa_mac_operation_t *operation,
const uint8_t *mac,
size_t mac_length )
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
{
Rename MBEDTLS_xxx macros in psa_crypto.c to placate check-names.sh
2018-06-18 21:25:51 +00:00
uint8_t actual_mac[PSA_MAC_MAX_SIZE];
Add static internal MAC finish function add new psa_mac_finish_internal() to be called by psa_mac_finish() and psa_mac_verify() in order to be able to check key usage separatly.
2018-04-02 15:34:15 +00:00
psa_status_t status;
psa: Disallow use of invalid MAC contexts Ensure that when doing MAC operations out of order, PSA_ERROR_BAD_STATE is returned as documented in crypto.h and the PSA Crypto specification.
2019-02-15 14:05:35 +00:00
if( operation->alg == 0 )
{
return( PSA_ERROR_BAD_STATE );
}
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 18:12:23 +00:00
if( operation->is_sign )
{
psa: Don't abort when operations are invalid In places where we detect a context is in a bad state and there is no sensitive data to clear, simply return PSA_ERROR_BAD_STATE and don't abort on behalf of the application. The application will choose what to do when it gets a bad state error. The motivation for this change is that an application should decide what to do when it misuses the API and encounters a PSA_ERROR_BAD_STATE error. The library should not attempt to abort on behalf of the application, as that may not be the correct thing to do in all circumstances.
2019-02-20 15:37:15 +00:00
return( PSA_ERROR_BAD_STATE );
Streamline cleanup logic in MAC finish Reorganize error handling code in psa_mac_finish_internal, psa_mac_sign_finish and psa_mac_verify finish to ensure that: * psa_mac_abort() is always called, on all success and error paths. * psa_mac_finish places a safe value in the output parameters on all error paths, even if abort fails.
2018-07-08 18:35:02 +00:00
}
if( operation->mac_size != mac_length )
{
status = PSA_ERROR_INVALID_SIGNATURE;
goto cleanup;
Split psa_mac_setup -> psa_mac_{sign,verify}_setup Make function names for multipart operations more consistent (MAC setup edition). Split psa_mac_setup into two functions psa_mac_sign_setup and psa_mac_verify_setup. These functions behave identically except that they require different usage flags on the key. The goal of the split is to enforce the key policy during setup rather than at the end of the operation (which was a bit of a hack). In psa_mac_sign_finish and psa_mac_verify_finish, if the operation is of the wrong type, abort the operation before returning BAD_STATE.
2018-07-08 18:12:23 +00:00
}
Add static internal MAC finish function add new psa_mac_finish_internal() to be called by psa_mac_finish() and psa_mac_verify() in order to be able to check key usage separatly.
2018-04-02 15:34:15 +00:00
status = psa_mac_finish_internal( operation,
Streamline cleanup logic in MAC finish Reorganize error handling code in psa_mac_finish_internal, psa_mac_sign_finish and psa_mac_verify finish to ensure that: * psa_mac_abort() is always called, on all success and error paths. * psa_mac_finish places a safe value in the output parameters on all error paths, even if abort fails.
2018-07-08 18:35:02 +00:00
actual_mac, sizeof( actual_mac ) );
if( safer_memcmp( mac, actual_mac, mac_length ) != 0 )
status = PSA_ERROR_INVALID_SIGNATURE;
cleanup:
if( status == PSA_SUCCESS )
status = psa_mac_abort( operation );
else
psa_mac_abort( operation );
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 17:14:53 +00:00
mbedtls_platform_zeroize( actual_mac, sizeof( actual_mac ) );
Add support for truncated MAC algorithms
2018-08-14 13:18:45 +00:00
Streamline cleanup logic in MAC finish Reorganize error handling code in psa_mac_finish_internal, psa_mac_sign_finish and psa_mac_verify finish to ensure that: * psa_mac_abort() is always called, on all success and error paths. * psa_mac_finish places a safe value in the output parameters on all error paths, even if abort fails.
2018-07-08 18:35:02 +00:00
return( status );
PSA: Implement MAC functions Implement psa_mac_start, psa_mac_update and psa_mac_final. Implement HMAC anc CMAC. Smoke tests.
2018-02-08 09:02:12 +00:00
}
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
/****************************************************************/
/* Asymmetric cryptography */
/****************************************************************/
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
#if defined(MBEDTLS_RSA_C)
Rename verify_RSA_hash_input_and_get_md_type Give it a shorter name that's more in line with our naming conventions.
2018-06-08 14:34:46 +00:00
/* Decode the hash algorithm from alg and store the mbedtls encoding in
Allow RSA PSS with any input size Although RSASSA-PSS defines its input as a message to be hashed, we implement a sign-the-hash function. This function can take an input which isn't a hash, so don't restrict the size of the input, any more than Mbed TLS does. Remove a redundant check that hash_length fits in unsigned int for the sake of Mbed TLS RSA functions. Test that PSS accepts inputs of various lengths. For PKCS#1 v1.5 signature in raw mode, test the maximum input length.
2018-06-29 21:36:35 +00:00
* md_alg. Verify that the hash length is acceptable. */
Rename verify_RSA_hash_input_and_get_md_type Give it a shorter name that's more in line with our naming conventions.
2018-06-08 14:34:46 +00:00
static psa_status_t psa_rsa_decode_md_type( psa_algorithm_t alg,
size_t hash_length,
mbedtls_md_type_t *md_alg )
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
{
Rename PSA_ALG_RSA_GET_HASH to PSA_ALG_SIGN_GET_HASH And don't use it for HMAC when there's a perfectly serviceable PSA_ALG_HMAC_HASH. HMAC isn't hash-and-sign.
2018-06-26 13:50:08 +00:00
psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH( alg );
Normalize whitespace to Mbed TLS standards Only whitespace changes in this commit.
2018-06-08 14:09:36 +00:00
const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa( hash_alg );
Allow RSA PSS with any input size Although RSASSA-PSS defines its input as a message to be hashed, we implement a sign-the-hash function. This function can take an input which isn't a hash, so don't restrict the size of the input, any more than Mbed TLS does. Remove a redundant check that hash_length fits in unsigned int for the sake of Mbed TLS RSA functions. Test that PSS accepts inputs of various lengths. For PKCS#1 v1.5 signature in raw mode, test the maximum input length.
2018-06-29 21:36:35 +00:00
*md_alg = mbedtls_md_get_type( md_info );
/* The Mbed TLS RSA module uses an unsigned int for hash length
* parameters. Validate that it fits so that we don't risk an
* overflow later. */
Extract common code Make code easier to maintain.
2018-06-04 13:40:31 +00:00
#if SIZE_MAX > UINT_MAX
Allow RSA PSS with any input size Although RSASSA-PSS defines its input as a message to be hashed, we implement a sign-the-hash function. This function can take an input which isn't a hash, so don't restrict the size of the input, any more than Mbed TLS does. Remove a redundant check that hash_length fits in unsigned int for the sake of Mbed TLS RSA functions. Test that PSS accepts inputs of various lengths. For PKCS#1 v1.5 signature in raw mode, test the maximum input length.
2018-06-29 21:36:35 +00:00
if( hash_length > UINT_MAX )
return( PSA_ERROR_INVALID_ARGUMENT );
Extract common code Make code easier to maintain.
2018-06-04 13:40:31 +00:00
#endif
Allow RSA PSS with any input size Although RSASSA-PSS defines its input as a message to be hashed, we implement a sign-the-hash function. This function can take an input which isn't a hash, so don't restrict the size of the input, any more than Mbed TLS does. Remove a redundant check that hash_length fits in unsigned int for the sake of Mbed TLS RSA functions. Test that PSS accepts inputs of various lengths. For PKCS#1 v1.5 signature in raw mode, test the maximum input length.
2018-06-29 21:36:35 +00:00
#if defined(MBEDTLS_PKCS1_V15)
/* For PKCS#1 v1.5 signature, if using a hash, the hash length
* must be correct. */
if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) &&
alg != PSA_ALG_RSA_PKCS1V15_SIGN_RAW )
Extract common code Make code easier to maintain.
2018-06-04 13:40:31 +00:00
{
Allow RSA PSS with any input size Although RSASSA-PSS defines its input as a message to be hashed, we implement a sign-the-hash function. This function can take an input which isn't a hash, so don't restrict the size of the input, any more than Mbed TLS does. Remove a redundant check that hash_length fits in unsigned int for the sake of Mbed TLS RSA functions. Test that PSS accepts inputs of various lengths. For PKCS#1 v1.5 signature in raw mode, test the maximum input length.
2018-06-29 21:36:35 +00:00
if( md_info == NULL )
return( PSA_ERROR_NOT_SUPPORTED );
Normalize whitespace to Mbed TLS standards Only whitespace changes in this commit.
2018-06-08 14:09:36 +00:00
if( mbedtls_md_get_size( md_info ) != hash_length )
return( PSA_ERROR_INVALID_ARGUMENT );
Allow RSA PSS with any input size Although RSASSA-PSS defines its input as a message to be hashed, we implement a sign-the-hash function. This function can take an input which isn't a hash, so don't restrict the size of the input, any more than Mbed TLS does. Remove a redundant check that hash_length fits in unsigned int for the sake of Mbed TLS RSA functions. Test that PSS accepts inputs of various lengths. For PKCS#1 v1.5 signature in raw mode, test the maximum input length.
2018-06-29 21:36:35 +00:00
}
#endif /* MBEDTLS_PKCS1_V15 */
#if defined(MBEDTLS_PKCS1_V21)
/* PSS requires a hash internally. */
if( PSA_ALG_IS_RSA_PSS( alg ) )
{
Normalize whitespace to Mbed TLS standards Only whitespace changes in this commit.
2018-06-08 14:09:36 +00:00
if( md_info == NULL )
return( PSA_ERROR_NOT_SUPPORTED );
Extract common code Make code easier to maintain.
2018-06-04 13:40:31 +00:00
}
Allow RSA PSS with any input size Although RSASSA-PSS defines its input as a message to be hashed, we implement a sign-the-hash function. This function can take an input which isn't a hash, so don't restrict the size of the input, any more than Mbed TLS does. Remove a redundant check that hash_length fits in unsigned int for the sake of Mbed TLS RSA functions. Test that PSS accepts inputs of various lengths. For PKCS#1 v1.5 signature in raw mode, test the maximum input length.
2018-06-29 21:36:35 +00:00
#endif /* MBEDTLS_PKCS1_V21 */
Normalize whitespace to Mbed TLS standards Only whitespace changes in this commit.
2018-06-08 14:09:36 +00:00
return( PSA_SUCCESS );
Extract common code Make code easier to maintain.
2018-06-04 13:40:31 +00:00
}
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
static psa_status_t psa_rsa_sign( mbedtls_rsa_context *rsa,
psa_algorithm_t alg,
const uint8_t *hash,
size_t hash_length,
uint8_t *signature,
size_t signature_size,
size_t *signature_length )
{
psa_status_t status;
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
mbedtls_md_type_t md_alg;
status = psa_rsa_decode_md_type( alg, hash_length, &md_alg );
if( status != PSA_SUCCESS )
return( status );
Don't break the rsa context abstraction This would fail on alternative implementation.
2018-06-29 15:49:35 +00:00
if( signature_size < mbedtls_rsa_get_len( rsa ) )
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
return( PSA_ERROR_BUFFER_TOO_SMALL );
#if defined(MBEDTLS_PKCS1_V15)
if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) )
{
mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V15,
MBEDTLS_MD_NONE );
ret = mbedtls_rsa_pkcs1_sign( rsa,
mbedtls_ctr_drbg_random,
&global_data.ctr_drbg,
MBEDTLS_RSA_PRIVATE,
psa: Pass hash_length with explicit types The RSA module uses unsigned int for hash_length. The PSA Crypto API uses size_t for hash_length. Cast hash_length to unsigned int when passed to the hash module.
2018-06-26 13:20:51 +00:00
md_alg,
(unsigned int) hash_length,
hash,
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
signature );
}
else
#endif /* MBEDTLS_PKCS1_V15 */
#if defined(MBEDTLS_PKCS1_V21)
if( PSA_ALG_IS_RSA_PSS( alg ) )
{
mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg );
ret = mbedtls_rsa_rsassa_pss_sign( rsa,
mbedtls_ctr_drbg_random,
&global_data.ctr_drbg,
MBEDTLS_RSA_PRIVATE,
Allow RSA PSS with any input size Although RSASSA-PSS defines its input as a message to be hashed, we implement a sign-the-hash function. This function can take an input which isn't a hash, so don't restrict the size of the input, any more than Mbed TLS does. Remove a redundant check that hash_length fits in unsigned int for the sake of Mbed TLS RSA functions. Test that PSS accepts inputs of various lengths. For PKCS#1 v1.5 signature in raw mode, test the maximum input length.
2018-06-29 21:36:35 +00:00
MBEDTLS_MD_NONE,
psa: Pass hash_length with explicit types The RSA module uses unsigned int for hash_length. The PSA Crypto API uses size_t for hash_length. Cast hash_length to unsigned int when passed to the hash module.
2018-06-26 13:20:51 +00:00
(unsigned int) hash_length,
hash,
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
signature );
}
else
#endif /* MBEDTLS_PKCS1_V21 */
{
return( PSA_ERROR_INVALID_ARGUMENT );
}
if( ret == 0 )
Don't break the rsa context abstraction This would fail on alternative implementation.
2018-06-29 15:49:35 +00:00
*signature_length = mbedtls_rsa_get_len( rsa );
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
return( mbedtls_to_psa_error( ret ) );
}
static psa_status_t psa_rsa_verify( mbedtls_rsa_context *rsa,
psa_algorithm_t alg,
const uint8_t *hash,
size_t hash_length,
const uint8_t *signature,
size_t signature_length )
{
psa_status_t status;
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
mbedtls_md_type_t md_alg;
status = psa_rsa_decode_md_type( alg, hash_length, &md_alg );
if( status != PSA_SUCCESS )
return( status );
Fix signature size checks in psa_asymmetric_verify for RSA The signature must have exactly the same length as the key, it can't be longer. Fix #258 If the signature doesn't have the correct size, that's an invalid signature, not a problem with an output buffer size. Fix the error code. Add test cases.
2019-09-12 20:08:23 +00:00
if( signature_length != mbedtls_rsa_get_len( rsa ) )
return( PSA_ERROR_INVALID_SIGNATURE );
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
#if defined(MBEDTLS_PKCS1_V15)
if( PSA_ALG_IS_RSA_PKCS1V15_SIGN( alg ) )
{
mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V15,
MBEDTLS_MD_NONE );
ret = mbedtls_rsa_pkcs1_verify( rsa,
mbedtls_ctr_drbg_random,
&global_data.ctr_drbg,
MBEDTLS_RSA_PUBLIC,
md_alg,
psa: Pass hash_length with explicit types The RSA module uses unsigned int for hash_length. The PSA Crypto API uses size_t for hash_length. Cast hash_length to unsigned int when passed to the hash module.
2018-06-26 13:20:51 +00:00
(unsigned int) hash_length,
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
hash,
signature );
}
else
#endif /* MBEDTLS_PKCS1_V15 */
#if defined(MBEDTLS_PKCS1_V21)
if( PSA_ALG_IS_RSA_PSS( alg ) )
{
mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg );
ret = mbedtls_rsa_rsassa_pss_verify( rsa,
mbedtls_ctr_drbg_random,
&global_data.ctr_drbg,
MBEDTLS_RSA_PUBLIC,
Allow RSA PSS with any input size Although RSASSA-PSS defines its input as a message to be hashed, we implement a sign-the-hash function. This function can take an input which isn't a hash, so don't restrict the size of the input, any more than Mbed TLS does. Remove a redundant check that hash_length fits in unsigned int for the sake of Mbed TLS RSA functions. Test that PSS accepts inputs of various lengths. For PKCS#1 v1.5 signature in raw mode, test the maximum input length.
2018-06-29 21:36:35 +00:00
MBEDTLS_MD_NONE,
psa: Pass hash_length with explicit types The RSA module uses unsigned int for hash_length. The PSA Crypto API uses size_t for hash_length. Cast hash_length to unsigned int when passed to the hash module.
2018-06-26 13:20:51 +00:00
(unsigned int) hash_length,
hash,
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
signature );
}
else
#endif /* MBEDTLS_PKCS1_V21 */
{
return( PSA_ERROR_INVALID_ARGUMENT );
}
RSA verification: don't report an invalid padding error Mbed TLS distinguishes "invalid padding" from "valid padding but the rest of the signature is invalid". This has little use in practice and PSA doesn't report this distinction. We just report "invalid signature".
2018-09-13 18:37:48 +00:00
/* Mbed TLS distinguishes "invalid padding" from "valid padding but
* the rest of the signature is invalid". This has little use in
* practice and PSA doesn't report this distinction. */
if( ret == MBEDTLS_ERR_RSA_INVALID_PADDING )
return( PSA_ERROR_INVALID_SIGNATURE );
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
return( mbedtls_to_psa_error( ret ) );
}
#endif /* MBEDTLS_RSA_C */
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
#if defined(MBEDTLS_ECDSA_C)
/* `ecp` cannot be const because `ecp->grp` needs to be non-const
* for mbedtls_ecdsa_sign() and mbedtls_ecdsa_sign_det()
* (even though these functions don't modify it). */
static psa_status_t psa_ecdsa_sign( mbedtls_ecp_keypair *ecp,
psa_algorithm_t alg,
const uint8_t *hash,
size_t hash_length,
uint8_t *signature,
size_t signature_size,
size_t *signature_length )
{
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
mbedtls_mpi r, s;
Change ECDSA signature representation to r||s Change the representation of an ECDSA signature from the ASN.1 DER encoding used in TLS and X.509, to the concatenation of r and s in big-endian order with a fixed size. A fixed size helps memory and buffer management and this representation is generally easier to use for anything that doesn't require the ASN.1 representation. This is the same representation as PKCS#11 (Cryptoki) except that PKCS#11 allows r and s to be truncated (both to the same length), which complicates the implementation and negates the advantage of a fixed-size representation.
2018-06-28 11:56:01 +00:00
size_t curve_bytes = PSA_BITS_TO_BYTES( ecp->grp.pbits );
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
mbedtls_mpi_init( &r );
mbedtls_mpi_init( &s );
Change ECDSA signature representation to r||s Change the representation of an ECDSA signature from the ASN.1 DER encoding used in TLS and X.509, to the concatenation of r and s in big-endian order with a fixed size. A fixed size helps memory and buffer management and this representation is generally easier to use for anything that doesn't require the ASN.1 representation. This is the same representation as PKCS#11 (Cryptoki) except that PKCS#11 allows r and s to be truncated (both to the same length), which complicates the implementation and negates the advantage of a fixed-size representation.
2018-06-28 11:56:01 +00:00
if( signature_size < 2 * curve_bytes )
{
ret = MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL;
goto cleanup;
}
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
Add some missing compilation guards Add missing checks for defined(MBEDTLS_MD_C) around types and functions that require it (HMAC, HKDF, TLS12_PRF). Add missing checks for defined(MBEDTLS_ECDSA_DETERMINISTIC) around code that calls mbedtls_ecdsa_sign_det(). Add missing checks for defined(MBEDTLS_ECDH_C) around ECDH-specific functions.
2018-11-16 15:02:56 +00:00
#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
if( PSA_ALG_DSA_IS_DETERMINISTIC( alg ) )
{
psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH( alg );
const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa( hash_alg );
mbedtls_md_type_t md_alg = mbedtls_md_get_type( md_info );
Use safer deterministic function in psa_ecdsa_sign
2019-09-05 13:06:34 +00:00
MBEDTLS_MPI_CHK( mbedtls_ecdsa_sign_det_ext( &ecp->grp, &r, &s,
&ecp->d, hash,
hash_length, md_alg,
mbedtls_ctr_drbg_random,
&global_data.ctr_drbg ) );
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
}
else
Add some missing compilation guards Add missing checks for defined(MBEDTLS_MD_C) around types and functions that require it (HMAC, HKDF, TLS12_PRF). Add missing checks for defined(MBEDTLS_ECDSA_DETERMINISTIC) around code that calls mbedtls_ecdsa_sign_det(). Add missing checks for defined(MBEDTLS_ECDH_C) around ECDH-specific functions.
2018-11-16 15:02:56 +00:00
#endif /* MBEDTLS_ECDSA_DETERMINISTIC */
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
{
Add some missing compilation guards Add missing checks for defined(MBEDTLS_MD_C) around types and functions that require it (HMAC, HKDF, TLS12_PRF). Add missing checks for defined(MBEDTLS_ECDSA_DETERMINISTIC) around code that calls mbedtls_ecdsa_sign_det(). Add missing checks for defined(MBEDTLS_ECDH_C) around ECDH-specific functions.
2018-11-16 15:02:56 +00:00
(void) alg;
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
MBEDTLS_MPI_CHK( mbedtls_ecdsa_sign( &ecp->grp, &r, &s, &ecp->d,
hash, hash_length,
mbedtls_ctr_drbg_random,
&global_data.ctr_drbg ) );
}
Change ECDSA signature representation to r||s Change the representation of an ECDSA signature from the ASN.1 DER encoding used in TLS and X.509, to the concatenation of r and s in big-endian order with a fixed size. A fixed size helps memory and buffer management and this representation is generally easier to use for anything that doesn't require the ASN.1 representation. This is the same representation as PKCS#11 (Cryptoki) except that PKCS#11 allows r and s to be truncated (both to the same length), which complicates the implementation and negates the advantage of a fixed-size representation.
2018-06-28 11:56:01 +00:00
MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &r,
signature,
curve_bytes ) );
MBEDTLS_MPI_CHK( mbedtls_mpi_write_binary( &s,
signature + curve_bytes,
curve_bytes ) );
cleanup:
mbedtls_mpi_free( &r );
mbedtls_mpi_free( &s );
if( ret == 0 )
*signature_length = 2 * curve_bytes;
return( mbedtls_to_psa_error( ret ) );
}
static psa_status_t psa_ecdsa_verify( mbedtls_ecp_keypair *ecp,
const uint8_t *hash,
size_t hash_length,
const uint8_t *signature,
size_t signature_length )
{
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Change ECDSA signature representation to r||s Change the representation of an ECDSA signature from the ASN.1 DER encoding used in TLS and X.509, to the concatenation of r and s in big-endian order with a fixed size. A fixed size helps memory and buffer management and this representation is generally easier to use for anything that doesn't require the ASN.1 representation. This is the same representation as PKCS#11 (Cryptoki) except that PKCS#11 allows r and s to be truncated (both to the same length), which complicates the implementation and negates the advantage of a fixed-size representation.
2018-06-28 11:56:01 +00:00
mbedtls_mpi r, s;
size_t curve_bytes = PSA_BITS_TO_BYTES( ecp->grp.pbits );
mbedtls_mpi_init( &r );
mbedtls_mpi_init( &s );
if( signature_length != 2 * curve_bytes )
return( PSA_ERROR_INVALID_SIGNATURE );
MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &r,
signature,
curve_bytes ) );
MBEDTLS_MPI_CHK( mbedtls_mpi_read_binary( &s,
signature + curve_bytes,
curve_bytes ) );
ret = mbedtls_ecdsa_verify( &ecp->grp, hash, hash_length,
&ecp->Q, &r, &s );
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
cleanup:
mbedtls_mpi_free( &r );
mbedtls_mpi_free( &s );
return( mbedtls_to_psa_error( ret ) );
}
#endif /* MBEDTLS_ECDSA_C */
Rename some signature-related identifiers Rename some macros and functions related to signature which are changing as part of the addition of psa_sign_message and psa_verify_message. perl -i -pe '%t = ( PSA_KEY_USAGE_SIGN => PSA_KEY_USAGE_SIGN_HASH, PSA_KEY_USAGE_VERIFY => PSA_KEY_USAGE_VERIFY_HASH, PSA_ASYMMETRIC_SIGNATURE_MAX_SIZE => PSA_SIGNATURE_MAX_SIZE, PSA_ASYMMETRIC_SIGN_OUTPUT_SIZE => PSA_SIGN_OUTPUT_SIZE, psa_asymmetric_sign => psa_sign_hash, psa_asymmetric_verify => psa_verify_hash, ); s/\b(@{[join("|", keys %t)]})\b/$t{$1}/ge' $(git ls-files . ':!:**/crypto_compat.h')
2019-11-26 16:01:59 +00:00
psa_status_t psa_sign_hash( psa_key_handle_t handle,
psa_algorithm_t alg,
const uint8_t *hash,
size_t hash_length,
uint8_t *signature,
size_t signature_size,
size_t *signature_length )
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 16:12:32 +00:00
psa_key_slot_t *slot;
psa_asymmetric_sign: consistently fill unused output with '!' Fill the unused part of the output buffer with '!', for consistency with hash and mac. On error, set the output length to the output buffer size and fill the output buffer with '!', again for consistency with hash and mac. This way an invalid output is more visible in a memory dump. Restructure the error paths so that there is a single place where the unused part of the output buffer is filled. Also remove a redundant initialization of *signature_length to 0.
2018-06-28 10:21:19 +00:00
psa_status_t status;
SE driver support: Implement sign and verify hooks
2019-08-07 19:05:07 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
const psa_drv_se_t *drv;
psa_drv_se_context_t *drv_context;
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
psa_asymmetric_sign: consistently fill unused output with '!' Fill the unused part of the output buffer with '!', for consistency with hash and mac. On error, set the output length to the output buffer size and fill the output buffer with '!', again for consistency with hash and mac. This way an invalid output is more visible in a memory dump. Restructure the error paths so that there is a single place where the unused part of the output buffer is filled. Also remove a redundant initialization of *signature_length to 0.
2018-06-28 10:21:19 +00:00
*signature_length = signature_size;
Immediately reject 0-size signature buffer when signing In psa_asymmetric_sign, immediately reject an empty signature buffer. This can never be right. Add test cases (one RSA and one ECDSA). Change the SE HAL mock tests not to use an empty signature buffer.
2019-09-12 20:05:59 +00:00
/* Immediately reject a zero-length signature buffer. This guarantees
* that signature must be a valid pointer. (On the other hand, the hash
* buffer can in principle be empty since it doesn't actually have
* to be a hash.) */
if( signature_size == 0 )
return( PSA_ERROR_BUFFER_TOO_SMALL );
psa_asymmetric_sign: consistently fill unused output with '!' Fill the unused part of the output buffer with '!', for consistency with hash and mac. On error, set the output length to the output buffer size and fill the output buffer with '!', again for consistency with hash and mac. This way an invalid output is more visible in a memory dump. Restructure the error paths so that there is a single place where the unused part of the output buffer is filled. Also remove a redundant initialization of *signature_length to 0.
2018-06-28 10:21:19 +00:00
Rename some signature-related identifiers Rename some macros and functions related to signature which are changing as part of the addition of psa_sign_message and psa_verify_message. perl -i -pe '%t = ( PSA_KEY_USAGE_SIGN => PSA_KEY_USAGE_SIGN_HASH, PSA_KEY_USAGE_VERIFY => PSA_KEY_USAGE_VERIFY_HASH, PSA_ASYMMETRIC_SIGNATURE_MAX_SIZE => PSA_SIGNATURE_MAX_SIZE, PSA_ASYMMETRIC_SIGN_OUTPUT_SIZE => PSA_SIGN_OUTPUT_SIZE, psa_asymmetric_sign => psa_sign_hash, psa_asymmetric_verify => psa_verify_hash, ); s/\b(@{[join("|", keys %t)]})\b/$t{$1}/ge' $(git ls-files . ':!:**/crypto_compat.h')
2019-11-26 16:01:59 +00:00
status = psa_get_key_from_slot( handle, &slot, PSA_KEY_USAGE_SIGN_HASH, alg );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 15:01:38 +00:00
if( status != PSA_SUCCESS )
psa_asymmetric_sign: consistently fill unused output with '!' Fill the unused part of the output buffer with '!', for consistency with hash and mac. On error, set the output length to the output buffer size and fill the output buffer with '!', again for consistency with hash and mac. This way an invalid output is more visible in a memory dump. Restructure the error paths so that there is a single place where the unused part of the output buffer is filled. Also remove a redundant initialization of *signature_length to 0.
2018-06-28 10:21:19 +00:00
goto exit;
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( ! PSA_KEY_TYPE_IS_KEY_PAIR( slot->attr.type ) )
psa_asymmetric_sign: consistently fill unused output with '!' Fill the unused part of the output buffer with '!', for consistency with hash and mac. On error, set the output length to the output buffer size and fill the output buffer with '!', again for consistency with hash and mac. This way an invalid output is more visible in a memory dump. Restructure the error paths so that there is a single place where the unused part of the output buffer is filled. Also remove a redundant initialization of *signature_length to 0.
2018-06-28 10:21:19 +00:00
{
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
}
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
SE driver support: Implement sign and verify hooks
2019-08-07 19:05:07 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
if( psa_get_se_driver( slot->attr.lifetime, &drv, &drv_context ) )
{
if( drv->asymmetric == NULL ||
drv->asymmetric->p_sign == NULL )
{
status = PSA_ERROR_NOT_SUPPORTED;
goto exit;
}
status = drv->asymmetric->p_sign( drv_context,
slot->data.se.slot_number,
alg,
hash, hash_length,
signature, signature_size,
signature_length );
}
else
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
#if defined(MBEDTLS_RSA_C)
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( slot->attr.type == PSA_KEY_TYPE_RSA_KEY_PAIR )
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
{
psa_asymmetric_sign: consistently fill unused output with '!' Fill the unused part of the output buffer with '!', for consistency with hash and mac. On error, set the output length to the output buffer size and fill the output buffer with '!', again for consistency with hash and mac. This way an invalid output is more visible in a memory dump. Restructure the error paths so that there is a single place where the unused part of the output buffer is filled. Also remove a redundant initialization of *signature_length to 0.
2018-06-28 10:21:19 +00:00
status = psa_rsa_sign( slot->data.rsa,
alg,
hash, hash_length,
signature, signature_size,
signature_length );
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
}
else
#endif /* defined(MBEDTLS_RSA_C) */
#if defined(MBEDTLS_ECP_C)
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( PSA_KEY_TYPE_IS_ECC( slot->attr.type ) )
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
{
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
#if defined(MBEDTLS_ECDSA_C)
Add some missing compilation guards Add missing checks for defined(MBEDTLS_MD_C) around types and functions that require it (HMAC, HKDF, TLS12_PRF). Add missing checks for defined(MBEDTLS_ECDSA_DETERMINISTIC) around code that calls mbedtls_ecdsa_sign_det(). Add missing checks for defined(MBEDTLS_ECDH_C) around ECDH-specific functions.
2018-11-16 15:02:56 +00:00
if(
#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
PSA_ALG_IS_ECDSA( alg )
#else
PSA_ALG_IS_RANDOMIZED_ECDSA( alg )
#endif
)
psa_asymmetric_sign: consistently fill unused output with '!' Fill the unused part of the output buffer with '!', for consistency with hash and mac. On error, set the output length to the output buffer size and fill the output buffer with '!', again for consistency with hash and mac. This way an invalid output is more visible in a memory dump. Restructure the error paths so that there is a single place where the unused part of the output buffer is filled. Also remove a redundant initialization of *signature_length to 0.
2018-06-28 10:21:19 +00:00
status = psa_ecdsa_sign( slot->data.ecp,
alg,
hash, hash_length,
signature, signature_size,
signature_length );
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
else
#endif /* defined(MBEDTLS_ECDSA_C) */
{
psa_asymmetric_sign: consistently fill unused output with '!' Fill the unused part of the output buffer with '!', for consistency with hash and mac. On error, set the output length to the output buffer size and fill the output buffer with '!', again for consistency with hash and mac. This way an invalid output is more visible in a memory dump. Restructure the error paths so that there is a single place where the unused part of the output buffer is filled. Also remove a redundant initialization of *signature_length to 0.
2018-06-28 10:21:19 +00:00
status = PSA_ERROR_INVALID_ARGUMENT;
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
}
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 08:18:38 +00:00
}
else
#endif /* defined(MBEDTLS_ECP_C) */
{
psa_asymmetric_sign: consistently fill unused output with '!' Fill the unused part of the output buffer with '!', for consistency with hash and mac. On error, set the output length to the output buffer size and fill the output buffer with '!', again for consistency with hash and mac. This way an invalid output is more visible in a memory dump. Restructure the error paths so that there is a single place where the unused part of the output buffer is filled. Also remove a redundant initialization of *signature_length to 0.
2018-06-28 10:21:19 +00:00
status = PSA_ERROR_NOT_SUPPORTED;
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
}
psa_asymmetric_sign: consistently fill unused output with '!' Fill the unused part of the output buffer with '!', for consistency with hash and mac. On error, set the output length to the output buffer size and fill the output buffer with '!', again for consistency with hash and mac. This way an invalid output is more visible in a memory dump. Restructure the error paths so that there is a single place where the unused part of the output buffer is filled. Also remove a redundant initialization of *signature_length to 0.
2018-06-28 10:21:19 +00:00
exit:
/* Fill the unused part of the output buffer (the whole buffer on error,
* the trailing part on success) with something that isn't a valid mac
* (barring an attack on the mac and deliberately-crafted input),
* in case the caller doesn't check the return status properly. */
if( status == PSA_SUCCESS )
memset( signature + *signature_length, '!',
signature_size - *signature_length );
Immediately reject 0-size signature buffer when signing In psa_asymmetric_sign, immediately reject an empty signature buffer. This can never be right. Add test cases (one RSA and one ECDSA). Change the SE HAL mock tests not to use an empty signature buffer.
2019-09-12 20:05:59 +00:00
else
psa_asymmetric_sign: consistently fill unused output with '!' Fill the unused part of the output buffer with '!', for consistency with hash and mac. On error, set the output length to the output buffer size and fill the output buffer with '!', again for consistency with hash and mac. This way an invalid output is more visible in a memory dump. Restructure the error paths so that there is a single place where the unused part of the output buffer is filled. Also remove a redundant initialization of *signature_length to 0.
2018-06-28 10:21:19 +00:00
memset( signature, '!', signature_size );
Handle null pointers safely when used as buffers of size 0 When the size of a buffer is 0, the corresponding pointer argument may be null. In such cases, library functions must not perform arithmetic on the pointer or call standard library functions such as memset and memcpy, since that would be undefined behavior in C. Protect such cases. Refactor the storage of a 0-sized raw data object to make it store a null pointer, rather than depending on the behavior of calloc(1,0).
2018-06-28 17:31:31 +00:00
/* If signature_size is 0 then we have nothing to do. We must not call
* memset because signature may be NULL in this case. */
psa_asymmetric_sign: consistently fill unused output with '!' Fill the unused part of the output buffer with '!', for consistency with hash and mac. On error, set the output length to the output buffer size and fill the output buffer with '!', again for consistency with hash and mac. This way an invalid output is more visible in a memory dump. Restructure the error paths so that there is a single place where the unused part of the output buffer is filled. Also remove a redundant initialization of *signature_length to 0.
2018-06-28 10:21:19 +00:00
return( status );
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 08:18:38 +00:00
}
Rename some signature-related identifiers Rename some macros and functions related to signature which are changing as part of the addition of psa_sign_message and psa_verify_message. perl -i -pe '%t = ( PSA_KEY_USAGE_SIGN => PSA_KEY_USAGE_SIGN_HASH, PSA_KEY_USAGE_VERIFY => PSA_KEY_USAGE_VERIFY_HASH, PSA_ASYMMETRIC_SIGNATURE_MAX_SIZE => PSA_SIGNATURE_MAX_SIZE, PSA_ASYMMETRIC_SIGN_OUTPUT_SIZE => PSA_SIGN_OUTPUT_SIZE, psa_asymmetric_sign => psa_sign_hash, psa_asymmetric_verify => psa_verify_hash, ); s/\b(@{[join("|", keys %t)]})\b/$t{$1}/ge' $(git ls-files . ':!:**/crypto_compat.h')
2019-11-26 16:01:59 +00:00
psa_status_t psa_verify_hash( psa_key_handle_t handle,
psa_algorithm_t alg,
const uint8_t *hash,
size_t hash_length,
const uint8_t *signature,
size_t signature_length )
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 08:18:38 +00:00
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 16:12:32 +00:00
psa_key_slot_t *slot;
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 15:01:38 +00:00
psa_status_t status;
SE driver support: Implement sign and verify hooks
2019-08-07 19:05:07 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
const psa_drv_se_t *drv;
psa_drv_se_context_t *drv_context;
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
Rename some signature-related identifiers Rename some macros and functions related to signature which are changing as part of the addition of psa_sign_message and psa_verify_message. perl -i -pe '%t = ( PSA_KEY_USAGE_SIGN => PSA_KEY_USAGE_SIGN_HASH, PSA_KEY_USAGE_VERIFY => PSA_KEY_USAGE_VERIFY_HASH, PSA_ASYMMETRIC_SIGNATURE_MAX_SIZE => PSA_SIGNATURE_MAX_SIZE, PSA_ASYMMETRIC_SIGN_OUTPUT_SIZE => PSA_SIGN_OUTPUT_SIZE, psa_asymmetric_sign => psa_sign_hash, psa_asymmetric_verify => psa_verify_hash, ); s/\b(@{[join("|", keys %t)]})\b/$t{$1}/ge' $(git ls-files . ':!:**/crypto_compat.h')
2019-11-26 16:01:59 +00:00
status = psa_get_key_from_slot( handle, &slot, PSA_KEY_USAGE_VERIFY_HASH, alg );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 15:01:38 +00:00
if( status != PSA_SUCCESS )
return( status );
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 08:18:38 +00:00
SE driver support: Implement sign and verify hooks
2019-08-07 19:05:07 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
if( psa_get_se_driver( slot->attr.lifetime, &drv, &drv_context ) )
{
if( drv->asymmetric == NULL ||
drv->asymmetric->p_verify == NULL )
return( PSA_ERROR_NOT_SUPPORTED );
return( drv->asymmetric->p_verify( drv_context,
slot->data.se.slot_number,
alg,
hash, hash_length,
signature, signature_length ) );
}
else
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Normalize whitespace to Mbed TLS standards Only whitespace changes in this commit.
2018-06-08 14:09:36 +00:00
#if defined(MBEDTLS_RSA_C)
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
{
Factor RSA sign/verify code into its own functions This makes the functions smaller and makes error paths easier to read.
2018-06-27 13:42:46 +00:00
return( psa_rsa_verify( slot->data.rsa,
alg,
hash, hash_length,
signature, signature_length ) );
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
}
else
#endif /* defined(MBEDTLS_RSA_C) */
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 08:18:38 +00:00
#if defined(MBEDTLS_ECP_C)
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( PSA_KEY_TYPE_IS_ECC( slot->attr.type ) )
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 08:18:38 +00:00
{
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
#if defined(MBEDTLS_ECDSA_C)
if( PSA_ALG_IS_ECDSA( alg ) )
Change ECDSA signature representation to r||s Change the representation of an ECDSA signature from the ASN.1 DER encoding used in TLS and X.509, to the concatenation of r and s in big-endian order with a fixed size. A fixed size helps memory and buffer management and this representation is generally easier to use for anything that doesn't require the ASN.1 representation. This is the same representation as PKCS#11 (Cryptoki) except that PKCS#11 allows r and s to be truncated (both to the same length), which complicates the implementation and negates the advantage of a fixed-size representation.
2018-06-28 11:56:01 +00:00
return( psa_ecdsa_verify( slot->data.ecp,
hash, hash_length,
signature, signature_length ) );
Sort out ECDSA mechanisms * Distinguish randomized ECDSA from deterministic ECDSA. * Deterministic ECDSA needs to be parametrized by a hash. * Randomized ECDSA only uses the hash for the initial hash step, but add ECDSA(hash) algorithms anyway so that all the signature algorithms encode the initial hashing step. * Add brief documentation for the ECDSA signature mechanisms. * Also define DSA signature mechanisms while I'm at it. There were already key types for DSA.
2018-06-26 14:10:23 +00:00
else
#endif /* defined(MBEDTLS_ECDSA_C) */
{
return( PSA_ERROR_INVALID_ARGUMENT );
}
ECDSA sign and verify implementation and tests ECDSA sign and verify implementation and tests
2018-05-08 08:18:38 +00:00
}
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
else
#endif /* defined(MBEDTLS_ECP_C) */
{
return( PSA_ERROR_NOT_SUPPORTED );
}
}
Implement OAEP Implement RSAES-OAEP encryption and decryption. Test it to the same level as PKCS#1 v1.5.
2018-06-29 22:21:29 +00:00
#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PKCS1_V21)
static void psa_rsa_oaep_set_padding_mode( psa_algorithm_t alg,
mbedtls_rsa_context *rsa )
{
psa_algorithm_t hash_alg = PSA_ALG_RSA_OAEP_GET_HASH( alg );
const mbedtls_md_info_t *md_info = mbedtls_md_info_from_psa( hash_alg );
mbedtls_md_type_t md_alg = mbedtls_md_get_type( md_info );
mbedtls_rsa_set_padding( rsa, MBEDTLS_RSA_PKCS_V21, md_alg );
}
#endif /* defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PKCS1_V21) */
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 17:08:14 +00:00
psa_status_t psa_asymmetric_encrypt( psa_key_handle_t handle,
Normalize whitespace to Mbed TLS standards Only whitespace changes in this commit.
2018-06-08 14:09:36 +00:00
psa_algorithm_t alg,
const uint8_t *input,
size_t input_length,
const uint8_t *salt,
size_t salt_length,
uint8_t *output,
size_t output_size,
size_t *output_length )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 16:12:32 +00:00
psa_key_slot_t *slot;
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 15:01:38 +00:00
psa_status_t status;
Add handling for (sometimes) unused parameters
2018-07-24 14:34:10 +00:00
(void) input;
(void) input_length;
(void) salt;
(void) output;
(void) output_size;
Set output length to safe value
2018-06-04 13:43:12 +00:00
*output_length = 0;
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
psa_asymmetric_{encrypt,decrypt}: reject salt when not allowed In psa_asymmetric_encrypt and psa_asymmetric_decrypt, if the algorithm does not use a salt, require the salt to be empty.
2018-06-30 17:04:35 +00:00
if( ! PSA_ALG_IS_RSA_OAEP( alg ) && salt_length != 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
SE keys: ensure that functions that lack support properly error out Introduce a new function psa_get_transparent_key which returns NOT_SUPPORTED if the key is in a secure element. Use this function in functions that don't support keys in a secure element. After this commit, all functions that access a key slot directly via psa_get_key_slot or psa_get_key_from_slot rather than via psa_get_transparent_key have at least enough support for secure elements not to crash or otherwise cause undefined behavior. Lesser bad behavior such as wrong results or resource leakage is still possible in error cases.
2019-07-24 11:30:31 +00:00
status = psa_get_transparent_key( handle, &slot, PSA_KEY_USAGE_ENCRYPT, alg );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 15:01:38 +00:00
if( status != PSA_SUCCESS )
return( status );
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( ! ( PSA_KEY_TYPE_IS_PUBLIC_KEY( slot->attr.type ) ||
PSA_KEY_TYPE_IS_KEY_PAIR( slot->attr.type ) ) )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
return( PSA_ERROR_INVALID_ARGUMENT );
#if defined(MBEDTLS_RSA_C)
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( PSA_KEY_TYPE_IS_RSA( slot->attr.type ) )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
{
mbedtls_rsa_context *rsa = slot->data.rsa;
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Don't break the rsa context abstraction This would fail on alternative implementation.
2018-06-29 15:49:35 +00:00
if( output_size < mbedtls_rsa_get_len( rsa ) )
Return right error code. Issue : 126 https://github.com/ARMmbed/mbed-crypto/issues/126 PSA_ERROR_BUFFER_TOO_SMALL error returned when we check for output_size.
2019-08-02 11:26:29 +00:00
return( PSA_ERROR_BUFFER_TOO_SMALL );
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
#if defined(MBEDTLS_PKCS1_V15)
Finish renaming around PSA_ALG_IS_RSA_PKCS1V15 Now the code compiles. Some OAEP and PSS macros may still need to be fixed.
2018-05-31 11:16:08 +00:00
if( alg == PSA_ALG_RSA_PKCS1V15_CRYPT )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
{
Normalize whitespace to Mbed TLS standards Only whitespace changes in this commit.
2018-06-08 14:09:36 +00:00
ret = mbedtls_rsa_pkcs1_encrypt( rsa,
mbedtls_ctr_drbg_random,
&global_data.ctr_drbg,
MBEDTLS_RSA_PUBLIC,
input_length,
input,
output );
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
}
else
#endif /* MBEDTLS_PKCS1_V15 */
#if defined(MBEDTLS_PKCS1_V21)
Sort out RSA mechanisms * PSS needs to be parametrized by a hash. * Don't use `_MGF1` in the names of macros for OAEP and PSS. No one ever uses anything else. * Add brief documentation for the RSA signature mechanisms.
2018-06-26 13:53:48 +00:00
if( PSA_ALG_IS_RSA_OAEP( alg ) )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
{
Implement OAEP Implement RSAES-OAEP encryption and decryption. Test it to the same level as PKCS#1 v1.5.
2018-06-29 22:21:29 +00:00
psa_rsa_oaep_set_padding_mode( alg, rsa );
ret = mbedtls_rsa_rsaes_oaep_encrypt( rsa,
mbedtls_ctr_drbg_random,
&global_data.ctr_drbg,
MBEDTLS_RSA_PUBLIC,
salt, salt_length,
input_length,
input,
output );
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
}
else
#endif /* MBEDTLS_PKCS1_V21 */
{
return( PSA_ERROR_INVALID_ARGUMENT );
}
if( ret == 0 )
Don't break the rsa context abstraction This would fail on alternative implementation.
2018-06-29 15:49:35 +00:00
*output_length = mbedtls_rsa_get_len( rsa );
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
return( mbedtls_to_psa_error( ret ) );
}
else
Remove ECC boilerplate in asymmetric encrypt/decrypt We don't have any encryption algorithm using ECC keys at the moment.
2018-06-08 15:44:47 +00:00
#endif /* defined(MBEDTLS_RSA_C) */
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
{
return( PSA_ERROR_NOT_SUPPORTED );
}
Remove trailing whitespace Only horizontal whitespace changes in this commit.
2018-05-31 11:25:48 +00:00
}
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 17:08:14 +00:00
psa_status_t psa_asymmetric_decrypt( psa_key_handle_t handle,
Normalize whitespace to Mbed TLS standards Only whitespace changes in this commit.
2018-06-08 14:09:36 +00:00
psa_algorithm_t alg,
const uint8_t *input,
size_t input_length,
const uint8_t *salt,
size_t salt_length,
uint8_t *output,
size_t output_size,
size_t *output_length )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 16:12:32 +00:00
psa_key_slot_t *slot;
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 15:01:38 +00:00
psa_status_t status;
Add handling for (sometimes) unused parameters
2018-07-24 14:34:10 +00:00
(void) input;
(void) input_length;
(void) salt;
(void) output;
(void) output_size;
Set output length to safe value
2018-06-04 13:43:12 +00:00
*output_length = 0;
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
psa_asymmetric_{encrypt,decrypt}: reject salt when not allowed In psa_asymmetric_encrypt and psa_asymmetric_decrypt, if the algorithm does not use a salt, require the salt to be empty.
2018-06-30 17:04:35 +00:00
if( ! PSA_ALG_IS_RSA_OAEP( alg ) && salt_length != 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
SE keys: ensure that functions that lack support properly error out Introduce a new function psa_get_transparent_key which returns NOT_SUPPORTED if the key is in a secure element. Use this function in functions that don't support keys in a secure element. After this commit, all functions that access a key slot directly via psa_get_key_slot or psa_get_key_from_slot rather than via psa_get_transparent_key have at least enough support for secure elements not to crash or otherwise cause undefined behavior. Lesser bad behavior such as wrong results or resource leakage is still possible in error cases.
2019-07-24 11:30:31 +00:00
status = psa_get_transparent_key( handle, &slot, PSA_KEY_USAGE_DECRYPT, alg );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 15:01:38 +00:00
if( status != PSA_SUCCESS )
return( status );
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( ! PSA_KEY_TYPE_IS_KEY_PAIR( slot->attr.type ) )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
return( PSA_ERROR_INVALID_ARGUMENT );
#if defined(MBEDTLS_RSA_C)
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( slot->attr.type == PSA_KEY_TYPE_RSA_KEY_PAIR )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
{
mbedtls_rsa_context *rsa = slot->data.rsa;
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
Don't break the rsa context abstraction This would fail on alternative implementation.
2018-06-29 15:49:35 +00:00
if( input_length != mbedtls_rsa_get_len( rsa ) )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
return( PSA_ERROR_INVALID_ARGUMENT );
#if defined(MBEDTLS_PKCS1_V15)
Finish renaming around PSA_ALG_IS_RSA_PKCS1V15 Now the code compiles. Some OAEP and PSS macros may still need to be fixed.
2018-05-31 11:16:08 +00:00
if( alg == PSA_ALG_RSA_PKCS1V15_CRYPT )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
{
Normalize whitespace to Mbed TLS standards Only whitespace changes in this commit.
2018-06-08 14:09:36 +00:00
ret = mbedtls_rsa_pkcs1_decrypt( rsa,
mbedtls_ctr_drbg_random,
&global_data.ctr_drbg,
MBEDTLS_RSA_PRIVATE,
output_length,
input,
output,
output_size );
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
}
else
#endif /* MBEDTLS_PKCS1_V15 */
#if defined(MBEDTLS_PKCS1_V21)
Sort out RSA mechanisms * PSS needs to be parametrized by a hash. * Don't use `_MGF1` in the names of macros for OAEP and PSS. No one ever uses anything else. * Add brief documentation for the RSA signature mechanisms.
2018-06-26 13:53:48 +00:00
if( PSA_ALG_IS_RSA_OAEP( alg ) )
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
{
Implement OAEP Implement RSAES-OAEP encryption and decryption. Test it to the same level as PKCS#1 v1.5.
2018-06-29 22:21:29 +00:00
psa_rsa_oaep_set_padding_mode( alg, rsa );
ret = mbedtls_rsa_rsaes_oaep_decrypt( rsa,
mbedtls_ctr_drbg_random,
&global_data.ctr_drbg,
MBEDTLS_RSA_PRIVATE,
salt, salt_length,
output_length,
input,
output,
output_size );
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
}
else
#endif /* MBEDTLS_PKCS1_V21 */
{
return( PSA_ERROR_INVALID_ARGUMENT );
}
Remove duplicate / unneeded code 1. remove duplicate function introduced by re-base 2. remove unneeded code
2018-06-04 13:36:15 +00:00
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
return( mbedtls_to_psa_error( ret ) );
}
else
Remove ECC boilerplate in asymmetric encrypt/decrypt We don't have any encryption algorithm using ECC keys at the moment.
2018-06-08 15:44:47 +00:00
#endif /* defined(MBEDTLS_RSA_C) */
added support for PKCSv1.5 signature verification and encryption/decryption and very basic tests.
2018-05-02 20:16:26 +00:00
{
return( PSA_ERROR_NOT_SUPPORTED );
}
Remove trailing whitespace Only horizontal whitespace changes in this commit.
2018-05-31 11:25:48 +00:00
}
PSA crypto: asymmetric signature (RSA PKCS#1v1.5 only) Define hash algorithms and RSA signature algorithms. New function psa_asymmetric_sign. Implement psa_asymmetric_sign for RSA PKCS#1 v1.5.
2018-02-03 21:44:14 +00:00
Be more consistent about blank lines
2018-06-18 19:49:39 +00:00
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
/****************************************************************/
/* Symmetric cryptography */
/****************************************************************/
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 14:05:20 +00:00
/* Initialize the cipher operation structure. Once this function has been
* called, psa_cipher_abort can run and will do the right thing. */
static psa_status_t psa_cipher_init( psa_cipher_operation_t *operation,
psa_algorithm_t alg )
{
Favor INVALID_ARGUMENT over NOT_SUPPORTED for bad algorithm types In psa_hash_start, psa_mac_start and psa_cipher_setup, return PSA_ERROR_INVALID_ARGUMENT rather than PSA_ERROR_NOT_SUPPORTED when the algorithm parameter is not the right category.
2018-06-20 14:21:04 +00:00
if( ! PSA_ALG_IS_CIPHER( alg ) )
{
memset( operation, 0, sizeof( *operation ) );
return( PSA_ERROR_INVALID_ARGUMENT );
}
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 14:05:20 +00:00
operation->alg = alg;
operation->key_set = 0;
operation->iv_set = 0;
operation->iv_required = 1;
operation->iv_size = 0;
operation->block_size = 0;
mbedtls_cipher_init( &operation->ctx.cipher );
return( PSA_SUCCESS );
}
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 14:22:46 +00:00
static psa_status_t psa_cipher_setup( psa_cipher_operation_t *operation,
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 17:08:14 +00:00
psa_key_handle_t handle,
Wrap lines to 80 columns
2018-06-04 14:23:10 +00:00
psa_algorithm_t alg,
mbedtls_operation_t cipher_operation )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
{
Fix cleanup in psa_cipher_setup In some error cases, psa_cipher_setup was leaving a partly-initialized operation context.
2019-02-25 16:43:14 +00:00
int ret = 0;
psa_status_t status = PSA_ERROR_GENERIC_ERROR;
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 16:12:32 +00:00
psa_key_slot_t *slot;
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
size_t key_bits;
const mbedtls_cipher_info_t *cipher_info = NULL;
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 15:01:38 +00:00
psa_key_usage_t usage = ( cipher_operation == MBEDTLS_ENCRYPT ?
PSA_KEY_USAGE_ENCRYPT :
PSA_KEY_USAGE_DECRYPT );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
psa: Disallow repeated setup Calling psa_*_setup() twice on a MAC, cipher, or hash context should result in a PSA_ERROR_BAD_STATE error because the operation has already been set up. Fixes #10
2019-02-19 09:25:10 +00:00
/* A context must be freshly initialized before it can be set up. */
if( operation->alg != 0 )
{
return( PSA_ERROR_BAD_STATE );
}
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 14:05:20 +00:00
status = psa_cipher_init( operation, alg );
if( status != PSA_SUCCESS )
return( status );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
SE keys: ensure that functions that lack support properly error out Introduce a new function psa_get_transparent_key which returns NOT_SUPPORTED if the key is in a secure element. Use this function in functions that don't support keys in a secure element. After this commit, all functions that access a key slot directly via psa_get_key_slot or psa_get_key_from_slot rather than via psa_get_transparent_key have at least enough support for secure elements not to crash or otherwise cause undefined behavior. Lesser bad behavior such as wrong results or resource leakage is still possible in error cases.
2019-07-24 11:30:31 +00:00
status = psa_get_transparent_key( handle, &slot, usage, alg);
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 15:01:38 +00:00
if( status != PSA_SUCCESS )
Fix cleanup in psa_cipher_setup In some error cases, psa_cipher_setup was leaving a partly-initialized operation context.
2019-02-25 16:43:14 +00:00
goto exit;
Implement missing attributes setters and getters
2019-04-18 10:53:01 +00:00
key_bits = psa_get_key_slot_bits( slot );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
cipher_info = mbedtls_cipher_info_from_psa( alg, slot->attr.type, key_bits, NULL );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
if( cipher_info == NULL )
Fix cleanup in psa_cipher_setup In some error cases, psa_cipher_setup was leaving a partly-initialized operation context.
2019-02-25 16:43:14 +00:00
{
status = PSA_ERROR_NOT_SUPPORTED;
goto exit;
}
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
ret = mbedtls_cipher_setup( &operation->ctx.cipher, cipher_info );
partly pr fix
2018-04-04 12:43:05 +00:00
if( ret != 0 )
Fix cleanup in psa_cipher_setup In some error cases, psa_cipher_setup was leaving a partly-initialized operation context.
2019-02-25 16:43:14 +00:00
goto exit;
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
Add what little was missing to fully support DES Also add what was missing in the test suite to support block ciphers with a block size that isn't 16. Fix some buggy test data that passed only due to problems with DES support in the product.
2018-06-21 07:40:04 +00:00
#if defined(MBEDTLS_DES_C)
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( slot->attr.type == PSA_KEY_TYPE_DES && key_bits == 128 )
Add what little was missing to fully support DES Also add what was missing in the test suite to support block ciphers with a block size that isn't 16. Fix some buggy test data that passed only due to problems with DES support in the product.
2018-06-21 07:40:04 +00:00
{
/* Two-key Triple-DES is 3-key Triple-DES with K1=K3 */
Favor stdint.h types in internal types Use uint8_t for PSA buffers. Keep unsigned char for generic libc buffers and for mbedtls buffers.
2019-07-15 09:06:38 +00:00
uint8_t keys[24];
Add what little was missing to fully support DES Also add what was missing in the test suite to support block ciphers with a block size that isn't 16. Fix some buggy test data that passed only due to problems with DES support in the product.
2018-06-21 07:40:04 +00:00
memcpy( keys, slot->data.raw.data, 16 );
memcpy( keys + 16, slot->data.raw.data, 8 );
ret = mbedtls_cipher_setkey( &operation->ctx.cipher,
keys,
192, cipher_operation );
}
else
#endif
{
ret = mbedtls_cipher_setkey( &operation->ctx.cipher,
slot->data.raw.data,
psa: Pass the number of bits with explicit types The GCM, CCM, RSA, and cipher modules inconsistently use int or unsigned int for a count of bits. The PSA Crypto API uses size_t for counting things. This causes issues on LLP64 systems where a size_t can hold more than an unsigned int. Add casts for where key_bits and bits are passed to mbedtls_* APIs.
2018-06-26 13:16:54 +00:00
(int) key_bits, cipher_operation );
Add what little was missing to fully support DES Also add what was missing in the test suite to support block ciphers with a block size that isn't 16. Fix some buggy test data that passed only due to problems with DES support in the product.
2018-06-21 07:40:04 +00:00
}
partly pr fix
2018-04-04 12:43:05 +00:00
if( ret != 0 )
Fix cleanup in psa_cipher_setup In some error cases, psa_cipher_setup was leaving a partly-initialized operation context.
2019-02-25 16:43:14 +00:00
goto exit;
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 11:57:31 +00:00
#if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING)
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 12:02:45 +00:00
switch( alg )
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 11:57:31 +00:00
{
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 12:02:45 +00:00
case PSA_ALG_CBC_NO_PADDING:
ret = mbedtls_cipher_set_padding_mode( &operation->ctx.cipher,
MBEDTLS_PADDING_NONE );
break;
case PSA_ALG_CBC_PKCS7:
ret = mbedtls_cipher_set_padding_mode( &operation->ctx.cipher,
MBEDTLS_PADDING_PKCS7 );
break;
default:
/* The algorithm doesn't involve padding. */
ret = 0;
break;
}
if( ret != 0 )
Fix cleanup in psa_cipher_setup In some error cases, psa_cipher_setup was leaving a partly-initialized operation context.
2019-02-25 16:43:14 +00:00
goto exit;
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 11:57:31 +00:00
#endif //MBEDTLS_CIPHER_MODE_WITH_PADDING
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
operation->key_set = 1;
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 12:02:45 +00:00
operation->block_size = ( PSA_ALG_IS_STREAM_CIPHER( alg ) ? 1 :
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
PSA_BLOCK_CIPHER_BLOCK_SIZE( slot->attr.type ) );
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 12:02:45 +00:00
if( alg & PSA_ALG_CIPHER_FROM_BLOCK_FLAG )
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 11:57:31 +00:00
{
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
operation->iv_size = PSA_BLOCK_CIPHER_BLOCK_SIZE( slot->attr.type );
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 11:57:31 +00:00
}
Implement ChaCha20 and ChaCha20-Poly1305 Smoke tests: test data for ChaCha20 calculated with PyCryptodome; test vector from RFC 7539 for ChaCha20-Poly1305.
2019-05-06 13:25:00 +00:00
#if defined(MBEDTLS_CHACHA20_C)
else
if( alg == PSA_ALG_CHACHA20 )
operation->iv_size = 12;
#endif
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
Fix cleanup in psa_cipher_setup In some error cases, psa_cipher_setup was leaving a partly-initialized operation context.
2019-02-25 16:43:14 +00:00
exit:
if( status == 0 )
status = mbedtls_to_psa_error( ret );
if( status != 0 )
psa_cipher_abort( operation );
return( status );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
}
Rename psa cipher functions to psa_cipher_xxx Make function names for multipart operations more consistent (cipher edition). Rename symmetric cipher multipart operation functions so that they all start with psa_cipher_: * psa_encrypt_setup -> psa_cipher_encrypt_setup * psa_decrypt_setup -> psa_cipher_decrypt_setup * psa_encrypt_set_iv -> psa_cipher_set_iv * psa_encrypt_generate_iv -> psa_cipher_generate_iv
2018-07-08 19:39:34 +00:00
psa_status_t psa_cipher_encrypt_setup( psa_cipher_operation_t *operation,
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 17:08:14 +00:00
psa_key_handle_t handle,
Rename psa cipher functions to psa_cipher_xxx Make function names for multipart operations more consistent (cipher edition). Rename symmetric cipher multipart operation functions so that they all start with psa_cipher_: * psa_encrypt_setup -> psa_cipher_encrypt_setup * psa_decrypt_setup -> psa_cipher_decrypt_setup * psa_encrypt_set_iv -> psa_cipher_set_iv * psa_encrypt_generate_iv -> psa_cipher_generate_iv
2018-07-08 19:39:34 +00:00
psa_algorithm_t alg )
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 11:57:31 +00:00
{
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 17:08:14 +00:00
return( psa_cipher_setup( operation, handle, alg, MBEDTLS_ENCRYPT ) );
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 11:57:31 +00:00
}
Rename psa cipher functions to psa_cipher_xxx Make function names for multipart operations more consistent (cipher edition). Rename symmetric cipher multipart operation functions so that they all start with psa_cipher_: * psa_encrypt_setup -> psa_cipher_encrypt_setup * psa_decrypt_setup -> psa_cipher_decrypt_setup * psa_encrypt_set_iv -> psa_cipher_set_iv * psa_encrypt_generate_iv -> psa_cipher_generate_iv
2018-07-08 19:39:34 +00:00
psa_status_t psa_cipher_decrypt_setup( psa_cipher_operation_t *operation,
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 17:08:14 +00:00
psa_key_handle_t handle,
Rename psa cipher functions to psa_cipher_xxx Make function names for multipart operations more consistent (cipher edition). Rename symmetric cipher multipart operation functions so that they all start with psa_cipher_: * psa_encrypt_setup -> psa_cipher_encrypt_setup * psa_decrypt_setup -> psa_cipher_decrypt_setup * psa_encrypt_set_iv -> psa_cipher_set_iv * psa_encrypt_generate_iv -> psa_cipher_generate_iv
2018-07-08 19:39:34 +00:00
psa_algorithm_t alg )
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 11:57:31 +00:00
{
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 17:08:14 +00:00
return( psa_cipher_setup( operation, handle, alg, MBEDTLS_DECRYPT ) );
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 11:57:31 +00:00
}
Rename psa cipher functions to psa_cipher_xxx Make function names for multipart operations more consistent (cipher edition). Rename symmetric cipher multipart operation functions so that they all start with psa_cipher_: * psa_encrypt_setup -> psa_cipher_encrypt_setup * psa_decrypt_setup -> psa_cipher_decrypt_setup * psa_encrypt_set_iv -> psa_cipher_set_iv * psa_encrypt_generate_iv -> psa_cipher_generate_iv
2018-07-08 19:39:34 +00:00
psa_status_t psa_cipher_generate_iv( psa_cipher_operation_t *operation,
Apply same changes to implementation source code
2019-05-15 11:33:23 +00:00
uint8_t *iv,
Rename psa cipher functions to psa_cipher_xxx Make function names for multipart operations more consistent (cipher edition). Rename symmetric cipher multipart operation functions so that they all start with psa_cipher_: * psa_encrypt_setup -> psa_cipher_encrypt_setup * psa_decrypt_setup -> psa_cipher_decrypt_setup * psa_encrypt_set_iv -> psa_cipher_set_iv * psa_encrypt_generate_iv -> psa_cipher_generate_iv
2018-07-08 19:39:34 +00:00
size_t iv_size,
size_t *iv_length )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
{
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 10:56:32 +00:00
psa_status_t status;
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Formatting improvements Avoid lines longer than 80 columns. Remove some redundant parentheses, e.g. change if( ( a == b ) && ( c == d ) ) to if( a == b && c == d ) which makes lines less long and makes the remaining parentheses more relevant. Add missing parentheses around return statements. There should be no semantic change in this commit.
2018-06-18 14:04:39 +00:00
if( operation->iv_set || ! operation->iv_required )
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 10:56:32 +00:00
{
psa: Don't abort when operations are invalid In places where we detect a context is in a bad state and there is no sensitive data to clear, simply return PSA_ERROR_BAD_STATE and don't abort on behalf of the application. The application will choose what to do when it gets a bad state error. The motivation for this change is that an application should decide what to do when it misuses the API and encounters a PSA_ERROR_BAD_STATE error. The library should not attempt to abort on behalf of the application, as that may not be the correct thing to do in all circumstances.
2019-02-20 15:37:15 +00:00
return( PSA_ERROR_BAD_STATE );
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 10:56:32 +00:00
}
partly pr fix
2018-04-04 12:43:05 +00:00
if( iv_size < operation->iv_size )
{
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 10:56:32 +00:00
status = PSA_ERROR_BUFFER_TOO_SMALL;
partly pr fix
2018-04-04 12:43:05 +00:00
goto exit;
}
Wrap lines to 80 columns
2018-06-04 14:23:10 +00:00
ret = mbedtls_ctr_drbg_random( &global_data.ctr_drbg,
iv, operation->iv_size );
partly pr fix
2018-04-04 12:43:05 +00:00
if( ret != 0 )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
{
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 10:56:32 +00:00
status = mbedtls_to_psa_error( ret );
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 14:22:46 +00:00
goto exit;
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
}
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 14:22:46 +00:00
CR fixes more fixes Compilation fixes Compilation fixes for PSA crypto code and tests
2018-03-18 11:57:31 +00:00
*iv_length = operation->iv_size;
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 10:56:32 +00:00
status = psa_cipher_set_iv( operation, iv, *iv_length );
partly pr fix
2018-04-04 12:43:05 +00:00
adjust indentation per Mbed TLS standards
2018-05-31 11:07:14 +00:00
exit:
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 10:56:32 +00:00
if( status != PSA_SUCCESS )
adjust indentation per Mbed TLS standards
2018-05-31 11:07:14 +00:00
psa_cipher_abort( operation );
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 10:56:32 +00:00
return( status );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
}
Rename psa cipher functions to psa_cipher_xxx Make function names for multipart operations more consistent (cipher edition). Rename symmetric cipher multipart operation functions so that they all start with psa_cipher_: * psa_encrypt_setup -> psa_cipher_encrypt_setup * psa_decrypt_setup -> psa_cipher_decrypt_setup * psa_encrypt_set_iv -> psa_cipher_set_iv * psa_encrypt_generate_iv -> psa_cipher_generate_iv
2018-07-08 19:39:34 +00:00
psa_status_t psa_cipher_set_iv( psa_cipher_operation_t *operation,
Apply same changes to implementation source code
2019-05-15 11:33:23 +00:00
const uint8_t *iv,
Rename psa cipher functions to psa_cipher_xxx Make function names for multipart operations more consistent (cipher edition). Rename symmetric cipher multipart operation functions so that they all start with psa_cipher_: * psa_encrypt_setup -> psa_cipher_encrypt_setup * psa_decrypt_setup -> psa_cipher_decrypt_setup * psa_encrypt_set_iv -> psa_cipher_set_iv * psa_encrypt_generate_iv -> psa_cipher_generate_iv
2018-07-08 19:39:34 +00:00
size_t iv_length )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
{
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 10:56:32 +00:00
psa_status_t status;
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Formatting improvements Avoid lines longer than 80 columns. Remove some redundant parentheses, e.g. change if( ( a == b ) && ( c == d ) ) to if( a == b && c == d ) which makes lines less long and makes the remaining parentheses more relevant. Add missing parentheses around return statements. There should be no semantic change in this commit.
2018-06-18 14:04:39 +00:00
if( operation->iv_set || ! operation->iv_required )
add missing call to psa_cipher_abort in cipher_setup func + iv_length check in cipher_set_iv func
2018-04-22 17:23:16 +00:00
{
psa: Don't abort when operations are invalid In places where we detect a context is in a bad state and there is no sensitive data to clear, simply return PSA_ERROR_BAD_STATE and don't abort on behalf of the application. The application will choose what to do when it gets a bad state error. The motivation for this change is that an application should decide what to do when it misuses the API and encounters a PSA_ERROR_BAD_STATE error. The library should not attempt to abort on behalf of the application, as that may not be the correct thing to do in all circumstances.
2019-02-20 15:37:15 +00:00
return( PSA_ERROR_BAD_STATE );
add missing call to psa_cipher_abort in cipher_setup func + iv_length check in cipher_set_iv func
2018-04-22 17:23:16 +00:00
}
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 10:56:32 +00:00
if( iv_length != operation->iv_size )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
{
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 10:56:32 +00:00
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
}
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 10:56:32 +00:00
ret = mbedtls_cipher_set_iv( &operation->ctx.cipher, iv, iv_length );
status = mbedtls_to_psa_error( ret );
exit:
if( status == PSA_SUCCESS )
operation->iv_set = 1;
else
psa_cipher_abort( operation );
return( status );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
}
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 14:22:46 +00:00
psa_status_t psa_cipher_update( psa_cipher_operation_t *operation,
const uint8_t *input,
size_t input_length,
Apply same changes to implementation source code
2019-05-15 11:33:23 +00:00
uint8_t *output,
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 14:22:46 +00:00
size_t output_size,
size_t *output_length )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
{
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 10:56:32 +00:00
psa_status_t status;
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Refactor some argument checks for readability No intended behavior change.
2018-06-04 15:17:16 +00:00
size_t expected_output_size;
psa: Disallow use of invalid cipher contexts Ensure that when doing cipher operations out of order, PSA_ERROR_BAD_STATE is returned as documented in crypto.h and the PSA Crypto specification.
2019-02-15 14:12:05 +00:00
if( operation->alg == 0 )
{
return( PSA_ERROR_BAD_STATE );
}
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 12:02:45 +00:00
if( ! PSA_ALG_IS_STREAM_CIPHER( operation->alg ) )
Refactor some argument checks for readability No intended behavior change.
2018-06-04 15:17:16 +00:00
{
/* Take the unprocessed partial block left over from previous
* update calls, if any, plus the input to this call. Remove
* the last partial block, if any. You get the data that will be
* output in this call. */
expected_output_size =
( operation->ctx.cipher.unprocessed_len + input_length )
/ operation->block_size * operation->block_size;
}
else
{
expected_output_size = input_length;
}
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 10:56:32 +00:00
Refactor some argument checks for readability No intended behavior change.
2018-06-04 15:17:16 +00:00
if( output_size < expected_output_size )
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 10:56:32 +00:00
{
status = PSA_ERROR_BUFFER_TOO_SMALL;
goto exit;
}
warnings fixes
2018-03-12 16:16:40 +00:00
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
ret = mbedtls_cipher_update( &operation->ctx.cipher, input,
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 14:22:46 +00:00
input_length, output, output_length );
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 10:56:32 +00:00
status = mbedtls_to_psa_error( ret );
exit:
if( status != PSA_SUCCESS )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
psa_cipher_abort( operation );
Add missing calls to psa_cipher_abort in cipher functions
2018-08-02 10:56:32 +00:00
return( status );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
}
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 14:22:46 +00:00
psa_status_t psa_cipher_finish( psa_cipher_operation_t *operation,
uint8_t *output,
size_t output_size,
size_t *output_length )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
{
Replace PSA error code definitions with the ones defined in PSA spec
2019-02-14 11:48:10 +00:00
psa_status_t status = PSA_ERROR_GENERIC_ERROR;
Fix memory leak in psa_cipher_finish()
2018-07-09 15:04:51 +00:00
int cipher_ret = MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE;
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 14:22:46 +00:00
uint8_t temp_output_buffer[MBEDTLS_MAX_BLOCK_LENGTH];
fix missing check on output_size in psa_cipher_finish func
2018-04-22 17:19:20 +00:00
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
if( ! operation->key_set )
abort operation before return + fix error checks
2018-06-05 08:40:02 +00:00
{
psa: Don't abort when operations are invalid In places where we detect a context is in a bad state and there is no sensitive data to clear, simply return PSA_ERROR_BAD_STATE and don't abort on behalf of the application. The application will choose what to do when it gets a bad state error. The motivation for this change is that an application should decide what to do when it misuses the API and encounters a PSA_ERROR_BAD_STATE error. The library should not attempt to abort on behalf of the application, as that may not be the correct thing to do in all circumstances.
2019-02-20 15:37:15 +00:00
return( PSA_ERROR_BAD_STATE );
abort operation before return + fix error checks
2018-06-05 08:40:02 +00:00
}
adjust indentation per Mbed TLS standards
2018-05-29 13:25:04 +00:00
if( operation->iv_required && ! operation->iv_set )
abort operation before return + fix error checks
2018-06-05 08:40:02 +00:00
{
psa: Don't abort when operations are invalid In places where we detect a context is in a bad state and there is no sensitive data to clear, simply return PSA_ERROR_BAD_STATE and don't abort on behalf of the application. The application will choose what to do when it gets a bad state error. The motivation for this change is that an application should decide what to do when it misuses the API and encounters a PSA_ERROR_BAD_STATE error. The library should not attempt to abort on behalf of the application, as that may not be the correct thing to do in all circumstances.
2019-02-20 15:37:15 +00:00
return( PSA_ERROR_BAD_STATE );
abort operation before return + fix error checks
2018-06-05 08:40:02 +00:00
}
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 12:02:45 +00:00
Whitespace normalization No semantic change.
2018-06-06 13:12:32 +00:00
if( operation->ctx.cipher.operation == MBEDTLS_ENCRYPT &&
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 12:02:45 +00:00
operation->alg == PSA_ALG_CBC_NO_PADDING &&
operation->ctx.cipher.unprocessed_len != 0 )
fix missing check on output_size in psa_cipher_finish func
2018-04-22 17:19:20 +00:00
{
Correct and simplify block-based cipher modes OFB and CFB are streaming modes. XTS is a not a cipher mode but it doesn't use a separate padding step. This leaves only CBC as a block cipher mode that needs a padding step. Since CBC is the only mode that uses a separate padding step, and is likely to remain the only mode in the future, encode the padding mode directly in the algorithm constant, rather than building up an algorithm value from a chaining mode and a padding mode. This greatly simplifies the interface as well as some parts of the implementation.
2018-08-21 12:02:45 +00:00
status = PSA_ERROR_INVALID_ARGUMENT;
Fix memory leak in psa_cipher_finish()
2018-07-09 15:04:51 +00:00
goto error;
delete decrypt checks + fix memcpy& return value
2018-04-30 12:45:34 +00:00
}
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
Fix memory leak in psa_cipher_finish()
2018-07-09 15:04:51 +00:00
cipher_ret = mbedtls_cipher_finish( &operation->ctx.cipher,
temp_output_buffer,
output_length );
if( cipher_ret != 0 )
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
{
Fix memory leak in psa_cipher_finish()
2018-07-09 15:04:51 +00:00
status = mbedtls_to_psa_error( cipher_ret );
goto error;
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
}
Fix memory leak in psa_cipher_finish()
2018-07-09 15:04:51 +00:00
Handle null pointers safely when used as buffers of size 0 When the size of a buffer is 0, the corresponding pointer argument may be null. In such cases, library functions must not perform arithmetic on the pointer or call standard library functions such as memset and memcpy, since that would be undefined behavior in C. Protect such cases. Refactor the storage of a 0-sized raw data object to make it store a null pointer, rather than depending on the behavior of calloc(1,0).
2018-06-28 17:31:31 +00:00
if( *output_length == 0 )
Fix memory leak in psa_cipher_finish()
2018-07-09 15:04:51 +00:00
; /* Nothing to copy. Note that output may be NULL in this case. */
Handle null pointers safely when used as buffers of size 0 When the size of a buffer is 0, the corresponding pointer argument may be null. In such cases, library functions must not perform arithmetic on the pointer or call standard library functions such as memset and memcpy, since that would be undefined behavior in C. Protect such cases. Refactor the storage of a 0-sized raw data object to make it store a null pointer, rather than depending on the behavior of calloc(1,0).
2018-06-28 17:31:31 +00:00
else if( output_size >= *output_length )
delete decrypt checks + fix memcpy& return value
2018-04-30 12:45:34 +00:00
memcpy( output, temp_output_buffer, *output_length );
else
{
Fix memory leak in psa_cipher_finish()
2018-07-09 15:04:51 +00:00
status = PSA_ERROR_BUFFER_TOO_SMALL;
goto error;
delete decrypt checks + fix memcpy& return value
2018-04-30 12:45:34 +00:00
}
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 17:14:53 +00:00
mbedtls_platform_zeroize( temp_output_buffer, sizeof( temp_output_buffer ) );
Fix memory leak in psa_cipher_finish()
2018-07-09 15:04:51 +00:00
status = psa_cipher_abort( operation );
return( status );
error:
*output_length = 0;
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 17:14:53 +00:00
mbedtls_platform_zeroize( temp_output_buffer, sizeof( temp_output_buffer ) );
Fix memory leak in psa_cipher_finish()
2018-07-09 15:04:51 +00:00
(void) psa_cipher_abort( operation );
return( status );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
}
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 14:22:46 +00:00
psa_status_t psa_cipher_abort( psa_cipher_operation_t *operation )
{
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 14:05:20 +00:00
if( operation->alg == 0 )
psa_hash_abort: return PSA_SUCCESS if alg=0 Make psa_hash_abort consistent with psa_mac_abort and psa_cipher_abort. Add a comment explaining the reasoning.
2018-06-26 13:04:31 +00:00
{
/* The object has (apparently) been initialized but it is not
* in use. It's ok to call abort on such an object, and there's
* nothing to do. */
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 14:05:20 +00:00
return( PSA_SUCCESS );
psa_hash_abort: return PSA_SUCCESS if alg=0 Make psa_hash_abort consistent with psa_mac_abort and psa_cipher_abort. Add a comment explaining the reasoning.
2018-06-26 13:04:31 +00:00
}
Fix potential memory corruption on MAC/cipher setup failure When psa_mac_start(), psa_encrypt_setup() or psa_cipher_setup() failed, depending on when the failure happened, it was possible that psa_mac_abort() or psa_cipher_abort() would crash because it would try to call a free() function uninitialized data in the operation structure. Refactor the functions so that they initialize the operation structure before doing anything else. Add non-regression tests and a few more positive and negative unit tests for psa_mac_start() and psa_cipher_setup() (the latter via psa_encrypt_setip()).
2018-06-20 14:05:20 +00:00
In abort functions, return BAD_STATE on obviously bad input psa_hash_abort, psa_mac_abort and psa_cipher_abort now return PSA_ERROR_BAD_STATE if operation->alg is obviously not valid, which can only happen due to a programming error in the caller or in the library. We can't detect all cases of calling abort on uninitialized memory but this is dirt cheap and better than nothing.
2018-06-21 14:57:07 +00:00
/* Sanity check (shouldn't happen: operation->alg should
* always have been initialized to a valid value). */
if( ! PSA_ALG_IS_CIPHER( operation->alg ) )
return( PSA_ERROR_BAD_STATE );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
mbedtls_cipher_free( &operation->ctx.cipher );
Fix indentation and horizontal whitespace Only whitespace changes in this commit.
2018-06-04 14:22:46 +00:00
partly pr fix
2018-04-04 12:43:05 +00:00
operation->alg = 0;
add iv_required field to psa_cipher_operation_s and fix relevant functions
2018-04-30 09:31:04 +00:00
operation->key_set = 0;
operation->iv_set = 0;
operation->iv_size = 0;
partly pr fix
2018-04-04 12:43:05 +00:00
operation->block_size = 0;
add iv_required field to psa_cipher_operation_s and fix relevant functions
2018-04-30 09:31:04 +00:00
operation->iv_required = 0;
partly pr fix
2018-04-04 12:43:05 +00:00
adjust indentation per Mbed TLS standards
2018-05-31 11:07:14 +00:00
return( PSA_SUCCESS );
initial implementation for PSA symmetric APIs - missing tests and documentations
2018-03-12 13:59:30 +00:00
}
Merge remote-tracking branch 'psa/pr/13' into feature-psa Conflicts: library/psa_crypto.c tests/suites/test_suite_psa_crypto.data tests/suites/test_suite_psa_crypto.function All the conflicts are concurrent additions where the order doesn't matter. I put the code from feature-psa (key policy) before the code from PR #13 (key lifetime).
2018-04-30 15:06:50 +00:00
Be more consistent about blank lines
2018-06-18 19:49:39 +00:00
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 21:53:03 +00:00
/****************************************************************/
/* AEAD */
/****************************************************************/
Be more consistent about blank lines
2018-06-18 19:49:39 +00:00
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
typedef struct
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 16:12:32 +00:00
psa_key_slot_t *slot;
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
const mbedtls_cipher_info_t *cipher_info;
union
{
#if defined(MBEDTLS_CCM_C)
mbedtls_ccm_context ccm;
#endif /* MBEDTLS_CCM_C */
#if defined(MBEDTLS_GCM_C)
mbedtls_gcm_context gcm;
#endif /* MBEDTLS_GCM_C */
Implement ChaCha20 and ChaCha20-Poly1305 Smoke tests: test data for ChaCha20 calculated with PyCryptodome; test vector from RFC 7539 for ChaCha20-Poly1305.
2019-05-06 13:25:00 +00:00
#if defined(MBEDTLS_CHACHAPOLY_C)
mbedtls_chachapoly_context chachapoly;
#endif /* MBEDTLS_CHACHAPOLY_C */
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
} ctx;
Add support for non-default-tag-size AEAD (CCM and GCM)
2018-08-17 17:47:52 +00:00
psa_algorithm_t core_alg;
uint8_t full_tag_length;
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
uint8_t tag_length;
} aead_operation_t;
Declare multipart AEAD functions Declare and document multipart AEAD functions. This commit does not contain any implementation or tests.
2019-01-14 17:36:12 +00:00
static void psa_aead_abort_internal( aead_operation_t *operation )
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
{
Fix memory leak with AEAD with non-default tag lengths When freeing the key context, choose the context format based on the base algorithm value stored in the operation object.
2018-08-21 14:38:05 +00:00
switch( operation->core_alg )
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
{
#if defined(MBEDTLS_CCM_C)
case PSA_ALG_CCM:
mbedtls_ccm_free( &operation->ctx.ccm );
break;
#endif /* MBEDTLS_CCM_C */
Add missing compilation guards for GCM and CCM Add missing compilation guards that broke the build if either GCM or CCM was not defined. Add missing guards on test cases that require GCM or CBC. The build and tests now pass for any subset of {MBEDTLS_CCM_C, MBEDTLS_GCM_C}. There are still unused variables warnings if neither is defined.
2018-11-28 16:30:58 +00:00
#if defined(MBEDTLS_GCM_C)
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
case PSA_ALG_GCM:
mbedtls_gcm_free( &operation->ctx.gcm );
break;
#endif /* MBEDTLS_GCM_C */
}
}
static psa_status_t psa_aead_setup( aead_operation_t *operation,
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 17:08:14 +00:00
psa_key_handle_t handle,
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
psa_key_usage_t usage,
psa_algorithm_t alg )
{
psa_status_t status;
size_t key_bits;
mbedtls_cipher_id_t cipher_id;
SE keys: ensure that functions that lack support properly error out Introduce a new function psa_get_transparent_key which returns NOT_SUPPORTED if the key is in a secure element. Use this function in functions that don't support keys in a secure element. After this commit, all functions that access a key slot directly via psa_get_key_slot or psa_get_key_from_slot rather than via psa_get_transparent_key have at least enough support for secure elements not to crash or otherwise cause undefined behavior. Lesser bad behavior such as wrong results or resource leakage is still possible in error cases.
2019-07-24 11:30:31 +00:00
status = psa_get_transparent_key( handle, &operation->slot, usage, alg );
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
if( status != PSA_SUCCESS )
return( status );
Implement missing attributes setters and getters
2019-04-18 10:53:01 +00:00
key_bits = psa_get_key_slot_bits( operation->slot );
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
operation->cipher_info =
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
mbedtls_cipher_info_from_psa( alg, operation->slot->attr.type, key_bits,
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
&cipher_id );
if( operation->cipher_info == NULL )
return( PSA_ERROR_NOT_SUPPORTED );
Add support for non-default-tag-size AEAD (CCM and GCM)
2018-08-17 17:47:52 +00:00
switch( PSA_ALG_AEAD_WITH_TAG_LENGTH( alg, 0 ) )
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
{
#if defined(MBEDTLS_CCM_C)
Add support for non-default-tag-size AEAD (CCM and GCM)
2018-08-17 17:47:52 +00:00
case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_CCM, 0 ):
operation->core_alg = PSA_ALG_CCM;
operation->full_tag_length = 16;
Minor refactoring in AEAD code Make it a little easier to add ChaCha20-Poly1305. This also fixes the error code in case mbedtls_gcm_setkey() fails with a status that doesn't map to INVALID_ARGUMENT.
2019-05-06 13:27:16 +00:00
/* CCM allows the following tag lengths: 4, 6, 8, 10, 12, 14, 16.
* The call to mbedtls_ccm_encrypt_and_tag or
* mbedtls_ccm_auth_decrypt will validate the tag length. */
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( PSA_BLOCK_CIPHER_BLOCK_SIZE( operation->slot->attr.type ) != 16 )
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
return( PSA_ERROR_INVALID_ARGUMENT );
mbedtls_ccm_init( &operation->ctx.ccm );
status = mbedtls_to_psa_error(
mbedtls_ccm_setkey( &operation->ctx.ccm, cipher_id,
operation->slot->data.raw.data,
(unsigned int) key_bits ) );
if( status != 0 )
goto cleanup;
break;
#endif /* MBEDTLS_CCM_C */
#if defined(MBEDTLS_GCM_C)
Add support for non-default-tag-size AEAD (CCM and GCM)
2018-08-17 17:47:52 +00:00
case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_GCM, 0 ):
operation->core_alg = PSA_ALG_GCM;
operation->full_tag_length = 16;
Minor refactoring in AEAD code Make it a little easier to add ChaCha20-Poly1305. This also fixes the error code in case mbedtls_gcm_setkey() fails with a status that doesn't map to INVALID_ARGUMENT.
2019-05-06 13:27:16 +00:00
/* GCM allows the following tag lengths: 4, 8, 12, 13, 14, 15, 16.
* The call to mbedtls_gcm_crypt_and_tag or
* mbedtls_gcm_auth_decrypt will validate the tag length. */
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( PSA_BLOCK_CIPHER_BLOCK_SIZE( operation->slot->attr.type ) != 16 )
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
return( PSA_ERROR_INVALID_ARGUMENT );
mbedtls_gcm_init( &operation->ctx.gcm );
status = mbedtls_to_psa_error(
mbedtls_gcm_setkey( &operation->ctx.gcm, cipher_id,
operation->slot->data.raw.data,
(unsigned int) key_bits ) );
Minor refactoring in AEAD code Make it a little easier to add ChaCha20-Poly1305. This also fixes the error code in case mbedtls_gcm_setkey() fails with a status that doesn't map to INVALID_ARGUMENT.
2019-05-06 13:27:16 +00:00
if( status != 0 )
goto cleanup;
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
break;
#endif /* MBEDTLS_GCM_C */
Implement ChaCha20 and ChaCha20-Poly1305 Smoke tests: test data for ChaCha20 calculated with PyCryptodome; test vector from RFC 7539 for ChaCha20-Poly1305.
2019-05-06 13:25:00 +00:00
#if defined(MBEDTLS_CHACHAPOLY_C)
case PSA_ALG_AEAD_WITH_TAG_LENGTH( PSA_ALG_CHACHA20_POLY1305, 0 ):
operation->core_alg = PSA_ALG_CHACHA20_POLY1305;
operation->full_tag_length = 16;
/* We only support the default tag length. */
if( alg != PSA_ALG_CHACHA20_POLY1305 )
return( PSA_ERROR_NOT_SUPPORTED );
mbedtls_chachapoly_init( &operation->ctx.chachapoly );
status = mbedtls_to_psa_error(
mbedtls_chachapoly_setkey( &operation->ctx.chachapoly,
operation->slot->data.raw.data ) );
if( status != 0 )
goto cleanup;
break;
#endif /* MBEDTLS_CHACHAPOLY_C */
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
default:
return( PSA_ERROR_NOT_SUPPORTED );
}
Add support for non-default-tag-size AEAD (CCM and GCM)
2018-08-17 17:47:52 +00:00
if( PSA_AEAD_TAG_LENGTH( alg ) > operation->full_tag_length )
{
status = PSA_ERROR_INVALID_ARGUMENT;
goto cleanup;
}
operation->tag_length = PSA_AEAD_TAG_LENGTH( alg );
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
return( PSA_SUCCESS );
cleanup:
Declare multipart AEAD functions Declare and document multipart AEAD functions. This commit does not contain any implementation or tests.
2019-01-14 17:36:12 +00:00
psa_aead_abort_internal( operation );
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
return( status );
}
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 17:08:14 +00:00
psa_status_t psa_aead_encrypt( psa_key_handle_t handle,
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 21:53:03 +00:00
psa_algorithm_t alg,
const uint8_t *nonce,
size_t nonce_length,
const uint8_t *additional_data,
size_t additional_data_length,
const uint8_t *plaintext,
size_t plaintext_length,
uint8_t *ciphertext,
size_t ciphertext_size,
size_t *ciphertext_length )
{
psa_status_t status;
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
aead_operation_t operation;
write the tag directly on the ciphertext buffer.
2018-06-03 14:19:55 +00:00
uint8_t *tag;
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 13:41:12 +00:00
set output length to zero to cover output length in error case
2018-06-03 12:05:47 +00:00
*ciphertext_length = 0;
fix condition over key type
2018-05-09 11:58:32 +00:00
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 17:08:14 +00:00
status = psa_aead_setup( &operation, handle, PSA_KEY_USAGE_ENCRYPT, alg );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 15:01:38 +00:00
if( status != PSA_SUCCESS )
return( status );
add Key and Algorithm validation
2018-05-09 09:24:42 +00:00
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
/* For all currently supported modes, the tag is at the end of the
* ciphertext. */
if( ciphertext_size < ( plaintext_length + operation.tag_length ) )
{
status = PSA_ERROR_BUFFER_TOO_SMALL;
goto exit;
}
tag = ciphertext + plaintext_length;
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 21:53:03 +00:00
Add missing compilation guards for GCM and CCM Add missing compilation guards that broke the build if either GCM or CCM was not defined. Add missing guards on test cases that require GCM or CBC. The build and tests now pass for any subset of {MBEDTLS_CCM_C, MBEDTLS_GCM_C}. There are still unused variables warnings if neither is defined.
2018-11-28 16:30:58 +00:00
#if defined(MBEDTLS_GCM_C)
Add support for non-default-tag-size AEAD (CCM and GCM)
2018-08-17 17:47:52 +00:00
if( operation.core_alg == PSA_ALG_GCM )
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 21:53:03 +00:00
{
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
status = mbedtls_to_psa_error(
mbedtls_gcm_crypt_and_tag( &operation.ctx.gcm,
MBEDTLS_GCM_ENCRYPT,
plaintext_length,
nonce, nonce_length,
additional_data, additional_data_length,
plaintext, ciphertext,
operation.tag_length, tag ) );
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 21:53:03 +00:00
}
Add missing compilation guards for GCM and CCM Add missing compilation guards that broke the build if either GCM or CCM was not defined. Add missing guards on test cases that require GCM or CBC. The build and tests now pass for any subset of {MBEDTLS_CCM_C, MBEDTLS_GCM_C}. There are still unused variables warnings if neither is defined.
2018-11-28 16:30:58 +00:00
else
#endif /* MBEDTLS_GCM_C */
#if defined(MBEDTLS_CCM_C)
if( operation.core_alg == PSA_ALG_CCM )
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 21:53:03 +00:00
{
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
status = mbedtls_to_psa_error(
mbedtls_ccm_encrypt_and_tag( &operation.ctx.ccm,
plaintext_length,
nonce, nonce_length,
additional_data,
additional_data_length,
plaintext, ciphertext,
tag, operation.tag_length ) );
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 21:53:03 +00:00
}
return invalid argument for unsupported algorithms
2018-05-09 12:40:09 +00:00
else
Add missing compilation guards for GCM and CCM Add missing compilation guards that broke the build if either GCM or CCM was not defined. Add missing guards on test cases that require GCM or CBC. The build and tests now pass for any subset of {MBEDTLS_CCM_C, MBEDTLS_GCM_C}. There are still unused variables warnings if neither is defined.
2018-11-28 16:30:58 +00:00
#endif /* MBEDTLS_CCM_C */
Implement ChaCha20 and ChaCha20-Poly1305 Smoke tests: test data for ChaCha20 calculated with PyCryptodome; test vector from RFC 7539 for ChaCha20-Poly1305.
2019-05-06 13:25:00 +00:00
#if defined(MBEDTLS_CHACHAPOLY_C)
if( operation.core_alg == PSA_ALG_CHACHA20_POLY1305 )
return invalid argument for unsupported algorithms
2018-05-09 12:40:09 +00:00
{
Implement ChaCha20 and ChaCha20-Poly1305 Smoke tests: test data for ChaCha20 calculated with PyCryptodome; test vector from RFC 7539 for ChaCha20-Poly1305.
2019-05-06 13:25:00 +00:00
if( nonce_length != 12 || operation.tag_length != 16 )
{
status = PSA_ERROR_NOT_SUPPORTED;
goto exit;
}
status = mbedtls_to_psa_error(
mbedtls_chachapoly_encrypt_and_tag( &operation.ctx.chachapoly,
plaintext_length,
nonce,
additional_data,
additional_data_length,
plaintext,
ciphertext,
tag ) );
}
else
#endif /* MBEDTLS_CHACHAPOLY_C */
return invalid argument for unsupported algorithms
2018-05-09 12:40:09 +00:00
{
return NOT_SUPPORTED instead of INVLID_ARGUMENT
2018-06-03 12:07:38 +00:00
return( PSA_ERROR_NOT_SUPPORTED );
return invalid argument for unsupported algorithms
2018-05-09 12:40:09 +00:00
}
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 13:41:12 +00:00
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
if( status != PSA_SUCCESS && ciphertext_size != 0 )
memset( ciphertext, 0, ciphertext_size );
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 13:41:12 +00:00
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
exit:
Declare multipart AEAD functions Declare and document multipart AEAD functions. This commit does not contain any implementation or tests.
2019-01-14 17:36:12 +00:00
psa_aead_abort_internal( &operation );
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
if( status == PSA_SUCCESS )
*ciphertext_length = plaintext_length + operation.tag_length;
return( status );
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 21:53:03 +00:00
}
Fix psa_aead_decrypt to read the tag at the end of the ciphertext
2018-06-01 17:23:52 +00:00
/* Locate the tag in a ciphertext buffer containing the encrypted data
* followed by the tag. Return the length of the part preceding the tag in
* *plaintext_length. This is the size of the plaintext in modes where
* the encrypted data has the same size as the plaintext, such as
* CCM and GCM. */
static psa_status_t psa_aead_unpadded_locate_tag( size_t tag_length,
const uint8_t *ciphertext,
size_t ciphertext_length,
size_t plaintext_size,
const uint8_t **p_tag )
{
size_t payload_length;
if( tag_length > ciphertext_length )
return( PSA_ERROR_INVALID_ARGUMENT );
payload_length = ciphertext_length - tag_length;
if( payload_length > plaintext_size )
return( PSA_ERROR_BUFFER_TOO_SMALL );
*p_tag = ciphertext + payload_length;
return( PSA_SUCCESS );
}
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 17:08:14 +00:00
psa_status_t psa_aead_decrypt( psa_key_handle_t handle,
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 21:53:03 +00:00
psa_algorithm_t alg,
const uint8_t *nonce,
size_t nonce_length,
const uint8_t *additional_data,
size_t additional_data_length,
const uint8_t *ciphertext,
size_t ciphertext_length,
uint8_t *plaintext,
size_t plaintext_size,
size_t *plaintext_length )
{
psa_status_t status;
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
aead_operation_t operation;
const uint8_t *tag = NULL;
Normalize whitespace Normalize whitespace to Mbed TLS standards. There are only whitespace changes in this commit.
2018-06-18 13:41:12 +00:00
Fix psa_aead_decrypt to read the tag at the end of the ciphertext
2018-06-01 17:23:52 +00:00
*plaintext_length = 0;
Fix parameter validation
2018-04-26 09:07:35 +00:00
Drop support for psa_key_slot_t in psa_crypto.c This commit finishes the removal of support for direct access to key slots in psa_crypto.c. This marks the end of the necessary phase of the transition to key handles. The code should subsequently be refactored to move key slot management from psa_crypto.c to psa_crypto_slot_management.c.
2018-12-03 17:08:14 +00:00
status = psa_aead_setup( &operation, handle, PSA_KEY_USAGE_DECRYPT, alg );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 15:01:38 +00:00
if( status != PSA_SUCCESS )
return( status );
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 21:53:03 +00:00
Minor refactoring in AEAD code Make it a little easier to add ChaCha20-Poly1305. This also fixes the error code in case mbedtls_gcm_setkey() fails with a status that doesn't map to INVALID_ARGUMENT.
2019-05-06 13:27:16 +00:00
status = psa_aead_unpadded_locate_tag( operation.tag_length,
ciphertext, ciphertext_length,
plaintext_size, &tag );
if( status != PSA_SUCCESS )
goto exit;
Add missing compilation guards for GCM and CCM Add missing compilation guards that broke the build if either GCM or CCM was not defined. Add missing guards on test cases that require GCM or CBC. The build and tests now pass for any subset of {MBEDTLS_CCM_C, MBEDTLS_GCM_C}. There are still unused variables warnings if neither is defined.
2018-11-28 16:30:58 +00:00
#if defined(MBEDTLS_GCM_C)
Add support for non-default-tag-size AEAD (CCM and GCM)
2018-08-17 17:47:52 +00:00
if( operation.core_alg == PSA_ALG_GCM )
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 21:53:03 +00:00
{
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
status = mbedtls_to_psa_error(
mbedtls_gcm_auth_decrypt( &operation.ctx.gcm,
ciphertext_length - operation.tag_length,
nonce, nonce_length,
additional_data,
additional_data_length,
tag, operation.tag_length,
ciphertext, plaintext ) );
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 21:53:03 +00:00
}
Add missing compilation guards for GCM and CCM Add missing compilation guards that broke the build if either GCM or CCM was not defined. Add missing guards on test cases that require GCM or CBC. The build and tests now pass for any subset of {MBEDTLS_CCM_C, MBEDTLS_GCM_C}. There are still unused variables warnings if neither is defined.
2018-11-28 16:30:58 +00:00
else
#endif /* MBEDTLS_GCM_C */
#if defined(MBEDTLS_CCM_C)
if( operation.core_alg == PSA_ALG_CCM )
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 21:53:03 +00:00
{
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
status = mbedtls_to_psa_error(
mbedtls_ccm_auth_decrypt( &operation.ctx.ccm,
ciphertext_length - operation.tag_length,
nonce, nonce_length,
additional_data,
additional_data_length,
ciphertext, plaintext,
tag, operation.tag_length ) );
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 21:53:03 +00:00
}
add else for not supported algorithm
2018-06-01 11:39:53 +00:00
else
Add missing compilation guards for GCM and CCM Add missing compilation guards that broke the build if either GCM or CCM was not defined. Add missing guards on test cases that require GCM or CBC. The build and tests now pass for any subset of {MBEDTLS_CCM_C, MBEDTLS_GCM_C}. There are still unused variables warnings if neither is defined.
2018-11-28 16:30:58 +00:00
#endif /* MBEDTLS_CCM_C */
Implement ChaCha20 and ChaCha20-Poly1305 Smoke tests: test data for ChaCha20 calculated with PyCryptodome; test vector from RFC 7539 for ChaCha20-Poly1305.
2019-05-06 13:25:00 +00:00
#if defined(MBEDTLS_CHACHAPOLY_C)
if( operation.core_alg == PSA_ALG_CHACHA20_POLY1305 )
{
if( nonce_length != 12 || operation.tag_length != 16 )
{
status = PSA_ERROR_NOT_SUPPORTED;
goto exit;
}
status = mbedtls_to_psa_error(
mbedtls_chachapoly_auth_decrypt( &operation.ctx.chachapoly,
ciphertext_length - operation.tag_length,
nonce,
additional_data,
additional_data_length,
tag,
ciphertext,
plaintext ) );
}
else
#endif /* MBEDTLS_CHACHAPOLY_C */
add else for not supported algorithm
2018-06-01 11:39:53 +00:00
{
return NOT_SUPPORTED instead of INVLID_ARGUMENT
2018-06-03 12:07:38 +00:00
return( PSA_ERROR_NOT_SUPPORTED );
add else for not supported algorithm
2018-06-01 11:39:53 +00:00
}
Whitespace fixes Changed indentation to match Mbed TLS style. Wrapped some lines to 80 columns.
2018-06-01 14:28:30 +00:00
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
if( status != PSA_SUCCESS && plaintext_size != 0 )
memset( plaintext, 0, plaintext_size );
remove unnecessary argument to the psa_aead_unpadded_locate_tag function
2018-06-03 14:20:42 +00:00
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
exit:
Declare multipart AEAD functions Declare and document multipart AEAD functions. This commit does not contain any implementation or tests.
2019-01-14 17:36:12 +00:00
psa_aead_abort_internal( &operation );
Refactor AEAD setup into a common function There was a lot of repetition between psa_aead_encrypt and psa_aead_decrypt. Refactor the code into a new function psa_aead_setup. The new code should behave identically except that in some cases where multiple error conditions apply, the code may now return a different error code. Internally, I rearranged some of the code: * I removed a check that the key type was in CATEGORY_SYMMETRIC because it's redundant with mbedtls_cipher_info_from_psa which enumerates supported key types explicitly. * The order of some validations is different to allow the split between setup and data processing. The code now calls a more robust function psa_aead_abort in case of any error after the early stage of the setup.
2018-08-17 16:11:56 +00:00
if( status == PSA_SUCCESS )
*plaintext_length = ciphertext_length - operation.tag_length;
return( status );
Initial implementation of the AEAD decrypt/encrypt APIs Initial implementation for the AEAD APIs, missing the following: * Concatenation of the tag to the output buffer. * Updated documentation of the new functions. * argument validations * tests
2018-04-25 21:53:03 +00:00
}
Merge remote-tracking branch 'psa/pr/13' into feature-psa Conflicts: library/psa_crypto.c tests/suites/test_suite_psa_crypto.data tests/suites/test_suite_psa_crypto.function All the conflicts are concurrent additions where the order doesn't matter. I put the code from feature-psa (key policy) before the code from PR #13 (key lifetime).
2018-04-30 15:06:50 +00:00
Be more consistent about blank lines
2018-06-18 19:49:39 +00:00
Implement psa_generate_random
2018-06-19 20:00:52 +00:00
/****************************************************************/
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
/* Generators */
/****************************************************************/
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
#define HKDF_STATE_INIT 0 /* no input yet */
#define HKDF_STATE_STARTED 1 /* got salt */
#define HKDF_STATE_KEYED 2 /* got key */
#define HKDF_STATE_OUTPUT 3 /* output started */
Rename generator-related internal identifiers perl -pe 's/crypto_generator/key_derivation/gi' $(git ls-files) perl -pe 's/_generator/_key_derivation/gi' $(git ls-files)
2019-05-16 14:59:18 +00:00
static psa_algorithm_t psa_key_derivation_get_kdf_alg(
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
const psa_key_derivation_operation_t *operation )
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
if ( PSA_ALG_IS_KEY_AGREEMENT( operation->alg ) )
return( PSA_ALG_KEY_AGREEMENT_GET_KDF( operation->alg ) );
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
else
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
return( operation->alg );
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
}
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
psa_status_t psa_key_derivation_abort( psa_key_derivation_operation_t *operation )
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
{
psa_status_t status = PSA_SUCCESS;
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg( operation );
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
if( kdf_alg == 0 )
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
{
/* The object has (apparently) been initialized but it is not
* in use. It's ok to call abort on such an object, and there's
* nothing to do. */
}
else
Implement HKDF
2018-07-12 15:22:21 +00:00
#if defined(MBEDTLS_MD_C)
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
if( PSA_ALG_IS_HKDF( kdf_alg ) )
Implement HKDF
2018-07-12 15:22:21 +00:00
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
mbedtls_free( operation->ctx.hkdf.info );
status = psa_hmac_abort_internal( &operation->ctx.hkdf.hmac );
Implement HKDF
2018-07-12 15:22:21 +00:00
}
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
else if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
/* TLS-1.2 PSK-to-MS KDF uses the same core as TLS-1.2 PRF */
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
Add implementation of TLS-1.2 PRF
2018-10-09 16:33:01 +00:00
{
Adapt psa_key_derivation_abort to the new context
2019-06-11 09:37:28 +00:00
if( operation->ctx.tls12_prf.seed != NULL )
Add implementation of TLS-1.2 PRF
2018-10-09 16:33:01 +00:00
{
Adapt psa_key_derivation_abort to the new context
2019-06-11 09:37:28 +00:00
mbedtls_platform_zeroize( operation->ctx.tls12_prf.seed,
operation->ctx.tls12_prf.seed_length );
mbedtls_free( operation->ctx.tls12_prf.seed );
Add implementation of TLS-1.2 PRF
2018-10-09 16:33:01 +00:00
}
Dynamically allocate `A(i) + seed` buffer for TLS-1.2 PRF
2018-11-13 20:50:45 +00:00
Adapt psa_key_derivation_abort to the new context
2019-06-11 09:37:28 +00:00
if( operation->ctx.tls12_prf.label != NULL )
Dynamically allocate `A(i) + seed` buffer for TLS-1.2 PRF
2018-11-13 20:50:45 +00:00
{
Adapt psa_key_derivation_abort to the new context
2019-06-11 09:37:28 +00:00
mbedtls_platform_zeroize( operation->ctx.tls12_prf.label,
operation->ctx.tls12_prf.label_length );
mbedtls_free( operation->ctx.tls12_prf.label );
Dynamically allocate `A(i) + seed` buffer for TLS-1.2 PRF
2018-11-13 20:50:45 +00:00
}
Adapt psa_key_derivation_abort to the new context
2019-06-11 09:37:28 +00:00
status = psa_hmac_abort_internal( &operation->ctx.tls12_prf.hmac );
/* We leave the fields Ai and output_block to be erased safely by the
* mbedtls_platform_zeroize() in the end of this function. */
Add implementation of TLS-1.2 PRF
2018-10-09 16:33:01 +00:00
}
Implement HKDF
2018-07-12 15:22:21 +00:00
else
#endif /* MBEDTLS_MD_C */
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
{
status = PSA_ERROR_BAD_STATE;
}
Safely erase key material upon abort Some key derivation operation contexts (like psa_tls12_prf_key_derivation_t) directly contain buffers with parts of the derived key. Erase them safely as part of the abort.
2019-06-11 09:22:26 +00:00
mbedtls_platform_zeroize( operation, sizeof( *operation ) );
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
return( status );
}
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
psa_status_t psa_key_derivation_get_capacity(const psa_key_derivation_operation_t *operation,
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
size_t *capacity)
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
if( operation->alg == 0 )
psa: Check generator validity before read Check generator validity (i.e. that alg has been initialized) before allowing reads from the generator or allowing reads of the generator's capacity. This aligns our implementation with the documented error code behavior in our crypto.h and the PSA Crypto API.
2019-02-15 13:05:49 +00:00
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
/* This is a blank key derivation operation. */
psa: Check generator validity before read Check generator validity (i.e. that alg has been initialized) before allowing reads from the generator or allowing reads of the generator's capacity. This aligns our implementation with the documented error code behavior in our crypto.h and the PSA Crypto API.
2019-02-15 13:05:49 +00:00
return PSA_ERROR_BAD_STATE;
}
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
*capacity = operation->capacity;
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
return( PSA_SUCCESS );
}
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
psa_status_t psa_key_derivation_set_capacity( psa_key_derivation_operation_t *operation,
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
size_t capacity )
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
if( operation->alg == 0 )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
return( PSA_ERROR_BAD_STATE );
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
if( capacity > operation->capacity )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
return( PSA_ERROR_INVALID_ARGUMENT );
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
operation->capacity = capacity;
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
return( PSA_SUCCESS );
}
Implement HKDF
2018-07-12 15:22:21 +00:00
#if defined(MBEDTLS_MD_C)
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
/* Read some bytes from an HKDF-based operation. This performs a chunk
Implement HKDF
2018-07-12 15:22:21 +00:00
* of the expand phase of the HKDF algorithm. */
Rename generator-related internal identifiers perl -pe 's/crypto_generator/key_derivation/gi' $(git ls-files) perl -pe 's/_generator/_key_derivation/gi' $(git ls-files)
2019-05-16 14:59:18 +00:00
static psa_status_t psa_key_derivation_hkdf_read( psa_hkdf_key_derivation_t *hkdf,
Implement HKDF
2018-07-12 15:22:21 +00:00
psa_algorithm_t hash_alg,
uint8_t *output,
size_t output_length )
{
uint8_t hash_length = PSA_HASH_SIZE( hash_alg );
psa_status_t status;
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
if( hkdf->state < HKDF_STATE_KEYED || ! hkdf->info_set )
return( PSA_ERROR_BAD_STATE );
hkdf->state = HKDF_STATE_OUTPUT;
Implement HKDF
2018-07-12 15:22:21 +00:00
while( output_length != 0 )
{
/* Copy what remains of the current block */
uint8_t n = hash_length - hkdf->offset_in_block;
if( n > output_length )
n = (uint8_t) output_length;
memcpy( output, hkdf->output_block + hkdf->offset_in_block, n );
output += n;
output_length -= n;
hkdf->offset_in_block += n;
HKDF: be more robust if we reach the maximum ouptut length In psa_generator_hkdf_read, return BAD_STATE if we're trying to construct more output than the algorithm allows. This can't happen through the API due to the capacity limit, but it could potentially happen in an internal call. Also add a test case that verifies that we can set up HKDF with its maximum capacity and read up to the maximum capacity.
2018-07-17 19:06:59 +00:00
if( output_length == 0 )
Implement HKDF
2018-07-12 15:22:21 +00:00
break;
HKDF: be more robust if we reach the maximum ouptut length In psa_generator_hkdf_read, return BAD_STATE if we're trying to construct more output than the algorithm allows. This can't happen through the API due to the capacity limit, but it could potentially happen in an internal call. Also add a test case that verifies that we can set up HKDF with its maximum capacity and read up to the maximum capacity.
2018-07-17 19:06:59 +00:00
/* We can't be wanting more output after block 0xff, otherwise
Rename generator functions to psa_key_derivation_xxx Generators are mostly about key derivation (currently: only about key derivation). "Generator" is not a commonly used term in cryptography. So favor "derivation" as terminology. Call a generator a key derivation operation structure, since it behaves like other multipart operation structures. Furthermore, the function names are not fully consistent. In this commit, I rename the functions to consistently have the prefix "psa_key_derivation_". I used the following command: perl -i -pe '%t = ( psa_crypto_generator_t => "psa_key_derivation_operation_t", psa_crypto_generator_init => "psa_key_derivation_init", psa_key_derivation_setup => "psa_key_derivation_setup", psa_key_derivation_input_key => "psa_key_derivation_input_key", psa_key_derivation_input_bytes => "psa_key_derivation_input_bytes", psa_key_agreement => "psa_key_derivation_key_agreement", psa_set_generator_capacity => "psa_key_derivation_set_capacity", psa_get_generator_capacity => "psa_key_derivation_get_capacity", psa_generator_read => "psa_key_derivation_output_bytes", psa_generate_derived_key => "psa_key_derivation_output_key", psa_generator_abort => "psa_key_derivation_abort", PSA_CRYPTO_GENERATOR_INIT => "PSA_KEY_DERIVATION_OPERATION_INIT", PSA_GENERATOR_UNBRIDLED_CAPACITY => "PSA_KEY_DERIVATION_UNLIMITED_CAPACITY", ); s/\b(@{[join("|", keys %t)]})\b/$t{$1}/ge' $(git ls-files)
2019-05-16 13:28:51 +00:00
* the capacity check in psa_key_derivation_output_bytes() would have
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
* prevented this call. It could happen only if the operation
HKDF: be more robust if we reach the maximum ouptut length In psa_generator_hkdf_read, return BAD_STATE if we're trying to construct more output than the algorithm allows. This can't happen through the API due to the capacity limit, but it could potentially happen in an internal call. Also add a test case that verifies that we can set up HKDF with its maximum capacity and read up to the maximum capacity.
2018-07-17 19:06:59 +00:00
* object was corrupted or if this function is called directly
* inside the library. */
if( hkdf->block_number == 0xff )
return( PSA_ERROR_BAD_STATE );
Implement HKDF
2018-07-12 15:22:21 +00:00
/* We need a new block */
++hkdf->block_number;
hkdf->offset_in_block = 0;
status = psa_hmac_setup_internal( &hkdf->hmac,
hkdf->prk, hash_length,
hash_alg );
if( status != PSA_SUCCESS )
return( status );
if( hkdf->block_number != 1 )
{
status = psa_hash_update( &hkdf->hmac.hash_ctx,
hkdf->output_block,
hash_length );
if( status != PSA_SUCCESS )
return( status );
}
status = psa_hash_update( &hkdf->hmac.hash_ctx,
hkdf->info,
hkdf->info_length );
if( status != PSA_SUCCESS )
return( status );
status = psa_hash_update( &hkdf->hmac.hash_ctx,
&hkdf->block_number, 1 );
if( status != PSA_SUCCESS )
return( status );
status = psa_hmac_finish_internal( &hkdf->hmac,
hkdf->output_block,
sizeof( hkdf->output_block ) );
if( status != PSA_SUCCESS )
return( status );
}
return( PSA_SUCCESS );
}
Add implementation of TLS-1.2 PRF
2018-10-09 16:33:01 +00:00
Add stub for new tls12_prf_generate_next_block
2019-06-17 11:58:10 +00:00
static psa_status_t psa_key_derivation_tls12_prf_generate_next_block(
psa_tls12_prf_key_derivation_t *tls12_prf,
psa_algorithm_t alg )
{
psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( alg );
uint8_t hash_length = PSA_HASH_SIZE( hash_alg );
Add tls12_prf key derivation to the new API The TLS 1.2 pseudorandom function does a lot of distinct HMAC operations with the same key. To save the battery and CPU cycles spent on calculating the paddings and hashing the inner padding, we keep the hash context in the status right after the inner padding having been hashed and clone it as needed.
2019-06-19 11:21:20 +00:00
psa_hash_operation_t backup = PSA_HASH_OPERATION_INIT;
psa_status_t status, cleanup_status;
Add implementation of TLS-1.2 PRF
2018-10-09 16:33:01 +00:00
Add stub for new tls12_prf_generate_next_block
2019-06-17 11:58:10 +00:00
/* We can't be wanting more output after block 0xff, otherwise
* the capacity check in psa_key_derivation_output_bytes() would have
* prevented this call. It could happen only if the operation
* object was corrupted or if this function is called directly
* inside the library. */
if( tls12_prf->block_number == 0xff )
Fix error code PSA_ERROR_BAD_STATE means that the function was called on a context in a bad state. This error is something that can't happen while only using the PSA API and therefore a PSA_ERROR_CORRUPTION_DETECTED is a more appropriate error code.
2019-06-25 09:15:04 +00:00
return( PSA_ERROR_CORRUPTION_DETECTED );
Add stub for new tls12_prf_generate_next_block
2019-06-17 11:58:10 +00:00
/* We need a new block */
++tls12_prf->block_number;
Add tls12_prf_read for the new API Technically we could have reused the old one for the new API, but then we had to set an extra field during setup. The new version works when all the fields that haven't been set explicitely are zero-initialised.
2019-06-19 11:10:49 +00:00
tls12_prf->left_in_block = hash_length;
Add stub for new tls12_prf_generate_next_block
2019-06-17 11:58:10 +00:00
/* Recall the definition of the TLS-1.2-PRF from RFC 5246:
*
* PRF(secret, label, seed) = P_<hash>(secret, label + seed)
*
* P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
* HMAC_hash(secret, A(2) + seed) +
* HMAC_hash(secret, A(3) + seed) + ...
*
* A(0) = seed
Add tls12_prf key derivation to the new API The TLS 1.2 pseudorandom function does a lot of distinct HMAC operations with the same key. To save the battery and CPU cycles spent on calculating the paddings and hashing the inner padding, we keep the hash context in the status right after the inner padding having been hashed and clone it as needed.
2019-06-19 11:21:20 +00:00
* A(i) = HMAC_hash(secret, A(i-1))
Add stub for new tls12_prf_generate_next_block
2019-06-17 11:58:10 +00:00
*
Add tls12_prf key derivation to the new API The TLS 1.2 pseudorandom function does a lot of distinct HMAC operations with the same key. To save the battery and CPU cycles spent on calculating the paddings and hashing the inner padding, we keep the hash context in the status right after the inner padding having been hashed and clone it as needed.
2019-06-19 11:21:20 +00:00
* The `psa_tls12_prf_key_derivation` structure saves the block
Add stub for new tls12_prf_generate_next_block
2019-06-17 11:58:10 +00:00
* `HMAC_hash(secret, A(i) + seed)` from which the output
Clarify TLS PRF algorithm description
2019-06-26 11:50:36 +00:00
* is currently extracted as `output_block` and where i is
* `block_number`.
Add stub for new tls12_prf_generate_next_block
2019-06-17 11:58:10 +00:00
*/
Add tls12_prf key derivation to the new API The TLS 1.2 pseudorandom function does a lot of distinct HMAC operations with the same key. To save the battery and CPU cycles spent on calculating the paddings and hashing the inner padding, we keep the hash context in the status right after the inner padding having been hashed and clone it as needed.
2019-06-19 11:21:20 +00:00
/* Save the hash context before using it, to preserve the hash state with
* only the inner padding in it. We need this, because inner padding depends
* on the key (secret in the RFC's terminology). */
status = psa_hash_clone( &tls12_prf->hmac.hash_ctx, &backup );
if( status != PSA_SUCCESS )
goto cleanup;
/* Calculate A(i) where i = tls12_prf->block_number. */
if( tls12_prf->block_number == 1 )
{
/* A(1) = HMAC_hash(secret, A(0)), where A(0) = seed. (The RFC overloads
* the variable seed and in this instance means it in the context of the
* P_hash function, where seed = label + seed.) */
status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
tls12_prf->label, tls12_prf->label_length );
if( status != PSA_SUCCESS )
goto cleanup;
status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
tls12_prf->seed, tls12_prf->seed_length );
if( status != PSA_SUCCESS )
goto cleanup;
}
else
{
/* A(i) = HMAC_hash(secret, A(i-1)) */
status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
tls12_prf->Ai, hash_length );
if( status != PSA_SUCCESS )
goto cleanup;
}
status = psa_hmac_finish_internal( &tls12_prf->hmac,
tls12_prf->Ai, hash_length );
if( status != PSA_SUCCESS )
goto cleanup;
status = psa_hash_clone( &backup, &tls12_prf->hmac.hash_ctx );
if( status != PSA_SUCCESS )
goto cleanup;
/* Calculate HMAC_hash(secret, A(i) + label + seed). */
status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
tls12_prf->Ai, hash_length );
if( status != PSA_SUCCESS )
goto cleanup;
status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
tls12_prf->label, tls12_prf->label_length );
if( status != PSA_SUCCESS )
goto cleanup;
status = psa_hash_update( &tls12_prf->hmac.hash_ctx,
tls12_prf->seed, tls12_prf->seed_length );
if( status != PSA_SUCCESS )
goto cleanup;
status = psa_hmac_finish_internal( &tls12_prf->hmac,
tls12_prf->output_block, hash_length );
if( status != PSA_SUCCESS )
goto cleanup;
status = psa_hash_clone( &backup, &tls12_prf->hmac.hash_ctx );
if( status != PSA_SUCCESS )
goto cleanup;
Add stub for new tls12_prf_generate_next_block
2019-06-17 11:58:10 +00:00
cleanup:
Add tls12_prf key derivation to the new API The TLS 1.2 pseudorandom function does a lot of distinct HMAC operations with the same key. To save the battery and CPU cycles spent on calculating the paddings and hashing the inner padding, we keep the hash context in the status right after the inner padding having been hashed and clone it as needed.
2019-06-19 11:21:20 +00:00
cleanup_status = psa_hash_abort( &backup );
if( status == PSA_SUCCESS && cleanup_status != PSA_SUCCESS )
status = cleanup_status;
return( status );
Add stub for new tls12_prf_generate_next_block
2019-06-17 11:58:10 +00:00
}
Add implementation of TLS-1.2 PRF
2018-10-09 16:33:01 +00:00
Add tls12_prf_read for the new API Technically we could have reused the old one for the new API, but then we had to set an extra field during setup. The new version works when all the fields that haven't been set explicitely are zero-initialised.
2019-06-19 11:10:49 +00:00
static psa_status_t psa_key_derivation_tls12_prf_read(
psa_tls12_prf_key_derivation_t *tls12_prf,
psa_algorithm_t alg,
uint8_t *output,
size_t output_length )
{
psa_algorithm_t hash_alg = PSA_ALG_TLS12_PRF_GET_HASH( alg );
uint8_t hash_length = PSA_HASH_SIZE( hash_alg );
psa_status_t status;
uint8_t offset, length;
while( output_length != 0 )
{
/* Check if we have fully processed the current block. */
if( tls12_prf->left_in_block == 0 )
{
status = psa_key_derivation_tls12_prf_generate_next_block( tls12_prf,
alg );
if( status != PSA_SUCCESS )
return( status );
continue;
}
if( tls12_prf->left_in_block > output_length )
length = (uint8_t) output_length;
else
length = tls12_prf->left_in_block;
offset = hash_length - tls12_prf->left_in_block;
memcpy( output, tls12_prf->output_block + offset, length );
output += length;
output_length -= length;
tls12_prf->left_in_block -= length;
}
return( PSA_SUCCESS );
}
Implement HKDF
2018-07-12 15:22:21 +00:00
#endif /* MBEDTLS_MD_C */
Improve style
2019-06-17 11:38:20 +00:00
psa_status_t psa_key_derivation_output_bytes(
psa_key_derivation_operation_t *operation,
uint8_t *output,
size_t output_length )
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
{
psa_status_t status;
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg( operation );
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
if( operation->alg == 0 )
psa: Check generator validity before read Check generator validity (i.e. that alg has been initialized) before allowing reads from the generator or allowing reads of the generator's capacity. This aligns our implementation with the documented error code behavior in our crypto.h and the PSA Crypto API.
2019-02-15 13:05:49 +00:00
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
/* This is a blank operation. */
psa: Check generator validity before read Check generator validity (i.e. that alg has been initialized) before allowing reads from the generator or allowing reads of the generator's capacity. This aligns our implementation with the documented error code behavior in our crypto.h and the PSA Crypto API.
2019-02-15 13:05:49 +00:00
return PSA_ERROR_BAD_STATE;
}
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
if( output_length > operation->capacity )
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
operation->capacity = 0;
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
/* Go through the error path to wipe all confidential data now
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
* that the operation object is useless. */
Replace PSA error code definitions with the ones defined in PSA spec
2019-02-14 11:48:10 +00:00
status = PSA_ERROR_INSUFFICIENT_DATA;
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
goto exit;
}
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
if( output_length == 0 && operation->capacity == 0 )
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
/* Edge case: this is a finished operation, and 0 bytes
psa: Check generator validity before read Check generator validity (i.e. that alg has been initialized) before allowing reads from the generator or allowing reads of the generator's capacity. This aligns our implementation with the documented error code behavior in our crypto.h and the PSA Crypto API.
2019-02-15 13:05:49 +00:00
* were requested. The right error in this case could
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
* be either INSUFFICIENT_CAPACITY or BAD_STATE. Return
* INSUFFICIENT_CAPACITY, which is right for a finished
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
* operation, for consistency with the case when
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
* output_length > 0. */
Replace PSA error code definitions with the ones defined in PSA spec
2019-02-14 11:48:10 +00:00
return( PSA_ERROR_INSUFFICIENT_DATA );
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
}
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
operation->capacity -= output_length;
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
Implement HKDF
2018-07-12 15:22:21 +00:00
#if defined(MBEDTLS_MD_C)
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
if( PSA_ALG_IS_HKDF( kdf_alg ) )
Implement HKDF
2018-07-12 15:22:21 +00:00
{
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( kdf_alg );
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
status = psa_key_derivation_hkdf_read( &operation->ctx.hkdf, hash_alg,
Implement HKDF
2018-07-12 15:22:21 +00:00
output, output_length );
}
Remove the deprecated PSA_ALG_SELECT_RAW option This change affects the psa_key_derivation_s structure. With the buffer removed from the union, it is empty if MBEDTLS_MD_C is not defined. We can avoid undefined behaviour by adding a new dummy field that is always present or make the whole union conditional on MBEDTLS_MD_C. In this latter case the initialiser macro has to depend on MBEDTLS_MD_C as well. Furthermore the first structure would be either psa_hkdf_key_derivation_t or psa_tls12_prf_key_derivation_t both of which are very deep and would make the initialisation macro difficult to maintain, therefore we go with the first option.
2019-06-14 10:05:39 +00:00
else
if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
Add implementation of TLS-1.2 PRF
2018-10-09 16:33:01 +00:00
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
status = psa_key_derivation_tls12_prf_read( &operation->ctx.tls12_prf,
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
kdf_alg, output,
Add implementation of TLS-1.2 PRF
2018-10-09 16:33:01 +00:00
output_length );
}
Implement HKDF
2018-07-12 15:22:21 +00:00
else
#endif /* MBEDTLS_MD_C */
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
{
return( PSA_ERROR_BAD_STATE );
}
exit:
if( status != PSA_SUCCESS )
{
psa: Check generator validity before read Check generator validity (i.e. that alg has been initialized) before allowing reads from the generator or allowing reads of the generator's capacity. This aligns our implementation with the documented error code behavior in our crypto.h and the PSA Crypto API.
2019-02-15 13:05:49 +00:00
/* Preserve the algorithm upon errors, but clear all sensitive state.
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
* This allows us to differentiate between exhausted operations and
* blank operations, so we can return PSA_ERROR_BAD_STATE on blank
* operations. */
psa_algorithm_t alg = operation->alg;
psa_key_derivation_abort( operation );
operation->alg = alg;
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
memset( output, '!', output_length );
}
return( status );
}
Fix psa_generator_import_key for DES In psa_generator_import_key, if generating a DES or 3DES key, set the parity bits. Add tests for deriving a DES key. Also test deriving an AES key while I'm at it.
2018-07-19 15:05:42 +00:00
#if defined(MBEDTLS_DES_C)
static void psa_des_set_key_parity( uint8_t *data, size_t data_size )
{
if( data_size >= 8 )
mbedtls_des_key_set_parity( data );
if( data_size >= 16 )
mbedtls_des_key_set_parity( data + 8 );
if( data_size >= 24 )
mbedtls_des_key_set_parity( data + 16 );
}
#endif /* MBEDTLS_DES_C */
Rename psa_generate_key() and psa_generator_import_key()
2019-05-03 14:44:28 +00:00
static psa_status_t psa_generate_derived_key_internal(
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 10:53:30 +00:00
psa_key_slot_t *slot,
size_t bits,
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
psa_key_derivation_operation_t *operation )
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
{
uint8_t *data = NULL;
size_t bytes = PSA_BITS_TO_BYTES( bits );
psa_status_t status;
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( ! key_type_is_raw_bytes( slot->attr.type ) )
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
return( PSA_ERROR_INVALID_ARGUMENT );
if( bits % 8 != 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
data = mbedtls_calloc( 1, bytes );
if( data == NULL )
return( PSA_ERROR_INSUFFICIENT_MEMORY );
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
status = psa_key_derivation_output_bytes( operation, data, bytes );
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
if( status != PSA_SUCCESS )
goto exit;
Fix psa_generator_import_key for DES In psa_generator_import_key, if generating a DES or 3DES key, set the parity bits. Add tests for deriving a DES key. Also test deriving an AES key while I'm at it.
2018-07-19 15:05:42 +00:00
#if defined(MBEDTLS_DES_C)
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( slot->attr.type == PSA_KEY_TYPE_DES )
Fix psa_generator_import_key for DES In psa_generator_import_key, if generating a DES or 3DES key, set the parity bits. Add tests for deriving a DES key. Also test deriving an AES key while I'm at it.
2018-07-19 15:05:42 +00:00
psa_des_set_key_parity( data, bytes );
#endif /* MBEDTLS_DES_C */
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 10:53:30 +00:00
status = psa_import_key_into_slot( slot, data, bytes );
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
exit:
mbedtls_free( data );
return( status );
}
Rename generator functions to psa_key_derivation_xxx Generators are mostly about key derivation (currently: only about key derivation). "Generator" is not a commonly used term in cryptography. So favor "derivation" as terminology. Call a generator a key derivation operation structure, since it behaves like other multipart operation structures. Furthermore, the function names are not fully consistent. In this commit, I rename the functions to consistently have the prefix "psa_key_derivation_". I used the following command: perl -i -pe '%t = ( psa_crypto_generator_t => "psa_key_derivation_operation_t", psa_crypto_generator_init => "psa_key_derivation_init", psa_key_derivation_setup => "psa_key_derivation_setup", psa_key_derivation_input_key => "psa_key_derivation_input_key", psa_key_derivation_input_bytes => "psa_key_derivation_input_bytes", psa_key_agreement => "psa_key_derivation_key_agreement", psa_set_generator_capacity => "psa_key_derivation_set_capacity", psa_get_generator_capacity => "psa_key_derivation_get_capacity", psa_generator_read => "psa_key_derivation_output_bytes", psa_generate_derived_key => "psa_key_derivation_output_key", psa_generator_abort => "psa_key_derivation_abort", PSA_CRYPTO_GENERATOR_INIT => "PSA_KEY_DERIVATION_OPERATION_INIT", PSA_GENERATOR_UNBRIDLED_CAPACITY => "PSA_KEY_DERIVATION_UNLIMITED_CAPACITY", ); s/\b(@{[join("|", keys %t)]})\b/$t{$1}/ge' $(git ls-files)
2019-05-16 13:28:51 +00:00
psa_status_t psa_key_derivation_output_key( const psa_key_attributes_t *attributes,
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
psa_key_derivation_operation_t *operation,
Put handle parameter last: psa_generate_derived_key In psa_generate_derived_key, change the order of parameters to pass the pointer where the newly created handle will be stored last. This is consistent with most other library functions that put inputs before outputs.
2019-05-15 17:43:49 +00:00
psa_key_handle_t *handle )
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 10:53:30 +00:00
{
psa_status_t status;
psa_key_slot_t *slot = NULL;
Driver table entries are now mutable Since driver table entries contain the driver context, which is mutable, they can't be const anymore.
2019-07-12 21:40:35 +00:00
psa_se_drv_table_entry_t *driver = NULL;
Reject keys of size 0 Implement the prohibition on keys of size 0.
2019-09-12 17:03:13 +00:00
/* Reject any attempt to create a zero-length key so that we don't
* risk tripping up later, e.g. on a malloc(0) that returns NULL. */
if( psa_get_key_bits( attributes ) == 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
Key derivation: forbid output_key without input_key If none of the inputs to a key derivation is a PSA_KEY_DERIVATION_INPUT_SECRET passed with psa_key_derivation_input_key(), forbid psa_key_derivation_output_key(). It usually doesn't make sense to derive a key object if the secret isn't itself a proper key.
2019-09-24 16:21:06 +00:00
if( ! operation->can_output_key )
return( PSA_ERROR_NOT_PERMITTED );
psa_start_key_creation: take the method as a parameter Let psa_start_key_creation know what type of key creation this is. This will be used at least for key registration in a secure element, which is a peculiar kind of creation since it uses existing key material.
2019-07-15 20:02:14 +00:00
status = psa_start_key_creation( PSA_KEY_CREATION_DERIVE,
attributes, handle, &slot, &driver );
SE keys: error out in key creation function that lack support
2019-07-24 11:44:30 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
if( driver != NULL )
{
/* Deriving a key in a secure element is not implemented yet. */
status = PSA_ERROR_NOT_SUPPORTED;
}
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 10:53:30 +00:00
if( status == PSA_SUCCESS )
{
Rename psa_generate_key() and psa_generator_import_key()
2019-05-03 14:44:28 +00:00
status = psa_generate_derived_key_internal( slot,
Move attribute fields to a substructure Move the "core attributes" to a substructure of psa_key_attribute_t. The motivation is to be able to use the new structure psa_core_key_attributes_t internally.
2019-07-30 11:48:52 +00:00
attributes->core.bits,
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
operation );
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 10:53:30 +00:00
}
if( status == PSA_SUCCESS )
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
status = psa_finish_key_creation( slot, driver );
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 10:53:30 +00:00
if( status != PSA_SUCCESS )
{
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
psa_fail_key_creation( slot, driver );
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 10:53:30 +00:00
*handle = 0;
}
return( status );
}
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
Add framework for simple key derivation New key type PSA_KEY_TYPE_DERIVE. New usage flag PSA_KEY_USAGE_DERIVE. New function psa_key_derivation. No key derivation algorithm is implemented yet. The code may not compile with -Wunused. Write some unit test code for psa_key_derivation. Most of it cannot be used yet due to the lack of a key derivation algorithm.
2018-07-12 15:17:20 +00:00
/****************************************************************/
/* Key derivation */
/****************************************************************/
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
static psa_status_t psa_key_derivation_setup_kdf(
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
psa_key_derivation_operation_t *operation,
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
psa_algorithm_t kdf_alg )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
{
Make key derivation initialisation consistent The macro initialiser might leave bytes in the union unspecified. Zeroising it in setup makes sure that the behaviour is the same independently of the initialisation method used.
2019-06-20 14:09:30 +00:00
/* Make sure that operation->ctx is properly zero-initialised. (Macro
* initialisers for this union leave some bytes unspecified.) */
memset( &operation->ctx, 0, sizeof( operation->ctx ) );
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
/* Make sure that kdf_alg is a supported key derivation algorithm. */
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
#if defined(MBEDTLS_MD_C)
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
if( PSA_ALG_IS_HKDF( kdf_alg ) ||
PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
{
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH( kdf_alg );
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
size_t hash_size = PSA_HASH_SIZE( hash_alg );
if( hash_size == 0 )
return( PSA_ERROR_NOT_SUPPORTED );
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
if( ( PSA_ALG_IS_TLS12_PRF( kdf_alg ) ||
PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) ) &&
fixup! Key derivation by small input steps: proof-of-concept Fix logic error that clang helpfully points out
2019-04-12 13:06:27 +00:00
! ( hash_alg == PSA_ALG_SHA_256 || hash_alg == PSA_ALG_SHA_384 ) )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
{
return( PSA_ERROR_NOT_SUPPORTED );
}
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
operation->capacity = 255 * hash_size;
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
return( PSA_SUCCESS );
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
}
#endif /* MBEDTLS_MD_C */
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
else
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
return( PSA_ERROR_NOT_SUPPORTED );
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
}
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
psa_status_t psa_key_derivation_setup( psa_key_derivation_operation_t *operation,
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
psa_algorithm_t alg )
{
psa_status_t status;
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
if( operation->alg != 0 )
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
return( PSA_ERROR_BAD_STATE );
Simplify the encoding of key agreement algorithms Get rid of "key selection" algorithms (of which there was only one: raw key selection). Encode key agreement by combining a raw key agreement with a KDF, rather than passing the KDF as an argument of a key agreement macro.
2019-01-18 15:44:49 +00:00
if( PSA_ALG_IS_RAW_KEY_AGREEMENT( alg ) )
return( PSA_ERROR_INVALID_ARGUMENT );
else if( PSA_ALG_IS_KEY_AGREEMENT( alg ) )
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
{
psa_algorithm_t kdf_alg = PSA_ALG_KEY_AGREEMENT_GET_KDF( alg );
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
status = psa_key_derivation_setup_kdf( operation, kdf_alg );
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
}
else if( PSA_ALG_IS_KEY_DERIVATION( alg ) )
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
status = psa_key_derivation_setup_kdf( operation, alg );
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
}
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
else
return( PSA_ERROR_INVALID_ARGUMENT );
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
if( status == PSA_SUCCESS )
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
operation->alg = alg;
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
return( status );
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
}
#if defined(MBEDTLS_MD_C)
Rename generator-related internal identifiers perl -pe 's/crypto_generator/key_derivation/gi' $(git ls-files) perl -pe 's/_generator/_key_derivation/gi' $(git ls-files)
2019-05-16 14:59:18 +00:00
static psa_status_t psa_hkdf_input( psa_hkdf_key_derivation_t *hkdf,
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
psa_algorithm_t hash_alg,
psa_key_derivation_step_t step,
const uint8_t *data,
size_t data_length )
{
psa_status_t status;
switch( step )
{
Rename PSA_KDF_STEP_xxx -> PSA_KEY_DERIVATION_INPUT_xxx More consistent with the new function names.
2019-05-16 14:05:19 +00:00
case PSA_KEY_DERIVATION_INPUT_SALT:
fixup! Key derivation by small input steps: proof-of-concept Simplify the logic inside a few case statements. This removes unreachable break statements.
2019-04-12 13:11:49 +00:00
if( hkdf->state != HKDF_STATE_INIT )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
return( PSA_ERROR_BAD_STATE );
fixup! Key derivation by small input steps: proof-of-concept Simplify the logic inside a few case statements. This removes unreachable break statements.
2019-04-12 13:11:49 +00:00
status = psa_hmac_setup_internal( &hkdf->hmac,
data, data_length,
hash_alg );
if( status != PSA_SUCCESS )
return( status );
hkdf->state = HKDF_STATE_STARTED;
return( PSA_SUCCESS );
Rename PSA_KDF_STEP_xxx -> PSA_KEY_DERIVATION_INPUT_xxx More consistent with the new function names.
2019-05-16 14:05:19 +00:00
case PSA_KEY_DERIVATION_INPUT_SECRET:
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
/* If no salt was provided, use an empty salt. */
if( hkdf->state == HKDF_STATE_INIT )
{
status = psa_hmac_setup_internal( &hkdf->hmac,
NULL, 0,
Fix confusion between HMAC algorithm and the corresponding hash
2019-04-11 19:22:52 +00:00
hash_alg );
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
if( status != PSA_SUCCESS )
return( status );
hkdf->state = HKDF_STATE_STARTED;
}
fixup! Key derivation by small input steps: proof-of-concept Simplify the logic inside a few case statements. This removes unreachable break statements.
2019-04-12 13:11:49 +00:00
if( hkdf->state != HKDF_STATE_STARTED )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
return( PSA_ERROR_BAD_STATE );
fixup! Key derivation by small input steps: proof-of-concept Simplify the logic inside a few case statements. This removes unreachable break statements.
2019-04-12 13:11:49 +00:00
status = psa_hash_update( &hkdf->hmac.hash_ctx,
data, data_length );
if( status != PSA_SUCCESS )
return( status );
status = psa_hmac_finish_internal( &hkdf->hmac,
hkdf->prk,
sizeof( hkdf->prk ) );
if( status != PSA_SUCCESS )
return( status );
hkdf->offset_in_block = PSA_HASH_SIZE( hash_alg );
hkdf->block_number = 0;
hkdf->state = HKDF_STATE_KEYED;
return( PSA_SUCCESS );
Rename PSA_KDF_STEP_xxx -> PSA_KEY_DERIVATION_INPUT_xxx More consistent with the new function names.
2019-05-16 14:05:19 +00:00
case PSA_KEY_DERIVATION_INPUT_INFO:
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
if( hkdf->state == HKDF_STATE_OUTPUT )
return( PSA_ERROR_BAD_STATE );
if( hkdf->info_set )
return( PSA_ERROR_BAD_STATE );
hkdf->info_length = data_length;
if( data_length != 0 )
{
hkdf->info = mbedtls_calloc( 1, data_length );
if( hkdf->info == NULL )
return( PSA_ERROR_INSUFFICIENT_MEMORY );
memcpy( hkdf->info, data, data_length );
}
hkdf->info_set = 1;
return( PSA_SUCCESS );
default:
return( PSA_ERROR_INVALID_ARGUMENT );
}
}
Add seed input for psa_tls12_prf_input
2019-06-13 08:05:41 +00:00
static psa_status_t psa_tls12_prf_set_seed( psa_tls12_prf_key_derivation_t *prf,
const uint8_t *data,
size_t data_length )
{
if( prf->state != TLS12_PRF_STATE_INIT )
return( PSA_ERROR_BAD_STATE );
Fix zero-length seed or label in TLS 1.2 PRF The psa_tls12_prf_set_seed() and psa_tls12_prf_set_label() functions did not work on platforms where malloc(0) returns NULL. It does not affect the TLS use case but these PRFs are used in other protocols as well and might not be used the same way. For example EAP uses the TLS PRF with an empty secret. (This would not trigger the bug, but is a strong indication that it is not safe to assume that certain inputs to this function are not zero length.) The conditional block includes the memcpy() call as well to avoid passing a NULL pointer as a parameter resulting in undefined behaviour. The current tests are already using zero length label and seed, there is no need to add new test for this bug.
2019-07-04 08:11:38 +00:00
if( data_length != 0 )
{
prf->seed = mbedtls_calloc( 1, data_length );
if( prf->seed == NULL )
return( PSA_ERROR_INSUFFICIENT_MEMORY );
Add seed input for psa_tls12_prf_input
2019-06-13 08:05:41 +00:00
Fix zero-length seed or label in TLS 1.2 PRF The psa_tls12_prf_set_seed() and psa_tls12_prf_set_label() functions did not work on platforms where malloc(0) returns NULL. It does not affect the TLS use case but these PRFs are used in other protocols as well and might not be used the same way. For example EAP uses the TLS PRF with an empty secret. (This would not trigger the bug, but is a strong indication that it is not safe to assume that certain inputs to this function are not zero length.) The conditional block includes the memcpy() call as well to avoid passing a NULL pointer as a parameter resulting in undefined behaviour. The current tests are already using zero length label and seed, there is no need to add new test for this bug.
2019-07-04 08:11:38 +00:00
memcpy( prf->seed, data, data_length );
prf->seed_length = data_length;
}
Add seed input for psa_tls12_prf_input
2019-06-13 08:05:41 +00:00
prf->state = TLS12_PRF_STATE_SEED_SET;
return( PSA_SUCCESS );
}
Add key import for psa_tls12_prf_input
2019-06-13 13:26:34 +00:00
static psa_status_t psa_tls12_prf_set_key( psa_tls12_prf_key_derivation_t *prf,
psa_algorithm_t hash_alg,
const uint8_t *data,
size_t data_length )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
{
psa_status_t status;
Add key import for psa_tls12_prf_input
2019-06-13 13:26:34 +00:00
if( prf->state != TLS12_PRF_STATE_SEED_SET )
return( PSA_ERROR_BAD_STATE );
status = psa_hmac_setup_internal( &prf->hmac, data, data_length, hash_alg );
if( status != PSA_SUCCESS )
return( status );
prf->state = TLS12_PRF_STATE_KEY_SET;
return( PSA_SUCCESS );
}
Add TLS 1.2 PSK master secret generation
2019-06-17 07:44:03 +00:00
static psa_status_t psa_tls12_prf_psk_to_ms_set_key(
psa_tls12_prf_key_derivation_t *prf,
psa_algorithm_t hash_alg,
const uint8_t *data,
size_t data_length )
{
psa_status_t status;
Favor stdint.h types in internal types Use uint8_t for PSA buffers. Keep unsigned char for generic libc buffers and for mbedtls buffers.
2019-07-15 09:06:38 +00:00
uint8_t pms[ 4 + 2 * PSA_ALG_TLS12_PSK_TO_MS_MAX_PSK_LEN ];
uint8_t *cur = pms;
Add TLS 1.2 PSK master secret generation
2019-06-17 07:44:03 +00:00
if( data_length > PSA_ALG_TLS12_PSK_TO_MS_MAX_PSK_LEN )
return( PSA_ERROR_INVALID_ARGUMENT );
/* Quoting RFC 4279, Section 2:
*
* The premaster secret is formed as follows: if the PSK is N octets
* long, concatenate a uint16 with the value N, N zero octets, a second
* uint16 with the value N, and the PSK itself.
*/
Optimize TLS PRF PSK key calculation
2019-06-26 12:22:29 +00:00
*cur++ = ( data_length >> 8 ) & 0xff;
*cur++ = ( data_length >> 0 ) & 0xff;
memset( cur, 0, data_length );
cur += data_length;
*cur++ = pms[0];
*cur++ = pms[1];
memcpy( cur, data, data_length );
cur += data_length;
Add TLS 1.2 PSK master secret generation
2019-06-17 07:44:03 +00:00
Optimize TLS PRF PSK key calculation
2019-06-26 12:22:29 +00:00
status = psa_tls12_prf_set_key( prf, hash_alg, pms, cur - pms );
Add TLS 1.2 PSK master secret generation
2019-06-17 07:44:03 +00:00
mbedtls_platform_zeroize( pms, sizeof( pms ) );
return( status );
}
Add label input for psa_tls12_prf_input
2019-06-13 08:15:47 +00:00
static psa_status_t psa_tls12_prf_set_label( psa_tls12_prf_key_derivation_t *prf,
const uint8_t *data,
size_t data_length )
{
if( prf->state != TLS12_PRF_STATE_KEY_SET )
return( PSA_ERROR_BAD_STATE );
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
Fix zero-length seed or label in TLS 1.2 PRF The psa_tls12_prf_set_seed() and psa_tls12_prf_set_label() functions did not work on platforms where malloc(0) returns NULL. It does not affect the TLS use case but these PRFs are used in other protocols as well and might not be used the same way. For example EAP uses the TLS PRF with an empty secret. (This would not trigger the bug, but is a strong indication that it is not safe to assume that certain inputs to this function are not zero length.) The conditional block includes the memcpy() call as well to avoid passing a NULL pointer as a parameter resulting in undefined behaviour. The current tests are already using zero length label and seed, there is no need to add new test for this bug.
2019-07-04 08:11:38 +00:00
if( data_length != 0 )
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
{
Fix zero-length seed or label in TLS 1.2 PRF The psa_tls12_prf_set_seed() and psa_tls12_prf_set_label() functions did not work on platforms where malloc(0) returns NULL. It does not affect the TLS use case but these PRFs are used in other protocols as well and might not be used the same way. For example EAP uses the TLS PRF with an empty secret. (This would not trigger the bug, but is a strong indication that it is not safe to assume that certain inputs to this function are not zero length.) The conditional block includes the memcpy() call as well to avoid passing a NULL pointer as a parameter resulting in undefined behaviour. The current tests are already using zero length label and seed, there is no need to add new test for this bug.
2019-07-04 08:11:38 +00:00
prf->label = mbedtls_calloc( 1, data_length );
if( prf->label == NULL )
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
return( PSA_ERROR_INSUFFICIENT_MEMORY );
Add label input for psa_tls12_prf_input
2019-06-13 08:15:47 +00:00
Fix zero-length seed or label in TLS 1.2 PRF The psa_tls12_prf_set_seed() and psa_tls12_prf_set_label() functions did not work on platforms where malloc(0) returns NULL. It does not affect the TLS use case but these PRFs are used in other protocols as well and might not be used the same way. For example EAP uses the TLS PRF with an empty secret. (This would not trigger the bug, but is a strong indication that it is not safe to assume that certain inputs to this function are not zero length.) The conditional block includes the memcpy() call as well to avoid passing a NULL pointer as a parameter resulting in undefined behaviour. The current tests are already using zero length label and seed, there is no need to add new test for this bug.
2019-07-04 08:11:38 +00:00
memcpy( prf->label, data, data_length );
prf->label_length = data_length;
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
}
Add label input for psa_tls12_prf_input
2019-06-13 08:15:47 +00:00
prf->state = TLS12_PRF_STATE_LABEL_SET;
return( PSA_SUCCESS );
}
Add stubs for psa_tls12_prf_input
2019-06-11 14:30:30 +00:00
static psa_status_t psa_tls12_prf_input( psa_tls12_prf_key_derivation_t *prf,
psa_algorithm_t hash_alg,
psa_key_derivation_step_t step,
const uint8_t *data,
size_t data_length )
{
switch( step )
{
Add seed input for psa_tls12_prf_input
2019-06-13 08:05:41 +00:00
case PSA_KEY_DERIVATION_INPUT_SEED:
return( psa_tls12_prf_set_seed( prf, data, data_length ) );
Add key import for psa_tls12_prf_input
2019-06-13 13:26:34 +00:00
case PSA_KEY_DERIVATION_INPUT_SECRET:
return( psa_tls12_prf_set_key( prf, hash_alg, data, data_length ) );
Add label input for psa_tls12_prf_input
2019-06-13 08:15:47 +00:00
case PSA_KEY_DERIVATION_INPUT_LABEL:
return( psa_tls12_prf_set_label( prf, data, data_length ) );
Add stubs for psa_tls12_prf_input
2019-06-11 14:30:30 +00:00
default:
return( PSA_ERROR_INVALID_ARGUMENT );
}
}
Add TLS 1.2 PSK master secret generation
2019-06-17 07:44:03 +00:00
static psa_status_t psa_tls12_prf_psk_to_ms_input(
psa_tls12_prf_key_derivation_t *prf,
psa_algorithm_t hash_alg,
psa_key_derivation_step_t step,
const uint8_t *data,
size_t data_length )
{
if( step == PSA_KEY_DERIVATION_INPUT_SECRET )
Improve style
2019-06-28 12:35:36 +00:00
{
Add TLS 1.2 PSK master secret generation
2019-06-17 07:44:03 +00:00
return( psa_tls12_prf_psk_to_ms_set_key( prf, hash_alg,
data, data_length ) );
Improve style
2019-06-28 12:35:36 +00:00
}
Add TLS 1.2 PSK master secret generation
2019-06-17 07:44:03 +00:00
return( psa_tls12_prf_input( prf, hash_alg, step, data, data_length ) );
}
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
#endif /* MBEDTLS_MD_C */
Use the constant PSA_KEY_TYPE_NONE rather than 0 No behavior change, just a readability improvement.
2019-09-24 14:21:10 +00:00
/** Check whether the given key type is acceptable for the given
* input step of a key derivation.
*
* Secret inputs must have the type #PSA_KEY_TYPE_DERIVE.
* Non-secret inputs must have the type #PSA_KEY_TYPE_RAW_DATA.
* Both secret and non-secret inputs can alternatively have the type
* #PSA_KEY_TYPE_NONE, which is never the type of a key object, meaning
* that the input was passed as a buffer rather than via a key object.
*/
Key derivation: allow both keys and direct inputs Allow a direct input as the SECRET input step in a key derivation, in addition to allowing DERIVE keys. This makes it easier for applications to run a key derivation where the "secret" input is obtained from somewhere else. This makes it possible for the "secret" input to be empty (keys cannot be empty), which some protocols do (for example the IV derivation in EAP-TLS). Conversely, allow a RAW_DATA key as the INFO/LABEL/SALT/SEED input to a key derivation, in addition to allowing direct inputs. This doesn't improve security, but removes a step when a personalization parameter is stored in the key store, and allows this personalization parameter to remain opaque. Add test cases that explore step/key-type-and-keyhood combinations.
2019-09-23 16:13:17 +00:00
static int psa_key_derivation_check_input_type(
psa_key_derivation_step_t step,
psa_key_type_t key_type )
{
switch( step )
{
case PSA_KEY_DERIVATION_INPUT_SECRET:
Use the constant PSA_KEY_TYPE_NONE rather than 0 No behavior change, just a readability improvement.
2019-09-24 14:21:10 +00:00
if( key_type == PSA_KEY_TYPE_DERIVE )
return( PSA_SUCCESS );
if( key_type == PSA_KEY_TYPE_NONE )
Key derivation: allow both keys and direct inputs Allow a direct input as the SECRET input step in a key derivation, in addition to allowing DERIVE keys. This makes it easier for applications to run a key derivation where the "secret" input is obtained from somewhere else. This makes it possible for the "secret" input to be empty (keys cannot be empty), which some protocols do (for example the IV derivation in EAP-TLS). Conversely, allow a RAW_DATA key as the INFO/LABEL/SALT/SEED input to a key derivation, in addition to allowing direct inputs. This doesn't improve security, but removes a step when a personalization parameter is stored in the key store, and allows this personalization parameter to remain opaque. Add test cases that explore step/key-type-and-keyhood combinations.
2019-09-23 16:13:17 +00:00
return( PSA_SUCCESS );
break;
case PSA_KEY_DERIVATION_INPUT_LABEL:
case PSA_KEY_DERIVATION_INPUT_SALT:
case PSA_KEY_DERIVATION_INPUT_INFO:
case PSA_KEY_DERIVATION_INPUT_SEED:
Use the constant PSA_KEY_TYPE_NONE rather than 0 No behavior change, just a readability improvement.
2019-09-24 14:21:10 +00:00
if( key_type == PSA_KEY_TYPE_RAW_DATA )
return( PSA_SUCCESS );
if( key_type == PSA_KEY_TYPE_NONE )
Key derivation: allow both keys and direct inputs Allow a direct input as the SECRET input step in a key derivation, in addition to allowing DERIVE keys. This makes it easier for applications to run a key derivation where the "secret" input is obtained from somewhere else. This makes it possible for the "secret" input to be empty (keys cannot be empty), which some protocols do (for example the IV derivation in EAP-TLS). Conversely, allow a RAW_DATA key as the INFO/LABEL/SALT/SEED input to a key derivation, in addition to allowing direct inputs. This doesn't improve security, but removes a step when a personalization parameter is stored in the key store, and allows this personalization parameter to remain opaque. Add test cases that explore step/key-type-and-keyhood combinations.
2019-09-23 16:13:17 +00:00
return( PSA_SUCCESS );
break;
}
return( PSA_ERROR_INVALID_ARGUMENT );
}
Rename psa_key_derivation_input_raw The function dispatches between all the available methods and does not just handle the raw key derivation case like the name suggests.
2019-06-12 14:54:46 +00:00
static psa_status_t psa_key_derivation_input_internal(
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
psa_key_derivation_operation_t *operation,
Improve the rules on key derivation input types Use separate step types for a KDF secret and for the private key in a key agreement. Determine which key type is allowed from the step type, independently of the KDF. Forbid raw inputs for certain steps. They definitely should be forbidden for asymmetric keys, which are structured. Also forbid them for KDF secrets: the secrets are supposed to be keys, even if they're unstructured.
2019-01-08 09:31:27 +00:00
psa_key_derivation_step_t step,
Key derivation: allow both keys and direct inputs Allow a direct input as the SECRET input step in a key derivation, in addition to allowing DERIVE keys. This makes it easier for applications to run a key derivation where the "secret" input is obtained from somewhere else. This makes it possible for the "secret" input to be empty (keys cannot be empty), which some protocols do (for example the IV derivation in EAP-TLS). Conversely, allow a RAW_DATA key as the INFO/LABEL/SALT/SEED input to a key derivation, in addition to allowing direct inputs. This doesn't improve security, but removes a step when a personalization parameter is stored in the key store, and allows this personalization parameter to remain opaque. Add test cases that explore step/key-type-and-keyhood combinations.
2019-09-23 16:13:17 +00:00
psa_key_type_t key_type,
Improve the rules on key derivation input types Use separate step types for a KDF secret and for the private key in a key agreement. Determine which key type is allowed from the step type, independently of the KDF. Forbid raw inputs for certain steps. They definitely should be forbidden for asymmetric keys, which are structured. Also forbid them for KDF secrets: the secrets are supposed to be keys, even if they're unstructured.
2019-01-08 09:31:27 +00:00
const uint8_t *data,
size_t data_length )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
{
Don't jump past a variable declaration This is valid C99 (since the variable in question is not a VLA and is not used) but not accepted by IAR 8.20.
2019-09-23 17:22:55 +00:00
psa_status_t status;
psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg( operation );
status = psa_key_derivation_check_input_type( step, key_type );
Key derivation: allow both keys and direct inputs Allow a direct input as the SECRET input step in a key derivation, in addition to allowing DERIVE keys. This makes it easier for applications to run a key derivation where the "secret" input is obtained from somewhere else. This makes it possible for the "secret" input to be empty (keys cannot be empty), which some protocols do (for example the IV derivation in EAP-TLS). Conversely, allow a RAW_DATA key as the INFO/LABEL/SALT/SEED input to a key derivation, in addition to allowing direct inputs. This doesn't improve security, but removes a step when a personalization parameter is stored in the key store, and allows this personalization parameter to remain opaque. Add test cases that explore step/key-type-and-keyhood combinations.
2019-09-23 16:13:17 +00:00
if( status != PSA_SUCCESS )
goto exit;
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
#if defined(MBEDTLS_MD_C)
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
if( PSA_ALG_IS_HKDF( kdf_alg ) )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
status = psa_hkdf_input( &operation->ctx.hkdf,
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
PSA_ALG_HKDF_GET_HASH( kdf_alg ),
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
step, data, data_length );
}
Remove PSA_PRE_1_0_KEY_DERIVATION and the corresponding code
2019-08-13 12:55:03 +00:00
else if( PSA_ALG_IS_TLS12_PRF( kdf_alg ) )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
{
Add stubs for psa_tls12_prf_input
2019-06-11 14:30:30 +00:00
status = psa_tls12_prf_input( &operation->ctx.tls12_prf,
PSA_ALG_HKDF_GET_HASH( kdf_alg ),
step, data, data_length );
Add TLS 1.2 PSK master secret generation
2019-06-17 07:44:03 +00:00
}
else if( PSA_ALG_IS_TLS12_PSK_TO_MS( kdf_alg ) )
{
status = psa_tls12_prf_psk_to_ms_input( &operation->ctx.tls12_prf,
PSA_ALG_HKDF_GET_HASH( kdf_alg ),
step, data, data_length );
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
}
else
#endif /* MBEDTLS_MD_C */
{
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
/* This can't happen unless the operation object was not initialized */
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
return( PSA_ERROR_BAD_STATE );
}
Key derivation: allow both keys and direct inputs Allow a direct input as the SECRET input step in a key derivation, in addition to allowing DERIVE keys. This makes it easier for applications to run a key derivation where the "secret" input is obtained from somewhere else. This makes it possible for the "secret" input to be empty (keys cannot be empty), which some protocols do (for example the IV derivation in EAP-TLS). Conversely, allow a RAW_DATA key as the INFO/LABEL/SALT/SEED input to a key derivation, in addition to allowing direct inputs. This doesn't improve security, but removes a step when a personalization parameter is stored in the key store, and allows this personalization parameter to remain opaque. Add test cases that explore step/key-type-and-keyhood combinations.
2019-09-23 16:13:17 +00:00
exit:
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
if( status != PSA_SUCCESS )
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
psa_key_derivation_abort( operation );
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
return( status );
}
Style: enforce 80 column limit
2019-06-14 10:35:55 +00:00
psa_status_t psa_key_derivation_input_bytes(
psa_key_derivation_operation_t *operation,
psa_key_derivation_step_t step,
const uint8_t *data,
size_t data_length )
Improve the rules on key derivation input types Use separate step types for a KDF secret and for the private key in a key agreement. Determine which key type is allowed from the step type, independently of the KDF. Forbid raw inputs for certain steps. They definitely should be forbidden for asymmetric keys, which are structured. Also forbid them for KDF secrets: the secrets are supposed to be keys, even if they're unstructured.
2019-01-08 09:31:27 +00:00
{
Use the constant PSA_KEY_TYPE_NONE rather than 0 No behavior change, just a readability improvement.
2019-09-24 14:21:10 +00:00
return( psa_key_derivation_input_internal( operation, step,
PSA_KEY_TYPE_NONE,
Simplify psa_key_derivation_input_bytes The specific key derivation input functions support a subset of the input options and need to check it anyway. Checking it at the top level is redundant, it brings a very little value and comes with a cost in code size and maintainability.
2019-06-14 10:27:57 +00:00
data, data_length ) );
Improve the rules on key derivation input types Use separate step types for a KDF secret and for the private key in a key agreement. Determine which key type is allowed from the step type, independently of the KDF. Forbid raw inputs for certain steps. They definitely should be forbidden for asymmetric keys, which are structured. Also forbid them for KDF secrets: the secrets are supposed to be keys, even if they're unstructured.
2019-01-08 09:31:27 +00:00
}
Style: enforce 80 column limit
2019-06-14 10:35:55 +00:00
psa_status_t psa_key_derivation_input_key(
psa_key_derivation_operation_t *operation,
psa_key_derivation_step_t step,
psa_key_handle_t handle )
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
{
psa_key_slot_t *slot;
psa_status_t status;
Key derivation: forbid output_key without input_key If none of the inputs to a key derivation is a PSA_KEY_DERIVATION_INPUT_SECRET passed with psa_key_derivation_input_key(), forbid psa_key_derivation_output_key(). It usually doesn't make sense to derive a key object if the secret isn't itself a proper key.
2019-09-24 16:21:06 +00:00
SE keys: ensure that functions that lack support properly error out Introduce a new function psa_get_transparent_key which returns NOT_SUPPORTED if the key is in a secure element. Use this function in functions that don't support keys in a secure element. After this commit, all functions that access a key slot directly via psa_get_key_slot or psa_get_key_from_slot rather than via psa_get_transparent_key have at least enough support for secure elements not to crash or otherwise cause undefined behavior. Lesser bad behavior such as wrong results or resource leakage is still possible in error cases.
2019-07-24 11:30:31 +00:00
status = psa_get_transparent_key( handle, &slot,
Fix indentation
2019-07-25 08:51:03 +00:00
PSA_KEY_USAGE_DERIVE,
operation->alg );
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
if( status != PSA_SUCCESS )
Consistently abort key derivation operations on input error
2019-09-23 16:17:40 +00:00
{
psa_key_derivation_abort( operation );
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
return( status );
Consistently abort key derivation operations on input error
2019-09-23 16:17:40 +00:00
}
Key derivation: forbid output_key without input_key If none of the inputs to a key derivation is a PSA_KEY_DERIVATION_INPUT_SECRET passed with psa_key_derivation_input_key(), forbid psa_key_derivation_output_key(). It usually doesn't make sense to derive a key object if the secret isn't itself a proper key.
2019-09-24 16:21:06 +00:00
/* Passing a key object as a SECRET input unlocks the permission
* to output to a key object. */
if( step == PSA_KEY_DERIVATION_INPUT_SECRET )
operation->can_output_key = 1;
Rename psa_key_derivation_input_raw The function dispatches between all the available methods and does not just handle the raw key derivation case like the name suggests.
2019-06-12 14:54:46 +00:00
return( psa_key_derivation_input_internal( operation,
Key derivation: allow both keys and direct inputs Allow a direct input as the SECRET input step in a key derivation, in addition to allowing DERIVE keys. This makes it easier for applications to run a key derivation where the "secret" input is obtained from somewhere else. This makes it possible for the "secret" input to be empty (keys cannot be empty), which some protocols do (for example the IV derivation in EAP-TLS). Conversely, allow a RAW_DATA key as the INFO/LABEL/SALT/SEED input to a key derivation, in addition to allowing direct inputs. This doesn't improve security, but removes a step when a personalization parameter is stored in the key store, and allows this personalization parameter to remain opaque. Add test cases that explore step/key-type-and-keyhood combinations.
2019-09-23 16:13:17 +00:00
step, slot->attr.type,
Rename psa_key_derivation_input_raw The function dispatches between all the available methods and does not just handle the raw key derivation case like the name suggests.
2019-06-12 14:54:46 +00:00
slot->data.raw.data,
slot->data.raw.bytes ) );
Key derivation by small input steps: proof-of-concept Document the new API. Keep the old one. Implement for HKDF. Use it in a few test cases. Key agreement is still unchanged.
2019-01-07 21:59:38 +00:00
}
Add framework for simple key derivation New key type PSA_KEY_TYPE_DERIVE. New usage flag PSA_KEY_USAGE_DERIVE. New function psa_key_derivation. No key derivation algorithm is implemented yet. The code may not compile with -Wunused. Write some unit test code for psa_key_derivation. Most of it cannot be used yet due to the lack of a key derivation algorithm.
2018-07-12 15:17:20 +00:00
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 10:01:02 +00:00
/****************************************************************/
/* Key agreement */
/****************************************************************/
Add some missing compilation guards Add missing checks for defined(MBEDTLS_MD_C) around types and functions that require it (HMAC, HKDF, TLS12_PRF). Add missing checks for defined(MBEDTLS_ECDSA_DETERMINISTIC) around code that calls mbedtls_ecdsa_sign_det(). Add missing checks for defined(MBEDTLS_ECDH_C) around ECDH-specific functions.
2018-11-16 15:02:56 +00:00
#if defined(MBEDTLS_ECDH_C)
Implement ECDH
2018-09-18 10:11:27 +00:00
static psa_status_t psa_key_agreement_ecdh( const uint8_t *peer_key,
size_t peer_key_length,
const mbedtls_ecp_keypair *our_key,
uint8_t *shared_secret,
size_t shared_secret_size,
size_t *shared_secret_length )
{
mbedtls_ecp_keypair *their_key = NULL;
mbedtls_ecdh_context ecdh;
psa: Use psa_status_t in psa_key_agreement_ecdh() Use the PSA-native status type in psa_key_agreement_ecdh() in preparation for us calling PSA functions (and not just Mbed TLS functions) and still being able to return a psa_status_t (without having to translate it to a Mbed TLS error and then back again).
2019-01-10 19:38:51 +00:00
psa_status_t status;
Implement ECDH
2018-09-18 10:11:27 +00:00
mbedtls_ecdh_init( &ecdh );
psa: Simplify EC public key format Remove front matter from our EC key format, to make it just the contents of an ECPoint as defined by SEC1 section 2.3.3. As a consequence of the simplification, remove the restriction on not being able to use an ECDH key with ECDSA. There is no longer any OID specified when importing a key, so we can't reject importing of an ECDH key for the purpose of ECDSA based on the OID.
2019-01-10 11:42:27 +00:00
status = psa_import_ec_public_key(
mbedtls_ecc_group_to_psa( our_key->grp.id ),
peer_key, peer_key_length,
&their_key );
psa: Use psa_status_t in psa_key_agreement_ecdh() Use the PSA-native status type in psa_key_agreement_ecdh() in preparation for us calling PSA functions (and not just Mbed TLS functions) and still being able to return a psa_status_t (without having to translate it to a Mbed TLS error and then back again).
2019-01-10 19:38:51 +00:00
if( status != PSA_SUCCESS )
ECDH: check that the keys are on the same curve In psa_key_agreement_ecdh, check that the public key is on the same curve as the private key. The underlying mbedtls API doesn't check. If the curves don't match, psa_key_agreement_ecdh is practically guaranteed to return INVALID_ARGUMENT anyway, because way the code is written, the public point is interpreted on the curve of the private point, and it is rejected because the point is not on the curve. This is why the test case "PSA key agreement setup: ECDH, raw: public key on different curve" passed even before adding this check.
2018-11-14 19:51:23 +00:00
goto exit;
psa: Use psa_status_t in psa_key_agreement_ecdh() Use the PSA-native status type in psa_key_agreement_ecdh() in preparation for us calling PSA functions (and not just Mbed TLS functions) and still being able to return a psa_status_t (without having to translate it to a Mbed TLS error and then back again).
2019-01-10 19:38:51 +00:00
status = mbedtls_to_psa_error(
mbedtls_ecdh_get_params( &ecdh, their_key, MBEDTLS_ECDH_THEIRS ) );
if( status != PSA_SUCCESS )
Implement ECDH
2018-09-18 10:11:27 +00:00
goto exit;
psa: Use psa_status_t in psa_key_agreement_ecdh() Use the PSA-native status type in psa_key_agreement_ecdh() in preparation for us calling PSA functions (and not just Mbed TLS functions) and still being able to return a psa_status_t (without having to translate it to a Mbed TLS error and then back again).
2019-01-10 19:38:51 +00:00
status = mbedtls_to_psa_error(
mbedtls_ecdh_get_params( &ecdh, our_key, MBEDTLS_ECDH_OURS ) );
if( status != PSA_SUCCESS )
Implement ECDH
2018-09-18 10:11:27 +00:00
goto exit;
psa: Use psa_status_t in psa_key_agreement_ecdh() Use the PSA-native status type in psa_key_agreement_ecdh() in preparation for us calling PSA functions (and not just Mbed TLS functions) and still being able to return a psa_status_t (without having to translate it to a Mbed TLS error and then back again).
2019-01-10 19:38:51 +00:00
status = mbedtls_to_psa_error(
mbedtls_ecdh_calc_secret( &ecdh,
shared_secret_length,
shared_secret, shared_secret_size,
mbedtls_ctr_drbg_random,
&global_data.ctr_drbg ) );
Implement ECDH
2018-09-18 10:11:27 +00:00
exit:
mbedtls_ecdh_free( &ecdh );
psa: Simplify EC public key format Remove front matter from our EC key format, to make it just the contents of an ECPoint as defined by SEC1 section 2.3.3. As a consequence of the simplification, remove the restriction on not being able to use an ECDH key with ECDSA. There is no longer any OID specified when importing a key, so we can't reject importing of an ECDH key for the purpose of ECDSA based on the OID.
2019-01-10 11:42:27 +00:00
mbedtls_ecp_keypair_free( their_key );
mbedtls_free( their_key );
psa: Use psa_status_t in psa_key_agreement_ecdh() Use the PSA-native status type in psa_key_agreement_ecdh() in preparation for us calling PSA functions (and not just Mbed TLS functions) and still being able to return a psa_status_t (without having to translate it to a Mbed TLS error and then back again).
2019-01-10 19:38:51 +00:00
return( status );
Implement ECDH
2018-09-18 10:11:27 +00:00
}
Add some missing compilation guards Add missing checks for defined(MBEDTLS_MD_C) around types and functions that require it (HMAC, HKDF, TLS12_PRF). Add missing checks for defined(MBEDTLS_ECDSA_DETERMINISTIC) around code that calls mbedtls_ecdsa_sign_det(). Add missing checks for defined(MBEDTLS_ECDH_C) around ECDH-specific functions.
2018-11-16 15:02:56 +00:00
#endif /* MBEDTLS_ECDH_C */
Implement ECDH
2018-09-18 10:11:27 +00:00
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 10:01:02 +00:00
#define PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE MBEDTLS_ECP_MAX_BYTES
Implement psa_key_agreement_raw_shared_secret Refactor: split psa_key_agreement_raw_internal out of psa_key_agreement_internal, and call it from psa_key_agreement_raw_shared_secret as well.
2019-04-11 19:23:21 +00:00
static psa_status_t psa_key_agreement_raw_internal( psa_algorithm_t alg,
psa_key_slot_t *private_key,
const uint8_t *peer_key,
size_t peer_key_length,
uint8_t *shared_secret,
size_t shared_secret_size,
size_t *shared_secret_length )
{
switch( alg )
{
#if defined(MBEDTLS_ECDH_C)
case PSA_ALG_ECDH:
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
if( ! PSA_KEY_TYPE_IS_ECC_KEY_PAIR( private_key->attr.type ) )
Implement psa_key_agreement_raw_shared_secret Refactor: split psa_key_agreement_raw_internal out of psa_key_agreement_internal, and call it from psa_key_agreement_raw_shared_secret as well.
2019-04-11 19:23:21 +00:00
return( PSA_ERROR_INVALID_ARGUMENT );
return( psa_key_agreement_ecdh( peer_key, peer_key_length,
private_key->data.ecp,
shared_secret, shared_secret_size,
shared_secret_length ) );
#endif /* MBEDTLS_ECDH_C */
default:
(void) private_key;
(void) peer_key;
(void) peer_key_length;
(void) shared_secret;
(void) shared_secret_size;
(void) shared_secret_length;
return( PSA_ERROR_NOT_SUPPORTED );
}
}
Rename generator functions to psa_key_derivation_xxx Generators are mostly about key derivation (currently: only about key derivation). "Generator" is not a commonly used term in cryptography. So favor "derivation" as terminology. Call a generator a key derivation operation structure, since it behaves like other multipart operation structures. Furthermore, the function names are not fully consistent. In this commit, I rename the functions to consistently have the prefix "psa_key_derivation_". I used the following command: perl -i -pe '%t = ( psa_crypto_generator_t => "psa_key_derivation_operation_t", psa_crypto_generator_init => "psa_key_derivation_init", psa_key_derivation_setup => "psa_key_derivation_setup", psa_key_derivation_input_key => "psa_key_derivation_input_key", psa_key_derivation_input_bytes => "psa_key_derivation_input_bytes", psa_key_agreement => "psa_key_derivation_key_agreement", psa_set_generator_capacity => "psa_key_derivation_set_capacity", psa_get_generator_capacity => "psa_key_derivation_get_capacity", psa_generator_read => "psa_key_derivation_output_bytes", psa_generate_derived_key => "psa_key_derivation_output_key", psa_generator_abort => "psa_key_derivation_abort", PSA_CRYPTO_GENERATOR_INIT => "PSA_KEY_DERIVATION_OPERATION_INIT", PSA_GENERATOR_UNBRIDLED_CAPACITY => "PSA_KEY_DERIVATION_UNLIMITED_CAPACITY", ); s/\b(@{[join("|", keys %t)]})\b/$t{$1}/ge' $(git ls-files)
2019-05-16 13:28:51 +00:00
/* Note that if this function fails, you must call psa_key_derivation_abort()
Add missing cleanup on failure in psa_key_agreement If psa_key_derivation_internal() fails, it's up to the caller to clean up. Do this, and add a note at the top of psa_key_derivation_internal() and its auxiliary functions. There is no non-regression test because at the moment the only way to trigger an error is a borderline low-memory condition and we don't have the means to trigger this.
2018-11-16 15:05:06 +00:00
* to potentially free embedded data structures and wipe confidential data.
*/
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
static psa_status_t psa_key_agreement_internal( psa_key_derivation_operation_t *operation,
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
psa_key_derivation_step_t step,
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 16:12:32 +00:00
psa_key_slot_t *private_key,
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 10:01:02 +00:00
const uint8_t *peer_key,
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
size_t peer_key_length )
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 10:01:02 +00:00
{
psa_status_t status;
uint8_t shared_secret[PSA_KEY_AGREEMENT_MAX_SHARED_SECRET_SIZE];
size_t shared_secret_length = 0;
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
psa_algorithm_t ka_alg = PSA_ALG_KEY_AGREEMENT_GET_BASE( operation->alg );
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 10:01:02 +00:00
/* Step 1: run the secret agreement algorithm to generate the shared
* secret. */
Implement psa_key_agreement_raw_shared_secret Refactor: split psa_key_agreement_raw_internal out of psa_key_agreement_internal, and call it from psa_key_agreement_raw_shared_secret as well.
2019-04-11 19:23:21 +00:00
status = psa_key_agreement_raw_internal( ka_alg,
private_key,
peer_key, peer_key_length,
Implement ECDH
2018-09-18 10:11:27 +00:00
shared_secret,
sizeof( shared_secret ),
&shared_secret_length );
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 10:01:02 +00:00
if( status != PSA_SUCCESS )
goto exit;
/* Step 2: set up the key derivation to generate key material from
Key derivation: allow both keys and direct inputs Allow a direct input as the SECRET input step in a key derivation, in addition to allowing DERIVE keys. This makes it easier for applications to run a key derivation where the "secret" input is obtained from somewhere else. This makes it possible for the "secret" input to be empty (keys cannot be empty), which some protocols do (for example the IV derivation in EAP-TLS). Conversely, allow a RAW_DATA key as the INFO/LABEL/SALT/SEED input to a key derivation, in addition to allowing direct inputs. This doesn't improve security, but removes a step when a personalization parameter is stored in the key store, and allows this personalization parameter to remain opaque. Add test cases that explore step/key-type-and-keyhood combinations.
2019-09-23 16:13:17 +00:00
* the shared secret. A shared secret is permitted wherever a key
* of type DERIVE is permitted. */
Rename psa_key_derivation_input_raw The function dispatches between all the available methods and does not just handle the raw key derivation case like the name suggests.
2019-06-12 14:54:46 +00:00
status = psa_key_derivation_input_internal( operation, step,
Key derivation: allow both keys and direct inputs Allow a direct input as the SECRET input step in a key derivation, in addition to allowing DERIVE keys. This makes it easier for applications to run a key derivation where the "secret" input is obtained from somewhere else. This makes it possible for the "secret" input to be empty (keys cannot be empty), which some protocols do (for example the IV derivation in EAP-TLS). Conversely, allow a RAW_DATA key as the INFO/LABEL/SALT/SEED input to a key derivation, in addition to allowing direct inputs. This doesn't improve security, but removes a step when a personalization parameter is stored in the key store, and allows this personalization parameter to remain opaque. Add test cases that explore step/key-type-and-keyhood combinations.
2019-09-23 16:13:17 +00:00
PSA_KEY_TYPE_DERIVE,
Rename psa_key_derivation_input_raw The function dispatches between all the available methods and does not just handle the raw key derivation case like the name suggests.
2019-06-12 14:54:46 +00:00
shared_secret,
shared_secret_length );
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 10:01:02 +00:00
exit:
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 17:14:53 +00:00
mbedtls_platform_zeroize( shared_secret, shared_secret_length );
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 10:01:02 +00:00
return( status );
}
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
psa_status_t psa_key_derivation_key_agreement( psa_key_derivation_operation_t *operation,
Wrap and reindent some lines After renaming several identifiers, re-wrap and re-indent some lines to make the code prettier.
2019-05-16 15:53:40 +00:00
psa_key_derivation_step_t step,
psa_key_handle_t private_key,
const uint8_t *peer_key,
size_t peer_key_length )
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 10:01:02 +00:00
{
Rename key_slot_t to psa_key_slot_t in psa_crypto.c That way it'll be ok to add it to an internal header so as to use it in multiple source modules.
2018-12-04 16:12:32 +00:00
psa_key_slot_t *slot;
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 10:01:02 +00:00
psa_status_t status;
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
if( ! PSA_ALG_IS_KEY_AGREEMENT( operation->alg ) )
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 10:01:02 +00:00
return( PSA_ERROR_INVALID_ARGUMENT );
SE keys: ensure that functions that lack support properly error out Introduce a new function psa_get_transparent_key which returns NOT_SUPPORTED if the key is in a secure element. Use this function in functions that don't support keys in a secure element. After this commit, all functions that access a key slot directly via psa_get_key_slot or psa_get_key_from_slot rather than via psa_get_transparent_key have at least enough support for secure elements not to crash or otherwise cause undefined behavior. Lesser bad behavior such as wrong results or resource leakage is still possible in error cases.
2019-07-24 11:30:31 +00:00
status = psa_get_transparent_key( private_key, &slot,
Fix indentation
2019-07-25 08:51:03 +00:00
PSA_KEY_USAGE_DERIVE, operation->alg );
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 10:01:02 +00:00
if( status != PSA_SUCCESS )
return( status );
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
status = psa_key_agreement_internal( operation, step,
Add missing cleanup on failure in psa_key_agreement If psa_key_derivation_internal() fails, it's up to the caller to clean up. Do this, and add a note at the top of psa_key_derivation_internal() and its auxiliary functions. There is no non-regression test because at the moment the only way to trigger an error is a borderline low-memory condition and we don't have the means to trigger this.
2018-11-16 15:05:06 +00:00
slot,
Make key agreement the secret input for key derivation * Documentation * Proof-of-concept implementation * Updates to the tests (work in progress)
2019-01-16 14:53:06 +00:00
peer_key, peer_key_length );
Add missing cleanup on failure in psa_key_agreement If psa_key_derivation_internal() fails, it's up to the caller to clean up. Do this, and add a note at the top of psa_key_derivation_internal() and its auxiliary functions. There is no non-regression test because at the moment the only way to trigger an error is a borderline low-memory condition and we don't have the means to trigger this.
2018-11-16 15:05:06 +00:00
if( status != PSA_SUCCESS )
Rename "generator" to "operation" Generators are now key derivation operations. Keep "random generator" intact.
2019-05-16 15:31:03 +00:00
psa_key_derivation_abort( operation );
Add missing cleanup on failure in psa_key_agreement If psa_key_derivation_internal() fails, it's up to the caller to clean up. Do this, and add a note at the top of psa_key_derivation_internal() and its auxiliary functions. There is no non-regression test because at the moment the only way to trigger an error is a borderline low-memory condition and we don't have the means to trigger this.
2018-11-16 15:05:06 +00:00
return( status );
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 10:01:02 +00:00
}
Shorten the name of psa_key_agreement_raw_shared_secret There is less of a risk of confusion with the KA+KDF function now.
2019-05-16 16:00:41 +00:00
psa_status_t psa_raw_key_agreement( psa_algorithm_t alg,
psa_key_handle_t private_key,
const uint8_t *peer_key,
size_t peer_key_length,
uint8_t *output,
size_t output_size,
size_t *output_length )
Implement psa_key_agreement_raw_shared_secret Refactor: split psa_key_agreement_raw_internal out of psa_key_agreement_internal, and call it from psa_key_agreement_raw_shared_secret as well.
2019-04-11 19:23:21 +00:00
{
psa_key_slot_t *slot;
psa_status_t status;
if( ! PSA_ALG_IS_KEY_AGREEMENT( alg ) )
{
status = PSA_ERROR_INVALID_ARGUMENT;
goto exit;
}
SE keys: ensure that functions that lack support properly error out Introduce a new function psa_get_transparent_key which returns NOT_SUPPORTED if the key is in a secure element. Use this function in functions that don't support keys in a secure element. After this commit, all functions that access a key slot directly via psa_get_key_slot or psa_get_key_from_slot rather than via psa_get_transparent_key have at least enough support for secure elements not to crash or otherwise cause undefined behavior. Lesser bad behavior such as wrong results or resource leakage is still possible in error cases.
2019-07-24 11:30:31 +00:00
status = psa_get_transparent_key( private_key, &slot,
Fix indentation
2019-07-25 08:51:03 +00:00
PSA_KEY_USAGE_DERIVE, alg );
Implement psa_key_agreement_raw_shared_secret Refactor: split psa_key_agreement_raw_internal out of psa_key_agreement_internal, and call it from psa_key_agreement_raw_shared_secret as well.
2019-04-11 19:23:21 +00:00
if( status != PSA_SUCCESS )
goto exit;
status = psa_key_agreement_raw_internal( alg, slot,
peer_key, peer_key_length,
output, output_size,
output_length );
exit:
if( status != PSA_SUCCESS )
{
/* If an error happens and is not handled properly, the output
* may be used as a key to protect sensitive data. Arrange for such
* a key to be random, which is likely to result in decryption or
* verification errors. This is better than filling the buffer with
* some constant data such as zeros, which would result in the data
* being protected with a reproducible, easily knowable key.
*/
psa_generate_random( output, output_size );
*output_length = output_size;
}
return( status );
}
New API function: psa_key_agreement Set up a generator from a key agreement.
2018-09-18 10:01:02 +00:00
Add generator API Add an API for byte generators: psa_crypto_generator_t, PSA_CRYPTO_GENERATOR_INIT, psa_crypto_generator_init, psa_get_generator_capacity, psa_generator_read, psa_generator_import_key, psa_generator_abort. This commit does not yet implement any generator algorithm, it only provides the framework. This code may not compile with -Wunused.
2018-07-12 15:12:33 +00:00
/****************************************************************/
/* Random generation */
Implement psa_generate_random
2018-06-19 20:00:52 +00:00
/****************************************************************/
psa_status_t psa_generate_random( uint8_t *output,
size_t output_size )
{
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Ensure the module is initialized in psa_generate_random
2018-09-06 13:24:41 +00:00
GUARD_MODULE_INITIALIZED;
Fix psa_generate_random for >1024 bytes mbedtls_ctr_drbg_random can only return up to MBEDTLS_CTR_DRBG_MAX_REQUEST (normally 1024) bytes at a time. So if more than that is requested, call mbedtls_ctr_drbg_random in a loop.
2019-08-07 11:49:00 +00:00
while( output_size > MBEDTLS_CTR_DRBG_MAX_REQUEST )
{
ret = mbedtls_ctr_drbg_random( &global_data.ctr_drbg,
output,
MBEDTLS_CTR_DRBG_MAX_REQUEST );
if( ret != 0 )
return( mbedtls_to_psa_error( ret ) );
output += MBEDTLS_CTR_DRBG_MAX_REQUEST;
output_size -= MBEDTLS_CTR_DRBG_MAX_REQUEST;
}
Ensure the module is initialized in psa_generate_random
2018-09-06 13:24:41 +00:00
ret = mbedtls_ctr_drbg_random( &global_data.ctr_drbg, output, output_size );
Implement psa_generate_random
2018-06-19 20:00:52 +00:00
return( mbedtls_to_psa_error( ret ) );
}
Gate entropy injection through a dedicated configuration option Entropy injection has specific testing requirements. Therefore it should depend on a specific option.
2019-02-25 10:04:06 +00:00
#if defined(MBEDTLS_PSA_INJECT_ENTROPY)
#include "mbedtls/entropy_poll.h"
Favor stdint.h types in implementation-specific API
2019-07-15 09:06:15 +00:00
psa_status_t mbedtls_psa_inject_entropy( const uint8_t *seed,
Add entropy injection function to psa cripto APIs
2018-11-19 09:53:02 +00:00
size_t seed_size )
{
if( global_data.initialized )
return( PSA_ERROR_NOT_PERMITTED );
Add Tests for psa crypto entropy incjection Adjust code to handle and work with MBEDTLS_ENTROPY_BLOCK_SIZE definition option
2018-11-19 09:53:55 +00:00
if( ( ( seed_size < MBEDTLS_ENTROPY_MIN_PLATFORM ) ||
( seed_size < MBEDTLS_ENTROPY_BLOCK_SIZE ) ) ||
( seed_size > MBEDTLS_ENTROPY_MAX_SEED_SIZE ) )
return( PSA_ERROR_INVALID_ARGUMENT );
Gate entropy injection through a dedicated configuration option Entropy injection has specific testing requirements. Therefore it should depend on a specific option.
2019-02-25 10:04:06 +00:00
return( mbedtls_psa_storage_inject_entropy( seed, seed_size ) );
Add entropy injection function to psa cripto APIs
2018-11-19 09:53:02 +00:00
}
Gate entropy injection through a dedicated configuration option Entropy injection has specific testing requirements. Therefore it should depend on a specific option.
2019-02-25 10:04:06 +00:00
#endif /* MBEDTLS_PSA_INJECT_ENTROPY */
Add entropy injection function to psa cripto APIs
2018-11-19 09:53:02 +00:00
Remove `extra` parameter from psa_generate_key Read extra data from the domain parameters in the attribute structure instead of taking an argument on the function call. Implement this for RSA key generation, where the public exponent can be set as a domain parameter. Add tests that generate RSA keys with various public exponents.
2019-04-26 15:34:02 +00:00
#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_GENPRIME)
static psa_status_t psa_read_rsa_exponent( const uint8_t *domain_parameters,
size_t domain_parameters_size,
int *exponent )
Implement psa_generate_random
2018-06-19 20:00:52 +00:00
{
Remove `extra` parameter from psa_generate_key Read extra data from the domain parameters in the attribute structure instead of taking an argument on the function call. Implement this for RSA key generation, where the public exponent can be set as a domain parameter. Add tests that generate RSA keys with various public exponents.
2019-04-26 15:34:02 +00:00
size_t i;
uint32_t acc = 0;
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-19 22:20:32 +00:00
Remove `extra` parameter from psa_generate_key Read extra data from the domain parameters in the attribute structure instead of taking an argument on the function call. Implement this for RSA key generation, where the public exponent can be set as a domain parameter. Add tests that generate RSA keys with various public exponents.
2019-04-26 15:34:02 +00:00
if( domain_parameters_size == 0 )
{
*exponent = 65537;
return( PSA_SUCCESS );
}
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-19 22:20:32 +00:00
Remove `extra` parameter from psa_generate_key Read extra data from the domain parameters in the attribute structure instead of taking an argument on the function call. Implement this for RSA key generation, where the public exponent can be set as a domain parameter. Add tests that generate RSA keys with various public exponents.
2019-04-26 15:34:02 +00:00
/* Mbed TLS encodes the public exponent as an int. For simplicity, only
* support values that fit in a 32-bit integer, which is larger than
* int on just about every platform anyway. */
if( domain_parameters_size > sizeof( acc ) )
return( PSA_ERROR_NOT_SUPPORTED );
for( i = 0; i < domain_parameters_size; i++ )
acc = ( acc << 8 ) | domain_parameters[i];
if( acc > INT_MAX )
return( PSA_ERROR_NOT_SUPPORTED );
*exponent = acc;
return( PSA_SUCCESS );
}
#endif /* MBEDTLS_RSA_C && MBEDTLS_GENPRIME */
Rename psa_generate_random_key back to psa_generate_key generate_key is a more classical name. The longer name was only introduced to avoid confusion with getting a key from a generator, which is key derivation, but we no longer use the generator terminology so this reason no longer applies. perl -i -pe 's/psa_generate_random_key/psa_generate_key/g' $(git ls-files)
2019-05-16 17:42:05 +00:00
static psa_status_t psa_generate_key_internal(
Remove `extra` parameter from psa_generate_key Read extra data from the domain parameters in the attribute structure instead of taking an argument on the function call. Implement this for RSA key generation, where the public exponent can be set as a domain parameter. Add tests that generate RSA keys with various public exponents.
2019-04-26 15:34:02 +00:00
psa_key_slot_t *slot, size_t bits,
const uint8_t *domain_parameters, size_t domain_parameters_size )
Implement psa_generate_random
2018-06-19 20:00:52 +00:00
{
Use psa_core_key_attributes_t in key slots in memory Change the type of key slots in memory to use psa_core_key_attributes_t rather than separate fields. The goal is to simplify some parts of the code. This commit only does the mechanical replacement, not the substitution. The bit-field `allocate` is now a flag `PSA_KEY_SLOT_FLAG_ALLOCATED` in the `flags` field. Write accessor functions for flags. Key slots now contain a bit size field which is currently unused. Subsequent commits will make use of it.
2019-07-30 18:06:31 +00:00
psa_key_type_t type = slot->attr.type;
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-19 22:20:32 +00:00
Remove `extra` parameter from psa_generate_key Read extra data from the domain parameters in the attribute structure instead of taking an argument on the function call. Implement this for RSA key generation, where the public exponent can be set as a domain parameter. Add tests that generate RSA keys with various public exponents.
2019-04-26 15:34:02 +00:00
if( domain_parameters == NULL && domain_parameters_size != 0 )
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-19 22:20:32 +00:00
return( PSA_ERROR_INVALID_ARGUMENT );
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 15:01:38 +00:00
Remove PSA_KEY_TYPE_IS_RAW_BYTES from crypto.h It isn't used to define other macros and it doesn't seem that useful for users. Remove it, we can reintroduce it if needed. Define a similar function key_type_is_raw_bytes in the implementation with a clear semantics: it's a key that's represented as a struct raw_data.
2018-06-21 12:15:31 +00:00
if( key_type_is_raw_bytes( type ) )
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-19 22:20:32 +00:00
{
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 10:53:30 +00:00
psa_status_t status;
Always access key slots through accessor functions New functions psa_get_key_slot(), psa_get_empty_key_slot(), psa_get_key_from_slot() to access a key slot object from a key slot number. These functions perform all requisite validations: * psa_get_key_slot() verifies that the key slot number is in range. * psa_get_empty_key_slot() verifies that the slot is empty. * psa_get_key_from_slot() verifies that the slot contains a key with a suitable policy. Always use these functions so as to make sure that the requisite validations are always performed.
2018-07-06 15:01:38 +00:00
status = prepare_raw_data_slot( type, bits, &slot->data.raw );
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-19 22:20:32 +00:00
if( status != PSA_SUCCESS )
return( status );
status = psa_generate_random( slot->data.raw.data,
slot->data.raw.bytes );
if( status != PSA_SUCCESS )
return( status );
#if defined(MBEDTLS_DES_C)
if( type == PSA_KEY_TYPE_DES )
Fix psa_generator_import_key for DES In psa_generator_import_key, if generating a DES or 3DES key, set the parity bits. Add tests for deriving a DES key. Also test deriving an AES key while I'm at it.
2018-07-19 15:05:42 +00:00
psa_des_set_key_parity( slot->data.raw.data,
slot->data.raw.bytes );
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-19 22:20:32 +00:00
#endif /* MBEDTLS_DES_C */
}
else
#if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_GENPRIME)
Rename *KEYPAIR* to *KEY_PAIR* Be consistent with PUBLIC_KEY. perl -i -pe 's/KEYPAIR/KEY_PAIR/g' $(git ls-files)
2019-05-16 17:39:54 +00:00
if ( type == PSA_KEY_TYPE_RSA_KEY_PAIR )
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-19 22:20:32 +00:00
{
mbedtls_rsa_context *rsa;
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Remove `extra` parameter from psa_generate_key Read extra data from the domain parameters in the attribute structure instead of taking an argument on the function call. Implement this for RSA key generation, where the public exponent can be set as a domain parameter. Add tests that generate RSA keys with various public exponents.
2019-04-26 15:34:02 +00:00
int exponent;
psa_status_t status;
Define max sizes for MAC and signatures This requires defining a maximum RSA key size, since the RSA key size is the signature size. Enforce the maximum RSA key size when importing or generating a key.
2018-06-27 20:55:52 +00:00
if( bits > PSA_VENDOR_RSA_MAX_KEY_BITS )
return( PSA_ERROR_NOT_SUPPORTED );
Reject non-byte-aligned RSA keys On key import and key generation, for RSA, reject key sizes that are not a multiple of 8. Such keys are not well-supported in Mbed TLS and are hardly ever used in practice. The previous commit removed support for non-byte-aligned keys at the PSA level. This commit actively rejects such keys and adds corresponding tests (test keys generated with "openssl genrsa").
2018-11-12 17:39:40 +00:00
/* Accept only byte-aligned keys, for the same reasons as
* in psa_import_rsa_key(). */
if( bits % 8 != 0 )
return( PSA_ERROR_NOT_SUPPORTED );
Remove `extra` parameter from psa_generate_key Read extra data from the domain parameters in the attribute structure instead of taking an argument on the function call. Implement this for RSA key generation, where the public exponent can be set as a domain parameter. Add tests that generate RSA keys with various public exponents.
2019-04-26 15:34:02 +00:00
status = psa_read_rsa_exponent( domain_parameters,
domain_parameters_size,
&exponent );
if( status != PSA_SUCCESS )
return( status );
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-19 22:20:32 +00:00
rsa = mbedtls_calloc( 1, sizeof( *rsa ) );
if( rsa == NULL )
return( PSA_ERROR_INSUFFICIENT_MEMORY );
mbedtls_rsa_init( rsa, MBEDTLS_RSA_PKCS_V15, MBEDTLS_MD_NONE );
ret = mbedtls_rsa_gen_key( rsa,
mbedtls_ctr_drbg_random,
&global_data.ctr_drbg,
psa: Pass the number of bits with explicit types The GCM, CCM, RSA, and cipher modules inconsistently use int or unsigned int for a count of bits. The PSA Crypto API uses size_t for counting things. This causes issues on LLP64 systems where a size_t can hold more than an unsigned int. Add casts for where key_bits and bits are passed to mbedtls_* APIs.
2018-06-26 13:16:54 +00:00
(unsigned int) bits,
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-19 22:20:32 +00:00
exponent );
if( ret != 0 )
{
mbedtls_rsa_free( rsa );
mbedtls_free( rsa );
return( mbedtls_to_psa_error( ret ) );
}
slot->data.rsa = rsa;
}
else
#endif /* MBEDTLS_RSA_C && MBEDTLS_GENPRIME */
#if defined(MBEDTLS_ECP_C)
Rename *KEYPAIR* to *KEY_PAIR* Be consistent with PUBLIC_KEY. perl -i -pe 's/KEYPAIR/KEY_PAIR/g' $(git ls-files)
2019-05-16 17:39:54 +00:00
if ( PSA_KEY_TYPE_IS_ECC( type ) && PSA_KEY_TYPE_IS_KEY_PAIR( type ) )
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-19 22:20:32 +00:00
{
psa_ecc_curve_t curve = PSA_KEY_TYPE_GET_CURVE( type );
mbedtls_ecp_group_id grp_id = mbedtls_ecc_group_of_psa( curve );
const mbedtls_ecp_curve_info *curve_info =
mbedtls_ecp_curve_info_from_grp_id( grp_id );
mbedtls_ecp_keypair *ecp;
Initialise return values to an error Initialising the return values to and error is best practice and makes the library more robust.
2019-11-22 13:21:35 +00:00
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
Remove `extra` parameter from psa_generate_key Read extra data from the domain parameters in the attribute structure instead of taking an argument on the function call. Implement this for RSA key generation, where the public exponent can be set as a domain parameter. Add tests that generate RSA keys with various public exponents.
2019-04-26 15:34:02 +00:00
if( domain_parameters_size != 0 )
Implement psa_generate_key: AES, DES, RSA, ECP In the test cases, try exporting the generated key and perform sanity checks on it.
2018-06-19 22:20:32 +00:00
return( PSA_ERROR_NOT_SUPPORTED );
if( grp_id == MBEDTLS_ECP_DP_NONE || curve_info == NULL )
return( PSA_ERROR_NOT_SUPPORTED );
if( curve_info->bit_size != bits )
return( PSA_ERROR_INVALID_ARGUMENT );
ecp = mbedtls_calloc( 1, sizeof( *ecp ) );
if( ecp == NULL )
return( PSA_ERROR_INSUFFICIENT_MEMORY );
mbedtls_ecp_keypair_init( ecp );
ret = mbedtls_ecp_gen_key( grp_id, ecp,
mbedtls_ctr_drbg_random,
&global_data.ctr_drbg );
if( ret != 0 )
{
mbedtls_ecp_keypair_free( ecp );
mbedtls_free( ecp );
return( mbedtls_to_psa_error( ret ) );
}
slot->data.ecp = ecp;
}
else
#endif /* MBEDTLS_ECP_C */
return( PSA_ERROR_NOT_SUPPORTED );
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 10:53:30 +00:00
return( PSA_SUCCESS );
}
psa: Extend psa_generate_key to support persistent lifetimes
2018-11-07 16:05:30 +00:00
Rename psa_generate_random_key back to psa_generate_key generate_key is a more classical name. The longer name was only introduced to avoid confusion with getting a key from a generator, which is key derivation, but we no longer use the generator terminology so this reason no longer applies. perl -i -pe 's/psa_generate_random_key/psa_generate_key/g' $(git ls-files)
2019-05-16 17:42:05 +00:00
psa_status_t psa_generate_key( const psa_key_attributes_t *attributes,
Remove `extra` parameter from psa_generate_key Read extra data from the domain parameters in the attribute structure instead of taking an argument on the function call. Implement this for RSA key generation, where the public exponent can be set as a domain parameter. Add tests that generate RSA keys with various public exponents.
2019-04-26 15:34:02 +00:00
psa_key_handle_t *handle )
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 10:53:30 +00:00
{
psa_status_t status;
psa_key_slot_t *slot = NULL;
Driver table entries are now mutable Since driver table entries contain the driver context, which is mutable, they can't be const anymore.
2019-07-12 21:40:35 +00:00
psa_se_drv_table_entry_t *driver = NULL;
SE keys: implement and smoke-test p_generate
2019-08-06 16:36:36 +00:00
Reject keys of size 0 Implement the prohibition on keys of size 0.
2019-09-12 17:03:13 +00:00
/* Reject any attempt to create a zero-length key so that we don't
* risk tripping up later, e.g. on a malloc(0) that returns NULL. */
if( psa_get_key_bits( attributes ) == 0 )
return( PSA_ERROR_INVALID_ARGUMENT );
psa_start_key_creation: take the method as a parameter Let psa_start_key_creation know what type of key creation this is. This will be used at least for key registration in a secure element, which is a peculiar kind of creation since it uses existing key material.
2019-07-15 20:02:14 +00:00
status = psa_start_key_creation( PSA_KEY_CREATION_GENERATE,
attributes, handle, &slot, &driver );
SE keys: implement and smoke-test p_generate
2019-08-06 16:36:36 +00:00
if( status != PSA_SUCCESS )
goto exit;
SE keys: error out in key creation function that lack support
2019-07-24 11:44:30 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
if( driver != NULL )
psa: Extend psa_generate_key to support persistent lifetimes
2018-11-07 16:05:30 +00:00
{
SE keys: implement and smoke-test p_generate
2019-08-06 16:36:36 +00:00
const psa_drv_se_t *drv = psa_get_se_driver_methods( driver );
size_t pubkey_length = 0; /* We don't support this feature yet */
if( drv->key_management == NULL ||
drv->key_management->p_generate == NULL )
{
status = PSA_ERROR_NOT_SUPPORTED;
goto exit;
}
status = drv->key_management->p_generate(
psa_get_se_driver_context( driver ),
slot->data.se.slot_number, attributes,
NULL, 0, &pubkey_length );
SE keys: error out in key creation function that lack support
2019-07-24 11:44:30 +00:00
}
SE keys: implement and smoke-test p_generate
2019-08-06 16:36:36 +00:00
else
SE keys: error out in key creation function that lack support
2019-07-24 11:44:30 +00:00
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 10:53:30 +00:00
{
Rename psa_generate_random_key back to psa_generate_key generate_key is a more classical name. The longer name was only introduced to avoid confusion with getting a key from a generator, which is key derivation, but we no longer use the generator terminology so this reason no longer applies. perl -i -pe 's/psa_generate_random_key/psa_generate_key/g' $(git ls-files)
2019-05-16 17:42:05 +00:00
status = psa_generate_key_internal(
Move attribute fields to a substructure Move the "core attributes" to a substructure of psa_key_attribute_t. The motivation is to be able to use the new structure psa_core_key_attributes_t internally.
2019-07-30 11:48:52 +00:00
slot, attributes->core.bits,
Remove `extra` parameter from psa_generate_key Read extra data from the domain parameters in the attribute structure instead of taking an argument on the function call. Implement this for RSA key generation, where the public exponent can be set as a domain parameter. Add tests that generate RSA keys with various public exponents.
2019-04-26 15:34:02 +00:00
attributes->domain_parameters, attributes->domain_parameters_size );
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 10:53:30 +00:00
}
SE keys: implement and smoke-test p_generate
2019-08-06 16:36:36 +00:00
exit:
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 10:53:30 +00:00
if( status == PSA_SUCCESS )
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
status = psa_finish_key_creation( slot, driver );
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 10:53:30 +00:00
if( status != PSA_SUCCESS )
{
Look up the SE driver when creating a key When creating a key with a lifetime that places it in a secure element, retrieve the appropriate driver table entry. This commit doesn't yet achieve behavior: so far the code only retrieves the driver, it doesn't call the driver.
2019-06-26 16:34:38 +00:00
psa_fail_key_creation( slot, driver );
Implement atomic-creation psa_{generate,generator_import}_key Implement the new, attribute-based psa_generate_key and psa_generator_import_key.
2019-04-18 10:53:30 +00:00
*handle = 0;
psa: Extend psa_generate_key to support persistent lifetimes
2018-11-07 16:05:30 +00:00
}
return( status );
Implement psa_generate_random
2018-06-19 20:00:52 +00:00
}
Add key management functions Define psa_key_type_t and a first stab at a few values. New functions psa_import_key, psa_export_key, psa_destroy_key, psa_get_key_information. Implement them for raw data and RSA. Under the hood, create an in-memory, fixed-size keystore with room for MBEDTLS_PSA_KEY_SLOT_COUNT - 1 keys.
2018-01-28 12:16:24 +00:00
/****************************************************************/
/* Module setup */
/****************************************************************/
Add a facility to configure entropy sources Add a function to configure entropy sources. For testing only. Use it to test that the library initialization fails properly if there is no entropy source.
2018-11-20 20:59:56 +00:00
psa_status_t mbedtls_psa_crypto_configure_entropy_sources(
void (* entropy_init )( mbedtls_entropy_context *ctx ),
void (* entropy_free )( mbedtls_entropy_context *ctx ) )
{
if( global_data.rng_state != RNG_NOT_INITIALIZED )
return( PSA_ERROR_BAD_STATE );
global_data.entropy_init = entropy_init;
global_data.entropy_free = entropy_free;
return( PSA_SUCCESS );
}
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
void mbedtls_psa_crypto_free( void )
{
Move the key slot array to the slot management module Move the key slot array and its initialization and wiping to the slot management module. Also move the lowest-level key slot access function psa_get_key_slot and the auxiliary function for slot allocation psa_internal_allocate_key_slot to the slot management module.
2018-12-10 15:29:04 +00:00
psa_wipe_all_key_slots( );
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 20:42:52 +00:00
if( global_data.rng_state != RNG_NOT_INITIALIZED )
{
mbedtls_ctr_drbg_free( &global_data.ctr_drbg );
Add a facility to configure entropy sources Add a function to configure entropy sources. For testing only. Use it to test that the library initialization fails properly if there is no entropy source.
2018-11-20 20:59:56 +00:00
global_data.entropy_free( &global_data.entropy );
psa: Refactor psa_destroy_key() Create a new function psa_remove_key_from_memory() from psa_destroy_key(). This is needed as psa_destroy_key() will remove all key data, including persistent storage. mbedtls_psa_crypto_free() will now only free in-memory data and not persistent data.
2018-11-15 14:48:15 +00:00
}
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 20:42:52 +00:00
/* Wipe all remaining data, including configuration.
* In particular, this sets all state indicator to the value
* indicating "uninitialized". */
Use the library-wide zeroize function Since Mbed TLS 2.10, there is a single copy of mbedtls_platform_zeroize for the whole library instead of one per module. Update the PSA crypto module accordingly.
2018-12-07 17:14:53 +00:00
mbedtls_platform_zeroize( &global_data, sizeof( global_data ) );
Gate secure element support by a separate config option Secure element support has its own source file, and in addition requires many hooks in other files. This is a nontrivial amount of code, so make it optional (but default on).
2019-06-26 09:24:49 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
Unregister drivers on library deinitialization
2019-06-24 12:34:43 +00:00
/* Unregister all secure element drivers, so that we restart from
* a pristine state. */
psa_unregister_all_se_drivers( );
Gate secure element support by a separate config option Secure element support has its own source file, and in addition requires many hooks in other files. This is a nontrivial amount of code, so make it optional (but default on).
2019-06-26 09:24:49 +00:00
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
}
Add boilerplate to recover a transaction during init
2019-07-25 15:52:59 +00:00
#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
/** Recover a transaction that was interrupted by a power failure.
*
* This function is called during initialization, before psa_crypto_init()
* returns. If this function returns a failure status, the initialization
* fails.
*/
static psa_status_t psa_crypto_recover_transaction(
const psa_crypto_transaction_t *transaction )
{
switch( transaction->unknown.type )
{
case PSA_CRYPTO_TRANSACTION_CREATE_KEY:
case PSA_CRYPTO_TRANSACTION_DESTROY_KEY:
Make TODO comments consistent
2019-08-13 11:15:34 +00:00
/* TODO - fall through to the failure case until this
Add issue numbers for some missing parts of secure element support
2019-08-13 14:17:16 +00:00
* is implemented.
* https://github.com/ARMmbed/mbed-crypto/issues/218
*/
Add boilerplate to recover a transaction during init
2019-07-25 15:52:59 +00:00
default:
/* We found an unsupported transaction in the storage.
* We don't know what state the storage is in. Give up. */
return( PSA_ERROR_STORAGE_FAILURE );
}
}
#endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
psa_status_t psa_crypto_init( void )
{
Move the key slot array to the slot management module Move the key slot array and its initialization and wiping to the slot management module. Also move the lowest-level key slot access function psa_get_key_slot and the auxiliary function for slot allocation psa_internal_allocate_key_slot to the slot management module.
2018-12-10 15:29:04 +00:00
psa_status_t status;
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
const unsigned char drbg_seed[] = "PSA";
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 20:42:52 +00:00
/* Double initialization is explicitly allowed. */
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
if( global_data.initialized != 0 )
return( PSA_SUCCESS );
Add a facility to configure entropy sources Add a function to configure entropy sources. For testing only. Use it to test that the library initialization fails properly if there is no entropy source.
2018-11-20 20:59:56 +00:00
/* Set default configuration if
* mbedtls_psa_crypto_configure_entropy_sources() hasn't been called. */
if( global_data.entropy_init == NULL )
global_data.entropy_init = mbedtls_entropy_init;
if( global_data.entropy_free == NULL )
global_data.entropy_free = mbedtls_entropy_free;
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 20:42:52 +00:00
/* Initialize the random generator. */
Add a facility to configure entropy sources Add a function to configure entropy sources. For testing only. Use it to test that the library initialization fails properly if there is no entropy source.
2018-11-20 20:59:56 +00:00
global_data.entropy_init( &global_data.entropy );
psa: Add NV seed as an entropy source when needed When MBEDTLS_PSA_INJECT_ENTROPY is used, we now require also defining MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES. When MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES is defined, we do not add entropy sources by default. This includes the NV seed entropy source, which the PSA entropy injection API is built upon. The PSA entropy injection feature depends on using NV seed as an entropy source. Add NV seed as an entropy source for PSA entropy injection. Fixes e3dbdd8d9082 ("Gate entropy injection through a dedicated configuration option")
2019-06-04 16:14:43 +00:00
#if defined(MBEDTLS_PSA_INJECT_ENTROPY) && \
defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES)
/* The PSA entropy injection feature depends on using NV seed as an entropy
* source. Add NV seed as an entropy source for PSA entropy injection. */
mbedtls_entropy_add_source( &global_data.entropy,
mbedtls_nv_seed_poll, NULL,
MBEDTLS_ENTROPY_BLOCK_SIZE,
MBEDTLS_ENTROPY_SOURCE_STRONG );
#endif
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
mbedtls_ctr_drbg_init( &global_data.ctr_drbg );
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 20:42:52 +00:00
global_data.rng_state = RNG_INITIALIZED;
Move the key slot array to the slot management module Move the key slot array and its initialization and wiping to the slot management module. Also move the lowest-level key slot access function psa_get_key_slot and the auxiliary function for slot allocation psa_internal_allocate_key_slot to the slot management module.
2018-12-10 15:29:04 +00:00
status = mbedtls_to_psa_error(
mbedtls_ctr_drbg_seed( &global_data.ctr_drbg,
mbedtls_entropy_func,
&global_data.entropy,
drbg_seed, sizeof( drbg_seed ) - 1 ) );
if( status != PSA_SUCCESS )
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
goto exit;
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 20:42:52 +00:00
global_data.rng_state = RNG_SEEDED;
Move the key slot array to the slot management module Move the key slot array and its initialization and wiping to the slot management module. Also move the lowest-level key slot access function psa_get_key_slot and the auxiliary function for slot allocation psa_internal_allocate_key_slot to the slot management module.
2018-12-10 15:29:04 +00:00
status = psa_initialize_key_slots( );
if( status != PSA_SUCCESS )
goto exit;
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
SE driver: call the p_init method during psa_crypto_init()
2019-10-01 13:22:29 +00:00
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
status = psa_init_all_se_drivers( );
if( status != PSA_SUCCESS )
goto exit;
#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
Transaction support: be more future-proof If there's ever a non-SE-related transaction, make sure it gets handled during init.
2019-07-24 13:56:31 +00:00
#if defined(PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS)
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 17:30:34 +00:00
status = psa_crypto_load_transaction( );
if( status == PSA_SUCCESS )
{
Add boilerplate to recover a transaction during init
2019-07-25 15:52:59 +00:00
status = psa_crypto_recover_transaction( &psa_crypto_transaction );
if( status != PSA_SUCCESS )
goto exit;
status = psa_crypto_stop_transaction( );
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 17:30:34 +00:00
}
else if( status == PSA_ERROR_DOES_NOT_EXIST )
{
/* There's no transaction to complete. It's all good. */
status = PSA_SUCCESS;
}
Transaction support: be more future-proof If there's ever a non-SE-related transaction, make sure it gets handled during init.
2019-07-24 13:56:31 +00:00
#endif /* PSA_CRYPTO_STORAGE_HAS_TRANSACTIONS */
Do secure element key creation and destruction in a transaction Key creation and key destruction for a key in a secure element both require updating three pieces of data: the key data in the secure element, the key metadata in internal storage, and the SE driver's persistent data. Perform these actions in a transaction so that recovery is possible if the action is interrupted midway.
2019-07-22 17:30:34 +00:00
Make library init and deinit more robust to errors Allow mbedtls_psa_crypto_free to be called twice, or without a prior call to psa_crypto_init. Keep track of the initialization state more precisely in psa_crypto_init so that mbedtls_psa_crypto_free knows what to do.
2018-11-20 20:42:52 +00:00
/* All done. */
psa_crypto_init: set the global initialized flag
2018-03-07 13:16:44 +00:00
global_data.initialized = 1;
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
exit:
Move the key slot array to the slot management module Move the key slot array and its initialization and wiping to the slot management module. Also move the lowest-level key slot access function psa_get_key_slot and the auxiliary function for slot allocation psa_internal_allocate_key_slot to the slot management module.
2018-12-10 15:29:04 +00:00
if( status != PSA_SUCCESS )
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
mbedtls_psa_crypto_free( );
Move the key slot array to the slot management module Move the key slot array and its initialization and wiping to the slot management module. Also move the lowest-level key slot access function psa_get_key_slot and the auxiliary function for slot allocation psa_internal_allocate_key_slot to the slot management module.
2018-12-10 15:29:04 +00:00
return( status );
Add PSA crypto module New module psa_crypto.c (MBEDTLS_PSA_CRYPTO_C): Platform Security Architecture compatibility layer on top of libmedcrypto. Implement psa_crypto_init function which sets up a RNG. Add a mbedtls_psa_crypto_free function which deinitializes the library. Define a first batch of error codes.
2018-01-27 22:32:46 +00:00
}
#endif /* MBEDTLS_PSA_CRYPTO_C */
Reference in New Issue Copy Permalink