From d6f635e3f33a3776b011f0ea00759cd172548092 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Wed, 25 Feb 2026 16:12:16 +0000 Subject: [PATCH 01/19] test_suite_ccm: Added a test for invalid tag_len inputs. Signed-off-by: Minos Galanakis --- tests/suites/test_suite_ccm.data | 58 ++++++++++++++++++++++++++++ tests/suites/test_suite_ccm.function | 29 ++++++++++++++ 2 files changed, 87 insertions(+) diff --git a/tests/suites/test_suite_ccm.data b/tests/suites/test_suite_ccm.data index 22150f7a71..f3dfe0f41f 100644 --- a/tests/suites/test_suite_ccm.data +++ b/tests/suites/test_suite_ccm.data @@ -1746,6 +1746,64 @@ CCM* decrypt, instant finish AES-128 (P=0, N=13, A=0, T=16) depends_on:MBEDTLS_CCM_GCM_CAN_AES mbedtls_ccm_instant_finish:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_STAR_DECRYPT:"54caf96ef6d448734700aadab50faf7a":"a3803e752ae849c910d8da36af" +CCM finish check-boundary encrypt tag_len=8, finish_tag_len=32 +depends_on:MBEDTLS_CCM_GCM_CAN_AES +mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_ENCRYPT:8:32:MBEDTLS_ERR_CCM_BAD_INPUT:"54caf96ef6d448734700aadab50faf7a":"a3803e752ae849c910d8da36af" + +CCM finish check-boundary encrypt tag_len=8, finish_tag_len=8 +depends_on:MBEDTLS_CCM_GCM_CAN_AES +mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_ENCRYPT:8:8:0:"54caf96ef6d448734700aadab50faf7a":"a3803e752ae849c910d8da36af" + +CCM finish check-boundary decrypt tag_len=8, finish_tag_len=32 +depends_on:MBEDTLS_CCM_GCM_CAN_AES +mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_DECRYPT:8:32:MBEDTLS_ERR_CCM_BAD_INPUT:"54caf96ef6d448734700aadab50faf7a":"a3803e752ae849c910d8da36af" + +CCM finish check-boundary decrypt tag_len=8, finish_tag_len=8 +depends_on:MBEDTLS_CCM_GCM_CAN_AES +mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_DECRYPT:8:8:0:"54caf96ef6d448734700aadab50faf7a":"a3803e752ae849c910d8da36af" + +# CCM finish boundary matrix (encrypt) +CCM finish check-boundary encrypt tag_len=16, finish_tag_len=16 +depends_on:MBEDTLS_CCM_GCM_CAN_AES +mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_ENCRYPT:16:16:0:"54caf96ef6d448734700aadab50faf7a":"a3803e752ae849c910d8da36af" + +CCM finish check-boundary encrypt tag_len=8, finish_tag_len=16 +depends_on:MBEDTLS_CCM_GCM_CAN_AES +mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_ENCRYPT:8:16:MBEDTLS_ERR_CCM_BAD_INPUT:"54caf96ef6d448734700aadab50faf7a":"a3803e752ae849c910d8da36af" + +CCM finish check-boundary encrypt tag_len=16, finish_tag_len=17 +depends_on:MBEDTLS_CCM_GCM_CAN_AES +mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_ENCRYPT:16:17:MBEDTLS_ERR_CCM_BAD_INPUT:"54caf96ef6d448734700aadab50faf7a":"a3803e752ae849c910d8da36af" + +CCM finish check-boundary encrypt tag_len=16, finish_tag_len=4000 +depends_on:MBEDTLS_CCM_GCM_CAN_AES +mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_ENCRYPT:16:4000:MBEDTLS_ERR_CCM_BAD_INPUT:"54caf96ef6d448734700aadab50faf7a":"a3803e752ae849c910d8da36af" + +CCM finish check-boundary encrypt tag_len=16, finish_tag_len=8 +depends_on:MBEDTLS_CCM_GCM_CAN_AES +mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_ENCRYPT:16:8:MBEDTLS_ERR_CCM_BAD_INPUT:"54caf96ef6d448734700aadab50faf7a":"a3803e752ae849c910d8da36af" + +# CCM finish boundary matrix (decrypt) +CCM finish check-boundary decrypt tag_len=16, finish_tag_len=16 +depends_on:MBEDTLS_CCM_GCM_CAN_AES +mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_DECRYPT:16:16:0:"54caf96ef6d448734700aadab50faf7a":"a3803e752ae849c910d8da36af" + +CCM finish check-boundary decrypt tag_len=8, finish_tag_len=16 +depends_on:MBEDTLS_CCM_GCM_CAN_AES +mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_DECRYPT:8:16:MBEDTLS_ERR_CCM_BAD_INPUT:"54caf96ef6d448734700aadab50faf7a":"a3803e752ae849c910d8da36af" + +CCM finish check-boundary decrypt tag_len=16, finish_tag_len=17 +depends_on:MBEDTLS_CCM_GCM_CAN_AES +mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_DECRYPT:16:17:MBEDTLS_ERR_CCM_BAD_INPUT:"54caf96ef6d448734700aadab50faf7a":"a3803e752ae849c910d8da36af" + +CCM finish check-boundary decrypt tag_len=16, finish_tag_len=4000 +depends_on:MBEDTLS_CCM_GCM_CAN_AES +mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_DECRYPT:16:4000:MBEDTLS_ERR_CCM_BAD_INPUT:"54caf96ef6d448734700aadab50faf7a":"a3803e752ae849c910d8da36af" + +CCM finish check-boundary decrypt tag_len=16, finish_tag_len=8 +depends_on:MBEDTLS_CCM_GCM_CAN_AES +mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_DECRYPT:16:8:MBEDTLS_ERR_CCM_BAD_INPUT:"54caf96ef6d448734700aadab50faf7a":"a3803e752ae849c910d8da36af" + CCM pass unexpected auth data, NIST VPT AES-128 #14 (P=13, N=13, A=32, T=16) depends_on:MBEDTLS_CCM_GCM_CAN_AES mbedtls_ccm_unexpected_ad::MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_ENCRYPT:"d32088d50df9aba14d9022c870a0cb85":"e16c69861efc206e85aab1255e":"0eff7d7bcceb873c3203a8df74f4e91b04bd607ec11202f96cfeb99f5bcdb7aa" diff --git a/tests/suites/test_suite_ccm.function b/tests/suites/test_suite_ccm.function index 798be77013..cf54d2d591 100644 --- a/tests/suites/test_suite_ccm.function +++ b/tests/suites/test_suite_ccm.function @@ -906,3 +906,32 @@ exit: BLOCK_CIPHER_PSA_DONE(); } /* END_CASE */ + +/* BEGIN_CASE */ +void mbedtls_ccm_finish_boundary(int cipher_id, int mode, + int start_tag_len, int finish_tag_len, + int expected_finish_ret, + data_t *key, data_t *iv) +{ + mbedtls_ccm_context ctx; + unsigned char *tag = NULL; + + mbedtls_ccm_init(&ctx); + + BLOCK_CIPHER_PSA_INIT(); + TEST_EQUAL(mbedtls_ccm_setkey(&ctx, cipher_id, key->x, key->len * 8), 0); + TEST_EQUAL(0, mbedtls_ccm_starts(&ctx, mode, iv->x, iv->len)); + + /* Use the caller-provided tag length during setup, then finish with a + * different tag length to exercise boundary handling/API complianece */ + TEST_EQUAL(0, mbedtls_ccm_set_lengths(&ctx, 0, 0, (size_t) start_tag_len)); + + TEST_CALLOC(tag, finish_tag_len); + TEST_EQUAL(expected_finish_ret, + mbedtls_ccm_finish(&ctx, tag, finish_tag_len)); +exit: + mbedtls_free(tag); + mbedtls_ccm_free(&ctx); + BLOCK_CIPHER_PSA_DONE(); +} +/* END_CASE */ From 53ab8a525b12cfd941333030631387f56b4b00b6 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Mon, 2 Mar 2026 15:51:47 +0000 Subject: [PATCH 02/19] ccm_finish: Added a boundary check for tag-len. Signed-off-by: Minos Galanakis --- library/ccm.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/library/ccm.c b/library/ccm.c index 969c6c781b..b16b47117e 100644 --- a/library/ccm.c +++ b/library/ccm.c @@ -488,6 +488,11 @@ int mbedtls_ccm_finish(mbedtls_ccm_context *ctx, return MBEDTLS_ERR_CCM_BAD_INPUT; } + if ((tag_len != 0 && (tag_len < 4 || tag_len > 16 || (tag_len & 1) != 0)) || + (tag_len != ctx->tag_len)) { + return MBEDTLS_ERR_CCM_BAD_INPUT; + } + /* * Authentication: reset counter and crypt/mask internal tag */ From ee9829a32ecc194c9d104a10dc2022919270c5d7 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Tue, 3 Mar 2026 11:12:09 +0000 Subject: [PATCH 03/19] ccm_finish: Only reject tag_len missmatch when it has been set. Signed-off-by: Minos Galanakis --- library/ccm.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/library/ccm.c b/library/ccm.c index b16b47117e..8025409690 100644 --- a/library/ccm.c +++ b/library/ccm.c @@ -488,8 +488,11 @@ int mbedtls_ccm_finish(mbedtls_ccm_context *ctx, return MBEDTLS_ERR_CCM_BAD_INPUT; } - if ((tag_len != 0 && (tag_len < 4 || tag_len > 16 || (tag_len & 1) != 0)) || - (tag_len != ctx->tag_len)) { + /* Reject invalid tag lengths and mismatches with negotiated length (if set). */ + if (tag_len != 0 && (tag_len < 4 || tag_len > 16 || (tag_len & 1) != 0)) { + return MBEDTLS_ERR_CCM_BAD_INPUT; + } + if ((ctx->state & CCM_STATE__LENGTHS_SET) && tag_len != ctx->tag_len) { return MBEDTLS_ERR_CCM_BAD_INPUT; } From 24081fe484a7416e3fd901074a5844fc6ff2295c Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Mon, 2 Mar 2026 16:55:02 +0000 Subject: [PATCH 04/19] Added Changelog Signed-off-by: Minos Galanakis --- ChangeLog.d/fix-ccm-finish.txt | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 ChangeLog.d/fix-ccm-finish.txt diff --git a/ChangeLog.d/fix-ccm-finish.txt b/ChangeLog.d/fix-ccm-finish.txt new file mode 100644 index 0000000000..7bf5841612 --- /dev/null +++ b/ChangeLog.d/fix-ccm-finish.txt @@ -0,0 +1,3 @@ +Bugfix + * Add tag length validation in mbedtls_ccm_finish() to reject lengths + that are invalid or differ from the negotiated tag length. From de24220853bc41562eb3121abcd1e97d4a69bd18 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Thu, 5 Mar 2026 09:10:47 +0000 Subject: [PATCH 05/19] ccm_finish: Updated to only accept lens set by ccm_set_lengths Signed-off-by: Minos Galanakis --- library/ccm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/library/ccm.c b/library/ccm.c index 8025409690..a6eed4a56c 100644 --- a/library/ccm.c +++ b/library/ccm.c @@ -488,11 +488,11 @@ int mbedtls_ccm_finish(mbedtls_ccm_context *ctx, return MBEDTLS_ERR_CCM_BAD_INPUT; } - /* Reject invalid tag lengths and mismatches with negotiated length (if set). */ - if (tag_len != 0 && (tag_len < 4 || tag_len > 16 || (tag_len & 1) != 0)) { + if (!(ctx->state & CCM_STATE__LENGTHS_SET)) { return MBEDTLS_ERR_CCM_BAD_INPUT; } - if ((ctx->state & CCM_STATE__LENGTHS_SET) && tag_len != ctx->tag_len) { + + if (tag_len != ctx->tag_len) { return MBEDTLS_ERR_CCM_BAD_INPUT; } From a397bb13a38586557adc32c4a3f21ffa5306855f Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Thu, 5 Mar 2026 10:29:21 +0000 Subject: [PATCH 06/19] test_suite_psa_crypto: Extended aead_multipart_state_test for PSA_ALG_CCM Signed-off-by: Minos Galanakis --- tests/suites/test_suite_psa_crypto.function | 52 +++++++++++++++++++-- 1 file changed, 48 insertions(+), 4 deletions(-) diff --git a/tests/suites/test_suite_psa_crypto.function b/tests/suites/test_suite_psa_crypto.function index b4ff66ae9f..a568e243b1 100644 --- a/tests/suites/test_suite_psa_crypto.function +++ b/tests/suites/test_suite_psa_crypto.function @@ -6490,11 +6490,32 @@ void aead_multipart_state_test(int key_type_arg, data_t *key_data, PSA_ASSERT(psa_aead_set_nonce(&operation, nonce->x, nonce->len)); if (operation.alg == PSA_ALG_CCM) { - PSA_ASSERT(psa_aead_finish(&operation, final_data, + /* For CCM, finishing without setting lengths must fail. */ + TEST_EQUAL(psa_aead_finish(&operation, final_data, finish_output_size, &output_part_length, tag_buffer, tag_length, - &tag_size)); + &tag_size), + PSA_ERROR_INVALID_ARGUMENT); + psa_aead_abort(&operation); + + PSA_ASSERT(psa_aead_encrypt_setup(&operation, key, alg)); + PSA_ASSERT(psa_aead_set_nonce(&operation, nonce->x, nonce->len)); + + PSA_ASSERT(psa_aead_set_lengths(&operation, additional_data->len, + input_data->len)); + PSA_ASSERT(psa_aead_update_ad(&operation, additional_data->x, + additional_data->len)); + PSA_ASSERT(psa_aead_update(&operation, input_data->x, + input_data->len, output_data, + output_size, &output_length)); + + TEST_EQUAL(psa_aead_finish(&operation, final_data, + finish_output_size, + &output_part_length, + tag_buffer, tag_length, + &tag_size), + PSA_SUCCESS); } else { PSA_ASSERT(psa_aead_finish(&operation, final_data, finish_output_size, @@ -6562,11 +6583,34 @@ void aead_multipart_state_test(int key_type_arg, data_t *key_data, PSA_AEAD_NONCE_MAX_SIZE, &nonce_length)); if (operation.alg == PSA_ALG_CCM) { - PSA_ASSERT(psa_aead_finish(&operation, final_data, + /* For CCM, finishing without setting lengths must fail. */ + TEST_EQUAL(psa_aead_finish(&operation, final_data, finish_output_size, &output_part_length, tag_buffer, tag_length, - &tag_size)); + &tag_size), + PSA_ERROR_INVALID_ARGUMENT); + psa_aead_abort(&operation); + + PSA_ASSERT(psa_aead_encrypt_setup(&operation, key, alg)); + PSA_ASSERT(psa_aead_generate_nonce(&operation, nonce_buffer, + PSA_AEAD_NONCE_MAX_SIZE, + &nonce_length)); + + PSA_ASSERT(psa_aead_set_lengths(&operation, additional_data->len, + input_data->len)); + PSA_ASSERT(psa_aead_update_ad(&operation, additional_data->x, + additional_data->len)); + PSA_ASSERT(psa_aead_update(&operation, input_data->x, + input_data->len, output_data, + output_size, &output_length)); + + TEST_EQUAL(psa_aead_finish(&operation, final_data, + finish_output_size, + &output_part_length, + tag_buffer, tag_length, + &tag_size), + PSA_SUCCESS); } else { PSA_ASSERT(psa_aead_finish(&operation, final_data, finish_output_size, From e54d769fe80d4d6abbdcf7ef84e7d593f8f81eee Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Thu, 5 Mar 2026 10:40:08 +0000 Subject: [PATCH 07/19] Updated Changelog Signed-off-by: Minos Galanakis --- ChangeLog.d/fix-ccm-finish.txt | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/ChangeLog.d/fix-ccm-finish.txt b/ChangeLog.d/fix-ccm-finish.txt index 7bf5841612..7600ec89a0 100644 --- a/ChangeLog.d/fix-ccm-finish.txt +++ b/ChangeLog.d/fix-ccm-finish.txt @@ -1,3 +1,6 @@ -Bugfix - * Add tag length validation in mbedtls_ccm_finish() to reject lengths - that are invalid or differ from the negotiated tag length. +Security + * Add tag length validation in mbedtls_ccm_finish() to prevent + out-of-bounds reads and mitigate potential application buffer + overflows where applications relied on the library to enforce + tag length constraints. + From f447b0264a38f9a1716bf5f94a1b97f770bd5b3e Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Tue, 10 Mar 2026 15:37:50 +0000 Subject: [PATCH 08/19] test_suite_psa_crypto: Extended aead_multipart_state_test(2) This patch adds psa_aead_decrypt_setup() & psa_aead_finish() path to the multipart_state_testing. Signed-off-by: Minos Galanakis --- tests/suites/test_suite_psa_crypto.function | 56 +++++++++++++++++++++ 1 file changed, 56 insertions(+) diff --git a/tests/suites/test_suite_psa_crypto.function b/tests/suites/test_suite_psa_crypto.function index a568e243b1..2c9a95d779 100644 --- a/tests/suites/test_suite_psa_crypto.function +++ b/tests/suites/test_suite_psa_crypto.function @@ -6516,6 +6516,34 @@ void aead_multipart_state_test(int key_type_arg, data_t *key_data, tag_buffer, tag_length, &tag_size), PSA_SUCCESS); + + psa_aead_abort(&operation); + /* For CCM, verifing without setting lengths must fail. */ + TEST_EQUAL(psa_aead_verify(&operation, final_data, + finish_output_size, + &output_part_length, + tag_buffer, + tag_length), + PSA_ERROR_BAD_STATE); + + PSA_ASSERT(psa_aead_decrypt_setup(&operation, key, alg)); + PSA_ASSERT(psa_aead_set_nonce(&operation, nonce->x, nonce->len)); + + PSA_ASSERT(psa_aead_set_lengths(&operation, additional_data->len, + input_data->len)); + PSA_ASSERT(psa_aead_update_ad(&operation, additional_data->x, + additional_data->len)); + PSA_ASSERT(psa_aead_update(&operation, input_data->x, + input_data->len, output_data, + output_size, &output_length)); + + /* Signature verification is expected fail, but after the checks for lengths */ + TEST_EQUAL(psa_aead_verify(&operation, final_data, + finish_output_size, + &output_part_length, + tag_buffer, + tag_length), + PSA_ERROR_INVALID_SIGNATURE); } else { PSA_ASSERT(psa_aead_finish(&operation, final_data, finish_output_size, @@ -6611,6 +6639,34 @@ void aead_multipart_state_test(int key_type_arg, data_t *key_data, tag_buffer, tag_length, &tag_size), PSA_SUCCESS); + + psa_aead_abort(&operation); + /* For CCM, verifing without setting lengths must fail. */ + TEST_EQUAL(psa_aead_verify(&operation, final_data, + finish_output_size, + &output_part_length, + tag_buffer, + tag_length), + PSA_ERROR_BAD_STATE); + + PSA_ASSERT(psa_aead_decrypt_setup(&operation, key, alg)); + PSA_ASSERT(psa_aead_set_nonce(&operation, nonce->x, nonce->len)); + + PSA_ASSERT(psa_aead_set_lengths(&operation, additional_data->len, + input_data->len)); + PSA_ASSERT(psa_aead_update_ad(&operation, additional_data->x, + additional_data->len)); + PSA_ASSERT(psa_aead_update(&operation, input_data->x, + input_data->len, output_data, + output_size, &output_length)); + + /* Signature verification is expected fail, but after the checks for lengths */ + TEST_EQUAL(psa_aead_verify(&operation, final_data, + finish_output_size, + &output_part_length, + tag_buffer, + tag_length), + PSA_ERROR_INVALID_SIGNATURE); } else { PSA_ASSERT(psa_aead_finish(&operation, final_data, finish_output_size, From 27069c6be6a4b714b7e9031c2a7740a33a4d4454 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Tue, 10 Mar 2026 15:39:52 +0000 Subject: [PATCH 09/19] test_suite_ccm.function: Fixed typo in docs Signed-off-by: Minos Galanakis --- tests/suites/test_suite_ccm.function | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/suites/test_suite_ccm.function b/tests/suites/test_suite_ccm.function index cf54d2d591..5bd2c34493 100644 --- a/tests/suites/test_suite_ccm.function +++ b/tests/suites/test_suite_ccm.function @@ -923,7 +923,7 @@ void mbedtls_ccm_finish_boundary(int cipher_id, int mode, TEST_EQUAL(0, mbedtls_ccm_starts(&ctx, mode, iv->x, iv->len)); /* Use the caller-provided tag length during setup, then finish with a - * different tag length to exercise boundary handling/API complianece */ + * different tag length to exercise boundary handling/API compliance */ TEST_EQUAL(0, mbedtls_ccm_set_lengths(&ctx, 0, 0, (size_t) start_tag_len)); TEST_CALLOC(tag, finish_tag_len); From 32caf3bad07ac9fd222625a2e78a2114caa7ec58 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Tue, 10 Mar 2026 15:46:04 +0000 Subject: [PATCH 10/19] ccm: Fail when calling finish without ccm_starts Signed-off-by: Minos Galanakis --- library/ccm.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/library/ccm.c b/library/ccm.c index a6eed4a56c..9f97ca9fc2 100644 --- a/library/ccm.c +++ b/library/ccm.c @@ -480,6 +480,10 @@ int mbedtls_ccm_finish(mbedtls_ccm_context *ctx, return MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; } + if (!(ctx->state & CCM_STATE__STARTED)) { + return MBEDTLS_ERR_CCM_BAD_INPUT; + } + if (ctx->add_len > 0 && !(ctx->state & CCM_STATE__AUTH_DATA_FINISHED)) { return MBEDTLS_ERR_CCM_BAD_INPUT; } From 0004fe7e969b0cf1964778ff016ca8e178a5ed47 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Tue, 10 Mar 2026 15:51:01 +0000 Subject: [PATCH 11/19] test_suite_ccm: Updated input arguments Key and iv are now test function internal arguments. Signed-off-by: Minos Galanakis --- tests/suites/test_suite_ccm.data | 28 ++++++++++++++-------------- tests/suites/test_suite_ccm.function | 13 +++++++++---- 2 files changed, 23 insertions(+), 18 deletions(-) diff --git a/tests/suites/test_suite_ccm.data b/tests/suites/test_suite_ccm.data index f3dfe0f41f..e03406ca4b 100644 --- a/tests/suites/test_suite_ccm.data +++ b/tests/suites/test_suite_ccm.data @@ -1748,61 +1748,61 @@ mbedtls_ccm_instant_finish:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_STAR_DECRYPT:"54caf CCM finish check-boundary encrypt tag_len=8, finish_tag_len=32 depends_on:MBEDTLS_CCM_GCM_CAN_AES -mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_ENCRYPT:8:32:MBEDTLS_ERR_CCM_BAD_INPUT:"54caf96ef6d448734700aadab50faf7a":"a3803e752ae849c910d8da36af" +mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_ENCRYPT:8:32:MBEDTLS_ERR_CCM_BAD_INPUT CCM finish check-boundary encrypt tag_len=8, finish_tag_len=8 depends_on:MBEDTLS_CCM_GCM_CAN_AES -mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_ENCRYPT:8:8:0:"54caf96ef6d448734700aadab50faf7a":"a3803e752ae849c910d8da36af" +mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_ENCRYPT:8:8:0 CCM finish check-boundary decrypt tag_len=8, finish_tag_len=32 depends_on:MBEDTLS_CCM_GCM_CAN_AES -mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_DECRYPT:8:32:MBEDTLS_ERR_CCM_BAD_INPUT:"54caf96ef6d448734700aadab50faf7a":"a3803e752ae849c910d8da36af" +mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_DECRYPT:8:32:MBEDTLS_ERR_CCM_BAD_INPUT CCM finish check-boundary decrypt tag_len=8, finish_tag_len=8 depends_on:MBEDTLS_CCM_GCM_CAN_AES -mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_DECRYPT:8:8:0:"54caf96ef6d448734700aadab50faf7a":"a3803e752ae849c910d8da36af" +mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_DECRYPT:8:8:0 # CCM finish boundary matrix (encrypt) CCM finish check-boundary encrypt tag_len=16, finish_tag_len=16 depends_on:MBEDTLS_CCM_GCM_CAN_AES -mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_ENCRYPT:16:16:0:"54caf96ef6d448734700aadab50faf7a":"a3803e752ae849c910d8da36af" +mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_ENCRYPT:16:16:0 CCM finish check-boundary encrypt tag_len=8, finish_tag_len=16 depends_on:MBEDTLS_CCM_GCM_CAN_AES -mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_ENCRYPT:8:16:MBEDTLS_ERR_CCM_BAD_INPUT:"54caf96ef6d448734700aadab50faf7a":"a3803e752ae849c910d8da36af" +mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_ENCRYPT:8:16:MBEDTLS_ERR_CCM_BAD_INPUT CCM finish check-boundary encrypt tag_len=16, finish_tag_len=17 depends_on:MBEDTLS_CCM_GCM_CAN_AES -mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_ENCRYPT:16:17:MBEDTLS_ERR_CCM_BAD_INPUT:"54caf96ef6d448734700aadab50faf7a":"a3803e752ae849c910d8da36af" +mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_ENCRYPT:16:17:MBEDTLS_ERR_CCM_BAD_INPUT CCM finish check-boundary encrypt tag_len=16, finish_tag_len=4000 depends_on:MBEDTLS_CCM_GCM_CAN_AES -mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_ENCRYPT:16:4000:MBEDTLS_ERR_CCM_BAD_INPUT:"54caf96ef6d448734700aadab50faf7a":"a3803e752ae849c910d8da36af" +mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_ENCRYPT:16:4000:MBEDTLS_ERR_CCM_BAD_INPUT CCM finish check-boundary encrypt tag_len=16, finish_tag_len=8 depends_on:MBEDTLS_CCM_GCM_CAN_AES -mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_ENCRYPT:16:8:MBEDTLS_ERR_CCM_BAD_INPUT:"54caf96ef6d448734700aadab50faf7a":"a3803e752ae849c910d8da36af" +mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_ENCRYPT:16:8:MBEDTLS_ERR_CCM_BAD_INPUT # CCM finish boundary matrix (decrypt) CCM finish check-boundary decrypt tag_len=16, finish_tag_len=16 depends_on:MBEDTLS_CCM_GCM_CAN_AES -mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_DECRYPT:16:16:0:"54caf96ef6d448734700aadab50faf7a":"a3803e752ae849c910d8da36af" +mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_DECRYPT:16:16:0 CCM finish check-boundary decrypt tag_len=8, finish_tag_len=16 depends_on:MBEDTLS_CCM_GCM_CAN_AES -mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_DECRYPT:8:16:MBEDTLS_ERR_CCM_BAD_INPUT:"54caf96ef6d448734700aadab50faf7a":"a3803e752ae849c910d8da36af" +mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_DECRYPT:8:16:MBEDTLS_ERR_CCM_BAD_INPUT CCM finish check-boundary decrypt tag_len=16, finish_tag_len=17 depends_on:MBEDTLS_CCM_GCM_CAN_AES -mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_DECRYPT:16:17:MBEDTLS_ERR_CCM_BAD_INPUT:"54caf96ef6d448734700aadab50faf7a":"a3803e752ae849c910d8da36af" +mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_DECRYPT:16:17:MBEDTLS_ERR_CCM_BAD_INPUT CCM finish check-boundary decrypt tag_len=16, finish_tag_len=4000 depends_on:MBEDTLS_CCM_GCM_CAN_AES -mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_DECRYPT:16:4000:MBEDTLS_ERR_CCM_BAD_INPUT:"54caf96ef6d448734700aadab50faf7a":"a3803e752ae849c910d8da36af" +mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_DECRYPT:16:4000:MBEDTLS_ERR_CCM_BAD_INPUT CCM finish check-boundary decrypt tag_len=16, finish_tag_len=8 depends_on:MBEDTLS_CCM_GCM_CAN_AES -mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_DECRYPT:16:8:MBEDTLS_ERR_CCM_BAD_INPUT:"54caf96ef6d448734700aadab50faf7a":"a3803e752ae849c910d8da36af" +mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_DECRYPT:16:8:MBEDTLS_ERR_CCM_BAD_INPUT CCM pass unexpected auth data, NIST VPT AES-128 #14 (P=13, N=13, A=32, T=16) depends_on:MBEDTLS_CCM_GCM_CAN_AES diff --git a/tests/suites/test_suite_ccm.function b/tests/suites/test_suite_ccm.function index 5bd2c34493..251eb350d4 100644 --- a/tests/suites/test_suite_ccm.function +++ b/tests/suites/test_suite_ccm.function @@ -910,17 +910,22 @@ exit: /* BEGIN_CASE */ void mbedtls_ccm_finish_boundary(int cipher_id, int mode, int start_tag_len, int finish_tag_len, - int expected_finish_ret, - data_t *key, data_t *iv) + int expected_finish_ret) { + unsigned char key[16]; + unsigned char iv[13]; + /* Test does not rely on data/iv.Using Arbitrary values */ + memset(key, 42, sizeof(key)); + memset(iv, 11, sizeof(iv)); + mbedtls_ccm_context ctx; unsigned char *tag = NULL; mbedtls_ccm_init(&ctx); BLOCK_CIPHER_PSA_INIT(); - TEST_EQUAL(mbedtls_ccm_setkey(&ctx, cipher_id, key->x, key->len * 8), 0); - TEST_EQUAL(0, mbedtls_ccm_starts(&ctx, mode, iv->x, iv->len)); + TEST_EQUAL(mbedtls_ccm_setkey(&ctx, cipher_id, key, sizeof(key) * 8), 0); + TEST_EQUAL(0, mbedtls_ccm_starts(&ctx, mode, iv, sizeof(iv))); /* Use the caller-provided tag length during setup, then finish with a * different tag length to exercise boundary handling/API compliance */ From e96de338673f12c58064617dac8729bc97704cf7 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Tue, 10 Mar 2026 15:33:48 +0000 Subject: [PATCH 12/19] psa_core: Added a retval in psa_aead_final_checks() Signed-off-by: Minos Galanakis --- library/psa_crypto.c | 4 ++++ tests/suites/test_suite_psa_crypto.function | 4 ++-- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/library/psa_crypto.c b/library/psa_crypto.c index 9e17e27f2d..8fbfa77916 100644 --- a/library/psa_crypto.c +++ b/library/psa_crypto.c @@ -5523,6 +5523,10 @@ exit: static psa_status_t psa_aead_final_checks(const psa_aead_operation_t *operation) { + if (operation->alg == PSA_ALG_CCM && !operation->lengths_set) { + return PSA_ERROR_BAD_STATE; + } + if (operation->id == 0 || !operation->nonce_set) { return PSA_ERROR_BAD_STATE; } diff --git a/tests/suites/test_suite_psa_crypto.function b/tests/suites/test_suite_psa_crypto.function index 2c9a95d779..df3324d883 100644 --- a/tests/suites/test_suite_psa_crypto.function +++ b/tests/suites/test_suite_psa_crypto.function @@ -6496,7 +6496,7 @@ void aead_multipart_state_test(int key_type_arg, data_t *key_data, &output_part_length, tag_buffer, tag_length, &tag_size), - PSA_ERROR_INVALID_ARGUMENT); + PSA_ERROR_BAD_STATE); psa_aead_abort(&operation); PSA_ASSERT(psa_aead_encrypt_setup(&operation, key, alg)); @@ -6617,7 +6617,7 @@ void aead_multipart_state_test(int key_type_arg, data_t *key_data, &output_part_length, tag_buffer, tag_length, &tag_size), - PSA_ERROR_INVALID_ARGUMENT); + PSA_ERROR_BAD_STATE); psa_aead_abort(&operation); PSA_ASSERT(psa_aead_encrypt_setup(&operation, key, alg)); From 66d57b0d7b4d225e7a1cfd566cfae3027affcd6e Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Thu, 12 Mar 2026 10:06:14 +0000 Subject: [PATCH 13/19] test_suite_psa_crypto: Updated multipart tests Signed-off-by: Minos Galanakis --- tests/suites/test_suite_psa_crypto.function | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/tests/suites/test_suite_psa_crypto.function b/tests/suites/test_suite_psa_crypto.function index df3324d883..04c24451c7 100644 --- a/tests/suites/test_suite_psa_crypto.function +++ b/tests/suites/test_suite_psa_crypto.function @@ -6516,15 +6516,18 @@ void aead_multipart_state_test(int key_type_arg, data_t *key_data, tag_buffer, tag_length, &tag_size), PSA_SUCCESS); - psa_aead_abort(&operation); - /* For CCM, verifing without setting lengths must fail. */ + + /* For CCM, verifying without setting lengths must fail. */ + PSA_ASSERT(psa_aead_decrypt_setup(&operation, key, alg)); + PSA_ASSERT(psa_aead_set_nonce(&operation, nonce->x, nonce->len)); TEST_EQUAL(psa_aead_verify(&operation, final_data, finish_output_size, &output_part_length, tag_buffer, tag_length), PSA_ERROR_BAD_STATE); + psa_aead_abort(&operation); PSA_ASSERT(psa_aead_decrypt_setup(&operation, key, alg)); PSA_ASSERT(psa_aead_set_nonce(&operation, nonce->x, nonce->len)); @@ -6537,7 +6540,8 @@ void aead_multipart_state_test(int key_type_arg, data_t *key_data, input_data->len, output_data, output_size, &output_length)); - /* Signature verification is expected fail, but after the checks for lengths */ + /* psa_driver_wrapper_aead_verify, which is called after psa_aead_final_checks + will return PSA_ERROR_INVALID_SIGNATURE */ TEST_EQUAL(psa_aead_verify(&operation, final_data, finish_output_size, &output_part_length, @@ -6641,13 +6645,16 @@ void aead_multipart_state_test(int key_type_arg, data_t *key_data, PSA_SUCCESS); psa_aead_abort(&operation); - /* For CCM, verifing without setting lengths must fail. */ + /* For CCM, verifying without setting lengths must fail. */ + PSA_ASSERT(psa_aead_decrypt_setup(&operation, key, alg)); + PSA_ASSERT(psa_aead_set_nonce(&operation, nonce->x, nonce->len)); TEST_EQUAL(psa_aead_verify(&operation, final_data, finish_output_size, &output_part_length, tag_buffer, tag_length), PSA_ERROR_BAD_STATE); + psa_aead_abort(&operation); PSA_ASSERT(psa_aead_decrypt_setup(&operation, key, alg)); PSA_ASSERT(psa_aead_set_nonce(&operation, nonce->x, nonce->len)); @@ -6660,7 +6667,8 @@ void aead_multipart_state_test(int key_type_arg, data_t *key_data, input_data->len, output_data, output_size, &output_length)); - /* Signature verification is expected fail, but after the checks for lengths */ + /* psa_driver_wrapper_aead_verify, which is called after psa_aead_final_checks + will return PSA_ERROR_INVALID_SIGNATURE */ TEST_EQUAL(psa_aead_verify(&operation, final_data, finish_output_size, &output_part_length, From 8b50733a735c8a547e2fd314c24b205ff0b07881 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Thu, 12 Mar 2026 10:08:46 +0000 Subject: [PATCH 14/19] ccm: Re-ordered len checks in mbedtls_ccm_finish. Signed-off-by: Minos Galanakis --- library/ccm.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/library/ccm.c b/library/ccm.c index 9f97ca9fc2..11d1051e98 100644 --- a/library/ccm.c +++ b/library/ccm.c @@ -484,6 +484,10 @@ int mbedtls_ccm_finish(mbedtls_ccm_context *ctx, return MBEDTLS_ERR_CCM_BAD_INPUT; } + if (!(ctx->state & CCM_STATE__LENGTHS_SET)) { + return MBEDTLS_ERR_CCM_BAD_INPUT; + } + if (ctx->add_len > 0 && !(ctx->state & CCM_STATE__AUTH_DATA_FINISHED)) { return MBEDTLS_ERR_CCM_BAD_INPUT; } @@ -492,10 +496,6 @@ int mbedtls_ccm_finish(mbedtls_ccm_context *ctx, return MBEDTLS_ERR_CCM_BAD_INPUT; } - if (!(ctx->state & CCM_STATE__LENGTHS_SET)) { - return MBEDTLS_ERR_CCM_BAD_INPUT; - } - if (tag_len != ctx->tag_len) { return MBEDTLS_ERR_CCM_BAD_INPUT; } From e8a2499d4ebcbcf1844c937283772a1a4cc5c20c Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Thu, 12 Mar 2026 09:40:16 +0000 Subject: [PATCH 15/19] ccm: Fixed a missing error flag assertion. In ccm_calculate_first_block_if_ready when using ccm tag_len==0 is invalid. When it fails, it will now also assert the CCM_STATE__ERROR in the state machine's context. Signed-off-by: Minos Galanakis --- library/ccm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/library/ccm.c b/library/ccm.c index 11d1051e98..6a4fbb0a0f 100644 --- a/library/ccm.c +++ b/library/ccm.c @@ -177,6 +177,7 @@ static int ccm_calculate_first_block_if_ready(mbedtls_ccm_context *ctx) ctx->plaintext_len = 0; return 0; } else { + ctx->state |= CCM_STATE__ERROR; return MBEDTLS_ERR_CCM_BAD_INPUT; } } From 5311a6e220fa288fb40339851a543acd723472d1 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Thu, 12 Mar 2026 11:32:51 +0000 Subject: [PATCH 16/19] Updated mbedtls_ccm_finish_boundary to handle zero len tags Signed-off-by: Minos Galanakis --- tests/suites/test_suite_ccm.data | 8 ++++++++ tests/suites/test_suite_ccm.function | 18 ++++++++++++++---- 2 files changed, 22 insertions(+), 4 deletions(-) diff --git a/tests/suites/test_suite_ccm.data b/tests/suites/test_suite_ccm.data index e03406ca4b..b1930de50f 100644 --- a/tests/suites/test_suite_ccm.data +++ b/tests/suites/test_suite_ccm.data @@ -1762,6 +1762,14 @@ CCM finish check-boundary decrypt tag_len=8, finish_tag_len=8 depends_on:MBEDTLS_CCM_GCM_CAN_AES mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_DECRYPT:8:8:0 +CCM finish check-boundary encrypt tag_len=0, finish_tag_len=0 +depends_on:MBEDTLS_CCM_GCM_CAN_AES +mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_ENCRYPT:0:0:MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED + +CCM finish check-boundary decrypt tag_len=0, finish_tag_len=0 +depends_on:MBEDTLS_CCM_GCM_CAN_AES +mbedtls_ccm_finish_boundary:MBEDTLS_CIPHER_ID_AES:MBEDTLS_CCM_DECRYPT:0:0:MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED + # CCM finish boundary matrix (encrypt) CCM finish check-boundary encrypt tag_len=16, finish_tag_len=16 depends_on:MBEDTLS_CCM_GCM_CAN_AES diff --git a/tests/suites/test_suite_ccm.function b/tests/suites/test_suite_ccm.function index 251eb350d4..dd4302209a 100644 --- a/tests/suites/test_suite_ccm.function +++ b/tests/suites/test_suite_ccm.function @@ -925,11 +925,21 @@ void mbedtls_ccm_finish_boundary(int cipher_id, int mode, BLOCK_CIPHER_PSA_INIT(); TEST_EQUAL(mbedtls_ccm_setkey(&ctx, cipher_id, key, sizeof(key) * 8), 0); - TEST_EQUAL(0, mbedtls_ccm_starts(&ctx, mode, iv, sizeof(iv))); - /* Use the caller-provided tag length during setup, then finish with a - * different tag length to exercise boundary handling/API compliance */ - TEST_EQUAL(0, mbedtls_ccm_set_lengths(&ctx, 0, 0, (size_t) start_tag_len)); + + /* For non-CCM* with tag_len=0, validate the mbedtls_ccm_set_lengths path + * when ccm_calculate_first_block_if_ready() fails. */ + if (start_tag_len == 0) { + TEST_EQUAL(0, mbedtls_ccm_set_lengths(&ctx, 0, 0, (size_t) start_tag_len)); + TEST_EQUAL(MBEDTLS_ERR_CCM_BAD_INPUT, + mbedtls_ccm_starts(&ctx, mode, iv, sizeof(iv))); + + /* Use the caller-provided tag length during setup, then finish with a + * different tag length to exercise boundary handling/API compliance */ + } else { + TEST_EQUAL(0, mbedtls_ccm_starts(&ctx, mode, iv, sizeof(iv))); + TEST_EQUAL(0, mbedtls_ccm_set_lengths(&ctx, 0, 0, (size_t) start_tag_len)); + } TEST_CALLOC(tag, finish_tag_len); TEST_EQUAL(expected_finish_ret, From fa284db5a1329e3fd43f39ed9a6d1b39712fbc73 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Thu, 12 Mar 2026 16:10:06 +0000 Subject: [PATCH 17/19] test_suite_psa_crypto: Updated multipart tests - Added checks for calling `finish()`, `verify()` after `set_len()` without calling `update()` & `update_ad()` Signed-off-by: Minos Galanakis --- tests/suites/test_suite_psa_crypto.function | 63 ++++++++++++++++++++- 1 file changed, 62 insertions(+), 1 deletion(-) diff --git a/tests/suites/test_suite_psa_crypto.function b/tests/suites/test_suite_psa_crypto.function index 04c24451c7..6c6cd6439f 100644 --- a/tests/suites/test_suite_psa_crypto.function +++ b/tests/suites/test_suite_psa_crypto.function @@ -6499,6 +6499,21 @@ void aead_multipart_state_test(int key_type_arg, data_t *key_data, PSA_ERROR_BAD_STATE); psa_aead_abort(&operation); + /* For CCM, finishing after setting length with aead_update/ad must fail. */ + PSA_ASSERT(psa_aead_encrypt_setup(&operation, key, alg)); + PSA_ASSERT(psa_aead_set_nonce(&operation, nonce->x, nonce->len)); + + PSA_ASSERT(psa_aead_set_lengths(&operation, additional_data->len, + input_data->len)); + TEST_EQUAL(psa_aead_finish(&operation, final_data, + finish_output_size, + &output_part_length, + tag_buffer, tag_length, + &tag_size), + PSA_ERROR_INVALID_ARGUMENT); + psa_aead_abort(&operation); + + /* Valid path */ PSA_ASSERT(psa_aead_encrypt_setup(&operation, key, alg)); PSA_ASSERT(psa_aead_set_nonce(&operation, nonce->x, nonce->len)); @@ -6529,6 +6544,21 @@ void aead_multipart_state_test(int key_type_arg, data_t *key_data, PSA_ERROR_BAD_STATE); psa_aead_abort(&operation); + /* For CCM, verifying after setting length with aead_update/ad must fail. */ + PSA_ASSERT(psa_aead_decrypt_setup(&operation, key, alg)); + PSA_ASSERT(psa_aead_set_nonce(&operation, nonce->x, nonce->len)); + + PSA_ASSERT(psa_aead_set_lengths(&operation, additional_data->len, + input_data->len)); + TEST_EQUAL(psa_aead_verify(&operation, final_data, + finish_output_size, + &output_part_length, + tag_buffer, + tag_length), + PSA_ERROR_INVALID_ARGUMENT); + psa_aead_abort(&operation); + + /* Valid path */ PSA_ASSERT(psa_aead_decrypt_setup(&operation, key, alg)); PSA_ASSERT(psa_aead_set_nonce(&operation, nonce->x, nonce->len)); @@ -6624,6 +6654,23 @@ void aead_multipart_state_test(int key_type_arg, data_t *key_data, PSA_ERROR_BAD_STATE); psa_aead_abort(&operation); + /* For CCM, finishing after setting length with aead_update/ad must fail. */ + PSA_ASSERT(psa_aead_encrypt_setup(&operation, key, alg)); + PSA_ASSERT(psa_aead_generate_nonce(&operation, nonce_buffer, + PSA_AEAD_NONCE_MAX_SIZE, + &nonce_length)); + + PSA_ASSERT(psa_aead_set_lengths(&operation, additional_data->len, + input_data->len)); + TEST_EQUAL(psa_aead_finish(&operation, final_data, + finish_output_size, + &output_part_length, + tag_buffer, tag_length, + &tag_size), + PSA_ERROR_INVALID_ARGUMENT); + psa_aead_abort(&operation); + + /* Valid path */ PSA_ASSERT(psa_aead_encrypt_setup(&operation, key, alg)); PSA_ASSERT(psa_aead_generate_nonce(&operation, nonce_buffer, PSA_AEAD_NONCE_MAX_SIZE, @@ -6643,8 +6690,8 @@ void aead_multipart_state_test(int key_type_arg, data_t *key_data, tag_buffer, tag_length, &tag_size), PSA_SUCCESS); - psa_aead_abort(&operation); + /* For CCM, verifying without setting lengths must fail. */ PSA_ASSERT(psa_aead_decrypt_setup(&operation, key, alg)); PSA_ASSERT(psa_aead_set_nonce(&operation, nonce->x, nonce->len)); @@ -6656,9 +6703,23 @@ void aead_multipart_state_test(int key_type_arg, data_t *key_data, PSA_ERROR_BAD_STATE); psa_aead_abort(&operation); + /* For CCM, verifying after setting length with aead_update/ad must fail. */ PSA_ASSERT(psa_aead_decrypt_setup(&operation, key, alg)); PSA_ASSERT(psa_aead_set_nonce(&operation, nonce->x, nonce->len)); + PSA_ASSERT(psa_aead_set_lengths(&operation, additional_data->len, + input_data->len)); + TEST_EQUAL(psa_aead_verify(&operation, final_data, + finish_output_size, + &output_part_length, + tag_buffer, + tag_length), + PSA_ERROR_INVALID_ARGUMENT); + psa_aead_abort(&operation); + + /* Valid path */ + PSA_ASSERT(psa_aead_decrypt_setup(&operation, key, alg)); + PSA_ASSERT(psa_aead_set_nonce(&operation, nonce->x, nonce->len)); PSA_ASSERT(psa_aead_set_lengths(&operation, additional_data->len, input_data->len)); PSA_ASSERT(psa_aead_update_ad(&operation, additional_data->x, From ebe26fd095aae9f80cc91f21c9e2dae0471f47d1 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Mon, 16 Mar 2026 11:52:50 +0000 Subject: [PATCH 18/19] test_suite_psa_crypto: Fixed a typo in documentation Signed-off-by: Minos Galanakis --- tests/suites/test_suite_psa_crypto.function | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tests/suites/test_suite_psa_crypto.function b/tests/suites/test_suite_psa_crypto.function index 6c6cd6439f..d13443f5b3 100644 --- a/tests/suites/test_suite_psa_crypto.function +++ b/tests/suites/test_suite_psa_crypto.function @@ -6499,7 +6499,7 @@ void aead_multipart_state_test(int key_type_arg, data_t *key_data, PSA_ERROR_BAD_STATE); psa_aead_abort(&operation); - /* For CCM, finishing after setting length with aead_update/ad must fail. */ + /* For CCM, finishing after setting length without aead_update/ad must fail. */ PSA_ASSERT(psa_aead_encrypt_setup(&operation, key, alg)); PSA_ASSERT(psa_aead_set_nonce(&operation, nonce->x, nonce->len)); @@ -6544,7 +6544,7 @@ void aead_multipart_state_test(int key_type_arg, data_t *key_data, PSA_ERROR_BAD_STATE); psa_aead_abort(&operation); - /* For CCM, verifying after setting length with aead_update/ad must fail. */ + /* For CCM, verifying after setting length without aead_update/ad must fail. */ PSA_ASSERT(psa_aead_decrypt_setup(&operation, key, alg)); PSA_ASSERT(psa_aead_set_nonce(&operation, nonce->x, nonce->len)); @@ -6654,7 +6654,7 @@ void aead_multipart_state_test(int key_type_arg, data_t *key_data, PSA_ERROR_BAD_STATE); psa_aead_abort(&operation); - /* For CCM, finishing after setting length with aead_update/ad must fail. */ + /* For CCM, finishing after setting length without aead_update/ad must fail. */ PSA_ASSERT(psa_aead_encrypt_setup(&operation, key, alg)); PSA_ASSERT(psa_aead_generate_nonce(&operation, nonce_buffer, PSA_AEAD_NONCE_MAX_SIZE, @@ -6703,7 +6703,7 @@ void aead_multipart_state_test(int key_type_arg, data_t *key_data, PSA_ERROR_BAD_STATE); psa_aead_abort(&operation); - /* For CCM, verifying after setting length with aead_update/ad must fail. */ + /* For CCM, verifying after setting length without aead_update/ad must fail. */ PSA_ASSERT(psa_aead_decrypt_setup(&operation, key, alg)); PSA_ASSERT(psa_aead_set_nonce(&operation, nonce->x, nonce->len)); From 73c6d6d3e9b3169b39f11414fb6503b33c53f223 Mon Sep 17 00:00:00 2001 From: Minos Galanakis Date: Tue, 17 Mar 2026 11:42:42 +0000 Subject: [PATCH 19/19] test_suite_ccm: Added error.h Signed-off-by: Minos Galanakis --- tests/suites/test_suite_ccm.function | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/suites/test_suite_ccm.function b/tests/suites/test_suite_ccm.function index dd4302209a..75585f085b 100644 --- a/tests/suites/test_suite_ccm.function +++ b/tests/suites/test_suite_ccm.function @@ -1,5 +1,6 @@ /* BEGIN_HEADER */ #include "mbedtls/ccm.h" +#include "mbedtls/error.h" /* Use the multipart interface to process the encrypted data in two parts * and check that the output matches the expected output.