diff --git a/.gitmodules b/.gitmodules index 4612b3d0c9..24c7a08b00 100644 --- a/.gitmodules +++ b/.gitmodules @@ -3,4 +3,4 @@ url = https://github.com/Mbed-TLS/mbedtls-framework [submodule "tf-psa-crypto"] path = tf-psa-crypto - url = https://github.com/Mbed-TLS/TF-PSA-Crypto.git + url = https://gitlab.espressif.cn:6688/espressif/TF-PSA-Crypto diff --git a/library/.gitignore b/library/.gitignore index 92a33de2bc..0df1b6bf2f 100644 --- a/library/.gitignore +++ b/library/.gitignore @@ -3,10 +3,10 @@ libmbed* *.vcxproj ###START_GENERATED_FILES### -/error.c -/mbedtls_config_check_before.h -/mbedtls_config_check_final.h -/mbedtls_config_check_user.h -/version_features.c -/ssl_debug_helpers_generated.c +#/error.c +#/mbedtls_config_check_before.h +#/mbedtls_config_check_final.h +#/mbedtls_config_check_user.h +#/version_features.c +#/ssl_debug_helpers_generated.c ###END_GENERATED_FILES### diff --git a/library/error.c b/library/error.c new file mode 100644 index 0000000000..c5b0f5c764 --- /dev/null +++ b/library/error.c @@ -0,0 +1,509 @@ +/* + * Error message information + * + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#include "tf_psa_crypto_common.h" + +#include "mbedtls/error.h" + +#if defined(MBEDTLS_ERROR_C) || defined(MBEDTLS_ERROR_STRERROR_DUMMY) + +#if defined(MBEDTLS_ERROR_C) + +#include "mbedtls/platform.h" + +#include +#include + +#if defined(MBEDTLS_NET_C) +#include "mbedtls/net_sockets.h" +#endif + +#if defined(MBEDTLS_PKCS7_C) +#include "mbedtls/pkcs7.h" +#endif + +#if defined(MBEDTLS_SSL_TLS_C) +#include "mbedtls/ssl.h" +#endif + +#if defined(MBEDTLS_X509_USE_C) || \ + defined(MBEDTLS_X509_CREATE_C) +#include "mbedtls/x509.h" +#endif + +#if defined(MBEDTLS_AES_C) +#include "mbedtls/private/aes.h" +#endif + +#if defined(MBEDTLS_ARIA_C) +#include "mbedtls/private/aria.h" +#endif + +#if defined(MBEDTLS_BIGNUM_C) +#include "mbedtls/private/bignum.h" +#endif + +#if defined(MBEDTLS_CAMELLIA_C) +#include "mbedtls/private/camellia.h" +#endif + +#if defined(MBEDTLS_CHACHAPOLY_C) +#include "mbedtls/private/chachapoly.h" +#endif + +#if defined(MBEDTLS_CIPHER_C) +#include "mbedtls/private/cipher.h" +#endif + +#if defined(MBEDTLS_CTR_DRBG_C) +#include "mbedtls/private/ctr_drbg.h" +#endif + +#if defined(MBEDTLS_ECP_C) +#include "mbedtls/private/ecp.h" +#endif + +#if defined(MBEDTLS_ENTROPY_C) +#include "mbedtls/private/entropy.h" +#endif + +#if defined(MBEDTLS_HMAC_DRBG_C) +#include "mbedtls/private/hmac_drbg.h" +#endif + +#if defined(MBEDTLS_PKCS5_C) +#include "mbedtls/private/pkcs5.h" +#endif + +#if defined(MBEDTLS_RSA_C) +#include "mbedtls/private/rsa.h" +#endif + + +static const char *mbedtls_high_level_strerr(int error_code) +{ + int high_level_error_code; + + if (error_code < 0) { + error_code = -error_code; + } + + /* Extract the high-level part from the error code. */ + high_level_error_code = error_code & 0xFF80; + + switch (high_level_error_code) { + /* Begin Auto-Generated Code. */ +#if defined(MBEDTLS_PKCS7_C) + case -(MBEDTLS_ERR_PKCS7_INVALID_FORMAT): + return( "PKCS7 - The format is invalid, e.g. different type expected" ); + case -(MBEDTLS_ERR_PKCS7_FEATURE_UNAVAILABLE): + return( "PKCS7 - Unavailable feature, e.g. anything other than signed data" ); + case -(MBEDTLS_ERR_PKCS7_INVALID_VERSION): + return( "PKCS7 - The PKCS #7 version element is invalid or cannot be parsed" ); + case -(MBEDTLS_ERR_PKCS7_INVALID_CONTENT_INFO): + return( "PKCS7 - The PKCS #7 content info is invalid or cannot be parsed" ); + case -(MBEDTLS_ERR_PKCS7_INVALID_ALG): + return( "PKCS7 - The algorithm tag or value is invalid or cannot be parsed" ); + case -(MBEDTLS_ERR_PKCS7_INVALID_CERT): + return( "PKCS7 - The certificate tag or value is invalid or cannot be parsed" ); + case -(MBEDTLS_ERR_PKCS7_INVALID_SIGNATURE): + return( "PKCS7 - Error parsing the signature" ); + case -(MBEDTLS_ERR_PKCS7_INVALID_SIGNER_INFO): + return( "PKCS7 - Error parsing the signer's info" ); + case -(MBEDTLS_ERR_PKCS7_CERT_DATE_INVALID): + return( "PKCS7 - The PKCS #7 date issued/expired dates are invalid" ); +#endif /* MBEDTLS_PKCS7_C */ + +#if defined(MBEDTLS_SSL_TLS_C) + case -(MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS): + return( "SSL - A cryptographic operation is in progress. Try again later" ); + case -(MBEDTLS_ERR_SSL_FEATURE_UNAVAILABLE): + return( "SSL - The requested feature is not available" ); + case -(MBEDTLS_ERR_SSL_INVALID_MAC): + return( "SSL - Verification of the message MAC failed" ); + case -(MBEDTLS_ERR_SSL_INVALID_RECORD): + return( "SSL - An invalid SSL record was received" ); + case -(MBEDTLS_ERR_SSL_CONN_EOF): + return( "SSL - The connection indicated an EOF" ); + case -(MBEDTLS_ERR_SSL_DECODE_ERROR): + return( "SSL - A message could not be parsed due to a syntactic error" ); + case -(MBEDTLS_ERR_SSL_NO_RNG): + return( "SSL - No RNG was provided to the SSL module" ); + case -(MBEDTLS_ERR_SSL_NO_CLIENT_CERTIFICATE): + return( "SSL - No client certification received from the client, but required by the authentication mode" ); + case -(MBEDTLS_ERR_SSL_UNSUPPORTED_EXTENSION): + return( "SSL - Client received an extended server hello containing an unsupported extension" ); + case -(MBEDTLS_ERR_SSL_NO_APPLICATION_PROTOCOL): + return( "SSL - No ALPN protocols supported that the client advertises" ); + case -(MBEDTLS_ERR_SSL_PRIVATE_KEY_REQUIRED): + return( "SSL - The own private key or pre-shared key is not set, but needed" ); + case -(MBEDTLS_ERR_SSL_CA_CHAIN_REQUIRED): + return( "SSL - No CA Chain is set, but required to operate" ); + case -(MBEDTLS_ERR_SSL_UNEXPECTED_MESSAGE): + return( "SSL - An unexpected message was received from our peer" ); + case -(MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE): + return( "SSL - A fatal alert message was received from our peer" ); + case -(MBEDTLS_ERR_SSL_UNRECOGNIZED_NAME): + return( "SSL - No server could be identified matching the client's SNI" ); + case -(MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY): + return( "SSL - The peer notified us that the connection is going to be closed" ); + case -(MBEDTLS_ERR_SSL_BAD_CERTIFICATE): + return( "SSL - Processing of the Certificate handshake message failed" ); + case -(MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET): + return( "SSL - * Received NewSessionTicket Post Handshake Message. This error code is experimental and may be changed or removed without notice" ); + case -(MBEDTLS_ERR_SSL_CANNOT_READ_EARLY_DATA): + return( "SSL - Not possible to read early data" ); + case -(MBEDTLS_ERR_SSL_RECEIVED_EARLY_DATA): + return( "SSL - * Early data has been received as part of an on-going handshake. This error code can be returned only on server side if and only if early data has been enabled by means of the mbedtls_ssl_conf_early_data() API. This error code can then be returned by mbedtls_ssl_handshake(), mbedtls_ssl_handshake_step(), mbedtls_ssl_read() or mbedtls_ssl_write() if early data has been received as part of the handshake sequence they triggered. To read the early data, call mbedtls_ssl_read_early_data()" ); + case -(MBEDTLS_ERR_SSL_CANNOT_WRITE_EARLY_DATA): + return( "SSL - Not possible to write early data" ); + case -(MBEDTLS_ERR_SSL_CACHE_ENTRY_NOT_FOUND): + return( "SSL - Cache entry not found" ); + case -(MBEDTLS_ERR_SSL_HW_ACCEL_FAILED): + return( "SSL - Hardware acceleration function returned with error" ); + case -(MBEDTLS_ERR_SSL_HW_ACCEL_FALLTHROUGH): + return( "SSL - Hardware acceleration function skipped / left alone data" ); + case -(MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION): + return( "SSL - Handshake protocol not within min/max boundaries" ); + case -(MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE): + return( "SSL - The handshake negotiation failed" ); + case -(MBEDTLS_ERR_SSL_SESSION_TICKET_EXPIRED): + return( "SSL - Session ticket has expired" ); + case -(MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH): + return( "SSL - Public key type mismatch (eg, asked for RSA key exchange and presented EC key)" ); + case -(MBEDTLS_ERR_SSL_UNKNOWN_IDENTITY): + return( "SSL - Unknown identity received (eg, PSK identity)" ); + case -(MBEDTLS_ERR_SSL_INTERNAL_ERROR): + return( "SSL - Internal error (eg, unexpected failure in lower-level module)" ); + case -(MBEDTLS_ERR_SSL_COUNTER_WRAPPING): + return( "SSL - A counter would wrap (eg, too many messages exchanged)" ); + case -(MBEDTLS_ERR_SSL_WAITING_SERVER_HELLO_RENEGO): + return( "SSL - Unexpected message at ServerHello in renegotiation" ); + case -(MBEDTLS_ERR_SSL_HELLO_VERIFY_REQUIRED): + return( "SSL - DTLS client must retry for hello verification" ); + case -(MBEDTLS_ERR_SSL_WANT_READ): + return( "SSL - No data of requested type currently available on underlying transport" ); + case -(MBEDTLS_ERR_SSL_WANT_WRITE): + return( "SSL - Connection requires a write call" ); + case -(MBEDTLS_ERR_SSL_TIMEOUT): + return( "SSL - The operation timed out" ); + case -(MBEDTLS_ERR_SSL_CLIENT_RECONNECT): + return( "SSL - The client initiated a reconnect from the same port" ); + case -(MBEDTLS_ERR_SSL_UNEXPECTED_RECORD): + return( "SSL - Record header looks valid but is not expected" ); + case -(MBEDTLS_ERR_SSL_NON_FATAL): + return( "SSL - The alert message received indicates a non-fatal error" ); + case -(MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER): + return( "SSL - A field in a message was incorrect or inconsistent with other fields" ); + case -(MBEDTLS_ERR_SSL_CONTINUE_PROCESSING): + return( "SSL - Internal-only message signaling that further message-processing should be done" ); + case -(MBEDTLS_ERR_SSL_ASYNC_IN_PROGRESS): + return( "SSL - The asynchronous operation is not completed yet" ); + case -(MBEDTLS_ERR_SSL_EARLY_MESSAGE): + return( "SSL - Internal-only message signaling that a message arrived early" ); + case -(MBEDTLS_ERR_SSL_UNEXPECTED_CID): + return( "SSL - An encrypted DTLS-frame with an unexpected CID was received" ); + case -(MBEDTLS_ERR_SSL_VERSION_MISMATCH): + return( "SSL - An operation failed due to an unexpected version or configuration" ); + case -(MBEDTLS_ERR_SSL_BAD_CONFIG): + return( "SSL - Invalid value in SSL config" ); + case -(MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME): + return( "SSL - Attempt to verify a certificate without an expected hostname. This is usually insecure. In TLS clients, when a client authenticates a server through its certificate, the client normally checks three things: - the certificate chain must be valid; - the chain must start from a trusted CA; - the certificate must cover the server name that is expected by the client. Omitting any of these checks is generally insecure, and can allow a malicious server to impersonate a legitimate server. The third check may be safely skipped in some unusual scenarios, such as networks where eavesdropping is a risk but not active attacks, or a private PKI where the client equally trusts all servers that are accredited by the root CA. You should call mbedtls_ssl_set_hostname() with the expected server name before starting a TLS handshake on a client (unless the client is set up to only use PSK-based authentication, which does not rely on the host name). If you have determined that server name verification is not required for security in your scenario, call mbedtls_ssl_set_hostname() with \\p NULL as the server name. This error is raised if all of the following conditions are met: - A TLS client is configured with the authentication mode #MBEDTLS_SSL_VERIFY_REQUIRED (default). - Certificate authentication is enabled. - The client does not call mbedtls_ssl_set_hostname()" ); +#endif /* MBEDTLS_SSL_TLS_C */ + +#if defined(MBEDTLS_X509_USE_C) || \ + defined(MBEDTLS_X509_CREATE_C) + case -(MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE): + return( "X509 - Unavailable feature, e.g. RSA hashing/encryption combination" ); + case -(MBEDTLS_ERR_X509_UNKNOWN_OID): + return( "X509 - Requested OID is unknown" ); + case -(MBEDTLS_ERR_X509_INVALID_FORMAT): + return( "X509 - The CRT/CRL/CSR format is invalid, e.g. different type expected" ); + case -(MBEDTLS_ERR_X509_INVALID_VERSION): + return( "X509 - The CRT/CRL/CSR version element is invalid" ); + case -(MBEDTLS_ERR_X509_INVALID_SERIAL): + return( "X509 - The serial tag or value is invalid" ); + case -(MBEDTLS_ERR_X509_INVALID_ALG): + return( "X509 - The algorithm tag or value is invalid" ); + case -(MBEDTLS_ERR_X509_INVALID_NAME): + return( "X509 - The name tag or value is invalid" ); + case -(MBEDTLS_ERR_X509_INVALID_DATE): + return( "X509 - The date tag or value is invalid" ); + case -(MBEDTLS_ERR_X509_INVALID_SIGNATURE): + return( "X509 - The signature tag or value invalid" ); + case -(MBEDTLS_ERR_X509_INVALID_EXTENSIONS): + return( "X509 - The extension tag or value is invalid" ); + case -(MBEDTLS_ERR_X509_UNKNOWN_VERSION): + return( "X509 - CRT/CRL/CSR has an unsupported version number" ); + case -(MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG): + return( "X509 - Signature algorithm (oid) is unsupported" ); + case -(MBEDTLS_ERR_X509_SIG_MISMATCH): + return( "X509 - Signature algorithms do not match. (see \\c ::mbedtls_x509_crt sig_oid)" ); + case -(MBEDTLS_ERR_X509_CERT_VERIFY_FAILED): + return( "X509 - Certificate verification failed, e.g. CRL, CA or signature check failed" ); + case -(MBEDTLS_ERR_X509_CERT_UNKNOWN_FORMAT): + return( "X509 - Format not recognized as DER or PEM" ); + case -(MBEDTLS_ERR_X509_BAD_INPUT_DATA): + return( "X509 - Input invalid" ); + case -(MBEDTLS_ERR_X509_FILE_IO_ERROR): + return( "X509 - Read/write of file failed" ); + case -(MBEDTLS_ERR_X509_FATAL_ERROR): + return( "X509 - A fatal error occurred, eg the chain is too long or the vrfy callback failed" ); +#endif /* MBEDTLS_X509_USE_C || + MBEDTLS_X509_CREATE_C */ + +#if defined(MBEDTLS_CIPHER_C) + case -(MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE): + return( "CIPHER - The selected feature is not available" ); + case -(MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED): + return( "CIPHER - Decryption of block requires a full block" ); + case -(MBEDTLS_ERR_CIPHER_INVALID_CONTEXT): + return( "CIPHER - The context is invalid. For example, because it was freed" ); +#endif /* MBEDTLS_CIPHER_C */ + +#if defined(MBEDTLS_ECP_C) + case -(MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE): + return( "ECP - The requested feature is not available, for example, the requested curve is not supported" ); + case -(MBEDTLS_ERR_ECP_RANDOM_FAILED): + return( "ECP - Generation of random value, such as ephemeral key, failed" ); + case -(MBEDTLS_ERR_ECP_INVALID_KEY): + return( "ECP - Invalid private or public key" ); +#endif /* MBEDTLS_ECP_C */ + +#if defined(MBEDTLS_PKCS5_C) + case -(MBEDTLS_ERR_PKCS5_INVALID_FORMAT): + return( "PKCS5 - Unexpected ASN.1 data" ); + case -(MBEDTLS_ERR_PKCS5_FEATURE_UNAVAILABLE): + return( "PKCS5 - Requested encryption or digest alg not available" ); + case -(MBEDTLS_ERR_PKCS5_PASSWORD_MISMATCH): + return( "PKCS5 - Given private key password does not allow for correct decryption" ); +#endif /* MBEDTLS_PKCS5_C */ + +#if defined(MBEDTLS_RSA_C) + case -(MBEDTLS_ERR_RSA_KEY_GEN_FAILED): + return( "RSA - Something failed during generation of a key" ); + case -(MBEDTLS_ERR_RSA_KEY_CHECK_FAILED): + return( "RSA - Key failed to pass the validity check of the library" ); + case -(MBEDTLS_ERR_RSA_PUBLIC_FAILED): + return( "RSA - The public key operation failed" ); + case -(MBEDTLS_ERR_RSA_PRIVATE_FAILED): + return( "RSA - The private key operation failed" ); + case -(MBEDTLS_ERR_RSA_RNG_FAILED): + return( "RSA - The random generator failed to generate non-zeros" ); +#endif /* MBEDTLS_RSA_C */ + /* End Auto-Generated Code. */ + + default: + break; + } + + return NULL; +} + +static const char *mbedtls_low_level_strerr(int error_code) +{ + int low_level_error_code; + + if (error_code < 0) { + error_code = -error_code; + } + + /* Extract the low-level part from the error code. */ + low_level_error_code = error_code & ~0xFF80; + + switch (low_level_error_code) { + /* Begin Auto-Generated Code. */ +#if defined(MBEDTLS_NET_C) + case -(MBEDTLS_ERR_NET_SOCKET_FAILED): + return( "NET - Failed to open a socket" ); + case -(MBEDTLS_ERR_NET_CONNECT_FAILED): + return( "NET - The connection to the given server / port failed" ); + case -(MBEDTLS_ERR_NET_BIND_FAILED): + return( "NET - Binding of the socket failed" ); + case -(MBEDTLS_ERR_NET_LISTEN_FAILED): + return( "NET - Could not listen on the socket" ); + case -(MBEDTLS_ERR_NET_ACCEPT_FAILED): + return( "NET - Could not accept the incoming connection" ); + case -(MBEDTLS_ERR_NET_RECV_FAILED): + return( "NET - Reading information from the socket failed" ); + case -(MBEDTLS_ERR_NET_SEND_FAILED): + return( "NET - Sending information through the socket failed" ); + case -(MBEDTLS_ERR_NET_CONN_RESET): + return( "NET - Connection was reset by peer" ); + case -(MBEDTLS_ERR_NET_UNKNOWN_HOST): + return( "NET - Failed to get an IP address for the given hostname" ); + case -(MBEDTLS_ERR_NET_INVALID_CONTEXT): + return( "NET - The context is invalid, eg because it was free()ed" ); + case -(MBEDTLS_ERR_NET_POLL_FAILED): + return( "NET - Polling the net context failed" ); + case -(MBEDTLS_ERR_NET_BAD_INPUT_DATA): + return( "NET - Input invalid" ); +#endif /* MBEDTLS_NET_C */ + +#if defined(MBEDTLS_AES_C) + case -(MBEDTLS_ERR_AES_INVALID_KEY_LENGTH): + return( "AES - Invalid key length" ); + case -(MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH): + return( "AES - Invalid data input length" ); +#endif /* MBEDTLS_AES_C */ + +#if defined(MBEDTLS_ARIA_C) + case -(MBEDTLS_ERR_ARIA_INVALID_INPUT_LENGTH): + return( "ARIA - Invalid data input length" ); +#endif /* MBEDTLS_ARIA_C */ + +#if defined(MBEDTLS_BIGNUM_C) + case -(MBEDTLS_ERR_MPI_FILE_IO_ERROR): + return( "BIGNUM - An error occurred while reading from or writing to a file" ); + case -(MBEDTLS_ERR_MPI_INVALID_CHARACTER): + return( "BIGNUM - There is an invalid character in the digit string" ); + case -(MBEDTLS_ERR_MPI_NEGATIVE_VALUE): + return( "BIGNUM - The input arguments are negative or result in illegal output" ); + case -(MBEDTLS_ERR_MPI_DIVISION_BY_ZERO): + return( "BIGNUM - The input argument for division is zero, which is not allowed" ); + case -(MBEDTLS_ERR_MPI_NOT_ACCEPTABLE): + return( "BIGNUM - The input arguments are not acceptable" ); +#endif /* MBEDTLS_BIGNUM_C */ + +#if defined(MBEDTLS_CAMELLIA_C) + case -(MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH): + return( "CAMELLIA - Invalid data input length" ); +#endif /* MBEDTLS_CAMELLIA_C */ + +#if defined(MBEDTLS_CHACHAPOLY_C) + case -(MBEDTLS_ERR_CHACHAPOLY_BAD_STATE): + return( "CHACHAPOLY - The requested operation is not permitted in the current state" ); +#endif /* MBEDTLS_CHACHAPOLY_C */ + +#if defined(MBEDTLS_CTR_DRBG_C) + case -(MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED): + return( "CTR_DRBG - The entropy source failed" ); + case -(MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG): + return( "CTR_DRBG - The requested random buffer length is too big" ); + case -(MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG): + return( "CTR_DRBG - The input (entropy + additional data) is too large" ); + case -(MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR): + return( "CTR_DRBG - Read or write error in file" ); +#endif /* MBEDTLS_CTR_DRBG_C */ + +#if defined(MBEDTLS_ENTROPY_C) + case -(MBEDTLS_ERR_ENTROPY_MAX_SOURCES): + return( "ENTROPY - No more sources can be added" ); + case -(MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED): + return( "ENTROPY - No sources have been added to poll" ); + case -(MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE): + return( "ENTROPY - No strong sources have been added to poll" ); + case -(MBEDTLS_ERR_ENTROPY_FILE_IO_ERROR): + return( "ENTROPY - Read/write error in file" ); +#endif /* MBEDTLS_ENTROPY_C */ + +#if defined(MBEDTLS_HMAC_DRBG_C) + case -(MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG): + return( "HMAC_DRBG - Too many random requested in single call" ); + case -(MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG): + return( "HMAC_DRBG - Input too large (Entropy + additional)" ); + case -(MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR): + return( "HMAC_DRBG - Read/write error in file" ); + case -(MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED): + return( "HMAC_DRBG - The entropy source failed" ); +#endif /* MBEDTLS_HMAC_DRBG_C */ + /* End Auto-Generated Code. */ + + default: + break; + } + + return NULL; +} + +void mbedtls_strerror(int ret, char *buf, size_t buflen) +{ + size_t len; + int use_ret; + const char *high_level_error_description = NULL; + const char *low_level_error_description = NULL; + + if (buflen == 0) { + return; + } + + memset(buf, 0x00, buflen); + + if (ret < 0) { + ret = -ret; + } + + if (ret & 0xFF80) { + use_ret = ret & 0xFF80; + + // Translate high level error code. + high_level_error_description = mbedtls_high_level_strerr(ret); + + if (high_level_error_description == NULL) { + mbedtls_snprintf(buf, buflen, "UNKNOWN ERROR CODE (%04X)", (unsigned int) use_ret); + } else { + mbedtls_snprintf(buf, buflen, "%s", high_level_error_description); + } + +#if defined(MBEDTLS_SSL_TLS_C) + // Early return in case of a fatal error - do not try to translate low + // level code. + if (use_ret == -(MBEDTLS_ERR_SSL_FATAL_ALERT_MESSAGE)) { + return; + } +#endif /* MBEDTLS_SSL_TLS_C */ + } + + use_ret = ret & ~0xFF80; + + if (use_ret == 0) { + return; + } + + // If high level code is present, make a concatenation between both + // error strings. + // + len = strlen(buf); + + if (len > 0) { + if (buflen - len < 5) { + return; + } + + mbedtls_snprintf(buf + len, buflen - len, " : "); + + buf += len + 3; + buflen -= len + 3; + } + + // Translate low level error code. + low_level_error_description = mbedtls_low_level_strerr(ret); + + if (low_level_error_description == NULL) { + mbedtls_snprintf(buf, buflen, "UNKNOWN ERROR CODE (%04X)", (unsigned int) use_ret); + } else { + mbedtls_snprintf(buf, buflen, "%s", low_level_error_description); + } +} + +#else /* MBEDTLS_ERROR_C */ + +/* + * Provide a dummy implementation when MBEDTLS_ERROR_C is not defined + */ +void mbedtls_strerror(int ret, char *buf, size_t buflen) +{ + ((void) ret); + + if (buflen > 0) { + buf[0] = '\0'; + } +} + +#endif /* MBEDTLS_ERROR_C */ + +#endif /* MBEDTLS_ERROR_C || MBEDTLS_ERROR_STRERROR_DUMMY */ diff --git a/library/mbedtls_config_check_before.h b/library/mbedtls_config_check_before.h new file mode 100644 index 0000000000..f065253133 --- /dev/null +++ b/library/mbedtls_config_check_before.h @@ -0,0 +1,1846 @@ +/* mbedtls_config_check_before.h (generated part of mbedtls_config.c). */ +/* Automatically generated by generate_config_checks.py. Do not edit! */ + +#if !defined(MBEDTLS_CONFIG_CHECK_BYPASS) //no-check-names + +/* *INDENT-OFF* */ + +#if defined(MBEDTLS_AESCE_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AESCE_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AESCE_C 0 +#endif +#undef MBEDTLS_AESCE_C + +#if defined(MBEDTLS_AESNI_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AESNI_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AESNI_C 0 +#endif +#undef MBEDTLS_AESNI_C + +#if defined(MBEDTLS_AES_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AES_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AES_C 0 +#endif +#undef MBEDTLS_AES_C + +#if defined(MBEDTLS_AES_FEWER_TABLES) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AES_FEWER_TABLES 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AES_FEWER_TABLES 0 +#endif +#undef MBEDTLS_AES_FEWER_TABLES + +#if defined(MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH 0 +#endif +#undef MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH + +#if defined(MBEDTLS_AES_ROM_TABLES) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AES_ROM_TABLES 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AES_ROM_TABLES 0 +#endif +#undef MBEDTLS_AES_ROM_TABLES + +#if defined(MBEDTLS_AES_USE_HARDWARE_ONLY) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AES_USE_HARDWARE_ONLY 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AES_USE_HARDWARE_ONLY 0 +#endif +#undef MBEDTLS_AES_USE_HARDWARE_ONLY + +#if defined(MBEDTLS_ARIA_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ARIA_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ARIA_C 0 +#endif +#undef MBEDTLS_ARIA_C + +#if defined(MBEDTLS_ASN1_PARSE_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ASN1_PARSE_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ASN1_PARSE_C 0 +#endif +#undef MBEDTLS_ASN1_PARSE_C + +#if defined(MBEDTLS_ASN1_WRITE_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ASN1_WRITE_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ASN1_WRITE_C 0 +#endif +#undef MBEDTLS_ASN1_WRITE_C + +#if defined(MBEDTLS_BASE64_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_BASE64_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_BASE64_C 0 +#endif +#undef MBEDTLS_BASE64_C + +#if defined(MBEDTLS_BIGNUM_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_BIGNUM_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_BIGNUM_C 0 +#endif +#undef MBEDTLS_BIGNUM_C + +#if defined(MBEDTLS_BLOCK_CIPHER_NO_DECRYPT) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_BLOCK_CIPHER_NO_DECRYPT 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_BLOCK_CIPHER_NO_DECRYPT 0 +#endif +#undef MBEDTLS_BLOCK_CIPHER_NO_DECRYPT + +#if defined(MBEDTLS_CAMELLIA_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CAMELLIA_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CAMELLIA_C 0 +#endif +#undef MBEDTLS_CAMELLIA_C + +#if defined(MBEDTLS_CAMELLIA_SMALL_MEMORY) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CAMELLIA_SMALL_MEMORY 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CAMELLIA_SMALL_MEMORY 0 +#endif +#undef MBEDTLS_CAMELLIA_SMALL_MEMORY + +#if defined(MBEDTLS_CCM_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CCM_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CCM_C 0 +#endif +#undef MBEDTLS_CCM_C + +#if defined(MBEDTLS_CHACHA20_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CHACHA20_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CHACHA20_C 0 +#endif +#undef MBEDTLS_CHACHA20_C + +#if defined(MBEDTLS_CHACHAPOLY_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CHACHAPOLY_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CHACHAPOLY_C 0 +#endif +#undef MBEDTLS_CHACHAPOLY_C + +#if defined(MBEDTLS_CHECK_RETURN) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CHECK_RETURN 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CHECK_RETURN 0 +#endif +#undef MBEDTLS_CHECK_RETURN + +#if defined(MBEDTLS_CHECK_RETURN_WARNING) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CHECK_RETURN_WARNING 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CHECK_RETURN_WARNING 0 +#endif +#undef MBEDTLS_CHECK_RETURN_WARNING + +#if defined(MBEDTLS_CIPHER_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_C 0 +#endif +#undef MBEDTLS_CIPHER_C + +#if defined(MBEDTLS_CIPHER_MODE_CBC) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_MODE_CBC 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_MODE_CBC 0 +#endif +#undef MBEDTLS_CIPHER_MODE_CBC + +#if defined(MBEDTLS_CIPHER_MODE_CFB) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_MODE_CFB 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_MODE_CFB 0 +#endif +#undef MBEDTLS_CIPHER_MODE_CFB + +#if defined(MBEDTLS_CIPHER_MODE_CTR) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_MODE_CTR 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_MODE_CTR 0 +#endif +#undef MBEDTLS_CIPHER_MODE_CTR + +#if defined(MBEDTLS_CIPHER_MODE_OFB) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_MODE_OFB 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_MODE_OFB 0 +#endif +#undef MBEDTLS_CIPHER_MODE_OFB + +#if defined(MBEDTLS_CIPHER_MODE_XTS) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_MODE_XTS 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_MODE_XTS 0 +#endif +#undef MBEDTLS_CIPHER_MODE_XTS + +#if defined(MBEDTLS_CIPHER_NULL_CIPHER) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_NULL_CIPHER 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_NULL_CIPHER 0 +#endif +#undef MBEDTLS_CIPHER_NULL_CIPHER + +#if defined(MBEDTLS_CIPHER_PADDING_PKCS7) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_PADDING_PKCS7 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_PADDING_PKCS7 0 +#endif +#undef MBEDTLS_CIPHER_PADDING_PKCS7 + +#if defined(MBEDTLS_CMAC_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CMAC_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CMAC_C 0 +#endif +#undef MBEDTLS_CMAC_C + +#if defined(MBEDTLS_CTR_DRBG_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CTR_DRBG_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CTR_DRBG_C 0 +#endif +#undef MBEDTLS_CTR_DRBG_C + +#if defined(MBEDTLS_DEPRECATED_REMOVED) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_DEPRECATED_REMOVED 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_DEPRECATED_REMOVED 0 +#endif +#undef MBEDTLS_DEPRECATED_REMOVED + +#if defined(MBEDTLS_DEPRECATED_WARNING) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_DEPRECATED_WARNING 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_DEPRECATED_WARNING 0 +#endif +#undef MBEDTLS_DEPRECATED_WARNING + +#if defined(MBEDTLS_DES_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_DES_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_DES_C 0 +#endif +#undef MBEDTLS_DES_C + +#if defined(MBEDTLS_ECDH_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECDH_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECDH_C 0 +#endif +#undef MBEDTLS_ECDH_C + +#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED 0 +#endif +#undef MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED + +#if defined(MBEDTLS_ECDSA_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECDSA_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECDSA_C 0 +#endif +#undef MBEDTLS_ECDSA_C + +#if defined(MBEDTLS_ECDSA_DETERMINISTIC) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECDSA_DETERMINISTIC 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECDSA_DETERMINISTIC 0 +#endif +#undef MBEDTLS_ECDSA_DETERMINISTIC + +#if defined(MBEDTLS_ECJPAKE_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECJPAKE_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECJPAKE_C 0 +#endif +#undef MBEDTLS_ECJPAKE_C + +#if defined(MBEDTLS_ECP_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_C 0 +#endif +#undef MBEDTLS_ECP_C + +#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_BP256R1_ENABLED 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_BP256R1_ENABLED 0 +#endif +#undef MBEDTLS_ECP_DP_BP256R1_ENABLED + +#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_BP384R1_ENABLED 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_BP384R1_ENABLED 0 +#endif +#undef MBEDTLS_ECP_DP_BP384R1_ENABLED + +#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_BP512R1_ENABLED 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_BP512R1_ENABLED 0 +#endif +#undef MBEDTLS_ECP_DP_BP512R1_ENABLED + +#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_CURVE25519_ENABLED 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_CURVE25519_ENABLED 0 +#endif +#undef MBEDTLS_ECP_DP_CURVE25519_ENABLED + +#if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_CURVE448_ENABLED 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_CURVE448_ENABLED 0 +#endif +#undef MBEDTLS_ECP_DP_CURVE448_ENABLED + +#if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_SECP192K1_ENABLED 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_SECP192K1_ENABLED 0 +#endif +#undef MBEDTLS_ECP_DP_SECP192K1_ENABLED + +#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_SECP192R1_ENABLED 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_SECP192R1_ENABLED 0 +#endif +#undef MBEDTLS_ECP_DP_SECP192R1_ENABLED + +#if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_SECP256K1_ENABLED 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_SECP256K1_ENABLED 0 +#endif +#undef MBEDTLS_ECP_DP_SECP256K1_ENABLED + +#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_SECP256R1_ENABLED 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_SECP256R1_ENABLED 0 +#endif +#undef MBEDTLS_ECP_DP_SECP256R1_ENABLED + +#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_SECP384R1_ENABLED 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_SECP384R1_ENABLED 0 +#endif +#undef MBEDTLS_ECP_DP_SECP384R1_ENABLED + +#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_SECP521R1_ENABLED 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_SECP521R1_ENABLED 0 +#endif +#undef MBEDTLS_ECP_DP_SECP521R1_ENABLED + +#if defined(MBEDTLS_ECP_FIXED_POINT_OPTIM) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_FIXED_POINT_OPTIM 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_FIXED_POINT_OPTIM 0 +#endif +#undef MBEDTLS_ECP_FIXED_POINT_OPTIM + +#if defined(MBEDTLS_ECP_NIST_OPTIM) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_NIST_OPTIM 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_NIST_OPTIM 0 +#endif +#undef MBEDTLS_ECP_NIST_OPTIM + +#if defined(MBEDTLS_ECP_RESTARTABLE) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_RESTARTABLE 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_RESTARTABLE 0 +#endif +#undef MBEDTLS_ECP_RESTARTABLE + +#if defined(MBEDTLS_ECP_WINDOW_SIZE) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_WINDOW_SIZE 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_WINDOW_SIZE 0 +#endif +#undef MBEDTLS_ECP_WINDOW_SIZE + +#if defined(MBEDTLS_ECP_WITH_MPI_UINT) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_WITH_MPI_UINT 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_WITH_MPI_UINT 0 +#endif +#undef MBEDTLS_ECP_WITH_MPI_UINT + +#if defined(MBEDTLS_ENTROPY_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ENTROPY_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ENTROPY_C 0 +#endif +#undef MBEDTLS_ENTROPY_C + +#if defined(MBEDTLS_ENTROPY_NV_SEED) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ENTROPY_NV_SEED 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ENTROPY_NV_SEED 0 +#endif +#undef MBEDTLS_ENTROPY_NV_SEED + +#if defined(MBEDTLS_FS_IO) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_FS_IO 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_FS_IO 0 +#endif +#undef MBEDTLS_FS_IO + +#if defined(MBEDTLS_GCM_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_GCM_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_GCM_C 0 +#endif +#undef MBEDTLS_GCM_C + +#if defined(MBEDTLS_GCM_LARGE_TABLE) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_GCM_LARGE_TABLE 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_GCM_LARGE_TABLE 0 +#endif +#undef MBEDTLS_GCM_LARGE_TABLE + +#if defined(MBEDTLS_GENPRIME) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_GENPRIME 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_GENPRIME 0 +#endif +#undef MBEDTLS_GENPRIME + +#if defined(MBEDTLS_HAVE_ASM) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_HAVE_ASM 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_HAVE_ASM 0 +#endif +#undef MBEDTLS_HAVE_ASM + +#if defined(MBEDTLS_HAVE_SSE2) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_HAVE_SSE2 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_HAVE_SSE2 0 +#endif +#undef MBEDTLS_HAVE_SSE2 + +#if defined(MBEDTLS_HAVE_TIME) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_HAVE_TIME 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_HAVE_TIME 0 +#endif +#undef MBEDTLS_HAVE_TIME + +#if defined(MBEDTLS_HAVE_TIME_DATE) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_HAVE_TIME_DATE 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_HAVE_TIME_DATE 0 +#endif +#undef MBEDTLS_HAVE_TIME_DATE + +#if defined(MBEDTLS_HMAC_DRBG_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_HMAC_DRBG_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_HMAC_DRBG_C 0 +#endif +#undef MBEDTLS_HMAC_DRBG_C + +#if defined(MBEDTLS_IGNORE_RETURN) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_IGNORE_RETURN 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_IGNORE_RETURN 0 +#endif +#undef MBEDTLS_IGNORE_RETURN + +#if defined(MBEDTLS_LMS_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_LMS_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_LMS_C 0 +#endif +#undef MBEDTLS_LMS_C + +#if defined(MBEDTLS_LMS_PRIVATE) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_LMS_PRIVATE 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_LMS_PRIVATE 0 +#endif +#undef MBEDTLS_LMS_PRIVATE + +#if defined(MBEDTLS_MD5_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MD5_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MD5_C 0 +#endif +#undef MBEDTLS_MD5_C + +#if defined(MBEDTLS_MD_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MD_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MD_C 0 +#endif +#undef MBEDTLS_MD_C + +#if defined(MBEDTLS_MEMORY_ALIGN_MULTIPLE) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MEMORY_ALIGN_MULTIPLE 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MEMORY_ALIGN_MULTIPLE 0 +#endif +#undef MBEDTLS_MEMORY_ALIGN_MULTIPLE + +#if defined(MBEDTLS_MEMORY_BACKTRACE) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MEMORY_BACKTRACE 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MEMORY_BACKTRACE 0 +#endif +#undef MBEDTLS_MEMORY_BACKTRACE + +#if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MEMORY_BUFFER_ALLOC_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MEMORY_BUFFER_ALLOC_C 0 +#endif +#undef MBEDTLS_MEMORY_BUFFER_ALLOC_C + +#if defined(MBEDTLS_MEMORY_DEBUG) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MEMORY_DEBUG 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MEMORY_DEBUG 0 +#endif +#undef MBEDTLS_MEMORY_DEBUG + +#if defined(MBEDTLS_MPI_MAX_SIZE) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MPI_MAX_SIZE 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MPI_MAX_SIZE 0 +#endif +#undef MBEDTLS_MPI_MAX_SIZE + +#if defined(MBEDTLS_MPI_WINDOW_SIZE) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MPI_WINDOW_SIZE 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MPI_WINDOW_SIZE 0 +#endif +#undef MBEDTLS_MPI_WINDOW_SIZE + +#if defined(MBEDTLS_NIST_KW_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_NIST_KW_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_NIST_KW_C 0 +#endif +#undef MBEDTLS_NIST_KW_C + +#if defined(MBEDTLS_NO_64BIT_MULTIPLICATION) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_NO_64BIT_MULTIPLICATION 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_NO_64BIT_MULTIPLICATION 0 +#endif +#undef MBEDTLS_NO_64BIT_MULTIPLICATION + +#if defined(MBEDTLS_NO_UDBL_DIVISION) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_NO_UDBL_DIVISION 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_NO_UDBL_DIVISION 0 +#endif +#undef MBEDTLS_NO_UDBL_DIVISION + +#if defined(MBEDTLS_PEM_PARSE_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PEM_PARSE_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PEM_PARSE_C 0 +#endif +#undef MBEDTLS_PEM_PARSE_C + +#if defined(MBEDTLS_PEM_WRITE_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PEM_WRITE_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PEM_WRITE_C 0 +#endif +#undef MBEDTLS_PEM_WRITE_C + +#if defined(MBEDTLS_PKCS1_V15) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PKCS1_V15 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PKCS1_V15 0 +#endif +#undef MBEDTLS_PKCS1_V15 + +#if defined(MBEDTLS_PKCS1_V21) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PKCS1_V21 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PKCS1_V21 0 +#endif +#undef MBEDTLS_PKCS1_V21 + +#if defined(MBEDTLS_PKCS5_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PKCS5_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PKCS5_C 0 +#endif +#undef MBEDTLS_PKCS5_C + +#if defined(MBEDTLS_PK_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PK_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PK_C 0 +#endif +#undef MBEDTLS_PK_C + +#if defined(MBEDTLS_PK_PARSE_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PK_PARSE_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PK_PARSE_C 0 +#endif +#undef MBEDTLS_PK_PARSE_C + +#if defined(MBEDTLS_PK_PARSE_EC_COMPRESSED) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PK_PARSE_EC_COMPRESSED 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PK_PARSE_EC_COMPRESSED 0 +#endif +#undef MBEDTLS_PK_PARSE_EC_COMPRESSED + +#if defined(MBEDTLS_PK_PARSE_EC_EXTENDED) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PK_PARSE_EC_EXTENDED 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PK_PARSE_EC_EXTENDED 0 +#endif +#undef MBEDTLS_PK_PARSE_EC_EXTENDED + +#if defined(MBEDTLS_PK_WRITE_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PK_WRITE_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PK_WRITE_C 0 +#endif +#undef MBEDTLS_PK_WRITE_C + +#if defined(MBEDTLS_PLATFORM_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_C 0 +#endif +#undef MBEDTLS_PLATFORM_C + +#if defined(MBEDTLS_PLATFORM_CALLOC_MACRO) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_CALLOC_MACRO 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_CALLOC_MACRO 0 +#endif +#undef MBEDTLS_PLATFORM_CALLOC_MACRO + +#if defined(MBEDTLS_PLATFORM_EXIT_ALT) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_EXIT_ALT 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_EXIT_ALT 0 +#endif +#undef MBEDTLS_PLATFORM_EXIT_ALT + +#if defined(MBEDTLS_PLATFORM_EXIT_MACRO) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_EXIT_MACRO 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_EXIT_MACRO 0 +#endif +#undef MBEDTLS_PLATFORM_EXIT_MACRO + +#if defined(MBEDTLS_PLATFORM_FPRINTF_ALT) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_FPRINTF_ALT 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_FPRINTF_ALT 0 +#endif +#undef MBEDTLS_PLATFORM_FPRINTF_ALT + +#if defined(MBEDTLS_PLATFORM_FPRINTF_MACRO) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_FPRINTF_MACRO 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_FPRINTF_MACRO 0 +#endif +#undef MBEDTLS_PLATFORM_FPRINTF_MACRO + +#if defined(MBEDTLS_PLATFORM_FREE_MACRO) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_FREE_MACRO 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_FREE_MACRO 0 +#endif +#undef MBEDTLS_PLATFORM_FREE_MACRO + +#if defined(MBEDTLS_PLATFORM_GMTIME_R_ALT) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_GMTIME_R_ALT 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_GMTIME_R_ALT 0 +#endif +#undef MBEDTLS_PLATFORM_GMTIME_R_ALT + +#if defined(MBEDTLS_PLATFORM_MEMORY) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_MEMORY 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_MEMORY 0 +#endif +#undef MBEDTLS_PLATFORM_MEMORY + +#if defined(MBEDTLS_PLATFORM_MS_TIME_ALT) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_MS_TIME_ALT 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_MS_TIME_ALT 0 +#endif +#undef MBEDTLS_PLATFORM_MS_TIME_ALT + +#if defined(MBEDTLS_PLATFORM_MS_TIME_TYPE_MACRO) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_MS_TIME_TYPE_MACRO 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_MS_TIME_TYPE_MACRO 0 +#endif +#undef MBEDTLS_PLATFORM_MS_TIME_TYPE_MACRO + +#if defined(MBEDTLS_PLATFORM_NO_STD_FUNCTIONS) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_NO_STD_FUNCTIONS 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_NO_STD_FUNCTIONS 0 +#endif +#undef MBEDTLS_PLATFORM_NO_STD_FUNCTIONS + +#if defined(MBEDTLS_PLATFORM_NV_SEED_ALT) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_NV_SEED_ALT 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_NV_SEED_ALT 0 +#endif +#undef MBEDTLS_PLATFORM_NV_SEED_ALT + +#if defined(MBEDTLS_PLATFORM_NV_SEED_READ_MACRO) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_NV_SEED_READ_MACRO 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_NV_SEED_READ_MACRO 0 +#endif +#undef MBEDTLS_PLATFORM_NV_SEED_READ_MACRO + +#if defined(MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO 0 +#endif +#undef MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO + +#if defined(MBEDTLS_PLATFORM_PRINTF_ALT) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_PRINTF_ALT 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_PRINTF_ALT 0 +#endif +#undef MBEDTLS_PLATFORM_PRINTF_ALT + +#if defined(MBEDTLS_PLATFORM_PRINTF_MACRO) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_PRINTF_MACRO 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_PRINTF_MACRO 0 +#endif +#undef MBEDTLS_PLATFORM_PRINTF_MACRO + +#if defined(MBEDTLS_PLATFORM_SETBUF_ALT) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_SETBUF_ALT 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_SETBUF_ALT 0 +#endif +#undef MBEDTLS_PLATFORM_SETBUF_ALT + +#if defined(MBEDTLS_PLATFORM_SETBUF_MACRO) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_SETBUF_MACRO 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_SETBUF_MACRO 0 +#endif +#undef MBEDTLS_PLATFORM_SETBUF_MACRO + +#if defined(MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT 0 +#endif +#undef MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT + +#if defined(MBEDTLS_PLATFORM_SNPRINTF_ALT) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_SNPRINTF_ALT 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_SNPRINTF_ALT 0 +#endif +#undef MBEDTLS_PLATFORM_SNPRINTF_ALT + +#if defined(MBEDTLS_PLATFORM_SNPRINTF_MACRO) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_SNPRINTF_MACRO 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_SNPRINTF_MACRO 0 +#endif +#undef MBEDTLS_PLATFORM_SNPRINTF_MACRO + +#if defined(MBEDTLS_PLATFORM_STD_CALLOC) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_CALLOC 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_CALLOC 0 +#endif +#undef MBEDTLS_PLATFORM_STD_CALLOC + +#if defined(MBEDTLS_PLATFORM_STD_EXIT) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_EXIT 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_EXIT 0 +#endif +#undef MBEDTLS_PLATFORM_STD_EXIT + +#if defined(MBEDTLS_PLATFORM_STD_EXIT_FAILURE) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_EXIT_FAILURE 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_EXIT_FAILURE 0 +#endif +#undef MBEDTLS_PLATFORM_STD_EXIT_FAILURE + +#if defined(MBEDTLS_PLATFORM_STD_EXIT_SUCCESS) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_EXIT_SUCCESS 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_EXIT_SUCCESS 0 +#endif +#undef MBEDTLS_PLATFORM_STD_EXIT_SUCCESS + +#if defined(MBEDTLS_PLATFORM_STD_FPRINTF) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_FPRINTF 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_FPRINTF 0 +#endif +#undef MBEDTLS_PLATFORM_STD_FPRINTF + +#if defined(MBEDTLS_PLATFORM_STD_FREE) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_FREE 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_FREE 0 +#endif +#undef MBEDTLS_PLATFORM_STD_FREE + +#if defined(MBEDTLS_PLATFORM_STD_MEM_HDR) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_MEM_HDR 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_MEM_HDR 0 +#endif +#undef MBEDTLS_PLATFORM_STD_MEM_HDR + +#if defined(MBEDTLS_PLATFORM_STD_NV_SEED_FILE) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_NV_SEED_FILE 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_NV_SEED_FILE 0 +#endif +#undef MBEDTLS_PLATFORM_STD_NV_SEED_FILE + +#if defined(MBEDTLS_PLATFORM_STD_NV_SEED_READ) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_NV_SEED_READ 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_NV_SEED_READ 0 +#endif +#undef MBEDTLS_PLATFORM_STD_NV_SEED_READ + +#if defined(MBEDTLS_PLATFORM_STD_NV_SEED_WRITE) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_NV_SEED_WRITE 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_NV_SEED_WRITE 0 +#endif +#undef MBEDTLS_PLATFORM_STD_NV_SEED_WRITE + +#if defined(MBEDTLS_PLATFORM_STD_PRINTF) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_PRINTF 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_PRINTF 0 +#endif +#undef MBEDTLS_PLATFORM_STD_PRINTF + +#if defined(MBEDTLS_PLATFORM_STD_SETBUF) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_SETBUF 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_SETBUF 0 +#endif +#undef MBEDTLS_PLATFORM_STD_SETBUF + +#if defined(MBEDTLS_PLATFORM_STD_SNPRINTF) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_SNPRINTF 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_SNPRINTF 0 +#endif +#undef MBEDTLS_PLATFORM_STD_SNPRINTF + +#if defined(MBEDTLS_PLATFORM_STD_TIME) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_TIME 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_TIME 0 +#endif +#undef MBEDTLS_PLATFORM_STD_TIME + +#if defined(MBEDTLS_PLATFORM_TIME_ALT) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_TIME_ALT 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_TIME_ALT 0 +#endif +#undef MBEDTLS_PLATFORM_TIME_ALT + +#if defined(MBEDTLS_PLATFORM_TIME_MACRO) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_TIME_MACRO 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_TIME_MACRO 0 +#endif +#undef MBEDTLS_PLATFORM_TIME_MACRO + +#if defined(MBEDTLS_PLATFORM_TIME_TYPE_MACRO) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_TIME_TYPE_MACRO 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_TIME_TYPE_MACRO 0 +#endif +#undef MBEDTLS_PLATFORM_TIME_TYPE_MACRO + +#if defined(MBEDTLS_PLATFORM_VSNPRINTF_ALT) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_VSNPRINTF_ALT 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_VSNPRINTF_ALT 0 +#endif +#undef MBEDTLS_PLATFORM_VSNPRINTF_ALT + +#if defined(MBEDTLS_PLATFORM_VSNPRINTF_MACRO) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_VSNPRINTF_MACRO 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_VSNPRINTF_MACRO 0 +#endif +#undef MBEDTLS_PLATFORM_VSNPRINTF_MACRO + +#if defined(MBEDTLS_PLATFORM_ZEROIZE_ALT) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_ZEROIZE_ALT 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_ZEROIZE_ALT 0 +#endif +#undef MBEDTLS_PLATFORM_ZEROIZE_ALT + +#if defined(MBEDTLS_POLY1305_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_POLY1305_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_POLY1305_C 0 +#endif +#undef MBEDTLS_POLY1305_C + +#if defined(MBEDTLS_PRINTF_MS_TIME) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PRINTF_MS_TIME 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PRINTF_MS_TIME 0 +#endif +#undef MBEDTLS_PRINTF_MS_TIME + +#if defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS 0 +#endif +#undef MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS + +#if defined(MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS 0 +#endif +#undef MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS + +#if defined(MBEDTLS_PSA_CRYPTO_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_C 0 +#endif +#undef MBEDTLS_PSA_CRYPTO_C + +#if defined(MBEDTLS_PSA_CRYPTO_CLIENT) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_CLIENT 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_CLIENT 0 +#endif +#undef MBEDTLS_PSA_CRYPTO_CLIENT + +#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG 0 +#endif +#undef MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG + +#if defined(MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER 0 +#endif +#undef MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER + +#if defined(MBEDTLS_PSA_CRYPTO_PLATFORM_FILE) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_PLATFORM_FILE 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_PLATFORM_FILE 0 +#endif +#undef MBEDTLS_PSA_CRYPTO_PLATFORM_FILE + +#if defined(MBEDTLS_PSA_CRYPTO_SPM) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_SPM 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_SPM 0 +#endif +#undef MBEDTLS_PSA_CRYPTO_SPM + +#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_STORAGE_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_STORAGE_C 0 +#endif +#undef MBEDTLS_PSA_CRYPTO_STORAGE_C + +#if defined(MBEDTLS_PSA_CRYPTO_STRUCT_FILE) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_STRUCT_FILE 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_STRUCT_FILE 0 +#endif +#undef MBEDTLS_PSA_CRYPTO_STRUCT_FILE + +#if defined(MBEDTLS_PSA_ITS_FILE_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_ITS_FILE_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_ITS_FILE_C 0 +#endif +#undef MBEDTLS_PSA_ITS_FILE_C + +#if defined(MBEDTLS_PSA_KEY_SLOT_COUNT) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_KEY_SLOT_COUNT 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_KEY_SLOT_COUNT 0 +#endif +#undef MBEDTLS_PSA_KEY_SLOT_COUNT + +#if defined(MBEDTLS_PSA_KEY_STORE_DYNAMIC) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_KEY_STORE_DYNAMIC 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_KEY_STORE_DYNAMIC 0 +#endif +#undef MBEDTLS_PSA_KEY_STORE_DYNAMIC + +#if defined(MBEDTLS_PSA_P256M_DRIVER_ENABLED) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_P256M_DRIVER_ENABLED 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_P256M_DRIVER_ENABLED 0 +#endif +#undef MBEDTLS_PSA_P256M_DRIVER_ENABLED + +#if defined(MBEDTLS_PSA_STATIC_KEY_SLOTS) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_STATIC_KEY_SLOTS 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_STATIC_KEY_SLOTS 0 +#endif +#undef MBEDTLS_PSA_STATIC_KEY_SLOTS + +#if defined(MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE 0 +#endif +#undef MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE + +#if defined(MBEDTLS_RIPEMD160_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_RIPEMD160_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_RIPEMD160_C 0 +#endif +#undef MBEDTLS_RIPEMD160_C + +#if defined(MBEDTLS_RSA_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_RSA_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_RSA_C 0 +#endif +#undef MBEDTLS_RSA_C + +#if defined(MBEDTLS_RSA_GEN_KEY_MIN_BITS) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_RSA_GEN_KEY_MIN_BITS 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_RSA_GEN_KEY_MIN_BITS 0 +#endif +#undef MBEDTLS_RSA_GEN_KEY_MIN_BITS + +#if defined(MBEDTLS_RSA_NO_CRT) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_RSA_NO_CRT 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_RSA_NO_CRT 0 +#endif +#undef MBEDTLS_RSA_NO_CRT + +#if defined(MBEDTLS_SELF_TEST) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SELF_TEST 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SELF_TEST 0 +#endif +#undef MBEDTLS_SELF_TEST + +#if defined(MBEDTLS_SHA1_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA1_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA1_C 0 +#endif +#undef MBEDTLS_SHA1_C + +#if defined(MBEDTLS_SHA224_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA224_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA224_C 0 +#endif +#undef MBEDTLS_SHA224_C + +#if defined(MBEDTLS_SHA256_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA256_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA256_C 0 +#endif +#undef MBEDTLS_SHA256_C + +#if defined(MBEDTLS_SHA256_SMALLER) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA256_SMALLER 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA256_SMALLER 0 +#endif +#undef MBEDTLS_SHA256_SMALLER + +#if defined(MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT 0 +#endif +#undef MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT + +#if defined(MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY 0 +#endif +#undef MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY + +#if defined(MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT 0 +#endif +#undef MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT + +#if defined(MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY 0 +#endif +#undef MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY + +#if defined(MBEDTLS_SHA384_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA384_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA384_C 0 +#endif +#undef MBEDTLS_SHA384_C + +#if defined(MBEDTLS_SHA512_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA512_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA512_C 0 +#endif +#undef MBEDTLS_SHA512_C + +#if defined(MBEDTLS_SHA512_SMALLER) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA512_SMALLER 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA512_SMALLER 0 +#endif +#undef MBEDTLS_SHA512_SMALLER + +#if defined(MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT 0 +#endif +#undef MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT + +#if defined(MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY 0 +#endif +#undef MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY + +#if defined(MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN 0 +#endif +#undef MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN + +#if defined(MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND 0 +#endif +#undef MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND + +#if defined(MBEDTLS_TEST_HOOKS) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_TEST_HOOKS 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_TEST_HOOKS 0 +#endif +#undef MBEDTLS_TEST_HOOKS + +#if defined(MBEDTLS_THREADING_ALT) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_THREADING_ALT 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_THREADING_ALT 0 +#endif +#undef MBEDTLS_THREADING_ALT + +#if defined(MBEDTLS_THREADING_C) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_THREADING_C 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_THREADING_C 0 +#endif +#undef MBEDTLS_THREADING_C + +#if defined(MBEDTLS_THREADING_PTHREAD) +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_THREADING_PTHREAD 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_THREADING_PTHREAD 0 +#endif +#undef MBEDTLS_THREADING_PTHREAD + +#if defined(PSA_CRYPTO_CONFIG_H) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_CRYPTO_CONFIG_H 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_CRYPTO_CONFIG_H 0 +#endif +#undef PSA_CRYPTO_CONFIG_H + +#if defined(PSA_WANT_ALG_CBC_NO_PADDING) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CBC_NO_PADDING 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CBC_NO_PADDING 0 +#endif +#undef PSA_WANT_ALG_CBC_NO_PADDING + +#if defined(PSA_WANT_ALG_CBC_PKCS7) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CBC_PKCS7 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CBC_PKCS7 0 +#endif +#undef PSA_WANT_ALG_CBC_PKCS7 + +#if defined(PSA_WANT_ALG_CCM) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CCM 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CCM 0 +#endif +#undef PSA_WANT_ALG_CCM + +#if defined(PSA_WANT_ALG_CCM_STAR_NO_TAG) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CCM_STAR_NO_TAG 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CCM_STAR_NO_TAG 0 +#endif +#undef PSA_WANT_ALG_CCM_STAR_NO_TAG + +#if defined(PSA_WANT_ALG_CFB) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CFB 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CFB 0 +#endif +#undef PSA_WANT_ALG_CFB + +#if defined(PSA_WANT_ALG_CHACHA20_POLY1305) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CHACHA20_POLY1305 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CHACHA20_POLY1305 0 +#endif +#undef PSA_WANT_ALG_CHACHA20_POLY1305 + +#if defined(PSA_WANT_ALG_CMAC) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CMAC 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CMAC 0 +#endif +#undef PSA_WANT_ALG_CMAC + +#if defined(PSA_WANT_ALG_CTR) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CTR 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CTR 0 +#endif +#undef PSA_WANT_ALG_CTR + +#if defined(PSA_WANT_ALG_DETERMINISTIC_ECDSA) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_DETERMINISTIC_ECDSA 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_DETERMINISTIC_ECDSA 0 +#endif +#undef PSA_WANT_ALG_DETERMINISTIC_ECDSA + +#if defined(PSA_WANT_ALG_ECB_NO_PADDING) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_ECB_NO_PADDING 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_ECB_NO_PADDING 0 +#endif +#undef PSA_WANT_ALG_ECB_NO_PADDING + +#if defined(PSA_WANT_ALG_ECDH) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_ECDH 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_ECDH 0 +#endif +#undef PSA_WANT_ALG_ECDH + +#if defined(PSA_WANT_ALG_ECDSA) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_ECDSA 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_ECDSA 0 +#endif +#undef PSA_WANT_ALG_ECDSA + +#if defined(PSA_WANT_ALG_FFDH) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_FFDH 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_FFDH 0 +#endif +#undef PSA_WANT_ALG_FFDH + +#if defined(PSA_WANT_ALG_GCM) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_GCM 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_GCM 0 +#endif +#undef PSA_WANT_ALG_GCM + +#if defined(PSA_WANT_ALG_HKDF) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_HKDF 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_HKDF 0 +#endif +#undef PSA_WANT_ALG_HKDF + +#if defined(PSA_WANT_ALG_HKDF_EXPAND) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_HKDF_EXPAND 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_HKDF_EXPAND 0 +#endif +#undef PSA_WANT_ALG_HKDF_EXPAND + +#if defined(PSA_WANT_ALG_HKDF_EXTRACT) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_HKDF_EXTRACT 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_HKDF_EXTRACT 0 +#endif +#undef PSA_WANT_ALG_HKDF_EXTRACT + +#if defined(PSA_WANT_ALG_HMAC) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_HMAC 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_HMAC 0 +#endif +#undef PSA_WANT_ALG_HMAC + +#if defined(PSA_WANT_ALG_JPAKE) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_JPAKE 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_JPAKE 0 +#endif +#undef PSA_WANT_ALG_JPAKE + +#if defined(PSA_WANT_ALG_MD5) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_MD5 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_MD5 0 +#endif +#undef PSA_WANT_ALG_MD5 + +#if defined(PSA_WANT_ALG_OFB) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_OFB 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_OFB 0 +#endif +#undef PSA_WANT_ALG_OFB + +#if defined(PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128 0 +#endif +#undef PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128 + +#if defined(PSA_WANT_ALG_PBKDF2_HMAC) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_PBKDF2_HMAC 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_PBKDF2_HMAC 0 +#endif +#undef PSA_WANT_ALG_PBKDF2_HMAC + +#if defined(PSA_WANT_ALG_RIPEMD160) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_RIPEMD160 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_RIPEMD160 0 +#endif +#undef PSA_WANT_ALG_RIPEMD160 + +#if defined(PSA_WANT_ALG_RSA_OAEP) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_RSA_OAEP 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_RSA_OAEP 0 +#endif +#undef PSA_WANT_ALG_RSA_OAEP + +#if defined(PSA_WANT_ALG_RSA_PKCS1V15_CRYPT) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_RSA_PKCS1V15_CRYPT 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_RSA_PKCS1V15_CRYPT 0 +#endif +#undef PSA_WANT_ALG_RSA_PKCS1V15_CRYPT + +#if defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_RSA_PKCS1V15_SIGN 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_RSA_PKCS1V15_SIGN 0 +#endif +#undef PSA_WANT_ALG_RSA_PKCS1V15_SIGN + +#if defined(PSA_WANT_ALG_RSA_PSS) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_RSA_PSS 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_RSA_PSS 0 +#endif +#undef PSA_WANT_ALG_RSA_PSS + +#if defined(PSA_WANT_ALG_SHA3_224) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA3_224 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA3_224 0 +#endif +#undef PSA_WANT_ALG_SHA3_224 + +#if defined(PSA_WANT_ALG_SHA3_256) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA3_256 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA3_256 0 +#endif +#undef PSA_WANT_ALG_SHA3_256 + +#if defined(PSA_WANT_ALG_SHA3_384) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA3_384 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA3_384 0 +#endif +#undef PSA_WANT_ALG_SHA3_384 + +#if defined(PSA_WANT_ALG_SHA3_512) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA3_512 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA3_512 0 +#endif +#undef PSA_WANT_ALG_SHA3_512 + +#if defined(PSA_WANT_ALG_SHA_1) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA_1 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA_1 0 +#endif +#undef PSA_WANT_ALG_SHA_1 + +#if defined(PSA_WANT_ALG_SHA_224) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA_224 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA_224 0 +#endif +#undef PSA_WANT_ALG_SHA_224 + +#if defined(PSA_WANT_ALG_SHA_256) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA_256 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA_256 0 +#endif +#undef PSA_WANT_ALG_SHA_256 + +#if defined(PSA_WANT_ALG_SHA_384) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA_384 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA_384 0 +#endif +#undef PSA_WANT_ALG_SHA_384 + +#if defined(PSA_WANT_ALG_SHA_512) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA_512 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA_512 0 +#endif +#undef PSA_WANT_ALG_SHA_512 + +#if defined(PSA_WANT_ALG_STREAM_CIPHER) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_STREAM_CIPHER 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_STREAM_CIPHER 0 +#endif +#undef PSA_WANT_ALG_STREAM_CIPHER + +#if defined(PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS 0 +#endif +#undef PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS + +#if defined(PSA_WANT_ALG_TLS12_PRF) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_TLS12_PRF 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_TLS12_PRF 0 +#endif +#undef PSA_WANT_ALG_TLS12_PRF + +#if defined(PSA_WANT_ALG_TLS12_PSK_TO_MS) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_TLS12_PSK_TO_MS 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_TLS12_PSK_TO_MS 0 +#endif +#undef PSA_WANT_ALG_TLS12_PSK_TO_MS + +#if defined(PSA_WANT_DH_RFC7919_2048) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_DH_RFC7919_2048 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_DH_RFC7919_2048 0 +#endif +#undef PSA_WANT_DH_RFC7919_2048 + +#if defined(PSA_WANT_DH_RFC7919_3072) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_DH_RFC7919_3072 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_DH_RFC7919_3072 0 +#endif +#undef PSA_WANT_DH_RFC7919_3072 + +#if defined(PSA_WANT_DH_RFC7919_4096) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_DH_RFC7919_4096 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_DH_RFC7919_4096 0 +#endif +#undef PSA_WANT_DH_RFC7919_4096 + +#if defined(PSA_WANT_DH_RFC7919_6144) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_DH_RFC7919_6144 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_DH_RFC7919_6144 0 +#endif +#undef PSA_WANT_DH_RFC7919_6144 + +#if defined(PSA_WANT_DH_RFC7919_8192) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_DH_RFC7919_8192 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_DH_RFC7919_8192 0 +#endif +#undef PSA_WANT_DH_RFC7919_8192 + +#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_256) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_BRAINPOOL_P_R1_256 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_BRAINPOOL_P_R1_256 0 +#endif +#undef PSA_WANT_ECC_BRAINPOOL_P_R1_256 + +#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_384) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_BRAINPOOL_P_R1_384 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_BRAINPOOL_P_R1_384 0 +#endif +#undef PSA_WANT_ECC_BRAINPOOL_P_R1_384 + +#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_512) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_BRAINPOOL_P_R1_512 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_BRAINPOOL_P_R1_512 0 +#endif +#undef PSA_WANT_ECC_BRAINPOOL_P_R1_512 + +#if defined(PSA_WANT_ECC_MONTGOMERY_255) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_MONTGOMERY_255 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_MONTGOMERY_255 0 +#endif +#undef PSA_WANT_ECC_MONTGOMERY_255 + +#if defined(PSA_WANT_ECC_MONTGOMERY_448) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_MONTGOMERY_448 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_MONTGOMERY_448 0 +#endif +#undef PSA_WANT_ECC_MONTGOMERY_448 + +#if defined(PSA_WANT_ECC_SECP_K1_192) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_SECP_K1_192 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_SECP_K1_192 0 +#endif +#undef PSA_WANT_ECC_SECP_K1_192 + +#if defined(PSA_WANT_ECC_SECP_K1_256) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_SECP_K1_256 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_SECP_K1_256 0 +#endif +#undef PSA_WANT_ECC_SECP_K1_256 + +#if defined(PSA_WANT_ECC_SECP_R1_192) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_SECP_R1_192 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_SECP_R1_192 0 +#endif +#undef PSA_WANT_ECC_SECP_R1_192 + +#if defined(PSA_WANT_ECC_SECP_R1_256) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_SECP_R1_256 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_SECP_R1_256 0 +#endif +#undef PSA_WANT_ECC_SECP_R1_256 + +#if defined(PSA_WANT_ECC_SECP_R1_384) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_SECP_R1_384 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_SECP_R1_384 0 +#endif +#undef PSA_WANT_ECC_SECP_R1_384 + +#if defined(PSA_WANT_ECC_SECP_R1_521) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_SECP_R1_521 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_SECP_R1_521 0 +#endif +#undef PSA_WANT_ECC_SECP_R1_521 + +#if defined(PSA_WANT_KEY_TYPE_AES) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_AES 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_AES 0 +#endif +#undef PSA_WANT_KEY_TYPE_AES + +#if defined(PSA_WANT_KEY_TYPE_ARIA) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ARIA 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ARIA 0 +#endif +#undef PSA_WANT_KEY_TYPE_ARIA + +#if defined(PSA_WANT_KEY_TYPE_CAMELLIA) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_CAMELLIA 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_CAMELLIA 0 +#endif +#undef PSA_WANT_KEY_TYPE_CAMELLIA + +#if defined(PSA_WANT_KEY_TYPE_CHACHA20) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_CHACHA20 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_CHACHA20 0 +#endif +#undef PSA_WANT_KEY_TYPE_CHACHA20 + +#if defined(PSA_WANT_KEY_TYPE_DERIVE) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DERIVE 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DERIVE 0 +#endif +#undef PSA_WANT_KEY_TYPE_DERIVE + +#if defined(PSA_WANT_KEY_TYPE_DES) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DES 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DES 0 +#endif +#undef PSA_WANT_KEY_TYPE_DES + +#if defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC 0 +#endif +#undef PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC + +#if defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_DERIVE) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DH_KEY_PAIR_DERIVE 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DH_KEY_PAIR_DERIVE 0 +#endif +#undef PSA_WANT_KEY_TYPE_DH_KEY_PAIR_DERIVE + +#if defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT 0 +#endif +#undef PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT + +#if defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE 0 +#endif +#undef PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE + +#if defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT 0 +#endif +#undef PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT + +#if defined(PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY 0 +#endif +#undef PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY + +#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR 0 +#endif +#undef PSA_WANT_KEY_TYPE_ECC_KEY_PAIR + +#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC 0 +#endif +#undef PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC + +#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE 0 +#endif +#undef PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE + +#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT 0 +#endif +#undef PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT + +#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE 0 +#endif +#undef PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE + +#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT 0 +#endif +#undef PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT + +#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY 0 +#endif +#undef PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY + +#if defined(PSA_WANT_KEY_TYPE_HMAC) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_HMAC 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_HMAC 0 +#endif +#undef PSA_WANT_KEY_TYPE_HMAC + +#if defined(PSA_WANT_KEY_TYPE_PASSWORD) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_PASSWORD 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_PASSWORD 0 +#endif +#undef PSA_WANT_KEY_TYPE_PASSWORD + +#if defined(PSA_WANT_KEY_TYPE_PASSWORD_HASH) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_PASSWORD_HASH 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_PASSWORD_HASH 0 +#endif +#undef PSA_WANT_KEY_TYPE_PASSWORD_HASH + +#if defined(PSA_WANT_KEY_TYPE_RAW_DATA) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RAW_DATA 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RAW_DATA 0 +#endif +#undef PSA_WANT_KEY_TYPE_RAW_DATA + +#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR 0 +#endif +#undef PSA_WANT_KEY_TYPE_RSA_KEY_PAIR + +#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC 0 +#endif +#undef PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC + +#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_DERIVE) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_DERIVE 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_DERIVE 0 +#endif +#undef PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_DERIVE + +#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT 0 +#endif +#undef PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT + +#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE 0 +#endif +#undef PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE + +#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT 0 +#endif +#undef PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT + +#if defined(PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY) +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY 1 +#else +# define MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY 0 +#endif +#undef PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY + +/* *INDENT-ON* */ + +#endif /* !defined(MBEDTLS_CONFIG_CHECK_BYPASS) */ //no-check-names + +/* End of automatically generated mbedtls_config_check_before.h */ diff --git a/library/mbedtls_config_check_final.h b/library/mbedtls_config_check_final.h new file mode 100644 index 0000000000..39d344b466 --- /dev/null +++ b/library/mbedtls_config_check_final.h @@ -0,0 +1,12 @@ +/* mbedtls_config_check_final.h (generated part of mbedtls_config.c). */ +/* Automatically generated by generate_config_checks.py. Do not edit! */ + +#if !defined(MBEDTLS_CONFIG_CHECK_BYPASS) //no-check-names + +/* *INDENT-OFF* */ + +/* *INDENT-ON* */ + +#endif /* !defined(MBEDTLS_CONFIG_CHECK_BYPASS) */ //no-check-names + +/* End of automatically generated mbedtls_config_check_final.h */ diff --git a/library/mbedtls_config_check_user.h b/library/mbedtls_config_check_user.h new file mode 100644 index 0000000000..540a757667 --- /dev/null +++ b/library/mbedtls_config_check_user.h @@ -0,0 +1,2468 @@ +/* mbedtls_config_check_user.h (generated part of mbedtls_config.c). */ +/* Automatically generated by generate_config_checks.py. Do not edit! */ + +#if !defined(MBEDTLS_CONFIG_CHECK_BYPASS) //no-check-names + +/* *INDENT-OFF* */ + +#if defined(MBEDTLS_AESCE_C) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AESCE_C +# error "MBEDTLS_AESCE_C must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AESCE_C +# define MBEDTLS_AESCE_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AESCE_C + +#if defined(MBEDTLS_AESNI_C) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AESNI_C +# error "MBEDTLS_AESNI_C must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AESNI_C +# define MBEDTLS_AESNI_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AESNI_C + +#if defined(MBEDTLS_AES_ALT) //no-check-names +# error "MBEDTLS_AES_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_AES_C) +# error "MBEDTLS_AES_C is an internal macro of TF-PSA-Crypto and may not be configured." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AES_C +# define MBEDTLS_AES_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AES_C + +#if defined(MBEDTLS_AES_DECRYPT_ALT) //no-check-names +# error "MBEDTLS_AES_DECRYPT_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_AES_ENCRYPT_ALT) //no-check-names +# error "MBEDTLS_AES_ENCRYPT_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_AES_FEWER_TABLES) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AES_FEWER_TABLES +# error "MBEDTLS_AES_FEWER_TABLES must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AES_FEWER_TABLES +# define MBEDTLS_AES_FEWER_TABLES +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AES_FEWER_TABLES + +#if defined(MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH +# error "MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH +# define MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH + +#if defined(MBEDTLS_AES_ROM_TABLES) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AES_ROM_TABLES +# error "MBEDTLS_AES_ROM_TABLES must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AES_ROM_TABLES +# define MBEDTLS_AES_ROM_TABLES +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AES_ROM_TABLES + +#if defined(MBEDTLS_AES_SETKEY_DEC_ALT) //no-check-names +# error "MBEDTLS_AES_SETKEY_DEC_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_AES_SETKEY_ENC_ALT) //no-check-names +# error "MBEDTLS_AES_SETKEY_ENC_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_AES_USE_HARDWARE_ONLY) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AES_USE_HARDWARE_ONLY +# error "MBEDTLS_AES_USE_HARDWARE_ONLY must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AES_USE_HARDWARE_ONLY +# define MBEDTLS_AES_USE_HARDWARE_ONLY +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_AES_USE_HARDWARE_ONLY + +#if defined(MBEDTLS_ARIA_ALT) //no-check-names +# error "MBEDTLS_ARIA_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_ARIA_C) +# error "MBEDTLS_ARIA_C is an internal macro of TF-PSA-Crypto and may not be configured." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ARIA_C +# define MBEDTLS_ARIA_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ARIA_C + +#if defined(MBEDTLS_ASN1_PARSE_C) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ASN1_PARSE_C +# error "MBEDTLS_ASN1_PARSE_C must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ASN1_PARSE_C +# define MBEDTLS_ASN1_PARSE_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ASN1_PARSE_C + +#if defined(MBEDTLS_ASN1_WRITE_C) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ASN1_WRITE_C +# error "MBEDTLS_ASN1_WRITE_C must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ASN1_WRITE_C +# define MBEDTLS_ASN1_WRITE_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ASN1_WRITE_C + +#if defined(MBEDTLS_BASE64_C) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_BASE64_C +# error "MBEDTLS_BASE64_C must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_BASE64_C +# define MBEDTLS_BASE64_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_BASE64_C + +#if defined(MBEDTLS_BIGNUM_C) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_BIGNUM_C +# error "MBEDTLS_BIGNUM_C must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_BIGNUM_C +# define MBEDTLS_BIGNUM_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_BIGNUM_C + +#if defined(MBEDTLS_BLOCK_CIPHER_NO_DECRYPT) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_BLOCK_CIPHER_NO_DECRYPT +# error "MBEDTLS_BLOCK_CIPHER_NO_DECRYPT must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_BLOCK_CIPHER_NO_DECRYPT +# define MBEDTLS_BLOCK_CIPHER_NO_DECRYPT +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_BLOCK_CIPHER_NO_DECRYPT + +#if defined(MBEDTLS_CAMELLIA_ALT) //no-check-names +# error "MBEDTLS_CAMELLIA_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_CAMELLIA_C) +# error "MBEDTLS_CAMELLIA_C is an internal macro of TF-PSA-Crypto and may not be configured." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CAMELLIA_C +# define MBEDTLS_CAMELLIA_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CAMELLIA_C + +#if defined(MBEDTLS_CAMELLIA_SMALL_MEMORY) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CAMELLIA_SMALL_MEMORY +# error "MBEDTLS_CAMELLIA_SMALL_MEMORY must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CAMELLIA_SMALL_MEMORY +# define MBEDTLS_CAMELLIA_SMALL_MEMORY +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CAMELLIA_SMALL_MEMORY + +#if defined(MBEDTLS_CCM_ALT) //no-check-names +# error "MBEDTLS_CCM_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_CCM_C) +# error "MBEDTLS_CCM_C is an internal macro of TF-PSA-Crypto and may not be configured." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CCM_C +# define MBEDTLS_CCM_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CCM_C + +#if defined(MBEDTLS_CHACHA20_ALT) //no-check-names +# error "MBEDTLS_CHACHA20_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_CHACHA20_C) +# error "MBEDTLS_CHACHA20_C is an internal macro of TF-PSA-Crypto and may not be configured." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CHACHA20_C +# define MBEDTLS_CHACHA20_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CHACHA20_C + +#if defined(MBEDTLS_CHACHAPOLY_ALT) //no-check-names +# error "MBEDTLS_CHACHAPOLY_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_CHACHAPOLY_C) +# error "MBEDTLS_CHACHAPOLY_C is an internal macro of TF-PSA-Crypto and may not be configured." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CHACHAPOLY_C +# define MBEDTLS_CHACHAPOLY_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CHACHAPOLY_C + +#if defined(MBEDTLS_CHECK_RETURN) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CHECK_RETURN +# error "MBEDTLS_CHECK_RETURN must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CHECK_RETURN +# define MBEDTLS_CHECK_RETURN +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CHECK_RETURN + +#if defined(MBEDTLS_CHECK_RETURN_WARNING) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CHECK_RETURN_WARNING +# error "MBEDTLS_CHECK_RETURN_WARNING must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CHECK_RETURN_WARNING +# define MBEDTLS_CHECK_RETURN_WARNING +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CHECK_RETURN_WARNING + +#if defined(MBEDTLS_CIPHER_C) +# error "MBEDTLS_CIPHER_C is an internal macro of TF-PSA-Crypto and may not be configured." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_C +# define MBEDTLS_CIPHER_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_C + +#if defined(MBEDTLS_CIPHER_MODE_CBC) +# error "MBEDTLS_CIPHER_MODE_CBC is an internal macro of TF-PSA-Crypto and may not be configured." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_MODE_CBC +# define MBEDTLS_CIPHER_MODE_CBC +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_MODE_CBC + +#if defined(MBEDTLS_CIPHER_MODE_CFB) +# error "MBEDTLS_CIPHER_MODE_CFB is an internal macro of TF-PSA-Crypto and may not be configured." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_MODE_CFB +# define MBEDTLS_CIPHER_MODE_CFB +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_MODE_CFB + +#if defined(MBEDTLS_CIPHER_MODE_CTR) +# error "MBEDTLS_CIPHER_MODE_CTR is an internal macro of TF-PSA-Crypto and may not be configured." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_MODE_CTR +# define MBEDTLS_CIPHER_MODE_CTR +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_MODE_CTR + +#if defined(MBEDTLS_CIPHER_MODE_OFB) +# error "MBEDTLS_CIPHER_MODE_OFB is an internal macro of TF-PSA-Crypto and may not be configured." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_MODE_OFB +# define MBEDTLS_CIPHER_MODE_OFB +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_MODE_OFB + +#if defined(MBEDTLS_CIPHER_MODE_XTS) +# error "MBEDTLS_CIPHER_MODE_XTS is an internal macro of TF-PSA-Crypto and may not be configured." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_MODE_XTS +# define MBEDTLS_CIPHER_MODE_XTS +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_MODE_XTS + +#if defined(MBEDTLS_CIPHER_NULL_CIPHER) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_NULL_CIPHER +# error "MBEDTLS_CIPHER_NULL_CIPHER must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_NULL_CIPHER +# define MBEDTLS_CIPHER_NULL_CIPHER +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_NULL_CIPHER + +#if defined(MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS) //no-check-names +# error "MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_CIPHER_PADDING_PKCS7) +# error "MBEDTLS_CIPHER_PADDING_PKCS7 is an internal macro of TF-PSA-Crypto and may not be configured." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_PADDING_PKCS7 +# define MBEDTLS_CIPHER_PADDING_PKCS7 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CIPHER_PADDING_PKCS7 + +#if defined(MBEDTLS_CIPHER_PADDING_ZEROS) //no-check-names +# error "MBEDTLS_CIPHER_PADDING_ZEROS was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN) //no-check-names +# error "MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_CMAC_ALT) //no-check-names +# error "MBEDTLS_CMAC_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_CMAC_C) +# error "MBEDTLS_CMAC_C is an internal macro of TF-PSA-Crypto and may not be configured." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CMAC_C +# define MBEDTLS_CMAC_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CMAC_C + +#if defined(MBEDTLS_CTR_DRBG_C) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CTR_DRBG_C +# error "MBEDTLS_CTR_DRBG_C must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CTR_DRBG_C +# define MBEDTLS_CTR_DRBG_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_CTR_DRBG_C + +#if defined(MBEDTLS_CTR_DRBG_ENTROPY_LEN) //no-check-names +# error "MBEDTLS_CTR_DRBG_ENTROPY_LEN was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_CTR_DRBG_MAX_INPUT) //no-check-names +# error "MBEDTLS_CTR_DRBG_MAX_INPUT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_CTR_DRBG_MAX_REQUEST) //no-check-names +# error "MBEDTLS_CTR_DRBG_MAX_REQUEST was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_CTR_DRBG_MAX_SEED_INPUT) //no-check-names +# error "MBEDTLS_CTR_DRBG_MAX_SEED_INPUT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_CTR_DRBG_RESEED_INTERVAL) //no-check-names +# error "MBEDTLS_CTR_DRBG_RESEED_INTERVAL was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_CTR_DRBG_USE_128_BIT_KEY) //no-check-names +# error "MBEDTLS_CTR_DRBG_USE_128_BIT_KEY was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_DEPRECATED_REMOVED) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_DEPRECATED_REMOVED +# error "MBEDTLS_DEPRECATED_REMOVED must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_DEPRECATED_REMOVED +# define MBEDTLS_DEPRECATED_REMOVED +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_DEPRECATED_REMOVED + +#if defined(MBEDTLS_DEPRECATED_WARNING) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_DEPRECATED_WARNING +# error "MBEDTLS_DEPRECATED_WARNING must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_DEPRECATED_WARNING +# define MBEDTLS_DEPRECATED_WARNING +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_DEPRECATED_WARNING + +#if defined(MBEDTLS_DES3_CRYPT_ECB_ALT) //no-check-names +# error "MBEDTLS_DES3_CRYPT_ECB_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_DES_ALT) //no-check-names +# error "MBEDTLS_DES_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_DES_C) +# error "MBEDTLS_DES_C is an internal macro of TF-PSA-Crypto and may not be configured." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_DES_C +# define MBEDTLS_DES_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_DES_C + +#if defined(MBEDTLS_DES_CRYPT_ECB_ALT) //no-check-names +# error "MBEDTLS_DES_CRYPT_ECB_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_DES_SETKEY_ALT) //no-check-names +# error "MBEDTLS_DES_SETKEY_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_DHM_ALT) //no-check-names +# error "MBEDTLS_DHM_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_DHM_C) //no-check-names +# error "MBEDTLS_DHM_C was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_ECDH_C) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECDH_C +# error "MBEDTLS_ECDH_C must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECDH_C +# define MBEDTLS_ECDH_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECDH_C + +#if defined(MBEDTLS_ECDH_COMPUTE_SHARED_ALT) //no-check-names +# error "MBEDTLS_ECDH_COMPUTE_SHARED_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_ECDH_GEN_PUBLIC_ALT) //no-check-names +# error "MBEDTLS_ECDH_GEN_PUBLIC_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED +# error "MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED +# define MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED + +#if defined(MBEDTLS_ECDSA_C) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECDSA_C +# error "MBEDTLS_ECDSA_C must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECDSA_C +# define MBEDTLS_ECDSA_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECDSA_C + +#if defined(MBEDTLS_ECDSA_DETERMINISTIC) +# error "MBEDTLS_ECDSA_DETERMINISTIC is an internal macro of TF-PSA-Crypto and may not be configured." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECDSA_DETERMINISTIC +# define MBEDTLS_ECDSA_DETERMINISTIC +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECDSA_DETERMINISTIC + +#if defined(MBEDTLS_ECDSA_GENKEY_ALT) //no-check-names +# error "MBEDTLS_ECDSA_GENKEY_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_ECDSA_SIGN_ALT) //no-check-names +# error "MBEDTLS_ECDSA_SIGN_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_ECDSA_VERIFY_ALT) //no-check-names +# error "MBEDTLS_ECDSA_VERIFY_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_ECJPAKE_ALT) //no-check-names +# error "MBEDTLS_ECJPAKE_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_ECJPAKE_C) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECJPAKE_C +# error "MBEDTLS_ECJPAKE_C must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECJPAKE_C +# define MBEDTLS_ECJPAKE_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECJPAKE_C + +#if defined(MBEDTLS_ECP_ADD_MIXED_ALT) //no-check-names +# error "MBEDTLS_ECP_ADD_MIXED_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_ECP_ALT) //no-check-names +# error "MBEDTLS_ECP_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_ECP_C) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_C +# error "MBEDTLS_ECP_C must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_C +# define MBEDTLS_ECP_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_C + +#if defined(MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT) //no-check-names +# error "MBEDTLS_ECP_DOUBLE_ADD_MXZ_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_ECP_DOUBLE_JAC_ALT) //no-check-names +# error "MBEDTLS_ECP_DOUBLE_JAC_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_BP256R1_ENABLED +# error "MBEDTLS_ECP_DP_BP256R1_ENABLED must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_BP256R1_ENABLED +# define MBEDTLS_ECP_DP_BP256R1_ENABLED +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_BP256R1_ENABLED + +#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_BP384R1_ENABLED +# error "MBEDTLS_ECP_DP_BP384R1_ENABLED must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_BP384R1_ENABLED +# define MBEDTLS_ECP_DP_BP384R1_ENABLED +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_BP384R1_ENABLED + +#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_BP512R1_ENABLED +# error "MBEDTLS_ECP_DP_BP512R1_ENABLED must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_BP512R1_ENABLED +# define MBEDTLS_ECP_DP_BP512R1_ENABLED +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_BP512R1_ENABLED + +#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_CURVE25519_ENABLED +# error "MBEDTLS_ECP_DP_CURVE25519_ENABLED must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_CURVE25519_ENABLED +# define MBEDTLS_ECP_DP_CURVE25519_ENABLED +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_CURVE25519_ENABLED + +#if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_CURVE448_ENABLED +# error "MBEDTLS_ECP_DP_CURVE448_ENABLED must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_CURVE448_ENABLED +# define MBEDTLS_ECP_DP_CURVE448_ENABLED +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_CURVE448_ENABLED + +#if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_SECP192K1_ENABLED +# error "MBEDTLS_ECP_DP_SECP192K1_ENABLED must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_SECP192K1_ENABLED +# define MBEDTLS_ECP_DP_SECP192K1_ENABLED +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_SECP192K1_ENABLED + +#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_SECP192R1_ENABLED +# error "MBEDTLS_ECP_DP_SECP192R1_ENABLED must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_SECP192R1_ENABLED +# define MBEDTLS_ECP_DP_SECP192R1_ENABLED +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_SECP192R1_ENABLED + +#if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) //no-check-names +# error "MBEDTLS_ECP_DP_SECP224K1_ENABLED was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) //no-check-names +# error "MBEDTLS_ECP_DP_SECP224R1_ENABLED was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_SECP256K1_ENABLED +# error "MBEDTLS_ECP_DP_SECP256K1_ENABLED must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_SECP256K1_ENABLED +# define MBEDTLS_ECP_DP_SECP256K1_ENABLED +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_SECP256K1_ENABLED + +#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_SECP256R1_ENABLED +# error "MBEDTLS_ECP_DP_SECP256R1_ENABLED must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_SECP256R1_ENABLED +# define MBEDTLS_ECP_DP_SECP256R1_ENABLED +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_SECP256R1_ENABLED + +#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_SECP384R1_ENABLED +# error "MBEDTLS_ECP_DP_SECP384R1_ENABLED must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_SECP384R1_ENABLED +# define MBEDTLS_ECP_DP_SECP384R1_ENABLED +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_SECP384R1_ENABLED + +#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_SECP521R1_ENABLED +# error "MBEDTLS_ECP_DP_SECP521R1_ENABLED must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_SECP521R1_ENABLED +# define MBEDTLS_ECP_DP_SECP521R1_ENABLED +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_DP_SECP521R1_ENABLED + +#if defined(MBEDTLS_ECP_FIXED_POINT_OPTIM) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_FIXED_POINT_OPTIM +# error "MBEDTLS_ECP_FIXED_POINT_OPTIM must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_FIXED_POINT_OPTIM +# define MBEDTLS_ECP_FIXED_POINT_OPTIM +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_FIXED_POINT_OPTIM + +#if defined(MBEDTLS_ECP_INTERNAL_ALT) //no-check-names +# error "MBEDTLS_ECP_INTERNAL_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_ECP_NIST_OPTIM) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_NIST_OPTIM +# error "MBEDTLS_ECP_NIST_OPTIM must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_NIST_OPTIM +# define MBEDTLS_ECP_NIST_OPTIM +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_NIST_OPTIM + +#if defined(MBEDTLS_ECP_NORMALIZE_JAC_ALT) //no-check-names +# error "MBEDTLS_ECP_NORMALIZE_JAC_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT) //no-check-names +# error "MBEDTLS_ECP_NORMALIZE_JAC_MANY_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_ECP_NORMALIZE_MXZ_ALT) //no-check-names +# error "MBEDTLS_ECP_NORMALIZE_MXZ_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_ECP_NO_FALLBACK) //no-check-names +# error "MBEDTLS_ECP_NO_FALLBACK was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_ECP_RANDOMIZE_JAC_ALT) //no-check-names +# error "MBEDTLS_ECP_RANDOMIZE_JAC_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_ECP_RANDOMIZE_MXZ_ALT) //no-check-names +# error "MBEDTLS_ECP_RANDOMIZE_MXZ_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_ECP_RESTARTABLE) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_RESTARTABLE +# error "MBEDTLS_ECP_RESTARTABLE must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_RESTARTABLE +# define MBEDTLS_ECP_RESTARTABLE +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_RESTARTABLE + +#if defined(MBEDTLS_ECP_WINDOW_SIZE) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_WINDOW_SIZE +# error "MBEDTLS_ECP_WINDOW_SIZE must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_WINDOW_SIZE +# define MBEDTLS_ECP_WINDOW_SIZE +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_WINDOW_SIZE + +#if defined(MBEDTLS_ECP_WITH_MPI_UINT) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_WITH_MPI_UINT +# error "MBEDTLS_ECP_WITH_MPI_UINT must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_WITH_MPI_UINT +# define MBEDTLS_ECP_WITH_MPI_UINT +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ECP_WITH_MPI_UINT + +#if defined(MBEDTLS_ENTROPY_C) +# error "MBEDTLS_ENTROPY_C is an internal macro of TF-PSA-Crypto and may not be configured." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ENTROPY_C +# define MBEDTLS_ENTROPY_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ENTROPY_C + +#if defined(MBEDTLS_ENTROPY_FORCE_SHA256) //no-check-names +# error "MBEDTLS_ENTROPY_FORCE_SHA256 was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_ENTROPY_HARDWARE_ALT) //no-check-names +# error "MBEDTLS_ENTROPY_HARDWARE_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_ENTROPY_MAX_GATHER) //no-check-names +# error "MBEDTLS_ENTROPY_MAX_GATHER was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_ENTROPY_MAX_SOURCES) //no-check-names +# error "MBEDTLS_ENTROPY_MAX_SOURCES was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_ENTROPY_MIN_HARDWARE) //no-check-names +# error "MBEDTLS_ENTROPY_MIN_HARDWARE was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_ENTROPY_NV_SEED) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ENTROPY_NV_SEED +# error "MBEDTLS_ENTROPY_NV_SEED must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ENTROPY_NV_SEED +# define MBEDTLS_ENTROPY_NV_SEED +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_ENTROPY_NV_SEED + +#if defined(MBEDTLS_FS_IO) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_FS_IO +# error "MBEDTLS_FS_IO must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_FS_IO +# define MBEDTLS_FS_IO +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_FS_IO + +#if defined(MBEDTLS_GCM_ALT) //no-check-names +# error "MBEDTLS_GCM_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_GCM_C) +# error "MBEDTLS_GCM_C is an internal macro of TF-PSA-Crypto and may not be configured." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_GCM_C +# define MBEDTLS_GCM_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_GCM_C + +#if defined(MBEDTLS_GCM_LARGE_TABLE) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_GCM_LARGE_TABLE +# error "MBEDTLS_GCM_LARGE_TABLE must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_GCM_LARGE_TABLE +# define MBEDTLS_GCM_LARGE_TABLE +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_GCM_LARGE_TABLE + +#if defined(MBEDTLS_GENPRIME) +# error "MBEDTLS_GENPRIME is an internal macro of TF-PSA-Crypto and may not be configured." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_GENPRIME +# define MBEDTLS_GENPRIME +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_GENPRIME + +#if defined(MBEDTLS_HAVE_ASM) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_HAVE_ASM +# error "MBEDTLS_HAVE_ASM must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_HAVE_ASM +# define MBEDTLS_HAVE_ASM +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_HAVE_ASM + +#if defined(MBEDTLS_HAVE_SSE2) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_HAVE_SSE2 +# error "MBEDTLS_HAVE_SSE2 must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_HAVE_SSE2 +# define MBEDTLS_HAVE_SSE2 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_HAVE_SSE2 + +#if defined(MBEDTLS_HAVE_TIME) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_HAVE_TIME +# error "MBEDTLS_HAVE_TIME must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_HAVE_TIME +# define MBEDTLS_HAVE_TIME +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_HAVE_TIME + +#if defined(MBEDTLS_HAVE_TIME_DATE) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_HAVE_TIME_DATE +# error "MBEDTLS_HAVE_TIME_DATE must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_HAVE_TIME_DATE +# define MBEDTLS_HAVE_TIME_DATE +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_HAVE_TIME_DATE + +#if defined(MBEDTLS_HKDF_C) //no-check-names +# error "MBEDTLS_HKDF_C was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_HMAC_DRBG_C) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_HMAC_DRBG_C +# error "MBEDTLS_HMAC_DRBG_C must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_HMAC_DRBG_C +# define MBEDTLS_HMAC_DRBG_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_HMAC_DRBG_C + +#if defined(MBEDTLS_HMAC_DRBG_MAX_INPUT) //no-check-names +# error "MBEDTLS_HMAC_DRBG_MAX_INPUT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_HMAC_DRBG_MAX_REQUEST) //no-check-names +# error "MBEDTLS_HMAC_DRBG_MAX_REQUEST was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT) //no-check-names +# error "MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_HMAC_DRBG_RESEED_INTERVAL) //no-check-names +# error "MBEDTLS_HMAC_DRBG_RESEED_INTERVAL was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_IGNORE_RETURN) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_IGNORE_RETURN +# error "MBEDTLS_IGNORE_RETURN must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_IGNORE_RETURN +# define MBEDTLS_IGNORE_RETURN +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_IGNORE_RETURN + +#if defined(MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED) //no-check-names +# error "MBEDTLS_KEY_EXCHANGE_DHE_PSK_ENABLED was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED) //no-check-names +# error "MBEDTLS_KEY_EXCHANGE_DHE_RSA_ENABLED was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED) //no-check-names +# error "MBEDTLS_KEY_EXCHANGE_ECDH_ECDSA_ENABLED was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED) //no-check-names +# error "MBEDTLS_KEY_EXCHANGE_ECDH_RSA_ENABLED was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_RSA_ENABLED) //no-check-names +# error "MBEDTLS_KEY_EXCHANGE_RSA_ENABLED was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED) //no-check-names +# error "MBEDTLS_KEY_EXCHANGE_RSA_PSK_ENABLED was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_LMS_C) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_LMS_C +# error "MBEDTLS_LMS_C must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_LMS_C +# define MBEDTLS_LMS_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_LMS_C + +#if defined(MBEDTLS_LMS_PRIVATE) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_LMS_PRIVATE +# error "MBEDTLS_LMS_PRIVATE must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_LMS_PRIVATE +# define MBEDTLS_LMS_PRIVATE +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_LMS_PRIVATE + +#if defined(MBEDTLS_MD5_ALT) //no-check-names +# error "MBEDTLS_MD5_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_MD5_C) +# error "MBEDTLS_MD5_C is an internal macro of TF-PSA-Crypto and may not be configured." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MD5_C +# define MBEDTLS_MD5_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MD5_C + +#if defined(MBEDTLS_MD5_PROCESS_ALT) //no-check-names +# error "MBEDTLS_MD5_PROCESS_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_MD_C) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MD_C +# error "MBEDTLS_MD_C must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MD_C +# define MBEDTLS_MD_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MD_C + +#if defined(MBEDTLS_MEMORY_ALIGN_MULTIPLE) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MEMORY_ALIGN_MULTIPLE +# error "MBEDTLS_MEMORY_ALIGN_MULTIPLE must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MEMORY_ALIGN_MULTIPLE +# define MBEDTLS_MEMORY_ALIGN_MULTIPLE +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MEMORY_ALIGN_MULTIPLE + +#if defined(MBEDTLS_MEMORY_BACKTRACE) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MEMORY_BACKTRACE +# error "MBEDTLS_MEMORY_BACKTRACE must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MEMORY_BACKTRACE +# define MBEDTLS_MEMORY_BACKTRACE +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MEMORY_BACKTRACE + +#if defined(MBEDTLS_MEMORY_BUFFER_ALLOC_C) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MEMORY_BUFFER_ALLOC_C +# error "MBEDTLS_MEMORY_BUFFER_ALLOC_C must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MEMORY_BUFFER_ALLOC_C +# define MBEDTLS_MEMORY_BUFFER_ALLOC_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MEMORY_BUFFER_ALLOC_C + +#if defined(MBEDTLS_MEMORY_DEBUG) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MEMORY_DEBUG +# error "MBEDTLS_MEMORY_DEBUG must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MEMORY_DEBUG +# define MBEDTLS_MEMORY_DEBUG +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MEMORY_DEBUG + +#if defined(MBEDTLS_MPI_MAX_SIZE) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MPI_MAX_SIZE +# error "MBEDTLS_MPI_MAX_SIZE must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MPI_MAX_SIZE +# define MBEDTLS_MPI_MAX_SIZE +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MPI_MAX_SIZE + +#if defined(MBEDTLS_MPI_WINDOW_SIZE) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MPI_WINDOW_SIZE +# error "MBEDTLS_MPI_WINDOW_SIZE must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MPI_WINDOW_SIZE +# define MBEDTLS_MPI_WINDOW_SIZE +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_MPI_WINDOW_SIZE + +#if defined(MBEDTLS_NIST_KW_ALT) //no-check-names +# error "MBEDTLS_NIST_KW_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_NIST_KW_C) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_NIST_KW_C +# error "MBEDTLS_NIST_KW_C must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_NIST_KW_C +# define MBEDTLS_NIST_KW_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_NIST_KW_C + +#if defined(MBEDTLS_NO_64BIT_MULTIPLICATION) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_NO_64BIT_MULTIPLICATION +# error "MBEDTLS_NO_64BIT_MULTIPLICATION must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_NO_64BIT_MULTIPLICATION +# define MBEDTLS_NO_64BIT_MULTIPLICATION +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_NO_64BIT_MULTIPLICATION + +#if defined(MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES) //no-check-names +# error "MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_NO_PLATFORM_ENTROPY) //no-check-names +# error "MBEDTLS_NO_PLATFORM_ENTROPY was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_NO_UDBL_DIVISION) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_NO_UDBL_DIVISION +# error "MBEDTLS_NO_UDBL_DIVISION must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_NO_UDBL_DIVISION +# define MBEDTLS_NO_UDBL_DIVISION +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_NO_UDBL_DIVISION + +#if defined(MBEDTLS_OID_C) //no-check-names +# error "MBEDTLS_OID_C was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_PADLOCK_C) //no-check-names +# error "MBEDTLS_PADLOCK_C was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_PEM_PARSE_C) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PEM_PARSE_C +# error "MBEDTLS_PEM_PARSE_C must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PEM_PARSE_C +# define MBEDTLS_PEM_PARSE_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PEM_PARSE_C + +#if defined(MBEDTLS_PEM_WRITE_C) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PEM_WRITE_C +# error "MBEDTLS_PEM_WRITE_C must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PEM_WRITE_C +# define MBEDTLS_PEM_WRITE_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PEM_WRITE_C + +#if defined(MBEDTLS_PKCS12_C) //no-check-names +# error "MBEDTLS_PKCS12_C was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_PKCS1_V15) +# error "MBEDTLS_PKCS1_V15 is an internal macro of TF-PSA-Crypto and may not be configured." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PKCS1_V15 +# define MBEDTLS_PKCS1_V15 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PKCS1_V15 + +#if defined(MBEDTLS_PKCS1_V21) +# error "MBEDTLS_PKCS1_V21 is an internal macro of TF-PSA-Crypto and may not be configured." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PKCS1_V21 +# define MBEDTLS_PKCS1_V21 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PKCS1_V21 + +#if defined(MBEDTLS_PKCS5_C) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PKCS5_C +# error "MBEDTLS_PKCS5_C must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PKCS5_C +# define MBEDTLS_PKCS5_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PKCS5_C + +#if defined(MBEDTLS_PK_C) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PK_C +# error "MBEDTLS_PK_C must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PK_C +# define MBEDTLS_PK_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PK_C + +#if defined(MBEDTLS_PK_PARSE_C) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PK_PARSE_C +# error "MBEDTLS_PK_PARSE_C must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PK_PARSE_C +# define MBEDTLS_PK_PARSE_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PK_PARSE_C + +#if defined(MBEDTLS_PK_PARSE_EC_COMPRESSED) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PK_PARSE_EC_COMPRESSED +# error "MBEDTLS_PK_PARSE_EC_COMPRESSED must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PK_PARSE_EC_COMPRESSED +# define MBEDTLS_PK_PARSE_EC_COMPRESSED +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PK_PARSE_EC_COMPRESSED + +#if defined(MBEDTLS_PK_PARSE_EC_EXTENDED) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PK_PARSE_EC_EXTENDED +# error "MBEDTLS_PK_PARSE_EC_EXTENDED must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PK_PARSE_EC_EXTENDED +# define MBEDTLS_PK_PARSE_EC_EXTENDED +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PK_PARSE_EC_EXTENDED + +#if defined(MBEDTLS_PK_RSA_ALT_SUPPORT) //no-check-names +# error "MBEDTLS_PK_RSA_ALT_SUPPORT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_PK_WRITE_C) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PK_WRITE_C +# error "MBEDTLS_PK_WRITE_C must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PK_WRITE_C +# define MBEDTLS_PK_WRITE_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PK_WRITE_C + +#if defined(MBEDTLS_PLATFORM_C) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_C +# error "MBEDTLS_PLATFORM_C must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_C +# define MBEDTLS_PLATFORM_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_C + +#if defined(MBEDTLS_PLATFORM_CALLOC_MACRO) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_CALLOC_MACRO +# error "MBEDTLS_PLATFORM_CALLOC_MACRO must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_CALLOC_MACRO +# define MBEDTLS_PLATFORM_CALLOC_MACRO +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_CALLOC_MACRO + +#if defined(MBEDTLS_PLATFORM_EXIT_ALT) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_EXIT_ALT +# error "MBEDTLS_PLATFORM_EXIT_ALT must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_EXIT_ALT +# define MBEDTLS_PLATFORM_EXIT_ALT +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_EXIT_ALT + +#if defined(MBEDTLS_PLATFORM_EXIT_MACRO) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_EXIT_MACRO +# error "MBEDTLS_PLATFORM_EXIT_MACRO must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_EXIT_MACRO +# define MBEDTLS_PLATFORM_EXIT_MACRO +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_EXIT_MACRO + +#if defined(MBEDTLS_PLATFORM_FPRINTF_ALT) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_FPRINTF_ALT +# error "MBEDTLS_PLATFORM_FPRINTF_ALT must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_FPRINTF_ALT +# define MBEDTLS_PLATFORM_FPRINTF_ALT +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_FPRINTF_ALT + +#if defined(MBEDTLS_PLATFORM_FPRINTF_MACRO) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_FPRINTF_MACRO +# error "MBEDTLS_PLATFORM_FPRINTF_MACRO must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_FPRINTF_MACRO +# define MBEDTLS_PLATFORM_FPRINTF_MACRO +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_FPRINTF_MACRO + +#if defined(MBEDTLS_PLATFORM_FREE_MACRO) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_FREE_MACRO +# error "MBEDTLS_PLATFORM_FREE_MACRO must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_FREE_MACRO +# define MBEDTLS_PLATFORM_FREE_MACRO +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_FREE_MACRO + +#if defined(MBEDTLS_PLATFORM_GMTIME_R_ALT) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_GMTIME_R_ALT +# error "MBEDTLS_PLATFORM_GMTIME_R_ALT must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_GMTIME_R_ALT +# define MBEDTLS_PLATFORM_GMTIME_R_ALT +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_GMTIME_R_ALT + +#if defined(MBEDTLS_PLATFORM_MEMORY) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_MEMORY +# error "MBEDTLS_PLATFORM_MEMORY must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_MEMORY +# define MBEDTLS_PLATFORM_MEMORY +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_MEMORY + +#if defined(MBEDTLS_PLATFORM_MS_TIME_ALT) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_MS_TIME_ALT +# error "MBEDTLS_PLATFORM_MS_TIME_ALT must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_MS_TIME_ALT +# define MBEDTLS_PLATFORM_MS_TIME_ALT +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_MS_TIME_ALT + +#if defined(MBEDTLS_PLATFORM_MS_TIME_TYPE_MACRO) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_MS_TIME_TYPE_MACRO +# error "MBEDTLS_PLATFORM_MS_TIME_TYPE_MACRO must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_MS_TIME_TYPE_MACRO +# define MBEDTLS_PLATFORM_MS_TIME_TYPE_MACRO +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_MS_TIME_TYPE_MACRO + +#if defined(MBEDTLS_PLATFORM_NO_STD_FUNCTIONS) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_NO_STD_FUNCTIONS +# error "MBEDTLS_PLATFORM_NO_STD_FUNCTIONS must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_NO_STD_FUNCTIONS +# define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_NO_STD_FUNCTIONS + +#if defined(MBEDTLS_PLATFORM_NV_SEED_ALT) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_NV_SEED_ALT +# error "MBEDTLS_PLATFORM_NV_SEED_ALT must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_NV_SEED_ALT +# define MBEDTLS_PLATFORM_NV_SEED_ALT +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_NV_SEED_ALT + +#if defined(MBEDTLS_PLATFORM_NV_SEED_READ_MACRO) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_NV_SEED_READ_MACRO +# error "MBEDTLS_PLATFORM_NV_SEED_READ_MACRO must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_NV_SEED_READ_MACRO +# define MBEDTLS_PLATFORM_NV_SEED_READ_MACRO +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_NV_SEED_READ_MACRO + +#if defined(MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO +# error "MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO +# define MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO + +#if defined(MBEDTLS_PLATFORM_PRINTF_ALT) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_PRINTF_ALT +# error "MBEDTLS_PLATFORM_PRINTF_ALT must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_PRINTF_ALT +# define MBEDTLS_PLATFORM_PRINTF_ALT +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_PRINTF_ALT + +#if defined(MBEDTLS_PLATFORM_PRINTF_MACRO) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_PRINTF_MACRO +# error "MBEDTLS_PLATFORM_PRINTF_MACRO must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_PRINTF_MACRO +# define MBEDTLS_PLATFORM_PRINTF_MACRO +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_PRINTF_MACRO + +#if defined(MBEDTLS_PLATFORM_SETBUF_ALT) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_SETBUF_ALT +# error "MBEDTLS_PLATFORM_SETBUF_ALT must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_SETBUF_ALT +# define MBEDTLS_PLATFORM_SETBUF_ALT +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_SETBUF_ALT + +#if defined(MBEDTLS_PLATFORM_SETBUF_MACRO) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_SETBUF_MACRO +# error "MBEDTLS_PLATFORM_SETBUF_MACRO must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_SETBUF_MACRO +# define MBEDTLS_PLATFORM_SETBUF_MACRO +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_SETBUF_MACRO + +#if defined(MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT +# error "MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT +# define MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT + +#if defined(MBEDTLS_PLATFORM_SNPRINTF_ALT) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_SNPRINTF_ALT +# error "MBEDTLS_PLATFORM_SNPRINTF_ALT must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_SNPRINTF_ALT +# define MBEDTLS_PLATFORM_SNPRINTF_ALT +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_SNPRINTF_ALT + +#if defined(MBEDTLS_PLATFORM_SNPRINTF_MACRO) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_SNPRINTF_MACRO +# error "MBEDTLS_PLATFORM_SNPRINTF_MACRO must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_SNPRINTF_MACRO +# define MBEDTLS_PLATFORM_SNPRINTF_MACRO +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_SNPRINTF_MACRO + +#if defined(MBEDTLS_PLATFORM_STD_CALLOC) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_CALLOC +# error "MBEDTLS_PLATFORM_STD_CALLOC must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_CALLOC +# define MBEDTLS_PLATFORM_STD_CALLOC +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_CALLOC + +#if defined(MBEDTLS_PLATFORM_STD_EXIT) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_EXIT +# error "MBEDTLS_PLATFORM_STD_EXIT must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_EXIT +# define MBEDTLS_PLATFORM_STD_EXIT +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_EXIT + +#if defined(MBEDTLS_PLATFORM_STD_EXIT_FAILURE) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_EXIT_FAILURE +# error "MBEDTLS_PLATFORM_STD_EXIT_FAILURE must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_EXIT_FAILURE +# define MBEDTLS_PLATFORM_STD_EXIT_FAILURE +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_EXIT_FAILURE + +#if defined(MBEDTLS_PLATFORM_STD_EXIT_SUCCESS) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_EXIT_SUCCESS +# error "MBEDTLS_PLATFORM_STD_EXIT_SUCCESS must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_EXIT_SUCCESS +# define MBEDTLS_PLATFORM_STD_EXIT_SUCCESS +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_EXIT_SUCCESS + +#if defined(MBEDTLS_PLATFORM_STD_FPRINTF) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_FPRINTF +# error "MBEDTLS_PLATFORM_STD_FPRINTF must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_FPRINTF +# define MBEDTLS_PLATFORM_STD_FPRINTF +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_FPRINTF + +#if defined(MBEDTLS_PLATFORM_STD_FREE) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_FREE +# error "MBEDTLS_PLATFORM_STD_FREE must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_FREE +# define MBEDTLS_PLATFORM_STD_FREE +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_FREE + +#if defined(MBEDTLS_PLATFORM_STD_MEM_HDR) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_MEM_HDR +# error "MBEDTLS_PLATFORM_STD_MEM_HDR must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_MEM_HDR +# define MBEDTLS_PLATFORM_STD_MEM_HDR +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_MEM_HDR + +#if defined(MBEDTLS_PLATFORM_STD_NV_SEED_FILE) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_NV_SEED_FILE +# error "MBEDTLS_PLATFORM_STD_NV_SEED_FILE must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_NV_SEED_FILE +# define MBEDTLS_PLATFORM_STD_NV_SEED_FILE +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_NV_SEED_FILE + +#if defined(MBEDTLS_PLATFORM_STD_NV_SEED_READ) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_NV_SEED_READ +# error "MBEDTLS_PLATFORM_STD_NV_SEED_READ must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_NV_SEED_READ +# define MBEDTLS_PLATFORM_STD_NV_SEED_READ +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_NV_SEED_READ + +#if defined(MBEDTLS_PLATFORM_STD_NV_SEED_WRITE) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_NV_SEED_WRITE +# error "MBEDTLS_PLATFORM_STD_NV_SEED_WRITE must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_NV_SEED_WRITE +# define MBEDTLS_PLATFORM_STD_NV_SEED_WRITE +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_NV_SEED_WRITE + +#if defined(MBEDTLS_PLATFORM_STD_PRINTF) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_PRINTF +# error "MBEDTLS_PLATFORM_STD_PRINTF must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_PRINTF +# define MBEDTLS_PLATFORM_STD_PRINTF +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_PRINTF + +#if defined(MBEDTLS_PLATFORM_STD_SETBUF) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_SETBUF +# error "MBEDTLS_PLATFORM_STD_SETBUF must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_SETBUF +# define MBEDTLS_PLATFORM_STD_SETBUF +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_SETBUF + +#if defined(MBEDTLS_PLATFORM_STD_SNPRINTF) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_SNPRINTF +# error "MBEDTLS_PLATFORM_STD_SNPRINTF must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_SNPRINTF +# define MBEDTLS_PLATFORM_STD_SNPRINTF +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_SNPRINTF + +#if defined(MBEDTLS_PLATFORM_STD_TIME) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_TIME +# error "MBEDTLS_PLATFORM_STD_TIME must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_TIME +# define MBEDTLS_PLATFORM_STD_TIME +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_STD_TIME + +#if defined(MBEDTLS_PLATFORM_TIME_ALT) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_TIME_ALT +# error "MBEDTLS_PLATFORM_TIME_ALT must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_TIME_ALT +# define MBEDTLS_PLATFORM_TIME_ALT +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_TIME_ALT + +#if defined(MBEDTLS_PLATFORM_TIME_MACRO) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_TIME_MACRO +# error "MBEDTLS_PLATFORM_TIME_MACRO must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_TIME_MACRO +# define MBEDTLS_PLATFORM_TIME_MACRO +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_TIME_MACRO + +#if defined(MBEDTLS_PLATFORM_TIME_TYPE_MACRO) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_TIME_TYPE_MACRO +# error "MBEDTLS_PLATFORM_TIME_TYPE_MACRO must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_TIME_TYPE_MACRO +# define MBEDTLS_PLATFORM_TIME_TYPE_MACRO +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_TIME_TYPE_MACRO + +#if defined(MBEDTLS_PLATFORM_VSNPRINTF_ALT) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_VSNPRINTF_ALT +# error "MBEDTLS_PLATFORM_VSNPRINTF_ALT must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_VSNPRINTF_ALT +# define MBEDTLS_PLATFORM_VSNPRINTF_ALT +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_VSNPRINTF_ALT + +#if defined(MBEDTLS_PLATFORM_VSNPRINTF_MACRO) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_VSNPRINTF_MACRO +# error "MBEDTLS_PLATFORM_VSNPRINTF_MACRO must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_VSNPRINTF_MACRO +# define MBEDTLS_PLATFORM_VSNPRINTF_MACRO +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_VSNPRINTF_MACRO + +#if defined(MBEDTLS_PLATFORM_ZEROIZE_ALT) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_ZEROIZE_ALT +# error "MBEDTLS_PLATFORM_ZEROIZE_ALT must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_ZEROIZE_ALT +# define MBEDTLS_PLATFORM_ZEROIZE_ALT +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PLATFORM_ZEROIZE_ALT + +#if defined(MBEDTLS_POLY1305_ALT) //no-check-names +# error "MBEDTLS_POLY1305_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_POLY1305_C) +# error "MBEDTLS_POLY1305_C is an internal macro of TF-PSA-Crypto and may not be configured." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_POLY1305_C +# define MBEDTLS_POLY1305_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_POLY1305_C + +#if defined(MBEDTLS_PRINTF_MS_TIME) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PRINTF_MS_TIME +# error "MBEDTLS_PRINTF_MS_TIME must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PRINTF_MS_TIME +# define MBEDTLS_PRINTF_MS_TIME +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PRINTF_MS_TIME + +#if defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS +# error "MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS +# define MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS + +#if defined(MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS +# error "MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS +# define MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS + +#if defined(MBEDTLS_PSA_CRYPTO_C) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_C +# error "MBEDTLS_PSA_CRYPTO_C must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_C +# define MBEDTLS_PSA_CRYPTO_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_C + +#if defined(MBEDTLS_PSA_CRYPTO_CLIENT) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_CLIENT +# error "MBEDTLS_PSA_CRYPTO_CLIENT must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_CLIENT +# define MBEDTLS_PSA_CRYPTO_CLIENT +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_CLIENT + +#if defined(MBEDTLS_PSA_CRYPTO_CONFIG_FILE) //no-check-names +# error "MBEDTLS_PSA_CRYPTO_CONFIG_FILE was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG +# error "MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG +# define MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG + +#if defined(MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER +# error "MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER +# define MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER + +#if defined(MBEDTLS_PSA_CRYPTO_PLATFORM_FILE) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_PLATFORM_FILE +# error "MBEDTLS_PSA_CRYPTO_PLATFORM_FILE must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_PLATFORM_FILE +# define MBEDTLS_PSA_CRYPTO_PLATFORM_FILE +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_PLATFORM_FILE + +#if defined(MBEDTLS_PSA_CRYPTO_SE_C) //no-check-names +# error "MBEDTLS_PSA_CRYPTO_SE_C was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_PSA_CRYPTO_SPM) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_SPM +# error "MBEDTLS_PSA_CRYPTO_SPM must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_SPM +# define MBEDTLS_PSA_CRYPTO_SPM +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_SPM + +#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_STORAGE_C +# error "MBEDTLS_PSA_CRYPTO_STORAGE_C must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_STORAGE_C +# define MBEDTLS_PSA_CRYPTO_STORAGE_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_STORAGE_C + +#if defined(MBEDTLS_PSA_CRYPTO_STRUCT_FILE) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_STRUCT_FILE +# error "MBEDTLS_PSA_CRYPTO_STRUCT_FILE must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_STRUCT_FILE +# define MBEDTLS_PSA_CRYPTO_STRUCT_FILE +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_CRYPTO_STRUCT_FILE + +#if defined(MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE) //no-check-names +# error "MBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE) //no-check-names +# error "MBEDTLS_PSA_HMAC_DRBG_MD_TYPE was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_PSA_INJECT_ENTROPY) //no-check-names +# error "MBEDTLS_PSA_INJECT_ENTROPY was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_PSA_ITS_FILE_C) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_ITS_FILE_C +# error "MBEDTLS_PSA_ITS_FILE_C must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_ITS_FILE_C +# define MBEDTLS_PSA_ITS_FILE_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_ITS_FILE_C + +#if defined(MBEDTLS_PSA_KEY_SLOT_COUNT) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_KEY_SLOT_COUNT +# error "MBEDTLS_PSA_KEY_SLOT_COUNT must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_KEY_SLOT_COUNT +# define MBEDTLS_PSA_KEY_SLOT_COUNT +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_KEY_SLOT_COUNT + +#if defined(MBEDTLS_PSA_KEY_STORE_DYNAMIC) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_KEY_STORE_DYNAMIC +# error "MBEDTLS_PSA_KEY_STORE_DYNAMIC must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_KEY_STORE_DYNAMIC +# define MBEDTLS_PSA_KEY_STORE_DYNAMIC +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_KEY_STORE_DYNAMIC + +#if defined(MBEDTLS_PSA_P256M_DRIVER_ENABLED) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_P256M_DRIVER_ENABLED +# error "MBEDTLS_PSA_P256M_DRIVER_ENABLED must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_P256M_DRIVER_ENABLED +# define MBEDTLS_PSA_P256M_DRIVER_ENABLED +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_P256M_DRIVER_ENABLED + +#if defined(MBEDTLS_PSA_STATIC_KEY_SLOTS) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_STATIC_KEY_SLOTS +# error "MBEDTLS_PSA_STATIC_KEY_SLOTS must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_STATIC_KEY_SLOTS +# define MBEDTLS_PSA_STATIC_KEY_SLOTS +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_STATIC_KEY_SLOTS + +#if defined(MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE +# error "MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE +# define MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE + +#if defined(MBEDTLS_RIPEMD160_ALT) //no-check-names +# error "MBEDTLS_RIPEMD160_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_RIPEMD160_C) +# error "MBEDTLS_RIPEMD160_C is an internal macro of TF-PSA-Crypto and may not be configured." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_RIPEMD160_C +# define MBEDTLS_RIPEMD160_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_RIPEMD160_C + +#if defined(MBEDTLS_RIPEMD160_PROCESS_ALT) //no-check-names +# error "MBEDTLS_RIPEMD160_PROCESS_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_RSA_ALT) //no-check-names +# error "MBEDTLS_RSA_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_RSA_C) +# error "MBEDTLS_RSA_C is an internal macro of TF-PSA-Crypto and may not be configured." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_RSA_C +# define MBEDTLS_RSA_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_RSA_C + +#if defined(MBEDTLS_RSA_GEN_KEY_MIN_BITS) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_RSA_GEN_KEY_MIN_BITS +# error "MBEDTLS_RSA_GEN_KEY_MIN_BITS must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_RSA_GEN_KEY_MIN_BITS +# define MBEDTLS_RSA_GEN_KEY_MIN_BITS +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_RSA_GEN_KEY_MIN_BITS + +#if defined(MBEDTLS_RSA_NO_CRT) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_RSA_NO_CRT +# error "MBEDTLS_RSA_NO_CRT must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_RSA_NO_CRT +# define MBEDTLS_RSA_NO_CRT +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_RSA_NO_CRT + +#if defined(MBEDTLS_SELF_TEST) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SELF_TEST +# error "MBEDTLS_SELF_TEST must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SELF_TEST +# define MBEDTLS_SELF_TEST +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SELF_TEST + +#if defined(MBEDTLS_SHA1_ALT) //no-check-names +# error "MBEDTLS_SHA1_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_SHA1_C) +# error "MBEDTLS_SHA1_C is an internal macro of TF-PSA-Crypto and may not be configured." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA1_C +# define MBEDTLS_SHA1_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA1_C + +#if defined(MBEDTLS_SHA1_PROCESS_ALT) //no-check-names +# error "MBEDTLS_SHA1_PROCESS_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_SHA224_C) +# error "MBEDTLS_SHA224_C is an internal macro of TF-PSA-Crypto and may not be configured." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA224_C +# define MBEDTLS_SHA224_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA224_C + +#if defined(MBEDTLS_SHA256_ALT) //no-check-names +# error "MBEDTLS_SHA256_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_SHA256_C) +# error "MBEDTLS_SHA256_C is an internal macro of TF-PSA-Crypto and may not be configured." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA256_C +# define MBEDTLS_SHA256_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA256_C + +#if defined(MBEDTLS_SHA256_PROCESS_ALT) //no-check-names +# error "MBEDTLS_SHA256_PROCESS_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_SHA256_SMALLER) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA256_SMALLER +# error "MBEDTLS_SHA256_SMALLER must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA256_SMALLER +# define MBEDTLS_SHA256_SMALLER +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA256_SMALLER + +#if defined(MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT +# error "MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT +# define MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT + +#if defined(MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY +# error "MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY +# define MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY + +#if defined(MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT +# error "MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT +# define MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT + +#if defined(MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY +# error "MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY +# define MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY + +#if defined(MBEDTLS_SHA384_C) +# error "MBEDTLS_SHA384_C is an internal macro of TF-PSA-Crypto and may not be configured." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA384_C +# define MBEDTLS_SHA384_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA384_C + +#if defined(MBEDTLS_SHA3_C) //no-check-names +# error "MBEDTLS_SHA3_C was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_SHA512_ALT) //no-check-names +# error "MBEDTLS_SHA512_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_SHA512_C) +# error "MBEDTLS_SHA512_C is an internal macro of TF-PSA-Crypto and may not be configured." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA512_C +# define MBEDTLS_SHA512_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA512_C + +#if defined(MBEDTLS_SHA512_PROCESS_ALT) //no-check-names +# error "MBEDTLS_SHA512_PROCESS_ALT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_SHA512_SMALLER) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA512_SMALLER +# error "MBEDTLS_SHA512_SMALLER must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA512_SMALLER +# define MBEDTLS_SHA512_SMALLER +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA512_SMALLER + +#if defined(MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT +# error "MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT +# define MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT + +#if defined(MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY +# error "MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY +# define MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY + +#if defined(MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME) //no-check-names +# error "MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT) //no-check-names +# error "MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN +# error "MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN +# define MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN + +#if defined(MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND +# error "MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND +# define MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND + +#if defined(MBEDTLS_TEST_HOOKS) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_TEST_HOOKS +# error "MBEDTLS_TEST_HOOKS must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_TEST_HOOKS +# define MBEDTLS_TEST_HOOKS +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_TEST_HOOKS + +#if defined(MBEDTLS_THREADING_ALT) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_THREADING_ALT +# error "MBEDTLS_THREADING_ALT must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_THREADING_ALT +# define MBEDTLS_THREADING_ALT +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_THREADING_ALT + +#if defined(MBEDTLS_THREADING_C) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_THREADING_C +# error "MBEDTLS_THREADING_C must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_THREADING_C +# define MBEDTLS_THREADING_C +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_THREADING_C + +#if defined(MBEDTLS_THREADING_PTHREAD) && !MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_THREADING_PTHREAD +# error "MBEDTLS_THREADING_PTHREAD must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_THREADING_PTHREAD +# define MBEDTLS_THREADING_PTHREAD +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_MBEDTLS_THREADING_PTHREAD + +#if defined(PSA_CRYPTO_CONFIG_H) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_CRYPTO_CONFIG_H +# error "PSA_CRYPTO_CONFIG_H must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_CRYPTO_CONFIG_H +# define PSA_CRYPTO_CONFIG_H +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_CRYPTO_CONFIG_H + +#if defined(PSA_WANT_ALG_CBC_NO_PADDING) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CBC_NO_PADDING +# error "PSA_WANT_ALG_CBC_NO_PADDING must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CBC_NO_PADDING +# define PSA_WANT_ALG_CBC_NO_PADDING +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CBC_NO_PADDING + +#if defined(PSA_WANT_ALG_CBC_PKCS7) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CBC_PKCS7 +# error "PSA_WANT_ALG_CBC_PKCS7 must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CBC_PKCS7 +# define PSA_WANT_ALG_CBC_PKCS7 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CBC_PKCS7 + +#if defined(PSA_WANT_ALG_CCM) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CCM +# error "PSA_WANT_ALG_CCM must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CCM +# define PSA_WANT_ALG_CCM +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CCM + +#if defined(PSA_WANT_ALG_CCM_STAR_NO_TAG) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CCM_STAR_NO_TAG +# error "PSA_WANT_ALG_CCM_STAR_NO_TAG must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CCM_STAR_NO_TAG +# define PSA_WANT_ALG_CCM_STAR_NO_TAG +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CCM_STAR_NO_TAG + +#if defined(PSA_WANT_ALG_CFB) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CFB +# error "PSA_WANT_ALG_CFB must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CFB +# define PSA_WANT_ALG_CFB +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CFB + +#if defined(PSA_WANT_ALG_CHACHA20_POLY1305) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CHACHA20_POLY1305 +# error "PSA_WANT_ALG_CHACHA20_POLY1305 must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CHACHA20_POLY1305 +# define PSA_WANT_ALG_CHACHA20_POLY1305 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CHACHA20_POLY1305 + +#if defined(PSA_WANT_ALG_CMAC) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CMAC +# error "PSA_WANT_ALG_CMAC must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CMAC +# define PSA_WANT_ALG_CMAC +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CMAC + +#if defined(PSA_WANT_ALG_CTR) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CTR +# error "PSA_WANT_ALG_CTR must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CTR +# define PSA_WANT_ALG_CTR +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_CTR + +#if defined(PSA_WANT_ALG_DETERMINISTIC_ECDSA) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_DETERMINISTIC_ECDSA +# error "PSA_WANT_ALG_DETERMINISTIC_ECDSA must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_DETERMINISTIC_ECDSA +# define PSA_WANT_ALG_DETERMINISTIC_ECDSA +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_DETERMINISTIC_ECDSA + +#if defined(PSA_WANT_ALG_ECB_NO_PADDING) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_ECB_NO_PADDING +# error "PSA_WANT_ALG_ECB_NO_PADDING must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_ECB_NO_PADDING +# define PSA_WANT_ALG_ECB_NO_PADDING +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_ECB_NO_PADDING + +#if defined(PSA_WANT_ALG_ECDH) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_ECDH +# error "PSA_WANT_ALG_ECDH must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_ECDH +# define PSA_WANT_ALG_ECDH +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_ECDH + +#if defined(PSA_WANT_ALG_ECDSA) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_ECDSA +# error "PSA_WANT_ALG_ECDSA must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_ECDSA +# define PSA_WANT_ALG_ECDSA +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_ECDSA + +#if defined(PSA_WANT_ALG_FFDH) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_FFDH +# error "PSA_WANT_ALG_FFDH must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_FFDH +# define PSA_WANT_ALG_FFDH +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_FFDH + +#if defined(PSA_WANT_ALG_GCM) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_GCM +# error "PSA_WANT_ALG_GCM must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_GCM +# define PSA_WANT_ALG_GCM +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_GCM + +#if defined(PSA_WANT_ALG_HKDF) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_HKDF +# error "PSA_WANT_ALG_HKDF must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_HKDF +# define PSA_WANT_ALG_HKDF +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_HKDF + +#if defined(PSA_WANT_ALG_HKDF_EXPAND) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_HKDF_EXPAND +# error "PSA_WANT_ALG_HKDF_EXPAND must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_HKDF_EXPAND +# define PSA_WANT_ALG_HKDF_EXPAND +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_HKDF_EXPAND + +#if defined(PSA_WANT_ALG_HKDF_EXTRACT) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_HKDF_EXTRACT +# error "PSA_WANT_ALG_HKDF_EXTRACT must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_HKDF_EXTRACT +# define PSA_WANT_ALG_HKDF_EXTRACT +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_HKDF_EXTRACT + +#if defined(PSA_WANT_ALG_HMAC) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_HMAC +# error "PSA_WANT_ALG_HMAC must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_HMAC +# define PSA_WANT_ALG_HMAC +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_HMAC + +#if defined(PSA_WANT_ALG_JPAKE) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_JPAKE +# error "PSA_WANT_ALG_JPAKE must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_JPAKE +# define PSA_WANT_ALG_JPAKE +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_JPAKE + +#if defined(PSA_WANT_ALG_MD5) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_MD5 +# error "PSA_WANT_ALG_MD5 must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_MD5 +# define PSA_WANT_ALG_MD5 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_MD5 + +#if defined(PSA_WANT_ALG_OFB) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_OFB +# error "PSA_WANT_ALG_OFB must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_OFB +# define PSA_WANT_ALG_OFB +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_OFB + +#if defined(PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128 +# error "PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128 must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128 +# define PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128 + +#if defined(PSA_WANT_ALG_PBKDF2_HMAC) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_PBKDF2_HMAC +# error "PSA_WANT_ALG_PBKDF2_HMAC must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_PBKDF2_HMAC +# define PSA_WANT_ALG_PBKDF2_HMAC +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_PBKDF2_HMAC + +#if defined(PSA_WANT_ALG_RIPEMD160) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_RIPEMD160 +# error "PSA_WANT_ALG_RIPEMD160 must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_RIPEMD160 +# define PSA_WANT_ALG_RIPEMD160 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_RIPEMD160 + +#if defined(PSA_WANT_ALG_RSA_OAEP) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_RSA_OAEP +# error "PSA_WANT_ALG_RSA_OAEP must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_RSA_OAEP +# define PSA_WANT_ALG_RSA_OAEP +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_RSA_OAEP + +#if defined(PSA_WANT_ALG_RSA_PKCS1V15_CRYPT) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_RSA_PKCS1V15_CRYPT +# error "PSA_WANT_ALG_RSA_PKCS1V15_CRYPT must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_RSA_PKCS1V15_CRYPT +# define PSA_WANT_ALG_RSA_PKCS1V15_CRYPT +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_RSA_PKCS1V15_CRYPT + +#if defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_RSA_PKCS1V15_SIGN +# error "PSA_WANT_ALG_RSA_PKCS1V15_SIGN must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_RSA_PKCS1V15_SIGN +# define PSA_WANT_ALG_RSA_PKCS1V15_SIGN +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_RSA_PKCS1V15_SIGN + +#if defined(PSA_WANT_ALG_RSA_PSS) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_RSA_PSS +# error "PSA_WANT_ALG_RSA_PSS must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_RSA_PSS +# define PSA_WANT_ALG_RSA_PSS +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_RSA_PSS + +#if defined(PSA_WANT_ALG_SHA3_224) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA3_224 +# error "PSA_WANT_ALG_SHA3_224 must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA3_224 +# define PSA_WANT_ALG_SHA3_224 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA3_224 + +#if defined(PSA_WANT_ALG_SHA3_256) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA3_256 +# error "PSA_WANT_ALG_SHA3_256 must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA3_256 +# define PSA_WANT_ALG_SHA3_256 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA3_256 + +#if defined(PSA_WANT_ALG_SHA3_384) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA3_384 +# error "PSA_WANT_ALG_SHA3_384 must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA3_384 +# define PSA_WANT_ALG_SHA3_384 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA3_384 + +#if defined(PSA_WANT_ALG_SHA3_512) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA3_512 +# error "PSA_WANT_ALG_SHA3_512 must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA3_512 +# define PSA_WANT_ALG_SHA3_512 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA3_512 + +#if defined(PSA_WANT_ALG_SHA_1) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA_1 +# error "PSA_WANT_ALG_SHA_1 must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA_1 +# define PSA_WANT_ALG_SHA_1 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA_1 + +#if defined(PSA_WANT_ALG_SHA_224) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA_224 +# error "PSA_WANT_ALG_SHA_224 must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA_224 +# define PSA_WANT_ALG_SHA_224 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA_224 + +#if defined(PSA_WANT_ALG_SHA_256) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA_256 +# error "PSA_WANT_ALG_SHA_256 must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA_256 +# define PSA_WANT_ALG_SHA_256 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA_256 + +#if defined(PSA_WANT_ALG_SHA_384) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA_384 +# error "PSA_WANT_ALG_SHA_384 must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA_384 +# define PSA_WANT_ALG_SHA_384 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA_384 + +#if defined(PSA_WANT_ALG_SHA_512) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA_512 +# error "PSA_WANT_ALG_SHA_512 must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA_512 +# define PSA_WANT_ALG_SHA_512 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_SHA_512 + +#if defined(PSA_WANT_ALG_STREAM_CIPHER) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_STREAM_CIPHER +# error "PSA_WANT_ALG_STREAM_CIPHER must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_STREAM_CIPHER +# define PSA_WANT_ALG_STREAM_CIPHER +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_STREAM_CIPHER + +#if defined(PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS +# error "PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS +# define PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS + +#if defined(PSA_WANT_ALG_TLS12_PRF) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_TLS12_PRF +# error "PSA_WANT_ALG_TLS12_PRF must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_TLS12_PRF +# define PSA_WANT_ALG_TLS12_PRF +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_TLS12_PRF + +#if defined(PSA_WANT_ALG_TLS12_PSK_TO_MS) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_TLS12_PSK_TO_MS +# error "PSA_WANT_ALG_TLS12_PSK_TO_MS must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_TLS12_PSK_TO_MS +# define PSA_WANT_ALG_TLS12_PSK_TO_MS +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ALG_TLS12_PSK_TO_MS + +#if defined(PSA_WANT_DH_RFC7919_2048) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_DH_RFC7919_2048 +# error "PSA_WANT_DH_RFC7919_2048 must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_DH_RFC7919_2048 +# define PSA_WANT_DH_RFC7919_2048 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_DH_RFC7919_2048 + +#if defined(PSA_WANT_DH_RFC7919_3072) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_DH_RFC7919_3072 +# error "PSA_WANT_DH_RFC7919_3072 must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_DH_RFC7919_3072 +# define PSA_WANT_DH_RFC7919_3072 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_DH_RFC7919_3072 + +#if defined(PSA_WANT_DH_RFC7919_4096) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_DH_RFC7919_4096 +# error "PSA_WANT_DH_RFC7919_4096 must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_DH_RFC7919_4096 +# define PSA_WANT_DH_RFC7919_4096 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_DH_RFC7919_4096 + +#if defined(PSA_WANT_DH_RFC7919_6144) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_DH_RFC7919_6144 +# error "PSA_WANT_DH_RFC7919_6144 must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_DH_RFC7919_6144 +# define PSA_WANT_DH_RFC7919_6144 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_DH_RFC7919_6144 + +#if defined(PSA_WANT_DH_RFC7919_8192) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_DH_RFC7919_8192 +# error "PSA_WANT_DH_RFC7919_8192 must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_DH_RFC7919_8192 +# define PSA_WANT_DH_RFC7919_8192 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_DH_RFC7919_8192 + +#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_256) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_BRAINPOOL_P_R1_256 +# error "PSA_WANT_ECC_BRAINPOOL_P_R1_256 must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_BRAINPOOL_P_R1_256 +# define PSA_WANT_ECC_BRAINPOOL_P_R1_256 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_BRAINPOOL_P_R1_256 + +#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_384) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_BRAINPOOL_P_R1_384 +# error "PSA_WANT_ECC_BRAINPOOL_P_R1_384 must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_BRAINPOOL_P_R1_384 +# define PSA_WANT_ECC_BRAINPOOL_P_R1_384 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_BRAINPOOL_P_R1_384 + +#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_512) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_BRAINPOOL_P_R1_512 +# error "PSA_WANT_ECC_BRAINPOOL_P_R1_512 must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_BRAINPOOL_P_R1_512 +# define PSA_WANT_ECC_BRAINPOOL_P_R1_512 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_BRAINPOOL_P_R1_512 + +#if defined(PSA_WANT_ECC_MONTGOMERY_255) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_MONTGOMERY_255 +# error "PSA_WANT_ECC_MONTGOMERY_255 must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_MONTGOMERY_255 +# define PSA_WANT_ECC_MONTGOMERY_255 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_MONTGOMERY_255 + +#if defined(PSA_WANT_ECC_MONTGOMERY_448) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_MONTGOMERY_448 +# error "PSA_WANT_ECC_MONTGOMERY_448 must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_MONTGOMERY_448 +# define PSA_WANT_ECC_MONTGOMERY_448 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_MONTGOMERY_448 + +#if defined(PSA_WANT_ECC_SECP_K1_192) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_SECP_K1_192 +# error "PSA_WANT_ECC_SECP_K1_192 must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_SECP_K1_192 +# define PSA_WANT_ECC_SECP_K1_192 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_SECP_K1_192 + +#if defined(PSA_WANT_ECC_SECP_K1_256) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_SECP_K1_256 +# error "PSA_WANT_ECC_SECP_K1_256 must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_SECP_K1_256 +# define PSA_WANT_ECC_SECP_K1_256 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_SECP_K1_256 + +#if defined(PSA_WANT_ECC_SECP_R1_192) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_SECP_R1_192 +# error "PSA_WANT_ECC_SECP_R1_192 must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_SECP_R1_192 +# define PSA_WANT_ECC_SECP_R1_192 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_SECP_R1_192 + +#if defined(PSA_WANT_ECC_SECP_R1_224) //no-check-names +# error "PSA_WANT_ECC_SECP_R1_224 was removed in Mbed TLS 4.0." //no-check-names +#endif + +#if defined(PSA_WANT_ECC_SECP_R1_256) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_SECP_R1_256 +# error "PSA_WANT_ECC_SECP_R1_256 must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_SECP_R1_256 +# define PSA_WANT_ECC_SECP_R1_256 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_SECP_R1_256 + +#if defined(PSA_WANT_ECC_SECP_R1_384) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_SECP_R1_384 +# error "PSA_WANT_ECC_SECP_R1_384 must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_SECP_R1_384 +# define PSA_WANT_ECC_SECP_R1_384 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_SECP_R1_384 + +#if defined(PSA_WANT_ECC_SECP_R1_521) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_SECP_R1_521 +# error "PSA_WANT_ECC_SECP_R1_521 must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_SECP_R1_521 +# define PSA_WANT_ECC_SECP_R1_521 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_ECC_SECP_R1_521 + +#if defined(PSA_WANT_KEY_TYPE_AES) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_AES +# error "PSA_WANT_KEY_TYPE_AES must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_AES +# define PSA_WANT_KEY_TYPE_AES +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_AES + +#if defined(PSA_WANT_KEY_TYPE_ARIA) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ARIA +# error "PSA_WANT_KEY_TYPE_ARIA must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ARIA +# define PSA_WANT_KEY_TYPE_ARIA +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ARIA + +#if defined(PSA_WANT_KEY_TYPE_CAMELLIA) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_CAMELLIA +# error "PSA_WANT_KEY_TYPE_CAMELLIA must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_CAMELLIA +# define PSA_WANT_KEY_TYPE_CAMELLIA +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_CAMELLIA + +#if defined(PSA_WANT_KEY_TYPE_CHACHA20) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_CHACHA20 +# error "PSA_WANT_KEY_TYPE_CHACHA20 must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_CHACHA20 +# define PSA_WANT_KEY_TYPE_CHACHA20 +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_CHACHA20 + +#if defined(PSA_WANT_KEY_TYPE_DERIVE) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DERIVE +# error "PSA_WANT_KEY_TYPE_DERIVE must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DERIVE +# define PSA_WANT_KEY_TYPE_DERIVE +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DERIVE + +#if defined(PSA_WANT_KEY_TYPE_DES) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DES +# error "PSA_WANT_KEY_TYPE_DES must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DES +# define PSA_WANT_KEY_TYPE_DES +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DES + +#if defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC +# error "PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC +# define PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC + +#if defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_DERIVE) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DH_KEY_PAIR_DERIVE +# error "PSA_WANT_KEY_TYPE_DH_KEY_PAIR_DERIVE must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DH_KEY_PAIR_DERIVE +# define PSA_WANT_KEY_TYPE_DH_KEY_PAIR_DERIVE +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DH_KEY_PAIR_DERIVE + +#if defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT +# error "PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT +# define PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT + +#if defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE +# error "PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE +# define PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE + +#if defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT +# error "PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT +# define PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT + +#if defined(PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY +# error "PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY +# define PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY + +#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR +# error "PSA_WANT_KEY_TYPE_ECC_KEY_PAIR must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR +# define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR + +#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC +# error "PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC +# define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC + +#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE +# error "PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE +# define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE + +#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT +# error "PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT +# define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT + +#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE +# error "PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE +# define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE + +#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT +# error "PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT +# define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT + +#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY +# error "PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY +# define PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY + +#if defined(PSA_WANT_KEY_TYPE_HMAC) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_HMAC +# error "PSA_WANT_KEY_TYPE_HMAC must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_HMAC +# define PSA_WANT_KEY_TYPE_HMAC +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_HMAC + +#if defined(PSA_WANT_KEY_TYPE_PASSWORD) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_PASSWORD +# error "PSA_WANT_KEY_TYPE_PASSWORD must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_PASSWORD +# define PSA_WANT_KEY_TYPE_PASSWORD +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_PASSWORD + +#if defined(PSA_WANT_KEY_TYPE_PASSWORD_HASH) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_PASSWORD_HASH +# error "PSA_WANT_KEY_TYPE_PASSWORD_HASH must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_PASSWORD_HASH +# define PSA_WANT_KEY_TYPE_PASSWORD_HASH +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_PASSWORD_HASH + +#if defined(PSA_WANT_KEY_TYPE_RAW_DATA) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RAW_DATA +# error "PSA_WANT_KEY_TYPE_RAW_DATA must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RAW_DATA +# define PSA_WANT_KEY_TYPE_RAW_DATA +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RAW_DATA + +#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR +# error "PSA_WANT_KEY_TYPE_RSA_KEY_PAIR must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR +# define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR + +#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC +# error "PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC +# define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC + +#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_DERIVE) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_DERIVE +# error "PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_DERIVE must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_DERIVE +# define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_DERIVE +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_DERIVE + +#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT +# error "PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT +# define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT + +#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE +# error "PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE +# define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE + +#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT +# error "PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT +# define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT + +#if defined(PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY) && !MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY +# error "PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY must be configured in psa/crypto_config.h." +#endif +#if MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY +# define PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY +#endif +#undef MBEDTLS_CONFIG_CHECK_WASSET_PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY + +/* *INDENT-ON* */ + +#endif /* !defined(MBEDTLS_CONFIG_CHECK_BYPASS) */ //no-check-names + +/* End of automatically generated mbedtls_config_check_user.h */ diff --git a/library/ssl_debug_helpers_generated.c b/library/ssl_debug_helpers_generated.c new file mode 100644 index 0000000000..afbfa87d26 --- /dev/null +++ b/library/ssl_debug_helpers_generated.c @@ -0,0 +1,243 @@ +/* Automatically generated by generate_ssl_debug_helpers.py. DO NOT EDIT. */ + +/** + * \file ssl_debug_helpers_generated.c + * + * \brief Automatically generated helper functions for debugging + */ +/* + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + * + */ + +#include "ssl_misc.h" + +#if defined(MBEDTLS_DEBUG_C) + +#include "ssl_debug_helpers.h" + + +const char *mbedtls_ssl_named_group_to_str( uint16_t in ) +{ + switch( in ) + { + case MBEDTLS_SSL_IANA_TLS_GROUP_SECP256K1: + return "secp256k1"; + case MBEDTLS_SSL_IANA_TLS_GROUP_SECP256R1: + return "secp256r1"; + case MBEDTLS_SSL_IANA_TLS_GROUP_SECP384R1: + return "secp384r1"; + case MBEDTLS_SSL_IANA_TLS_GROUP_SECP521R1: + return "secp521r1"; + case MBEDTLS_SSL_IANA_TLS_GROUP_BP256R1: + return "bp256r1"; + case MBEDTLS_SSL_IANA_TLS_GROUP_BP384R1: + return "bp384r1"; + case MBEDTLS_SSL_IANA_TLS_GROUP_BP512R1: + return "bp512r1"; + case MBEDTLS_SSL_IANA_TLS_GROUP_X25519: + return "x25519"; + case MBEDTLS_SSL_IANA_TLS_GROUP_X448: + return "x448"; + case MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE2048: + return "ffdhe2048"; + case MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE3072: + return "ffdhe3072"; + case MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE4096: + return "ffdhe4096"; + case MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE6144: + return "ffdhe6144"; + case MBEDTLS_SSL_IANA_TLS_GROUP_FFDHE8192: + return "ffdhe8192"; + }; + + return "UNKNOWN"; +} +const char *mbedtls_ssl_sig_alg_to_str( uint16_t in ) +{ + switch( in ) + { + case MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA256: + return "rsa_pkcs1_sha256"; + case MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA384: + return "rsa_pkcs1_sha384"; + case MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA512: + return "rsa_pkcs1_sha512"; + case MBEDTLS_TLS1_3_SIG_ECDSA_SECP256R1_SHA256: + return "ecdsa_secp256r1_sha256"; + case MBEDTLS_TLS1_3_SIG_ECDSA_SECP384R1_SHA384: + return "ecdsa_secp384r1_sha384"; + case MBEDTLS_TLS1_3_SIG_ECDSA_SECP521R1_SHA512: + return "ecdsa_secp521r1_sha512"; + case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA256: + return "rsa_pss_rsae_sha256"; + case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA384: + return "rsa_pss_rsae_sha384"; + case MBEDTLS_TLS1_3_SIG_RSA_PSS_RSAE_SHA512: + return "rsa_pss_rsae_sha512"; + case MBEDTLS_TLS1_3_SIG_ED25519: + return "ed25519"; + case MBEDTLS_TLS1_3_SIG_ED448: + return "ed448"; + case MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA256: + return "rsa_pss_pss_sha256"; + case MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA384: + return "rsa_pss_pss_sha384"; + case MBEDTLS_TLS1_3_SIG_RSA_PSS_PSS_SHA512: + return "rsa_pss_pss_sha512"; + case MBEDTLS_TLS1_3_SIG_RSA_PKCS1_SHA1: + return "rsa_pkcs1_sha1"; + case MBEDTLS_TLS1_3_SIG_ECDSA_SHA1: + return "ecdsa_sha1"; + case MBEDTLS_TLS1_3_SIG_NONE: + return "none"; + }; + + return "UNKNOWN"; +} +const char *mbedtls_ssl_states_str( mbedtls_ssl_states in ) +{ + switch (in) { + case MBEDTLS_SSL_HELLO_REQUEST: + return "MBEDTLS_SSL_HELLO_REQUEST"; + case MBEDTLS_SSL_CLIENT_HELLO: + return "MBEDTLS_SSL_CLIENT_HELLO"; + case MBEDTLS_SSL_SERVER_HELLO: + return "MBEDTLS_SSL_SERVER_HELLO"; + case MBEDTLS_SSL_SERVER_CERTIFICATE: + return "MBEDTLS_SSL_SERVER_CERTIFICATE"; + case MBEDTLS_SSL_SERVER_KEY_EXCHANGE: + return "MBEDTLS_SSL_SERVER_KEY_EXCHANGE"; + case MBEDTLS_SSL_CERTIFICATE_REQUEST: + return "MBEDTLS_SSL_CERTIFICATE_REQUEST"; + case MBEDTLS_SSL_SERVER_HELLO_DONE: + return "MBEDTLS_SSL_SERVER_HELLO_DONE"; + case MBEDTLS_SSL_CLIENT_CERTIFICATE: + return "MBEDTLS_SSL_CLIENT_CERTIFICATE"; + case MBEDTLS_SSL_CLIENT_KEY_EXCHANGE: + return "MBEDTLS_SSL_CLIENT_KEY_EXCHANGE"; + case MBEDTLS_SSL_CERTIFICATE_VERIFY: + return "MBEDTLS_SSL_CERTIFICATE_VERIFY"; + case MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC: + return "MBEDTLS_SSL_CLIENT_CHANGE_CIPHER_SPEC"; + case MBEDTLS_SSL_CLIENT_FINISHED: + return "MBEDTLS_SSL_CLIENT_FINISHED"; + case MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC: + return "MBEDTLS_SSL_SERVER_CHANGE_CIPHER_SPEC"; + case MBEDTLS_SSL_SERVER_FINISHED: + return "MBEDTLS_SSL_SERVER_FINISHED"; + case MBEDTLS_SSL_FLUSH_BUFFERS: + return "MBEDTLS_SSL_FLUSH_BUFFERS"; + case MBEDTLS_SSL_HANDSHAKE_WRAPUP: + return "MBEDTLS_SSL_HANDSHAKE_WRAPUP"; + case MBEDTLS_SSL_NEW_SESSION_TICKET: + return "MBEDTLS_SSL_NEW_SESSION_TICKET"; + case MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT: + return "MBEDTLS_SSL_SERVER_HELLO_VERIFY_REQUEST_SENT"; + case MBEDTLS_SSL_HELLO_RETRY_REQUEST: + return "MBEDTLS_SSL_HELLO_RETRY_REQUEST"; + case MBEDTLS_SSL_ENCRYPTED_EXTENSIONS: + return "MBEDTLS_SSL_ENCRYPTED_EXTENSIONS"; + case MBEDTLS_SSL_END_OF_EARLY_DATA: + return "MBEDTLS_SSL_END_OF_EARLY_DATA"; + case MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY: + return "MBEDTLS_SSL_CLIENT_CERTIFICATE_VERIFY"; + case MBEDTLS_SSL_CLIENT_CCS_AFTER_SERVER_FINISHED: + return "MBEDTLS_SSL_CLIENT_CCS_AFTER_SERVER_FINISHED"; + case MBEDTLS_SSL_CLIENT_CCS_BEFORE_2ND_CLIENT_HELLO: + return "MBEDTLS_SSL_CLIENT_CCS_BEFORE_2ND_CLIENT_HELLO"; + case MBEDTLS_SSL_SERVER_CCS_AFTER_SERVER_HELLO: + return "MBEDTLS_SSL_SERVER_CCS_AFTER_SERVER_HELLO"; + case MBEDTLS_SSL_CLIENT_CCS_AFTER_CLIENT_HELLO: + return "MBEDTLS_SSL_CLIENT_CCS_AFTER_CLIENT_HELLO"; + case MBEDTLS_SSL_SERVER_CCS_AFTER_HELLO_RETRY_REQUEST: + return "MBEDTLS_SSL_SERVER_CCS_AFTER_HELLO_RETRY_REQUEST"; + case MBEDTLS_SSL_HANDSHAKE_OVER: + return "MBEDTLS_SSL_HANDSHAKE_OVER"; + case MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET: + return "MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET"; + case MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET_FLUSH: + return "MBEDTLS_SSL_TLS1_3_NEW_SESSION_TICKET_FLUSH"; + default: + return "UNKNOWN_VALUE"; + } +} + +#if defined(MBEDTLS_SSL_EARLY_DATA) && defined(MBEDTLS_SSL_CLI_C) +const char *mbedtls_ssl_early_data_status_str( mbedtls_ssl_early_data_status in ) +{ + switch (in) { + case MBEDTLS_SSL_EARLY_DATA_STATUS_NOT_INDICATED: + return "MBEDTLS_SSL_EARLY_DATA_STATUS_NOT_INDICATED"; + case MBEDTLS_SSL_EARLY_DATA_STATUS_ACCEPTED: + return "MBEDTLS_SSL_EARLY_DATA_STATUS_ACCEPTED"; + case MBEDTLS_SSL_EARLY_DATA_STATUS_REJECTED: + return "MBEDTLS_SSL_EARLY_DATA_STATUS_REJECTED"; + default: + return "UNKNOWN_VALUE"; + } +} + +#endif /* defined(MBEDTLS_SSL_EARLY_DATA) && defined(MBEDTLS_SSL_CLI_C) */ +const char *mbedtls_ssl_protocol_version_str( mbedtls_ssl_protocol_version in ) +{ + switch (in) { + case MBEDTLS_SSL_VERSION_UNKNOWN: + return "MBEDTLS_SSL_VERSION_UNKNOWN"; + case MBEDTLS_SSL_VERSION_TLS1_2: + return "MBEDTLS_SSL_VERSION_TLS1_2"; + case MBEDTLS_SSL_VERSION_TLS1_3: + return "MBEDTLS_SSL_VERSION_TLS1_3"; + default: + return "UNKNOWN_VALUE"; + } +} + +const char *mbedtls_tls_prf_types_str( mbedtls_tls_prf_types in ) +{ + switch (in) { + case MBEDTLS_SSL_TLS_PRF_NONE: + return "MBEDTLS_SSL_TLS_PRF_NONE"; + case MBEDTLS_SSL_TLS_PRF_SHA384: + return "MBEDTLS_SSL_TLS_PRF_SHA384"; + case MBEDTLS_SSL_TLS_PRF_SHA256: + return "MBEDTLS_SSL_TLS_PRF_SHA256"; + case MBEDTLS_SSL_HKDF_EXPAND_SHA384: + return "MBEDTLS_SSL_HKDF_EXPAND_SHA384"; + case MBEDTLS_SSL_HKDF_EXPAND_SHA256: + return "MBEDTLS_SSL_HKDF_EXPAND_SHA256"; + default: + return "UNKNOWN_VALUE"; + } +} + +const char *mbedtls_ssl_key_export_type_str( mbedtls_ssl_key_export_type in ) +{ + switch (in) { + case MBEDTLS_SSL_KEY_EXPORT_TLS12_MASTER_SECRET: + return "MBEDTLS_SSL_KEY_EXPORT_TLS12_MASTER_SECRET"; +#if defined(MBEDTLS_SSL_PROTO_TLS1_3) + case MBEDTLS_SSL_KEY_EXPORT_TLS1_3_CLIENT_EARLY_SECRET: + return "MBEDTLS_SSL_KEY_EXPORT_TLS1_3_CLIENT_EARLY_SECRET"; + case MBEDTLS_SSL_KEY_EXPORT_TLS1_3_EARLY_EXPORTER_SECRET: + return "MBEDTLS_SSL_KEY_EXPORT_TLS1_3_EARLY_EXPORTER_SECRET"; + case MBEDTLS_SSL_KEY_EXPORT_TLS1_3_CLIENT_HANDSHAKE_TRAFFIC_SECRET: + return "MBEDTLS_SSL_KEY_EXPORT_TLS1_3_CLIENT_HANDSHAKE_TRAFFIC_SECRET"; + case MBEDTLS_SSL_KEY_EXPORT_TLS1_3_SERVER_HANDSHAKE_TRAFFIC_SECRET: + return "MBEDTLS_SSL_KEY_EXPORT_TLS1_3_SERVER_HANDSHAKE_TRAFFIC_SECRET"; + case MBEDTLS_SSL_KEY_EXPORT_TLS1_3_CLIENT_APPLICATION_TRAFFIC_SECRET: + return "MBEDTLS_SSL_KEY_EXPORT_TLS1_3_CLIENT_APPLICATION_TRAFFIC_SECRET"; + case MBEDTLS_SSL_KEY_EXPORT_TLS1_3_SERVER_APPLICATION_TRAFFIC_SECRET: + return "MBEDTLS_SSL_KEY_EXPORT_TLS1_3_SERVER_APPLICATION_TRAFFIC_SECRET"; +#endif + default: + return "UNKNOWN_VALUE"; + } +} + + + +#endif /* MBEDTLS_DEBUG_C */ +/* End of automatically generated file. */ + diff --git a/library/version_features.c b/library/version_features.c new file mode 100644 index 0000000000..c59575405b --- /dev/null +++ b/library/version_features.c @@ -0,0 +1,244 @@ +/* + * Version feature information + * + * Copyright The Mbed TLS Contributors + * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later + */ + +#include "ssl_misc.h" + +#if defined(MBEDTLS_VERSION_C) + +#include "mbedtls/version.h" + +#include + +static const char * const features[] = { +#if defined(MBEDTLS_VERSION_FEATURES) + #if defined(MBEDTLS_NET_C) + "NET_C", //no-check-names +#endif /* MBEDTLS_NET_C */ +#if defined(MBEDTLS_TIMING_ALT) + "TIMING_ALT", //no-check-names +#endif /* MBEDTLS_TIMING_ALT */ +#if defined(MBEDTLS_TIMING_C) + "TIMING_C", //no-check-names +#endif /* MBEDTLS_TIMING_C */ +#if defined(MBEDTLS_ERROR_C) + "ERROR_C", //no-check-names +#endif /* MBEDTLS_ERROR_C */ +#if defined(MBEDTLS_ERROR_STRERROR_DUMMY) + "ERROR_STRERROR_DUMMY", //no-check-names +#endif /* MBEDTLS_ERROR_STRERROR_DUMMY */ +#if defined(MBEDTLS_VERSION_C) + "VERSION_C", //no-check-names +#endif /* MBEDTLS_VERSION_C */ +#if defined(MBEDTLS_VERSION_FEATURES) + "VERSION_FEATURES", //no-check-names +#endif /* MBEDTLS_VERSION_FEATURES */ +#if defined(MBEDTLS_CONFIG_FILE) + "CONFIG_FILE", //no-check-names +#endif /* MBEDTLS_CONFIG_FILE */ +#if defined(MBEDTLS_USER_CONFIG_FILE) + "USER_CONFIG_FILE", //no-check-names +#endif /* MBEDTLS_USER_CONFIG_FILE */ +#if defined(MBEDTLS_SSL_NULL_CIPHERSUITES) + "SSL_NULL_CIPHERSUITES", //no-check-names +#endif /* MBEDTLS_SSL_NULL_CIPHERSUITES */ +#if defined(MBEDTLS_DEBUG_C) + "DEBUG_C", //no-check-names +#endif /* MBEDTLS_DEBUG_C */ +#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED) + "KEY_EXCHANGE_ECDHE_ECDSA_ENABLED", //no-check-names +#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED */ +#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED) + "KEY_EXCHANGE_ECDHE_PSK_ENABLED", //no-check-names +#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED */ +#if defined(MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED) + "KEY_EXCHANGE_ECDHE_RSA_ENABLED", //no-check-names +#endif /* MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED */ +#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED) + "KEY_EXCHANGE_ECJPAKE_ENABLED", //no-check-names +#endif /* MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED */ +#if defined(MBEDTLS_KEY_EXCHANGE_PSK_ENABLED) + "KEY_EXCHANGE_PSK_ENABLED", //no-check-names +#endif /* MBEDTLS_KEY_EXCHANGE_PSK_ENABLED */ +#if defined(MBEDTLS_SSL_ALL_ALERT_MESSAGES) + "SSL_ALL_ALERT_MESSAGES", //no-check-names +#endif /* MBEDTLS_SSL_ALL_ALERT_MESSAGES */ +#if defined(MBEDTLS_SSL_ALPN) + "SSL_ALPN", //no-check-names +#endif /* MBEDTLS_SSL_ALPN */ +#if defined(MBEDTLS_SSL_ASYNC_PRIVATE) + "SSL_ASYNC_PRIVATE", //no-check-names +#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */ +#if defined(MBEDTLS_SSL_CACHE_C) + "SSL_CACHE_C", //no-check-names +#endif /* MBEDTLS_SSL_CACHE_C */ +#if defined(MBEDTLS_SSL_CLI_C) + "SSL_CLI_C", //no-check-names +#endif /* MBEDTLS_SSL_CLI_C */ +#if defined(MBEDTLS_SSL_CONTEXT_SERIALIZATION) + "SSL_CONTEXT_SERIALIZATION", //no-check-names +#endif /* MBEDTLS_SSL_CONTEXT_SERIALIZATION */ +#if defined(MBEDTLS_SSL_COOKIE_C) + "SSL_COOKIE_C", //no-check-names +#endif /* MBEDTLS_SSL_COOKIE_C */ +#if defined(MBEDTLS_SSL_DEBUG_ALL) + "SSL_DEBUG_ALL", //no-check-names +#endif /* MBEDTLS_SSL_DEBUG_ALL */ +#if defined(MBEDTLS_SSL_DTLS_ANTI_REPLAY) + "SSL_DTLS_ANTI_REPLAY", //no-check-names +#endif /* MBEDTLS_SSL_DTLS_ANTI_REPLAY */ +#if defined(MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE) + "SSL_DTLS_CLIENT_PORT_REUSE", //no-check-names +#endif /* MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE */ +#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) + "SSL_DTLS_CONNECTION_ID", //no-check-names +#endif /* MBEDTLS_SSL_DTLS_CONNECTION_ID */ +#if defined(MBEDTLS_SSL_DTLS_HELLO_VERIFY) + "SSL_DTLS_HELLO_VERIFY", //no-check-names +#endif /* MBEDTLS_SSL_DTLS_HELLO_VERIFY */ +#if defined(MBEDTLS_SSL_DTLS_SRTP) + "SSL_DTLS_SRTP", //no-check-names +#endif /* MBEDTLS_SSL_DTLS_SRTP */ +#if defined(MBEDTLS_SSL_EARLY_DATA) + "SSL_EARLY_DATA", //no-check-names +#endif /* MBEDTLS_SSL_EARLY_DATA */ +#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC) + "SSL_ENCRYPT_THEN_MAC", //no-check-names +#endif /* MBEDTLS_SSL_ENCRYPT_THEN_MAC */ +#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) + "SSL_EXTENDED_MASTER_SECRET", //no-check-names +#endif /* MBEDTLS_SSL_EXTENDED_MASTER_SECRET */ +#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) + "SSL_KEEP_PEER_CERTIFICATE", //no-check-names +#endif /* MBEDTLS_SSL_KEEP_PEER_CERTIFICATE */ +#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) + "SSL_MAX_FRAGMENT_LENGTH", //no-check-names +#endif /* MBEDTLS_SSL_MAX_FRAGMENT_LENGTH */ +#if defined(MBEDTLS_SSL_PROTO_DTLS) + "SSL_PROTO_DTLS", //no-check-names +#endif /* MBEDTLS_SSL_PROTO_DTLS */ +#if defined(MBEDTLS_SSL_PROTO_TLS1_2) + "SSL_PROTO_TLS1_2", //no-check-names +#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ +#if defined(MBEDTLS_SSL_PROTO_TLS1_3) + "SSL_PROTO_TLS1_3", //no-check-names +#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ +#if defined(MBEDTLS_SSL_RECORD_SIZE_LIMIT) + "SSL_RECORD_SIZE_LIMIT", //no-check-names +#endif /* MBEDTLS_SSL_RECORD_SIZE_LIMIT */ +#if defined(MBEDTLS_SSL_KEYING_MATERIAL_EXPORT) + "SSL_KEYING_MATERIAL_EXPORT", //no-check-names +#endif /* MBEDTLS_SSL_KEYING_MATERIAL_EXPORT */ +#if defined(MBEDTLS_SSL_RENEGOTIATION) + "SSL_RENEGOTIATION", //no-check-names +#endif /* MBEDTLS_SSL_RENEGOTIATION */ +#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION) + "SSL_SERVER_NAME_INDICATION", //no-check-names +#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */ +#if defined(MBEDTLS_SSL_SESSION_TICKETS) + "SSL_SESSION_TICKETS", //no-check-names +#endif /* MBEDTLS_SSL_SESSION_TICKETS */ +#if defined(MBEDTLS_SSL_SRV_C) + "SSL_SRV_C", //no-check-names +#endif /* MBEDTLS_SSL_SRV_C */ +#if defined(MBEDTLS_SSL_TICKET_C) + "SSL_TICKET_C", //no-check-names +#endif /* MBEDTLS_SSL_TICKET_C */ +#if defined(MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE) + "SSL_TLS1_3_COMPATIBILITY_MODE", //no-check-names +#endif /* MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE */ +#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED) + "SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED", //no-check-names +#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */ +#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED) + "SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED", //no-check-names +#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED */ +#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED) + "SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED", //no-check-names +#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED */ +#if defined(MBEDTLS_SSL_TLS_C) + "SSL_TLS_C", //no-check-names +#endif /* MBEDTLS_SSL_TLS_C */ +#if defined(MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH) + "SSL_VARIABLE_BUFFER_LENGTH", //no-check-names +#endif /* MBEDTLS_SSL_VARIABLE_BUFFER_LENGTH */ +#if defined(MBEDTLS_PSK_MAX_LEN) + "PSK_MAX_LEN", //no-check-names +#endif /* MBEDTLS_PSK_MAX_LEN */ +#if defined(MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES) + "SSL_CACHE_DEFAULT_MAX_ENTRIES", //no-check-names +#endif /* MBEDTLS_SSL_CACHE_DEFAULT_MAX_ENTRIES */ +#if defined(MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT) + "SSL_CACHE_DEFAULT_TIMEOUT", //no-check-names +#endif /* MBEDTLS_SSL_CACHE_DEFAULT_TIMEOUT */ +#if defined(MBEDTLS_SSL_CID_IN_LEN_MAX) + "SSL_CID_IN_LEN_MAX", //no-check-names +#endif /* MBEDTLS_SSL_CID_IN_LEN_MAX */ +#if defined(MBEDTLS_SSL_CID_OUT_LEN_MAX) + "SSL_CID_OUT_LEN_MAX", //no-check-names +#endif /* MBEDTLS_SSL_CID_OUT_LEN_MAX */ +#if defined(MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY) + "SSL_CID_TLS1_3_PADDING_GRANULARITY", //no-check-names +#endif /* MBEDTLS_SSL_CID_TLS1_3_PADDING_GRANULARITY */ +#if defined(MBEDTLS_SSL_CIPHERSUITES) + "SSL_CIPHERSUITES", //no-check-names +#endif /* MBEDTLS_SSL_CIPHERSUITES */ +#if defined(MBEDTLS_SSL_COOKIE_TIMEOUT) + "SSL_COOKIE_TIMEOUT", //no-check-names +#endif /* MBEDTLS_SSL_COOKIE_TIMEOUT */ +#if defined(MBEDTLS_SSL_DTLS_MAX_BUFFERING) + "SSL_DTLS_MAX_BUFFERING", //no-check-names +#endif /* MBEDTLS_SSL_DTLS_MAX_BUFFERING */ +#if defined(MBEDTLS_SSL_IN_CONTENT_LEN) + "SSL_IN_CONTENT_LEN", //no-check-names +#endif /* MBEDTLS_SSL_IN_CONTENT_LEN */ +#if defined(MBEDTLS_SSL_MAX_EARLY_DATA_SIZE) + "SSL_MAX_EARLY_DATA_SIZE", //no-check-names +#endif /* MBEDTLS_SSL_MAX_EARLY_DATA_SIZE */ +#if defined(MBEDTLS_SSL_OUT_CONTENT_LEN) + "SSL_OUT_CONTENT_LEN", //no-check-names +#endif /* MBEDTLS_SSL_OUT_CONTENT_LEN */ +#if defined(MBEDTLS_SSL_TLS1_3_DEFAULT_NEW_SESSION_TICKETS) + "SSL_TLS1_3_DEFAULT_NEW_SESSION_TICKETS", //no-check-names +#endif /* MBEDTLS_SSL_TLS1_3_DEFAULT_NEW_SESSION_TICKETS */ +#if defined(MBEDTLS_SSL_TLS1_3_TICKET_AGE_TOLERANCE) + "SSL_TLS1_3_TICKET_AGE_TOLERANCE", //no-check-names +#endif /* MBEDTLS_SSL_TLS1_3_TICKET_AGE_TOLERANCE */ +#if defined(MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH) + "SSL_TLS1_3_TICKET_NONCE_LENGTH", //no-check-names +#endif /* MBEDTLS_SSL_TLS1_3_TICKET_NONCE_LENGTH */ +#endif /* MBEDTLS_VERSION_FEATURES */ + NULL +}; + +int mbedtls_version_check_feature(const char *feature) +{ + const char * const *idx = features; + + if (*idx == NULL) { + return -2; + } + + if (feature == NULL) { + return -1; + } + + if (strncmp(feature, "MBEDTLS_", 8)) { + return -1; + } + + feature += 8; + + while (*idx != NULL) { + if (!strcmp(*idx, feature)) { + return 0; + } + idx++; + } + return -1; +} + +#endif /* MBEDTLS_VERSION_C */ diff --git a/tf-psa-crypto b/tf-psa-crypto new file mode 160000 index 0000000000..d0351902c7 --- /dev/null +++ b/tf-psa-crypto @@ -0,0 +1 @@ +Subproject commit d0351902c725dc192b8978ee8466a1621fa6c82d diff --git a/tf-psa-crypto/core/CMakeLists.txt b/tf-psa-crypto/core/CMakeLists.txt deleted file mode 100644 index 05a42d77a8..0000000000 --- a/tf-psa-crypto/core/CMakeLists.txt +++ /dev/null @@ -1,156 +0,0 @@ -set(src_crypto - psa_crypto.c - psa_crypto_client.c - psa_crypto_driver_wrappers_no_static.c - psa_crypto_slot_management.c - psa_crypto_storage.c - psa_its_file.c -) - -if(GEN_FILES) - add_custom_command( - OUTPUT - ${CMAKE_CURRENT_BINARY_DIR}/psa_crypto_driver_wrappers.h - ${CMAKE_CURRENT_BINARY_DIR}/psa_crypto_driver_wrappers_no_static.c - COMMAND - ${TF_PSA_CRYPTO_PYTHON_EXECUTABLE} - ${TF_PSA_CRYPTO_DIR}/scripts/generate_driver_wrappers.py - ${CMAKE_CURRENT_BINARY_DIR} - DEPENDS - ${TF_PSA_CRYPTO_DIR}/scripts/generate_driver_wrappers.py - ${TF_PSA_CRYPTO_DIR}/scripts/data_files/driver_templates/psa_crypto_driver_wrappers.h.jinja - ${TF_PSA_CRYPTO_DIR}/scripts/data_files/driver_templates/psa_crypto_driver_wrappers_no_static.c.jinja - ) -else() - link_to_source(psa_crypto_driver_wrappers.h) - link_to_source(psa_crypto_driver_wrappers_no_static.c) -endif() - -if(CMAKE_COMPILER_IS_GNUCC) - set(LIBS_C_FLAGS -Wmissing-declarations -Wmissing-prototypes) -endif(CMAKE_COMPILER_IS_GNUCC) - -if(CMAKE_COMPILER_IS_CLANG) - set(LIBS_C_FLAGS -Wmissing-declarations -Wmissing-prototypes -Wno-documentation-deprecated-sync -Wunreachable-code) -endif(CMAKE_COMPILER_IS_CLANG) - -if(CMAKE_COMPILER_IS_MSVC) - option(MSVC_STATIC_RUNTIME "Build the libraries with /MT compiler flag" OFF) - if(MSVC_STATIC_RUNTIME) - foreach(flag_var - CMAKE_C_FLAGS CMAKE_C_FLAGS_DEBUG CMAKE_C_FLAGS_RELEASE - CMAKE_C_FLAGS_MINSIZEREL CMAKE_C_FLAGS_RELWITHDEBINFO - CMAKE_C_FLAGS_CHECK) - string(REGEX REPLACE "/MD" "/MT" ${flag_var} "${${flag_var}}") - endforeach(flag_var) - endif() -endif() - -if(CMAKE_C_COMPILER_ID MATCHES "AppleClang") - set(CMAKE_C_ARCHIVE_CREATE " Scr ") - set(CMAKE_C_ARCHIVE_FINISH " -no_warning_for_no_symbols -c ") -endif() -if(CMAKE_CXX_COMPILER_ID MATCHES "AppleClang") - set(CMAKE_CXX_ARCHIVE_CREATE " Scr ") - set(CMAKE_CXX_ARCHIVE_FINISH " -no_warning_for_no_symbols -c ") -endif() - -if(LINK_WITH_PTHREAD) - set(libs ${libs} ${CMAKE_THREAD_LIBS_INIT}) -endif() - -if(LINK_WITH_TRUSTED_STORAGE) - set(libs ${libs} trusted_storage) -endif() - -if (NOT USE_STATIC_TF_PSA_CRYPTO_LIBRARY AND NOT USE_SHARED_TF_PSA_CRYPTO_LIBRARY) - message(FATAL_ERROR "Need to choose static or shared TF-PSA-Crypto build!") -endif(NOT USE_STATIC_TF_PSA_CRYPTO_LIBRARY AND NOT USE_SHARED_TF_PSA_CRYPTO_LIBRARY) - -set(tfpsacrypto_target "${TF_PSA_CRYPTO_TARGET_PREFIX}tfpsacrypto") -set(builtin_target "${TF_PSA_CRYPTO_TARGET_PREFIX}builtin") - -if (USE_STATIC_TF_PSA_CRYPTO_LIBRARY) - set(tfpsacrypto_static_target ${tfpsacrypto_target}) - set(builtin_static_target ${builtin_target}) -endif() - -set(target_libraries ${tfpsacrypto_target}) - -if(USE_STATIC_TF_PSA_CRYPTO_LIBRARY AND USE_SHARED_TF_PSA_CRYPTO_LIBRARY) - string(APPEND tfpsacrypto_static_target "_static") - string(APPEND builtin_static_target "_static") - - list(APPEND target_libraries - ${tfpsacrypto_static_target}) -endif() - -set(p256m_target "${TF_PSA_CRYPTO_TARGET_PREFIX}p256m") -set(everest_target "${TF_PSA_CRYPTO_TARGET_PREFIX}everest") - -if(USE_STATIC_TF_PSA_CRYPTO_LIBRARY) - add_library(${tfpsacrypto_static_target} STATIC ${src_crypto}) - set_base_compile_options(${tfpsacrypto_static_target}) - target_compile_options(${tfpsacrypto_static_target} PRIVATE ${LIBS_C_FLAGS}) - set_target_properties(${tfpsacrypto_static_target} PROPERTIES OUTPUT_NAME tfpsacrypto) - target_link_libraries(${tfpsacrypto_static_target} PUBLIC ${libs}) - - target_link_libraries(${tfpsacrypto_static_target} PUBLIC ${builtin_static_target}) - - if(TARGET ${everest_target}) - target_link_libraries(${tfpsacrypto_static_target} PUBLIC ${everest_target}) - endif() - - if(TARGET ${p256m_target}) - target_link_libraries(${tfpsacrypto_static_target} PUBLIC ${p256m_target}) - endif() -endif(USE_STATIC_TF_PSA_CRYPTO_LIBRARY) - -if(USE_SHARED_TF_PSA_CRYPTO_LIBRARY) - set(CMAKE_LIBRARY_PATH ${CMAKE_CURRENT_BINARY_DIR}) - add_library(${tfpsacrypto_target} SHARED ${src_crypto}) - set_base_compile_options(${tfpsacrypto_target}) - target_compile_options(${tfpsacrypto_target} PRIVATE ${LIBS_C_FLAGS}) - set_target_properties(${tfpsacrypto_target} PROPERTIES VERSION 4.0.0 SOVERSION 16) - target_link_libraries(${tfpsacrypto_target} PUBLIC ${libs}) - - target_link_libraries(${tfpsacrypto_target} PUBLIC ${builtin_target}) - - if(TARGET ${everest_target}) - target_link_libraries(${tfpsacrypto_target} PUBLIC ${everest_target}) - endif() - - if(TARGET ${p256m_target}) - target_link_libraries(${tfpsacrypto_target} PUBLIC ${p256m_target}) - endif() -endif(USE_SHARED_TF_PSA_CRYPTO_LIBRARY) - -foreach(target IN LISTS target_libraries) - add_library(TF-PSA-Crypto::${target} ALIAS ${target}) # add_subdirectory support - # Include public header files include/, drivers/builtin/include/ and - # ${MBEDTLS_DIR}/include/ as we still need it. Include private header files - # from core/ and drivers/builtin/src/. - target_include_directories(${target} - PUBLIC $ - $ - $ - PRIVATE ${TF_PSA_CRYPTO_DIR}/core - ${TF_PSA_CRYPTO_DIR}/drivers/builtin/src - # Needed to include psa_crypto_driver_wrappers.h - ${CMAKE_CURRENT_BINARY_DIR}) - set_config_files_compile_definitions(${target}) - install( - TARGETS ${target} - EXPORT MbedTLSTargets - ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR} - LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR} - RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR} - PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ) - install( - TARGETS ${target} - EXPORT TF-PSA-CryptoTargets - ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR} - LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR} - RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR} - PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ) -endforeach(target) diff --git a/tf-psa-crypto/core/psa_crypto.c b/tf-psa-crypto/core/psa_crypto.c deleted file mode 100644 index b9914ea4a7..0000000000 --- a/tf-psa-crypto/core/psa_crypto.c +++ /dev/null @@ -1,9606 +0,0 @@ -/* - * PSA crypto layer on top of Mbed TLS crypto - */ -/* - * Copyright The Mbed TLS Contributors - * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later - */ - -#include "common.h" -#include "psa_crypto_core_common.h" - -#if defined(MBEDTLS_PSA_CRYPTO_C) - -#include "check_crypto_config.h" -#include "psa/crypto.h" -#include "psa/crypto_values.h" - -#include "psa_crypto_cipher.h" -#include "psa_crypto_core.h" -#include "psa_crypto_invasive.h" -#include "psa_crypto_driver_wrappers.h" -#include "psa_crypto_driver_wrappers_no_static.h" -#include "psa_crypto_ecp.h" -#include "psa_crypto_ffdh.h" -#include "psa_crypto_hash.h" -#include "psa_crypto_mac.h" -#include "psa_crypto_rsa.h" -#include "psa_crypto_ecp.h" -#include "psa_crypto_slot_management.h" -/* Include internal declarations that are useful for implementing persistently - * stored keys. */ -#include "psa_crypto_storage.h" - -#include "psa_crypto_random_impl.h" - -#include -#include -#include "mbedtls/platform.h" - -#include "mbedtls/aes.h" -#include "mbedtls/asn1.h" -#include "mbedtls/asn1write.h" -#include "mbedtls/bignum.h" -#include "mbedtls/camellia.h" -#include "mbedtls/chacha20.h" -#include "mbedtls/chachapoly.h" -#include "mbedtls/cipher.h" -#include "mbedtls/ccm.h" -#include "mbedtls/cmac.h" -#include "mbedtls/constant_time.h" -#include "mbedtls/des.h" -#include "mbedtls/ecdh.h" -#include "mbedtls/ecp.h" -#include "mbedtls/entropy.h" -#include "mbedtls/error_common.h" -#include "mbedtls/gcm.h" -#include "mbedtls/md5.h" -#include "mbedtls/pk.h" -#include "pk_wrap.h" -#include "mbedtls/platform_util.h" -#include "mbedtls/error_common.h" -#include "mbedtls/ripemd160.h" -#include "mbedtls/rsa.h" -#include "mbedtls/sha1.h" -#include "mbedtls/sha256.h" -#include "mbedtls/sha512.h" -#include "psa_util_internal.h" -#include "mbedtls/threading.h" - -#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND) -#define BUILTIN_ALG_ANY_HKDF 1 -#endif - -/****************************************************************/ -/* Global data, support functions and library management */ -/****************************************************************/ - -static int key_type_is_raw_bytes(psa_key_type_t type) -{ - return PSA_KEY_TYPE_IS_UNSTRUCTURED(type); -} - -/* Values for psa_global_data_t::rng_state */ -#define RNG_NOT_INITIALIZED 0 -#define RNG_INITIALIZED 1 -#define RNG_SEEDED 2 - -/* IDs for PSA crypto subsystems. Starts at 1 to catch potential uninitialized - * variables as arguments. */ -typedef enum { - PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS = 1, - PSA_CRYPTO_SUBSYSTEM_KEY_SLOTS, - PSA_CRYPTO_SUBSYSTEM_RNG, - PSA_CRYPTO_SUBSYSTEM_TRANSACTION, -} mbedtls_psa_crypto_subsystem; - -/* Initialization flags for global_data::initialized */ -#define PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS_INITIALIZED 0x01 -#define PSA_CRYPTO_SUBSYSTEM_KEY_SLOTS_INITIALIZED 0x02 -#define PSA_CRYPTO_SUBSYSTEM_TRANSACTION_INITIALIZED 0x04 - -#define PSA_CRYPTO_SUBSYSTEM_ALL_INITIALISED ( \ - PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS_INITIALIZED | \ - PSA_CRYPTO_SUBSYSTEM_KEY_SLOTS_INITIALIZED | \ - PSA_CRYPTO_SUBSYSTEM_TRANSACTION_INITIALIZED) - -typedef struct { - uint8_t initialized; - uint8_t rng_state; - mbedtls_psa_random_context_t rng; -} psa_global_data_t; - -static psa_global_data_t global_data; - -static uint8_t psa_get_initialized(void) -{ - uint8_t initialized; - -#if defined(MBEDTLS_THREADING_C) - mbedtls_mutex_lock(&mbedtls_threading_psa_rngdata_mutex); -#endif /* defined(MBEDTLS_THREADING_C) */ - - initialized = global_data.rng_state == RNG_SEEDED; - -#if defined(MBEDTLS_THREADING_C) - mbedtls_mutex_unlock(&mbedtls_threading_psa_rngdata_mutex); -#endif /* defined(MBEDTLS_THREADING_C) */ - -#if defined(MBEDTLS_THREADING_C) - mbedtls_mutex_lock(&mbedtls_threading_psa_globaldata_mutex); -#endif /* defined(MBEDTLS_THREADING_C) */ - - initialized = - (initialized && (global_data.initialized == PSA_CRYPTO_SUBSYSTEM_ALL_INITIALISED)); - -#if defined(MBEDTLS_THREADING_C) - mbedtls_mutex_unlock(&mbedtls_threading_psa_globaldata_mutex); -#endif /* defined(MBEDTLS_THREADING_C) */ - - return initialized; -} - -static uint8_t psa_get_drivers_initialized(void) -{ - uint8_t initialized; - -#if defined(MBEDTLS_THREADING_C) - mbedtls_mutex_lock(&mbedtls_threading_psa_globaldata_mutex); -#endif /* defined(MBEDTLS_THREADING_C) */ - - initialized = (global_data.initialized & PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS_INITIALIZED) != 0; - -#if defined(MBEDTLS_THREADING_C) - mbedtls_mutex_unlock(&mbedtls_threading_psa_globaldata_mutex); -#endif /* defined(MBEDTLS_THREADING_C) */ - - return initialized; -} - -#define GUARD_MODULE_INITIALIZED \ - if (psa_get_initialized() == 0) \ - return PSA_ERROR_BAD_STATE; - -#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS) - -/* Declare a local copy of an input buffer and a variable that will be used - * to store a pointer to the start of the buffer. - * - * Note: This macro must be called before any operations which may jump to - * the exit label, so that the local input copy object is safe to be freed. - * - * Assumptions: - * - input is the name of a pointer to the buffer to be copied - * - The name LOCAL_INPUT_COPY_OF_input is unused in the current scope - * - input_copy_name is a name that is unused in the current scope - */ -#define LOCAL_INPUT_DECLARE(input, input_copy_name) \ - psa_crypto_local_input_t LOCAL_INPUT_COPY_OF_##input = PSA_CRYPTO_LOCAL_INPUT_INIT; \ - const uint8_t *input_copy_name = NULL; - -/* Allocate a copy of the buffer input and set the pointer input_copy to - * point to the start of the copy. - * - * Assumptions: - * - psa_status_t status exists - * - An exit label is declared - * - input is the name of a pointer to the buffer to be copied - * - LOCAL_INPUT_DECLARE(input, input_copy) has previously been called - */ -#define LOCAL_INPUT_ALLOC(input, length, input_copy) \ - status = psa_crypto_local_input_alloc(input, length, \ - &LOCAL_INPUT_COPY_OF_##input); \ - if (status != PSA_SUCCESS) { \ - goto exit; \ - } \ - input_copy = LOCAL_INPUT_COPY_OF_##input.buffer; - -/* Free the local input copy allocated previously by LOCAL_INPUT_ALLOC() - * - * Assumptions: - * - input_copy is the name of the input copy pointer set by LOCAL_INPUT_ALLOC() - * - input is the name of the original buffer that was copied - */ -#define LOCAL_INPUT_FREE(input, input_copy) \ - input_copy = NULL; \ - psa_crypto_local_input_free(&LOCAL_INPUT_COPY_OF_##input); - -/* Declare a local copy of an output buffer and a variable that will be used - * to store a pointer to the start of the buffer. - * - * Note: This macro must be called before any operations which may jump to - * the exit label, so that the local output copy object is safe to be freed. - * - * Assumptions: - * - output is the name of a pointer to the buffer to be copied - * - The name LOCAL_OUTPUT_COPY_OF_output is unused in the current scope - * - output_copy_name is a name that is unused in the current scope - */ -#define LOCAL_OUTPUT_DECLARE(output, output_copy_name) \ - psa_crypto_local_output_t LOCAL_OUTPUT_COPY_OF_##output = PSA_CRYPTO_LOCAL_OUTPUT_INIT; \ - uint8_t *output_copy_name = NULL; - -/* Allocate a copy of the buffer output and set the pointer output_copy to - * point to the start of the copy. - * - * Assumptions: - * - psa_status_t status exists - * - An exit label is declared - * - output is the name of a pointer to the buffer to be copied - * - LOCAL_OUTPUT_DECLARE(output, output_copy) has previously been called - */ -#define LOCAL_OUTPUT_ALLOC(output, length, output_copy) \ - status = psa_crypto_local_output_alloc(output, length, \ - &LOCAL_OUTPUT_COPY_OF_##output); \ - if (status != PSA_SUCCESS) { \ - goto exit; \ - } \ - output_copy = LOCAL_OUTPUT_COPY_OF_##output.buffer; - -/* Free the local output copy allocated previously by LOCAL_OUTPUT_ALLOC() - * after first copying back its contents to the original buffer. - * - * Assumptions: - * - psa_status_t status exists - * - output_copy is the name of the output copy pointer set by LOCAL_OUTPUT_ALLOC() - * - output is the name of the original buffer that was copied - */ -#define LOCAL_OUTPUT_FREE(output, output_copy) \ - output_copy = NULL; \ - do { \ - psa_status_t local_output_status; \ - local_output_status = psa_crypto_local_output_free(&LOCAL_OUTPUT_COPY_OF_##output); \ - if (local_output_status != PSA_SUCCESS) { \ - /* Since this error case is an internal error, it's more serious than \ - * any existing error code and so it's fine to overwrite the existing \ - * status. */ \ - status = local_output_status; \ - } \ - } while (0) -#else /* !MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS */ -#define LOCAL_INPUT_DECLARE(input, input_copy_name) \ - const uint8_t *input_copy_name = NULL; -#define LOCAL_INPUT_ALLOC(input, length, input_copy) \ - input_copy = input; -#define LOCAL_INPUT_FREE(input, input_copy) \ - input_copy = NULL; -#define LOCAL_OUTPUT_DECLARE(output, output_copy_name) \ - uint8_t *output_copy_name = NULL; -#define LOCAL_OUTPUT_ALLOC(output, length, output_copy) \ - output_copy = output; -#define LOCAL_OUTPUT_FREE(output, output_copy) \ - output_copy = NULL; -#endif /* !MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS */ - - -int psa_can_do_hash(psa_algorithm_t hash_alg) -{ - (void) hash_alg; - return psa_get_drivers_initialized(); -} - -int psa_can_do_cipher(psa_key_type_t key_type, psa_algorithm_t cipher_alg) -{ - (void) key_type; - (void) cipher_alg; - return psa_get_drivers_initialized(); -} - - -#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT) || \ - defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY) || \ - defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE) -static int psa_is_dh_key_size_valid(size_t bits) -{ - switch (bits) { -#if defined(PSA_WANT_DH_RFC7919_2048) - case 2048: - return 1; -#endif /* PSA_WANT_DH_RFC7919_2048 */ -#if defined(PSA_WANT_DH_RFC7919_3072) - case 3072: - return 1; -#endif /* PSA_WANT_DH_RFC7919_3072 */ -#if defined(PSA_WANT_DH_RFC7919_4096) - case 4096: - return 1; -#endif /* PSA_WANT_DH_RFC7919_4096 */ -#if defined(PSA_WANT_DH_RFC7919_6144) - case 6144: - return 1; -#endif /* PSA_WANT_DH_RFC7919_6144 */ -#if defined(PSA_WANT_DH_RFC7919_8192) - case 8192: - return 1; -#endif /* PSA_WANT_DH_RFC7919_8192 */ - default: - return 0; - } -} -#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT || - MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY || - PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE */ - -psa_status_t mbedtls_to_psa_error(int ret) -{ - /* Only legacy error codes need to be translated. - * Those are either a low-level error code (-127..-2) - * or a high-level error code (<= -0x1000). */ - if (ret > -0x1000 && ret < -0x80) { - return (psa_status_t) ret; - } - /* Mbed TLS error codes can combine a high-level error code and a - * low-level error code. The low-level error usually reflects the - * root cause better, so dispatch on that preferably. */ - int low_level_ret = -(-ret & 0x007f); - switch (low_level_ret != 0 ? low_level_ret : ret) { - case 0: - return PSA_SUCCESS; - -#if defined(MBEDTLS_AES_C) - case MBEDTLS_ERR_AES_INVALID_KEY_LENGTH: - case MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH: - return PSA_ERROR_NOT_SUPPORTED; - case MBEDTLS_ERR_AES_BAD_INPUT_DATA: - return PSA_ERROR_INVALID_ARGUMENT; -#endif - -#if defined(MBEDTLS_ASN1_PARSE_C) || defined(MBEDTLS_ASN1_WRITE_C) - case MBEDTLS_ERR_ASN1_OUT_OF_DATA: - case MBEDTLS_ERR_ASN1_UNEXPECTED_TAG: - case MBEDTLS_ERR_ASN1_INVALID_LENGTH: - case MBEDTLS_ERR_ASN1_LENGTH_MISMATCH: - case MBEDTLS_ERR_ASN1_INVALID_DATA: - return PSA_ERROR_INVALID_ARGUMENT; - case MBEDTLS_ERR_ASN1_ALLOC_FAILED: - return PSA_ERROR_INSUFFICIENT_MEMORY; - case MBEDTLS_ERR_ASN1_BUF_TOO_SMALL: - return PSA_ERROR_BUFFER_TOO_SMALL; -#endif - -#if defined(MBEDTLS_CAMELLIA_C) - case MBEDTLS_ERR_CAMELLIA_BAD_INPUT_DATA: - case MBEDTLS_ERR_CAMELLIA_INVALID_INPUT_LENGTH: - return PSA_ERROR_NOT_SUPPORTED; -#endif - -#if defined(MBEDTLS_CCM_C) - case MBEDTLS_ERR_CCM_BAD_INPUT: - return PSA_ERROR_INVALID_ARGUMENT; - case MBEDTLS_ERR_CCM_AUTH_FAILED: - return PSA_ERROR_INVALID_SIGNATURE; -#endif - -#if defined(MBEDTLS_CHACHA20_C) - case MBEDTLS_ERR_CHACHA20_BAD_INPUT_DATA: - return PSA_ERROR_INVALID_ARGUMENT; -#endif - -#if defined(MBEDTLS_CHACHAPOLY_C) - case MBEDTLS_ERR_CHACHAPOLY_BAD_STATE: - return PSA_ERROR_BAD_STATE; - case MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED: - return PSA_ERROR_INVALID_SIGNATURE; -#endif - -#if defined(MBEDTLS_CIPHER_C) - case MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE: - return PSA_ERROR_NOT_SUPPORTED; - case MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA: - return PSA_ERROR_INVALID_ARGUMENT; - case MBEDTLS_ERR_CIPHER_ALLOC_FAILED: - return PSA_ERROR_INSUFFICIENT_MEMORY; - case MBEDTLS_ERR_CIPHER_INVALID_PADDING: - return PSA_ERROR_INVALID_PADDING; - case MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED: - return PSA_ERROR_INVALID_ARGUMENT; - case MBEDTLS_ERR_CIPHER_AUTH_FAILED: - return PSA_ERROR_INVALID_SIGNATURE; - case MBEDTLS_ERR_CIPHER_INVALID_CONTEXT: - return PSA_ERROR_CORRUPTION_DETECTED; -#endif - -#if !(defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) || \ - defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE)) - /* Only check CTR_DRBG error codes if underlying mbedtls_xxx - * functions are passed a CTR_DRBG instance. */ - case MBEDTLS_ERR_CTR_DRBG_ENTROPY_SOURCE_FAILED: - return PSA_ERROR_INSUFFICIENT_ENTROPY; - case MBEDTLS_ERR_CTR_DRBG_REQUEST_TOO_BIG: - case MBEDTLS_ERR_CTR_DRBG_INPUT_TOO_BIG: - return PSA_ERROR_NOT_SUPPORTED; - case MBEDTLS_ERR_CTR_DRBG_FILE_IO_ERROR: - return PSA_ERROR_INSUFFICIENT_ENTROPY; -#endif - -#if defined(MBEDTLS_DES_C) - case MBEDTLS_ERR_DES_INVALID_INPUT_LENGTH: - return PSA_ERROR_NOT_SUPPORTED; -#endif - - case MBEDTLS_ERR_ENTROPY_NO_SOURCES_DEFINED: - case MBEDTLS_ERR_ENTROPY_NO_STRONG_SOURCE: - case MBEDTLS_ERR_ENTROPY_SOURCE_FAILED: - return PSA_ERROR_INSUFFICIENT_ENTROPY; - -#if defined(MBEDTLS_GCM_C) - case MBEDTLS_ERR_GCM_AUTH_FAILED: - return PSA_ERROR_INVALID_SIGNATURE; - case MBEDTLS_ERR_GCM_BUFFER_TOO_SMALL: - return PSA_ERROR_BUFFER_TOO_SMALL; - case MBEDTLS_ERR_GCM_BAD_INPUT: - return PSA_ERROR_INVALID_ARGUMENT; -#endif - -#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) && \ - defined(MBEDTLS_PSA_HMAC_DRBG_MD_TYPE) - /* Only check HMAC_DRBG error codes if underlying mbedtls_xxx - * functions are passed a HMAC_DRBG instance. */ - case MBEDTLS_ERR_HMAC_DRBG_ENTROPY_SOURCE_FAILED: - return PSA_ERROR_INSUFFICIENT_ENTROPY; - case MBEDTLS_ERR_HMAC_DRBG_REQUEST_TOO_BIG: - case MBEDTLS_ERR_HMAC_DRBG_INPUT_TOO_BIG: - return PSA_ERROR_NOT_SUPPORTED; - case MBEDTLS_ERR_HMAC_DRBG_FILE_IO_ERROR: - return PSA_ERROR_INSUFFICIENT_ENTROPY; -#endif - -#if defined(MBEDTLS_MD_LIGHT) - case MBEDTLS_ERR_MD_FEATURE_UNAVAILABLE: - return PSA_ERROR_NOT_SUPPORTED; - case MBEDTLS_ERR_MD_BAD_INPUT_DATA: - return PSA_ERROR_INVALID_ARGUMENT; - case MBEDTLS_ERR_MD_ALLOC_FAILED: - return PSA_ERROR_INSUFFICIENT_MEMORY; -#if defined(MBEDTLS_FS_IO) - case MBEDTLS_ERR_MD_FILE_IO_ERROR: - return PSA_ERROR_STORAGE_FAILURE; -#endif -#endif - -#if defined(MBEDTLS_BIGNUM_C) -#if defined(MBEDTLS_FS_IO) - case MBEDTLS_ERR_MPI_FILE_IO_ERROR: - return PSA_ERROR_STORAGE_FAILURE; -#endif - case MBEDTLS_ERR_MPI_BAD_INPUT_DATA: - return PSA_ERROR_INVALID_ARGUMENT; - case MBEDTLS_ERR_MPI_INVALID_CHARACTER: - return PSA_ERROR_INVALID_ARGUMENT; - case MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL: - return PSA_ERROR_BUFFER_TOO_SMALL; - case MBEDTLS_ERR_MPI_NEGATIVE_VALUE: - return PSA_ERROR_INVALID_ARGUMENT; - case MBEDTLS_ERR_MPI_DIVISION_BY_ZERO: - return PSA_ERROR_INVALID_ARGUMENT; - case MBEDTLS_ERR_MPI_NOT_ACCEPTABLE: - return PSA_ERROR_INVALID_ARGUMENT; - case MBEDTLS_ERR_MPI_ALLOC_FAILED: - return PSA_ERROR_INSUFFICIENT_MEMORY; -#endif - -#if defined(MBEDTLS_PK_C) - case MBEDTLS_ERR_PK_ALLOC_FAILED: - return PSA_ERROR_INSUFFICIENT_MEMORY; - case MBEDTLS_ERR_PK_TYPE_MISMATCH: - case MBEDTLS_ERR_PK_BAD_INPUT_DATA: - return PSA_ERROR_INVALID_ARGUMENT; -#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) || defined(MBEDTLS_FS_IO) || \ - defined(MBEDTLS_PSA_ITS_FILE_C) - case MBEDTLS_ERR_PK_FILE_IO_ERROR: - return PSA_ERROR_STORAGE_FAILURE; -#endif - case MBEDTLS_ERR_PK_KEY_INVALID_VERSION: - case MBEDTLS_ERR_PK_KEY_INVALID_FORMAT: - return PSA_ERROR_INVALID_ARGUMENT; - case MBEDTLS_ERR_PK_UNKNOWN_PK_ALG: - return PSA_ERROR_NOT_SUPPORTED; - case MBEDTLS_ERR_PK_PASSWORD_REQUIRED: - case MBEDTLS_ERR_PK_PASSWORD_MISMATCH: - return PSA_ERROR_NOT_PERMITTED; - case MBEDTLS_ERR_PK_INVALID_PUBKEY: - return PSA_ERROR_INVALID_ARGUMENT; - case MBEDTLS_ERR_PK_INVALID_ALG: - case MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE: - case MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE: - return PSA_ERROR_NOT_SUPPORTED; - case MBEDTLS_ERR_PK_BUFFER_TOO_SMALL: - return PSA_ERROR_BUFFER_TOO_SMALL; -#endif - - case MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED: - return PSA_ERROR_HARDWARE_FAILURE; - case MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED: - return PSA_ERROR_NOT_SUPPORTED; - -#if defined(MBEDTLS_RSA_C) - case MBEDTLS_ERR_RSA_BAD_INPUT_DATA: - return PSA_ERROR_INVALID_ARGUMENT; - case MBEDTLS_ERR_RSA_INVALID_PADDING: - return PSA_ERROR_INVALID_PADDING; - case MBEDTLS_ERR_RSA_KEY_GEN_FAILED: - return PSA_ERROR_HARDWARE_FAILURE; - case MBEDTLS_ERR_RSA_KEY_CHECK_FAILED: - return PSA_ERROR_INVALID_ARGUMENT; - case MBEDTLS_ERR_RSA_PUBLIC_FAILED: - case MBEDTLS_ERR_RSA_PRIVATE_FAILED: - return PSA_ERROR_CORRUPTION_DETECTED; - case MBEDTLS_ERR_RSA_VERIFY_FAILED: - return PSA_ERROR_INVALID_SIGNATURE; - case MBEDTLS_ERR_RSA_OUTPUT_TOO_LARGE: - return PSA_ERROR_BUFFER_TOO_SMALL; - case MBEDTLS_ERR_RSA_RNG_FAILED: - return PSA_ERROR_INSUFFICIENT_ENTROPY; -#endif - -#if defined(MBEDTLS_ECP_LIGHT) - case MBEDTLS_ERR_ECP_BAD_INPUT_DATA: - case MBEDTLS_ERR_ECP_INVALID_KEY: - return PSA_ERROR_INVALID_ARGUMENT; - case MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL: - return PSA_ERROR_BUFFER_TOO_SMALL; - case MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE: - return PSA_ERROR_NOT_SUPPORTED; - case MBEDTLS_ERR_ECP_VERIFY_FAILED: - return PSA_ERROR_INVALID_SIGNATURE; - case MBEDTLS_ERR_ECP_ALLOC_FAILED: - return PSA_ERROR_INSUFFICIENT_MEMORY; - case MBEDTLS_ERR_ECP_RANDOM_FAILED: - return PSA_ERROR_INSUFFICIENT_ENTROPY; - -#if defined(MBEDTLS_ECP_RESTARTABLE) - case MBEDTLS_ERR_ECP_IN_PROGRESS: - return PSA_OPERATION_INCOMPLETE; -#endif -#endif - - case MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED: - return PSA_ERROR_CORRUPTION_DETECTED; - - default: - return PSA_ERROR_GENERIC_ERROR; - } -} - -/** - * \brief For output buffers which contain "tags" - * (outputs that may be checked for validity like - * hashes, MACs and signatures), fill the unused - * part of the output buffer (the whole buffer on - * error, the trailing part on success) with - * something that isn't a valid tag (barring an - * attack on the tag and deliberately-crafted - * input), in case the caller doesn't check the - * return status properly. - * - * \param output_buffer Pointer to buffer to wipe. May not be NULL - * unless \p output_buffer_size is zero. - * \param status Status of function called to generate - * output_buffer originally - * \param output_buffer_size Size of output buffer. If zero, \p output_buffer - * could be NULL. - * \param output_buffer_length Length of data written to output_buffer, must be - * less than \p output_buffer_size - */ -static void psa_wipe_tag_output_buffer(uint8_t *output_buffer, psa_status_t status, - size_t output_buffer_size, size_t output_buffer_length) -{ - size_t offset = 0; - - if (output_buffer_size == 0) { - /* If output_buffer_size is 0 then we have nothing to do. We must not - call memset because output_buffer may be NULL in this case */ - return; - } - - if (status == PSA_SUCCESS) { - offset = output_buffer_length; - } - - memset(output_buffer + offset, '!', output_buffer_size - offset); -} - - -psa_status_t psa_validate_unstructured_key_bit_size(psa_key_type_t type, - size_t bits) -{ - /* Check that the bit size is acceptable for the key type */ - switch (type) { - case PSA_KEY_TYPE_RAW_DATA: - case PSA_KEY_TYPE_HMAC: - case PSA_KEY_TYPE_DERIVE: - case PSA_KEY_TYPE_PASSWORD: - case PSA_KEY_TYPE_PASSWORD_HASH: - break; -#if defined(PSA_WANT_KEY_TYPE_AES) - case PSA_KEY_TYPE_AES: - if (bits != 128 && bits != 192 && bits != 256) { - return PSA_ERROR_INVALID_ARGUMENT; - } - break; -#endif -#if defined(PSA_WANT_KEY_TYPE_ARIA) - case PSA_KEY_TYPE_ARIA: - if (bits != 128 && bits != 192 && bits != 256) { - return PSA_ERROR_INVALID_ARGUMENT; - } - break; -#endif -#if defined(PSA_WANT_KEY_TYPE_CAMELLIA) - case PSA_KEY_TYPE_CAMELLIA: - if (bits != 128 && bits != 192 && bits != 256) { - return PSA_ERROR_INVALID_ARGUMENT; - } - break; -#endif -#if defined(PSA_WANT_KEY_TYPE_DES) - case PSA_KEY_TYPE_DES: - if (bits != 64 && bits != 128 && bits != 192) { - return PSA_ERROR_INVALID_ARGUMENT; - } - break; -#endif -#if defined(PSA_WANT_KEY_TYPE_CHACHA20) - case PSA_KEY_TYPE_CHACHA20: - if (bits != 256) { - return PSA_ERROR_INVALID_ARGUMENT; - } - break; -#endif - default: - return PSA_ERROR_NOT_SUPPORTED; - } - if (bits % 8 != 0) { - return PSA_ERROR_INVALID_ARGUMENT; - } - - return PSA_SUCCESS; -} - -/** Check whether a given key type is valid for use with a given MAC algorithm - * - * Upon successful return of this function, the behavior of #PSA_MAC_LENGTH - * when called with the validated \p algorithm and \p key_type is well-defined. - * - * \param[in] algorithm The specific MAC algorithm (can be wildcard). - * \param[in] key_type The key type of the key to be used with the - * \p algorithm. - * - * \retval #PSA_SUCCESS - * The \p key_type is valid for use with the \p algorithm - * \retval #PSA_ERROR_INVALID_ARGUMENT - * The \p key_type is not valid for use with the \p algorithm - */ -MBEDTLS_STATIC_TESTABLE psa_status_t psa_mac_key_can_do( - psa_algorithm_t algorithm, - psa_key_type_t key_type) -{ - if (PSA_ALG_IS_HMAC(algorithm)) { - if (key_type == PSA_KEY_TYPE_HMAC) { - return PSA_SUCCESS; - } - } - - if (PSA_ALG_IS_BLOCK_CIPHER_MAC(algorithm)) { - /* Check that we're calling PSA_BLOCK_CIPHER_BLOCK_LENGTH with a cipher - * key. */ - if ((key_type & PSA_KEY_TYPE_CATEGORY_MASK) == - PSA_KEY_TYPE_CATEGORY_SYMMETRIC) { - /* PSA_BLOCK_CIPHER_BLOCK_LENGTH returns 1 for stream ciphers and - * the block length (larger than 1) for block ciphers. */ - if (PSA_BLOCK_CIPHER_BLOCK_LENGTH(key_type) > 1) { - return PSA_SUCCESS; - } - } - } - - return PSA_ERROR_INVALID_ARGUMENT; -} - -psa_status_t psa_allocate_buffer_to_slot(psa_key_slot_t *slot, - size_t buffer_length) -{ -#if defined(MBEDTLS_PSA_STATIC_KEY_SLOTS) - if (buffer_length > ((size_t) MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE)) { - return PSA_ERROR_NOT_SUPPORTED; - } -#else - if (slot->key.data != NULL) { - return PSA_ERROR_ALREADY_EXISTS; - } - - slot->key.data = mbedtls_calloc(1, buffer_length); - if (slot->key.data == NULL) { - return PSA_ERROR_INSUFFICIENT_MEMORY; - } -#endif - - slot->key.bytes = buffer_length; - return PSA_SUCCESS; -} - -psa_status_t psa_copy_key_material_into_slot(psa_key_slot_t *slot, - const uint8_t *data, - size_t data_length) -{ - psa_status_t status = psa_allocate_buffer_to_slot(slot, - data_length); - if (status != PSA_SUCCESS) { - return status; - } - - memcpy(slot->key.data, data, data_length); - return PSA_SUCCESS; -} - -psa_status_t psa_import_key_into_slot( - const psa_key_attributes_t *attributes, - const uint8_t *data, size_t data_length, - uint8_t *key_buffer, size_t key_buffer_size, - size_t *key_buffer_length, size_t *bits) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_type_t type = attributes->type; - - /* zero-length keys are never supported. */ - if (data_length == 0) { - return PSA_ERROR_NOT_SUPPORTED; - } - - if (key_type_is_raw_bytes(type)) { - *bits = PSA_BYTES_TO_BITS(data_length); - - status = psa_validate_unstructured_key_bit_size(attributes->type, - *bits); - if (status != PSA_SUCCESS) { - return status; - } - - /* Copy the key material. */ - memcpy(key_buffer, data, data_length); - *key_buffer_length = data_length; - (void) key_buffer_size; - - return PSA_SUCCESS; - } - else if (PSA_KEY_TYPE_IS_ASYMMETRIC(type)) { -#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT) || \ - defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY) - if (PSA_KEY_TYPE_IS_DH(type)) { - if (psa_is_dh_key_size_valid(PSA_BYTES_TO_BITS(data_length)) == 0) { - return PSA_ERROR_NOT_SUPPORTED; - } - return mbedtls_psa_ffdh_import_key(attributes, - data, data_length, - key_buffer, key_buffer_size, - key_buffer_length, - bits); - } -#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT) || - * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY) */ -#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT) || \ - defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) - if (PSA_KEY_TYPE_IS_ECC(type)) { - return mbedtls_psa_ecp_import_key(attributes, - data, data_length, - key_buffer, key_buffer_size, - key_buffer_length, - bits); - } -#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT) || - * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */ -#if (defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT) && \ - defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT)) || \ - defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) - if (PSA_KEY_TYPE_IS_RSA(type)) { - return mbedtls_psa_rsa_import_key(attributes, - data, data_length, - key_buffer, key_buffer_size, - key_buffer_length, - bits); - } -#endif /* (defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT) && - defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT)) || - * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */ - } - return PSA_ERROR_NOT_SUPPORTED; -} - -/** Calculate the intersection of two algorithm usage policies. - * - * Return 0 (which allows no operation) on incompatibility. - */ -static psa_algorithm_t psa_key_policy_algorithm_intersection( - psa_key_type_t key_type, - psa_algorithm_t alg1, - psa_algorithm_t alg2) -{ - /* Common case: both sides actually specify the same policy. */ - if (alg1 == alg2) { - return alg1; - } - /* If the policies are from the same hash-and-sign family, check - * if one is a wildcard. If so the other has the specific algorithm. */ - if (PSA_ALG_IS_SIGN_HASH(alg1) && - PSA_ALG_IS_SIGN_HASH(alg2) && - (alg1 & ~PSA_ALG_HASH_MASK) == (alg2 & ~PSA_ALG_HASH_MASK)) { - if (PSA_ALG_SIGN_GET_HASH(alg1) == PSA_ALG_ANY_HASH) { - return alg2; - } - if (PSA_ALG_SIGN_GET_HASH(alg2) == PSA_ALG_ANY_HASH) { - return alg1; - } - } - /* If the policies are from the same AEAD family, check whether - * one of them is a minimum-tag-length wildcard. Calculate the most - * restrictive tag length. */ - if (PSA_ALG_IS_AEAD(alg1) && PSA_ALG_IS_AEAD(alg2) && - (PSA_ALG_AEAD_WITH_SHORTENED_TAG(alg1, 0) == - PSA_ALG_AEAD_WITH_SHORTENED_TAG(alg2, 0))) { - size_t alg1_len = PSA_ALG_AEAD_GET_TAG_LENGTH(alg1); - size_t alg2_len = PSA_ALG_AEAD_GET_TAG_LENGTH(alg2); - size_t restricted_len = alg1_len > alg2_len ? alg1_len : alg2_len; - - /* If both are wildcards, return most restrictive wildcard */ - if (((alg1 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) && - ((alg2 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0)) { - return PSA_ALG_AEAD_WITH_AT_LEAST_THIS_LENGTH_TAG( - alg1, restricted_len); - } - /* If only one is a wildcard, return specific algorithm if compatible. */ - if (((alg1 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) && - (alg1_len <= alg2_len)) { - return alg2; - } - if (((alg2 & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) && - (alg2_len <= alg1_len)) { - return alg1; - } - } - /* If the policies are from the same MAC family, check whether one - * of them is a minimum-MAC-length policy. Calculate the most - * restrictive tag length. */ - if (PSA_ALG_IS_MAC(alg1) && PSA_ALG_IS_MAC(alg2) && - (PSA_ALG_FULL_LENGTH_MAC(alg1) == - PSA_ALG_FULL_LENGTH_MAC(alg2))) { - /* Validate the combination of key type and algorithm. Since the base - * algorithm of alg1 and alg2 are the same, we only need this once. */ - if (PSA_SUCCESS != psa_mac_key_can_do(alg1, key_type)) { - return 0; - } - - /* Get the (exact or at-least) output lengths for both sides of the - * requested intersection. None of the currently supported algorithms - * have an output length dependent on the actual key size, so setting it - * to a bogus value of 0 is currently OK. - * - * Note that for at-least-this-length wildcard algorithms, the output - * length is set to the shortest allowed length, which allows us to - * calculate the most restrictive tag length for the intersection. */ - size_t alg1_len = PSA_MAC_LENGTH(key_type, 0, alg1); - size_t alg2_len = PSA_MAC_LENGTH(key_type, 0, alg2); - size_t restricted_len = alg1_len > alg2_len ? alg1_len : alg2_len; - - /* If both are wildcards, return most restrictive wildcard */ - if (((alg1 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) && - ((alg2 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0)) { - return PSA_ALG_AT_LEAST_THIS_LENGTH_MAC(alg1, restricted_len); - } - - /* If only one is an at-least-this-length policy, the intersection would - * be the other (fixed-length) policy as long as said fixed length is - * equal to or larger than the shortest allowed length. */ - if ((alg1 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) { - return (alg1_len <= alg2_len) ? alg2 : 0; - } - if ((alg2 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) { - return (alg2_len <= alg1_len) ? alg1 : 0; - } - - /* If none of them are wildcards, check whether they define the same tag - * length. This is still possible here when one is default-length and - * the other specific-length. Ensure to always return the - * specific-length version for the intersection. */ - if (alg1_len == alg2_len) { - return PSA_ALG_TRUNCATED_MAC(alg1, alg1_len); - } - } - /* If the policies are incompatible, allow nothing. */ - return 0; -} - -static int psa_key_algorithm_permits(psa_key_type_t key_type, - psa_algorithm_t policy_alg, - psa_algorithm_t requested_alg) -{ - /* Common case: the policy only allows requested_alg. */ - if (requested_alg == policy_alg) { - return 1; - } - /* If policy_alg is a hash-and-sign with a wildcard for the hash, - * and requested_alg is the same hash-and-sign family with any hash, - * then requested_alg is compliant with policy_alg. */ - if (PSA_ALG_IS_SIGN_HASH(requested_alg) && - PSA_ALG_SIGN_GET_HASH(policy_alg) == PSA_ALG_ANY_HASH) { - return (policy_alg & ~PSA_ALG_HASH_MASK) == - (requested_alg & ~PSA_ALG_HASH_MASK); - } - /* If policy_alg is a wildcard AEAD algorithm of the same base as - * the requested algorithm, check the requested tag length to be - * equal-length or longer than the wildcard-specified length. */ - if (PSA_ALG_IS_AEAD(policy_alg) && - PSA_ALG_IS_AEAD(requested_alg) && - (PSA_ALG_AEAD_WITH_SHORTENED_TAG(policy_alg, 0) == - PSA_ALG_AEAD_WITH_SHORTENED_TAG(requested_alg, 0)) && - ((policy_alg & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0)) { - return PSA_ALG_AEAD_GET_TAG_LENGTH(policy_alg) <= - PSA_ALG_AEAD_GET_TAG_LENGTH(requested_alg); - } - /* If policy_alg is a MAC algorithm of the same base as the requested - * algorithm, check whether their MAC lengths are compatible. */ - if (PSA_ALG_IS_MAC(policy_alg) && - PSA_ALG_IS_MAC(requested_alg) && - (PSA_ALG_FULL_LENGTH_MAC(policy_alg) == - PSA_ALG_FULL_LENGTH_MAC(requested_alg))) { - /* Validate the combination of key type and algorithm. Since the policy - * and requested algorithms are the same, we only need this once. */ - if (PSA_SUCCESS != psa_mac_key_can_do(policy_alg, key_type)) { - return 0; - } - - /* Get both the requested output length for the algorithm which is to be - * verified, and the default output length for the base algorithm. - * Note that none of the currently supported algorithms have an output - * length dependent on actual key size, so setting it to a bogus value - * of 0 is currently OK. */ - size_t requested_output_length = PSA_MAC_LENGTH( - key_type, 0, requested_alg); - size_t default_output_length = PSA_MAC_LENGTH( - key_type, 0, - PSA_ALG_FULL_LENGTH_MAC(requested_alg)); - - /* If the policy is default-length, only allow an algorithm with - * a declared exact-length matching the default. */ - if (PSA_MAC_TRUNCATED_LENGTH(policy_alg) == 0) { - return requested_output_length == default_output_length; - } - - /* If the requested algorithm is default-length, allow it if the policy - * length exactly matches the default length. */ - if (PSA_MAC_TRUNCATED_LENGTH(requested_alg) == 0 && - PSA_MAC_TRUNCATED_LENGTH(policy_alg) == default_output_length) { - return 1; - } - - /* If policy_alg is an at-least-this-length wildcard MAC algorithm, - * check for the requested MAC length to be equal to or longer than the - * minimum allowed length. */ - if ((policy_alg & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG) != 0) { - return PSA_MAC_TRUNCATED_LENGTH(policy_alg) <= - requested_output_length; - } - } - /* If policy_alg is a generic key agreement operation, then using it for - * a key derivation with that key agreement should also be allowed. This - * behaviour is expected to be defined in a future specification version. */ - if (PSA_ALG_IS_RAW_KEY_AGREEMENT(policy_alg) && - PSA_ALG_IS_KEY_AGREEMENT(requested_alg)) { - return PSA_ALG_KEY_AGREEMENT_GET_BASE(requested_alg) == - policy_alg; - } - /* If it isn't explicitly permitted, it's forbidden. */ - return 0; -} - -/** Test whether a policy permits an algorithm. - * - * The caller must test usage flags separately. - * - * \note This function requires providing the key type for which the policy is - * being validated, since some algorithm policy definitions (e.g. MAC) - * have different properties depending on what kind of cipher it is - * combined with. - * - * \retval PSA_SUCCESS When \p alg is a specific algorithm - * allowed by the \p policy. - * \retval PSA_ERROR_INVALID_ARGUMENT When \p alg is not a specific algorithm - * \retval PSA_ERROR_NOT_PERMITTED When \p alg is a specific algorithm, but - * the \p policy does not allow it. - */ -static psa_status_t psa_key_policy_permits(const psa_key_policy_t *policy, - psa_key_type_t key_type, - psa_algorithm_t alg) -{ - /* '0' is not a valid algorithm */ - if (alg == 0) { - return PSA_ERROR_INVALID_ARGUMENT; - } - - /* A requested algorithm cannot be a wildcard. */ - if (PSA_ALG_IS_WILDCARD(alg)) { - return PSA_ERROR_INVALID_ARGUMENT; - } - - if (psa_key_algorithm_permits(key_type, policy->alg, alg) || - psa_key_algorithm_permits(key_type, policy->alg2, alg)) { - return PSA_SUCCESS; - } else { - return PSA_ERROR_NOT_PERMITTED; - } -} - -/** Restrict a key policy based on a constraint. - * - * \note This function requires providing the key type for which the policy is - * being restricted, since some algorithm policy definitions (e.g. MAC) - * have different properties depending on what kind of cipher it is - * combined with. - * - * \param[in] key_type The key type for which to restrict the policy - * \param[in,out] policy The policy to restrict. - * \param[in] constraint The policy constraint to apply. - * - * \retval #PSA_SUCCESS - * \c *policy contains the intersection of the original value of - * \c *policy and \c *constraint. - * \retval #PSA_ERROR_INVALID_ARGUMENT - * \c key_type, \c *policy and \c *constraint are incompatible. - * \c *policy is unchanged. - */ -static psa_status_t psa_restrict_key_policy( - psa_key_type_t key_type, - psa_key_policy_t *policy, - const psa_key_policy_t *constraint) -{ - psa_algorithm_t intersection_alg = - psa_key_policy_algorithm_intersection(key_type, policy->alg, - constraint->alg); - psa_algorithm_t intersection_alg2 = - psa_key_policy_algorithm_intersection(key_type, policy->alg2, - constraint->alg2); - if (intersection_alg == 0 && policy->alg != 0 && constraint->alg != 0) { - return PSA_ERROR_INVALID_ARGUMENT; - } - if (intersection_alg2 == 0 && policy->alg2 != 0 && constraint->alg2 != 0) { - return PSA_ERROR_INVALID_ARGUMENT; - } - policy->usage &= constraint->usage; - policy->alg = intersection_alg; - policy->alg2 = intersection_alg2; - return PSA_SUCCESS; -} - -/** Get the description of a key given its identifier and policy constraints - * and lock it. - * - * The key must have allow all the usage flags set in \p usage. If \p alg is - * nonzero, the key must allow operations with this algorithm. If \p alg is - * zero, the algorithm is not checked. - * - * In case of a persistent key, the function loads the description of the key - * into a key slot if not already done. - * - * On success, the returned key slot has been registered for reading. - * It is the responsibility of the caller to then unregister - * once they have finished reading the contents of the slot. - * The caller unregisters by calling psa_unregister_read() or - * psa_unregister_read_under_mutex(). psa_unregister_read() must be called - * if and only if the caller already holds the global key slot mutex - * (when mutexes are enabled). psa_unregister_read_under_mutex() encapsulates - * the unregister with mutex lock and unlock operations. - */ -static psa_status_t psa_get_and_lock_key_slot_with_policy( - mbedtls_svc_key_id_t key, - psa_key_slot_t **p_slot, - psa_key_usage_t usage, - psa_algorithm_t alg) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_slot_t *slot = NULL; - - status = psa_get_and_lock_key_slot(key, p_slot); - if (status != PSA_SUCCESS) { - return status; - } - slot = *p_slot; - - /* Enforce that usage policy for the key slot contains all the flags - * required by the usage parameter. There is one exception: public - * keys can always be exported, so we treat public key objects as - * if they had the export flag. */ - if (PSA_KEY_TYPE_IS_PUBLIC_KEY(slot->attr.type)) { - usage &= ~PSA_KEY_USAGE_EXPORT; - } - - if ((slot->attr.policy.usage & usage) != usage) { - status = PSA_ERROR_NOT_PERMITTED; - goto error; - } - - /* Enforce that the usage policy permits the requested algorithm. */ - if (alg != 0) { - status = psa_key_policy_permits(&slot->attr.policy, - slot->attr.type, - alg); - if (status != PSA_SUCCESS) { - goto error; - } - } - - return PSA_SUCCESS; - -error: - *p_slot = NULL; - psa_unregister_read_under_mutex(slot); - - return status; -} - -/** Get a key slot containing a transparent key and lock it. - * - * A transparent key is a key for which the key material is directly - * available, as opposed to a key in a secure element and/or to be used - * by a secure element. - * - * This is a temporary function that may be used instead of - * psa_get_and_lock_key_slot_with_policy() when there is no opaque key support - * for a cryptographic operation. - * - * On success, the returned key slot has been registered for reading. - * It is the responsibility of the caller to then unregister - * once they have finished reading the contents of the slot. - * The caller unregisters by calling psa_unregister_read() or - * psa_unregister_read_under_mutex(). psa_unregister_read() must be called - * if and only if the caller already holds the global key slot mutex - * (when mutexes are enabled). psa_unregister_read_under_mutex() encapsulates - * psa_unregister_read() with mutex lock and unlock operations. - */ -static psa_status_t psa_get_and_lock_transparent_key_slot_with_policy( - mbedtls_svc_key_id_t key, - psa_key_slot_t **p_slot, - psa_key_usage_t usage, - psa_algorithm_t alg) -{ - psa_status_t status = psa_get_and_lock_key_slot_with_policy(key, p_slot, - usage, alg); - if (status != PSA_SUCCESS) { - return status; - } - - if (psa_key_lifetime_is_external((*p_slot)->attr.lifetime)) { - psa_unregister_read_under_mutex(*p_slot); - *p_slot = NULL; - return PSA_ERROR_NOT_SUPPORTED; - } - - return PSA_SUCCESS; -} - -psa_status_t psa_remove_key_data_from_memory(psa_key_slot_t *slot) -{ -#if defined(MBEDTLS_PSA_STATIC_KEY_SLOTS) - if (slot->key.bytes > 0) { - mbedtls_platform_zeroize(slot->key.data, MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE); - } -#else - if (slot->key.data != NULL) { - mbedtls_zeroize_and_free(slot->key.data, slot->key.bytes); - } - - slot->key.data = NULL; -#endif /* MBEDTLS_PSA_STATIC_KEY_SLOTS */ - - slot->key.bytes = 0; - - return PSA_SUCCESS; -} - -/** Completely wipe a slot in memory, including its policy. - * Persistent storage is not affected. */ -psa_status_t psa_wipe_key_slot(psa_key_slot_t *slot) -{ - psa_status_t status = psa_remove_key_data_from_memory(slot); - - /* - * As the return error code may not be handled in case of multiple errors, - * do our best to report an unexpected amount of registered readers or - * an unexpected state. - * Assert with MBEDTLS_TEST_HOOK_TEST_ASSERT that the slot is valid for - * wiping. - * if the MBEDTLS_TEST_HOOKS configuration option is enabled and the - * function is called as part of the execution of a test suite, the - * execution of the test suite is stopped in error if the assertion fails. - */ - switch (slot->state) { - case PSA_SLOT_FULL: - /* In this state psa_wipe_key_slot() must only be called if the - * caller is the last reader. */ - case PSA_SLOT_PENDING_DELETION: - /* In this state psa_wipe_key_slot() must only be called if the - * caller is the last reader. */ - if (slot->var.occupied.registered_readers != 1) { - MBEDTLS_TEST_HOOK_TEST_ASSERT(slot->var.occupied.registered_readers == 1); - status = PSA_ERROR_CORRUPTION_DETECTED; - } - break; - case PSA_SLOT_FILLING: - /* In this state registered_readers must be 0. */ - if (slot->var.occupied.registered_readers != 0) { - MBEDTLS_TEST_HOOK_TEST_ASSERT(slot->var.occupied.registered_readers == 0); - status = PSA_ERROR_CORRUPTION_DETECTED; - } - break; - case PSA_SLOT_EMPTY: - /* The slot is already empty, it cannot be wiped. */ - MBEDTLS_TEST_HOOK_TEST_ASSERT(slot->state != PSA_SLOT_EMPTY); - status = PSA_ERROR_CORRUPTION_DETECTED; - break; - default: - /* The slot's state is invalid. */ - status = PSA_ERROR_CORRUPTION_DETECTED; - } - -#if defined(MBEDTLS_PSA_KEY_STORE_DYNAMIC) - size_t slice_index = slot->slice_index; -#endif /* MBEDTLS_PSA_KEY_STORE_DYNAMIC */ - - - /* Multipart operations may still be using the key. This is safe - * because all multipart operation objects are independent from - * the key slot: if they need to access the key after the setup - * phase, they have a copy of the key. Note that this means that - * key material can linger until all operations are completed. */ - /* At this point, key material and other type-specific content has - * been wiped. Clear remaining metadata. We can call memset and not - * zeroize because the metadata is not particularly sensitive. - * This memset also sets the slot's state to PSA_SLOT_EMPTY. */ - memset(slot, 0, sizeof(*slot)); - -#if defined(MBEDTLS_PSA_KEY_STORE_DYNAMIC) - /* If the slot is already corrupted, something went deeply wrong, - * like a thread still using the slot or a stray pointer leading - * to the slot's memory being used for another object. Let the slot - * leak rather than make the corruption worse. */ - if (status == PSA_SUCCESS) { - status = psa_free_key_slot(slice_index, slot); - } -#endif /* MBEDTLS_PSA_KEY_STORE_DYNAMIC */ - - return status; -} - -psa_status_t psa_destroy_key(mbedtls_svc_key_id_t key) -{ - psa_key_slot_t *slot; - psa_status_t status; /* status of the last operation */ - psa_status_t overall_status = PSA_SUCCESS; - - if (mbedtls_svc_key_id_is_null(key)) { - return PSA_SUCCESS; - } - - /* - * Get the description of the key in a key slot, and register to read it. - * In the case of a persistent key, this will load the key description - * from persistent memory if not done yet. - * We cannot avoid this loading as without it we don't know if - * the key is operated by an SE or not and this information is needed by - * the current implementation. */ - status = psa_get_and_lock_key_slot(key, &slot); - if (status != PSA_SUCCESS) { - return status; - } - -#if defined(MBEDTLS_THREADING_C) - /* We cannot unlock between setting the state to PENDING_DELETION - * and destroying the key in storage, as otherwise another thread - * could load the key into a new slot and the key will not be - * fully destroyed. */ - PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_lock( - &mbedtls_threading_key_slot_mutex)); - - if (slot->state == PSA_SLOT_PENDING_DELETION) { - /* Another thread has destroyed the key between us locking the slot - * and us gaining the mutex. Unregister from the slot, - * and report that the key does not exist. */ - status = psa_unregister_read(slot); - - PSA_THREADING_CHK_RET(mbedtls_mutex_unlock( - &mbedtls_threading_key_slot_mutex)); - return (status == PSA_SUCCESS) ? PSA_ERROR_INVALID_HANDLE : status; - } -#endif - /* Set the key slot containing the key description's state to - * PENDING_DELETION. This stops new operations from registering - * to read the slot. Current readers can safely continue to access - * the key within the slot; the last registered reader will - * automatically wipe the slot when they call psa_unregister_read(). - * If the key is persistent, we can now delete the copy of the key - * from memory. If the key is opaque, we require the driver to - * deal with the deletion. */ - overall_status = psa_key_slot_state_transition(slot, PSA_SLOT_FULL, - PSA_SLOT_PENDING_DELETION); - - if (overall_status != PSA_SUCCESS) { - goto exit; - } - - if (PSA_KEY_LIFETIME_IS_READ_ONLY(slot->attr.lifetime)) { - /* Refuse the destruction of a read-only key (which may or may not work - * if we attempt it, depending on whether the key is merely read-only - * by policy or actually physically read-only). - * Just do the best we can, which is to wipe the copy in memory - * (done in this function's cleanup code). */ - overall_status = PSA_ERROR_NOT_PERMITTED; - goto exit; - } - -#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) - if (!PSA_KEY_LIFETIME_IS_VOLATILE(slot->attr.lifetime)) { - /* Destroy the copy of the persistent key from storage. - * The slot will still hold a copy of the key until the last reader - * unregisters. */ - status = psa_destroy_persistent_key(slot->attr.id); - if (overall_status == PSA_SUCCESS) { - overall_status = status; - } - } -#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */ - -exit: - /* Unregister from reading the slot. If we are the last active reader - * then this will wipe the slot. */ - status = psa_unregister_read(slot); - /* Prioritize CORRUPTION_DETECTED from unregistering over - * a storage error. */ - if (status != PSA_SUCCESS) { - overall_status = status; - } - -#if defined(MBEDTLS_THREADING_C) - /* Don't overwrite existing errors if the unlock fails. */ - status = overall_status; - PSA_THREADING_CHK_RET(mbedtls_mutex_unlock( - &mbedtls_threading_key_slot_mutex)); -#endif - - return overall_status; -} - -/** Retrieve all the publicly-accessible attributes of a key. - */ -psa_status_t psa_get_key_attributes(mbedtls_svc_key_id_t key, - psa_key_attributes_t *attributes) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_slot_t *slot; - - psa_reset_key_attributes(attributes); - - status = psa_get_and_lock_key_slot_with_policy(key, &slot, 0, 0); - if (status != PSA_SUCCESS) { - return status; - } - - *attributes = slot->attr; - - return psa_unregister_read_under_mutex(slot); -} - -static psa_status_t psa_export_key_buffer_internal(const uint8_t *key_buffer, - size_t key_buffer_size, - uint8_t *data, - size_t data_size, - size_t *data_length) -{ - if (key_buffer_size > data_size) { - return PSA_ERROR_BUFFER_TOO_SMALL; - } - memcpy(data, key_buffer, key_buffer_size); - memset(data + key_buffer_size, 0, - data_size - key_buffer_size); - *data_length = key_buffer_size; - return PSA_SUCCESS; -} - -psa_status_t psa_export_key_internal( - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, size_t key_buffer_size, - uint8_t *data, size_t data_size, size_t *data_length) -{ - psa_key_type_t type = attributes->type; - - if (key_type_is_raw_bytes(type) || - PSA_KEY_TYPE_IS_RSA(type) || - PSA_KEY_TYPE_IS_ECC(type) || - PSA_KEY_TYPE_IS_DH(type)) { - return psa_export_key_buffer_internal( - key_buffer, key_buffer_size, - data, data_size, data_length); - } else { - /* This shouldn't happen in the reference implementation, but - it is valid for a special-purpose implementation to omit - support for exporting certain key types. */ - return PSA_ERROR_NOT_SUPPORTED; - } -} - -psa_status_t psa_export_key(mbedtls_svc_key_id_t key, - uint8_t *data_external, - size_t data_size, - size_t *data_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_slot_t *slot; - LOCAL_OUTPUT_DECLARE(data_external, data); - - /* Reject a zero-length output buffer now, since this can never be a - * valid key representation. This way we know that data must be a valid - * pointer and we can do things like memset(data, ..., data_size). */ - if (data_size == 0) { - return PSA_ERROR_BUFFER_TOO_SMALL; - } - - /* Set the key to empty now, so that even when there are errors, we always - * set data_length to a value between 0 and data_size. On error, setting - * the key to empty is a good choice because an empty key representation is - * unlikely to be accepted anywhere. */ - *data_length = 0; - - /* Export requires the EXPORT flag. There is an exception for public keys, - * which don't require any flag, but - * psa_get_and_lock_key_slot_with_policy() takes care of this. - */ - status = psa_get_and_lock_key_slot_with_policy(key, &slot, - PSA_KEY_USAGE_EXPORT, 0); - if (status != PSA_SUCCESS) { - return status; - } - - LOCAL_OUTPUT_ALLOC(data_external, data_size, data); - - status = psa_driver_wrapper_export_key(&slot->attr, - slot->key.data, slot->key.bytes, - data, data_size, data_length); - -#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS) -exit: -#endif - unlock_status = psa_unregister_read_under_mutex(slot); - - LOCAL_OUTPUT_FREE(data_external, data); - return (status == PSA_SUCCESS) ? unlock_status : status; -} - -psa_status_t psa_export_public_key_internal( - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, - size_t key_buffer_size, - uint8_t *data, - size_t data_size, - size_t *data_length) -{ - psa_key_type_t type = attributes->type; - - if (PSA_KEY_TYPE_IS_PUBLIC_KEY(type) && - (PSA_KEY_TYPE_IS_RSA(type) || PSA_KEY_TYPE_IS_ECC(type) || - PSA_KEY_TYPE_IS_DH(type))) { - /* Exporting public -> public */ - return psa_export_key_buffer_internal( - key_buffer, key_buffer_size, - data, data_size, data_length); - } else if (PSA_KEY_TYPE_IS_RSA(type)) { -#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT) || \ - defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) - return mbedtls_psa_rsa_export_public_key(attributes, - key_buffer, - key_buffer_size, - data, - data_size, - data_length); -#else - /* We don't know how to convert a private RSA key to public. */ - return PSA_ERROR_NOT_SUPPORTED; -#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT) || - * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY) */ - } else if (PSA_KEY_TYPE_IS_ECC(type)) { -#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT) || \ - defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) - return mbedtls_psa_ecp_export_public_key(attributes, - key_buffer, - key_buffer_size, - data, - data_size, - data_length); -#else - /* We don't know how to convert a private ECC key to public */ - return PSA_ERROR_NOT_SUPPORTED; -#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT) || - * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) */ - } else if (PSA_KEY_TYPE_IS_DH(type)) { -#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_EXPORT) || \ - defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY) - return mbedtls_psa_ffdh_export_public_key(attributes, - key_buffer, - key_buffer_size, - data, data_size, - data_length); -#else - return PSA_ERROR_NOT_SUPPORTED; -#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_EXPORT) || - * defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY) */ - } else { - (void) key_buffer; - (void) key_buffer_size; - (void) data; - (void) data_size; - (void) data_length; - return PSA_ERROR_NOT_SUPPORTED; - } -} - -psa_status_t psa_export_public_key(mbedtls_svc_key_id_t key, - uint8_t *data_external, - size_t data_size, - size_t *data_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_slot_t *slot; - - LOCAL_OUTPUT_DECLARE(data_external, data); - - /* Reject a zero-length output buffer now, since this can never be a - * valid key representation. This way we know that data must be a valid - * pointer and we can do things like memset(data, ..., data_size). */ - if (data_size == 0) { - return PSA_ERROR_BUFFER_TOO_SMALL; - } - - /* Set the key to empty now, so that even when there are errors, we always - * set data_length to a value between 0 and data_size. On error, setting - * the key to empty is a good choice because an empty key representation is - * unlikely to be accepted anywhere. */ - *data_length = 0; - - /* Exporting a public key doesn't require a usage flag. */ - status = psa_get_and_lock_key_slot_with_policy(key, &slot, 0, 0); - if (status != PSA_SUCCESS) { - return status; - } - - LOCAL_OUTPUT_ALLOC(data_external, data_size, data); - - if (!PSA_KEY_TYPE_IS_ASYMMETRIC(slot->attr.type)) { - status = PSA_ERROR_INVALID_ARGUMENT; - goto exit; - } - - status = psa_driver_wrapper_export_public_key( - &slot->attr, slot->key.data, slot->key.bytes, - data, data_size, data_length); - -exit: - unlock_status = psa_unregister_read_under_mutex(slot); - - LOCAL_OUTPUT_FREE(data_external, data); - return (status == PSA_SUCCESS) ? unlock_status : status; -} - -/****************************************************************/ -/* Interruptible ECC Export Public-key */ -/****************************************************************/ - -#if defined(MBEDTLS_ECP_RESTARTABLE) && \ - (defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT) || \ - defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT) || \ - defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)) -static psa_status_t psa_export_public_key_iop_abort_internal(psa_export_public_key_iop_t *operation) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - if (operation->id == 0) { - return PSA_SUCCESS; - } - - status = mbedtls_psa_ecp_export_public_key_iop_abort(&operation->ctx); - - memset(&operation->ctx, 0, sizeof(operation->ctx)); - - operation->id = 0; - - return status; -} -#endif - -uint32_t psa_export_public_key_iop_get_num_ops(psa_export_public_key_iop_t *operation) -{ -#if defined(MBEDTLS_ECP_RESTARTABLE) && \ - (defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT) || \ - defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT) || \ - defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)) - return operation->num_ops; -#else - (void) operation; - return 0; -#endif -} - -psa_status_t psa_export_public_key_iop_setup(psa_export_public_key_iop_t *operation, - mbedtls_svc_key_id_t key) -{ -#if defined(MBEDTLS_ECP_RESTARTABLE) && \ - (defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT) || \ - defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT) || \ - defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)) - - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_attributes_t key_attributes; - psa_key_type_t key_type; - psa_key_slot_t *slot = NULL; - - if (operation->id != 0 || operation->error_occurred) { - return PSA_ERROR_BAD_STATE; - } - - /* We only support the builtin/Mbed TLS driver for now. */ - operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; - - operation->num_ops = 0; - - status = psa_get_and_lock_transparent_key_slot_with_policy(key, &slot, - 0, - 0); - if (status != PSA_SUCCESS) { - goto exit; - } - - key_attributes = slot->attr; - - key_type = psa_get_key_type(&key_attributes); - - if (!PSA_KEY_TYPE_IS_ASYMMETRIC(key_type)) { - status = PSA_ERROR_INVALID_ARGUMENT; - goto exit; - } - - if (!PSA_KEY_TYPE_IS_ECC(key_type)) { - status = PSA_ERROR_NOT_SUPPORTED; - goto exit; - } - - status = mbedtls_psa_ecp_export_public_key_iop_setup(&operation->ctx, slot->key.data, - slot->key.bytes, &key_attributes); - -exit: - unlock_status = psa_unregister_read_under_mutex(slot); - if (status != PSA_SUCCESS) { - psa_export_public_key_iop_abort_internal(operation); - operation->error_occurred = 1; - return status; - } - return unlock_status; -#else - (void) operation; - (void) key; - return PSA_ERROR_NOT_SUPPORTED; -#endif -} - -psa_status_t psa_export_public_key_iop_complete(psa_export_public_key_iop_t *operation, - uint8_t *data, - size_t data_size, - size_t *data_length) -{ -#if defined(MBEDTLS_ECP_RESTARTABLE) && \ - (defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT) || \ - defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT) || \ - defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)) - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - if (operation->id == 0 || operation->error_occurred) { - return PSA_ERROR_BAD_STATE; - } - - status = mbedtls_psa_ecp_export_public_key_iop_complete(&operation->ctx, data, data_size, - data_length); - - operation->num_ops = mbedtls_psa_ecp_export_public_key_iop_get_num_ops(&operation->ctx); - - if (status != PSA_OPERATION_INCOMPLETE) { - psa_export_public_key_iop_abort_internal(operation); - - if (status != PSA_SUCCESS) { - operation->error_occurred = 1; - } - } - - return status; -#else - (void) operation; - (void) data; - (void) data_size; - (void) data_length; - - return PSA_ERROR_BAD_STATE; -#endif -} - -psa_status_t psa_export_public_key_iop_abort(psa_export_public_key_iop_t *operation) -{ -#if defined(MBEDTLS_ECP_RESTARTABLE) && \ - (defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT) || \ - defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT) || \ - defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY)) - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - status = psa_export_public_key_iop_abort_internal(operation); - - operation->num_ops = 0; - operation->error_occurred = 0; - - return status; -#else - (void) operation; - return PSA_SUCCESS; -#endif -} - -/** Validate that a key policy is internally well-formed. - * - * This function only rejects invalid policies. It does not validate the - * consistency of the policy with respect to other attributes of the key - * such as the key type. - */ -static psa_status_t psa_validate_key_policy(const psa_key_policy_t *policy) -{ - if ((policy->usage & ~(PSA_KEY_USAGE_EXPORT | - PSA_KEY_USAGE_COPY | - PSA_KEY_USAGE_ENCRYPT | - PSA_KEY_USAGE_DECRYPT | - PSA_KEY_USAGE_SIGN_MESSAGE | - PSA_KEY_USAGE_VERIFY_MESSAGE | - PSA_KEY_USAGE_SIGN_HASH | - PSA_KEY_USAGE_VERIFY_HASH | - PSA_KEY_USAGE_VERIFY_DERIVATION | - PSA_KEY_USAGE_DERIVE)) != 0) { - return PSA_ERROR_INVALID_ARGUMENT; - } - - return PSA_SUCCESS; -} - -/** Validate the internal consistency of key attributes. - * - * This function only rejects invalid attribute values. If does not - * validate the consistency of the attributes with any key data that may - * be involved in the creation of the key. - * - * Call this function early in the key creation process. - * - * \param[in] attributes Key attributes for the new key. - * - */ -static psa_status_t psa_validate_key_attributes(const psa_key_attributes_t *attributes) -{ - psa_status_t status = PSA_ERROR_INVALID_ARGUMENT; - psa_key_lifetime_t lifetime = psa_get_key_lifetime(attributes); - mbedtls_svc_key_id_t key = psa_get_key_id(attributes); - - status = psa_validate_key_persistence(lifetime); - if (status != PSA_SUCCESS) { - return status; - } - - if (PSA_KEY_LIFETIME_IS_VOLATILE(lifetime)) { - if (MBEDTLS_SVC_KEY_ID_GET_KEY_ID(key) != 0) { - return PSA_ERROR_INVALID_ARGUMENT; - } - } else { - if (!psa_is_valid_key_id(psa_get_key_id(attributes), 0)) { - return PSA_ERROR_INVALID_ARGUMENT; - } - } - - status = psa_validate_key_policy(&attributes->policy); - if (status != PSA_SUCCESS) { - return status; - } - - /* Refuse to create overly large keys. - * Note that this doesn't trigger on import if the attributes don't - * explicitly specify a size (so psa_get_key_bits returns 0), so - * psa_import_key() needs its own checks. */ - if (psa_get_key_bits(attributes) > PSA_MAX_KEY_BITS) { - return PSA_ERROR_NOT_SUPPORTED; - } - - return PSA_SUCCESS; -} - -/** Prepare a key slot to receive key material. - * - * This function allocates a key slot and sets its metadata. - * - * If this function fails, call psa_fail_key_creation(). - * - * This function is intended to be used as follows: - * -# Call psa_start_key_creation() to allocate a key slot, prepare - * it with the specified attributes, and in case of a volatile key assign it - * a volatile key identifier. - * -# Populate the slot with the key material. - * -# Call psa_finish_key_creation() to finalize the creation of the slot. - * In case of failure at any step, stop the sequence and call - * psa_fail_key_creation(). - * - * On success, the key slot's state is PSA_SLOT_FILLING. - * It is the responsibility of the caller to change the slot's state to - * PSA_SLOT_EMPTY/FULL once key creation has finished. - * - * \param[in] attributes Key attributes for the new key. - * \param[out] p_slot On success, a pointer to the prepared slot. - * - * \retval #PSA_SUCCESS - * The key slot is ready to receive key material. - * \return If this function fails, the key slot is an invalid state. - * You must call psa_fail_key_creation() to wipe and free the slot. - */ -static psa_status_t psa_start_key_creation( - const psa_key_attributes_t *attributes, - psa_key_slot_t **p_slot) -{ - psa_status_t status; - - status = psa_validate_key_attributes(attributes); - if (status != PSA_SUCCESS) { - return status; - } - - int key_is_volatile = PSA_KEY_LIFETIME_IS_VOLATILE(attributes->lifetime); - psa_key_id_t volatile_key_id; - -#if defined(MBEDTLS_THREADING_C) - PSA_THREADING_CHK_RET(mbedtls_mutex_lock( - &mbedtls_threading_key_slot_mutex)); -#endif - status = psa_reserve_free_key_slot( - key_is_volatile ? &volatile_key_id : NULL, - p_slot); -#if defined(MBEDTLS_THREADING_C) - PSA_THREADING_CHK_RET(mbedtls_mutex_unlock( - &mbedtls_threading_key_slot_mutex)); -#endif - if (status != PSA_SUCCESS) { - return status; - } - psa_key_slot_t *slot = *p_slot; - - /* We're storing the declared bit-size of the key. It's up to each - * creation mechanism to verify that this information is correct. - * It's automatically correct for mechanisms that use the bit-size as - * an input (generate, device) but not for those where the bit-size - * is optional (import, copy). In case of a volatile key, assign it the - * volatile key identifier associated to the slot returned to contain its - * definition. */ - - slot->attr = *attributes; - if (key_is_volatile) { -#if !defined(MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER) - slot->attr.id = volatile_key_id; -#else - slot->attr.id.key_id = volatile_key_id; -#endif - } - - return PSA_SUCCESS; -} - -/** Finalize the creation of a key once its key material has been set. - * - * This entails writing the key to persistent storage. - * - * If this function fails, call psa_fail_key_creation(). - * See the documentation of psa_start_key_creation() for the intended use - * of this function. - * - * If the finalization succeeds, the function sets the key slot's state to - * PSA_SLOT_FULL, and the key slot can no longer be accessed as part of the - * key creation process. - * - * \param[in,out] slot Pointer to the slot with key material. - * \param[out] key On success, identifier of the key. Note that the - * key identifier is also stored in the key slot. - * - * \retval #PSA_SUCCESS - * The key was successfully created. - * \retval #PSA_ERROR_INSUFFICIENT_MEMORY \emptydescription - * \retval #PSA_ERROR_INSUFFICIENT_STORAGE \emptydescription - * \retval #PSA_ERROR_ALREADY_EXISTS \emptydescription - * \retval #PSA_ERROR_DATA_INVALID \emptydescription - * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription - * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription - * - * \return If this function fails, the key slot is an invalid state. - * You must call psa_fail_key_creation() to wipe and free the slot. - */ -static psa_status_t psa_finish_key_creation( - psa_key_slot_t *slot, - mbedtls_svc_key_id_t *key) -{ - psa_status_t status = PSA_SUCCESS; - (void) slot; - -#if defined(MBEDTLS_THREADING_C) - PSA_THREADING_CHK_RET(mbedtls_mutex_lock( - &mbedtls_threading_key_slot_mutex)); -#endif - -#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) - if (!PSA_KEY_LIFETIME_IS_VOLATILE(slot->attr.lifetime)) { - /* Key material is saved in export representation in the slot, so - * just pass the slot buffer for storage. */ - status = psa_save_persistent_key(&slot->attr, - slot->key.data, - slot->key.bytes); - } -#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */ - - if (status == PSA_SUCCESS) { - *key = slot->attr.id; - status = psa_key_slot_state_transition(slot, PSA_SLOT_FILLING, - PSA_SLOT_FULL); - if (status != PSA_SUCCESS) { - *key = MBEDTLS_SVC_KEY_ID_INIT; - } - } - -#if defined(MBEDTLS_THREADING_C) - PSA_THREADING_CHK_RET(mbedtls_mutex_unlock( - &mbedtls_threading_key_slot_mutex)); -#endif - return status; -} - -/** Abort the creation of a key. - * - * You may call this function after calling psa_start_key_creation(), - * or after psa_finish_key_creation() fails. In other circumstances, this - * function may not clean up persistent storage. - * See the documentation of psa_start_key_creation() for the intended use - * of this function. Sets the slot's state to PSA_SLOT_EMPTY. - * - * \param[in,out] slot Pointer to the slot with key material. - */ -static void psa_fail_key_creation(psa_key_slot_t *slot) -{ - if (slot == NULL) { - return; - } - -#if defined(MBEDTLS_THREADING_C) - /* If the lock operation fails we still wipe the slot. - * Operations will no longer work after a failed lock, - * but we still need to wipe the slot of confidential data. */ - mbedtls_mutex_lock(&mbedtls_threading_key_slot_mutex); -#endif - - psa_wipe_key_slot(slot); - -#if defined(MBEDTLS_THREADING_C) - mbedtls_mutex_unlock(&mbedtls_threading_key_slot_mutex); -#endif -} - -/** Validate optional attributes during key creation. - * - * Some key attributes are optional during key creation. If they are - * specified in the attributes structure, check that they are consistent - * with the data in the slot. - * - * This function should be called near the end of key creation, after - * the slot in memory is fully populated but before saving persistent data. - */ -static psa_status_t psa_validate_optional_attributes( - const psa_key_slot_t *slot, - const psa_key_attributes_t *attributes) -{ - if (attributes->type != 0) { - if (attributes->type != slot->attr.type) { - return PSA_ERROR_INVALID_ARGUMENT; - } - } - - if (attributes->bits != 0) { - if (attributes->bits != slot->attr.bits) { - return PSA_ERROR_INVALID_ARGUMENT; - } - } - - return PSA_SUCCESS; -} - -psa_status_t psa_import_key(const psa_key_attributes_t *attributes, - const uint8_t *data_external, - size_t data_length, - mbedtls_svc_key_id_t *key) -{ - psa_status_t status; - LOCAL_INPUT_DECLARE(data_external, data); - psa_key_slot_t *slot = NULL; - size_t bits; - size_t storage_size = data_length; - - *key = MBEDTLS_SVC_KEY_ID_INIT; - - /* Reject zero-length symmetric keys (including raw data key objects). - * This also rejects any key which might be encoded as an empty string, - * which is never valid. */ - if (data_length == 0) { - return PSA_ERROR_INVALID_ARGUMENT; - } - - /* Ensure that the bytes-to-bits conversion cannot overflow. */ - if (data_length > SIZE_MAX / 8) { - return PSA_ERROR_NOT_SUPPORTED; - } - - LOCAL_INPUT_ALLOC(data_external, data_length, data); - - status = psa_start_key_creation(attributes, &slot); - if (status != PSA_SUCCESS) { - goto exit; - } - - /* In the case of a transparent key or an opaque key stored in local - * storage,we have to allocate a buffer to hold the imported key material. */ - if (slot->key.bytes == 0) { - if (psa_key_lifetime_is_external(attributes->lifetime)) { - status = psa_driver_wrapper_get_key_buffer_size_from_key_data( - attributes, data, data_length, &storage_size); - if (status != PSA_SUCCESS) { - goto exit; - } - } - status = psa_allocate_buffer_to_slot(slot, storage_size); - if (status != PSA_SUCCESS) { - goto exit; - } - } - - bits = slot->attr.bits; - status = psa_driver_wrapper_import_key(attributes, - data, data_length, - slot->key.data, - slot->key.bytes, - &slot->key.bytes, &bits); - if (status != PSA_SUCCESS) { - goto exit; - } - - if (slot->attr.bits == 0) { - slot->attr.bits = (psa_key_bits_t) bits; - } else if (bits != slot->attr.bits) { - status = PSA_ERROR_INVALID_ARGUMENT; - goto exit; - } - - /* Enforce a size limit, and in particular ensure that the bit - * size fits in its representation type.*/ - if (bits > PSA_MAX_KEY_BITS) { - status = PSA_ERROR_NOT_SUPPORTED; - goto exit; - } - status = psa_validate_optional_attributes(slot, attributes); - if (status != PSA_SUCCESS) { - goto exit; - } - - status = psa_finish_key_creation(slot, key); -exit: - LOCAL_INPUT_FREE(data_external, data); - if (status != PSA_SUCCESS) { - psa_fail_key_creation(slot); - } - - return status; -} - -psa_status_t psa_copy_key(mbedtls_svc_key_id_t source_key, - const psa_key_attributes_t *specified_attributes, - mbedtls_svc_key_id_t *target_key) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_slot_t *source_slot = NULL; - psa_key_slot_t *target_slot = NULL; - psa_key_attributes_t actual_attributes = *specified_attributes; - size_t storage_size = 0; - - *target_key = MBEDTLS_SVC_KEY_ID_INIT; - - status = psa_get_and_lock_key_slot_with_policy( - source_key, &source_slot, PSA_KEY_USAGE_COPY, 0); - if (status != PSA_SUCCESS) { - goto exit; - } - - status = psa_validate_optional_attributes(source_slot, - specified_attributes); - if (status != PSA_SUCCESS) { - goto exit; - } - - /* The target key type and number of bits have been validated by - * psa_validate_optional_attributes() to be either equal to zero or - * equal to the ones of the source key. So it is safe to inherit - * them from the source key now." - * */ - actual_attributes.bits = source_slot->attr.bits; - actual_attributes.type = source_slot->attr.type; - - - status = psa_restrict_key_policy(source_slot->attr.type, - &actual_attributes.policy, - &source_slot->attr.policy); - if (status != PSA_SUCCESS) { - goto exit; - } - - status = psa_start_key_creation(&actual_attributes, &target_slot); - if (status != PSA_SUCCESS) { - goto exit; - } - if (PSA_KEY_LIFETIME_GET_LOCATION(target_slot->attr.lifetime) != - PSA_KEY_LIFETIME_GET_LOCATION(source_slot->attr.lifetime)) { - /* - * If the source and target keys are stored in different locations, - * the source key would need to be exported as plaintext and re-imported - * in the other location. This has security implications which have not - * been fully mapped. For now, this can be achieved through - * appropriate API invocations from the application, if needed. - * */ - status = PSA_ERROR_NOT_SUPPORTED; - goto exit; - } - /* - * When the source and target keys are within the same location, - * - For transparent keys it is a blind copy without any driver invocation, - * - For opaque keys this translates to an invocation of the drivers' - * copy_key entry point through the dispatch layer. - * */ - if (psa_key_lifetime_is_external(actual_attributes.lifetime)) { - status = psa_driver_wrapper_get_key_buffer_size(&actual_attributes, - &storage_size); - if (status != PSA_SUCCESS) { - goto exit; - } - - status = psa_allocate_buffer_to_slot(target_slot, storage_size); - if (status != PSA_SUCCESS) { - goto exit; - } - - status = psa_driver_wrapper_copy_key(&actual_attributes, - source_slot->key.data, - source_slot->key.bytes, - target_slot->key.data, - target_slot->key.bytes, - &target_slot->key.bytes); - if (status != PSA_SUCCESS) { - goto exit; - } - } else { - status = psa_copy_key_material_into_slot(target_slot, - source_slot->key.data, - source_slot->key.bytes); - if (status != PSA_SUCCESS) { - goto exit; - } - } - status = psa_finish_key_creation(target_slot, target_key); -exit: - if (status != PSA_SUCCESS) { - psa_fail_key_creation(target_slot); - } - - unlock_status = psa_unregister_read_under_mutex(source_slot); - - return (status == PSA_SUCCESS) ? unlock_status : status; -} - - - -/****************************************************************/ -/* Message digests */ -/****************************************************************/ - -static int is_hash_supported(psa_algorithm_t alg) -{ - switch (alg) { -#if defined(PSA_WANT_ALG_MD5) - case PSA_ALG_MD5: - return 1; -#endif -#if defined(PSA_WANT_ALG_RIPEMD160) - case PSA_ALG_RIPEMD160: - return 1; -#endif -#if defined(PSA_WANT_ALG_SHA_1) - case PSA_ALG_SHA_1: - return 1; -#endif -#if defined(PSA_WANT_ALG_SHA_224) - case PSA_ALG_SHA_224: - return 1; -#endif -#if defined(PSA_WANT_ALG_SHA_256) - case PSA_ALG_SHA_256: - return 1; -#endif -#if defined(PSA_WANT_ALG_SHA_384) - case PSA_ALG_SHA_384: - return 1; -#endif -#if defined(PSA_WANT_ALG_SHA_512) - case PSA_ALG_SHA_512: - return 1; -#endif -#if defined(PSA_WANT_ALG_SHA3_224) - case PSA_ALG_SHA3_224: - return 1; -#endif -#if defined(PSA_WANT_ALG_SHA3_256) - case PSA_ALG_SHA3_256: - return 1; -#endif -#if defined(PSA_WANT_ALG_SHA3_384) - case PSA_ALG_SHA3_384: - return 1; -#endif -#if defined(PSA_WANT_ALG_SHA3_512) - case PSA_ALG_SHA3_512: - return 1; -#endif - default: - return 0; - } -} - -psa_status_t psa_hash_abort(psa_hash_operation_t *operation) -{ - /* Aborting a non-active operation is allowed */ - if (operation->id == 0) { - return PSA_SUCCESS; - } - - psa_status_t status = psa_driver_wrapper_hash_abort(operation); - operation->id = 0; - - return status; -} - -psa_status_t psa_hash_setup(psa_hash_operation_t *operation, - psa_algorithm_t alg) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - /* A context must be freshly initialized before it can be set up. */ - if (operation->id != 0) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - if (!PSA_ALG_IS_HASH(alg)) { - status = PSA_ERROR_INVALID_ARGUMENT; - goto exit; - } - - /* Make sure the driver-dependent part of the operation is zeroed. - * This is a guarantee we make to drivers. Initializing the operation - * does not necessarily take care of it, since the context is a - * union and initializing a union does not necessarily initialize - * all of its members. */ - memset(&operation->ctx, 0, sizeof(operation->ctx)); - - status = psa_driver_wrapper_hash_setup(operation, alg); - -exit: - if (status != PSA_SUCCESS) { - psa_hash_abort(operation); - } - - return status; -} - -psa_status_t psa_hash_update(psa_hash_operation_t *operation, - const uint8_t *input_external, - size_t input_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - LOCAL_INPUT_DECLARE(input_external, input); - - if (operation->id == 0) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - /* Don't require hash implementations to behave correctly on a - * zero-length input, which may have an invalid pointer. */ - if (input_length == 0) { - return PSA_SUCCESS; - } - - LOCAL_INPUT_ALLOC(input_external, input_length, input); - status = psa_driver_wrapper_hash_update(operation, input, input_length); - -exit: - if (status != PSA_SUCCESS) { - psa_hash_abort(operation); - } - - LOCAL_INPUT_FREE(input_external, input); - return status; -} - -static psa_status_t psa_hash_finish_internal(psa_hash_operation_t *operation, - uint8_t *hash, - size_t hash_size, - size_t *hash_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - *hash_length = 0; - if (operation->id == 0) { - return PSA_ERROR_BAD_STATE; - } - - status = psa_driver_wrapper_hash_finish( - operation, hash, hash_size, hash_length); - psa_hash_abort(operation); - - return status; -} - -psa_status_t psa_hash_finish(psa_hash_operation_t *operation, - uint8_t *hash_external, - size_t hash_size, - size_t *hash_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - LOCAL_OUTPUT_DECLARE(hash_external, hash); - - LOCAL_OUTPUT_ALLOC(hash_external, hash_size, hash); - status = psa_hash_finish_internal(operation, hash, hash_size, hash_length); - -#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS) -exit: -#endif - LOCAL_OUTPUT_FREE(hash_external, hash); - return status; -} - -psa_status_t psa_hash_verify(psa_hash_operation_t *operation, - const uint8_t *hash_external, - size_t hash_length) -{ - uint8_t actual_hash[PSA_HASH_MAX_SIZE]; - size_t actual_hash_length; - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - LOCAL_INPUT_DECLARE(hash_external, hash); - - status = psa_hash_finish_internal( - operation, - actual_hash, sizeof(actual_hash), - &actual_hash_length); - - if (status != PSA_SUCCESS) { - goto exit; - } - - if (actual_hash_length != hash_length) { - status = PSA_ERROR_INVALID_SIGNATURE; - goto exit; - } - - LOCAL_INPUT_ALLOC(hash_external, hash_length, hash); - if (mbedtls_ct_memcmp(hash, actual_hash, actual_hash_length) != 0) { - status = PSA_ERROR_INVALID_SIGNATURE; - } - -exit: - mbedtls_platform_zeroize(actual_hash, sizeof(actual_hash)); - if (status != PSA_SUCCESS) { - psa_hash_abort(operation); - } - LOCAL_INPUT_FREE(hash_external, hash); - return status; -} - -psa_status_t psa_hash_compute(psa_algorithm_t alg, - const uint8_t *input_external, size_t input_length, - uint8_t *hash_external, size_t hash_size, - size_t *hash_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - LOCAL_INPUT_DECLARE(input_external, input); - LOCAL_OUTPUT_DECLARE(hash_external, hash); - - *hash_length = 0; - if (!PSA_ALG_IS_HASH(alg)) { - return PSA_ERROR_INVALID_ARGUMENT; - } - - LOCAL_INPUT_ALLOC(input_external, input_length, input); - LOCAL_OUTPUT_ALLOC(hash_external, hash_size, hash); - status = psa_driver_wrapper_hash_compute(alg, input, input_length, - hash, hash_size, hash_length); - -#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS) -exit: -#endif - LOCAL_INPUT_FREE(input_external, input); - LOCAL_OUTPUT_FREE(hash_external, hash); - return status; -} - -psa_status_t psa_hash_compare(psa_algorithm_t alg, - const uint8_t *input_external, size_t input_length, - const uint8_t *hash_external, size_t hash_length) -{ - uint8_t actual_hash[PSA_HASH_MAX_SIZE]; - size_t actual_hash_length; - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - LOCAL_INPUT_DECLARE(input_external, input); - LOCAL_INPUT_DECLARE(hash_external, hash); - - if (!PSA_ALG_IS_HASH(alg)) { - status = PSA_ERROR_INVALID_ARGUMENT; - return status; - } - - LOCAL_INPUT_ALLOC(input_external, input_length, input); - status = psa_driver_wrapper_hash_compute( - alg, input, input_length, - actual_hash, sizeof(actual_hash), - &actual_hash_length); - if (status != PSA_SUCCESS) { - goto exit; - } - if (actual_hash_length != hash_length) { - status = PSA_ERROR_INVALID_SIGNATURE; - goto exit; - } - - LOCAL_INPUT_ALLOC(hash_external, hash_length, hash); - if (mbedtls_ct_memcmp(hash, actual_hash, actual_hash_length) != 0) { - status = PSA_ERROR_INVALID_SIGNATURE; - } - -exit: - mbedtls_platform_zeroize(actual_hash, sizeof(actual_hash)); - - LOCAL_INPUT_FREE(input_external, input); - LOCAL_INPUT_FREE(hash_external, hash); - - return status; -} - -psa_status_t psa_hash_clone(const psa_hash_operation_t *source_operation, - psa_hash_operation_t *target_operation) -{ - if (source_operation->id == 0 || - target_operation->id != 0) { - return PSA_ERROR_BAD_STATE; - } - - /* Make sure the driver-dependent part of the operation is zeroed. - * This is a guarantee we make to drivers. Initializing the operation - * does not necessarily take care of it, since the context is a - * union and initializing a union does not necessarily initialize - * all of its members. */ - memset(&target_operation->ctx, 0, sizeof(target_operation->ctx)); - - psa_status_t status = psa_driver_wrapper_hash_clone(source_operation, - target_operation); - if (status != PSA_SUCCESS) { - psa_hash_abort(target_operation); - } - - return status; -} - - -/****************************************************************/ -/* MAC */ -/****************************************************************/ - -psa_status_t psa_mac_abort(psa_mac_operation_t *operation) -{ - /* Aborting a non-active operation is allowed */ - if (operation->id == 0) { - return PSA_SUCCESS; - } - - psa_status_t status = psa_driver_wrapper_mac_abort(operation); - operation->mac_size = 0; - operation->is_sign = 0; - operation->id = 0; - - return status; -} - -static psa_status_t psa_mac_finalize_alg_and_key_validation( - psa_algorithm_t alg, - const psa_key_attributes_t *attributes, - uint8_t *mac_size) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_type_t key_type = psa_get_key_type(attributes); - size_t key_bits = psa_get_key_bits(attributes); - - if (!PSA_ALG_IS_MAC(alg)) { - return PSA_ERROR_INVALID_ARGUMENT; - } - - /* Validate the combination of key type and algorithm */ - status = psa_mac_key_can_do(alg, key_type); - if (status != PSA_SUCCESS) { - return status; - } - - /* Get the output length for the algorithm and key combination */ - *mac_size = PSA_MAC_LENGTH(key_type, key_bits, alg); - - if (*mac_size < 4) { - /* A very short MAC is too short for security since it can be - * brute-forced. Ancient protocols with 32-bit MACs do exist, - * so we make this our minimum, even though 32 bits is still - * too small for security. */ - return PSA_ERROR_NOT_SUPPORTED; - } - - if (*mac_size > PSA_MAC_LENGTH(key_type, key_bits, - PSA_ALG_FULL_LENGTH_MAC(alg))) { - /* It's impossible to "truncate" to a larger length than the full length - * of the algorithm. */ - return PSA_ERROR_INVALID_ARGUMENT; - } - - if (*mac_size > PSA_MAC_MAX_SIZE) { - /* PSA_MAC_LENGTH returns the correct length even for a MAC algorithm - * that is disabled in the compile-time configuration. The result can - * therefore be larger than PSA_MAC_MAX_SIZE, which does take the - * configuration into account. In this case, force a return of - * PSA_ERROR_NOT_SUPPORTED here. Otherwise psa_mac_verify(), or - * psa_mac_compute(mac_size=PSA_MAC_MAX_SIZE), would return - * PSA_ERROR_BUFFER_TOO_SMALL for an unsupported algorithm whose MAC size - * is larger than PSA_MAC_MAX_SIZE, which is misleading and which breaks - * systematically generated tests. */ - return PSA_ERROR_NOT_SUPPORTED; - } - - return PSA_SUCCESS; -} - -static psa_status_t psa_mac_setup(psa_mac_operation_t *operation, - mbedtls_svc_key_id_t key, - psa_algorithm_t alg, - int is_sign) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_slot_t *slot = NULL; - - /* A context must be freshly initialized before it can be set up. */ - if (operation->id != 0) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - /* Make sure the driver-dependent part of the operation is zeroed. - * This is a guarantee we make to drivers. Initializing the operation - * does not necessarily take care of it, since the context is a - * union and initializing a union does not necessarily initialize - * all of its members. */ - memset(&operation->ctx, 0, sizeof(operation->ctx)); - - status = psa_get_and_lock_key_slot_with_policy( - key, - &slot, - is_sign ? PSA_KEY_USAGE_SIGN_MESSAGE : PSA_KEY_USAGE_VERIFY_MESSAGE, - alg); - if (status != PSA_SUCCESS) { - goto exit; - } - - status = psa_mac_finalize_alg_and_key_validation(alg, &slot->attr, - &operation->mac_size); - if (status != PSA_SUCCESS) { - goto exit; - } - - operation->is_sign = is_sign; - /* Dispatch the MAC setup call with validated input */ - if (is_sign) { - status = psa_driver_wrapper_mac_sign_setup(operation, - &slot->attr, - slot->key.data, - slot->key.bytes, - alg); - } else { - status = psa_driver_wrapper_mac_verify_setup(operation, - &slot->attr, - slot->key.data, - slot->key.bytes, - alg); - } - -exit: - if (status != PSA_SUCCESS) { - psa_mac_abort(operation); - } - - unlock_status = psa_unregister_read_under_mutex(slot); - - return (status == PSA_SUCCESS) ? unlock_status : status; -} - -psa_status_t psa_mac_sign_setup(psa_mac_operation_t *operation, - mbedtls_svc_key_id_t key, - psa_algorithm_t alg) -{ - return psa_mac_setup(operation, key, alg, 1); -} - -psa_status_t psa_mac_verify_setup(psa_mac_operation_t *operation, - mbedtls_svc_key_id_t key, - psa_algorithm_t alg) -{ - return psa_mac_setup(operation, key, alg, 0); -} - -psa_status_t psa_mac_update(psa_mac_operation_t *operation, - const uint8_t *input_external, - size_t input_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - LOCAL_INPUT_DECLARE(input_external, input); - - if (operation->id == 0) { - status = PSA_ERROR_BAD_STATE; - return status; - } - - /* Don't require hash implementations to behave correctly on a - * zero-length input, which may have an invalid pointer. */ - if (input_length == 0) { - status = PSA_SUCCESS; - return status; - } - - LOCAL_INPUT_ALLOC(input_external, input_length, input); - status = psa_driver_wrapper_mac_update(operation, input, input_length); - - if (status != PSA_SUCCESS) { - psa_mac_abort(operation); - } - -#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS) -exit: -#endif - LOCAL_INPUT_FREE(input_external, input); - - return status; -} - -psa_status_t psa_mac_sign_finish(psa_mac_operation_t *operation, - uint8_t *mac_external, - size_t mac_size, - size_t *mac_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED; - LOCAL_OUTPUT_DECLARE(mac_external, mac); - LOCAL_OUTPUT_ALLOC(mac_external, mac_size, mac); - - if (operation->id == 0) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - if (!operation->is_sign) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - /* Sanity check. This will guarantee that mac_size != 0 (and so mac != NULL) - * once all the error checks are done. */ - if (operation->mac_size == 0) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - if (mac_size < operation->mac_size) { - status = PSA_ERROR_BUFFER_TOO_SMALL; - goto exit; - } - - - status = psa_driver_wrapper_mac_sign_finish(operation, - mac, operation->mac_size, - mac_length); - -exit: - /* In case of success, set the potential excess room in the output buffer - * to an invalid value, to avoid potentially leaking a longer MAC. - * In case of error, set the output length and content to a safe default, - * such that in case the caller misses an error check, the output would be - * an unachievable MAC. - */ - if (status != PSA_SUCCESS) { - *mac_length = mac_size; - operation->mac_size = 0; - } - - if (mac != NULL) { - psa_wipe_tag_output_buffer(mac, status, mac_size, *mac_length); - } - - abort_status = psa_mac_abort(operation); - LOCAL_OUTPUT_FREE(mac_external, mac); - - return status == PSA_SUCCESS ? abort_status : status; -} - -psa_status_t psa_mac_verify_finish(psa_mac_operation_t *operation, - const uint8_t *mac_external, - size_t mac_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED; - LOCAL_INPUT_DECLARE(mac_external, mac); - - if (operation->id == 0) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - if (operation->is_sign) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - if (operation->mac_size != mac_length) { - status = PSA_ERROR_INVALID_SIGNATURE; - goto exit; - } - - LOCAL_INPUT_ALLOC(mac_external, mac_length, mac); - status = psa_driver_wrapper_mac_verify_finish(operation, - mac, mac_length); - -exit: - abort_status = psa_mac_abort(operation); - LOCAL_INPUT_FREE(mac_external, mac); - - return status == PSA_SUCCESS ? abort_status : status; -} - -static psa_status_t psa_mac_compute_internal(mbedtls_svc_key_id_t key, - psa_algorithm_t alg, - const uint8_t *input, - size_t input_length, - uint8_t *mac, - size_t mac_size, - size_t *mac_length, - int is_sign) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_slot_t *slot; - uint8_t operation_mac_size = 0; - - status = psa_get_and_lock_key_slot_with_policy( - key, - &slot, - is_sign ? PSA_KEY_USAGE_SIGN_MESSAGE : PSA_KEY_USAGE_VERIFY_MESSAGE, - alg); - if (status != PSA_SUCCESS) { - goto exit; - } - - status = psa_mac_finalize_alg_and_key_validation(alg, &slot->attr, - &operation_mac_size); - if (status != PSA_SUCCESS) { - goto exit; - } - - if (mac_size < operation_mac_size) { - status = PSA_ERROR_BUFFER_TOO_SMALL; - goto exit; - } - - status = psa_driver_wrapper_mac_compute( - &slot->attr, - slot->key.data, slot->key.bytes, - alg, - input, input_length, - mac, operation_mac_size, mac_length); - -exit: - /* In case of success, set the potential excess room in the output buffer - * to an invalid value, to avoid potentially leaking a longer MAC. - * In case of error, set the output length and content to a safe default, - * such that in case the caller misses an error check, the output would be - * an unachievable MAC. - */ - if (status != PSA_SUCCESS) { - *mac_length = mac_size; - operation_mac_size = 0; - } - - psa_wipe_tag_output_buffer(mac, status, mac_size, *mac_length); - - unlock_status = psa_unregister_read_under_mutex(slot); - - return (status == PSA_SUCCESS) ? unlock_status : status; -} - -psa_status_t psa_mac_compute(mbedtls_svc_key_id_t key, - psa_algorithm_t alg, - const uint8_t *input_external, - size_t input_length, - uint8_t *mac_external, - size_t mac_size, - size_t *mac_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - LOCAL_INPUT_DECLARE(input_external, input); - LOCAL_OUTPUT_DECLARE(mac_external, mac); - - LOCAL_INPUT_ALLOC(input_external, input_length, input); - LOCAL_OUTPUT_ALLOC(mac_external, mac_size, mac); - status = psa_mac_compute_internal(key, alg, - input, input_length, - mac, mac_size, mac_length, 1); - -#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS) -exit: -#endif - LOCAL_INPUT_FREE(input_external, input); - LOCAL_OUTPUT_FREE(mac_external, mac); - - return status; -} - -psa_status_t psa_mac_verify(mbedtls_svc_key_id_t key, - psa_algorithm_t alg, - const uint8_t *input_external, - size_t input_length, - const uint8_t *mac_external, - size_t mac_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - uint8_t actual_mac[PSA_MAC_MAX_SIZE]; - size_t actual_mac_length; - LOCAL_INPUT_DECLARE(input_external, input); - LOCAL_INPUT_DECLARE(mac_external, mac); - - LOCAL_INPUT_ALLOC(input_external, input_length, input); - status = psa_mac_compute_internal(key, alg, - input, input_length, - actual_mac, sizeof(actual_mac), - &actual_mac_length, 0); - if (status != PSA_SUCCESS) { - goto exit; - } - - if (mac_length != actual_mac_length) { - status = PSA_ERROR_INVALID_SIGNATURE; - goto exit; - } - - LOCAL_INPUT_ALLOC(mac_external, mac_length, mac); - if (mbedtls_ct_memcmp(mac, actual_mac, actual_mac_length) != 0) { - status = PSA_ERROR_INVALID_SIGNATURE; - goto exit; - } - -exit: - mbedtls_platform_zeroize(actual_mac, sizeof(actual_mac)); - LOCAL_INPUT_FREE(input_external, input); - LOCAL_INPUT_FREE(mac_external, mac); - - return status; -} - -/****************************************************************/ -/* Asymmetric cryptography */ -/****************************************************************/ - -static psa_status_t psa_sign_verify_check_alg(int input_is_message, - psa_algorithm_t alg) -{ - if (input_is_message) { - if (!PSA_ALG_IS_SIGN_MESSAGE(alg)) { - return PSA_ERROR_INVALID_ARGUMENT; - } - } - - psa_algorithm_t hash_alg = 0; - if (PSA_ALG_IS_SIGN_HASH(alg)) { - hash_alg = PSA_ALG_SIGN_GET_HASH(alg); - } - - /* Now hash_alg==0 if alg by itself doesn't need a hash. - * This is good enough for sign-hash, but a guaranteed failure for - * sign-message which needs to hash first for all algorithms - * supported at the moment. */ - - if (hash_alg == 0 && input_is_message) { - return PSA_ERROR_INVALID_ARGUMENT; - } - if (hash_alg == PSA_ALG_ANY_HASH) { - return PSA_ERROR_INVALID_ARGUMENT; - } - /* Give up immediately if the hash is not supported. This has - * several advantages: - * - For mechanisms that don't use the hash at all (e.g. - * ECDSA verification, randomized ECDSA signature), without - * this check, the operation would succeed even though it has - * been given an invalid argument. This would not be insecure - * since the hash was not necessary, but it would be weird. - * - For mechanisms that do use the hash, we avoid an error - * deep inside the execution. In principle this doesn't matter, - * but there is a little more risk of a bug in error handling - * deep inside than in this preliminary check. - * - When calling a driver, the driver might be capable of using - * a hash that the core doesn't support. This could potentially - * result in a buffer overflow if the hash is larger than the - * maximum hash size assumed by the core. - * - Returning a consistent error makes it possible to test - * not-supported hashes in a consistent way. - */ - if (hash_alg != 0 && !is_hash_supported(hash_alg)) { - return PSA_ERROR_NOT_SUPPORTED; - } - - return PSA_SUCCESS; -} - -static psa_status_t psa_sign_internal(mbedtls_svc_key_id_t key, - int input_is_message, - psa_algorithm_t alg, - const uint8_t *input, - size_t input_length, - uint8_t *signature, - size_t signature_size, - size_t *signature_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_slot_t *slot; - - *signature_length = 0; - - status = psa_sign_verify_check_alg(input_is_message, alg); - if (status != PSA_SUCCESS) { - return status; - } - - /* Immediately reject a zero-length signature buffer. This guarantees - * that signature must be a valid pointer. (On the other hand, the input - * buffer can in principle be empty since it doesn't actually have - * to be a hash.) */ - if (signature_size == 0) { - return PSA_ERROR_BUFFER_TOO_SMALL; - } - - status = psa_get_and_lock_key_slot_with_policy( - key, &slot, - input_is_message ? PSA_KEY_USAGE_SIGN_MESSAGE : - PSA_KEY_USAGE_SIGN_HASH, - alg); - - if (status != PSA_SUCCESS) { - goto exit; - } - - if (!PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type)) { - status = PSA_ERROR_INVALID_ARGUMENT; - goto exit; - } - - if (input_is_message) { - status = psa_driver_wrapper_sign_message( - &slot->attr, slot->key.data, slot->key.bytes, - alg, input, input_length, - signature, signature_size, signature_length); - } else { - - status = psa_driver_wrapper_sign_hash( - &slot->attr, slot->key.data, slot->key.bytes, - alg, input, input_length, - signature, signature_size, signature_length); - } - - -exit: - psa_wipe_tag_output_buffer(signature, status, signature_size, - *signature_length); - - unlock_status = psa_unregister_read_under_mutex(slot); - - return (status == PSA_SUCCESS) ? unlock_status : status; -} - -static psa_status_t psa_verify_internal(mbedtls_svc_key_id_t key, - int input_is_message, - psa_algorithm_t alg, - const uint8_t *input, - size_t input_length, - const uint8_t *signature, - size_t signature_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_slot_t *slot; - - status = psa_sign_verify_check_alg(input_is_message, alg); - if (status != PSA_SUCCESS) { - return status; - } - - status = psa_get_and_lock_key_slot_with_policy( - key, &slot, - input_is_message ? PSA_KEY_USAGE_VERIFY_MESSAGE : - PSA_KEY_USAGE_VERIFY_HASH, - alg); - - if (status != PSA_SUCCESS) { - return status; - } - - if (input_is_message) { - status = psa_driver_wrapper_verify_message( - &slot->attr, slot->key.data, slot->key.bytes, - alg, input, input_length, - signature, signature_length); - } else { - status = psa_driver_wrapper_verify_hash( - &slot->attr, slot->key.data, slot->key.bytes, - alg, input, input_length, - signature, signature_length); - } - - unlock_status = psa_unregister_read_under_mutex(slot); - - return (status == PSA_SUCCESS) ? unlock_status : status; - -} - -psa_status_t psa_sign_message_builtin( - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, - size_t key_buffer_size, - psa_algorithm_t alg, - const uint8_t *input, - size_t input_length, - uint8_t *signature, - size_t signature_size, - size_t *signature_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - if (PSA_ALG_IS_SIGN_HASH(alg)) { - size_t hash_length; - uint8_t hash[PSA_HASH_MAX_SIZE]; - - status = psa_driver_wrapper_hash_compute( - PSA_ALG_SIGN_GET_HASH(alg), - input, input_length, - hash, sizeof(hash), &hash_length); - - if (status != PSA_SUCCESS) { - return status; - } - - return psa_driver_wrapper_sign_hash( - attributes, key_buffer, key_buffer_size, - alg, hash, hash_length, - signature, signature_size, signature_length); - } - - return PSA_ERROR_NOT_SUPPORTED; -} - -psa_status_t psa_sign_message(mbedtls_svc_key_id_t key, - psa_algorithm_t alg, - const uint8_t *input_external, - size_t input_length, - uint8_t *signature_external, - size_t signature_size, - size_t *signature_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - LOCAL_INPUT_DECLARE(input_external, input); - LOCAL_OUTPUT_DECLARE(signature_external, signature); - - LOCAL_INPUT_ALLOC(input_external, input_length, input); - LOCAL_OUTPUT_ALLOC(signature_external, signature_size, signature); - status = psa_sign_internal(key, 1, alg, input, input_length, signature, - signature_size, signature_length); - -#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS) -exit: -#endif - LOCAL_INPUT_FREE(input_external, input); - LOCAL_OUTPUT_FREE(signature_external, signature); - return status; -} - -psa_status_t psa_verify_message_builtin( - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, - size_t key_buffer_size, - psa_algorithm_t alg, - const uint8_t *input, - size_t input_length, - const uint8_t *signature, - size_t signature_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - if (PSA_ALG_IS_SIGN_HASH(alg)) { - size_t hash_length; - uint8_t hash[PSA_HASH_MAX_SIZE]; - - status = psa_driver_wrapper_hash_compute( - PSA_ALG_SIGN_GET_HASH(alg), - input, input_length, - hash, sizeof(hash), &hash_length); - - if (status != PSA_SUCCESS) { - return status; - } - - return psa_driver_wrapper_verify_hash( - attributes, key_buffer, key_buffer_size, - alg, hash, hash_length, - signature, signature_length); - } - - return PSA_ERROR_NOT_SUPPORTED; -} - -psa_status_t psa_verify_message(mbedtls_svc_key_id_t key, - psa_algorithm_t alg, - const uint8_t *input_external, - size_t input_length, - const uint8_t *signature_external, - size_t signature_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - LOCAL_INPUT_DECLARE(input_external, input); - LOCAL_INPUT_DECLARE(signature_external, signature); - - LOCAL_INPUT_ALLOC(input_external, input_length, input); - LOCAL_INPUT_ALLOC(signature_external, signature_length, signature); - status = psa_verify_internal(key, 1, alg, input, input_length, signature, - signature_length); - -#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS) -exit: -#endif - LOCAL_INPUT_FREE(input_external, input); - LOCAL_INPUT_FREE(signature_external, signature); - - return status; -} - -psa_status_t psa_sign_hash_builtin( - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, size_t key_buffer_size, - psa_algorithm_t alg, const uint8_t *hash, size_t hash_length, - uint8_t *signature, size_t signature_size, size_t *signature_length) -{ - if (attributes->type == PSA_KEY_TYPE_RSA_KEY_PAIR) { - if (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) || - PSA_ALG_IS_RSA_PSS(alg)) { -#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) - return mbedtls_psa_rsa_sign_hash( - attributes, - key_buffer, key_buffer_size, - alg, hash, hash_length, - signature, signature_size, signature_length); -#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || - * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */ - } else { - return PSA_ERROR_INVALID_ARGUMENT; - } - } else if (PSA_KEY_TYPE_IS_ECC(attributes->type)) { - if (PSA_ALG_IS_ECDSA(alg)) { -#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) - return mbedtls_psa_ecdsa_sign_hash( - attributes, - key_buffer, key_buffer_size, - alg, hash, hash_length, - signature, signature_size, signature_length); -#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || - * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */ - } else { - return PSA_ERROR_INVALID_ARGUMENT; - } - } - - (void) key_buffer; - (void) key_buffer_size; - (void) hash; - (void) hash_length; - (void) signature; - (void) signature_size; - (void) signature_length; - - return PSA_ERROR_NOT_SUPPORTED; -} - -psa_status_t psa_sign_hash(mbedtls_svc_key_id_t key, - psa_algorithm_t alg, - const uint8_t *hash_external, - size_t hash_length, - uint8_t *signature_external, - size_t signature_size, - size_t *signature_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - LOCAL_INPUT_DECLARE(hash_external, hash); - LOCAL_OUTPUT_DECLARE(signature_external, signature); - - LOCAL_INPUT_ALLOC(hash_external, hash_length, hash); - LOCAL_OUTPUT_ALLOC(signature_external, signature_size, signature); - status = psa_sign_internal(key, 0, alg, hash, hash_length, signature, - signature_size, signature_length); - -#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS) -exit: -#endif - LOCAL_INPUT_FREE(hash_external, hash); - LOCAL_OUTPUT_FREE(signature_external, signature); - - return status; -} - -psa_status_t psa_verify_hash_builtin( - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, size_t key_buffer_size, - psa_algorithm_t alg, const uint8_t *hash, size_t hash_length, - const uint8_t *signature, size_t signature_length) -{ - if (PSA_KEY_TYPE_IS_RSA(attributes->type)) { - if (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) || - PSA_ALG_IS_RSA_PSS(alg)) { -#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) - return mbedtls_psa_rsa_verify_hash( - attributes, - key_buffer, key_buffer_size, - alg, hash, hash_length, - signature, signature_length); -#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN) || - * defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS) */ - } else { - return PSA_ERROR_INVALID_ARGUMENT; - } - } else if (PSA_KEY_TYPE_IS_ECC(attributes->type)) { - if (PSA_ALG_IS_ECDSA(alg)) { -#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) - return mbedtls_psa_ecdsa_verify_hash( - attributes, - key_buffer, key_buffer_size, - alg, hash, hash_length, - signature, signature_length); -#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || - * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */ - } else { - return PSA_ERROR_INVALID_ARGUMENT; - } - } - - (void) key_buffer; - (void) key_buffer_size; - (void) hash; - (void) hash_length; - (void) signature; - (void) signature_length; - - return PSA_ERROR_NOT_SUPPORTED; -} - -psa_status_t psa_verify_hash(mbedtls_svc_key_id_t key, - psa_algorithm_t alg, - const uint8_t *hash_external, - size_t hash_length, - const uint8_t *signature_external, - size_t signature_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - LOCAL_INPUT_DECLARE(hash_external, hash); - LOCAL_INPUT_DECLARE(signature_external, signature); - - LOCAL_INPUT_ALLOC(hash_external, hash_length, hash); - LOCAL_INPUT_ALLOC(signature_external, signature_length, signature); - status = psa_verify_internal(key, 0, alg, hash, hash_length, signature, - signature_length); - -#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS) -exit: -#endif - LOCAL_INPUT_FREE(hash_external, hash); - LOCAL_INPUT_FREE(signature_external, signature); - - return status; -} - -psa_status_t psa_asymmetric_encrypt(mbedtls_svc_key_id_t key, - psa_algorithm_t alg, - const uint8_t *input_external, - size_t input_length, - const uint8_t *salt_external, - size_t salt_length, - uint8_t *output_external, - size_t output_size, - size_t *output_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_slot_t *slot; - - LOCAL_INPUT_DECLARE(input_external, input); - LOCAL_INPUT_DECLARE(salt_external, salt); - LOCAL_OUTPUT_DECLARE(output_external, output); - - (void) input; - (void) input_length; - (void) salt; - (void) output; - (void) output_size; - - *output_length = 0; - - if (!PSA_ALG_IS_RSA_OAEP(alg) && salt_length != 0) { - return PSA_ERROR_INVALID_ARGUMENT; - } - - status = psa_get_and_lock_key_slot_with_policy( - key, &slot, PSA_KEY_USAGE_ENCRYPT, alg); - if (status != PSA_SUCCESS) { - return status; - } - if (!(PSA_KEY_TYPE_IS_PUBLIC_KEY(slot->attr.type) || - PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type))) { - status = PSA_ERROR_INVALID_ARGUMENT; - goto exit; - } - - LOCAL_INPUT_ALLOC(input_external, input_length, input); - LOCAL_INPUT_ALLOC(salt_external, salt_length, salt); - LOCAL_OUTPUT_ALLOC(output_external, output_size, output); - - status = psa_driver_wrapper_asymmetric_encrypt( - &slot->attr, slot->key.data, slot->key.bytes, - alg, input, input_length, salt, salt_length, - output, output_size, output_length); -exit: - unlock_status = psa_unregister_read_under_mutex(slot); - - LOCAL_INPUT_FREE(input_external, input); - LOCAL_INPUT_FREE(salt_external, salt); - LOCAL_OUTPUT_FREE(output_external, output); - - return (status == PSA_SUCCESS) ? unlock_status : status; -} - -psa_status_t psa_asymmetric_decrypt(mbedtls_svc_key_id_t key, - psa_algorithm_t alg, - const uint8_t *input_external, - size_t input_length, - const uint8_t *salt_external, - size_t salt_length, - uint8_t *output_external, - size_t output_size, - size_t *output_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_slot_t *slot; - - LOCAL_INPUT_DECLARE(input_external, input); - LOCAL_INPUT_DECLARE(salt_external, salt); - LOCAL_OUTPUT_DECLARE(output_external, output); - - (void) input; - (void) input_length; - (void) salt; - (void) output; - (void) output_size; - - *output_length = 0; - - if (!PSA_ALG_IS_RSA_OAEP(alg) && salt_length != 0) { - return PSA_ERROR_INVALID_ARGUMENT; - } - - status = psa_get_and_lock_key_slot_with_policy( - key, &slot, PSA_KEY_USAGE_DECRYPT, alg); - if (status != PSA_SUCCESS) { - return status; - } - if (!PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type)) { - status = PSA_ERROR_INVALID_ARGUMENT; - goto exit; - } - - LOCAL_INPUT_ALLOC(input_external, input_length, input); - LOCAL_INPUT_ALLOC(salt_external, salt_length, salt); - LOCAL_OUTPUT_ALLOC(output_external, output_size, output); - - status = psa_driver_wrapper_asymmetric_decrypt( - &slot->attr, slot->key.data, slot->key.bytes, - alg, input, input_length, salt, salt_length, - output, output_size, output_length); - -exit: - unlock_status = psa_unregister_read_under_mutex(slot); - - LOCAL_INPUT_FREE(input_external, input); - LOCAL_INPUT_FREE(salt_external, salt); - LOCAL_OUTPUT_FREE(output_external, output); - - return (status == PSA_SUCCESS) ? unlock_status : status; -} - -/****************************************************************/ -/* Asymmetric interruptible cryptography */ -/****************************************************************/ - -static uint32_t psa_interruptible_max_ops = PSA_INTERRUPTIBLE_MAX_OPS_UNLIMITED; - -void psa_interruptible_set_max_ops(uint32_t max_ops) -{ - psa_interruptible_max_ops = max_ops; -} - -uint32_t psa_interruptible_get_max_ops(void) -{ - return psa_interruptible_max_ops; -} - -uint32_t psa_sign_hash_get_num_ops( - const psa_sign_hash_interruptible_operation_t *operation) -{ - return operation->num_ops; -} - -uint32_t psa_verify_hash_get_num_ops( - const psa_verify_hash_interruptible_operation_t *operation) -{ - return operation->num_ops; -} - -static psa_status_t psa_sign_hash_abort_internal( - psa_sign_hash_interruptible_operation_t *operation) -{ - if (operation->id == 0) { - /* The object has (apparently) been initialized but it is not (yet) - * in use. It's ok to call abort on such an object, and there's - * nothing to do. */ - return PSA_SUCCESS; - } - - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - status = psa_driver_wrapper_sign_hash_abort(operation); - - operation->id = 0; - - /* Do not clear either the error_occurred or num_ops elements here as they - * only want to be cleared by the application calling abort, not by abort - * being called at completion of an operation. */ - - return status; -} - -psa_status_t psa_sign_hash_start( - psa_sign_hash_interruptible_operation_t *operation, - mbedtls_svc_key_id_t key, psa_algorithm_t alg, - const uint8_t *hash_external, size_t hash_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_slot_t *slot; - - LOCAL_INPUT_DECLARE(hash_external, hash); - - /* Check that start has not been previously called, or operation has not - * previously errored. */ - if (operation->id != 0 || operation->error_occurred) { - return PSA_ERROR_BAD_STATE; - } - - /* Make sure the driver-dependent part of the operation is zeroed. - * This is a guarantee we make to drivers. Initializing the operation - * does not necessarily take care of it, since the context is a - * union and initializing a union does not necessarily initialize - * all of its members. */ - memset(&operation->ctx, 0, sizeof(operation->ctx)); - - status = psa_sign_verify_check_alg(0, alg); - if (status != PSA_SUCCESS) { - operation->error_occurred = 1; - return status; - } - - status = psa_get_and_lock_key_slot_with_policy(key, &slot, - PSA_KEY_USAGE_SIGN_HASH, - alg); - - if (status != PSA_SUCCESS) { - goto exit; - } - - if (!PSA_KEY_TYPE_IS_KEY_PAIR(slot->attr.type)) { - status = PSA_ERROR_INVALID_ARGUMENT; - goto exit; - } - - LOCAL_INPUT_ALLOC(hash_external, hash_length, hash); - - /* Ensure ops count gets reset, in case of operation re-use. */ - operation->num_ops = 0; - - status = psa_driver_wrapper_sign_hash_start(operation, &slot->attr, - slot->key.data, - slot->key.bytes, alg, - hash, hash_length); -exit: - - if (status != PSA_SUCCESS) { - operation->error_occurred = 1; - psa_sign_hash_abort_internal(operation); - } - - unlock_status = psa_unregister_read_under_mutex(slot); - - if (unlock_status != PSA_SUCCESS) { - operation->error_occurred = 1; - } - - LOCAL_INPUT_FREE(hash_external, hash); - - return (status == PSA_SUCCESS) ? unlock_status : status; -} - - -psa_status_t psa_sign_hash_complete( - psa_sign_hash_interruptible_operation_t *operation, - uint8_t *signature_external, size_t signature_size, - size_t *signature_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - LOCAL_OUTPUT_DECLARE(signature_external, signature); - - *signature_length = 0; - - /* Check that start has been called first, and that operation has not - * previously errored. */ - if (operation->id == 0 || operation->error_occurred) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - /* Immediately reject a zero-length signature buffer. This guarantees that - * signature must be a valid pointer. */ - if (signature_size == 0) { - status = PSA_ERROR_BUFFER_TOO_SMALL; - goto exit; - } - - LOCAL_OUTPUT_ALLOC(signature_external, signature_size, signature); - - status = psa_driver_wrapper_sign_hash_complete(operation, signature, - signature_size, - signature_length); - - /* Update ops count with work done. */ - operation->num_ops = psa_driver_wrapper_sign_hash_get_num_ops(operation); - -exit: - - if (signature != NULL) { - psa_wipe_tag_output_buffer(signature, status, signature_size, - *signature_length); - } - - if (status != PSA_OPERATION_INCOMPLETE) { - if (status != PSA_SUCCESS) { - operation->error_occurred = 1; - } - - psa_sign_hash_abort_internal(operation); - } - - LOCAL_OUTPUT_FREE(signature_external, signature); - - return status; -} - -psa_status_t psa_sign_hash_abort( - psa_sign_hash_interruptible_operation_t *operation) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - status = psa_sign_hash_abort_internal(operation); - - /* We clear the number of ops done here, so that it is not cleared when - * the operation fails or succeeds, only on manual abort. */ - operation->num_ops = 0; - - /* Likewise, failure state. */ - operation->error_occurred = 0; - - return status; -} - -static psa_status_t psa_verify_hash_abort_internal( - psa_verify_hash_interruptible_operation_t *operation) -{ - if (operation->id == 0) { - /* The object has (apparently) been initialized but it is not (yet) - * in use. It's ok to call abort on such an object, and there's - * nothing to do. */ - return PSA_SUCCESS; - } - - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - status = psa_driver_wrapper_verify_hash_abort(operation); - - operation->id = 0; - - /* Do not clear either the error_occurred or num_ops elements here as they - * only want to be cleared by the application calling abort, not by abort - * being called at completion of an operation. */ - - return status; -} - -psa_status_t psa_verify_hash_start( - psa_verify_hash_interruptible_operation_t *operation, - mbedtls_svc_key_id_t key, psa_algorithm_t alg, - const uint8_t *hash_external, size_t hash_length, - const uint8_t *signature_external, size_t signature_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_slot_t *slot; - - LOCAL_INPUT_DECLARE(hash_external, hash); - LOCAL_INPUT_DECLARE(signature_external, signature); - - /* Check that start has not been previously called, or operation has not - * previously errored. */ - if (operation->id != 0 || operation->error_occurred) { - return PSA_ERROR_BAD_STATE; - } - - /* Make sure the driver-dependent part of the operation is zeroed. - * This is a guarantee we make to drivers. Initializing the operation - * does not necessarily take care of it, since the context is a - * union and initializing a union does not necessarily initialize - * all of its members. */ - memset(&operation->ctx, 0, sizeof(operation->ctx)); - - status = psa_sign_verify_check_alg(0, alg); - if (status != PSA_SUCCESS) { - operation->error_occurred = 1; - return status; - } - - status = psa_get_and_lock_key_slot_with_policy(key, &slot, - PSA_KEY_USAGE_VERIFY_HASH, - alg); - - if (status != PSA_SUCCESS) { - operation->error_occurred = 1; - return status; - } - - LOCAL_INPUT_ALLOC(hash_external, hash_length, hash); - LOCAL_INPUT_ALLOC(signature_external, signature_length, signature); - - /* Ensure ops count gets reset, in case of operation re-use. */ - operation->num_ops = 0; - - status = psa_driver_wrapper_verify_hash_start(operation, &slot->attr, - slot->key.data, - slot->key.bytes, - alg, hash, hash_length, - signature, signature_length); -#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS) -exit: -#endif - - if (status != PSA_SUCCESS) { - operation->error_occurred = 1; - psa_verify_hash_abort_internal(operation); - } - - unlock_status = psa_unregister_read_under_mutex(slot); - - if (unlock_status != PSA_SUCCESS) { - operation->error_occurred = 1; - } - - LOCAL_INPUT_FREE(hash_external, hash); - LOCAL_INPUT_FREE(signature_external, signature); - - return (status == PSA_SUCCESS) ? unlock_status : status; -} - -psa_status_t psa_verify_hash_complete( - psa_verify_hash_interruptible_operation_t *operation) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - /* Check that start has been called first, and that operation has not - * previously errored. */ - if (operation->id == 0 || operation->error_occurred) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - status = psa_driver_wrapper_verify_hash_complete(operation); - - /* Update ops count with work done. */ - operation->num_ops = psa_driver_wrapper_verify_hash_get_num_ops( - operation); - -exit: - - if (status != PSA_OPERATION_INCOMPLETE) { - if (status != PSA_SUCCESS) { - operation->error_occurred = 1; - } - - psa_verify_hash_abort_internal(operation); - } - - return status; -} - -psa_status_t psa_verify_hash_abort( - psa_verify_hash_interruptible_operation_t *operation) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - status = psa_verify_hash_abort_internal(operation); - - /* We clear the number of ops done here, so that it is not cleared when - * the operation fails or succeeds, only on manual abort. */ - operation->num_ops = 0; - - /* Likewise, failure state. */ - operation->error_occurred = 0; - - return status; -} - -/****************************************************************/ -/* Asymmetric interruptible cryptography internal */ -/* implementations */ -/****************************************************************/ - -void mbedtls_psa_interruptible_set_max_ops(uint32_t max_ops) -{ - -#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \ - defined(MBEDTLS_ECP_RESTARTABLE) - - /* Internal implementation uses zero to indicate infinite number max ops, - * therefore avoid this value, and set to minimum possible. */ - if (max_ops == 0) { - max_ops = 1; - } - - mbedtls_ecp_set_max_ops(max_ops); -#else - (void) max_ops; -#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || - * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) && - * defined( MBEDTLS_ECP_RESTARTABLE ) */ -} - -uint32_t mbedtls_psa_sign_hash_get_num_ops( - const mbedtls_psa_sign_hash_interruptible_operation_t *operation) -{ -#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \ - defined(MBEDTLS_ECP_RESTARTABLE) - - return operation->num_ops; -#else - (void) operation; - return 0; -#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || - * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) && - * defined( MBEDTLS_ECP_RESTARTABLE ) */ -} - -uint32_t mbedtls_psa_verify_hash_get_num_ops( - const mbedtls_psa_verify_hash_interruptible_operation_t *operation) -{ - #if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \ - defined(MBEDTLS_ECP_RESTARTABLE) - - return operation->num_ops; -#else - (void) operation; - return 0; -#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || - * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) && - * defined( MBEDTLS_ECP_RESTARTABLE ) */ -} - -/* Detect supported interruptible sign/verify mechanisms precisely. - * This is not strictly needed: we could accept everything, and let the - * code fail later during complete() if the mechanism is unsupported - * (e.g. attempting deterministic ECDSA when only the randomized variant - * is available). But it's easier for applications and especially for our - * test code to detect all not-supported errors during start(). - * - * Note that this function ignores the hash component. The core code - * is supposed to check the hash part by calling is_hash_supported(). - */ -static inline int can_do_interruptible_sign_verify(psa_algorithm_t alg) -{ -#if defined(MBEDTLS_ECP_RESTARTABLE) -#if defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) - if (PSA_ALG_IS_DETERMINISTIC_ECDSA(alg)) { - return 1; - } -#endif -#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) - if (PSA_ALG_IS_RANDOMIZED_ECDSA(alg)) { - return 1; - } -#endif -#endif /* defined(MBEDTLS_ECP_RESTARTABLE) */ - (void) alg; - return 0; -} - -psa_status_t mbedtls_psa_sign_hash_start( - mbedtls_psa_sign_hash_interruptible_operation_t *operation, - const psa_key_attributes_t *attributes, const uint8_t *key_buffer, - size_t key_buffer_size, psa_algorithm_t alg, - const uint8_t *hash, size_t hash_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - size_t required_hash_length; - - if (!PSA_KEY_TYPE_IS_ECC_KEY_PAIR(attributes->type)) { - return PSA_ERROR_NOT_SUPPORTED; - } - psa_ecc_family_t curve = PSA_KEY_TYPE_ECC_GET_FAMILY(attributes->type); - if (!PSA_ECC_FAMILY_IS_WEIERSTRASS(curve)) { - return PSA_ERROR_INVALID_ARGUMENT; - } - - if (!can_do_interruptible_sign_verify(alg)) { - return PSA_ERROR_NOT_SUPPORTED; - } - -#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \ - defined(MBEDTLS_ECP_RESTARTABLE) - - mbedtls_ecdsa_restart_init(&operation->restart_ctx); - - /* Ensure num_ops is zero'ed in case of context re-use. */ - operation->num_ops = 0; - - status = mbedtls_psa_ecp_load_representation(attributes->type, - attributes->bits, - key_buffer, - key_buffer_size, - &operation->ctx); - - if (status != PSA_SUCCESS) { - return status; - } - - operation->coordinate_bytes = PSA_BITS_TO_BYTES( - operation->ctx->grp.nbits); - - psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH(alg); - operation->md_alg = mbedtls_md_type_from_psa_alg(hash_alg); - operation->alg = alg; - - /* We only need to store the same length of hash as the private key size - * here, it would be truncated by the internal implementation anyway. */ - required_hash_length = (hash_length < operation->coordinate_bytes ? - hash_length : operation->coordinate_bytes); - - if (required_hash_length > sizeof(operation->hash)) { - /* Shouldn't happen, but better safe than sorry. */ - return PSA_ERROR_CORRUPTION_DETECTED; - } - - memcpy(operation->hash, hash, required_hash_length); - operation->hash_length = required_hash_length; - - return PSA_SUCCESS; - -#else - (void) operation; - (void) key_buffer; - (void) key_buffer_size; - (void) alg; - (void) hash; - (void) hash_length; - (void) status; - (void) required_hash_length; - - return PSA_ERROR_NOT_SUPPORTED; -#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || - * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) && - * defined( MBEDTLS_ECP_RESTARTABLE ) */ -} - -psa_status_t mbedtls_psa_sign_hash_complete( - mbedtls_psa_sign_hash_interruptible_operation_t *operation, - uint8_t *signature, size_t signature_size, - size_t *signature_length) -{ -#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \ - defined(MBEDTLS_ECP_RESTARTABLE) - - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - mbedtls_mpi r; - mbedtls_mpi s; - - mbedtls_mpi_init(&r); - mbedtls_mpi_init(&s); - - /* Ensure max_ops is set to the current value (or default). */ - mbedtls_psa_interruptible_set_max_ops(psa_interruptible_get_max_ops()); - - if (signature_size < 2 * operation->coordinate_bytes) { - status = PSA_ERROR_BUFFER_TOO_SMALL; - goto exit; - } - - if (PSA_ALG_ECDSA_IS_DETERMINISTIC(operation->alg)) { - -#if defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) - status = mbedtls_to_psa_error( - mbedtls_ecdsa_sign_det_restartable(&operation->ctx->grp, - &r, - &s, - &operation->ctx->d, - operation->hash, - operation->hash_length, - operation->md_alg, - mbedtls_psa_get_random, - MBEDTLS_PSA_RANDOM_STATE, - &operation->restart_ctx)); -#else /* defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */ - status = PSA_ERROR_NOT_SUPPORTED; - goto exit; -#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) */ - } else { - status = mbedtls_to_psa_error( - mbedtls_ecdsa_sign_restartable(&operation->ctx->grp, - &r, - &s, - &operation->ctx->d, - operation->hash, - operation->hash_length, - mbedtls_psa_get_random, - MBEDTLS_PSA_RANDOM_STATE, - mbedtls_psa_get_random, - MBEDTLS_PSA_RANDOM_STATE, - &operation->restart_ctx)); - } - - /* Hide the fact that the restart context only holds a delta of number of - * ops done during the last operation, not an absolute value. */ - operation->num_ops += operation->restart_ctx.ecp.ops_done; - - if (status == PSA_SUCCESS) { - status = mbedtls_to_psa_error( - mbedtls_mpi_write_binary(&r, - signature, - operation->coordinate_bytes) - ); - - if (status != PSA_SUCCESS) { - goto exit; - } - - status = mbedtls_to_psa_error( - mbedtls_mpi_write_binary(&s, - signature + - operation->coordinate_bytes, - operation->coordinate_bytes) - ); - - if (status != PSA_SUCCESS) { - goto exit; - } - - *signature_length = operation->coordinate_bytes * 2; - - status = PSA_SUCCESS; - } - -exit: - - mbedtls_mpi_free(&r); - mbedtls_mpi_free(&s); - return status; - - #else - - (void) operation; - (void) signature; - (void) signature_size; - (void) signature_length; - - return PSA_ERROR_NOT_SUPPORTED; - -#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || - * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) && - * defined( MBEDTLS_ECP_RESTARTABLE ) */ -} - -psa_status_t mbedtls_psa_sign_hash_abort( - mbedtls_psa_sign_hash_interruptible_operation_t *operation) -{ - -#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \ - defined(MBEDTLS_ECP_RESTARTABLE) - - if (operation->ctx) { - mbedtls_ecdsa_free(operation->ctx); - mbedtls_free(operation->ctx); - operation->ctx = NULL; - } - - mbedtls_ecdsa_restart_free(&operation->restart_ctx); - - operation->num_ops = 0; - - return PSA_SUCCESS; - -#else - - (void) operation; - - return PSA_ERROR_NOT_SUPPORTED; - -#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || - * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) && - * defined( MBEDTLS_ECP_RESTARTABLE ) */ -} - -psa_status_t mbedtls_psa_verify_hash_start( - mbedtls_psa_verify_hash_interruptible_operation_t *operation, - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, size_t key_buffer_size, - psa_algorithm_t alg, - const uint8_t *hash, size_t hash_length, - const uint8_t *signature, size_t signature_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - size_t coordinate_bytes = 0; - size_t required_hash_length = 0; - - if (!PSA_KEY_TYPE_IS_ECC(attributes->type)) { - return PSA_ERROR_NOT_SUPPORTED; - } - psa_ecc_family_t curve = PSA_KEY_TYPE_ECC_GET_FAMILY(attributes->type); - if (!PSA_ECC_FAMILY_IS_WEIERSTRASS(curve)) { - return PSA_ERROR_INVALID_ARGUMENT; - } - - if (!can_do_interruptible_sign_verify(alg)) { - return PSA_ERROR_NOT_SUPPORTED; - } - -#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \ - defined(MBEDTLS_ECP_RESTARTABLE) - - mbedtls_ecdsa_restart_init(&operation->restart_ctx); - mbedtls_mpi_init(&operation->r); - mbedtls_mpi_init(&operation->s); - - /* Ensure num_ops is zero'ed in case of context re-use. */ - operation->num_ops = 0; - - status = mbedtls_psa_ecp_load_representation(attributes->type, - attributes->bits, - key_buffer, - key_buffer_size, - &operation->ctx); - - if (status != PSA_SUCCESS) { - return status; - } - - coordinate_bytes = PSA_BITS_TO_BYTES(operation->ctx->grp.nbits); - - if (signature_length != 2 * coordinate_bytes) { - return PSA_ERROR_INVALID_SIGNATURE; - } - - status = mbedtls_to_psa_error( - mbedtls_mpi_read_binary(&operation->r, - signature, - coordinate_bytes)); - - if (status != PSA_SUCCESS) { - return status; - } - - status = mbedtls_to_psa_error( - mbedtls_mpi_read_binary(&operation->s, - signature + - coordinate_bytes, - coordinate_bytes)); - - if (status != PSA_SUCCESS) { - return status; - } - - status = mbedtls_psa_ecp_load_public_part(operation->ctx); - - if (status != PSA_SUCCESS) { - return status; - } - - /* We only need to store the same length of hash as the private key size - * here, it would be truncated by the internal implementation anyway. */ - required_hash_length = (hash_length < coordinate_bytes ? hash_length : - coordinate_bytes); - - if (required_hash_length > sizeof(operation->hash)) { - /* Shouldn't happen, but better safe than sorry. */ - return PSA_ERROR_CORRUPTION_DETECTED; - } - - memcpy(operation->hash, hash, required_hash_length); - operation->hash_length = required_hash_length; - - return PSA_SUCCESS; -#else - (void) operation; - (void) key_buffer; - (void) key_buffer_size; - (void) alg; - (void) hash; - (void) hash_length; - (void) signature; - (void) signature_length; - (void) status; - (void) coordinate_bytes; - (void) required_hash_length; - - return PSA_ERROR_NOT_SUPPORTED; -#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || - * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) && - * defined( MBEDTLS_ECP_RESTARTABLE ) */ -} - -psa_status_t mbedtls_psa_verify_hash_complete( - mbedtls_psa_verify_hash_interruptible_operation_t *operation) -{ - -#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \ - defined(MBEDTLS_ECP_RESTARTABLE) - - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - /* Ensure max_ops is set to the current value (or default). */ - mbedtls_psa_interruptible_set_max_ops(psa_interruptible_get_max_ops()); - - status = mbedtls_to_psa_error( - mbedtls_ecdsa_verify_restartable(&operation->ctx->grp, - operation->hash, - operation->hash_length, - &operation->ctx->Q, - &operation->r, - &operation->s, - &operation->restart_ctx)); - - /* Hide the fact that the restart context only holds a delta of number of - * ops done during the last operation, not an absolute value. */ - operation->num_ops += operation->restart_ctx.ecp.ops_done; - - return status; -#else - (void) operation; - - return PSA_ERROR_NOT_SUPPORTED; - -#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || - * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) && - * defined( MBEDTLS_ECP_RESTARTABLE ) */ -} - -psa_status_t mbedtls_psa_verify_hash_abort( - mbedtls_psa_verify_hash_interruptible_operation_t *operation) -{ - -#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \ - defined(MBEDTLS_ECP_RESTARTABLE) - - if (operation->ctx) { - mbedtls_ecdsa_free(operation->ctx); - mbedtls_free(operation->ctx); - operation->ctx = NULL; - } - - mbedtls_ecdsa_restart_free(&operation->restart_ctx); - - operation->num_ops = 0; - - mbedtls_mpi_free(&operation->r); - mbedtls_mpi_free(&operation->s); - - return PSA_SUCCESS; - -#else - (void) operation; - - return PSA_ERROR_NOT_SUPPORTED; - -#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || - * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) && - * defined( MBEDTLS_ECP_RESTARTABLE ) */ -} - -static psa_status_t psa_generate_random_internal(uint8_t *output, - size_t output_size) -{ - GUARD_MODULE_INITIALIZED; - -#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) - - psa_status_t status; - size_t output_length = 0; - status = mbedtls_psa_external_get_random(&global_data.rng, - output, output_size, - &output_length); - if (status != PSA_SUCCESS) { - return status; - } - /* Breaking up a request into smaller chunks is currently not supported - * for the external RNG interface. */ - if (output_length != output_size) { - return PSA_ERROR_INSUFFICIENT_ENTROPY; - } - return PSA_SUCCESS; - -#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */ - - while (output_size > 0) { - int ret = MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED; - size_t request_size = - (output_size > MBEDTLS_PSA_RANDOM_MAX_REQUEST ? - MBEDTLS_PSA_RANDOM_MAX_REQUEST : - output_size); -#if defined(MBEDTLS_CTR_DRBG_C) - ret = mbedtls_ctr_drbg_random(&global_data.rng.drbg, output, request_size); -#elif defined(MBEDTLS_HMAC_DRBG_C) - ret = mbedtls_hmac_drbg_random(&global_data.rng.drbg, output, request_size); -#endif /* !MBEDTLS_CTR_DRBG_C && !MBEDTLS_HMAC_DRBG_C */ - if (ret != 0) { - return mbedtls_to_psa_error(ret); - } - output_size -= request_size; - output += request_size; - } - return PSA_SUCCESS; -#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */ -} - - -/****************************************************************/ -/* Symmetric cryptography */ -/****************************************************************/ - -static psa_status_t psa_cipher_setup(psa_cipher_operation_t *operation, - mbedtls_svc_key_id_t key, - psa_algorithm_t alg, - mbedtls_operation_t cipher_operation) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_slot_t *slot = NULL; - psa_key_usage_t usage = (cipher_operation == MBEDTLS_ENCRYPT ? - PSA_KEY_USAGE_ENCRYPT : - PSA_KEY_USAGE_DECRYPT); - - /* A context must be freshly initialized before it can be set up. */ - if (operation->id != 0) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - if (!PSA_ALG_IS_CIPHER(alg)) { - status = PSA_ERROR_INVALID_ARGUMENT; - goto exit; - } - - status = psa_get_and_lock_key_slot_with_policy(key, &slot, usage, alg); - if (status != PSA_SUCCESS) { - goto exit; - } - - /* Initialize the operation struct members, except for id. The id member - * is used to indicate to psa_cipher_abort that there are resources to free, - * so we only set it (in the driver wrapper) after resources have been - * allocated/initialized. */ - operation->iv_set = 0; - if (alg == PSA_ALG_ECB_NO_PADDING) { - operation->iv_required = 0; - } else { - operation->iv_required = 1; - } - operation->default_iv_length = PSA_CIPHER_IV_LENGTH(slot->attr.type, alg); - - - /* Make sure the driver-dependent part of the operation is zeroed. - * This is a guarantee we make to drivers. Initializing the operation - * does not necessarily take care of it, since the context is a - * union and initializing a union does not necessarily initialize - * all of its members. */ - memset(&operation->ctx, 0, sizeof(operation->ctx)); - - /* Try doing the operation through a driver before using software fallback. */ - if (cipher_operation == MBEDTLS_ENCRYPT) { - status = psa_driver_wrapper_cipher_encrypt_setup(operation, - &slot->attr, - slot->key.data, - slot->key.bytes, - alg); - } else { - status = psa_driver_wrapper_cipher_decrypt_setup(operation, - &slot->attr, - slot->key.data, - slot->key.bytes, - alg); - } - -exit: - if (status != PSA_SUCCESS) { - psa_cipher_abort(operation); - } - - unlock_status = psa_unregister_read_under_mutex(slot); - - return (status == PSA_SUCCESS) ? unlock_status : status; -} - -psa_status_t psa_cipher_encrypt_setup(psa_cipher_operation_t *operation, - mbedtls_svc_key_id_t key, - psa_algorithm_t alg) -{ - return psa_cipher_setup(operation, key, alg, MBEDTLS_ENCRYPT); -} - -psa_status_t psa_cipher_decrypt_setup(psa_cipher_operation_t *operation, - mbedtls_svc_key_id_t key, - psa_algorithm_t alg) -{ - return psa_cipher_setup(operation, key, alg, MBEDTLS_DECRYPT); -} - -psa_status_t psa_cipher_generate_iv(psa_cipher_operation_t *operation, - uint8_t *iv_external, - size_t iv_size, - size_t *iv_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - size_t default_iv_length = 0; - - LOCAL_OUTPUT_DECLARE(iv_external, iv); - - if (operation->id == 0) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - if (operation->iv_set || !operation->iv_required) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - default_iv_length = operation->default_iv_length; - if (iv_size < default_iv_length) { - status = PSA_ERROR_BUFFER_TOO_SMALL; - goto exit; - } - - if (default_iv_length > PSA_CIPHER_IV_MAX_SIZE) { - status = PSA_ERROR_GENERIC_ERROR; - goto exit; - } - - LOCAL_OUTPUT_ALLOC(iv_external, default_iv_length, iv); - - status = psa_generate_random_internal(iv, default_iv_length); - if (status != PSA_SUCCESS) { - goto exit; - } - - status = psa_driver_wrapper_cipher_set_iv(operation, - iv, default_iv_length); - -exit: - if (status == PSA_SUCCESS) { - *iv_length = default_iv_length; - operation->iv_set = 1; - } else { - *iv_length = 0; - psa_cipher_abort(operation); - if (iv != NULL) { - mbedtls_platform_zeroize(iv, default_iv_length); - } - } - - LOCAL_OUTPUT_FREE(iv_external, iv); - return status; -} - -psa_status_t psa_cipher_set_iv(psa_cipher_operation_t *operation, - const uint8_t *iv_external, - size_t iv_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - LOCAL_INPUT_DECLARE(iv_external, iv); - - if (operation->id == 0) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - if (operation->iv_set || !operation->iv_required) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - if (iv_length > PSA_CIPHER_IV_MAX_SIZE) { - status = PSA_ERROR_INVALID_ARGUMENT; - goto exit; - } - - LOCAL_INPUT_ALLOC(iv_external, iv_length, iv); - - status = psa_driver_wrapper_cipher_set_iv(operation, - iv, - iv_length); - -exit: - if (status == PSA_SUCCESS) { - operation->iv_set = 1; - } else { - psa_cipher_abort(operation); - } - - LOCAL_INPUT_FREE(iv_external, iv); - - return status; -} - -psa_status_t psa_cipher_update(psa_cipher_operation_t *operation, - const uint8_t *input_external, - size_t input_length, - uint8_t *output_external, - size_t output_size, - size_t *output_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - LOCAL_INPUT_DECLARE(input_external, input); - LOCAL_OUTPUT_DECLARE(output_external, output); - - if (operation->id == 0) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - if (operation->iv_required && !operation->iv_set) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - LOCAL_INPUT_ALLOC(input_external, input_length, input); - LOCAL_OUTPUT_ALLOC(output_external, output_size, output); - - status = psa_driver_wrapper_cipher_update(operation, - input, - input_length, - output, - output_size, - output_length); - -exit: - if (status != PSA_SUCCESS) { - psa_cipher_abort(operation); - } - - LOCAL_INPUT_FREE(input_external, input); - LOCAL_OUTPUT_FREE(output_external, output); - - return status; -} - -psa_status_t psa_cipher_finish(psa_cipher_operation_t *operation, - uint8_t *output_external, - size_t output_size, - size_t *output_length) -{ - psa_status_t status = PSA_ERROR_GENERIC_ERROR; - - LOCAL_OUTPUT_DECLARE(output_external, output); - - if (operation->id == 0) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - if (operation->iv_required && !operation->iv_set) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - LOCAL_OUTPUT_ALLOC(output_external, output_size, output); - - status = psa_driver_wrapper_cipher_finish(operation, - output, - output_size, - output_length); - -exit: - if (status == PSA_SUCCESS) { - status = psa_cipher_abort(operation); - } else { - *output_length = 0; - (void) psa_cipher_abort(operation); - } - - LOCAL_OUTPUT_FREE(output_external, output); - - return status; -} - -psa_status_t psa_cipher_abort(psa_cipher_operation_t *operation) -{ - if (operation->id == 0) { - /* The object has (apparently) been initialized but it is not (yet) - * in use. It's ok to call abort on such an object, and there's - * nothing to do. */ - return PSA_SUCCESS; - } - - psa_driver_wrapper_cipher_abort(operation); - - operation->id = 0; - operation->iv_set = 0; - operation->iv_required = 0; - - return PSA_SUCCESS; -} - -psa_status_t psa_cipher_encrypt(mbedtls_svc_key_id_t key, - psa_algorithm_t alg, - const uint8_t *input_external, - size_t input_length, - uint8_t *output_external, - size_t output_size, - size_t *output_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_slot_t *slot = NULL; - uint8_t local_iv[PSA_CIPHER_IV_MAX_SIZE]; - size_t default_iv_length = 0; - - LOCAL_INPUT_DECLARE(input_external, input); - LOCAL_OUTPUT_DECLARE(output_external, output); - - if (!PSA_ALG_IS_CIPHER(alg)) { - status = PSA_ERROR_INVALID_ARGUMENT; - goto exit; - } - - status = psa_get_and_lock_key_slot_with_policy(key, &slot, - PSA_KEY_USAGE_ENCRYPT, - alg); - if (status != PSA_SUCCESS) { - goto exit; - } - - default_iv_length = PSA_CIPHER_IV_LENGTH(slot->attr.type, alg); - if (default_iv_length > PSA_CIPHER_IV_MAX_SIZE) { - status = PSA_ERROR_GENERIC_ERROR; - goto exit; - } - - if (default_iv_length > 0) { - if (output_size < default_iv_length) { - status = PSA_ERROR_BUFFER_TOO_SMALL; - goto exit; - } - - status = psa_generate_random_internal(local_iv, default_iv_length); - if (status != PSA_SUCCESS) { - goto exit; - } - } - - LOCAL_INPUT_ALLOC(input_external, input_length, input); - LOCAL_OUTPUT_ALLOC(output_external, output_size, output); - - status = psa_driver_wrapper_cipher_encrypt( - &slot->attr, slot->key.data, slot->key.bytes, - alg, local_iv, default_iv_length, input, input_length, - psa_crypto_buffer_offset(output, default_iv_length), - output_size - default_iv_length, output_length); - -exit: - unlock_status = psa_unregister_read_under_mutex(slot); - if (status == PSA_SUCCESS) { - status = unlock_status; - } - - if (status == PSA_SUCCESS) { - if (default_iv_length > 0) { - memcpy(output, local_iv, default_iv_length); - } - *output_length += default_iv_length; - } else { - *output_length = 0; - } - - LOCAL_INPUT_FREE(input_external, input); - LOCAL_OUTPUT_FREE(output_external, output); - - return status; -} - -psa_status_t psa_cipher_decrypt(mbedtls_svc_key_id_t key, - psa_algorithm_t alg, - const uint8_t *input_external, - size_t input_length, - uint8_t *output_external, - size_t output_size, - size_t *output_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_slot_t *slot = NULL; - - LOCAL_INPUT_DECLARE(input_external, input); - LOCAL_OUTPUT_DECLARE(output_external, output); - - if (!PSA_ALG_IS_CIPHER(alg)) { - status = PSA_ERROR_INVALID_ARGUMENT; - goto exit; - } - - status = psa_get_and_lock_key_slot_with_policy(key, &slot, - PSA_KEY_USAGE_DECRYPT, - alg); - if (status != PSA_SUCCESS) { - goto exit; - } - - if (input_length < PSA_CIPHER_IV_LENGTH(slot->attr.type, alg)) { - status = PSA_ERROR_INVALID_ARGUMENT; - goto exit; - } - - LOCAL_INPUT_ALLOC(input_external, input_length, input); - LOCAL_OUTPUT_ALLOC(output_external, output_size, output); - - status = psa_driver_wrapper_cipher_decrypt( - &slot->attr, slot->key.data, slot->key.bytes, - alg, input, input_length, - output, output_size, output_length); - -exit: - unlock_status = psa_unregister_read_under_mutex(slot); - if (status == PSA_SUCCESS) { - status = unlock_status; - } - - if (status != PSA_SUCCESS) { - *output_length = 0; - } - - LOCAL_INPUT_FREE(input_external, input); - LOCAL_OUTPUT_FREE(output_external, output); - - return status; -} - - -/****************************************************************/ -/* AEAD */ -/****************************************************************/ - -/* Helper function to get the base algorithm from its variants. */ -static psa_algorithm_t psa_aead_get_base_algorithm(psa_algorithm_t alg) -{ - return PSA_ALG_AEAD_WITH_DEFAULT_LENGTH_TAG(alg); -} - -/* Helper function to perform common nonce length checks. */ -static psa_status_t psa_aead_check_nonce_length(psa_algorithm_t alg, - size_t nonce_length) -{ - psa_algorithm_t base_alg = psa_aead_get_base_algorithm(alg); - - switch (base_alg) { -#if defined(PSA_WANT_ALG_GCM) - case PSA_ALG_GCM: - /* Not checking max nonce size here as GCM spec allows almost - * arbitrarily large nonces. Please note that we do not generally - * recommend the usage of nonces of greater length than - * PSA_AEAD_NONCE_MAX_SIZE, as large nonces are hashed to a shorter - * size, which can then lead to collisions if you encrypt a very - * large number of messages.*/ - if (nonce_length != 0) { - return PSA_SUCCESS; - } - break; -#endif /* PSA_WANT_ALG_GCM */ -#if defined(PSA_WANT_ALG_CCM) - case PSA_ALG_CCM: - if (nonce_length >= 7 && nonce_length <= 13) { - return PSA_SUCCESS; - } - break; -#endif /* PSA_WANT_ALG_CCM */ -#if defined(PSA_WANT_ALG_CHACHA20_POLY1305) - case PSA_ALG_CHACHA20_POLY1305: - if (nonce_length == 12) { - return PSA_SUCCESS; - } else if (nonce_length == 8) { - return PSA_ERROR_NOT_SUPPORTED; - } - break; -#endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */ - default: - (void) nonce_length; - return PSA_ERROR_NOT_SUPPORTED; - } - - return PSA_ERROR_INVALID_ARGUMENT; -} - -static psa_status_t psa_aead_check_algorithm(psa_algorithm_t alg) -{ - if (!PSA_ALG_IS_AEAD(alg) || PSA_ALG_IS_WILDCARD(alg)) { - return PSA_ERROR_INVALID_ARGUMENT; - } - - return PSA_SUCCESS; -} - -psa_status_t psa_aead_encrypt(mbedtls_svc_key_id_t key, - psa_algorithm_t alg, - const uint8_t *nonce_external, - size_t nonce_length, - const uint8_t *additional_data_external, - size_t additional_data_length, - const uint8_t *plaintext_external, - size_t plaintext_length, - uint8_t *ciphertext_external, - size_t ciphertext_size, - size_t *ciphertext_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_slot_t *slot; - - LOCAL_INPUT_DECLARE(nonce_external, nonce); - LOCAL_INPUT_DECLARE(additional_data_external, additional_data); - LOCAL_INPUT_DECLARE(plaintext_external, plaintext); - LOCAL_OUTPUT_DECLARE(ciphertext_external, ciphertext); - - *ciphertext_length = 0; - - status = psa_aead_check_algorithm(alg); - if (status != PSA_SUCCESS) { - return status; - } - - status = psa_get_and_lock_key_slot_with_policy( - key, &slot, PSA_KEY_USAGE_ENCRYPT, alg); - if (status != PSA_SUCCESS) { - return status; - } - - LOCAL_INPUT_ALLOC(nonce_external, nonce_length, nonce); - LOCAL_INPUT_ALLOC(additional_data_external, additional_data_length, additional_data); - LOCAL_INPUT_ALLOC(plaintext_external, plaintext_length, plaintext); - LOCAL_OUTPUT_ALLOC(ciphertext_external, ciphertext_size, ciphertext); - - status = psa_aead_check_nonce_length(alg, nonce_length); - if (status != PSA_SUCCESS) { - goto exit; - } - - status = psa_driver_wrapper_aead_encrypt( - &slot->attr, slot->key.data, slot->key.bytes, - alg, - nonce, nonce_length, - additional_data, additional_data_length, - plaintext, plaintext_length, - ciphertext, ciphertext_size, ciphertext_length); - - if (status != PSA_SUCCESS && ciphertext_size != 0) { - memset(ciphertext, 0, ciphertext_size); - } - -exit: - LOCAL_INPUT_FREE(nonce_external, nonce); - LOCAL_INPUT_FREE(additional_data_external, additional_data); - LOCAL_INPUT_FREE(plaintext_external, plaintext); - LOCAL_OUTPUT_FREE(ciphertext_external, ciphertext); - - psa_unregister_read_under_mutex(slot); - - return status; -} - -psa_status_t psa_aead_decrypt(mbedtls_svc_key_id_t key, - psa_algorithm_t alg, - const uint8_t *nonce_external, - size_t nonce_length, - const uint8_t *additional_data_external, - size_t additional_data_length, - const uint8_t *ciphertext_external, - size_t ciphertext_length, - uint8_t *plaintext_external, - size_t plaintext_size, - size_t *plaintext_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_slot_t *slot; - - LOCAL_INPUT_DECLARE(nonce_external, nonce); - LOCAL_INPUT_DECLARE(additional_data_external, additional_data); - LOCAL_INPUT_DECLARE(ciphertext_external, ciphertext); - LOCAL_OUTPUT_DECLARE(plaintext_external, plaintext); - - *plaintext_length = 0; - - status = psa_aead_check_algorithm(alg); - if (status != PSA_SUCCESS) { - return status; - } - - status = psa_get_and_lock_key_slot_with_policy( - key, &slot, PSA_KEY_USAGE_DECRYPT, alg); - if (status != PSA_SUCCESS) { - return status; - } - - LOCAL_INPUT_ALLOC(nonce_external, nonce_length, nonce); - LOCAL_INPUT_ALLOC(additional_data_external, additional_data_length, - additional_data); - LOCAL_INPUT_ALLOC(ciphertext_external, ciphertext_length, ciphertext); - LOCAL_OUTPUT_ALLOC(plaintext_external, plaintext_size, plaintext); - - status = psa_aead_check_nonce_length(alg, nonce_length); - if (status != PSA_SUCCESS) { - goto exit; - } - - status = psa_driver_wrapper_aead_decrypt( - &slot->attr, slot->key.data, slot->key.bytes, - alg, - nonce, nonce_length, - additional_data, additional_data_length, - ciphertext, ciphertext_length, - plaintext, plaintext_size, plaintext_length); - - if (status != PSA_SUCCESS && plaintext_size != 0) { - memset(plaintext, 0, plaintext_size); - } - -exit: - LOCAL_INPUT_FREE(nonce_external, nonce); - LOCAL_INPUT_FREE(additional_data_external, additional_data); - LOCAL_INPUT_FREE(ciphertext_external, ciphertext); - LOCAL_OUTPUT_FREE(plaintext_external, plaintext); - - psa_unregister_read_under_mutex(slot); - - return status; -} - -static psa_status_t psa_validate_tag_length(psa_algorithm_t alg) -{ - const uint8_t tag_len = PSA_ALG_AEAD_GET_TAG_LENGTH(alg); - - switch (PSA_ALG_AEAD_WITH_SHORTENED_TAG(alg, 0)) { -#if defined(PSA_WANT_ALG_CCM) - case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, 0): - /* CCM allows the following tag lengths: 4, 6, 8, 10, 12, 14, 16.*/ - if (tag_len < 4 || tag_len > 16 || tag_len % 2) { - return PSA_ERROR_INVALID_ARGUMENT; - } - break; -#endif /* PSA_WANT_ALG_CCM */ - -#if defined(PSA_WANT_ALG_GCM) - case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_GCM, 0): - /* GCM allows the following tag lengths: 4, 8, 12, 13, 14, 15, 16. */ - if (tag_len != 4 && tag_len != 8 && (tag_len < 12 || tag_len > 16)) { - return PSA_ERROR_INVALID_ARGUMENT; - } - break; -#endif /* PSA_WANT_ALG_GCM */ - -#if defined(PSA_WANT_ALG_CHACHA20_POLY1305) - case PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CHACHA20_POLY1305, 0): - /* We only support the default tag length. */ - if (tag_len != 16) { - return PSA_ERROR_INVALID_ARGUMENT; - } - break; -#endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */ - - default: - (void) tag_len; - return PSA_ERROR_NOT_SUPPORTED; - } - return PSA_SUCCESS; -} - -/* Set the key for a multipart authenticated operation. */ -static psa_status_t psa_aead_setup(psa_aead_operation_t *operation, - int is_encrypt, - mbedtls_svc_key_id_t key, - psa_algorithm_t alg) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_slot_t *slot = NULL; - psa_key_usage_t key_usage = 0; - - status = psa_aead_check_algorithm(alg); - if (status != PSA_SUCCESS) { - goto exit; - } - - if (operation->id != 0) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - if (operation->nonce_set || operation->lengths_set || - operation->ad_started || operation->body_started) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - /* Make sure the driver-dependent part of the operation is zeroed. - * This is a guarantee we make to drivers. Initializing the operation - * does not necessarily take care of it, since the context is a - * union and initializing a union does not necessarily initialize - * all of its members. */ - memset(&operation->ctx, 0, sizeof(operation->ctx)); - - if (is_encrypt) { - key_usage = PSA_KEY_USAGE_ENCRYPT; - } else { - key_usage = PSA_KEY_USAGE_DECRYPT; - } - - status = psa_get_and_lock_key_slot_with_policy(key, &slot, key_usage, - alg); - if (status != PSA_SUCCESS) { - goto exit; - } - - if ((status = psa_validate_tag_length(alg)) != PSA_SUCCESS) { - goto exit; - } - - if (is_encrypt) { - status = psa_driver_wrapper_aead_encrypt_setup(operation, - &slot->attr, - slot->key.data, - slot->key.bytes, - alg); - } else { - status = psa_driver_wrapper_aead_decrypt_setup(operation, - &slot->attr, - slot->key.data, - slot->key.bytes, - alg); - } - if (status != PSA_SUCCESS) { - goto exit; - } - - operation->key_type = psa_get_key_type(&slot->attr); - -exit: - unlock_status = psa_unregister_read_under_mutex(slot); - - if (status == PSA_SUCCESS) { - status = unlock_status; - operation->alg = psa_aead_get_base_algorithm(alg); - operation->is_encrypt = is_encrypt; - } else { - psa_aead_abort(operation); - } - - return status; -} - -/* Set the key for a multipart authenticated encryption operation. */ -psa_status_t psa_aead_encrypt_setup(psa_aead_operation_t *operation, - mbedtls_svc_key_id_t key, - psa_algorithm_t alg) -{ - return psa_aead_setup(operation, 1, key, alg); -} - -/* Set the key for a multipart authenticated decryption operation. */ -psa_status_t psa_aead_decrypt_setup(psa_aead_operation_t *operation, - mbedtls_svc_key_id_t key, - psa_algorithm_t alg) -{ - return psa_aead_setup(operation, 0, key, alg); -} - -static psa_status_t psa_aead_set_nonce_internal(psa_aead_operation_t *operation, - const uint8_t *nonce, - size_t nonce_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - if (operation->id == 0) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - if (operation->nonce_set) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - status = psa_aead_check_nonce_length(operation->alg, nonce_length); - if (status != PSA_SUCCESS) { - status = PSA_ERROR_INVALID_ARGUMENT; - goto exit; - } - - status = psa_driver_wrapper_aead_set_nonce(operation, nonce, - nonce_length); - -exit: - if (status == PSA_SUCCESS) { - operation->nonce_set = 1; - } else { - psa_aead_abort(operation); - } - - return status; -} - -/* Generate a random nonce / IV for multipart AEAD operation */ -psa_status_t psa_aead_generate_nonce(psa_aead_operation_t *operation, - uint8_t *nonce_external, - size_t nonce_size, - size_t *nonce_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - uint8_t local_nonce[PSA_AEAD_NONCE_MAX_SIZE]; - size_t required_nonce_size = 0; - - LOCAL_OUTPUT_DECLARE(nonce_external, nonce); - LOCAL_OUTPUT_ALLOC(nonce_external, nonce_size, nonce); - - *nonce_length = 0; - - if (operation->id == 0) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - if (operation->nonce_set || !operation->is_encrypt) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - /* For CCM, this size may not be correct according to the PSA - * specification. The PSA Crypto 1.0.1 specification states: - * - * CCM encodes the plaintext length pLen in L octets, with L the smallest - * integer >= 2 where pLen < 2^(8L). The nonce length is then 15 - L bytes. - * - * However this restriction that L has to be the smallest integer is not - * applied in practice, and it is not implementable here since the - * plaintext length may or may not be known at this time. */ - required_nonce_size = PSA_AEAD_NONCE_LENGTH(operation->key_type, - operation->alg); - if (nonce_size < required_nonce_size) { - status = PSA_ERROR_BUFFER_TOO_SMALL; - goto exit; - } - - status = psa_generate_random_internal(local_nonce, required_nonce_size); - if (status != PSA_SUCCESS) { - goto exit; - } - - status = psa_aead_set_nonce_internal(operation, local_nonce, - required_nonce_size); - -exit: - if (status == PSA_SUCCESS) { - memcpy(nonce, local_nonce, required_nonce_size); - *nonce_length = required_nonce_size; - } else { - psa_aead_abort(operation); - } - - LOCAL_OUTPUT_FREE(nonce_external, nonce); - - return status; -} - -/* Set the nonce for a multipart authenticated encryption or decryption - operation.*/ -psa_status_t psa_aead_set_nonce(psa_aead_operation_t *operation, - const uint8_t *nonce_external, - size_t nonce_length) -{ - psa_status_t status; - - LOCAL_INPUT_DECLARE(nonce_external, nonce); - LOCAL_INPUT_ALLOC(nonce_external, nonce_length, nonce); - - status = psa_aead_set_nonce_internal(operation, nonce, nonce_length); - -/* Exit label is only needed for buffer copying, prevent unused warnings. */ -#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS) -exit: -#endif - - LOCAL_INPUT_FREE(nonce_external, nonce); - - return status; -} - -/* Declare the lengths of the message and additional data for multipart AEAD. */ -psa_status_t psa_aead_set_lengths(psa_aead_operation_t *operation, - size_t ad_length, - size_t plaintext_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - if (operation->id == 0) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - if (operation->lengths_set || operation->ad_started || - operation->body_started) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - switch (operation->alg) { -#if defined(PSA_WANT_ALG_GCM) - case PSA_ALG_GCM: - /* Lengths can only be too large for GCM if size_t is bigger than 32 - * bits. Without the guard this code will generate warnings on 32bit - * builds. */ -#if SIZE_MAX > UINT32_MAX - if (((uint64_t) ad_length) >> 61 != 0 || - ((uint64_t) plaintext_length) > 0xFFFFFFFE0ull) { - status = PSA_ERROR_INVALID_ARGUMENT; - goto exit; - } -#endif - break; -#endif /* PSA_WANT_ALG_GCM */ -#if defined(PSA_WANT_ALG_CCM) - case PSA_ALG_CCM: - if (ad_length > 0xFF00) { - status = PSA_ERROR_INVALID_ARGUMENT; - goto exit; - } - break; -#endif /* PSA_WANT_ALG_CCM */ -#if defined(PSA_WANT_ALG_CHACHA20_POLY1305) - case PSA_ALG_CHACHA20_POLY1305: - /* No length restrictions for ChaChaPoly. */ - break; -#endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */ - default: - break; - } - - status = psa_driver_wrapper_aead_set_lengths(operation, ad_length, - plaintext_length); - -exit: - if (status == PSA_SUCCESS) { - operation->ad_remaining = ad_length; - operation->body_remaining = plaintext_length; - operation->lengths_set = 1; - } else { - psa_aead_abort(operation); - } - - return status; -} - -/* Pass additional data to an active multipart AEAD operation. */ -psa_status_t psa_aead_update_ad(psa_aead_operation_t *operation, - const uint8_t *input_external, - size_t input_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - LOCAL_INPUT_DECLARE(input_external, input); - LOCAL_INPUT_ALLOC(input_external, input_length, input); - - if (operation->id == 0) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - if (!operation->nonce_set || operation->body_started) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - /* No input to add (zero length), nothing to do. */ - if (input_length == 0) { - status = PSA_SUCCESS; - goto exit; - } - - if (operation->lengths_set) { - if (operation->ad_remaining < input_length) { - status = PSA_ERROR_INVALID_ARGUMENT; - goto exit; - } - - operation->ad_remaining -= input_length; - } -#if defined(PSA_WANT_ALG_CCM) - else if (operation->alg == PSA_ALG_CCM) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } -#endif /* PSA_WANT_ALG_CCM */ - - status = psa_driver_wrapper_aead_update_ad(operation, input, - input_length); - -exit: - if (status == PSA_SUCCESS) { - operation->ad_started = 1; - } else { - psa_aead_abort(operation); - } - - LOCAL_INPUT_FREE(input_external, input); - - return status; -} - -/* Encrypt or decrypt a message fragment in an active multipart AEAD - operation.*/ -psa_status_t psa_aead_update(psa_aead_operation_t *operation, - const uint8_t *input_external, - size_t input_length, - uint8_t *output_external, - size_t output_size, - size_t *output_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - - LOCAL_INPUT_DECLARE(input_external, input); - LOCAL_OUTPUT_DECLARE(output_external, output); - - LOCAL_INPUT_ALLOC(input_external, input_length, input); - LOCAL_OUTPUT_ALLOC(output_external, output_size, output); - - *output_length = 0; - - if (operation->id == 0) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - if (!operation->nonce_set) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - if (operation->lengths_set) { - /* Additional data length was supplied, but not all the additional - data was supplied.*/ - if (operation->ad_remaining != 0) { - status = PSA_ERROR_INVALID_ARGUMENT; - goto exit; - } - - /* Too much data provided. */ - if (operation->body_remaining < input_length) { - status = PSA_ERROR_INVALID_ARGUMENT; - goto exit; - } - - operation->body_remaining -= input_length; - } -#if defined(PSA_WANT_ALG_CCM) - else if (operation->alg == PSA_ALG_CCM) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } -#endif /* PSA_WANT_ALG_CCM */ - - status = psa_driver_wrapper_aead_update(operation, input, input_length, - output, output_size, - output_length); - -exit: - if (status == PSA_SUCCESS) { - operation->body_started = 1; - } else { - psa_aead_abort(operation); - } - - LOCAL_INPUT_FREE(input_external, input); - LOCAL_OUTPUT_FREE(output_external, output); - - return status; -} - -static psa_status_t psa_aead_final_checks(const psa_aead_operation_t *operation) -{ - if (operation->id == 0 || !operation->nonce_set) { - return PSA_ERROR_BAD_STATE; - } - - if (operation->lengths_set && (operation->ad_remaining != 0 || - operation->body_remaining != 0)) { - return PSA_ERROR_INVALID_ARGUMENT; - } - - return PSA_SUCCESS; -} - -/* Finish encrypting a message in a multipart AEAD operation. */ -psa_status_t psa_aead_finish(psa_aead_operation_t *operation, - uint8_t *ciphertext_external, - size_t ciphertext_size, - size_t *ciphertext_length, - uint8_t *tag_external, - size_t tag_size, - size_t *tag_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - LOCAL_OUTPUT_DECLARE(ciphertext_external, ciphertext); - LOCAL_OUTPUT_DECLARE(tag_external, tag); - - LOCAL_OUTPUT_ALLOC(ciphertext_external, ciphertext_size, ciphertext); - LOCAL_OUTPUT_ALLOC(tag_external, tag_size, tag); - - *ciphertext_length = 0; - *tag_length = tag_size; - - status = psa_aead_final_checks(operation); - if (status != PSA_SUCCESS) { - goto exit; - } - - if (!operation->is_encrypt) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - status = psa_driver_wrapper_aead_finish(operation, ciphertext, - ciphertext_size, - ciphertext_length, - tag, tag_size, tag_length); - -exit: - - - /* In case the operation fails and the user fails to check for failure or - * the zero tag size, make sure the tag is set to something implausible. - * Even if the operation succeeds, make sure we clear the rest of the - * buffer to prevent potential leakage of anything previously placed in - * the same buffer.*/ - psa_wipe_tag_output_buffer(tag, status, tag_size, *tag_length); - - psa_aead_abort(operation); - - LOCAL_OUTPUT_FREE(ciphertext_external, ciphertext); - LOCAL_OUTPUT_FREE(tag_external, tag); - - return status; -} - -/* Finish authenticating and decrypting a message in a multipart AEAD - operation.*/ -psa_status_t psa_aead_verify(psa_aead_operation_t *operation, - uint8_t *plaintext_external, - size_t plaintext_size, - size_t *plaintext_length, - const uint8_t *tag_external, - size_t tag_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - LOCAL_OUTPUT_DECLARE(plaintext_external, plaintext); - LOCAL_INPUT_DECLARE(tag_external, tag); - - LOCAL_OUTPUT_ALLOC(plaintext_external, plaintext_size, plaintext); - LOCAL_INPUT_ALLOC(tag_external, tag_length, tag); - - *plaintext_length = 0; - - status = psa_aead_final_checks(operation); - if (status != PSA_SUCCESS) { - goto exit; - } - - if (operation->is_encrypt) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - status = psa_driver_wrapper_aead_verify(operation, plaintext, - plaintext_size, - plaintext_length, - tag, tag_length); - -exit: - psa_aead_abort(operation); - - LOCAL_OUTPUT_FREE(plaintext_external, plaintext); - LOCAL_INPUT_FREE(tag_external, tag); - - return status; -} - -/* Abort an AEAD operation. */ -psa_status_t psa_aead_abort(psa_aead_operation_t *operation) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - if (operation->id == 0) { - /* The object has (apparently) been initialized but it is not (yet) - * in use. It's ok to call abort on such an object, and there's - * nothing to do. */ - return PSA_SUCCESS; - } - - status = psa_driver_wrapper_aead_abort(operation); - - memset(operation, 0, sizeof(*operation)); - - return status; -} - -/****************************************************************/ -/* Key derivation: output generation */ -/****************************************************************/ - -#if defined(BUILTIN_ALG_ANY_HKDF) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) || \ - defined(PSA_HAVE_SOFT_PBKDF2) -#define AT_LEAST_ONE_BUILTIN_KDF -#endif /* At least one builtin KDF */ - -#if defined(BUILTIN_ALG_ANY_HKDF) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) - -/** Internal helper to set up an HMAC operation with a key passed directly. - * - * \param[in,out] operation A MAC operation object. It does not need to - * be initialized. - * \param hash_alg The hash algorithm used for HMAC. - * \param hmac_key The HMAC key. - * \param hmac_key_length Length of \p hmac_key in bytes. - * - * \return A PSA status code. - */ -static psa_status_t psa_key_derivation_start_hmac( - psa_mac_operation_t *operation, - psa_algorithm_t hash_alg, - const uint8_t *hmac_key, - size_t hmac_key_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; - psa_set_key_type(&attributes, PSA_KEY_TYPE_HMAC); - psa_set_key_bits(&attributes, PSA_BYTES_TO_BITS(hmac_key_length)); - psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_HASH); - - /* Make sure the whole the operation is zeroed. - * It isn't enough to require the caller to initialize operation to - * PSA_MAC_OPERATION_INIT, since one field is a union and initializing - * a union does not necessarily initialize all of its members. - * psa_mac_setup() would handle PSA_MAC_OPERATION_INIT, but here we - * bypass it and call lower-level functions directly. */ - memset(operation, 0, sizeof(*operation)); - - operation->is_sign = 1; - operation->mac_size = PSA_HASH_LENGTH(hash_alg); - - status = psa_driver_wrapper_mac_sign_setup(operation, - &attributes, - hmac_key, hmac_key_length, - PSA_ALG_HMAC(hash_alg)); - - psa_reset_key_attributes(&attributes); - return status; -} -#endif /* KDF algorithms reliant on HMAC */ - -#define HKDF_STATE_INIT 0 /* no input yet */ -#define HKDF_STATE_STARTED 1 /* got salt */ -#define HKDF_STATE_KEYED 2 /* got key */ -#define HKDF_STATE_OUTPUT 3 /* output started */ - -static psa_algorithm_t psa_key_derivation_get_kdf_alg( - const psa_key_derivation_operation_t *operation) -{ - if (PSA_ALG_IS_KEY_AGREEMENT(operation->alg)) { - return PSA_ALG_KEY_AGREEMENT_GET_KDF(operation->alg); - } else { - return operation->alg; - } -} - -psa_status_t psa_key_derivation_abort(psa_key_derivation_operation_t *operation) -{ - psa_status_t status = PSA_SUCCESS; - psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation); - if (kdf_alg == 0) { - /* The object has (apparently) been initialized but it is not - * in use. It's ok to call abort on such an object, and there's - * nothing to do. */ - } else -#if defined(BUILTIN_ALG_ANY_HKDF) - if (PSA_ALG_IS_ANY_HKDF(kdf_alg)) { - mbedtls_free(operation->ctx.hkdf.info); - status = psa_mac_abort(&operation->ctx.hkdf.hmac); - } else -#endif /* BUILTIN_ALG_ANY_HKDF */ -#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) - if (PSA_ALG_IS_TLS12_PRF(kdf_alg) || - /* TLS-1.2 PSK-to-MS KDF uses the same core as TLS-1.2 PRF */ - PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) { - if (operation->ctx.tls12_prf.secret != NULL) { - mbedtls_zeroize_and_free(operation->ctx.tls12_prf.secret, - operation->ctx.tls12_prf.secret_length); - } - - if (operation->ctx.tls12_prf.seed != NULL) { - mbedtls_zeroize_and_free(operation->ctx.tls12_prf.seed, - operation->ctx.tls12_prf.seed_length); - } - - if (operation->ctx.tls12_prf.label != NULL) { - mbedtls_zeroize_and_free(operation->ctx.tls12_prf.label, - operation->ctx.tls12_prf.label_length); - } -#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) - if (operation->ctx.tls12_prf.other_secret != NULL) { - mbedtls_zeroize_and_free(operation->ctx.tls12_prf.other_secret, - operation->ctx.tls12_prf.other_secret_length); - } -#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */ - status = PSA_SUCCESS; - - /* We leave the fields Ai and output_block to be erased safely by the - * mbedtls_platform_zeroize() in the end of this function. */ - } else -#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || - * defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) */ -#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) - if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) { - mbedtls_platform_zeroize(operation->ctx.tls12_ecjpake_to_pms.data, - sizeof(operation->ctx.tls12_ecjpake_to_pms.data)); - } else -#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) */ -#if defined(PSA_HAVE_SOFT_PBKDF2) - if (PSA_ALG_IS_PBKDF2(kdf_alg)) { - if (operation->ctx.pbkdf2.salt != NULL) { - mbedtls_zeroize_and_free(operation->ctx.pbkdf2.salt, - operation->ctx.pbkdf2.salt_length); - } - - status = PSA_SUCCESS; - } else -#endif /* defined(PSA_HAVE_SOFT_PBKDF2) */ - { - status = PSA_ERROR_BAD_STATE; - } - mbedtls_platform_zeroize(operation, sizeof(*operation)); - return status; -} - -psa_status_t psa_key_derivation_get_capacity(const psa_key_derivation_operation_t *operation, - size_t *capacity) -{ - if (operation->alg == 0) { - /* This is a blank key derivation operation. */ - return PSA_ERROR_BAD_STATE; - } - - *capacity = operation->capacity; - return PSA_SUCCESS; -} - -psa_status_t psa_key_derivation_set_capacity(psa_key_derivation_operation_t *operation, - size_t capacity) -{ - if (operation->alg == 0) { - return PSA_ERROR_BAD_STATE; - } - if (capacity > operation->capacity) { - return PSA_ERROR_INVALID_ARGUMENT; - } - operation->capacity = capacity; - return PSA_SUCCESS; -} - -#if defined(BUILTIN_ALG_ANY_HKDF) -/* Read some bytes from an HKDF-based operation. */ -static psa_status_t psa_key_derivation_hkdf_read(psa_hkdf_key_derivation_t *hkdf, - psa_algorithm_t kdf_alg, - uint8_t *output, - size_t output_length) -{ - psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(kdf_alg); - uint8_t hash_length = PSA_HASH_LENGTH(hash_alg); - size_t hmac_output_length; - psa_status_t status; -#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT) - const uint8_t last_block = PSA_ALG_IS_HKDF_EXTRACT(kdf_alg) ? 0 : 0xff; -#else - const uint8_t last_block = 0xff; -#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */ - - if (hkdf->state < HKDF_STATE_KEYED || - (!hkdf->info_set -#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT) - && !PSA_ALG_IS_HKDF_EXTRACT(kdf_alg) -#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */ - )) { - return PSA_ERROR_BAD_STATE; - } - hkdf->state = HKDF_STATE_OUTPUT; - - while (output_length != 0) { - /* Copy what remains of the current block */ - uint8_t n = hash_length - hkdf->offset_in_block; - if (n > output_length) { - n = (uint8_t) output_length; - } - memcpy(output, hkdf->output_block + hkdf->offset_in_block, n); - output += n; - output_length -= n; - hkdf->offset_in_block += n; - if (output_length == 0) { - break; - } - /* We can't be wanting more output after the last block, otherwise - * the capacity check in psa_key_derivation_output_bytes() would have - * prevented this call. It could happen only if the operation - * object was corrupted or if this function is called directly - * inside the library. */ - if (hkdf->block_number == last_block) { - return PSA_ERROR_BAD_STATE; - } - - /* We need a new block */ - ++hkdf->block_number; - hkdf->offset_in_block = 0; - - status = psa_key_derivation_start_hmac(&hkdf->hmac, - hash_alg, - hkdf->prk, - hash_length); - if (status != PSA_SUCCESS) { - return status; - } - - if (hkdf->block_number != 1) { - status = psa_mac_update(&hkdf->hmac, - hkdf->output_block, - hash_length); - if (status != PSA_SUCCESS) { - return status; - } - } - status = psa_mac_update(&hkdf->hmac, - hkdf->info, - hkdf->info_length); - if (status != PSA_SUCCESS) { - return status; - } - status = psa_mac_update(&hkdf->hmac, - &hkdf->block_number, 1); - if (status != PSA_SUCCESS) { - return status; - } - status = psa_mac_sign_finish(&hkdf->hmac, - hkdf->output_block, - sizeof(hkdf->output_block), - &hmac_output_length); - if (status != PSA_SUCCESS) { - return status; - } - } - - return PSA_SUCCESS; -} -#endif /* BUILTIN_ALG_ANY_HKDF */ - -#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) -static psa_status_t psa_key_derivation_tls12_prf_generate_next_block( - psa_tls12_prf_key_derivation_t *tls12_prf, - psa_algorithm_t alg) -{ - psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(alg); - uint8_t hash_length = PSA_HASH_LENGTH(hash_alg); - psa_mac_operation_t hmac; - size_t hmac_output_length; - psa_status_t status, cleanup_status; - - /* We can't be wanting more output after block 0xff, otherwise - * the capacity check in psa_key_derivation_output_bytes() would have - * prevented this call. It could happen only if the operation - * object was corrupted or if this function is called directly - * inside the library. */ - if (tls12_prf->block_number == 0xff) { - return PSA_ERROR_CORRUPTION_DETECTED; - } - - /* We need a new block */ - ++tls12_prf->block_number; - tls12_prf->left_in_block = hash_length; - - /* Recall the definition of the TLS-1.2-PRF from RFC 5246: - * - * PRF(secret, label, seed) = P_(secret, label + seed) - * - * P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) + - * HMAC_hash(secret, A(2) + seed) + - * HMAC_hash(secret, A(3) + seed) + ... - * - * A(0) = seed - * A(i) = HMAC_hash(secret, A(i-1)) - * - * The `psa_tls12_prf_key_derivation` structure saves the block - * `HMAC_hash(secret, A(i) + seed)` from which the output - * is currently extracted as `output_block` and where i is - * `block_number`. - */ - - status = psa_key_derivation_start_hmac(&hmac, - hash_alg, - tls12_prf->secret, - tls12_prf->secret_length); - if (status != PSA_SUCCESS) { - goto cleanup; - } - - /* Calculate A(i) where i = tls12_prf->block_number. */ - if (tls12_prf->block_number == 1) { - /* A(1) = HMAC_hash(secret, A(0)), where A(0) = seed. (The RFC overloads - * the variable seed and in this instance means it in the context of the - * P_hash function, where seed = label + seed.) */ - status = psa_mac_update(&hmac, - tls12_prf->label, - tls12_prf->label_length); - if (status != PSA_SUCCESS) { - goto cleanup; - } - status = psa_mac_update(&hmac, - tls12_prf->seed, - tls12_prf->seed_length); - if (status != PSA_SUCCESS) { - goto cleanup; - } - } else { - /* A(i) = HMAC_hash(secret, A(i-1)) */ - status = psa_mac_update(&hmac, tls12_prf->Ai, hash_length); - if (status != PSA_SUCCESS) { - goto cleanup; - } - } - - status = psa_mac_sign_finish(&hmac, - tls12_prf->Ai, hash_length, - &hmac_output_length); - if (hmac_output_length != hash_length) { - status = PSA_ERROR_CORRUPTION_DETECTED; - } - if (status != PSA_SUCCESS) { - goto cleanup; - } - - /* Calculate HMAC_hash(secret, A(i) + label + seed). */ - status = psa_key_derivation_start_hmac(&hmac, - hash_alg, - tls12_prf->secret, - tls12_prf->secret_length); - if (status != PSA_SUCCESS) { - goto cleanup; - } - status = psa_mac_update(&hmac, tls12_prf->Ai, hash_length); - if (status != PSA_SUCCESS) { - goto cleanup; - } - status = psa_mac_update(&hmac, tls12_prf->label, tls12_prf->label_length); - if (status != PSA_SUCCESS) { - goto cleanup; - } - status = psa_mac_update(&hmac, tls12_prf->seed, tls12_prf->seed_length); - if (status != PSA_SUCCESS) { - goto cleanup; - } - status = psa_mac_sign_finish(&hmac, - tls12_prf->output_block, hash_length, - &hmac_output_length); - if (status != PSA_SUCCESS) { - goto cleanup; - } - - -cleanup: - cleanup_status = psa_mac_abort(&hmac); - if (status == PSA_SUCCESS && cleanup_status != PSA_SUCCESS) { - status = cleanup_status; - } - - return status; -} - -static psa_status_t psa_key_derivation_tls12_prf_read( - psa_tls12_prf_key_derivation_t *tls12_prf, - psa_algorithm_t alg, - uint8_t *output, - size_t output_length) -{ - psa_algorithm_t hash_alg = PSA_ALG_TLS12_PRF_GET_HASH(alg); - uint8_t hash_length = PSA_HASH_LENGTH(hash_alg); - psa_status_t status; - uint8_t offset, length; - - switch (tls12_prf->state) { - case PSA_TLS12_PRF_STATE_LABEL_SET: - tls12_prf->state = PSA_TLS12_PRF_STATE_OUTPUT; - break; - case PSA_TLS12_PRF_STATE_OUTPUT: - break; - default: - return PSA_ERROR_BAD_STATE; - } - - while (output_length != 0) { - /* Check if we have fully processed the current block. */ - if (tls12_prf->left_in_block == 0) { - status = psa_key_derivation_tls12_prf_generate_next_block(tls12_prf, - alg); - if (status != PSA_SUCCESS) { - return status; - } - - continue; - } - - if (tls12_prf->left_in_block > output_length) { - length = (uint8_t) output_length; - } else { - length = tls12_prf->left_in_block; - } - - offset = hash_length - tls12_prf->left_in_block; - memcpy(output, tls12_prf->output_block + offset, length); - output += length; - output_length -= length; - tls12_prf->left_in_block -= length; - } - - return PSA_SUCCESS; -} -#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF || - * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */ - -#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) -static psa_status_t psa_key_derivation_tls12_ecjpake_to_pms_read( - psa_tls12_ecjpake_to_pms_t *ecjpake, - uint8_t *output, - size_t output_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - size_t output_size = 0; - - if (output_length != 32) { - return PSA_ERROR_INVALID_ARGUMENT; - } - - status = psa_hash_compute(PSA_ALG_SHA_256, ecjpake->data, - PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE, output, output_length, - &output_size); - if (status != PSA_SUCCESS) { - return status; - } - - if (output_size != output_length) { - return PSA_ERROR_GENERIC_ERROR; - } - - return PSA_SUCCESS; -} -#endif - -#if defined(PSA_HAVE_SOFT_PBKDF2) -static psa_status_t psa_key_derivation_pbkdf2_generate_block( - psa_pbkdf2_key_derivation_t *pbkdf2, - psa_algorithm_t prf_alg, - uint8_t prf_output_length, - psa_key_attributes_t *attributes) -{ - psa_status_t status; - psa_mac_operation_t mac_operation; - /* Make sure the whole the operation is zeroed. - * PSA_MAC_OPERATION_INIT does not necessarily do it fully, - * since one field is a union and initializing a union does not - * necessarily initialize all of its members. - * psa_mac_setup() would do it, but here we bypass it and call - * lower-level functions directly. */ - memset(&mac_operation, 0, sizeof(mac_operation)); - size_t mac_output_length; - uint8_t U_i[PSA_MAC_MAX_SIZE]; - uint8_t *U_accumulator = pbkdf2->output_block; - uint64_t i; - uint8_t block_counter[4]; - - mac_operation.is_sign = 1; - mac_operation.mac_size = prf_output_length; - MBEDTLS_PUT_UINT32_BE(pbkdf2->block_number, block_counter, 0); - - status = psa_driver_wrapper_mac_sign_setup(&mac_operation, - attributes, - pbkdf2->password, - pbkdf2->password_length, - prf_alg); - if (status != PSA_SUCCESS) { - goto cleanup; - } - status = psa_mac_update(&mac_operation, pbkdf2->salt, pbkdf2->salt_length); - if (status != PSA_SUCCESS) { - goto cleanup; - } - status = psa_mac_update(&mac_operation, block_counter, sizeof(block_counter)); - if (status != PSA_SUCCESS) { - goto cleanup; - } - status = psa_mac_sign_finish(&mac_operation, U_i, sizeof(U_i), - &mac_output_length); - if (status != PSA_SUCCESS) { - goto cleanup; - } - - if (mac_output_length != prf_output_length) { - status = PSA_ERROR_CORRUPTION_DETECTED; - goto cleanup; - } - - memcpy(U_accumulator, U_i, prf_output_length); - - for (i = 1; i < pbkdf2->input_cost; i++) { - /* We are passing prf_output_length as mac_size because the driver - * function directly sets mac_output_length as mac_size upon success. - * See https://github.com/Mbed-TLS/mbedtls/issues/7801 */ - status = psa_driver_wrapper_mac_compute(attributes, - pbkdf2->password, - pbkdf2->password_length, - prf_alg, U_i, prf_output_length, - U_i, prf_output_length, - &mac_output_length); - if (status != PSA_SUCCESS) { - goto cleanup; - } - - mbedtls_xor(U_accumulator, U_accumulator, U_i, prf_output_length); - } - -cleanup: - /* Zeroise buffers to clear sensitive data from memory. */ - mbedtls_platform_zeroize(U_i, PSA_MAC_MAX_SIZE); - return status; -} - -static psa_status_t psa_key_derivation_pbkdf2_read( - psa_pbkdf2_key_derivation_t *pbkdf2, - psa_algorithm_t kdf_alg, - uint8_t *output, - size_t output_length) -{ - psa_status_t status; - psa_algorithm_t prf_alg; - uint8_t prf_output_length; - psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; - psa_set_key_bits(&attributes, PSA_BYTES_TO_BITS(pbkdf2->password_length)); - psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_MESSAGE); - - if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) { - prf_alg = PSA_ALG_HMAC(PSA_ALG_PBKDF2_HMAC_GET_HASH(kdf_alg)); - prf_output_length = PSA_HASH_LENGTH(prf_alg); - psa_set_key_type(&attributes, PSA_KEY_TYPE_HMAC); - } else if (kdf_alg == PSA_ALG_PBKDF2_AES_CMAC_PRF_128) { - prf_alg = PSA_ALG_CMAC; - prf_output_length = PSA_MAC_LENGTH(PSA_KEY_TYPE_AES, 128U, PSA_ALG_CMAC); - psa_set_key_type(&attributes, PSA_KEY_TYPE_AES); - } else { - return PSA_ERROR_INVALID_ARGUMENT; - } - - switch (pbkdf2->state) { - case PSA_PBKDF2_STATE_PASSWORD_SET: - /* Initially we need a new block so bytes_used is equal to block size*/ - pbkdf2->bytes_used = prf_output_length; - pbkdf2->state = PSA_PBKDF2_STATE_OUTPUT; - break; - case PSA_PBKDF2_STATE_OUTPUT: - break; - default: - return PSA_ERROR_BAD_STATE; - } - - while (output_length != 0) { - uint8_t n = prf_output_length - pbkdf2->bytes_used; - if (n > output_length) { - n = (uint8_t) output_length; - } - memcpy(output, pbkdf2->output_block + pbkdf2->bytes_used, n); - output += n; - output_length -= n; - pbkdf2->bytes_used += n; - - if (output_length == 0) { - break; - } - - /* We need a new block */ - pbkdf2->bytes_used = 0; - pbkdf2->block_number++; - - status = psa_key_derivation_pbkdf2_generate_block(pbkdf2, prf_alg, - prf_output_length, - &attributes); - if (status != PSA_SUCCESS) { - return status; - } - } - - return PSA_SUCCESS; -} -#endif /* PSA_HAVE_SOFT_PBKDF2 */ - -psa_status_t psa_key_derivation_output_bytes( - psa_key_derivation_operation_t *operation, - uint8_t *output_external, - size_t output_length) -{ - psa_status_t status; - LOCAL_OUTPUT_DECLARE(output_external, output); - - psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation); - - if (operation->alg == 0) { - /* This is a blank operation. */ - return PSA_ERROR_BAD_STATE; - } - - if (output_length == 0 && operation->capacity == 0) { - /* Edge case: this is a finished operation, and 0 bytes - * were requested. The right error in this case could - * be either INSUFFICIENT_CAPACITY or BAD_STATE. Return - * INSUFFICIENT_CAPACITY, which is right for a finished - * operation, for consistency with the case when - * output_length > 0. */ - return PSA_ERROR_INSUFFICIENT_DATA; - } - - LOCAL_OUTPUT_ALLOC(output_external, output_length, output); - if (output_length > operation->capacity) { - operation->capacity = 0; - /* Go through the error path to wipe all confidential data now - * that the operation object is useless. */ - status = PSA_ERROR_INSUFFICIENT_DATA; - goto exit; - } - - operation->capacity -= output_length; - -#if defined(BUILTIN_ALG_ANY_HKDF) - if (PSA_ALG_IS_ANY_HKDF(kdf_alg)) { - status = psa_key_derivation_hkdf_read(&operation->ctx.hkdf, kdf_alg, - output, output_length); - } else -#endif /* BUILTIN_ALG_ANY_HKDF */ -#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) - if (PSA_ALG_IS_TLS12_PRF(kdf_alg) || - PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) { - status = psa_key_derivation_tls12_prf_read(&operation->ctx.tls12_prf, - kdf_alg, output, - output_length); - } else -#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF || - * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */ -#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) - if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) { - status = psa_key_derivation_tls12_ecjpake_to_pms_read( - &operation->ctx.tls12_ecjpake_to_pms, output, output_length); - } else -#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */ -#if defined(PSA_HAVE_SOFT_PBKDF2) - if (PSA_ALG_IS_PBKDF2(kdf_alg)) { - status = psa_key_derivation_pbkdf2_read(&operation->ctx.pbkdf2, kdf_alg, - output, output_length); - } else -#endif /* PSA_HAVE_SOFT_PBKDF2 */ - - { - (void) kdf_alg; - status = PSA_ERROR_BAD_STATE; - LOCAL_OUTPUT_FREE(output_external, output); - - return status; - } - -exit: - if (status != PSA_SUCCESS) { - /* Preserve the algorithm upon errors, but clear all sensitive state. - * This allows us to differentiate between exhausted operations and - * blank operations, so we can return PSA_ERROR_BAD_STATE on blank - * operations. */ - psa_algorithm_t alg = operation->alg; - psa_key_derivation_abort(operation); - operation->alg = alg; - if (output != NULL) { - memset(output, '!', output_length); - } - } - - LOCAL_OUTPUT_FREE(output_external, output); - return status; -} - -#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES) -static void psa_des_set_key_parity(uint8_t *data, size_t data_size) -{ - if (data_size >= 8) { - mbedtls_des_key_set_parity(data); - } - if (data_size >= 16) { - mbedtls_des_key_set_parity(data + 8); - } - if (data_size >= 24) { - mbedtls_des_key_set_parity(data + 16); - } -} -#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */ - -/* - * ECC keys on a Weierstrass elliptic curve require the generation - * of a private key which is an integer - * in the range [1, N - 1], where N is the boundary of the private key domain: - * N is the prime p for Diffie-Hellman, or the order of the - * curve’s base point for ECC. - * - * Let m be the bit size of N, such that 2^m > N >= 2^(m-1). - * This function generates the private key using the following process: - * - * 1. Draw a byte string of length ceiling(m/8) bytes. - * 2. If m is not a multiple of 8, set the most significant - * (8 * ceiling(m/8) - m) bits of the first byte in the string to zero. - * 3. Convert the string to integer k by decoding it as a big-endian byte string. - * 4. If k > N - 2, discard the result and return to step 1. - * 5. Output k + 1 as the private key. - * - * This method allows compliance to NIST standards, specifically the methods titled - * Key-Pair Generation by Testing Candidates in the following publications: - * - NIST Special Publication 800-56A: Recommendation for Pair-Wise Key-Establishment - * Schemes Using Discrete Logarithm Cryptography [SP800-56A] §5.6.1.1.4 for - * Diffie-Hellman keys. - * - * - [SP800-56A] §5.6.1.2.2 or FIPS Publication 186-4: Digital Signature - * Standard (DSS) [FIPS186-4] §B.4.2 for elliptic curve keys. - * - * Note: Function allocates memory for *data buffer, so given *data should be - * always NULL. - */ -#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE) -#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE) -static psa_status_t psa_generate_derived_ecc_key_weierstrass_helper( - psa_key_slot_t *slot, - size_t bits, - psa_key_derivation_operation_t *operation, - uint8_t **data - ) -{ - unsigned key_out_of_range = 1; - mbedtls_mpi k; - mbedtls_mpi diff_N_2; - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - size_t m; - size_t m_bytes = 0; - - mbedtls_mpi_init(&k); - mbedtls_mpi_init(&diff_N_2); - - psa_ecc_family_t curve = PSA_KEY_TYPE_ECC_GET_FAMILY( - slot->attr.type); - mbedtls_ecp_group_id grp_id = - mbedtls_ecc_group_from_psa(curve, bits); - - if (grp_id == MBEDTLS_ECP_DP_NONE) { - ret = MBEDTLS_ERR_ASN1_INVALID_DATA; - goto cleanup; - } - - mbedtls_ecp_group ecp_group; - mbedtls_ecp_group_init(&ecp_group); - - MBEDTLS_MPI_CHK(mbedtls_ecp_group_load(&ecp_group, grp_id)); - - /* N is the boundary of the private key domain (ecp_group.N). */ - /* Let m be the bit size of N. */ - m = ecp_group.nbits; - - m_bytes = PSA_BITS_TO_BYTES(m); - - /* Calculate N - 2 - it will be needed later. */ - MBEDTLS_MPI_CHK(mbedtls_mpi_sub_int(&diff_N_2, &ecp_group.N, 2)); - - /* Note: This function is always called with *data == NULL and it - * allocates memory for the data buffer. */ - *data = mbedtls_calloc(1, m_bytes); - if (*data == NULL) { - ret = MBEDTLS_ERR_ASN1_ALLOC_FAILED; - goto cleanup; - } - - while (key_out_of_range) { - /* 1. Draw a byte string of length ceiling(m/8) bytes. */ - if ((status = psa_key_derivation_output_bytes(operation, *data, m_bytes)) != 0) { - goto cleanup; - } - - /* 2. If m is not a multiple of 8 */ - if (m % 8 != 0) { - /* Set the most significant - * (8 * ceiling(m/8) - m) bits of the first byte in - * the string to zero. - */ - uint8_t clear_bit_mask = (1 << (m % 8)) - 1; - (*data)[0] &= clear_bit_mask; - } - - /* 3. Convert the string to integer k by decoding it as a - * big-endian byte string. - */ - MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary(&k, *data, m_bytes)); - - /* 4. If k > N - 2, discard the result and return to step 1. - * Result of comparison is returned. When it indicates error - * then this function is called again. - */ - MBEDTLS_MPI_CHK(mbedtls_mpi_lt_mpi_ct(&diff_N_2, &k, &key_out_of_range)); - } - - /* 5. Output k + 1 as the private key. */ - MBEDTLS_MPI_CHK(mbedtls_mpi_add_int(&k, &k, 1)); - MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary(&k, *data, m_bytes)); -cleanup: - if (ret != 0) { - status = mbedtls_to_psa_error(ret); - } - if (status != PSA_SUCCESS) { - mbedtls_zeroize_and_free(*data, m_bytes); - *data = NULL; - } - mbedtls_mpi_free(&k); - mbedtls_mpi_free(&diff_N_2); - return status; -} - -/* ECC keys on a Montgomery elliptic curve draws a byte string whose length - * is determined by the curve, and sets the mandatory bits accordingly. That is: - * - * - Curve25519 (PSA_ECC_FAMILY_MONTGOMERY, 255 bits): - * draw a 32-byte string and process it as specified in - * Elliptic Curves for Security [RFC7748] §5. - * - * - Curve448 (PSA_ECC_FAMILY_MONTGOMERY, 448 bits): - * draw a 56-byte string and process it as specified in [RFC7748] §5. - * - * Note: Function allocates memory for *data buffer, so given *data should be - * always NULL. - */ - -static psa_status_t psa_generate_derived_ecc_key_montgomery_helper( - size_t bits, - psa_key_derivation_operation_t *operation, - uint8_t **data - ) -{ - size_t output_length; - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - switch (bits) { - case 255: - output_length = 32; - break; - case 448: - output_length = 56; - break; - default: - return PSA_ERROR_INVALID_ARGUMENT; - break; - } - - *data = mbedtls_calloc(1, output_length); - - if (*data == NULL) { - return PSA_ERROR_INSUFFICIENT_MEMORY; - } - - status = psa_key_derivation_output_bytes(operation, *data, output_length); - - if (status != PSA_SUCCESS) { - return status; - } - - switch (bits) { - case 255: - (*data)[0] &= 248; - (*data)[31] &= 127; - (*data)[31] |= 64; - break; - case 448: - (*data)[0] &= 252; - (*data)[55] |= 128; - break; - default: - return PSA_ERROR_CORRUPTION_DETECTED; - break; - } - - return status; -} -#else /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE */ -static psa_status_t psa_generate_derived_ecc_key_weierstrass_helper( - psa_key_slot_t *slot, size_t bits, - psa_key_derivation_operation_t *operation, uint8_t **data) -{ - (void) slot; - (void) bits; - (void) operation; - (void) data; - return PSA_ERROR_NOT_SUPPORTED; -} - -static psa_status_t psa_generate_derived_ecc_key_montgomery_helper( - size_t bits, psa_key_derivation_operation_t *operation, uint8_t **data) -{ - (void) bits; - (void) operation; - (void) data; - return PSA_ERROR_NOT_SUPPORTED; -} -#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE */ -#endif /* PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE */ - -static psa_status_t psa_generate_derived_key_internal( - psa_key_slot_t *slot, - size_t bits, - psa_key_derivation_operation_t *operation) -{ - uint8_t *data = NULL; - size_t bytes = PSA_BITS_TO_BYTES(bits); - size_t storage_size = bytes; - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - if (PSA_KEY_TYPE_IS_PUBLIC_KEY(slot->attr.type)) { - return PSA_ERROR_INVALID_ARGUMENT; - } - -#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE) || \ - defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE) - if (PSA_KEY_TYPE_IS_ECC(slot->attr.type)) { - psa_ecc_family_t curve = PSA_KEY_TYPE_ECC_GET_FAMILY(slot->attr.type); - if (PSA_ECC_FAMILY_IS_WEIERSTRASS(curve)) { - /* Weierstrass elliptic curve */ - status = psa_generate_derived_ecc_key_weierstrass_helper(slot, bits, operation, &data); - if (status != PSA_SUCCESS) { - goto exit; - } - } else { - /* Montgomery elliptic curve */ - status = psa_generate_derived_ecc_key_montgomery_helper(bits, operation, &data); - if (status != PSA_SUCCESS) { - goto exit; - } - } - } else -#endif /* defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE) || - defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE) */ - if (key_type_is_raw_bytes(slot->attr.type)) { - if (bits % 8 != 0) { - return PSA_ERROR_INVALID_ARGUMENT; - } - data = mbedtls_calloc(1, bytes); - if (data == NULL) { - return PSA_ERROR_INSUFFICIENT_MEMORY; - } - - status = psa_key_derivation_output_bytes(operation, data, bytes); - if (status != PSA_SUCCESS) { - goto exit; - } -#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES) - if (slot->attr.type == PSA_KEY_TYPE_DES) { - psa_des_set_key_parity(data, bytes); - } -#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES) */ - } else { - return PSA_ERROR_NOT_SUPPORTED; - } - - slot->attr.bits = (psa_key_bits_t) bits; - - if (psa_key_lifetime_is_external(slot->attr.lifetime)) { - status = psa_driver_wrapper_get_key_buffer_size(&slot->attr, - &storage_size); - if (status != PSA_SUCCESS) { - goto exit; - } - } - status = psa_allocate_buffer_to_slot(slot, storage_size); - if (status != PSA_SUCCESS) { - goto exit; - } - - status = psa_driver_wrapper_import_key(&slot->attr, - data, bytes, - slot->key.data, - slot->key.bytes, - &slot->key.bytes, &bits); - if (bits != slot->attr.bits) { - status = PSA_ERROR_INVALID_ARGUMENT; - } - -exit: - mbedtls_zeroize_and_free(data, bytes); - return status; -} - -static const psa_custom_key_parameters_t default_custom_production = - PSA_CUSTOM_KEY_PARAMETERS_INIT; - -int psa_custom_key_parameters_are_default( - const psa_custom_key_parameters_t *custom, - size_t custom_data_length) -{ - if (custom->flags != 0) { - return 0; - } - if (custom_data_length != 0) { - return 0; - } - return 1; -} - -psa_status_t psa_key_derivation_output_key_custom( - const psa_key_attributes_t *attributes, - psa_key_derivation_operation_t *operation, - const psa_custom_key_parameters_t *custom, - const uint8_t *custom_data, - size_t custom_data_length, - mbedtls_svc_key_id_t *key) -{ - psa_status_t status; - psa_key_slot_t *slot = NULL; - - *key = MBEDTLS_SVC_KEY_ID_INIT; - - /* Reject any attempt to create a zero-length key so that we don't - * risk tripping up later, e.g. on a malloc(0) that returns NULL. */ - if (psa_get_key_bits(attributes) == 0) { - return PSA_ERROR_INVALID_ARGUMENT; - } - - (void) custom_data; /* We only accept 0-length data */ - if (!psa_custom_key_parameters_are_default(custom, custom_data_length)) { - return PSA_ERROR_INVALID_ARGUMENT; - } - - if (operation->alg == PSA_ALG_NONE) { - return PSA_ERROR_BAD_STATE; - } - - if (!operation->can_output_key) { - return PSA_ERROR_NOT_PERMITTED; - } - - status = psa_start_key_creation(attributes, &slot); - if (status == PSA_SUCCESS) { - status = psa_generate_derived_key_internal(slot, - attributes->bits, - operation); - } - if (status == PSA_SUCCESS) { - status = psa_finish_key_creation(slot, key); - } - if (status != PSA_SUCCESS) { - psa_fail_key_creation(slot); - } - - return status; -} - -psa_status_t psa_key_derivation_output_key( - const psa_key_attributes_t *attributes, - psa_key_derivation_operation_t *operation, - mbedtls_svc_key_id_t *key) -{ - return psa_key_derivation_output_key_custom(attributes, operation, - &default_custom_production, - NULL, 0, - key); -} - - -/****************************************************************/ -/* Key derivation: operation management */ -/****************************************************************/ - -#if defined(AT_LEAST_ONE_BUILTIN_KDF) -static int is_kdf_alg_supported(psa_algorithm_t kdf_alg) -{ -#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF) - if (PSA_ALG_IS_HKDF(kdf_alg)) { - return 1; - } -#endif -#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT) - if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) { - return 1; - } -#endif -#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND) - if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg)) { - return 1; - } -#endif -#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) - if (PSA_ALG_IS_TLS12_PRF(kdf_alg)) { - return 1; - } -#endif -#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) - if (PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) { - return 1; - } -#endif -#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) - if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) { - return 1; - } -#endif -#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC) - if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) { - return 1; - } -#endif -#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_AES_CMAC_PRF_128) - if (kdf_alg == PSA_ALG_PBKDF2_AES_CMAC_PRF_128) { - return 1; - } -#endif - return 0; -} - -static psa_status_t psa_hash_try_support(psa_algorithm_t alg) -{ - psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT; - psa_status_t status = psa_hash_setup(&operation, alg); - psa_hash_abort(&operation); - return status; -} - -static psa_status_t psa_key_derivation_set_maximum_capacity( - psa_key_derivation_operation_t *operation, - psa_algorithm_t kdf_alg) -{ -#if defined(PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS) - if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) { - operation->capacity = PSA_HASH_LENGTH(PSA_ALG_SHA_256); - return PSA_SUCCESS; - } -#endif -#if defined(PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128) - if (kdf_alg == PSA_ALG_PBKDF2_AES_CMAC_PRF_128) { -#if (SIZE_MAX > UINT32_MAX) - operation->capacity = UINT32_MAX * (size_t) PSA_MAC_LENGTH( - PSA_KEY_TYPE_AES, - 128U, - PSA_ALG_CMAC); -#else - operation->capacity = SIZE_MAX; -#endif - return PSA_SUCCESS; - } -#endif /* PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128 */ - - /* After this point, if kdf_alg is not valid then value of hash_alg may be - * invalid or meaningless but it does not affect this function */ - psa_algorithm_t hash_alg = PSA_ALG_GET_HASH(kdf_alg); - size_t hash_size = PSA_HASH_LENGTH(hash_alg); - if (hash_size == 0) { - return PSA_ERROR_NOT_SUPPORTED; - } - - /* Make sure that hash_alg is a supported hash algorithm. Otherwise - * we might fail later, which is somewhat unfriendly and potentially - * risk-prone. */ - psa_status_t status = psa_hash_try_support(hash_alg); - if (status != PSA_SUCCESS) { - return status; - } - -#if defined(PSA_WANT_ALG_HKDF) - if (PSA_ALG_IS_HKDF(kdf_alg)) { - operation->capacity = 255 * hash_size; - } else -#endif -#if defined(PSA_WANT_ALG_HKDF_EXTRACT) - if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) { - operation->capacity = hash_size; - } else -#endif -#if defined(PSA_WANT_ALG_HKDF_EXPAND) - if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg)) { - operation->capacity = 255 * hash_size; - } else -#endif -#if defined(PSA_WANT_ALG_TLS12_PRF) - if (PSA_ALG_IS_TLS12_PRF(kdf_alg) && - (hash_alg == PSA_ALG_SHA_256 || hash_alg == PSA_ALG_SHA_384)) { - operation->capacity = SIZE_MAX; - } else -#endif -#if defined(PSA_WANT_ALG_TLS12_PSK_TO_MS) - if (PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg) && - (hash_alg == PSA_ALG_SHA_256 || hash_alg == PSA_ALG_SHA_384)) { - /* Master Secret is always 48 bytes - * https://datatracker.ietf.org/doc/html/rfc5246.html#section-8.1 */ - operation->capacity = 48U; - } else -#endif -#if defined(PSA_WANT_ALG_PBKDF2_HMAC) - if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) { -#if (SIZE_MAX > UINT32_MAX) - operation->capacity = UINT32_MAX * hash_size; -#else - operation->capacity = SIZE_MAX; -#endif - } else -#endif /* PSA_WANT_ALG_PBKDF2_HMAC */ - { - (void) hash_size; - status = PSA_ERROR_NOT_SUPPORTED; - } - return status; -} - -static psa_status_t psa_key_derivation_setup_kdf( - psa_key_derivation_operation_t *operation, - psa_algorithm_t kdf_alg) -{ - /* Make sure that operation->ctx is properly zero-initialised. (Macro - * initialisers for this union leave some bytes unspecified.) */ - memset(&operation->ctx, 0, sizeof(operation->ctx)); - - /* Make sure that kdf_alg is a supported key derivation algorithm. */ - if (!is_kdf_alg_supported(kdf_alg)) { - return PSA_ERROR_NOT_SUPPORTED; - } - - psa_status_t status = psa_key_derivation_set_maximum_capacity(operation, - kdf_alg); - return status; -} - -static psa_status_t psa_key_agreement_try_support(psa_algorithm_t alg) -{ -#if defined(PSA_WANT_ALG_ECDH) - if (alg == PSA_ALG_ECDH) { - return PSA_SUCCESS; - } -#endif -#if defined(PSA_WANT_ALG_FFDH) - if (alg == PSA_ALG_FFDH) { - return PSA_SUCCESS; - } -#endif - (void) alg; - return PSA_ERROR_NOT_SUPPORTED; -} - -static int psa_key_derivation_allows_free_form_secret_input( - psa_algorithm_t kdf_alg) -{ -#if defined(PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS) - if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) { - return 0; - } -#endif - (void) kdf_alg; - return 1; -} -#endif /* AT_LEAST_ONE_BUILTIN_KDF */ - -psa_status_t psa_key_derivation_setup(psa_key_derivation_operation_t *operation, - psa_algorithm_t alg) -{ - psa_status_t status; - - if (operation->alg != 0) { - return PSA_ERROR_BAD_STATE; - } - - if (PSA_ALG_IS_RAW_KEY_AGREEMENT(alg)) { - return PSA_ERROR_INVALID_ARGUMENT; - } else if (PSA_ALG_IS_KEY_AGREEMENT(alg)) { -#if defined(AT_LEAST_ONE_BUILTIN_KDF) - psa_algorithm_t kdf_alg = PSA_ALG_KEY_AGREEMENT_GET_KDF(alg); - psa_algorithm_t ka_alg = PSA_ALG_KEY_AGREEMENT_GET_BASE(alg); - status = psa_key_agreement_try_support(ka_alg); - if (status != PSA_SUCCESS) { - return status; - } - if (!psa_key_derivation_allows_free_form_secret_input(kdf_alg)) { - return PSA_ERROR_INVALID_ARGUMENT; - } - status = psa_key_derivation_setup_kdf(operation, kdf_alg); -#else - return PSA_ERROR_NOT_SUPPORTED; -#endif /* AT_LEAST_ONE_BUILTIN_KDF */ - } else if (PSA_ALG_IS_KEY_DERIVATION(alg)) { -#if defined(AT_LEAST_ONE_BUILTIN_KDF) - status = psa_key_derivation_setup_kdf(operation, alg); -#else - return PSA_ERROR_NOT_SUPPORTED; -#endif /* AT_LEAST_ONE_BUILTIN_KDF */ - } else { - return PSA_ERROR_INVALID_ARGUMENT; - } - - if (status == PSA_SUCCESS) { - operation->alg = alg; - } - return status; -} - -#if defined(BUILTIN_ALG_ANY_HKDF) -static psa_status_t psa_hkdf_input(psa_hkdf_key_derivation_t *hkdf, - psa_algorithm_t kdf_alg, - psa_key_derivation_step_t step, - const uint8_t *data, - size_t data_length) -{ - psa_algorithm_t hash_alg = PSA_ALG_HKDF_GET_HASH(kdf_alg); - psa_status_t status; - switch (step) { - case PSA_KEY_DERIVATION_INPUT_SALT: -#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND) - if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg)) { - return PSA_ERROR_INVALID_ARGUMENT; - } -#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND */ - if (hkdf->state != HKDF_STATE_INIT) { - return PSA_ERROR_BAD_STATE; - } else { - status = psa_key_derivation_start_hmac(&hkdf->hmac, - hash_alg, - data, data_length); - if (status != PSA_SUCCESS) { - return status; - } - hkdf->state = HKDF_STATE_STARTED; - return PSA_SUCCESS; - } - case PSA_KEY_DERIVATION_INPUT_SECRET: -#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND) - if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg)) { - /* We shouldn't be in different state as HKDF_EXPAND only allows - * two inputs: SECRET (this case) and INFO which does not modify - * the state. It could happen only if the hkdf - * object was corrupted. */ - if (hkdf->state != HKDF_STATE_INIT) { - return PSA_ERROR_BAD_STATE; - } - - /* Allow only input that fits expected prk size */ - if (data_length != PSA_HASH_LENGTH(hash_alg)) { - return PSA_ERROR_INVALID_ARGUMENT; - } - - memcpy(hkdf->prk, data, data_length); - } else -#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND */ - { - /* HKDF: If no salt was provided, use an empty salt. - * HKDF-EXTRACT: salt is mandatory. */ - if (hkdf->state == HKDF_STATE_INIT) { -#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT) - if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) { - return PSA_ERROR_BAD_STATE; - } -#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */ - status = psa_key_derivation_start_hmac(&hkdf->hmac, - hash_alg, - NULL, 0); - if (status != PSA_SUCCESS) { - return status; - } - hkdf->state = HKDF_STATE_STARTED; - } - if (hkdf->state != HKDF_STATE_STARTED) { - return PSA_ERROR_BAD_STATE; - } - status = psa_mac_update(&hkdf->hmac, - data, data_length); - if (status != PSA_SUCCESS) { - return status; - } - status = psa_mac_sign_finish(&hkdf->hmac, - hkdf->prk, - sizeof(hkdf->prk), - &data_length); - if (status != PSA_SUCCESS) { - return status; - } - } - - hkdf->state = HKDF_STATE_KEYED; - hkdf->block_number = 0; -#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT) - if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) { - /* The only block of output is the PRK. */ - memcpy(hkdf->output_block, hkdf->prk, PSA_HASH_LENGTH(hash_alg)); - hkdf->offset_in_block = 0; - } else -#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */ - { - /* Block 0 is empty, and the next block will be - * generated by psa_key_derivation_hkdf_read(). */ - hkdf->offset_in_block = PSA_HASH_LENGTH(hash_alg); - } - - return PSA_SUCCESS; - case PSA_KEY_DERIVATION_INPUT_INFO: -#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT) - if (PSA_ALG_IS_HKDF_EXTRACT(kdf_alg)) { - return PSA_ERROR_INVALID_ARGUMENT; - } -#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */ -#if defined(MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND) - if (PSA_ALG_IS_HKDF_EXPAND(kdf_alg) && - hkdf->state == HKDF_STATE_INIT) { - return PSA_ERROR_BAD_STATE; - } -#endif /* MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT */ - if (hkdf->state == HKDF_STATE_OUTPUT) { - return PSA_ERROR_BAD_STATE; - } - if (hkdf->info_set) { - return PSA_ERROR_BAD_STATE; - } - hkdf->info_length = data_length; - if (data_length != 0) { - hkdf->info = mbedtls_calloc(1, data_length); - if (hkdf->info == NULL) { - return PSA_ERROR_INSUFFICIENT_MEMORY; - } - memcpy(hkdf->info, data, data_length); - } - hkdf->info_set = 1; - return PSA_SUCCESS; - default: - return PSA_ERROR_INVALID_ARGUMENT; - } -} -#endif /* BUILTIN_ALG_ANY_HKDF */ - -#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) -static psa_status_t psa_tls12_prf_set_seed(psa_tls12_prf_key_derivation_t *prf, - const uint8_t *data, - size_t data_length) -{ - if (prf->state != PSA_TLS12_PRF_STATE_INIT) { - return PSA_ERROR_BAD_STATE; - } - - if (data_length != 0) { - prf->seed = mbedtls_calloc(1, data_length); - if (prf->seed == NULL) { - return PSA_ERROR_INSUFFICIENT_MEMORY; - } - - memcpy(prf->seed, data, data_length); - prf->seed_length = data_length; - } - - prf->state = PSA_TLS12_PRF_STATE_SEED_SET; - - return PSA_SUCCESS; -} - -static psa_status_t psa_tls12_prf_set_key(psa_tls12_prf_key_derivation_t *prf, - const uint8_t *data, - size_t data_length) -{ - if (prf->state != PSA_TLS12_PRF_STATE_SEED_SET && - prf->state != PSA_TLS12_PRF_STATE_OTHER_KEY_SET) { - return PSA_ERROR_BAD_STATE; - } - - if (data_length != 0) { - prf->secret = mbedtls_calloc(1, data_length); - if (prf->secret == NULL) { - return PSA_ERROR_INSUFFICIENT_MEMORY; - } - - memcpy(prf->secret, data, data_length); - prf->secret_length = data_length; - } - - prf->state = PSA_TLS12_PRF_STATE_KEY_SET; - - return PSA_SUCCESS; -} - -static psa_status_t psa_tls12_prf_set_label(psa_tls12_prf_key_derivation_t *prf, - const uint8_t *data, - size_t data_length) -{ - if (prf->state != PSA_TLS12_PRF_STATE_KEY_SET) { - return PSA_ERROR_BAD_STATE; - } - - if (data_length != 0) { - prf->label = mbedtls_calloc(1, data_length); - if (prf->label == NULL) { - return PSA_ERROR_INSUFFICIENT_MEMORY; - } - - memcpy(prf->label, data, data_length); - prf->label_length = data_length; - } - - prf->state = PSA_TLS12_PRF_STATE_LABEL_SET; - - return PSA_SUCCESS; -} - -static psa_status_t psa_tls12_prf_input(psa_tls12_prf_key_derivation_t *prf, - psa_key_derivation_step_t step, - const uint8_t *data, - size_t data_length) -{ - switch (step) { - case PSA_KEY_DERIVATION_INPUT_SEED: - return psa_tls12_prf_set_seed(prf, data, data_length); - case PSA_KEY_DERIVATION_INPUT_SECRET: - return psa_tls12_prf_set_key(prf, data, data_length); - case PSA_KEY_DERIVATION_INPUT_LABEL: - return psa_tls12_prf_set_label(prf, data, data_length); - default: - return PSA_ERROR_INVALID_ARGUMENT; - } -} -#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) || - * MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */ - -#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) -static psa_status_t psa_tls12_prf_psk_to_ms_set_key( - psa_tls12_prf_key_derivation_t *prf, - const uint8_t *data, - size_t data_length) -{ - psa_status_t status; - const size_t pms_len = (prf->state == PSA_TLS12_PRF_STATE_OTHER_KEY_SET ? - 4 + data_length + prf->other_secret_length : - 4 + 2 * data_length); - - if (data_length > PSA_TLS12_PSK_TO_MS_PSK_MAX_SIZE) { - return PSA_ERROR_INVALID_ARGUMENT; - } - - uint8_t *pms = mbedtls_calloc(1, pms_len); - if (pms == NULL) { - return PSA_ERROR_INSUFFICIENT_MEMORY; - } - uint8_t *cur = pms; - - /* pure-PSK: - * Quoting RFC 4279, Section 2: - * - * The premaster secret is formed as follows: if the PSK is N octets - * long, concatenate a uint16 with the value N, N zero octets, a second - * uint16 with the value N, and the PSK itself. - * - * mixed-PSK: - * In a ECDHE-PSK the premaster secret is formed as follows: - * concatenate a uint16 with the length of the other secret, - * the other secret itself, uint16 with the length of PSK, and the - * PSK itself. - * For details please check RFC 5489 for the definition of ECDHE-PSK. - */ - - if (prf->state == PSA_TLS12_PRF_STATE_OTHER_KEY_SET) { - *cur++ = MBEDTLS_BYTE_1(prf->other_secret_length); - *cur++ = MBEDTLS_BYTE_0(prf->other_secret_length); - if (prf->other_secret_length != 0) { - memcpy(cur, prf->other_secret, prf->other_secret_length); - mbedtls_platform_zeroize(prf->other_secret, prf->other_secret_length); - cur += prf->other_secret_length; - } - } else { - *cur++ = MBEDTLS_BYTE_1(data_length); - *cur++ = MBEDTLS_BYTE_0(data_length); - memset(cur, 0, data_length); - cur += data_length; - } - - *cur++ = MBEDTLS_BYTE_1(data_length); - *cur++ = MBEDTLS_BYTE_0(data_length); - memcpy(cur, data, data_length); - cur += data_length; - - status = psa_tls12_prf_set_key(prf, pms, (size_t) (cur - pms)); - - mbedtls_zeroize_and_free(pms, pms_len); - return status; -} - -static psa_status_t psa_tls12_prf_psk_to_ms_set_other_key( - psa_tls12_prf_key_derivation_t *prf, - const uint8_t *data, - size_t data_length) -{ - if (prf->state != PSA_TLS12_PRF_STATE_SEED_SET) { - return PSA_ERROR_BAD_STATE; - } - - if (data_length != 0) { - prf->other_secret = mbedtls_calloc(1, data_length); - if (prf->other_secret == NULL) { - return PSA_ERROR_INSUFFICIENT_MEMORY; - } - - memcpy(prf->other_secret, data, data_length); - prf->other_secret_length = data_length; - } else { - prf->other_secret_length = 0; - } - - prf->state = PSA_TLS12_PRF_STATE_OTHER_KEY_SET; - - return PSA_SUCCESS; -} - -static psa_status_t psa_tls12_prf_psk_to_ms_input( - psa_tls12_prf_key_derivation_t *prf, - psa_key_derivation_step_t step, - const uint8_t *data, - size_t data_length) -{ - switch (step) { - case PSA_KEY_DERIVATION_INPUT_SECRET: - return psa_tls12_prf_psk_to_ms_set_key(prf, - data, data_length); - break; - case PSA_KEY_DERIVATION_INPUT_OTHER_SECRET: - return psa_tls12_prf_psk_to_ms_set_other_key(prf, - data, - data_length); - break; - default: - return psa_tls12_prf_input(prf, step, data, data_length); - break; - - } -} -#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */ - -#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) -static psa_status_t psa_tls12_ecjpake_to_pms_input( - psa_tls12_ecjpake_to_pms_t *ecjpake, - psa_key_derivation_step_t step, - const uint8_t *data, - size_t data_length) -{ - if (data_length != PSA_TLS12_ECJPAKE_TO_PMS_INPUT_SIZE || - step != PSA_KEY_DERIVATION_INPUT_SECRET) { - return PSA_ERROR_INVALID_ARGUMENT; - } - - /* Check if the passed point is in an uncompressed form */ - if (data[0] != 0x04) { - return PSA_ERROR_INVALID_ARGUMENT; - } - - /* Only K.X has to be extracted - bytes 1 to 32 inclusive. */ - memcpy(ecjpake->data, data + 1, PSA_TLS12_ECJPAKE_TO_PMS_DATA_SIZE); - - return PSA_SUCCESS; -} -#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */ - -#if defined(PSA_HAVE_SOFT_PBKDF2) -static psa_status_t psa_pbkdf2_set_input_cost( - psa_pbkdf2_key_derivation_t *pbkdf2, - psa_key_derivation_step_t step, - uint64_t data) -{ - if (step != PSA_KEY_DERIVATION_INPUT_COST) { - return PSA_ERROR_INVALID_ARGUMENT; - } - - if (pbkdf2->state != PSA_PBKDF2_STATE_INIT) { - return PSA_ERROR_BAD_STATE; - } - - if (data > PSA_VENDOR_PBKDF2_MAX_ITERATIONS) { - return PSA_ERROR_NOT_SUPPORTED; - } - - if (data == 0) { - return PSA_ERROR_INVALID_ARGUMENT; - } - - pbkdf2->input_cost = data; - pbkdf2->state = PSA_PBKDF2_STATE_INPUT_COST_SET; - - return PSA_SUCCESS; -} - -static psa_status_t psa_pbkdf2_set_salt(psa_pbkdf2_key_derivation_t *pbkdf2, - const uint8_t *data, - size_t data_length) -{ - if (pbkdf2->state == PSA_PBKDF2_STATE_INPUT_COST_SET) { - pbkdf2->state = PSA_PBKDF2_STATE_SALT_SET; - } else if (pbkdf2->state == PSA_PBKDF2_STATE_SALT_SET) { - /* Appending to existing salt. No state change. */ - } else { - return PSA_ERROR_BAD_STATE; - } - - if (data_length == 0) { - /* Appending an empty string, nothing to do. */ - } else { - uint8_t *next_salt; - - next_salt = mbedtls_calloc(1, data_length + pbkdf2->salt_length); - if (next_salt == NULL) { - return PSA_ERROR_INSUFFICIENT_MEMORY; - } - - if (pbkdf2->salt_length != 0) { - memcpy(next_salt, pbkdf2->salt, pbkdf2->salt_length); - } - memcpy(next_salt + pbkdf2->salt_length, data, data_length); - pbkdf2->salt_length += data_length; - mbedtls_free(pbkdf2->salt); - pbkdf2->salt = next_salt; - } - return PSA_SUCCESS; -} - -#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC) -static psa_status_t psa_pbkdf2_hmac_set_password(psa_algorithm_t hash_alg, - const uint8_t *input, - size_t input_len, - uint8_t *output, - size_t *output_len) -{ - psa_status_t status = PSA_SUCCESS; - if (input_len > PSA_HASH_BLOCK_LENGTH(hash_alg)) { - return psa_hash_compute(hash_alg, input, input_len, output, - PSA_HMAC_MAX_HASH_BLOCK_SIZE, output_len); - } else if (input_len > 0) { - memcpy(output, input, input_len); - } - *output_len = PSA_HASH_BLOCK_LENGTH(hash_alg); - return status; -} -#endif /* MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC */ - -#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_AES_CMAC_PRF_128) -static psa_status_t psa_pbkdf2_cmac_set_password(const uint8_t *input, - size_t input_len, - uint8_t *output, - size_t *output_len) -{ - psa_status_t status = PSA_SUCCESS; - if (input_len != PSA_MAC_LENGTH(PSA_KEY_TYPE_AES, 128U, PSA_ALG_CMAC)) { - psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; - uint8_t zeros[16] = { 0 }; - psa_set_key_type(&attributes, PSA_KEY_TYPE_AES); - psa_set_key_bits(&attributes, PSA_BYTES_TO_BITS(sizeof(zeros))); - psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_MESSAGE); - /* Passing PSA_MAC_LENGTH(PSA_KEY_TYPE_AES, 128U, PSA_ALG_CMAC) as - * mac_size as the driver function sets mac_output_length = mac_size - * on success. See https://github.com/Mbed-TLS/mbedtls/issues/7801 */ - status = psa_driver_wrapper_mac_compute(&attributes, - zeros, sizeof(zeros), - PSA_ALG_CMAC, input, input_len, - output, - PSA_MAC_LENGTH(PSA_KEY_TYPE_AES, - 128U, - PSA_ALG_CMAC), - output_len); - } else { - memcpy(output, input, input_len); - *output_len = PSA_MAC_LENGTH(PSA_KEY_TYPE_AES, 128U, PSA_ALG_CMAC); - } - return status; -} -#endif /* MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_AES_CMAC_PRF_128 */ - -static psa_status_t psa_pbkdf2_set_password(psa_pbkdf2_key_derivation_t *pbkdf2, - psa_algorithm_t kdf_alg, - const uint8_t *data, - size_t data_length) -{ - psa_status_t status = PSA_SUCCESS; - if (pbkdf2->state != PSA_PBKDF2_STATE_SALT_SET) { - return PSA_ERROR_BAD_STATE; - } - -#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC) - if (PSA_ALG_IS_PBKDF2_HMAC(kdf_alg)) { - psa_algorithm_t hash_alg = PSA_ALG_PBKDF2_HMAC_GET_HASH(kdf_alg); - status = psa_pbkdf2_hmac_set_password(hash_alg, data, data_length, - pbkdf2->password, - &pbkdf2->password_length); - } else -#endif /* MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC */ -#if defined(MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_AES_CMAC_PRF_128) - if (kdf_alg == PSA_ALG_PBKDF2_AES_CMAC_PRF_128) { - status = psa_pbkdf2_cmac_set_password(data, data_length, - pbkdf2->password, - &pbkdf2->password_length); - } else -#endif /* MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_AES_CMAC_PRF_128 */ - { - return PSA_ERROR_INVALID_ARGUMENT; - } - - pbkdf2->state = PSA_PBKDF2_STATE_PASSWORD_SET; - - return status; -} - -static psa_status_t psa_pbkdf2_input(psa_pbkdf2_key_derivation_t *pbkdf2, - psa_algorithm_t kdf_alg, - psa_key_derivation_step_t step, - const uint8_t *data, - size_t data_length) -{ - switch (step) { - case PSA_KEY_DERIVATION_INPUT_SALT: - return psa_pbkdf2_set_salt(pbkdf2, data, data_length); - case PSA_KEY_DERIVATION_INPUT_PASSWORD: - return psa_pbkdf2_set_password(pbkdf2, kdf_alg, data, data_length); - default: - return PSA_ERROR_INVALID_ARGUMENT; - } -} -#endif /* PSA_HAVE_SOFT_PBKDF2 */ - -/** Check whether the given key type is acceptable for the given - * input step of a key derivation. - * - * Secret inputs must have the type #PSA_KEY_TYPE_DERIVE. - * Non-secret inputs must have the type #PSA_KEY_TYPE_RAW_DATA. - * Both secret and non-secret inputs can alternatively have the type - * #PSA_KEY_TYPE_NONE, which is never the type of a key object, meaning - * that the input was passed as a buffer rather than via a key object. - */ -static int psa_key_derivation_check_input_type( - psa_key_derivation_step_t step, - psa_key_type_t key_type) -{ - switch (step) { - case PSA_KEY_DERIVATION_INPUT_SECRET: - if (key_type == PSA_KEY_TYPE_DERIVE) { - return PSA_SUCCESS; - } - if (key_type == PSA_KEY_TYPE_NONE) { - return PSA_SUCCESS; - } - break; - case PSA_KEY_DERIVATION_INPUT_OTHER_SECRET: - if (key_type == PSA_KEY_TYPE_DERIVE) { - return PSA_SUCCESS; - } - if (key_type == PSA_KEY_TYPE_NONE) { - return PSA_SUCCESS; - } - break; - case PSA_KEY_DERIVATION_INPUT_LABEL: - case PSA_KEY_DERIVATION_INPUT_SALT: - case PSA_KEY_DERIVATION_INPUT_INFO: - case PSA_KEY_DERIVATION_INPUT_SEED: - if (key_type == PSA_KEY_TYPE_RAW_DATA) { - return PSA_SUCCESS; - } - if (key_type == PSA_KEY_TYPE_NONE) { - return PSA_SUCCESS; - } - break; - case PSA_KEY_DERIVATION_INPUT_PASSWORD: - if (key_type == PSA_KEY_TYPE_PASSWORD) { - return PSA_SUCCESS; - } - if (key_type == PSA_KEY_TYPE_DERIVE) { - return PSA_SUCCESS; - } - if (key_type == PSA_KEY_TYPE_NONE) { - return PSA_SUCCESS; - } - break; - } - return PSA_ERROR_INVALID_ARGUMENT; -} - -static psa_status_t psa_key_derivation_input_internal( - psa_key_derivation_operation_t *operation, - psa_key_derivation_step_t step, - psa_key_type_t key_type, - const uint8_t *data, - size_t data_length) -{ - psa_status_t status; - psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation); - - if (kdf_alg == PSA_ALG_NONE) { - /* This is a blank or aborted operation. */ - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - status = psa_key_derivation_check_input_type(step, key_type); - if (status != PSA_SUCCESS) { - goto exit; - } - -#if defined(BUILTIN_ALG_ANY_HKDF) - if (PSA_ALG_IS_ANY_HKDF(kdf_alg)) { - status = psa_hkdf_input(&operation->ctx.hkdf, kdf_alg, - step, data, data_length); - } else -#endif /* BUILTIN_ALG_ANY_HKDF */ -#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF) - if (PSA_ALG_IS_TLS12_PRF(kdf_alg)) { - status = psa_tls12_prf_input(&operation->ctx.tls12_prf, - step, data, data_length); - } else -#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF */ -#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS) - if (PSA_ALG_IS_TLS12_PSK_TO_MS(kdf_alg)) { - status = psa_tls12_prf_psk_to_ms_input(&operation->ctx.tls12_prf, - step, data, data_length); - } else -#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS */ -#if defined(MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS) - if (kdf_alg == PSA_ALG_TLS12_ECJPAKE_TO_PMS) { - status = psa_tls12_ecjpake_to_pms_input( - &operation->ctx.tls12_ecjpake_to_pms, step, data, data_length); - } else -#endif /* MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS */ -#if defined(PSA_HAVE_SOFT_PBKDF2) - if (PSA_ALG_IS_PBKDF2(kdf_alg)) { - status = psa_pbkdf2_input(&operation->ctx.pbkdf2, kdf_alg, - step, data, data_length); - } else -#endif /* PSA_HAVE_SOFT_PBKDF2 */ - { - /* This can't happen unless the operation object was not initialized */ - (void) data; - (void) data_length; - (void) kdf_alg; - return PSA_ERROR_BAD_STATE; - } - -exit: - if (status != PSA_SUCCESS) { - psa_key_derivation_abort(operation); - } - return status; -} - -static psa_status_t psa_key_derivation_input_integer_internal( - psa_key_derivation_operation_t *operation, - psa_key_derivation_step_t step, - uint64_t value) -{ - psa_status_t status; - psa_algorithm_t kdf_alg = psa_key_derivation_get_kdf_alg(operation); - - if (kdf_alg == PSA_ALG_NONE) { - /* This is a blank or aborted operation. */ - status = PSA_ERROR_BAD_STATE; - goto exit; - } - -#if defined(PSA_HAVE_SOFT_PBKDF2) - if (PSA_ALG_IS_PBKDF2(kdf_alg)) { - status = psa_pbkdf2_set_input_cost( - &operation->ctx.pbkdf2, step, value); - } else -#endif /* PSA_HAVE_SOFT_PBKDF2 */ - { - (void) step; - (void) value; - (void) kdf_alg; - status = PSA_ERROR_INVALID_ARGUMENT; - } - -exit: - if (status != PSA_SUCCESS) { - psa_key_derivation_abort(operation); - } - return status; -} - -psa_status_t psa_key_derivation_input_bytes( - psa_key_derivation_operation_t *operation, - psa_key_derivation_step_t step, - const uint8_t *data_external, - size_t data_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - LOCAL_INPUT_DECLARE(data_external, data); - - LOCAL_INPUT_ALLOC(data_external, data_length, data); - - status = psa_key_derivation_input_internal(operation, step, - PSA_KEY_TYPE_NONE, - data, data_length); -#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS) -exit: -#endif - LOCAL_INPUT_FREE(data_external, data); - return status; -} - -psa_status_t psa_key_derivation_input_integer( - psa_key_derivation_operation_t *operation, - psa_key_derivation_step_t step, - uint64_t value) -{ - return psa_key_derivation_input_integer_internal(operation, step, value); -} - -psa_status_t psa_key_derivation_input_key( - psa_key_derivation_operation_t *operation, - psa_key_derivation_step_t step, - mbedtls_svc_key_id_t key) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_slot_t *slot; - - status = psa_get_and_lock_transparent_key_slot_with_policy( - key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg); - if (status != PSA_SUCCESS) { - psa_key_derivation_abort(operation); - return status; - } - - /* Passing a key object as a SECRET or PASSWORD input unlocks the - * permission to output to a key object. */ - if (step == PSA_KEY_DERIVATION_INPUT_SECRET || - step == PSA_KEY_DERIVATION_INPUT_PASSWORD) { - operation->can_output_key = 1; - } - - status = psa_key_derivation_input_internal(operation, - step, slot->attr.type, - slot->key.data, - slot->key.bytes); - - unlock_status = psa_unregister_read_under_mutex(slot); - - return (status == PSA_SUCCESS) ? unlock_status : status; -} - - - -/****************************************************************/ -/* Key agreement */ -/****************************************************************/ - -psa_status_t psa_key_agreement_raw_builtin(const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, - size_t key_buffer_size, - psa_algorithm_t alg, - const uint8_t *peer_key, - size_t peer_key_length, - uint8_t *shared_secret, - size_t shared_secret_size, - size_t *shared_secret_length) -{ - switch (alg) { -#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH) - case PSA_ALG_ECDH: - return mbedtls_psa_key_agreement_ecdh(attributes, key_buffer, - key_buffer_size, alg, - peer_key, peer_key_length, - shared_secret, - shared_secret_size, - shared_secret_length); -#endif /* MBEDTLS_PSA_BUILTIN_ALG_ECDH */ - -#if defined(MBEDTLS_PSA_BUILTIN_ALG_FFDH) - case PSA_ALG_FFDH: - return mbedtls_psa_ffdh_key_agreement(attributes, - peer_key, - peer_key_length, - key_buffer, - key_buffer_size, - shared_secret, - shared_secret_size, - shared_secret_length); -#endif /* MBEDTLS_PSA_BUILTIN_ALG_FFDH */ - - default: - (void) attributes; - (void) key_buffer; - (void) key_buffer_size; - (void) peer_key; - (void) peer_key_length; - (void) shared_secret; - (void) shared_secret_size; - (void) shared_secret_length; - return PSA_ERROR_NOT_SUPPORTED; - } -} - -/** Internal function for raw key agreement - * Calls the driver wrapper which will hand off key agreement task - * to the driver's implementation if a driver is present. - * Fallback specified in the driver wrapper is built-in raw key agreement - * (psa_key_agreement_raw_builtin). - */ -static psa_status_t psa_key_agreement_raw_internal(psa_algorithm_t alg, - psa_key_slot_t *private_key, - const uint8_t *peer_key, - size_t peer_key_length, - uint8_t *shared_secret, - size_t shared_secret_size, - size_t *shared_secret_length) -{ - if (!PSA_ALG_IS_RAW_KEY_AGREEMENT(alg)) { - return PSA_ERROR_NOT_SUPPORTED; - } - - return psa_driver_wrapper_key_agreement(&private_key->attr, - private_key->key.data, - private_key->key.bytes, alg, - peer_key, peer_key_length, - shared_secret, - shared_secret_size, - shared_secret_length); -} - -/* Note that if this function fails, you must call psa_key_derivation_abort() - * to potentially free embedded data structures and wipe confidential data. - */ -static psa_status_t psa_key_agreement_internal(psa_key_derivation_operation_t *operation, - psa_key_derivation_step_t step, - psa_key_slot_t *private_key, - const uint8_t *peer_key, - size_t peer_key_length) -{ - psa_status_t status; - uint8_t shared_secret[PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE] = { 0 }; - size_t shared_secret_length = 0; - psa_algorithm_t ka_alg = PSA_ALG_KEY_AGREEMENT_GET_BASE(operation->alg); - - /* Step 1: run the secret agreement algorithm to generate the shared - * secret. */ - status = psa_key_agreement_raw_internal(ka_alg, - private_key, - peer_key, peer_key_length, - shared_secret, - sizeof(shared_secret), - &shared_secret_length); - if (status != PSA_SUCCESS) { - goto exit; - } - - /* Step 2: set up the key derivation to generate key material from - * the shared secret. A shared secret is permitted wherever a key - * of type DERIVE is permitted. */ - status = psa_key_derivation_input_internal(operation, step, - PSA_KEY_TYPE_DERIVE, - shared_secret, - shared_secret_length); -exit: - mbedtls_platform_zeroize(shared_secret, shared_secret_length); - return status; -} - -psa_status_t psa_key_derivation_key_agreement(psa_key_derivation_operation_t *operation, - psa_key_derivation_step_t step, - mbedtls_svc_key_id_t private_key, - const uint8_t *peer_key_external, - size_t peer_key_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_slot_t *slot; - LOCAL_INPUT_DECLARE(peer_key_external, peer_key); - - if (!PSA_ALG_IS_KEY_AGREEMENT(operation->alg)) { - return PSA_ERROR_INVALID_ARGUMENT; - } - status = psa_get_and_lock_transparent_key_slot_with_policy( - private_key, &slot, PSA_KEY_USAGE_DERIVE, operation->alg); - if (status != PSA_SUCCESS) { - return status; - } - - LOCAL_INPUT_ALLOC(peer_key_external, peer_key_length, peer_key); - status = psa_key_agreement_internal(operation, step, - slot, - peer_key, peer_key_length); - -#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS) -exit: -#endif - if (status != PSA_SUCCESS) { - psa_key_derivation_abort(operation); - } else { - /* If a private key has been added as SECRET, we allow the derived - * key material to be used as a key in PSA Crypto. */ - if (step == PSA_KEY_DERIVATION_INPUT_SECRET) { - operation->can_output_key = 1; - } - } - - unlock_status = psa_unregister_read_under_mutex(slot); - LOCAL_INPUT_FREE(peer_key_external, peer_key); - - return (status == PSA_SUCCESS) ? unlock_status : status; -} - -psa_status_t psa_raw_key_agreement(psa_algorithm_t alg, - mbedtls_svc_key_id_t private_key, - const uint8_t *peer_key_external, - size_t peer_key_length, - uint8_t *output_external, - size_t output_size, - size_t *output_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_slot_t *slot = NULL; - size_t expected_length; - LOCAL_INPUT_DECLARE(peer_key_external, peer_key); - LOCAL_OUTPUT_DECLARE(output_external, output); - LOCAL_OUTPUT_ALLOC(output_external, output_size, output); - - if (!PSA_ALG_IS_KEY_AGREEMENT(alg)) { - status = PSA_ERROR_INVALID_ARGUMENT; - goto exit; - } - status = psa_get_and_lock_transparent_key_slot_with_policy( - private_key, &slot, PSA_KEY_USAGE_DERIVE, alg); - if (status != PSA_SUCCESS) { - goto exit; - } - - /* PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE() is in general an upper bound - * for the output size. The PSA specification only guarantees that this - * function works if output_size >= PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE(...), - * but it might be nice to allow smaller buffers if the output fits. - * At the time of writing this comment, with only ECDH implemented, - * PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE() is exact so the point is moot. - * If FFDH is implemented, PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE() can easily - * be exact for it as well. */ - expected_length = - PSA_RAW_KEY_AGREEMENT_OUTPUT_SIZE(slot->attr.type, slot->attr.bits); - if (output_size < expected_length) { - status = PSA_ERROR_BUFFER_TOO_SMALL; - goto exit; - } - - LOCAL_INPUT_ALLOC(peer_key_external, peer_key_length, peer_key); - status = psa_key_agreement_raw_internal(alg, slot, - peer_key, peer_key_length, - output, output_size, - output_length); - -exit: - /* Check for successful allocation of output, - * with an unsuccessful status. */ - if (output != NULL && status != PSA_SUCCESS) { - /* If an error happens and is not handled properly, the output - * may be used as a key to protect sensitive data. Arrange for such - * a key to be random, which is likely to result in decryption or - * verification errors. This is better than filling the buffer with - * some constant data such as zeros, which would result in the data - * being protected with a reproducible, easily knowable key. - */ - psa_generate_random_internal(output, output_size); - *output_length = output_size; - } - - if (output == NULL) { - /* output allocation failed. */ - *output_length = 0; - } - - unlock_status = psa_unregister_read_under_mutex(slot); - - LOCAL_INPUT_FREE(peer_key_external, peer_key); - LOCAL_OUTPUT_FREE(output_external, output); - return (status == PSA_SUCCESS) ? unlock_status : status; -} - -static psa_status_t validate_key_agreement_params(const psa_key_attributes_t *attributes, - psa_algorithm_t alg) -{ - psa_key_type_t key_type; - - if (!PSA_ALG_IS_RAW_KEY_AGREEMENT(alg)) { - return PSA_ERROR_NOT_SUPPORTED; - } - - key_type = psa_get_key_type(attributes); - if (key_type != PSA_KEY_TYPE_DERIVE && key_type != PSA_KEY_TYPE_RAW_DATA - && key_type != PSA_KEY_TYPE_HMAC && key_type != PSA_KEY_TYPE_PASSWORD) { - return PSA_ERROR_INVALID_ARGUMENT; - } - - return PSA_SUCCESS; -} - -psa_status_t psa_key_agreement(mbedtls_svc_key_id_t private_key, - const uint8_t *peer_key, - size_t peer_key_length, - psa_algorithm_t alg, - const psa_key_attributes_t *attributes, - mbedtls_svc_key_id_t *key) -{ - psa_status_t status; - uint8_t shared_secret[PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE]; - size_t shared_secret_len; - - *key = MBEDTLS_SVC_KEY_ID_INIT; - - status = validate_key_agreement_params(attributes, alg); - if (status != PSA_SUCCESS) { - return status; - } - - status = psa_raw_key_agreement(alg, private_key, peer_key, peer_key_length, shared_secret, - sizeof(shared_secret), &shared_secret_len); - - if (status != PSA_SUCCESS) { - return status; - } - - status = psa_import_key(attributes, shared_secret, shared_secret_len, key); - - return status; -} - -#if defined(MBEDTLS_ECP_RESTARTABLE) && \ - defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH) - -static psa_status_t psa_key_agreement_iop_abort_internal(psa_key_agreement_iop_t *operation) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - if (operation->id == 0) { - return PSA_SUCCESS; - } - - status = mbedtls_psa_key_agreement_iop_abort(&operation->mbedtls_ctx); - - operation->id = 0; - - return status; -} -#endif - -uint32_t psa_key_agreement_iop_get_num_ops( - psa_key_agreement_iop_t *operation) -{ -#if defined(MBEDTLS_ECP_RESTARTABLE) && \ - defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH) - return operation->num_ops; -#else - (void) operation; - return 0; -#endif -} - -psa_status_t psa_key_agreement_iop_setup( - psa_key_agreement_iop_t *operation, - mbedtls_svc_key_id_t private_key, - const uint8_t *peer_key, - size_t peer_key_length, - psa_algorithm_t alg, - const psa_key_attributes_t *attributes) -{ -#if defined(MBEDTLS_ECP_RESTARTABLE) && \ - defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH) - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_slot_t *slot = NULL; - - if (operation->id != 0 || operation->error_occurred) { - return PSA_ERROR_BAD_STATE; - } - - status = validate_key_agreement_params(attributes, alg); - if (status != PSA_SUCCESS) { - operation->error_occurred = 1; - return status; - } - - status = psa_get_and_lock_transparent_key_slot_with_policy( - private_key, &slot, PSA_KEY_USAGE_DERIVE, alg); - if (status != PSA_SUCCESS) { - goto exit; - } - - /* We only support raw key agreement here, not combined with a key - * derivation. Also, for the time being, we only allow ECDH, not - * other key agreement algorithms. - * - * This check could come slightly earlier or later. Having it here - * gives consistent error codes with non-interruptible key agreement - * (psa_raw_key_agreement(), psa_key_agreement()) when the input - * parameters (including the key) are also invalid for - * non-interruptible key agreement. - */ - if (alg != PSA_ALG_ECDH) { - status = PSA_ERROR_INVALID_ARGUMENT; - goto exit; - } - - operation->attributes = *attributes; - - operation->num_ops = 0; - - /* To be removed later when driver dispatch is added. */ - operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; - - status = mbedtls_psa_key_agreement_iop_setup(&operation->mbedtls_ctx, - &slot->attr, slot->key.data, - slot->key.bytes, peer_key, - peer_key_length); - - operation->num_ops = mbedtls_psa_key_agreement_iop_get_num_ops(&operation->mbedtls_ctx); - -exit: - unlock_status = psa_unregister_read_under_mutex(slot); - if (status != PSA_SUCCESS) { - operation->error_occurred = 1; - psa_key_agreement_iop_abort_internal(operation); - return status; - } - if (unlock_status != PSA_SUCCESS) { - operation->error_occurred = 1; - } - return unlock_status; -#else - (void) operation; - (void) private_key; - (void) peer_key; - (void) peer_key_length; - (void) alg; - (void) attributes; - return PSA_ERROR_NOT_SUPPORTED; -#endif -} - -psa_status_t psa_key_agreement_iop_complete( - psa_key_agreement_iop_t *operation, - mbedtls_svc_key_id_t *key) -{ -#if defined(MBEDTLS_ECP_RESTARTABLE) && \ - defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH) - - if (operation->id == 0 || operation->error_occurred) { - return PSA_ERROR_BAD_STATE; - } - - psa_status_t status; - uint8_t intermediate_key[PSA_RAW_KEY_AGREEMENT_OUTPUT_MAX_SIZE]; - size_t key_len = 0; - - status = mbedtls_psa_key_agreement_iop_complete(&operation->mbedtls_ctx, intermediate_key, - sizeof(intermediate_key), - &key_len); - - operation->num_ops = mbedtls_psa_key_agreement_iop_get_num_ops(&operation->mbedtls_ctx); - - if (status == PSA_SUCCESS) { - status = psa_import_key(&operation->attributes, intermediate_key, - key_len, key); - } - - if (status != PSA_OPERATION_INCOMPLETE) { - operation->error_occurred = 1; - psa_key_agreement_iop_abort_internal(operation); - } - mbedtls_platform_zeroize(intermediate_key, sizeof(intermediate_key)); - return status; -#else - (void) operation; - (void) key; - return PSA_ERROR_BAD_STATE; -#endif -} - -psa_status_t psa_key_agreement_iop_abort( - psa_key_agreement_iop_t *operation) -{ -#if defined(MBEDTLS_ECP_RESTARTABLE) && \ - defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH) - psa_status_t status; - - status = psa_key_agreement_iop_abort_internal(operation); - - operation->num_ops = 0; - operation->error_occurred = 0; - - return status; -#else - (void) operation; - return PSA_SUCCESS; -#endif -} - -/****************************************************************/ -/* Random generation */ -/****************************************************************/ - -/** Initialize the PSA random generator. - * - * Note: the mbedtls_threading_psa_rngdata_mutex should be held when calling - * this function if mutexes are enabled. - */ -static void mbedtls_psa_random_init(mbedtls_psa_random_context_t *rng) -{ -#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) - memset(rng, 0, sizeof(*rng)); -#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */ - - /* Set default configuration if - * mbedtls_psa_crypto_configure_entropy_sources() hasn't been called. */ - if (rng->entropy_init == NULL) { - rng->entropy_init = mbedtls_entropy_init; - } - if (rng->entropy_free == NULL) { - rng->entropy_free = mbedtls_entropy_free; - } - - rng->entropy_init(&rng->entropy); - mbedtls_psa_drbg_init(&rng->drbg); -#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */ -} - -/** Deinitialize the PSA random generator. - * - * Note: the mbedtls_threading_psa_rngdata_mutex should be held when calling - * this function if mutexes are enabled. - */ -static void mbedtls_psa_random_free(mbedtls_psa_random_context_t *rng) -{ -#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) - memset(rng, 0, sizeof(*rng)); -#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */ - mbedtls_psa_drbg_free(&rng->drbg); - rng->entropy_free(&rng->entropy); -#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */ -} - -/** Seed the PSA random generator. - */ -static psa_status_t mbedtls_psa_random_seed(mbedtls_psa_random_context_t *rng) -{ -#if defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) - /* Do nothing: the external RNG seeds itself. */ - (void) rng; - return PSA_SUCCESS; -#else /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */ - const unsigned char drbg_seed[] = "PSA"; - int ret = mbedtls_psa_drbg_seed(&rng->drbg, &rng->entropy, - drbg_seed, sizeof(drbg_seed) - 1); - return mbedtls_to_psa_error(ret); -#endif /* MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG */ -} - -psa_status_t psa_generate_random(uint8_t *output_external, - size_t output_size) -{ - psa_status_t status; - - LOCAL_OUTPUT_DECLARE(output_external, output); - LOCAL_OUTPUT_ALLOC(output_external, output_size, output); - - status = psa_generate_random_internal(output, output_size); - -#if !defined(MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS) -exit: -#endif - LOCAL_OUTPUT_FREE(output_external, output); - return status; -} - -/** Validate the key type and size for key generation - * - * \param type The key type - * \param bits The number of bits of the key - * - * \retval #PSA_SUCCESS - * The key type and size are valid. - * \retval #PSA_ERROR_INVALID_ARGUMENT - * The size in bits of the key is not valid. - * \retval #PSA_ERROR_NOT_SUPPORTED - * The type and/or the size in bits of the key or the combination of - * the two is not supported. - */ -static psa_status_t psa_validate_key_type_and_size_for_key_generation( - psa_key_type_t type, size_t bits) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - if (key_type_is_raw_bytes(type)) { - status = psa_validate_unstructured_key_bit_size(type, bits); - if (status != PSA_SUCCESS) { - return status; - } - } else -#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE) - if (PSA_KEY_TYPE_IS_RSA(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) { - if (bits > PSA_VENDOR_RSA_MAX_KEY_BITS) { - return PSA_ERROR_NOT_SUPPORTED; - } - if (bits < PSA_VENDOR_RSA_GENERATE_MIN_KEY_BITS) { - return PSA_ERROR_NOT_SUPPORTED; - } - - /* Accept only byte-aligned keys, for the same reasons as - * in psa_import_rsa_key(). */ - if (bits % 8 != 0) { - return PSA_ERROR_NOT_SUPPORTED; - } - } else -#endif /* defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE) */ - -#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE) - if (PSA_KEY_TYPE_IS_ECC(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) { - /* To avoid empty block, return successfully here. */ - return PSA_SUCCESS; - } else -#endif /* defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE) */ - -#if defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE) - if (PSA_KEY_TYPE_IS_DH(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) { - if (psa_is_dh_key_size_valid(bits) == 0) { - return PSA_ERROR_NOT_SUPPORTED; - } - } else -#endif /* defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE) */ - { - return PSA_ERROR_NOT_SUPPORTED; - } - - return PSA_SUCCESS; -} - -psa_status_t psa_generate_key_internal( - const psa_key_attributes_t *attributes, - const psa_custom_key_parameters_t *custom, - const uint8_t *custom_data, - size_t custom_data_length, - uint8_t *key_buffer, size_t key_buffer_size, size_t *key_buffer_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_type_t type = attributes->type; - - /* Only used for RSA */ - (void) custom; - (void) custom_data; - (void) custom_data_length; - - if (key_type_is_raw_bytes(type)) { - status = psa_generate_random_internal(key_buffer, key_buffer_size); - if (status != PSA_SUCCESS) { - return status; - } - -#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES) - if (type == PSA_KEY_TYPE_DES) { - psa_des_set_key_parity(key_buffer, key_buffer_size); - } -#endif /* MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES */ - } else - -#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_GENERATE) - if (type == PSA_KEY_TYPE_RSA_KEY_PAIR) { - return mbedtls_psa_rsa_generate_key(attributes, - custom_data, custom_data_length, - key_buffer, - key_buffer_size, - key_buffer_length); - } else -#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_GENERATE) */ - -#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_GENERATE) - if (PSA_KEY_TYPE_IS_ECC(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) { - return mbedtls_psa_ecp_generate_key(attributes, - key_buffer, - key_buffer_size, - key_buffer_length); - } else -#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_GENERATE) */ - -#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_GENERATE) - if (PSA_KEY_TYPE_IS_DH(type) && PSA_KEY_TYPE_IS_KEY_PAIR(type)) { - return mbedtls_psa_ffdh_generate_key(attributes, - key_buffer, - key_buffer_size, - key_buffer_length); - } else -#endif /* defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_GENERATE) */ - { - (void) key_buffer_length; - return PSA_ERROR_NOT_SUPPORTED; - } - - return PSA_SUCCESS; -} - -psa_status_t psa_generate_key_custom(const psa_key_attributes_t *attributes, - const psa_custom_key_parameters_t *custom, - const uint8_t *custom_data, - size_t custom_data_length, - mbedtls_svc_key_id_t *key) -{ - psa_status_t status; - psa_key_slot_t *slot = NULL; - size_t key_buffer_size; - - *key = MBEDTLS_SVC_KEY_ID_INIT; - - /* Reject any attempt to create a zero-length key so that we don't - * risk tripping up later, e.g. on a malloc(0) that returns NULL. */ - if (psa_get_key_bits(attributes) == 0) { - return PSA_ERROR_INVALID_ARGUMENT; - } - - /* Reject any attempt to create a public key. */ - if (PSA_KEY_TYPE_IS_PUBLIC_KEY(attributes->type)) { - return PSA_ERROR_INVALID_ARGUMENT; - } - -#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE) - if (attributes->type == PSA_KEY_TYPE_RSA_KEY_PAIR) { - if (custom->flags != 0) { - return PSA_ERROR_INVALID_ARGUMENT; - } - } else -#endif - if (!psa_custom_key_parameters_are_default(custom, custom_data_length)) { - return PSA_ERROR_INVALID_ARGUMENT; - } - - status = psa_start_key_creation(attributes, &slot); - if (status != PSA_SUCCESS) { - goto exit; - } - - /* In the case of a transparent key or an opaque key stored in local - * storage, we have to allocate a buffer to hold the generated key material. */ - if (slot->key.bytes == 0) { - if (PSA_KEY_LIFETIME_GET_LOCATION(attributes->lifetime) == - PSA_KEY_LOCATION_LOCAL_STORAGE) { - status = psa_validate_key_type_and_size_for_key_generation( - attributes->type, attributes->bits); - if (status != PSA_SUCCESS) { - goto exit; - } - - key_buffer_size = PSA_EXPORT_KEY_OUTPUT_SIZE( - attributes->type, - attributes->bits); - } else { - status = psa_driver_wrapper_get_key_buffer_size( - attributes, &key_buffer_size); - if (status != PSA_SUCCESS) { - goto exit; - } - } - - status = psa_allocate_buffer_to_slot(slot, key_buffer_size); - if (status != PSA_SUCCESS) { - goto exit; - } - } - - status = psa_driver_wrapper_generate_key(attributes, - custom, - custom_data, custom_data_length, - slot->key.data, slot->key.bytes, - &slot->key.bytes); - if (status != PSA_SUCCESS) { - psa_remove_key_data_from_memory(slot); - } - -exit: - if (status == PSA_SUCCESS) { - status = psa_finish_key_creation(slot, key); - } - if (status != PSA_SUCCESS) { - psa_fail_key_creation(slot); - } - - return status; -} - -psa_status_t psa_generate_key(const psa_key_attributes_t *attributes, - mbedtls_svc_key_id_t *key) -{ - return psa_generate_key_custom(attributes, - &default_custom_production, - NULL, 0, - key); -} - -#if defined(MBEDTLS_ECP_RESTARTABLE) && \ - defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_GENERATE) -static psa_status_t psa_generate_key_iop_abort_internal( - psa_generate_key_iop_t *operation) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - if (operation->id == 0) { - return PSA_SUCCESS; - } - - status = mbedtls_psa_ecp_generate_key_iop_abort(&operation->ctx); - - psa_reset_key_attributes(&operation->attributes); - - operation->id = 0; - - return status; -} -#endif - -uint32_t psa_generate_key_iop_get_num_ops( - psa_generate_key_iop_t *operation) -{ - return operation->num_ops; -} - -psa_status_t psa_generate_key_iop_setup( - psa_generate_key_iop_t *operation, - const psa_key_attributes_t *attributes) -{ -#if defined(MBEDTLS_ECP_RESTARTABLE) && \ - defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_GENERATE) - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_type_t type; - - type = psa_get_key_type(attributes); - - if (!PSA_KEY_TYPE_IS_ECC(type)) { - status = PSA_ERROR_NOT_SUPPORTED; - goto exit; - } - - if (operation->id != 0 || operation->error_occurred) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - if (psa_get_key_bits(attributes) == 0) { - status = PSA_ERROR_INVALID_ARGUMENT; - goto exit; - } - - if (PSA_KEY_TYPE_IS_PUBLIC_KEY(type)) { - status = PSA_ERROR_INVALID_ARGUMENT; - goto exit; - } - - operation->attributes = *attributes; - - operation->num_ops = 0; - - /* We only support the builtin/Mbed TLS driver for now. */ - operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; - - status = mbedtls_psa_ecp_generate_key_iop_setup(&operation->ctx, attributes); - -exit: - if (status != PSA_SUCCESS) { - operation->error_occurred = 1; - psa_generate_key_iop_abort_internal(operation); - } - - return status; -#else - (void) operation; - (void) attributes; - return PSA_ERROR_NOT_SUPPORTED; -#endif -} - -psa_status_t psa_generate_key_iop_complete( - psa_generate_key_iop_t *operation, - mbedtls_svc_key_id_t *key) -{ -#if defined(MBEDTLS_ECP_RESTARTABLE) && \ - defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_GENERATE) - psa_status_t status; - uint8_t key_data[PSA_KEY_EXPORT_ECC_KEY_PAIR_MAX_SIZE(PSA_VENDOR_ECC_MAX_CURVE_BITS)+1] = { 0 }; - size_t key_len = 0; - - if (operation->id == 0 || operation->error_occurred) { - return PSA_ERROR_BAD_STATE; - } - - status = mbedtls_psa_ecp_generate_key_iop_complete(&operation->ctx, key_data, - sizeof(key_data), &key_len); - if (status != PSA_SUCCESS) { - goto exit; - } - - operation->num_ops = mbedtls_psa_generate_key_iop_get_num_ops(&operation->ctx); - - status = psa_import_key(&operation->attributes, - key_data + (sizeof(key_data) - key_len), - key_len, - key); - -exit: - if (status != PSA_OPERATION_INCOMPLETE) { - if (status != PSA_SUCCESS) { - operation->error_occurred = 1; - } - psa_generate_key_iop_abort_internal(operation); - } - - mbedtls_platform_zeroize(key_data, sizeof(key_data)); - return status; -#else - (void) operation; - (void) key; - - return PSA_ERROR_BAD_STATE; -#endif -} - -psa_status_t psa_generate_key_iop_abort( - psa_generate_key_iop_t *operation) -{ -#if defined(MBEDTLS_ECP_RESTARTABLE) && \ - defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_GENERATE) - psa_status_t status; - - status = psa_generate_key_iop_abort_internal(operation); - - operation->error_occurred = 0; - operation->num_ops = 0; - return status; -#else - (void) operation; - return PSA_SUCCESS; -#endif -} - - - -/****************************************************************/ -/* Module setup */ -/****************************************************************/ - -#if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) -psa_status_t mbedtls_psa_crypto_configure_entropy_sources( - void (* entropy_init)(mbedtls_entropy_context *ctx), - void (* entropy_free)(mbedtls_entropy_context *ctx)) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - -#if defined(MBEDTLS_THREADING_C) - mbedtls_mutex_lock(&mbedtls_threading_psa_rngdata_mutex); -#endif /* defined(MBEDTLS_THREADING_C) */ - - if (global_data.rng_state != RNG_NOT_INITIALIZED) { - status = PSA_ERROR_BAD_STATE; - } else { - global_data.rng.entropy_init = entropy_init; - global_data.rng.entropy_free = entropy_free; - status = PSA_SUCCESS; - } - -#if defined(MBEDTLS_THREADING_C) - mbedtls_mutex_unlock(&mbedtls_threading_psa_rngdata_mutex); -#endif /* defined(MBEDTLS_THREADING_C) */ - - return status; -} -#endif /* !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) */ - -void mbedtls_psa_crypto_free(void) -{ - -#if defined(MBEDTLS_THREADING_C) - mbedtls_mutex_lock(&mbedtls_threading_psa_globaldata_mutex); -#endif /* defined(MBEDTLS_THREADING_C) */ - - /* Nothing to do to free transaction. */ - if (global_data.initialized & PSA_CRYPTO_SUBSYSTEM_TRANSACTION_INITIALIZED) { - global_data.initialized &= ~PSA_CRYPTO_SUBSYSTEM_TRANSACTION_INITIALIZED; - } - - if (global_data.initialized & PSA_CRYPTO_SUBSYSTEM_KEY_SLOTS_INITIALIZED) { - psa_wipe_all_key_slots(); - global_data.initialized &= ~PSA_CRYPTO_SUBSYSTEM_KEY_SLOTS_INITIALIZED; - } - -#if defined(MBEDTLS_THREADING_C) - mbedtls_mutex_unlock(&mbedtls_threading_psa_globaldata_mutex); -#endif /* defined(MBEDTLS_THREADING_C) */ - -#if defined(MBEDTLS_THREADING_C) - mbedtls_mutex_lock(&mbedtls_threading_psa_rngdata_mutex); -#endif /* defined(MBEDTLS_THREADING_C) */ - - if (global_data.rng_state != RNG_NOT_INITIALIZED) { - mbedtls_psa_random_free(&global_data.rng); - } - global_data.rng_state = RNG_NOT_INITIALIZED; - mbedtls_platform_zeroize(&global_data.rng, sizeof(global_data.rng)); - -#if defined(MBEDTLS_THREADING_C) - mbedtls_mutex_unlock(&mbedtls_threading_psa_rngdata_mutex); -#endif /* defined(MBEDTLS_THREADING_C) */ - -#if defined(MBEDTLS_THREADING_C) - mbedtls_mutex_lock(&mbedtls_threading_psa_globaldata_mutex); -#endif /* defined(MBEDTLS_THREADING_C) */ - - /* Terminate drivers */ - if (global_data.initialized & PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS_INITIALIZED) { - psa_driver_wrapper_free(); - global_data.initialized &= ~PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS_INITIALIZED; - } - -#if defined(MBEDTLS_THREADING_C) - mbedtls_mutex_unlock(&mbedtls_threading_psa_globaldata_mutex); -#endif /* defined(MBEDTLS_THREADING_C) */ - -} - -static psa_status_t mbedtls_psa_crypto_init_subsystem(mbedtls_psa_crypto_subsystem subsystem) -{ - psa_status_t status = PSA_SUCCESS; - uint8_t driver_wrappers_initialized = 0; - - switch (subsystem) { - case PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS: - -#if defined(MBEDTLS_THREADING_C) - PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_lock(&mbedtls_threading_psa_globaldata_mutex)); -#endif /* defined(MBEDTLS_THREADING_C) */ - - if (!(global_data.initialized & PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS_INITIALIZED)) { - /* Init drivers */ - status = psa_driver_wrapper_init(); - - /* Drivers need shutdown regardless of startup errors. */ - global_data.initialized |= PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS_INITIALIZED; - - - } -#if defined(MBEDTLS_THREADING_C) - PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_unlock( - &mbedtls_threading_psa_globaldata_mutex)); -#endif /* defined(MBEDTLS_THREADING_C) */ - - break; - - case PSA_CRYPTO_SUBSYSTEM_KEY_SLOTS: - -#if defined(MBEDTLS_THREADING_C) - PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_lock(&mbedtls_threading_psa_globaldata_mutex)); -#endif /* defined(MBEDTLS_THREADING_C) */ - - if (!(global_data.initialized & PSA_CRYPTO_SUBSYSTEM_KEY_SLOTS_INITIALIZED)) { - status = psa_initialize_key_slots(); - - /* Need to wipe keys even if initialization fails. */ - global_data.initialized |= PSA_CRYPTO_SUBSYSTEM_KEY_SLOTS_INITIALIZED; - - } -#if defined(MBEDTLS_THREADING_C) - PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_unlock( - &mbedtls_threading_psa_globaldata_mutex)); -#endif /* defined(MBEDTLS_THREADING_C) */ - - break; - - case PSA_CRYPTO_SUBSYSTEM_RNG: - -#if defined(MBEDTLS_THREADING_C) - PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_lock(&mbedtls_threading_psa_globaldata_mutex)); -#endif /* defined(MBEDTLS_THREADING_C) */ - - driver_wrappers_initialized = - (global_data.initialized & PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS_INITIALIZED); - -#if defined(MBEDTLS_THREADING_C) - PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_unlock( - &mbedtls_threading_psa_globaldata_mutex)); -#endif /* defined(MBEDTLS_THREADING_C) */ - - /* Need to use separate mutex here, as initialisation can require - * testing of init flags, which requires locking the global data - * mutex. */ -#if defined(MBEDTLS_THREADING_C) - PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_lock(&mbedtls_threading_psa_rngdata_mutex)); -#endif /* defined(MBEDTLS_THREADING_C) */ - - /* Initialize and seed the random generator. */ - if (global_data.rng_state == RNG_NOT_INITIALIZED && driver_wrappers_initialized) { - mbedtls_psa_random_init(&global_data.rng); - global_data.rng_state = RNG_INITIALIZED; - - status = mbedtls_psa_random_seed(&global_data.rng); - if (status == PSA_SUCCESS) { - global_data.rng_state = RNG_SEEDED; - } - } - -#if defined(MBEDTLS_THREADING_C) - PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_unlock( - &mbedtls_threading_psa_rngdata_mutex)); -#endif /* defined(MBEDTLS_THREADING_C) */ - - break; - - case PSA_CRYPTO_SUBSYSTEM_TRANSACTION: - -#if defined(MBEDTLS_THREADING_C) - PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_lock(&mbedtls_threading_psa_globaldata_mutex)); -#endif /* defined(MBEDTLS_THREADING_C) */ - - if (!(global_data.initialized & PSA_CRYPTO_SUBSYSTEM_TRANSACTION_INITIALIZED)) { - global_data.initialized |= PSA_CRYPTO_SUBSYSTEM_TRANSACTION_INITIALIZED; - status = PSA_SUCCESS; - } - -#if defined(MBEDTLS_THREADING_C) - PSA_THREADING_CHK_GOTO_EXIT(mbedtls_mutex_unlock( - &mbedtls_threading_psa_globaldata_mutex)); -#endif /* defined(MBEDTLS_THREADING_C) */ - - break; - - default: - status = PSA_ERROR_CORRUPTION_DETECTED; - } - - /* Exit label only required when using threading macros. */ -#if defined(MBEDTLS_THREADING_C) -exit: -#endif /* defined(MBEDTLS_THREADING_C) */ - - return status; -} - -psa_status_t psa_crypto_init(void) -{ - psa_status_t status; - - /* Double initialization is explicitly allowed. Early out if everything is - * done. */ - if (psa_get_initialized()) { - return PSA_SUCCESS; - } - - status = mbedtls_psa_crypto_init_subsystem(PSA_CRYPTO_SUBSYSTEM_DRIVER_WRAPPERS); - if (status != PSA_SUCCESS) { - goto exit; - } - - status = mbedtls_psa_crypto_init_subsystem(PSA_CRYPTO_SUBSYSTEM_KEY_SLOTS); - if (status != PSA_SUCCESS) { - goto exit; - } - - status = mbedtls_psa_crypto_init_subsystem(PSA_CRYPTO_SUBSYSTEM_RNG); - if (status != PSA_SUCCESS) { - goto exit; - } - - status = mbedtls_psa_crypto_init_subsystem(PSA_CRYPTO_SUBSYSTEM_TRANSACTION); - -exit: - - if (status != PSA_SUCCESS) { - mbedtls_psa_crypto_free(); - } - - return status; -} - - - -/****************************************************************/ -/* PAKE */ -/****************************************************************/ - -#if defined(PSA_WANT_ALG_SOME_PAKE) -psa_status_t psa_crypto_driver_pake_get_password_len( - const psa_crypto_driver_pake_inputs_t *inputs, - size_t *password_len) -{ - if (inputs->password_len == 0) { - return PSA_ERROR_BAD_STATE; - } - - *password_len = inputs->password_len; - - return PSA_SUCCESS; -} - -psa_status_t psa_crypto_driver_pake_get_password( - const psa_crypto_driver_pake_inputs_t *inputs, - uint8_t *buffer, size_t buffer_size, size_t *buffer_length) -{ - if (inputs->password_len == 0) { - return PSA_ERROR_BAD_STATE; - } - - if (buffer_size < inputs->password_len) { - return PSA_ERROR_BUFFER_TOO_SMALL; - } - - memcpy(buffer, inputs->password, inputs->password_len); - *buffer_length = inputs->password_len; - - return PSA_SUCCESS; -} - -psa_status_t psa_crypto_driver_pake_get_user_len( - const psa_crypto_driver_pake_inputs_t *inputs, - size_t *user_len) -{ - if (inputs->user_len == 0) { - return PSA_ERROR_BAD_STATE; - } - - *user_len = inputs->user_len; - - return PSA_SUCCESS; -} - -psa_status_t psa_crypto_driver_pake_get_user( - const psa_crypto_driver_pake_inputs_t *inputs, - uint8_t *user_id, size_t user_id_size, size_t *user_id_len) -{ - if (inputs->user_len == 0) { - return PSA_ERROR_BAD_STATE; - } - - if (user_id_size < inputs->user_len) { - return PSA_ERROR_BUFFER_TOO_SMALL; - } - - memcpy(user_id, inputs->user, inputs->user_len); - *user_id_len = inputs->user_len; - - return PSA_SUCCESS; -} - -psa_status_t psa_crypto_driver_pake_get_peer_len( - const psa_crypto_driver_pake_inputs_t *inputs, - size_t *peer_len) -{ - if (inputs->peer_len == 0) { - return PSA_ERROR_BAD_STATE; - } - - *peer_len = inputs->peer_len; - - return PSA_SUCCESS; -} - -psa_status_t psa_crypto_driver_pake_get_peer( - const psa_crypto_driver_pake_inputs_t *inputs, - uint8_t *peer_id, size_t peer_id_size, size_t *peer_id_length) -{ - if (inputs->peer_len == 0) { - return PSA_ERROR_BAD_STATE; - } - - if (peer_id_size < inputs->peer_len) { - return PSA_ERROR_BUFFER_TOO_SMALL; - } - - memcpy(peer_id, inputs->peer, inputs->peer_len); - *peer_id_length = inputs->peer_len; - - return PSA_SUCCESS; -} - -psa_status_t psa_crypto_driver_pake_get_cipher_suite( - const psa_crypto_driver_pake_inputs_t *inputs, - psa_pake_cipher_suite_t *cipher_suite) -{ - if (inputs->cipher_suite.algorithm == PSA_ALG_NONE) { - return PSA_ERROR_BAD_STATE; - } - - *cipher_suite = inputs->cipher_suite; - - return PSA_SUCCESS; -} - -psa_status_t psa_pake_setup( - psa_pake_operation_t *operation, - const psa_pake_cipher_suite_t *cipher_suite) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - if (operation->stage != PSA_PAKE_OPERATION_STAGE_SETUP) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - if (PSA_ALG_IS_PAKE(cipher_suite->algorithm) == 0 || - PSA_ALG_IS_HASH(cipher_suite->hash) == 0) { - status = PSA_ERROR_INVALID_ARGUMENT; - goto exit; - } - - /* Make sure the variable-purpose part of the operation is zeroed. - * Initializing the operation does not necessarily take care of it, - * since the context is a union and initializing a union does not - * necessarily initialize all of its members. */ - memset(&operation->data, 0, sizeof(operation->data)); - - operation->alg = cipher_suite->algorithm; - operation->primitive = PSA_PAKE_PRIMITIVE(cipher_suite->type, - cipher_suite->family, cipher_suite->bits); - operation->data.inputs.cipher_suite = *cipher_suite; - -#if defined(PSA_WANT_ALG_JPAKE) - if (operation->alg == PSA_ALG_JPAKE) { - psa_jpake_computation_stage_t *computation_stage = - &operation->computation_stage.jpake; - - memset(computation_stage, 0, sizeof(*computation_stage)); - computation_stage->step = PSA_PAKE_STEP_KEY_SHARE; - } else -#endif /* PSA_WANT_ALG_JPAKE */ - { - status = PSA_ERROR_NOT_SUPPORTED; - goto exit; - } - - operation->stage = PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS; - - return PSA_SUCCESS; -exit: - psa_pake_abort(operation); - return status; -} - -psa_status_t psa_pake_set_password_key( - psa_pake_operation_t *operation, - mbedtls_svc_key_id_t password) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_slot_t *slot = NULL; - psa_key_type_t type; - - if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - status = psa_get_and_lock_key_slot_with_policy(password, &slot, - PSA_KEY_USAGE_DERIVE, - operation->alg); - if (status != PSA_SUCCESS) { - goto exit; - } - - type = psa_get_key_type(&slot->attr); - - if (type != PSA_KEY_TYPE_PASSWORD && - type != PSA_KEY_TYPE_PASSWORD_HASH) { - status = PSA_ERROR_INVALID_ARGUMENT; - goto exit; - } - - operation->data.inputs.password = mbedtls_calloc(1, slot->key.bytes); - if (operation->data.inputs.password == NULL) { - status = PSA_ERROR_INSUFFICIENT_MEMORY; - goto exit; - } - - memcpy(operation->data.inputs.password, slot->key.data, slot->key.bytes); - operation->data.inputs.password_len = slot->key.bytes; - operation->data.inputs.attributes = slot->attr; - -exit: - if (status != PSA_SUCCESS) { - psa_pake_abort(operation); - } - unlock_status = psa_unregister_read_under_mutex(slot); - return (status == PSA_SUCCESS) ? unlock_status : status; -} - -psa_status_t psa_pake_set_user( - psa_pake_operation_t *operation, - const uint8_t *user_id_external, - size_t user_id_len) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - LOCAL_INPUT_DECLARE(user_id_external, user_id); - - if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - if (user_id_len == 0) { - status = PSA_ERROR_INVALID_ARGUMENT; - goto exit; - } - - if (operation->data.inputs.user_len != 0) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - operation->data.inputs.user = mbedtls_calloc(1, user_id_len); - if (operation->data.inputs.user == NULL) { - status = PSA_ERROR_INSUFFICIENT_MEMORY; - goto exit; - } - - LOCAL_INPUT_ALLOC(user_id_external, user_id_len, user_id); - - memcpy(operation->data.inputs.user, user_id, user_id_len); - operation->data.inputs.user_len = user_id_len; - - status = PSA_SUCCESS; - -exit: - LOCAL_INPUT_FREE(user_id_external, user_id); - if (status != PSA_SUCCESS) { - psa_pake_abort(operation); - } - return status; -} - -psa_status_t psa_pake_set_peer( - psa_pake_operation_t *operation, - const uint8_t *peer_id_external, - size_t peer_id_len) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - LOCAL_INPUT_DECLARE(peer_id_external, peer_id); - - if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - if (peer_id_len == 0) { - status = PSA_ERROR_INVALID_ARGUMENT; - goto exit; - } - - if (operation->data.inputs.peer_len != 0) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - operation->data.inputs.peer = mbedtls_calloc(1, peer_id_len); - if (operation->data.inputs.peer == NULL) { - status = PSA_ERROR_INSUFFICIENT_MEMORY; - goto exit; - } - - LOCAL_INPUT_ALLOC(peer_id_external, peer_id_len, peer_id); - - memcpy(operation->data.inputs.peer, peer_id, peer_id_len); - operation->data.inputs.peer_len = peer_id_len; - - status = PSA_SUCCESS; - -exit: - LOCAL_INPUT_FREE(peer_id_external, peer_id); - if (status != PSA_SUCCESS) { - psa_pake_abort(operation); - } - return status; -} - -psa_status_t psa_pake_set_role( - psa_pake_operation_t *operation, - psa_pake_role_t role) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - if (operation->stage != PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - switch (operation->alg) { -#if defined(PSA_WANT_ALG_JPAKE) - case PSA_ALG_JPAKE: - if (role == PSA_PAKE_ROLE_NONE) { - return PSA_SUCCESS; - } - status = PSA_ERROR_INVALID_ARGUMENT; - break; -#endif - default: - (void) role; - status = PSA_ERROR_NOT_SUPPORTED; - goto exit; - } -exit: - psa_pake_abort(operation); - return status; -} - -/* Auxiliary function to convert core computation stage to single driver step. */ -#if defined(PSA_WANT_ALG_JPAKE) -static psa_crypto_driver_pake_step_t convert_jpake_computation_stage_to_driver_step( - psa_jpake_computation_stage_t *stage) -{ - psa_crypto_driver_pake_step_t key_share_step; - if (stage->round == PSA_JPAKE_FIRST) { - int is_x1; - - if (stage->io_mode == PSA_JPAKE_OUTPUT) { - is_x1 = (stage->outputs < 1); - } else { - is_x1 = (stage->inputs < 1); - } - - key_share_step = is_x1 ? - PSA_JPAKE_X1_STEP_KEY_SHARE : - PSA_JPAKE_X2_STEP_KEY_SHARE; - } else if (stage->round == PSA_JPAKE_SECOND) { - key_share_step = (stage->io_mode == PSA_JPAKE_OUTPUT) ? - PSA_JPAKE_X2S_STEP_KEY_SHARE : - PSA_JPAKE_X4S_STEP_KEY_SHARE; - } else { - return PSA_JPAKE_STEP_INVALID; - } - return (psa_crypto_driver_pake_step_t) (key_share_step + stage->step - PSA_PAKE_STEP_KEY_SHARE); -} -#endif /* PSA_WANT_ALG_JPAKE */ - -static psa_status_t psa_pake_complete_inputs( - psa_pake_operation_t *operation) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - /* Create copy of the inputs on stack as inputs share memory - with the driver context which will be setup by the driver. */ - psa_crypto_driver_pake_inputs_t inputs = operation->data.inputs; - - if (inputs.password_len == 0) { - return PSA_ERROR_BAD_STATE; - } - - if (operation->alg == PSA_ALG_JPAKE) { - if (inputs.user_len == 0 || inputs.peer_len == 0) { - return PSA_ERROR_BAD_STATE; - } - } - - /* Clear driver context */ - mbedtls_platform_zeroize(&operation->data, sizeof(operation->data)); - - status = psa_driver_wrapper_pake_setup(operation, &inputs); - - /* Driver is responsible for creating its own copy of the password. */ - mbedtls_zeroize_and_free(inputs.password, inputs.password_len); - - /* User and peer are translated to role. */ - mbedtls_free(inputs.user); - mbedtls_free(inputs.peer); - - if (status == PSA_SUCCESS) { -#if defined(PSA_WANT_ALG_JPAKE) - if (operation->alg == PSA_ALG_JPAKE) { - operation->stage = PSA_PAKE_OPERATION_STAGE_COMPUTATION; - } else -#endif /* PSA_WANT_ALG_JPAKE */ - { - status = PSA_ERROR_NOT_SUPPORTED; - } - } - return status; -} - -#if defined(PSA_WANT_ALG_JPAKE) -static psa_status_t psa_jpake_prologue( - psa_pake_operation_t *operation, - psa_pake_step_t step, - psa_jpake_io_mode_t io_mode) -{ - if (step != PSA_PAKE_STEP_KEY_SHARE && - step != PSA_PAKE_STEP_ZK_PUBLIC && - step != PSA_PAKE_STEP_ZK_PROOF) { - return PSA_ERROR_INVALID_ARGUMENT; - } - - psa_jpake_computation_stage_t *computation_stage = - &operation->computation_stage.jpake; - - if (computation_stage->round != PSA_JPAKE_FIRST && - computation_stage->round != PSA_JPAKE_SECOND) { - return PSA_ERROR_BAD_STATE; - } - - /* Check that the step we are given is the one we were expecting */ - if (step != computation_stage->step) { - return PSA_ERROR_BAD_STATE; - } - - if (step == PSA_PAKE_STEP_KEY_SHARE && - computation_stage->inputs == 0 && - computation_stage->outputs == 0) { - /* Start of the round, so function decides whether we are inputting - * or outputting */ - computation_stage->io_mode = io_mode; - } else if (computation_stage->io_mode != io_mode) { - /* Middle of the round so the mode we are in must match the function - * called by the user */ - return PSA_ERROR_BAD_STATE; - } - - return PSA_SUCCESS; -} - -static psa_status_t psa_jpake_epilogue( - psa_pake_operation_t *operation, - psa_jpake_io_mode_t io_mode) -{ - psa_jpake_computation_stage_t *stage = - &operation->computation_stage.jpake; - - if (stage->step == PSA_PAKE_STEP_ZK_PROOF) { - /* End of an input/output */ - if (io_mode == PSA_JPAKE_INPUT) { - stage->inputs++; - if (stage->inputs == PSA_JPAKE_EXPECTED_INPUTS(stage->round)) { - stage->io_mode = PSA_JPAKE_OUTPUT; - } - } - if (io_mode == PSA_JPAKE_OUTPUT) { - stage->outputs++; - if (stage->outputs == PSA_JPAKE_EXPECTED_OUTPUTS(stage->round)) { - stage->io_mode = PSA_JPAKE_INPUT; - } - } - if (stage->inputs == PSA_JPAKE_EXPECTED_INPUTS(stage->round) && - stage->outputs == PSA_JPAKE_EXPECTED_OUTPUTS(stage->round)) { - /* End of a round, move to the next round */ - stage->inputs = 0; - stage->outputs = 0; - stage->round++; - } - stage->step = PSA_PAKE_STEP_KEY_SHARE; - } else { - stage->step++; - } - return PSA_SUCCESS; -} - -#endif /* PSA_WANT_ALG_JPAKE */ - -psa_status_t psa_pake_output( - psa_pake_operation_t *operation, - psa_pake_step_t step, - uint8_t *output_external, - size_t output_size, - size_t *output_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_crypto_driver_pake_step_t driver_step = PSA_JPAKE_STEP_INVALID; - LOCAL_OUTPUT_DECLARE(output_external, output); - *output_length = 0; - - if (operation->stage == PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) { - status = psa_pake_complete_inputs(operation); - if (status != PSA_SUCCESS) { - goto exit; - } - } - - if (operation->stage != PSA_PAKE_OPERATION_STAGE_COMPUTATION) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - if (output_size == 0) { - status = PSA_ERROR_INVALID_ARGUMENT; - goto exit; - } - - switch (operation->alg) { -#if defined(PSA_WANT_ALG_JPAKE) - case PSA_ALG_JPAKE: - status = psa_jpake_prologue(operation, step, PSA_JPAKE_OUTPUT); - if (status != PSA_SUCCESS) { - goto exit; - } - driver_step = convert_jpake_computation_stage_to_driver_step( - &operation->computation_stage.jpake); - break; -#endif /* PSA_WANT_ALG_JPAKE */ - default: - (void) step; - status = PSA_ERROR_NOT_SUPPORTED; - goto exit; - } - - LOCAL_OUTPUT_ALLOC(output_external, output_size, output); - - status = psa_driver_wrapper_pake_output(operation, driver_step, - output, output_size, output_length); - - if (status != PSA_SUCCESS) { - goto exit; - } - - switch (operation->alg) { -#if defined(PSA_WANT_ALG_JPAKE) - case PSA_ALG_JPAKE: - status = psa_jpake_epilogue(operation, PSA_JPAKE_OUTPUT); - if (status != PSA_SUCCESS) { - goto exit; - } - break; -#endif /* PSA_WANT_ALG_JPAKE */ - default: - status = PSA_ERROR_NOT_SUPPORTED; - goto exit; - } - -exit: - LOCAL_OUTPUT_FREE(output_external, output); - if (status != PSA_SUCCESS) { - psa_pake_abort(operation); - } - return status; -} - -psa_status_t psa_pake_input( - psa_pake_operation_t *operation, - psa_pake_step_t step, - const uint8_t *input_external, - size_t input_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_crypto_driver_pake_step_t driver_step = PSA_JPAKE_STEP_INVALID; - const size_t max_input_length = (size_t) PSA_PAKE_INPUT_SIZE(operation->alg, - operation->primitive, - step); - LOCAL_INPUT_DECLARE(input_external, input); - - if (operation->stage == PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) { - status = psa_pake_complete_inputs(operation); - if (status != PSA_SUCCESS) { - goto exit; - } - } - - if (operation->stage != PSA_PAKE_OPERATION_STAGE_COMPUTATION) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - - if (input_length == 0 || input_length > max_input_length) { - status = PSA_ERROR_INVALID_ARGUMENT; - goto exit; - } - - switch (operation->alg) { -#if defined(PSA_WANT_ALG_JPAKE) - case PSA_ALG_JPAKE: - status = psa_jpake_prologue(operation, step, PSA_JPAKE_INPUT); - if (status != PSA_SUCCESS) { - goto exit; - } - driver_step = convert_jpake_computation_stage_to_driver_step( - &operation->computation_stage.jpake); - break; -#endif /* PSA_WANT_ALG_JPAKE */ - default: - (void) step; - status = PSA_ERROR_NOT_SUPPORTED; - goto exit; - } - - LOCAL_INPUT_ALLOC(input_external, input_length, input); - status = psa_driver_wrapper_pake_input(operation, driver_step, - input, input_length); - - if (status != PSA_SUCCESS) { - goto exit; - } - - switch (operation->alg) { -#if defined(PSA_WANT_ALG_JPAKE) - case PSA_ALG_JPAKE: - status = psa_jpake_epilogue(operation, PSA_JPAKE_INPUT); - if (status != PSA_SUCCESS) { - goto exit; - } - break; -#endif /* PSA_WANT_ALG_JPAKE */ - default: - status = PSA_ERROR_NOT_SUPPORTED; - goto exit; - } - -exit: - LOCAL_INPUT_FREE(input_external, input); - if (status != PSA_SUCCESS) { - psa_pake_abort(operation); - } - return status; -} - -psa_status_t psa_pake_get_implicit_key( - psa_pake_operation_t *operation, - psa_key_derivation_operation_t *output) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_status_t abort_status = PSA_ERROR_CORRUPTION_DETECTED; - uint8_t shared_key[MBEDTLS_PSA_JPAKE_BUFFER_SIZE]; - size_t shared_key_len = 0; - - if (operation->stage != PSA_PAKE_OPERATION_STAGE_COMPUTATION) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - -#if defined(PSA_WANT_ALG_JPAKE) - if (operation->alg == PSA_ALG_JPAKE) { - psa_jpake_computation_stage_t *computation_stage = - &operation->computation_stage.jpake; - if (computation_stage->round != PSA_JPAKE_FINISHED) { - status = PSA_ERROR_BAD_STATE; - goto exit; - } - } else -#endif /* PSA_WANT_ALG_JPAKE */ - { - status = PSA_ERROR_NOT_SUPPORTED; - goto exit; - } - - status = psa_driver_wrapper_pake_get_implicit_key(operation, - shared_key, - sizeof(shared_key), - &shared_key_len); - - if (status != PSA_SUCCESS) { - goto exit; - } - - status = psa_key_derivation_input_bytes(output, - PSA_KEY_DERIVATION_INPUT_SECRET, - shared_key, - shared_key_len); - - mbedtls_platform_zeroize(shared_key, sizeof(shared_key)); -exit: - abort_status = psa_pake_abort(operation); - return status == PSA_SUCCESS ? abort_status : status; -} - -psa_status_t psa_pake_abort( - psa_pake_operation_t *operation) -{ - psa_status_t status = PSA_SUCCESS; - - if (operation->stage == PSA_PAKE_OPERATION_STAGE_COMPUTATION) { - status = psa_driver_wrapper_pake_abort(operation); - } - - if (operation->stage == PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS) { - if (operation->data.inputs.password != NULL) { - mbedtls_zeroize_and_free(operation->data.inputs.password, - operation->data.inputs.password_len); - } - if (operation->data.inputs.user != NULL) { - mbedtls_free(operation->data.inputs.user); - } - if (operation->data.inputs.peer != NULL) { - mbedtls_free(operation->data.inputs.peer); - } - } - memset(operation, 0, sizeof(psa_pake_operation_t)); - - return status; -} -#endif /* PSA_WANT_ALG_SOME_PAKE */ - -/* Memory copying test hooks. These are called before input copy, after input - * copy, before output copy and after output copy, respectively. - * They are used by memory-poisoning tests to temporarily unpoison buffers - * while they are copied. */ -#if defined(MBEDTLS_TEST_HOOKS) -void (*psa_input_pre_copy_hook)(const uint8_t *input, size_t input_len) = NULL; -void (*psa_input_post_copy_hook)(const uint8_t *input, size_t input_len) = NULL; -void (*psa_output_pre_copy_hook)(const uint8_t *output, size_t output_len) = NULL; -void (*psa_output_post_copy_hook)(const uint8_t *output, size_t output_len) = NULL; -#endif - -/** Copy from an input buffer to a local copy. - * - * \param[in] input Pointer to input buffer. - * \param[in] input_len Length of the input buffer. - * \param[out] input_copy Pointer to a local copy in which to store the input data. - * \param[out] input_copy_len Length of the local copy buffer. - * \return #PSA_SUCCESS, if the buffer was successfully - * copied. - * \return #PSA_ERROR_CORRUPTION_DETECTED, if the local - * copy is too small to hold contents of the - * input buffer. - */ -MBEDTLS_STATIC_TESTABLE -psa_status_t psa_crypto_copy_input(const uint8_t *input, size_t input_len, - uint8_t *input_copy, size_t input_copy_len) -{ - if (input_len > input_copy_len) { - return PSA_ERROR_CORRUPTION_DETECTED; - } - -#if defined(MBEDTLS_TEST_HOOKS) - if (psa_input_pre_copy_hook != NULL) { - psa_input_pre_copy_hook(input, input_len); - } -#endif - - if (input_len > 0) { - memcpy(input_copy, input, input_len); - } - -#if defined(MBEDTLS_TEST_HOOKS) - if (psa_input_post_copy_hook != NULL) { - psa_input_post_copy_hook(input, input_len); - } -#endif - - return PSA_SUCCESS; -} - -/** Copy from a local output buffer into a user-supplied one. - * - * \param[in] output_copy Pointer to a local buffer containing the output. - * \param[in] output_copy_len Length of the local buffer. - * \param[out] output Pointer to user-supplied output buffer. - * \param[out] output_len Length of the user-supplied output buffer. - * \return #PSA_SUCCESS, if the buffer was successfully - * copied. - * \return #PSA_ERROR_BUFFER_TOO_SMALL, if the - * user-supplied output buffer is too small to - * hold the contents of the local buffer. - */ -MBEDTLS_STATIC_TESTABLE -psa_status_t psa_crypto_copy_output(const uint8_t *output_copy, size_t output_copy_len, - uint8_t *output, size_t output_len) -{ - if (output_len < output_copy_len) { - return PSA_ERROR_BUFFER_TOO_SMALL; - } - -#if defined(MBEDTLS_TEST_HOOKS) - if (psa_output_pre_copy_hook != NULL) { - psa_output_pre_copy_hook(output, output_len); - } -#endif - - if (output_copy_len > 0) { - memcpy(output, output_copy, output_copy_len); - } - -#if defined(MBEDTLS_TEST_HOOKS) - if (psa_output_post_copy_hook != NULL) { - psa_output_post_copy_hook(output, output_len); - } -#endif - - return PSA_SUCCESS; -} - -psa_status_t psa_crypto_local_input_alloc(const uint8_t *input, size_t input_len, - psa_crypto_local_input_t *local_input) -{ - psa_status_t status; - - *local_input = PSA_CRYPTO_LOCAL_INPUT_INIT; - - if (input_len == 0) { - return PSA_SUCCESS; - } - - local_input->buffer = mbedtls_calloc(input_len, 1); - if (local_input->buffer == NULL) { - /* Since we dealt with the zero-length case above, we know that - * a NULL return value means a failure of allocation. */ - return PSA_ERROR_INSUFFICIENT_MEMORY; - } - /* From now on, we must free local_input->buffer on error. */ - - local_input->length = input_len; - - status = psa_crypto_copy_input(input, input_len, - local_input->buffer, local_input->length); - if (status != PSA_SUCCESS) { - goto error; - } - - return PSA_SUCCESS; - -error: - mbedtls_zeroize_and_free(local_input->buffer, local_input->length); - local_input->buffer = NULL; - local_input->length = 0; - return status; -} - -void psa_crypto_local_input_free(psa_crypto_local_input_t *local_input) -{ - mbedtls_zeroize_and_free(local_input->buffer, local_input->length); - local_input->buffer = NULL; - local_input->length = 0; -} - -psa_status_t psa_crypto_local_output_alloc(uint8_t *output, size_t output_len, - psa_crypto_local_output_t *local_output) -{ - *local_output = PSA_CRYPTO_LOCAL_OUTPUT_INIT; - - if (output_len == 0) { - return PSA_SUCCESS; - } - local_output->buffer = mbedtls_calloc(output_len, 1); - if (local_output->buffer == NULL) { - /* Since we dealt with the zero-length case above, we know that - * a NULL return value means a failure of allocation. */ - return PSA_ERROR_INSUFFICIENT_MEMORY; - } - local_output->length = output_len; - local_output->original = output; - - return PSA_SUCCESS; -} - -psa_status_t psa_crypto_local_output_free(psa_crypto_local_output_t *local_output) -{ - psa_status_t status; - - if (local_output->buffer == NULL) { - local_output->length = 0; - return PSA_SUCCESS; - } - if (local_output->original == NULL) { - /* We have an internal copy but nothing to copy back to. */ - return PSA_ERROR_CORRUPTION_DETECTED; - } - - status = psa_crypto_copy_output(local_output->buffer, local_output->length, - local_output->original, local_output->length); - if (status != PSA_SUCCESS) { - return status; - } - - mbedtls_zeroize_and_free(local_output->buffer, local_output->length); - local_output->buffer = NULL; - local_output->length = 0; - - return PSA_SUCCESS; -} - -#endif /* MBEDTLS_PSA_CRYPTO_C */ diff --git a/tf-psa-crypto/core/psa_crypto_driver_wrappers.h b/tf-psa-crypto/core/psa_crypto_driver_wrappers.h deleted file mode 100644 index 672ef7d442..0000000000 --- a/tf-psa-crypto/core/psa_crypto_driver_wrappers.h +++ /dev/null @@ -1,3063 +0,0 @@ -/* - * Functions to delegate cryptographic operations to an available - * and appropriate accelerator. - * Warning: This file is now auto-generated. - */ -/* Copyright The Mbed TLS Contributors - * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later - */ - - -/* BEGIN-common headers */ -#include "common.h" -#include "psa_crypto_aead.h" -#include "psa_crypto_cipher.h" -#include "psa_crypto_core.h" -#include "psa_crypto_driver_wrappers_no_static.h" -#include "psa_crypto_hash.h" -#include "psa_crypto_mac.h" -#include "psa_crypto_pake.h" -#include "psa_crypto_rsa.h" - -#include "mbedtls/platform.h" -#include "mbedtls/constant_time.h" -/* END-common headers */ - -#if defined(MBEDTLS_PSA_CRYPTO_C) - -/* BEGIN-driver headers */ -/* Headers for mbedtls_test opaque driver */ -#if defined(PSA_CRYPTO_DRIVER_TEST) -#include "test/drivers/test_driver.h" - -#endif -/* Headers for mbedtls_test transparent driver */ -#if defined(PSA_CRYPTO_DRIVER_TEST) -#include "test/drivers/test_driver.h" - -#endif -/* Headers for p256 transparent driver */ -#if defined(MBEDTLS_PSA_P256M_DRIVER_ENABLED) -#include "../drivers/p256-m/p256-m_driver_entrypoints.h" - -#endif -/* Headers for esp_sha transparent driver */ -#if defined(ESP_SHA_DRIVER_ENABLED) -#include "../../../port/psa_driver/include/psa_crypto_driver_esp_sha.h" - -#endif -/* Headers for esp_aes transparent driver */ -#if defined(ESP_AES_DRIVER_ENABLED) -#include "../../../port/psa_driver/include/psa_crypto_driver_esp_aes.h" -#include "../../../port/psa_driver/include/psa_crypto_driver_esp_aes_gcm.h" - -#endif -/* Headers for esp_cmac transparent driver */ -#if defined(ESP_AES_DRIVER_ENABLED) -#include "../../../port/psa_driver/include/psa_crypto_driver_esp_cmac.h" - -#endif - -/* END-driver headers */ - -/* Auto-generated values depending on which drivers are registered. - * ID 0 is reserved for unallocated operations. - * ID 1 is reserved for the Mbed TLS software driver. */ -/* BEGIN-driver id definition */ -#define PSA_CRYPTO_MBED_TLS_DRIVER_ID (1) -#define MBEDTLS_TEST_OPAQUE_DRIVER_ID (2) -#define MBEDTLS_TEST_TRANSPARENT_DRIVER_ID (3) -#define P256_TRANSPARENT_DRIVER_ID (4) -#define ESP_SHA_TRANSPARENT_DRIVER_ID (5) -#define ESP_AES_TRANSPARENT_DRIVER_ID (6) -#define ESP_CMAC_TRANSPARENT_DRIVER_ID (7) - -/* END-driver id */ - -/* BEGIN-Common Macro definitions */ - -/* END-Common Macro definitions */ - -static inline psa_status_t psa_driver_wrapper_init( void ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_init( ); - if( status != PSA_SUCCESS ) - return( status ); - - status = mbedtls_test_opaque_init( ); - if( status != PSA_SUCCESS ) - return( status ); -#endif - - (void) status; - return( PSA_SUCCESS ); -} - -static inline void psa_driver_wrapper_free( void ) -{ -#if defined(PSA_CRYPTO_DRIVER_TEST) - mbedtls_test_transparent_free( ); - mbedtls_test_opaque_free( ); -#endif -} - -/* Start delegation functions */ -static inline psa_status_t psa_driver_wrapper_sign_message( - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, - size_t key_buffer_size, - psa_algorithm_t alg, - const uint8_t *input, - size_t input_length, - uint8_t *signature, - size_t signature_size, - size_t *signature_length ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_signature_sign_message( - attributes, - key_buffer, - key_buffer_size, - alg, - input, - input_length, - signature, - signature_size, - signature_length ); - /* Declared with fallback == true */ - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - break; - - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: - status = mbedtls_test_opaque_signature_sign_message( - attributes, - key_buffer, - key_buffer_size, - alg, - input, - input_length, - signature, - signature_size, - signature_length ); - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); - break; -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - /* Key is declared with a lifetime not known to us */ - (void)status; - break; - } - - return( psa_sign_message_builtin( attributes, - key_buffer, - key_buffer_size, - alg, - input, - input_length, - signature, - signature_size, - signature_length ) ); -} - -static inline psa_status_t psa_driver_wrapper_verify_message( - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, - size_t key_buffer_size, - psa_algorithm_t alg, - const uint8_t *input, - size_t input_length, - const uint8_t *signature, - size_t signature_length ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_signature_verify_message( - attributes, - key_buffer, - key_buffer_size, - alg, - input, - input_length, - signature, - signature_length ); - /* Declared with fallback == true */ - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - break; - - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: - return( mbedtls_test_opaque_signature_verify_message( - attributes, - key_buffer, - key_buffer_size, - alg, - input, - input_length, - signature, - signature_length ) ); - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); - break; -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - /* Key is declared with a lifetime not known to us */ - (void)status; - break; - } - - return( psa_verify_message_builtin( attributes, - key_buffer, - key_buffer_size, - alg, - input, - input_length, - signature, - signature_length ) ); -} - -static inline psa_status_t psa_driver_wrapper_sign_hash( - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, size_t key_buffer_size, - psa_algorithm_t alg, const uint8_t *hash, size_t hash_length, - uint8_t *signature, size_t signature_size, size_t *signature_length ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_signature_sign_hash( attributes, - key_buffer, - key_buffer_size, - alg, - hash, - hash_length, - signature, - signature_size, - signature_length ); - /* Declared with fallback == true */ - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#if defined (MBEDTLS_PSA_P256M_DRIVER_ENABLED) - if( PSA_KEY_TYPE_IS_ECC( psa_get_key_type(attributes) ) && - PSA_ALG_IS_RANDOMIZED_ECDSA(alg) && - PSA_KEY_TYPE_ECC_GET_FAMILY(psa_get_key_type(attributes)) == PSA_ECC_FAMILY_SECP_R1 && - psa_get_key_bits(attributes) == 256 ) - { - status = p256_transparent_sign_hash( attributes, - key_buffer, - key_buffer_size, - alg, - hash, - hash_length, - signature, - signature_size, - signature_length ); - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); - } -#endif /* MBEDTLS_PSA_P256M_DRIVER_ENABLED */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - /* Fell through, meaning no accelerator supports this operation */ - return( psa_sign_hash_builtin( attributes, - key_buffer, - key_buffer_size, - alg, - hash, - hash_length, - signature, - signature_size, - signature_length ) ); - - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: - return( mbedtls_test_opaque_signature_sign_hash( attributes, - key_buffer, - key_buffer_size, - alg, - hash, - hash_length, - signature, - signature_size, - signature_length ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - /* Key is declared with a lifetime not known to us */ - (void)status; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_verify_hash( - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, size_t key_buffer_size, - psa_algorithm_t alg, const uint8_t *hash, size_t hash_length, - const uint8_t *signature, size_t signature_length ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_signature_verify_hash( - attributes, - key_buffer, - key_buffer_size, - alg, - hash, - hash_length, - signature, - signature_length ); - /* Declared with fallback == true */ - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#if defined (MBEDTLS_PSA_P256M_DRIVER_ENABLED) - if( PSA_KEY_TYPE_IS_ECC( psa_get_key_type(attributes) ) && - PSA_ALG_IS_ECDSA(alg) && - PSA_KEY_TYPE_ECC_GET_FAMILY(psa_get_key_type(attributes)) == PSA_ECC_FAMILY_SECP_R1 && - psa_get_key_bits(attributes) == 256 ) - { - status = p256_transparent_verify_hash( attributes, - key_buffer, - key_buffer_size, - alg, - hash, - hash_length, - signature, - signature_length ); - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); - } -#endif /* MBEDTLS_PSA_P256M_DRIVER_ENABLED */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - return( psa_verify_hash_builtin( attributes, - key_buffer, - key_buffer_size, - alg, - hash, - hash_length, - signature, - signature_length ) ); - - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: - return( mbedtls_test_opaque_signature_verify_hash( attributes, - key_buffer, - key_buffer_size, - alg, - hash, - hash_length, - signature, - signature_length ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - /* Key is declared with a lifetime not known to us */ - (void)status; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline uint32_t psa_driver_wrapper_sign_hash_get_num_ops( - psa_sign_hash_interruptible_operation_t *operation ) -{ - switch( operation->id ) - { - /* If uninitialised, return 0, as no work can have been done. */ - case 0: - return 0; - - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return(mbedtls_psa_sign_hash_get_num_ops(&operation->ctx.mbedtls_ctx)); - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - /* Add test driver tests here */ - -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - } - - /* Can't happen (see discussion in #8271) */ - return 0; -} - -static inline uint32_t psa_driver_wrapper_verify_hash_get_num_ops( - psa_verify_hash_interruptible_operation_t *operation ) -{ - switch( operation->id ) - { - /* If uninitialised, return 0, as no work can have been done. */ - case 0: - return 0; - - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return (mbedtls_psa_verify_hash_get_num_ops(&operation->ctx.mbedtls_ctx)); - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - /* Add test driver tests here */ - -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - } - - /* Can't happen (see discussion in #8271) */ - return 0; -} - -static inline psa_status_t psa_driver_wrapper_sign_hash_start( - psa_sign_hash_interruptible_operation_t *operation, - const psa_key_attributes_t *attributes, const uint8_t *key_buffer, - size_t key_buffer_size, psa_algorithm_t alg, - const uint8_t *hash, size_t hash_length ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION( - psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - - /* Add test driver tests here */ - - /* Declared with fallback == true */ - -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - /* Fell through, meaning no accelerator supports this operation */ - operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; - status = mbedtls_psa_sign_hash_start( &operation->ctx.mbedtls_ctx, - attributes, - key_buffer, key_buffer_size, - alg, hash, hash_length ); - break; - - /* Add cases for opaque driver here */ - - default: - /* Key is declared with a lifetime not known to us */ - status = PSA_ERROR_INVALID_ARGUMENT; - break; - } - - return( status ); -} - -static inline psa_status_t psa_driver_wrapper_sign_hash_complete( - psa_sign_hash_interruptible_operation_t *operation, - uint8_t *signature, size_t signature_size, - size_t *signature_length ) -{ - switch( operation->id ) - { - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_sign_hash_complete( &operation->ctx.mbedtls_ctx, - signature, signature_size, - signature_length ) ); - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - /* Add test driver tests here */ - -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - } - - ( void ) signature; - ( void ) signature_size; - ( void ) signature_length; - - return( PSA_ERROR_INVALID_ARGUMENT ); -} - -static inline psa_status_t psa_driver_wrapper_sign_hash_abort( - psa_sign_hash_interruptible_operation_t *operation ) -{ - switch( operation->id ) - { - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_sign_hash_abort( &operation->ctx.mbedtls_ctx ) ); - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - /* Add test driver tests here */ - -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - } - - return( PSA_ERROR_INVALID_ARGUMENT ); -} - -static inline psa_status_t psa_driver_wrapper_verify_hash_start( - psa_verify_hash_interruptible_operation_t *operation, - const psa_key_attributes_t *attributes, const uint8_t *key_buffer, - size_t key_buffer_size, psa_algorithm_t alg, - const uint8_t *hash, size_t hash_length, - const uint8_t *signature, size_t signature_length ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION( - psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - - /* Add test driver tests here */ - - /* Declared with fallback == true */ - -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - /* Fell through, meaning no accelerator supports this operation */ - operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; - status = mbedtls_psa_verify_hash_start( &operation->ctx.mbedtls_ctx, - attributes, - key_buffer, key_buffer_size, - alg, hash, hash_length, - signature, signature_length ); - break; - - /* Add cases for opaque driver here */ - - default: - /* Key is declared with a lifetime not known to us */ - status = PSA_ERROR_INVALID_ARGUMENT; - break; - } - - return( status ); -} - -static inline psa_status_t psa_driver_wrapper_verify_hash_complete( - psa_verify_hash_interruptible_operation_t *operation ) -{ - switch( operation->id ) - { - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_verify_hash_complete( - &operation->ctx.mbedtls_ctx - ) ); - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - /* Add test driver tests here */ - -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - } - - return( PSA_ERROR_INVALID_ARGUMENT ); -} - -static inline psa_status_t psa_driver_wrapper_verify_hash_abort( - psa_verify_hash_interruptible_operation_t *operation ) -{ - switch( operation->id ) - { - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_verify_hash_abort( &operation->ctx.mbedtls_ctx - ) ); - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - /* Add test driver tests here */ - -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - } - - return( PSA_ERROR_INVALID_ARGUMENT ); -} - -/** Calculate the key buffer size required to store the key material of a key - * associated with an opaque driver from input key data. - * - * \param[in] attributes The key attributes - * \param[in] data The input key data. - * \param[in] data_length The input data length. - * \param[out] key_buffer_size Minimum buffer size to contain the key material. - * - * \retval #PSA_SUCCESS \emptydescription - * \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - * \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - */ -static inline psa_status_t psa_driver_wrapper_get_key_buffer_size_from_key_data( - const psa_key_attributes_t *attributes, - const uint8_t *data, - size_t data_length, - size_t *key_buffer_size ) -{ - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - psa_key_type_t key_type = psa_get_key_type(attributes); - - *key_buffer_size = 0; - switch( location ) - { -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: - *key_buffer_size = mbedtls_test_opaque_size_function( key_type, - PSA_BYTES_TO_BITS( data_length ) ); - return( ( *key_buffer_size != 0 ) ? - PSA_SUCCESS : PSA_ERROR_NOT_SUPPORTED ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ - - default: - (void)key_type; - (void)data; - (void)data_length; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_generate_key( - const psa_key_attributes_t *attributes, - const psa_custom_key_parameters_t *custom, - const uint8_t *custom_data, size_t custom_data_length, - uint8_t *key_buffer, size_t key_buffer_size, size_t *key_buffer_length ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)); - -#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE) - int is_default_production = - psa_custom_key_parameters_are_default(custom, custom_data_length); - if( location != PSA_KEY_LOCATION_LOCAL_STORAGE && !is_default_production ) - { - /* We don't support passing custom production parameters - * to drivers yet. */ - return PSA_ERROR_NOT_SUPPORTED; - } -#else - int is_default_production = 1; - (void) is_default_production; -#endif - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) - /* Transparent drivers are limited to generating asymmetric keys. */ - /* We don't support passing custom production parameters - * to drivers yet. */ - if( PSA_KEY_TYPE_IS_ASYMMETRIC( psa_get_key_type(attributes) ) && - is_default_production ) - { - /* Cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_generate_key( - attributes, key_buffer, key_buffer_size, - key_buffer_length ); - /* Declared with fallback == true */ - if( status != PSA_ERROR_NOT_SUPPORTED ) - break; -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#if defined(MBEDTLS_PSA_P256M_DRIVER_ENABLED) - if( PSA_KEY_TYPE_IS_ECC( psa_get_key_type(attributes) ) && - psa_get_key_type(attributes) == PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1) && - psa_get_key_bits(attributes) == 256 ) - { - status = p256_transparent_generate_key( attributes, - key_buffer, - key_buffer_size, - key_buffer_length ); - if( status != PSA_ERROR_NOT_SUPPORTED ) - break; - } - -#endif /* MBEDTLS_PSA_P256M_DRIVER_ENABLED */ - } -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - /* Software fallback */ - status = psa_generate_key_internal( - attributes, custom, custom_data, custom_data_length, - key_buffer, key_buffer_size, key_buffer_length ); - break; - - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: - status = mbedtls_test_opaque_generate_key( - attributes, key_buffer, key_buffer_size, key_buffer_length ); - break; -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - default: - /* Key is declared with a lifetime not known to us */ - status = PSA_ERROR_INVALID_ARGUMENT; - break; - } - - return( status ); -} - -static inline psa_status_t psa_driver_wrapper_import_key( - const psa_key_attributes_t *attributes, - const uint8_t *data, - size_t data_length, - uint8_t *key_buffer, - size_t key_buffer_size, - size_t *key_buffer_length, - size_t *bits ) -{ - - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION( - psa_get_key_lifetime( attributes ) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) - -#if (defined(PSA_CRYPTO_DRIVER_TEST) ) - status = mbedtls_test_transparent_import_key - (attributes, - data, - data_length, - key_buffer, - key_buffer_size, - key_buffer_length, - bits - ); - - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif - -#if (defined(MBEDTLS_PSA_P256M_DRIVER_ENABLED) ) - status = p256_transparent_import_key - (attributes, - data, - data_length, - key_buffer, - key_buffer_size, - key_buffer_length, - bits - ); - - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif - - - - - -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - /* Fell through, meaning no accelerator supports this operation */ - return( psa_import_key_into_slot( attributes, - data, data_length, - key_buffer, key_buffer_size, - key_buffer_length, bits ) ); - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) - -#if (defined(PSA_CRYPTO_DRIVER_TEST) ) - case 0x7fffff: - return( mbedtls_test_opaque_import_key - (attributes, - data, - data_length, - key_buffer, - key_buffer_size, - key_buffer_length, - bits - )); -#endif - - -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - (void)status; - return( PSA_ERROR_INVALID_ARGUMENT ); - } - -} - -static inline psa_status_t psa_driver_wrapper_export_key( - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, size_t key_buffer_size, - uint8_t *data, size_t data_size, size_t *data_length ) - -{ - - psa_status_t status = PSA_ERROR_INVALID_ARGUMENT; - psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION( - psa_get_key_lifetime( attributes ) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - return( psa_export_key_internal( attributes, - key_buffer, - key_buffer_size, - data, - data_size, - data_length ) ); - - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) - -#if (defined(PSA_CRYPTO_DRIVER_TEST) ) - case 0x7fffff: - return( mbedtls_test_opaque_export_key - (attributes, - key_buffer, - key_buffer_size, - data, - data_size, - data_length - )); -#endif - - -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - /* Key is declared with a lifetime not known to us */ - return( status ); - } - -} - -static inline psa_status_t psa_driver_wrapper_copy_key( - psa_key_attributes_t *attributes, - const uint8_t *source_key, size_t source_key_length, - uint8_t *target_key_buffer, size_t target_key_buffer_size, - size_t *target_key_buffer_length ) -{ - - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) - -#if (defined(PSA_CRYPTO_DRIVER_TEST) ) - case 0x7fffff: - return( mbedtls_test_opaque_copy_key - (attributes, - source_key, - source_key_length, - target_key_buffer, - target_key_buffer_size, - target_key_buffer_length - )); -#endif - - -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - (void)source_key; - (void)source_key_length; - (void)target_key_buffer; - (void)target_key_buffer_size; - (void)target_key_buffer_length; - status = PSA_ERROR_INVALID_ARGUMENT; - } - return( status ); - -} - -/* - * Cipher functions - */ -static inline psa_status_t psa_driver_wrapper_cipher_encrypt( - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, - size_t key_buffer_size, - psa_algorithm_t alg, - const uint8_t *iv, - size_t iv_length, - const uint8_t *input, - size_t input_length, - uint8_t *output, - size_t output_size, - size_t *output_length ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_cipher_encrypt( attributes, - key_buffer, - key_buffer_size, - alg, - iv, - iv_length, - input, - input_length, - output, - output_size, - output_length ); - /* Declared with fallback == true */ - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#if defined(ESP_AES_DRIVER_ENABLED) - return esp_aes_cipher_encrypt(attributes, - key_buffer, - key_buffer_size, - alg, - iv, - iv_length, - input, - input_length, - output, - output_size, - output_length ); -#endif /* ESP_AES_DRIVER_ENABLED */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - -#if defined(MBEDTLS_PSA_BUILTIN_CIPHER) - return( mbedtls_psa_cipher_encrypt( attributes, - key_buffer, - key_buffer_size, - alg, - iv, - iv_length, - input, - input_length, - output, - output_size, - output_length ) ); -#else - return( PSA_ERROR_NOT_SUPPORTED ); -#endif /* MBEDTLS_PSA_BUILTIN_CIPHER */ - - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: - return( mbedtls_test_opaque_cipher_encrypt( attributes, - key_buffer, - key_buffer_size, - alg, - iv, - iv_length, - input, - input_length, - output, - output_size, - output_length ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - default: - /* Key is declared with a lifetime not known to us */ - (void)status; - (void)key_buffer; - (void)key_buffer_size; - (void)alg; - (void)iv; - (void)iv_length; - (void)input; - (void)input_length; - (void)output; - (void)output_size; - (void)output_length; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_cipher_decrypt( - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, - size_t key_buffer_size, - psa_algorithm_t alg, - const uint8_t *input, - size_t input_length, - uint8_t *output, - size_t output_size, - size_t *output_length ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(ESP_AES_DRIVER_ENABLED) - return esp_aes_cipher_decrypt(attributes, - key_buffer, - key_buffer_size, - alg, - input, - input_length, - output, - output_size, - output_length ); -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_cipher_decrypt( attributes, - key_buffer, - key_buffer_size, - alg, - input, - input_length, - output, - output_size, - output_length ); - /* Declared with fallback == true */ - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - -#if defined(MBEDTLS_PSA_BUILTIN_CIPHER) - return( mbedtls_psa_cipher_decrypt( attributes, - key_buffer, - key_buffer_size, - alg, - input, - input_length, - output, - output_size, - output_length ) ); -#else - return( PSA_ERROR_NOT_SUPPORTED ); -#endif /* MBEDTLS_PSA_BUILTIN_CIPHER */ - - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: - return( mbedtls_test_opaque_cipher_decrypt( attributes, - key_buffer, - key_buffer_size, - alg, - input, - input_length, - output, - output_size, - output_length ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - default: - /* Key is declared with a lifetime not known to us */ - (void)status; - (void)key_buffer; - (void)key_buffer_size; - (void)alg; - (void)input; - (void)input_length; - (void)output; - (void)output_size; - (void)output_length; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_cipher_encrypt_setup( - psa_cipher_operation_t *operation, - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, size_t key_buffer_size, - psa_algorithm_t alg ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(ESP_AES_DRIVER_ENABLED) - status = esp_aes_cipher_encrypt_setup( &operation->ctx.esp_aes_ctx, - attributes, - key_buffer, - key_buffer_size, - alg ); - if (status == PSA_SUCCESS) { - operation->id = ESP_AES_TRANSPARENT_DRIVER_ID; - } - return status; -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_cipher_encrypt_setup( - &operation->ctx.transparent_test_driver_ctx, - attributes, - key_buffer, - key_buffer_size, - alg ); - /* Declared with fallback == true */ - if( status == PSA_SUCCESS ) - operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID; - - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ -#if defined(MBEDTLS_PSA_BUILTIN_CIPHER) - /* Fell through, meaning no accelerator supports this operation */ - status = mbedtls_psa_cipher_encrypt_setup( &operation->ctx.mbedtls_ctx, - attributes, - key_buffer, - key_buffer_size, - alg ); - if( status == PSA_SUCCESS ) - operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; - - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* MBEDTLS_PSA_BUILTIN_CIPHER */ - return( PSA_ERROR_NOT_SUPPORTED ); - - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: - status = mbedtls_test_opaque_cipher_encrypt_setup( - &operation->ctx.opaque_test_driver_ctx, - attributes, - key_buffer, key_buffer_size, - alg ); - - if( status == PSA_SUCCESS ) - operation->id = MBEDTLS_TEST_OPAQUE_DRIVER_ID; - - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - /* Key is declared with a lifetime not known to us */ - (void)status; - (void)operation; - (void)key_buffer; - (void)key_buffer_size; - (void)alg; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_cipher_decrypt_setup( - psa_cipher_operation_t *operation, - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, size_t key_buffer_size, - psa_algorithm_t alg ) -{ - psa_status_t status = PSA_ERROR_INVALID_ARGUMENT; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(ESP_AES_DRIVER_ENABLED) - status = esp_aes_cipher_decrypt_setup( &operation->ctx.esp_aes_ctx, - attributes, - key_buffer, - key_buffer_size, - alg ); - if (status == PSA_SUCCESS) { - operation->id = ESP_AES_TRANSPARENT_DRIVER_ID; - } - return status; -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_cipher_decrypt_setup( - &operation->ctx.transparent_test_driver_ctx, - attributes, - key_buffer, - key_buffer_size, - alg ); - /* Declared with fallback == true */ - if( status == PSA_SUCCESS ) - operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID; - - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ -#if defined(MBEDTLS_PSA_BUILTIN_CIPHER) - /* Fell through, meaning no accelerator supports this operation */ - status = mbedtls_psa_cipher_decrypt_setup( &operation->ctx.mbedtls_ctx, - attributes, - key_buffer, - key_buffer_size, - alg ); - if( status == PSA_SUCCESS ) - operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; - - return( status ); -#else /* MBEDTLS_PSA_BUILTIN_CIPHER */ - return( PSA_ERROR_NOT_SUPPORTED ); -#endif /* MBEDTLS_PSA_BUILTIN_CIPHER */ - - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: - status = mbedtls_test_opaque_cipher_decrypt_setup( - &operation->ctx.opaque_test_driver_ctx, - attributes, - key_buffer, key_buffer_size, - alg ); - - if( status == PSA_SUCCESS ) - operation->id = MBEDTLS_TEST_OPAQUE_DRIVER_ID; - - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - /* Key is declared with a lifetime not known to us */ - (void)status; - (void)operation; - (void)key_buffer; - (void)key_buffer_size; - (void)alg; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_cipher_set_iv( - psa_cipher_operation_t *operation, - const uint8_t *iv, - size_t iv_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_CIPHER) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_cipher_set_iv( &operation->ctx.mbedtls_ctx, - iv, - iv_length ) ); -#endif /* MBEDTLS_PSA_BUILTIN_CIPHER */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(ESP_AES_DRIVER_ENABLED) - case ESP_AES_TRANSPARENT_DRIVER_ID: - return( esp_aes_cipher_set_iv( - &operation->ctx.esp_aes_ctx, - iv, iv_length ) ); -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_cipher_set_iv( - &operation->ctx.transparent_test_driver_ctx, - iv, iv_length ) ); - - case MBEDTLS_TEST_OPAQUE_DRIVER_ID: - return( mbedtls_test_opaque_cipher_set_iv( - &operation->ctx.opaque_test_driver_ctx, - iv, iv_length ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - } - - (void)iv; - (void)iv_length; - - return( PSA_ERROR_INVALID_ARGUMENT ); -} - -static inline psa_status_t psa_driver_wrapper_cipher_update( - psa_cipher_operation_t *operation, - const uint8_t *input, - size_t input_length, - uint8_t *output, - size_t output_size, - size_t *output_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_CIPHER) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_cipher_update( &operation->ctx.mbedtls_ctx, - input, - input_length, - output, - output_size, - output_length ) ); -#endif /* MBEDTLS_PSA_BUILTIN_CIPHER */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(ESP_AES_DRIVER_ENABLED) - case ESP_AES_TRANSPARENT_DRIVER_ID: - return( esp_aes_cipher_update( &operation->ctx.esp_aes_ctx, - input, - input_length, - output, - output_size, - output_length ) ); -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_cipher_update( - &operation->ctx.transparent_test_driver_ctx, - input, input_length, - output, output_size, output_length ) ); - - case MBEDTLS_TEST_OPAQUE_DRIVER_ID: - return( mbedtls_test_opaque_cipher_update( - &operation->ctx.opaque_test_driver_ctx, - input, input_length, - output, output_size, output_length ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - } - - (void)input; - (void)input_length; - (void)output; - (void)output_size; - (void)output_length; - - return( PSA_ERROR_INVALID_ARGUMENT ); -} - -static inline psa_status_t psa_driver_wrapper_cipher_finish( - psa_cipher_operation_t *operation, - uint8_t *output, - size_t output_size, - size_t *output_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_CIPHER) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_cipher_finish( &operation->ctx.mbedtls_ctx, - output, - output_size, - output_length ) ); -#endif /* MBEDTLS_PSA_BUILTIN_CIPHER */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(ESP_AES_DRIVER_ENABLED) - case ESP_AES_TRANSPARENT_DRIVER_ID: - return( esp_aes_cipher_finish( &operation->ctx.esp_aes_ctx, - output, - output_size, - output_length ) ); -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_cipher_finish( - &operation->ctx.transparent_test_driver_ctx, - output, output_size, output_length ) ); - - case MBEDTLS_TEST_OPAQUE_DRIVER_ID: - return( mbedtls_test_opaque_cipher_finish( - &operation->ctx.opaque_test_driver_ctx, - output, output_size, output_length ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - } - - (void)output; - (void)output_size; - (void)output_length; - - return( PSA_ERROR_INVALID_ARGUMENT ); -} - -static inline psa_status_t psa_driver_wrapper_cipher_abort( - psa_cipher_operation_t *operation ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_CIPHER) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_cipher_abort( &operation->ctx.mbedtls_ctx ) ); -#endif /* MBEDTLS_PSA_BUILTIN_CIPHER */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(ESP_AES_DRIVER_ENABLED) - case ESP_AES_TRANSPARENT_DRIVER_ID: - return( esp_aes_cipher_abort( &operation->ctx.esp_aes_ctx ) ); -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - status = mbedtls_test_transparent_cipher_abort( - &operation->ctx.transparent_test_driver_ctx ); - mbedtls_platform_zeroize( - &operation->ctx.transparent_test_driver_ctx, - sizeof( operation->ctx.transparent_test_driver_ctx ) ); - return( status ); - - case MBEDTLS_TEST_OPAQUE_DRIVER_ID: - status = mbedtls_test_opaque_cipher_abort( - &operation->ctx.opaque_test_driver_ctx ); - mbedtls_platform_zeroize( - &operation->ctx.opaque_test_driver_ctx, - sizeof( operation->ctx.opaque_test_driver_ctx ) ); - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - } - - (void)status; - return( PSA_ERROR_INVALID_ARGUMENT ); -} - -/* - * Hashing functions - */ -static inline psa_status_t psa_driver_wrapper_hash_compute( - psa_algorithm_t alg, - const uint8_t *input, - size_t input_length, - uint8_t *hash, - size_t hash_size, - size_t *hash_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - /* Try accelerators first */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_hash_compute( - alg, input, input_length, hash, hash_size, hash_length ); - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ - -#if defined(ESP_SHA_DRIVER_ENABLED) - status = esp_sha_hash_compute(alg, input, input_length, - hash, hash_size, hash_length ); - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* ESP_SHA_DRIVER_ENABLED */ - -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - /* If software fallback is compiled in, try fallback */ -#if defined(MBEDTLS_PSA_BUILTIN_HASH) - status = mbedtls_psa_hash_compute( alg, input, input_length, - hash, hash_size, hash_length ); - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif - (void) status; - (void) alg; - (void) input; - (void) input_length; - (void) hash; - (void) hash_size; - (void) hash_length; - - return( PSA_ERROR_NOT_SUPPORTED ); -} - -static inline psa_status_t psa_driver_wrapper_hash_setup( - psa_hash_operation_t *operation, - psa_algorithm_t alg ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - /* Try setup on accelerators first */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_hash_setup( - &operation->ctx.test_driver_ctx, alg ); - if( status == PSA_SUCCESS ) - operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID; - - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif - -#if defined(ESP_SHA_DRIVER_ENABLED) - status = esp_sha_hash_setup(&operation->ctx.esp_ctx, alg); - if( status == PSA_SUCCESS ) - operation->id = ESP_SHA_TRANSPARENT_DRIVER_ID; - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* ESP_SHA_DRIVER_ENABLED */ - -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - /* If software fallback is compiled in, try fallback */ -#if defined(MBEDTLS_PSA_BUILTIN_HASH) - status = mbedtls_psa_hash_setup( &operation->ctx.mbedtls_ctx, alg ); - if( status == PSA_SUCCESS ) - operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; - - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif - /* Nothing left to try if we fall through here */ - (void) status; - (void) operation; - (void) alg; - return( PSA_ERROR_NOT_SUPPORTED ); -} - -static inline psa_status_t psa_driver_wrapper_hash_clone( - const psa_hash_operation_t *source_operation, - psa_hash_operation_t *target_operation ) -{ - switch( source_operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_HASH) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - target_operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; - return( mbedtls_psa_hash_clone( &source_operation->ctx.mbedtls_ctx, - &target_operation->ctx.mbedtls_ctx ) ); -#endif -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(ESP_SHA_DRIVER_ENABLED) - case ESP_SHA_TRANSPARENT_DRIVER_ID: - target_operation->id = ESP_SHA_TRANSPARENT_DRIVER_ID; - return( esp_sha_hash_clone( - &source_operation->ctx.esp_ctx, - &target_operation->ctx.esp_ctx ) ); -#endif /* ESP_SHA_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - target_operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID; - return( mbedtls_test_transparent_hash_clone( - &source_operation->ctx.test_driver_ctx, - &target_operation->ctx.test_driver_ctx ) ); -#endif -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - (void) target_operation; - return( PSA_ERROR_BAD_STATE ); - } -} - -static inline psa_status_t psa_driver_wrapper_hash_update( - psa_hash_operation_t *operation, - const uint8_t *input, - size_t input_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_HASH) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_hash_update( &operation->ctx.mbedtls_ctx, - input, input_length ) ); -#endif -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_hash_update( - &operation->ctx.test_driver_ctx, - input, input_length ) ); -#endif -#if defined(ESP_SHA_DRIVER_ENABLED) - case ESP_SHA_TRANSPARENT_DRIVER_ID: - return( esp_sha_hash_update( - &operation->ctx.esp_ctx, - input, input_length ) ); -#endif /* ESP_SHA_DRIVER_ENABLED */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - (void) input; - (void) input_length; - return( PSA_ERROR_BAD_STATE ); - } -} - -static inline psa_status_t psa_driver_wrapper_hash_finish( - psa_hash_operation_t *operation, - uint8_t *hash, - size_t hash_size, - size_t *hash_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_HASH) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_hash_finish( &operation->ctx.mbedtls_ctx, - hash, hash_size, hash_length ) ); -#endif -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_hash_finish( - &operation->ctx.test_driver_ctx, - hash, hash_size, hash_length ) ); -#endif -#if defined(ESP_SHA_DRIVER_ENABLED) - case ESP_SHA_TRANSPARENT_DRIVER_ID: - return( esp_sha_hash_finish( - &operation->ctx.esp_ctx, - hash, hash_size, hash_length ) ); -#endif /* ESP_SHA_DRIVER_ENABLED */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - (void) hash; - (void) hash_size; - (void) hash_length; - return( PSA_ERROR_BAD_STATE ); - } -} - -static inline psa_status_t psa_driver_wrapper_hash_abort( - psa_hash_operation_t *operation ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_HASH) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_hash_abort( &operation->ctx.mbedtls_ctx ) ); -#endif -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_hash_abort( - &operation->ctx.test_driver_ctx ) ); -#endif -#if defined(ESP_SHA_DRIVER_ENABLED) - case ESP_SHA_TRANSPARENT_DRIVER_ID: - return( esp_sha_hash_abort( - &operation->ctx.esp_ctx ) ); -#endif /* ESP_SHA_DRIVER_ENABLED */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - return( PSA_ERROR_BAD_STATE ); - } -} - -static inline psa_status_t psa_driver_wrapper_aead_encrypt( - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, size_t key_buffer_size, - psa_algorithm_t alg, - const uint8_t *nonce, size_t nonce_length, - const uint8_t *additional_data, size_t additional_data_length, - const uint8_t *plaintext, size_t plaintext_length, - uint8_t *ciphertext, size_t ciphertext_size, size_t *ciphertext_length ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if (defined(ESP_AES_DRIVER_ENABLED) && (MBEDTLS_HARDWARE_GCM)) - status = esp_crypto_aes_gcm_encrypt( - attributes, key_buffer, key_buffer_size, - alg, - nonce, nonce_length, - additional_data, additional_data_length, - plaintext, plaintext_length, - ciphertext, ciphertext_size, ciphertext_length ); -#ifdef MBEDTLS_GCM_NON_AES_CIPHER_SOFT_FALLBACK - if( status != PSA_ERROR_NOT_SUPPORTED ) -#endif /* MBEDTLS_GCM_NON_AES_CIPHER_SOFT_FALLBACK */ - { - return( status ); - } -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_aead_encrypt( - attributes, key_buffer, key_buffer_size, - alg, - nonce, nonce_length, - additional_data, additional_data_length, - plaintext, plaintext_length, - ciphertext, ciphertext_size, ciphertext_length ); - /* Declared with fallback == true */ - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - /* Fell through, meaning no accelerator supports this operation */ - return( mbedtls_psa_aead_encrypt( - attributes, key_buffer, key_buffer_size, - alg, - nonce, nonce_length, - additional_data, additional_data_length, - plaintext, plaintext_length, - ciphertext, ciphertext_size, ciphertext_length ) ); - - /* Add cases for opaque driver here */ - - default: - /* Key is declared with a lifetime not known to us */ - (void)status; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_aead_decrypt( - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, size_t key_buffer_size, - psa_algorithm_t alg, - const uint8_t *nonce, size_t nonce_length, - const uint8_t *additional_data, size_t additional_data_length, - const uint8_t *ciphertext, size_t ciphertext_length, - uint8_t *plaintext, size_t plaintext_size, size_t *plaintext_length ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if (defined(ESP_AES_DRIVER_ENABLED) && (MBEDTLS_HARDWARE_GCM)) - status = esp_crypto_aes_gcm_decrypt( - attributes, key_buffer, key_buffer_size, - alg, - nonce, nonce_length, - additional_data, additional_data_length, - ciphertext, ciphertext_length, - plaintext, plaintext_size, plaintext_length ); -#ifdef MBEDTLS_GCM_NON_AES_CIPHER_SOFT_FALLBACK - if( status != PSA_ERROR_NOT_SUPPORTED ) -#endif /* MBEDTLS_GCM_NON_AES_CIPHER_SOFT_FALLBACK */ - { - return( status ); - } -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_aead_decrypt( - attributes, key_buffer, key_buffer_size, - alg, - nonce, nonce_length, - additional_data, additional_data_length, - ciphertext, ciphertext_length, - plaintext, plaintext_size, plaintext_length ); - /* Declared with fallback == true */ - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - /* Fell through, meaning no accelerator supports this operation */ - return( mbedtls_psa_aead_decrypt( - attributes, key_buffer, key_buffer_size, - alg, - nonce, nonce_length, - additional_data, additional_data_length, - ciphertext, ciphertext_length, - plaintext, plaintext_size, plaintext_length ) ); - - /* Add cases for opaque driver here */ - - default: - /* Key is declared with a lifetime not known to us */ - (void)status; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_aead_encrypt_setup( - psa_aead_operation_t *operation, - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, size_t key_buffer_size, - psa_algorithm_t alg ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) - -#if (defined(ESP_AES_DRIVER_ENABLED) && (MBEDTLS_HARDWARE_GCM)) - status = esp_crypto_aes_gcm_encrypt_setup( - &operation->ctx.esp_aes_gcm_ctx, - attributes, key_buffer, key_buffer_size, - alg); - - if (status == PSA_SUCCESS) { - operation->id = ESP_AES_TRANSPARENT_DRIVER_ID; - } - -#ifdef MBEDTLS_GCM_NON_AES_CIPHER_SOFT_FALLBACK - if( status != PSA_ERROR_NOT_SUPPORTED ) -#endif /* MBEDTLS_GCM_NON_AES_CIPHER_SOFT_FALLBACK */ - { - return( status ); - } -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID; - status = mbedtls_test_transparent_aead_encrypt_setup( - &operation->ctx.transparent_test_driver_ctx, - attributes, key_buffer, key_buffer_size, - alg ); - - /* Declared with fallback == true */ - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - /* Fell through, meaning no accelerator supports this operation */ - operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; - status = mbedtls_psa_aead_encrypt_setup( - &operation->ctx.mbedtls_ctx, attributes, - key_buffer, key_buffer_size, - alg ); - - return( status ); - - /* Add cases for opaque driver here */ - - default: - /* Key is declared with a lifetime not known to us */ - (void)status; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_aead_decrypt_setup( - psa_aead_operation_t *operation, - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, size_t key_buffer_size, - psa_algorithm_t alg ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if (defined(ESP_AES_DRIVER_ENABLED) && (MBEDTLS_HARDWARE_GCM)) - status = esp_crypto_aes_gcm_decrypt_setup( - &operation->ctx.esp_aes_gcm_ctx, - attributes, key_buffer, key_buffer_size, - alg); - - if (status == PSA_SUCCESS) { - operation->id = ESP_AES_TRANSPARENT_DRIVER_ID; - } - -#ifdef MBEDTLS_GCM_NON_AES_CIPHER_SOFT_FALLBACK - if( status != PSA_ERROR_NOT_SUPPORTED ) -#endif /* MBEDTLS_GCM_NON_AES_CIPHER_SOFT_FALLBACK */ - { - return( status ); - } -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID; - status = mbedtls_test_transparent_aead_decrypt_setup( - &operation->ctx.transparent_test_driver_ctx, - attributes, - key_buffer, key_buffer_size, - alg ); - - /* Declared with fallback == true */ - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - /* Fell through, meaning no accelerator supports this operation */ - operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; - status = mbedtls_psa_aead_decrypt_setup( - &operation->ctx.mbedtls_ctx, - attributes, - key_buffer, key_buffer_size, - alg ); - - return( status ); - - /* Add cases for opaque driver here */ - - default: - /* Key is declared with a lifetime not known to us */ - (void)status; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_aead_set_nonce( - psa_aead_operation_t *operation, - const uint8_t *nonce, - size_t nonce_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_AEAD) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_aead_set_nonce( &operation->ctx.mbedtls_ctx, - nonce, - nonce_length ) ); - -#endif /* MBEDTLS_PSA_BUILTIN_AEAD */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) - -#if (defined(ESP_AES_DRIVER_ENABLED) && (MBEDTLS_HARDWARE_GCM)) - case ESP_AES_TRANSPARENT_DRIVER_ID: - return esp_crypto_aes_gcm_set_nonce( - &operation->ctx.esp_aes_gcm_ctx, - nonce, - nonce_length); -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_aead_set_nonce( - &operation->ctx.transparent_test_driver_ctx, - nonce, nonce_length ) ); - - /* Add cases for opaque driver here */ - -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - } - - (void)nonce; - (void)nonce_length; - - return( PSA_ERROR_INVALID_ARGUMENT ); -} - -static inline psa_status_t psa_driver_wrapper_aead_set_lengths( - psa_aead_operation_t *operation, - size_t ad_length, - size_t plaintext_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_AEAD) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_aead_set_lengths( &operation->ctx.mbedtls_ctx, - ad_length, - plaintext_length ) ); - -#endif /* MBEDTLS_PSA_BUILTIN_AEAD */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(ESP_AES_DRIVER_ENABLED) - case ESP_AES_TRANSPARENT_DRIVER_ID: - return PSA_SUCCESS; -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_aead_set_lengths( - &operation->ctx.transparent_test_driver_ctx, - ad_length, plaintext_length ) ); - - /* Add cases for opaque driver here */ - -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - } - - (void)ad_length; - (void)plaintext_length; - - return( PSA_ERROR_INVALID_ARGUMENT ); -} - -static inline psa_status_t psa_driver_wrapper_aead_update_ad( - psa_aead_operation_t *operation, - const uint8_t *input, - size_t input_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_AEAD) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_aead_update_ad( &operation->ctx.mbedtls_ctx, - input, - input_length ) ); - -#endif /* MBEDTLS_PSA_BUILTIN_AEAD */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if (defined(ESP_AES_DRIVER_ENABLED) && (MBEDTLS_HARDWARE_GCM)) - case ESP_AES_TRANSPARENT_DRIVER_ID: - return esp_crypto_aes_gcm_update_ad( - &operation->ctx.esp_aes_gcm_ctx, - input, - input_length); -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_aead_update_ad( - &operation->ctx.transparent_test_driver_ctx, - input, input_length ) ); - - /* Add cases for opaque driver here */ - -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - } - - (void)input; - (void)input_length; - - return( PSA_ERROR_INVALID_ARGUMENT ); -} - -static inline psa_status_t psa_driver_wrapper_aead_update( - psa_aead_operation_t *operation, - const uint8_t *input, - size_t input_length, - uint8_t *output, - size_t output_size, - size_t *output_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_AEAD) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_aead_update( &operation->ctx.mbedtls_ctx, - input, input_length, - output, output_size, - output_length ) ); - -#endif /* MBEDTLS_PSA_BUILTIN_AEAD */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if (defined(ESP_AES_DRIVER_ENABLED) && (MBEDTLS_HARDWARE_GCM)) - case ESP_AES_TRANSPARENT_DRIVER_ID: - return esp_crypto_aes_gcm_update( - &operation->ctx.esp_aes_gcm_ctx, - input, input_length, output, output_size, output_length); -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_aead_update( - &operation->ctx.transparent_test_driver_ctx, - input, input_length, output, output_size, - output_length ) ); - - /* Add cases for opaque driver here */ - -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - } - - (void)input; - (void)input_length; - (void)output; - (void)output_size; - (void)output_length; - - return( PSA_ERROR_INVALID_ARGUMENT ); -} - -static inline psa_status_t psa_driver_wrapper_aead_finish( - psa_aead_operation_t *operation, - uint8_t *ciphertext, - size_t ciphertext_size, - size_t *ciphertext_length, - uint8_t *tag, - size_t tag_size, - size_t *tag_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_AEAD) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_aead_finish( &operation->ctx.mbedtls_ctx, - ciphertext, - ciphertext_size, - ciphertext_length, tag, - tag_size, tag_length ) ); - -#endif /* MBEDTLS_PSA_BUILTIN_AEAD */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) - -#if (defined(ESP_AES_DRIVER_ENABLED) && (MBEDTLS_HARDWARE_GCM)) - case ESP_AES_TRANSPARENT_DRIVER_ID: - return esp_crypto_aes_gcm_finish( - &operation->ctx.esp_aes_gcm_ctx, - ciphertext, ciphertext_size, ciphertext_length, tag, tag_size, tag_length); -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_aead_finish( - &operation->ctx.transparent_test_driver_ctx, - ciphertext, ciphertext_size, - ciphertext_length, tag, tag_size, tag_length ) ); - - /* Add cases for opaque driver here */ - -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - } - - (void)ciphertext; - (void)ciphertext_size; - (void)ciphertext_length; - (void)tag; - (void)tag_size; - (void)tag_length; - - return( PSA_ERROR_INVALID_ARGUMENT ); -} - -static inline psa_status_t psa_driver_wrapper_aead_verify( - psa_aead_operation_t *operation, - uint8_t *plaintext, - size_t plaintext_size, - size_t *plaintext_length, - const uint8_t *tag, - size_t tag_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_AEAD) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - { - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - uint8_t check_tag[PSA_AEAD_TAG_MAX_SIZE]; - size_t check_tag_length; - - status = mbedtls_psa_aead_finish( &operation->ctx.mbedtls_ctx, - plaintext, - plaintext_size, - plaintext_length, - check_tag, - sizeof( check_tag ), - &check_tag_length ); - - if( status == PSA_SUCCESS ) - { - if( tag_length != check_tag_length || - mbedtls_ct_memcmp( tag, check_tag, tag_length ) - != 0 ) - status = PSA_ERROR_INVALID_SIGNATURE; - } - - mbedtls_platform_zeroize( check_tag, sizeof( check_tag ) ); - - return( status ); - } - -#endif /* MBEDTLS_PSA_BUILTIN_AEAD */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if (defined(ESP_AES_DRIVER_ENABLED) && (MBEDTLS_HARDWARE_GCM)) - case ESP_AES_TRANSPARENT_DRIVER_ID: - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - uint8_t check_tag[PSA_AEAD_TAG_MAX_SIZE]; - size_t check_tag_length; - - status = esp_crypto_aes_gcm_finish(&operation->ctx.esp_aes_gcm_ctx, - plaintext, plaintext_size, plaintext_length, check_tag, sizeof(check_tag), &check_tag_length); - - if(status == PSA_SUCCESS) { - if(tag_length != check_tag_length || mbedtls_ct_memcmp(tag, check_tag, tag_length) != 0) { - status = PSA_ERROR_INVALID_SIGNATURE; - } - } - - mbedtls_platform_zeroize(check_tag, sizeof(check_tag)); - - return(status); -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_aead_verify( - &operation->ctx.transparent_test_driver_ctx, - plaintext, plaintext_size, - plaintext_length, tag, tag_length ) ); - - /* Add cases for opaque driver here */ - -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - } - - (void)plaintext; - (void)plaintext_size; - (void)plaintext_length; - (void)tag; - (void)tag_length; - - return( PSA_ERROR_INVALID_ARGUMENT ); -} - -static inline psa_status_t psa_driver_wrapper_aead_abort( - psa_aead_operation_t *operation ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_AEAD) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_aead_abort( &operation->ctx.mbedtls_ctx ) ); - -#endif /* MBEDTLS_PSA_BUILTIN_AEAD */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) - -#if (defined(ESP_AES_DRIVER_ENABLED) && (MBEDTLS_HARDWARE_GCM)) - case ESP_AES_TRANSPARENT_DRIVER_ID: - return (esp_crypto_aes_gcm_abort(&operation->ctx.esp_aes_gcm_ctx)); -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_aead_abort( - &operation->ctx.transparent_test_driver_ctx ) ); - - /* Add cases for opaque driver here */ - -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - } - - return( PSA_ERROR_INVALID_ARGUMENT ); -} - -/* - * MAC functions - */ -static inline psa_status_t psa_driver_wrapper_mac_compute( - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, - size_t key_buffer_size, - psa_algorithm_t alg, - const uint8_t *input, - size_t input_length, - uint8_t *mac, - size_t mac_size, - size_t *mac_length ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(ESP_AES_DRIVER_ENABLED) && defined(ESP_AES_SHA_DRIVER_ENABLED) - return (esp_cmac_mac_compute(attributes, key_buffer, key_buffer_size, alg, - input, input_length, - mac, mac_size, mac_length )); -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_mac_compute( - attributes, key_buffer, key_buffer_size, alg, - input, input_length, - mac, mac_size, mac_length ); - /* Declared with fallback == true */ - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ -#if defined(MBEDTLS_PSA_BUILTIN_MAC) - /* Fell through, meaning no accelerator supports this operation */ - status = mbedtls_psa_mac_compute( - attributes, key_buffer, key_buffer_size, alg, - input, input_length, - mac, mac_size, mac_length ); - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* MBEDTLS_PSA_BUILTIN_MAC */ - return( PSA_ERROR_NOT_SUPPORTED ); - - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: - status = mbedtls_test_opaque_mac_compute( - attributes, key_buffer, key_buffer_size, alg, - input, input_length, - mac, mac_size, mac_length ); - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - /* Key is declared with a lifetime not known to us */ - (void) key_buffer; - (void) key_buffer_size; - (void) alg; - (void) input; - (void) input_length; - (void) mac; - (void) mac_size; - (void) mac_length; - (void) status; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_mac_sign_setup( - psa_mac_operation_t *operation, - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, - size_t key_buffer_size, - psa_algorithm_t alg ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_mac_sign_setup( - &operation->ctx.transparent_test_driver_ctx, - attributes, - key_buffer, key_buffer_size, - alg ); - /* Declared with fallback == true */ - if( status == PSA_SUCCESS ) - operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID; - - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#if defined(ESP_AES_DRIVER_ENABLED) && defined(ESP_AES_SHA_DRIVER_ENABLED) - status = (esp_cmac_mac_setup( &operation->ctx.esp_cmac_ctx, - attributes, - key_buffer, key_buffer_size, - alg )); - if( status == PSA_SUCCESS ) - operation->id = ESP_CMAC_TRANSPARENT_DRIVER_ID; - return status; -#endif /* ESP_AES_DRIVER_ENABLED && defined(ESP_AES_SHA_DRIVER_ENABLED) */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ -#if defined(MBEDTLS_PSA_BUILTIN_MAC) - /* Fell through, meaning no accelerator supports this operation */ - status = mbedtls_psa_mac_sign_setup( &operation->ctx.mbedtls_ctx, - attributes, - key_buffer, key_buffer_size, - alg ); - if( status == PSA_SUCCESS ) - operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; - - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* MBEDTLS_PSA_BUILTIN_MAC */ - return( PSA_ERROR_NOT_SUPPORTED ); - - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: - status = mbedtls_test_opaque_mac_sign_setup( - &operation->ctx.opaque_test_driver_ctx, - attributes, - key_buffer, key_buffer_size, - alg ); - - if( status == PSA_SUCCESS ) - operation->id = MBEDTLS_TEST_OPAQUE_DRIVER_ID; - - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - /* Key is declared with a lifetime not known to us */ - (void) status; - (void) operation; - (void) key_buffer; - (void) key_buffer_size; - (void) alg; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_mac_verify_setup( - psa_mac_operation_t *operation, - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, - size_t key_buffer_size, - psa_algorithm_t alg ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_mac_verify_setup( - &operation->ctx.transparent_test_driver_ctx, - attributes, - key_buffer, key_buffer_size, - alg ); - /* Declared with fallback == true */ - if( status == PSA_SUCCESS ) - operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID; - - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#if defined(ESP_AES_DRIVER_ENABLED) && defined(ESP_AES_SHA_DRIVER_ENABLED) - status = (esp_cmac_mac_setup( &operation->ctx.esp_cmac_ctx, - attributes, - key_buffer, key_buffer_size, - alg )); - if( status == PSA_SUCCESS ) - operation->id = ESP_CMAC_TRANSPARENT_DRIVER_ID; - return status; -#endif /* ESP_AES_DRIVER_ENABLED */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ -#if defined(MBEDTLS_PSA_BUILTIN_MAC) - /* Fell through, meaning no accelerator supports this operation */ - status = mbedtls_psa_mac_verify_setup( &operation->ctx.mbedtls_ctx, - attributes, - key_buffer, key_buffer_size, - alg ); - if( status == PSA_SUCCESS ) - operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; - - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* MBEDTLS_PSA_BUILTIN_MAC */ - return( PSA_ERROR_NOT_SUPPORTED ); - - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: - status = mbedtls_test_opaque_mac_verify_setup( - &operation->ctx.opaque_test_driver_ctx, - attributes, - key_buffer, key_buffer_size, - alg ); - - if( status == PSA_SUCCESS ) - operation->id = MBEDTLS_TEST_OPAQUE_DRIVER_ID; - - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - /* Key is declared with a lifetime not known to us */ - (void) status; - (void) operation; - (void) key_buffer; - (void) key_buffer_size; - (void) alg; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_mac_update( - psa_mac_operation_t *operation, - const uint8_t *input, - size_t input_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_MAC) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_mac_update( &operation->ctx.mbedtls_ctx, - input, input_length ) ); -#endif /* MBEDTLS_PSA_BUILTIN_MAC */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(ESP_AES_DRIVER_ENABLED) && defined(ESP_AES_SHA_DRIVER_ENABLED) - case ESP_CMAC_TRANSPARENT_DRIVER_ID: - return (esp_cmac_mac_update( &operation->ctx.esp_cmac_ctx, - input, input_length )); -#endif /* ESP_AES_DRIVER_ENABLED && defined(ESP_AES_SHA_DRIVER_ENABLED) */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_mac_update( - &operation->ctx.transparent_test_driver_ctx, - input, input_length ) ); - - case MBEDTLS_TEST_OPAQUE_DRIVER_ID: - return( mbedtls_test_opaque_mac_update( - &operation->ctx.opaque_test_driver_ctx, - input, input_length ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - (void) input; - (void) input_length; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_mac_sign_finish( - psa_mac_operation_t *operation, - uint8_t *mac, - size_t mac_size, - size_t *mac_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_MAC) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_mac_sign_finish( &operation->ctx.mbedtls_ctx, - mac, mac_size, mac_length ) ); -#endif /* MBEDTLS_PSA_BUILTIN_MAC */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(ESP_AES_DRIVER_ENABLED) && defined(ESP_AES_SHA_DRIVER_ENABLED) - case ESP_CMAC_TRANSPARENT_DRIVER_ID: - return (esp_cmac_mac_finish( &operation->ctx.esp_cmac_ctx, - mac, mac_size, mac_length )); -#endif /* ESP_AES_DRIVER_ENABLED && defined(ESP_AES_SHA_DRIVER_ENABLED) */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_mac_sign_finish( - &operation->ctx.transparent_test_driver_ctx, - mac, mac_size, mac_length ) ); - - case MBEDTLS_TEST_OPAQUE_DRIVER_ID: - return( mbedtls_test_opaque_mac_sign_finish( - &operation->ctx.opaque_test_driver_ctx, - mac, mac_size, mac_length ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - (void) mac; - (void) mac_size; - (void) mac_length; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_mac_verify_finish( - psa_mac_operation_t *operation, - const uint8_t *mac, - size_t mac_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_MAC) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_mac_verify_finish( &operation->ctx.mbedtls_ctx, - mac, mac_length ) ); -#endif /* MBEDTLS_PSA_BUILTIN_MAC */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(ESP_AES_DRIVER_ENABLED) && defined(ESP_AES_SHA_DRIVER_ENABLED) - case ESP_CMAC_TRANSPARENT_DRIVER_ID: - return (esp_cmac_mac_verify_finish( &operation->ctx.esp_cmac_ctx, - mac, mac_length )); -#endif /* ESP_AES_DRIVER_ENABLED && defined(ESP_AES_SHA_DRIVER_ENABLED) */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_mac_verify_finish( - &operation->ctx.transparent_test_driver_ctx, - mac, mac_length ) ); - - case MBEDTLS_TEST_OPAQUE_DRIVER_ID: - return( mbedtls_test_opaque_mac_verify_finish( - &operation->ctx.opaque_test_driver_ctx, - mac, mac_length ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - (void) mac; - (void) mac_length; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_mac_abort( - psa_mac_operation_t *operation ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_MAC) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_mac_abort( &operation->ctx.mbedtls_ctx ) ); -#endif /* MBEDTLS_PSA_BUILTIN_MAC */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(ESP_AES_DRIVER_ENABLED) && defined(ESP_AES_SHA_DRIVER_ENABLED) - case ESP_CMAC_TRANSPARENT_DRIVER_ID: - return (esp_cmac_mac_abort( &operation->ctx.esp_cmac_ctx )); -#endif /* ESP_AES_DRIVER_ENABLED && defined(ESP_AES_SHA_DRIVER_ENABLED) */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_mac_abort( - &operation->ctx.transparent_test_driver_ctx ) ); - case MBEDTLS_TEST_OPAQUE_DRIVER_ID: - return( mbedtls_test_opaque_mac_abort( - &operation->ctx.opaque_test_driver_ctx ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -/* - * Asymmetric cryptography - */ -static inline psa_status_t psa_driver_wrapper_asymmetric_encrypt( - const psa_key_attributes_t *attributes, const uint8_t *key_buffer, - size_t key_buffer_size, psa_algorithm_t alg, const uint8_t *input, - size_t input_length, const uint8_t *salt, size_t salt_length, - uint8_t *output, size_t output_size, size_t *output_length ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_asymmetric_encrypt( attributes, - key_buffer, key_buffer_size, alg, input, input_length, - salt, salt_length, output, output_size, - output_length ); - /* Declared with fallback == true */ - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - return( mbedtls_psa_asymmetric_encrypt( attributes, - key_buffer, key_buffer_size, alg, input, input_length, - salt, salt_length, output, output_size, output_length ) - ); - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: - return( mbedtls_test_opaque_asymmetric_encrypt( attributes, - key_buffer, key_buffer_size, alg, input, input_length, - salt, salt_length, output, output_size, output_length ) - ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - default: - /* Key is declared with a lifetime not known to us */ - (void)status; - (void)key_buffer; - (void)key_buffer_size; - (void)alg; - (void)input; - (void)input_length; - (void)salt; - (void)salt_length; - (void)output; - (void)output_size; - (void)output_length; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_asymmetric_decrypt( - const psa_key_attributes_t *attributes, const uint8_t *key_buffer, - size_t key_buffer_size, psa_algorithm_t alg, const uint8_t *input, - size_t input_length, const uint8_t *salt, size_t salt_length, - uint8_t *output, size_t output_size, size_t *output_length ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_asymmetric_decrypt( attributes, - key_buffer, key_buffer_size, alg, input, input_length, - salt, salt_length, output, output_size, - output_length ); - /* Declared with fallback == true */ - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - return( mbedtls_psa_asymmetric_decrypt( attributes, - key_buffer, key_buffer_size, alg,input, input_length, - salt, salt_length, output, output_size, - output_length ) ); - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: - return( mbedtls_test_opaque_asymmetric_decrypt( attributes, - key_buffer, key_buffer_size, alg, input, input_length, - salt, salt_length, output, output_size, - output_length ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - default: - /* Key is declared with a lifetime not known to us */ - (void)status; - (void)key_buffer; - (void)key_buffer_size; - (void)alg; - (void)input; - (void)input_length; - (void)salt; - (void)salt_length; - (void)output; - (void)output_size; - (void)output_length; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_key_agreement( - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, - size_t key_buffer_size, - psa_algorithm_t alg, - const uint8_t *peer_key, - size_t peer_key_length, - uint8_t *shared_secret, - size_t shared_secret_size, - size_t *shared_secret_length - ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = - mbedtls_test_transparent_key_agreement( attributes, - key_buffer, key_buffer_size, alg, peer_key, - peer_key_length, shared_secret, shared_secret_size, - shared_secret_length ); - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#if defined(MBEDTLS_PSA_P256M_DRIVER_ENABLED) - if( PSA_KEY_TYPE_IS_ECC( psa_get_key_type(attributes) ) && - PSA_ALG_IS_ECDH(alg) && - PSA_KEY_TYPE_ECC_GET_FAMILY(psa_get_key_type(attributes)) == PSA_ECC_FAMILY_SECP_R1 && - psa_get_key_bits(attributes) == 256 ) - { - status = p256_transparent_key_agreement( attributes, - key_buffer, - key_buffer_size, - alg, - peer_key, - peer_key_length, - shared_secret, - shared_secret_size, - shared_secret_length ); - if( status != PSA_ERROR_NOT_SUPPORTED) - return( status ); - } -#endif /* MBEDTLS_PSA_P256M_DRIVER_ENABLED */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - /* Software Fallback */ - status = psa_key_agreement_raw_builtin( attributes, - key_buffer, - key_buffer_size, - alg, - peer_key, - peer_key_length, - shared_secret, - shared_secret_size, - shared_secret_length ); - return( status ); -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: - return( mbedtls_test_opaque_key_agreement( attributes, - key_buffer, key_buffer_size, alg, peer_key, - peer_key_length, shared_secret, shared_secret_size, - shared_secret_length ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - default: - (void) attributes; - (void) key_buffer; - (void) key_buffer_size; - (void) peer_key; - (void) peer_key_length; - (void) shared_secret; - (void) shared_secret_size; - (void) shared_secret_length; - return( PSA_ERROR_NOT_SUPPORTED ); - - } -} - -static inline psa_status_t psa_driver_wrapper_pake_setup( - psa_pake_operation_t *operation, - const psa_crypto_driver_pake_inputs_t *inputs ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime( &inputs->attributes ) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ - status = PSA_ERROR_NOT_SUPPORTED; -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_pake_setup( - &operation->data.ctx.transparent_test_driver_ctx, - inputs ); - if( status == PSA_SUCCESS ) - operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID; - /* Declared with fallback == true */ - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ -#if defined(MBEDTLS_PSA_BUILTIN_PAKE) - status = mbedtls_psa_pake_setup( &operation->data.ctx.mbedtls_ctx, - inputs ); - if( status == PSA_SUCCESS ) - operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; -#endif - return status; - /* Add cases for opaque driver here */ - default: - /* Key is declared with a lifetime not known to us */ - (void)operation; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_pake_output( - psa_pake_operation_t *operation, - psa_crypto_driver_pake_step_t step, - uint8_t *output, - size_t output_size, - size_t *output_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_PAKE) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_pake_output( &operation->data.ctx.mbedtls_ctx, step, - output, output_size, output_length ) ); -#endif /* MBEDTLS_PSA_BUILTIN_PAKE */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_pake_output( - &operation->data.ctx.transparent_test_driver_ctx, - step, output, output_size, output_length ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - (void) step; - (void) output; - (void) output_size; - (void) output_length; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_pake_input( - psa_pake_operation_t *operation, - psa_crypto_driver_pake_step_t step, - const uint8_t *input, - size_t input_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_PAKE) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_pake_input( &operation->data.ctx.mbedtls_ctx, - step, input, - input_length ) ); -#endif /* MBEDTLS_PSA_BUILTIN_PAKE */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_pake_input( - &operation->data.ctx.transparent_test_driver_ctx, - step, - input, input_length ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - (void) step; - (void) input; - (void) input_length; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_pake_get_implicit_key( - psa_pake_operation_t *operation, - uint8_t *output, size_t output_size, - size_t *output_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_PAKE) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_pake_get_implicit_key( &operation->data.ctx.mbedtls_ctx, - output, output_size, output_length ) ); -#endif /* MBEDTLS_PSA_BUILTIN_PAKE */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_pake_get_implicit_key( - &operation->data.ctx.transparent_test_driver_ctx, - output, output_size, output_length ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - (void) output; - (void) output_size; - (void) output_length; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_pake_abort( - psa_pake_operation_t * operation ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_PAKE) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_pake_abort( &operation->data.ctx.mbedtls_ctx ) ); -#endif /* MBEDTLS_PSA_BUILTIN_PAKE */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_pake_abort( - &operation->data.ctx.transparent_test_driver_ctx ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -#endif /* MBEDTLS_PSA_CRYPTO_C */ diff --git a/tf-psa-crypto/core/psa_crypto_driver_wrappers_no_static.c b/tf-psa-crypto/core/psa_crypto_driver_wrappers_no_static.c deleted file mode 100644 index 6ca37b8580..0000000000 --- a/tf-psa-crypto/core/psa_crypto_driver_wrappers_no_static.c +++ /dev/null @@ -1,247 +0,0 @@ -/* - * Functions to delegate cryptographic operations to an available - * and appropriate accelerator. - * Warning: This file is now auto-generated. - */ -/* Copyright The Mbed TLS Contributors - * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later - */ - - -/* BEGIN-common headers */ -#include "common.h" -#include "psa_crypto_aead.h" -#include "psa_crypto_cipher.h" -#include "psa_crypto_core.h" -#include "psa_crypto_driver_wrappers_no_static.h" -#include "psa_crypto_hash.h" -#include "psa_crypto_mac.h" -#include "psa_crypto_pake.h" -#include "psa_crypto_rsa.h" - -#include "mbedtls/platform.h" -/* END-common headers */ - -#if defined(MBEDTLS_PSA_CRYPTO_C) - -/* BEGIN-driver headers */ -/* Headers for mbedtls_test opaque driver */ -#if defined(PSA_CRYPTO_DRIVER_TEST) -#include "test/drivers/test_driver.h" - -#endif -/* Headers for mbedtls_test transparent driver */ -#if defined(PSA_CRYPTO_DRIVER_TEST) -#include "test/drivers/test_driver.h" - -#endif -/* Headers for p256 transparent driver */ -#if defined(MBEDTLS_PSA_P256M_DRIVER_ENABLED) -#include "../drivers/p256-m/p256-m_driver_entrypoints.h" - -#endif -/* Headers for esp_sha transparent driver */ -#if defined(ESP_SHA_DRIVER_ENABLED) -#include "../../../port/psa_driver/include/psa_crypto_driver_esp_sha.h" - -#endif -/* Headers for esp_aes transparent driver */ -#if defined(ESP_AES_DRIVER_ENABLED) -#include "../../../port/psa_driver/include/psa_crypto_driver_esp_aes.h" -#include "../../../port/psa_driver/include/psa_crypto_driver_esp_aes_gcm.h" - -#endif -/* Headers for esp_cmac transparent driver */ -#if defined(ESP_AES_DRIVER_ENABLED) -#include "../../../port/psa_driver/include/psa_crypto_driver_esp_cmac.h" - -#endif - -/* END-driver headers */ - -/* Auto-generated values depending on which drivers are registered. - * ID 0 is reserved for unallocated operations. - * ID 1 is reserved for the Mbed TLS software driver. */ -/* BEGIN-driver id definition */ -#define PSA_CRYPTO_MBED_TLS_DRIVER_ID (1) -#define MBEDTLS_TEST_OPAQUE_DRIVER_ID (2) -#define MBEDTLS_TEST_TRANSPARENT_DRIVER_ID (3) -#define P256_TRANSPARENT_DRIVER_ID (4) -#define ESP_SHA_TRANSPARENT_DRIVER_ID (5) -#define ESP_AES_TRANSPARENT_DRIVER_ID (6) -#define ESP_CMAC_TRANSPARENT_DRIVER_ID (7) - -/* END-driver id */ - -/* BEGIN-Common Macro definitions */ - -/* END-Common Macro definitions */ - -/** Get the key buffer size required to store the key material of a key - * associated with an opaque driver. - * - * \param[in] attributes The key attributes. - * \param[out] key_buffer_size Minimum buffer size to contain the key material - * - * \retval #PSA_SUCCESS - * The minimum size for a buffer to contain the key material has been - * returned successfully. - * \retval #PSA_ERROR_NOT_SUPPORTED - * The type and/or the size in bits of the key or the combination of - * the two is not supported. - * \retval #PSA_ERROR_INVALID_ARGUMENT - * The key is declared with a lifetime not known to us. - */ -psa_status_t psa_driver_wrapper_get_key_buffer_size( - const psa_key_attributes_t *attributes, - size_t *key_buffer_size ) -{ - psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - psa_key_type_t key_type = psa_get_key_type(attributes); - size_t key_bits = psa_get_key_bits(attributes); - - *key_buffer_size = 0; - switch( location ) - { -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: -#if defined(MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS) - /* Emulate property 'builtin_key_size' */ - if( psa_key_id_is_builtin( - MBEDTLS_SVC_KEY_ID_GET_KEY_ID( - psa_get_key_id( attributes ) ) ) ) - { - *key_buffer_size = sizeof( psa_drv_slot_number_t ); - return( PSA_SUCCESS ); - } -#endif /* MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS */ - *key_buffer_size = mbedtls_test_opaque_size_function( key_type, - key_bits ); - return( ( *key_buffer_size != 0 ) ? - PSA_SUCCESS : PSA_ERROR_NOT_SUPPORTED ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ - - default: - (void)key_type; - (void)key_bits; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -psa_status_t psa_driver_wrapper_export_public_key( - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, size_t key_buffer_size, - uint8_t *data, size_t data_size, size_t *data_length ) - -{ - - psa_status_t status = PSA_ERROR_INVALID_ARGUMENT; - psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION( - psa_get_key_lifetime( attributes ) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) - -#if (defined(PSA_CRYPTO_DRIVER_TEST) ) - status = mbedtls_test_transparent_export_public_key - (attributes, - key_buffer, - key_buffer_size, - data, - data_size, - data_length - ); - - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif - -#if (defined(MBEDTLS_PSA_P256M_DRIVER_ENABLED) ) - status = p256_transparent_export_public_key - (attributes, - key_buffer, - key_buffer_size, - data, - data_size, - data_length - ); - - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif - - - - -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - /* Fell through, meaning no accelerator supports this operation */ - return( psa_export_public_key_internal( attributes, - key_buffer, - key_buffer_size, - data, - data_size, - data_length ) ); - - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) - -#if (defined(PSA_CRYPTO_DRIVER_TEST) ) - case 0x7fffff: - return( mbedtls_test_opaque_export_public_key - (attributes, - key_buffer, - key_buffer_size, - data, - data_size, - data_length - )); -#endif - - -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - /* Key is declared with a lifetime not known to us */ - return( status ); - } - -} - -psa_status_t psa_driver_wrapper_get_builtin_key( - psa_drv_slot_number_t slot_number, - psa_key_attributes_t *attributes, - uint8_t *key_buffer, size_t key_buffer_size, size_t *key_buffer_length ) -{ - - psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - switch( location ) - { -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) - -#if (defined(PSA_CRYPTO_DRIVER_TEST) ) - case 0x7fffff: - return( mbedtls_test_opaque_get_builtin_key - (slot_number, - attributes, - key_buffer, - key_buffer_size, - key_buffer_length - )); -#endif - - -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - (void) slot_number; - (void) key_buffer; - (void) key_buffer_size; - (void) key_buffer_length; - return( PSA_ERROR_DOES_NOT_EXIST ); - } - -} - -#endif /* MBEDTLS_PSA_CRYPTO_C */ diff --git a/tf-psa-crypto/drivers/builtin/include/mbedtls/config_adjust_legacy_from_psa.h b/tf-psa-crypto/drivers/builtin/include/mbedtls/config_adjust_legacy_from_psa.h deleted file mode 100644 index 640bafd097..0000000000 --- a/tf-psa-crypto/drivers/builtin/include/mbedtls/config_adjust_legacy_from_psa.h +++ /dev/null @@ -1,863 +0,0 @@ -/** - * \file mbedtls/config_adjust_legacy_from_psa.h - * \brief Adjust PSA configuration: activate legacy implementations - * - * This is an internal header. Do not include it directly. - * - * Activate legacy implementations of cryptographic mechanisms as needed to - * fulfill the needs of the PSA configuration. Generally speaking, we activate - * a legacy mechanism if it's needed for a requested PSA mechanism and there is - * no PSA driver for it. - */ -/* - * Copyright The Mbed TLS Contributors - * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later - */ - -#ifndef MBEDTLS_CONFIG_ADJUST_LEGACY_FROM_PSA_H -#define MBEDTLS_CONFIG_ADJUST_LEGACY_FROM_PSA_H - -#if !defined(TF_PSA_CRYPTO_CONFIG_FILES_READ) -#error "Do not include mbedtls/config_adjust_*.h manually! This can lead to problems, " \ - "up to and including runtime errors such as buffer overflows. " \ - "If you're trying to fix a complaint from check_config.h, just remove " \ - "it from your configuration file: since Mbed TLS 3.0, it is included " \ - "automatically at the right point." -#endif /* */ - -/* Define appropriate ACCEL macros for the p256-m driver. - * In the future, those should be generated from the drivers JSON description. - */ -#if defined(MBEDTLS_PSA_P256M_DRIVER_ENABLED) -#define MBEDTLS_PSA_ACCEL_ECC_SECP_R1_256 -#define MBEDTLS_PSA_ACCEL_ALG_ECDSA -#define MBEDTLS_PSA_ACCEL_ALG_ECDH -#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY -#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_BASIC -#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_IMPORT -#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_EXPORT -#define MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_GENERATE -#endif - -/* - * ECC: support for a feature is controlled by a triplet or a pair: - * (curve, key_type public/basic, alg) or (curve, key_type_). - * - * A triplet/pair is accelerated if all of is components are accelerated; - * otherwise each component needs to be built in. - * - * We proceed in two passes: - * 1. Check if acceleration is complete for curves, key types, algs. - * 2. Then enable built-ins for each thing that's either not accelerated of - * doesn't have complete acceleration of the other triplet/pair components. - * - * Note: this needs psa/crypto_adjust_keypair_types.h to have been included - * already, so that we know the full set of key types that are requested. - */ - -/* ECC: curves: is acceleration complete? */ -#if (defined(PSA_WANT_ECC_BRAINPOOL_P_R1_256) && \ - !defined(MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_256)) || \ - (defined(PSA_WANT_ECC_BRAINPOOL_P_R1_384) && \ - !defined(MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_384)) || \ - (defined(PSA_WANT_ECC_BRAINPOOL_P_R1_512) && \ - !defined(MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_512)) || \ - (defined(PSA_WANT_ECC_SECP_R1_192) && !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_192)) || \ - (defined(PSA_WANT_ECC_SECP_R1_224) && !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_224)) || \ - (defined(PSA_WANT_ECC_SECP_R1_256) && !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_256)) || \ - (defined(PSA_WANT_ECC_SECP_R1_384) && !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_384)) || \ - (defined(PSA_WANT_ECC_SECP_R1_521) && !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_521)) || \ - (defined(PSA_WANT_ECC_SECP_K1_192) && !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_192)) || \ - (defined(PSA_WANT_ECC_SECP_K1_256) && !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_256)) -#define MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_CURVES -#define MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_WEIERSTRASS_CURVES -#endif - -#if (defined(PSA_WANT_ECC_MONTGOMERY_255) && !defined(MBEDTLS_PSA_ACCEL_ECC_MONTGOMERY_255)) || \ - (defined(PSA_WANT_ECC_MONTGOMERY_448) && !defined(MBEDTLS_PSA_ACCEL_ECC_MONTGOMERY_448)) -#define MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_CURVES -#endif - -/* ECC: algs: is acceleration complete? */ -#if (defined(PSA_WANT_ALG_ECDH) && !defined(MBEDTLS_PSA_ACCEL_ALG_ECDH)) || \ - (defined(PSA_WANT_ALG_ECDSA) && !defined(MBEDTLS_PSA_ACCEL_ALG_ECDSA)) || \ - (defined(PSA_WANT_ALG_DETERMINISTIC_ECDSA) && \ - !defined(MBEDTLS_PSA_ACCEL_ALG_DETERMINISTIC_ECDSA)) || \ - (defined(PSA_WANT_ALG_JPAKE) && !defined(MBEDTLS_PSA_ACCEL_ALG_JPAKE)) -#define MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS -#endif - -/* ECC: key types: is acceleration complete? */ -#if (defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) && \ - !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY)) || \ - (defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC) && \ - !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_BASIC)) -#define MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES_BASIC -#endif - -/* Special case: we don't support cooked key derivation in drivers yet */ -#if defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_DERIVE) -#undef MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_DERIVE -#endif - -/* Note: the condition about key derivation is always true as DERIVE can't be - * accelerated yet */ -#if (defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) && \ - !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY)) || \ - (defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC) && \ - !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_BASIC)) || \ - (defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT) && \ - !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_IMPORT)) || \ - (defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT) && \ - !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_EXPORT)) || \ - (defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE) && \ - !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_GENERATE)) || \ - (defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE) && \ - !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_DERIVE)) -#define MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES -#endif - -/* ECC: curves: enable built-ins as needed. - * - * We need the curve built-in: - * - if it's not accelerated, or - * - if there's a key type with missing acceleration, or - * - if there's a alg with missing acceleration. - */ -#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_256) -#if !defined(MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_256) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS) -#define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_256 1 -#define MBEDTLS_ECP_DP_BP256R1_ENABLED -#endif /* missing accel */ -#endif /* PSA_WANT_ECC_BRAINPOOL_P_R1_256 */ - -#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_384) -#if !defined(MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_384) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS) -#define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_384 1 -#define MBEDTLS_ECP_DP_BP384R1_ENABLED -#endif /* missing accel */ -#endif /* PSA_WANT_ECC_BRAINPOOL_P_R1_384 */ - -#if defined(PSA_WANT_ECC_BRAINPOOL_P_R1_512) -#if !defined(MBEDTLS_PSA_ACCEL_ECC_BRAINPOOL_P_R1_512) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS) -#define MBEDTLS_PSA_BUILTIN_ECC_BRAINPOOL_P_R1_512 1 -#define MBEDTLS_ECP_DP_BP512R1_ENABLED -#endif /* missing accel */ -#endif /* PSA_WANT_ECC_BRAINPOOL_P_R1_512 */ - -#if defined(PSA_WANT_ECC_MONTGOMERY_255) -#if !defined(MBEDTLS_PSA_ACCEL_ECC_MONTGOMERY_255) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS) -#define MBEDTLS_PSA_BUILTIN_ECC_MONTGOMERY_255 1 -#define MBEDTLS_ECP_DP_CURVE25519_ENABLED -#endif /* missing accel */ -#endif /* PSA_WANT_ECC_MONTGOMERY_255 */ - -#if defined(PSA_WANT_ECC_MONTGOMERY_448) -#if !defined(MBEDTLS_PSA_ACCEL_ECC_MONTGOMERY_448) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS) -#define MBEDTLS_PSA_BUILTIN_ECC_MONTGOMERY_448 1 -#define MBEDTLS_ECP_DP_CURVE448_ENABLED -#endif /* missing accel */ -#endif /* PSA_WANT_ECC_MONTGOMERY_448 */ - -#if defined(PSA_WANT_ECC_SECP_R1_192) -#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_192) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS) -#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_192 1 -#define MBEDTLS_ECP_DP_SECP192R1_ENABLED -#endif /* missing accel */ -#endif /* PSA_WANT_ECC_SECP_R1_192 */ - -#if defined(PSA_WANT_ECC_SECP_R1_224) -#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_224) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS) -#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_224 1 -#define MBEDTLS_ECP_DP_SECP224R1_ENABLED -#endif /* missing accel */ -#endif /* PSA_WANT_ECC_SECP_R1_224 */ - -#if defined(PSA_WANT_ECC_SECP_R1_256) -#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_256) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS) -#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_256 1 -#define MBEDTLS_ECP_DP_SECP256R1_ENABLED -#endif /* missing accel */ -#endif /* PSA_WANT_ECC_SECP_R1_256 */ - -#if defined(PSA_WANT_ECC_SECP_R1_384) -#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_384) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS) -#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_384 1 -#define MBEDTLS_ECP_DP_SECP384R1_ENABLED -#endif /* missing accel */ -#endif /* PSA_WANT_ECC_SECP_R1_384 */ - -#if defined(PSA_WANT_ECC_SECP_R1_521) -#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_521) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS) -#define MBEDTLS_PSA_BUILTIN_ECC_SECP_R1_521 1 -#define MBEDTLS_ECP_DP_SECP521R1_ENABLED -#endif /* missing accel */ -#endif /* PSA_WANT_ECC_SECP_R1_521 */ - -#if defined(PSA_WANT_ECC_SECP_K1_192) -#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_192) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS) -#define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_192 1 -#define MBEDTLS_ECP_DP_SECP192K1_ENABLED -#endif /* missing accel */ -#endif /* PSA_WANT_ECC_SECP_K1_192 */ - -#if defined(PSA_WANT_ECC_SECP_K1_256) -#if !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_K1_256) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS) -#define MBEDTLS_PSA_BUILTIN_ECC_SECP_K1_256 1 -#define MBEDTLS_ECP_DP_SECP256K1_ENABLED -#endif /* missing accel */ -#endif /* PSA_WANT_ECC_SECP_K1_256 */ - -/* ECC: algs: enable built-ins as needed. - * - * We need the alg built-in: - * - if it's not accelerated, or - * - if there's a relevant curve (see below) with missing acceleration, or - * - if there's a key type among (public, basic) with missing acceleration. - * - * Relevant curves are: - * - all curves for ECDH - * - Weierstrass curves for (deterministic) ECDSA - * - secp256r1 for EC J-PAKE - */ -#if defined(PSA_WANT_ALG_DETERMINISTIC_ECDSA) -#if !defined(MBEDTLS_PSA_ACCEL_ALG_DETERMINISTIC_ECDSA) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_WEIERSTRASS_CURVES) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES_BASIC) -#define MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA 1 -#define MBEDTLS_ECDSA_DETERMINISTIC -#define MBEDTLS_HMAC_DRBG_C -#define MBEDTLS_MD_C -#define MBEDTLS_ECDSA_C -#define MBEDTLS_ECP_C -#define MBEDTLS_BIGNUM_C -#define MBEDTLS_ASN1_PARSE_C -#define MBEDTLS_ASN1_WRITE_C -#endif /* missing accel */ -#endif /* PSA_WANT_ALG_DETERMINISTIC_ECDSA */ - -#if defined(PSA_WANT_ALG_ECDH) -#if !defined(MBEDTLS_PSA_ACCEL_ALG_ECDH) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_CURVES) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES_BASIC) -#define MBEDTLS_PSA_BUILTIN_ALG_ECDH 1 -#define MBEDTLS_ECDH_C -#define MBEDTLS_ECP_C -#define MBEDTLS_BIGNUM_C -#endif /* missing accel */ -#endif /* PSA_WANT_ALG_ECDH */ - -#if defined(PSA_WANT_ALG_ECDSA) -#if !defined(MBEDTLS_PSA_ACCEL_ALG_ECDSA) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_WEIERSTRASS_CURVES) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES_BASIC) -#define MBEDTLS_PSA_BUILTIN_ALG_ECDSA 1 -#define MBEDTLS_ECDSA_C -#define MBEDTLS_ECP_C -#define MBEDTLS_BIGNUM_C -#define MBEDTLS_ASN1_PARSE_C -#define MBEDTLS_ASN1_WRITE_C -#endif /* missing accel */ -#endif /* PSA_WANT_ALG_ECDSA */ - -#if defined(PSA_WANT_ALG_JPAKE) -#if !defined(MBEDTLS_PSA_ACCEL_ALG_JPAKE) || \ - !defined(MBEDTLS_PSA_ACCEL_ECC_SECP_R1_256) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_KEY_TYPES_BASIC) -#define MBEDTLS_PSA_BUILTIN_PAKE 1 -#define MBEDTLS_PSA_BUILTIN_ALG_JPAKE 1 -#define MBEDTLS_ECP_DP_SECP256R1_ENABLED -#define MBEDTLS_BIGNUM_C -#define MBEDTLS_ECP_C -#define MBEDTLS_ECJPAKE_C -#endif /* missing accel */ -#endif /* PSA_WANT_ALG_JPAKE */ - -/* ECC: key types: enable built-ins as needed. - * - * We need the key type built-in: - * - if it's not accelerated, or - * - if there's a curve with missing acceleration, or - * - only for public/basic: if there's an alg with missing acceleration. - */ -#if defined(PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY) -#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_PUBLIC_KEY) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_CURVES) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS) -// #define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY 1 -#endif /* missing accel */ -#endif /* PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY */ - -#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC) -#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_BASIC) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_CURVES) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_ALGS) -#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_BASIC 1 -#endif /* missing accel */ -#endif /* PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC */ - -#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT) -#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_IMPORT) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_CURVES) -#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT 1 -#endif /* missing accel */ -#endif /* PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT */ - -#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT) -#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_EXPORT) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_CURVES) -#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT 1 -#endif /* missing accel */ -#endif /* PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT */ - -#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE) -#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_GENERATE) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_CURVES) -#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_GENERATE 1 -#endif /* missing accel */ -#endif /* PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE */ - -/* Note: the condition is always true as DERIVE can't be accelerated yet */ -#if defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE) -#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_DERIVE) || \ - defined(MBEDTLS_PSA_ECC_ACCEL_INCOMPLETE_CURVES) -#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE 1 -#endif /* missing accel */ -#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_ECC_KEY_PAIR_DERIVE */ - -#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_PUBLIC_KEY) || \ - defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_BASIC) || \ - defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_IMPORT) || \ - defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_DERIVE) -#define MBEDTLS_ECP_LIGHT -#define MBEDTLS_BIGNUM_C -#endif - -#if defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_EXPORT) || \ - defined(MBEDTLS_PSA_BUILTIN_KEY_TYPE_ECC_KEY_PAIR_GENERATE) -#define MBEDTLS_ECP_C -#define MBEDTLS_BIGNUM_C -#endif - -/* End of ECC section */ - -/* - * DH key types follow the same pattern used above for EC keys. They are defined - * by a triplet (group, key_type, alg). A triplet is accelerated if all its - * component are accelerated, otherwise each component needs to be builtin. - */ - -/* DH: groups: is acceleration complete? */ -#if (defined(PSA_WANT_DH_RFC7919_2048) && !defined(MBEDTLS_PSA_ACCEL_DH_RFC7919_2048)) || \ - (defined(PSA_WANT_DH_RFC7919_3072) && !defined(MBEDTLS_PSA_ACCEL_DH_RFC7919_3072)) || \ - (defined(PSA_WANT_DH_RFC7919_4096) && !defined(MBEDTLS_PSA_ACCEL_DH_RFC7919_4096)) || \ - (defined(PSA_WANT_DH_RFC7919_6144) && !defined(MBEDTLS_PSA_ACCEL_DH_RFC7919_6144)) || \ - (defined(PSA_WANT_DH_RFC7919_8192) && !defined(MBEDTLS_PSA_ACCEL_DH_RFC7919_8192)) -#define MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_GROUPS -#endif - -/* DH: algs: is acceleration complete? */ -#if defined(PSA_WANT_ALG_FFDH) && !defined(MBEDTLS_PSA_ACCEL_ALG_FFDH) -#define MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_ALGS -#endif - -/* DH: key types: is acceleration complete? */ -#if (defined(PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY) && \ - !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_PUBLIC_KEY)) || \ - (defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC) && \ - !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_BASIC)) || \ - (defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT) && \ - !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_IMPORT)) || \ - (defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT) && \ - !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_EXPORT)) || \ - (defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE) && \ - !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_GENERATE)) -#define MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_KEY_TYPES -#endif - -#if defined(PSA_WANT_DH_RFC7919_2048) -#if !defined(MBEDTLS_PSA_ACCEL_DH_RFC7919_2048) || \ - defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_ALGS) || \ - defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_KEY_TYPES) -#define MBEDTLS_PSA_BUILTIN_DH_RFC7919_2048 1 -#endif /* !MBEDTLS_PSA_BUILTIN_DH_RFC7919_2048 */ -#endif /* PSA_WANT_DH_RFC7919_2048 */ - -#if defined(PSA_WANT_DH_RFC7919_3072) -#if !defined(MBEDTLS_PSA_ACCEL_DH_RFC7919_3072) || \ - defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_ALGS) || \ - defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_KEY_TYPES) -#define MBEDTLS_PSA_BUILTIN_DH_RFC7919_3072 1 -#endif /* !MBEDTLS_PSA_BUILTIN_DH_RFC7919_3072 */ -#endif /* PSA_WANT_DH_RFC7919_3072 */ - -#if defined(PSA_WANT_DH_RFC7919_4096) -#if !defined(MBEDTLS_PSA_ACCEL_DH_RFC7919_4096) || \ - defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_ALGS) || \ - defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_KEY_TYPES) -#define MBEDTLS_PSA_BUILTIN_DH_RFC7919_4096 1 -#endif /* !MBEDTLS_PSA_BUILTIN_DH_RFC7919_4096 */ -#endif /* PSA_WANT_DH_RFC7919_4096 */ - -#if defined(PSA_WANT_DH_RFC7919_6144) -#if !defined(MBEDTLS_PSA_ACCEL_DH_RFC7919_6144) || \ - defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_ALGS) || \ - defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_KEY_TYPES) -#define MBEDTLS_PSA_BUILTIN_DH_RFC7919_6144 1 -#endif /* !MBEDTLS_PSA_BUILTIN_DH_RFC7919_6144 */ -#endif /* PSA_WANT_DH_RFC7919_6144 */ - -#if defined(PSA_WANT_DH_RFC7919_8192) -#if !defined(MBEDTLS_PSA_ACCEL_DH_RFC7919_8192) || \ - defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_ALGS) || \ - defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_KEY_TYPES) -#define MBEDTLS_PSA_BUILTIN_DH_RFC7919_8192 1 -#endif /* !MBEDTLS_PSA_BUILTIN_DH_RFC7919_8192 */ -#endif /* PSA_WANT_DH_RFC7919_8192 */ - -#if defined(PSA_WANT_ALG_FFDH) -#if !defined(MBEDTLS_PSA_ACCEL_ALG_FFDH) || \ - defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_GROUPS) || \ - defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_KEY_TYPES) -#define MBEDTLS_PSA_BUILTIN_ALG_FFDH 1 -#define MBEDTLS_BIGNUM_C -#endif /* !MBEDTLS_PSA_ACCEL_ALG_FFDH */ -#endif /* PSA_WANT_ALG_FFDH */ - -#if defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT) -#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_IMPORT) || \ - defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_GROUPS) || \ - defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_ALGS) -// #define MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_IMPORT 1 -#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_IMPORT */ -#endif /* PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT */ - -#if defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT) -#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_EXPORT) || \ - defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_GROUPS) || \ - defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_ALGS) -#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_EXPORT 1 -#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_EXPORT */ -#endif /* PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT */ - -#if defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE) -#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_GENERATE) -#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_GENERATE 1 -#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_GENERATE */ -#endif /* PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE */ - -#if defined(PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC) -#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_BASIC) || \ - defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_GROUPS) || \ - defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_ALGS) -#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_KEY_PAIR_BASIC 1 -#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_KEY_PAIR_BASIC */ -#endif /* PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC */ - -#if defined(PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY) -#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_PUBLIC_KEY) || \ - defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_GROUPS) || \ - defined(MBEDTLS_PSA_DH_ACCEL_INCOMPLETE_ALGS) -// #define MBEDTLS_PSA_BUILTIN_KEY_TYPE_DH_PUBLIC_KEY 1 -#define MBEDTLS_BIGNUM_C -#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_DH_PUBLIC_KEY */ -#endif /* PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY */ - -/* End of DH section */ - -#if defined(PSA_WANT_ALG_HKDF) -#if !defined(MBEDTLS_PSA_ACCEL_ALG_HKDF) -/* - * The PSA implementation has its own implementation of HKDF, separate from - * hkdf.c. No need to enable MBEDTLS_HKDF_C here. - */ -#define MBEDTLS_PSA_BUILTIN_ALG_HKDF 1 -#endif /* !MBEDTLS_PSA_ACCEL_ALG_HKDF */ -#endif /* PSA_WANT_ALG_HKDF */ - -#if defined(PSA_WANT_ALG_HKDF_EXTRACT) -#if !defined(MBEDTLS_PSA_ACCEL_ALG_HKDF_EXTRACT) -/* - * The PSA implementation has its own implementation of HKDF, separate from - * hkdf.c. No need to enable MBEDTLS_HKDF_C here. - */ -#define MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXTRACT 1 -#endif /* !MBEDTLS_PSA_ACCEL_ALG_HKDF_EXTRACT */ -#endif /* PSA_WANT_ALG_HKDF_EXTRACT */ - -#if defined(PSA_WANT_ALG_HKDF_EXPAND) -#if !defined(MBEDTLS_PSA_ACCEL_ALG_HKDF_EXPAND) -/* - * The PSA implementation has its own implementation of HKDF, separate from - * hkdf.c. No need to enable MBEDTLS_HKDF_C here. - */ -#define MBEDTLS_PSA_BUILTIN_ALG_HKDF_EXPAND 1 -#endif /* !MBEDTLS_PSA_ACCEL_ALG_HKDF_EXPAND */ -#endif /* PSA_WANT_ALG_HKDF_EXPAND */ - -#if defined(PSA_WANT_ALG_HMAC) -#if !defined(MBEDTLS_PSA_ACCEL_ALG_HMAC) -#define MBEDTLS_PSA_BUILTIN_ALG_HMAC 1 -#endif /* !MBEDTLS_PSA_ACCEL_ALG_HMAC */ -#endif /* PSA_WANT_ALG_HMAC */ - -#if defined(PSA_WANT_ALG_MD5) && !defined(MBEDTLS_PSA_ACCEL_ALG_MD5) -#define MBEDTLS_PSA_BUILTIN_ALG_MD5 1 -#define MBEDTLS_MD5_C -#endif - -#if defined(PSA_WANT_ALG_RIPEMD160) && !defined(MBEDTLS_PSA_ACCEL_ALG_RIPEMD160) -#define MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160 1 -#define MBEDTLS_RIPEMD160_C -#endif - -#if defined(PSA_WANT_ALG_RSA_OAEP) -#if !defined(MBEDTLS_PSA_ACCEL_ALG_RSA_OAEP) -#define MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP 1 -#define MBEDTLS_RSA_C -#define MBEDTLS_BIGNUM_C -#define MBEDTLS_PKCS1_V21 -#endif /* !MBEDTLS_PSA_ACCEL_ALG_RSA_OAEP */ -#endif /* PSA_WANT_ALG_RSA_OAEP */ - -#if defined(PSA_WANT_ALG_RSA_PKCS1V15_CRYPT) -#if !defined(MBEDTLS_PSA_ACCEL_ALG_RSA_PKCS1V15_CRYPT) -#define MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT 1 -#define MBEDTLS_RSA_C -#define MBEDTLS_BIGNUM_C -#define MBEDTLS_PKCS1_V15 -#endif /* !MBEDTLS_PSA_ACCEL_ALG_RSA_PKCS1V15_CRYPT */ -#endif /* PSA_WANT_ALG_RSA_PKCS1V15_CRYPT */ - -#if defined(PSA_WANT_ALG_RSA_PKCS1V15_SIGN) -#if !defined(MBEDTLS_PSA_ACCEL_ALG_RSA_PKCS1V15_SIGN) -#define MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_SIGN 1 -#define MBEDTLS_RSA_C -#define MBEDTLS_BIGNUM_C -#define MBEDTLS_PKCS1_V15 -#endif /* !MBEDTLS_PSA_ACCEL_ALG_RSA_PKCS1V15_SIGN */ -#endif /* PSA_WANT_ALG_RSA_PKCS1V15_SIGN */ - -#if defined(PSA_WANT_ALG_RSA_PSS) -#if !defined(MBEDTLS_PSA_ACCEL_ALG_RSA_PSS) -#define MBEDTLS_PSA_BUILTIN_ALG_RSA_PSS 1 -#define MBEDTLS_RSA_C -#define MBEDTLS_BIGNUM_C -#define MBEDTLS_PKCS1_V21 -#endif /* !MBEDTLS_PSA_ACCEL_ALG_RSA_PSS */ -#endif /* PSA_WANT_ALG_RSA_PSS */ - -#if defined(PSA_WANT_ALG_SHA_1) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA_1) -#define MBEDTLS_PSA_BUILTIN_ALG_SHA_1 1 -#define MBEDTLS_SHA1_C -#endif - -#if defined(PSA_WANT_ALG_SHA_224) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA_224) -#define MBEDTLS_PSA_BUILTIN_ALG_SHA_224 1 -#define MBEDTLS_SHA224_C -#endif - -#if defined(PSA_WANT_ALG_SHA_256) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA_256) -#define MBEDTLS_PSA_BUILTIN_ALG_SHA_256 1 -#define MBEDTLS_SHA256_C -#endif - -#if defined(PSA_WANT_ALG_SHA_384) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA_384) -#define MBEDTLS_PSA_BUILTIN_ALG_SHA_384 1 -#define MBEDTLS_SHA384_C -#endif - -#if defined(PSA_WANT_ALG_SHA_512) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA_512) -#define MBEDTLS_PSA_BUILTIN_ALG_SHA_512 1 -#define MBEDTLS_SHA512_C -#endif - -#if defined(PSA_WANT_ALG_SHA3_224) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA3_224) -#define MBEDTLS_PSA_BUILTIN_ALG_SHA3_224 1 -#endif - -#if defined(PSA_WANT_ALG_SHA3_256) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA3_256) -#define MBEDTLS_PSA_BUILTIN_ALG_SHA3_256 1 -#endif - -#if defined(PSA_WANT_ALG_SHA3_384) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA3_384) -#define MBEDTLS_PSA_BUILTIN_ALG_SHA3_384 1 -#endif - -#if defined(PSA_WANT_ALG_SHA3_512) && !defined(MBEDTLS_PSA_ACCEL_ALG_SHA3_512) -#define MBEDTLS_PSA_BUILTIN_ALG_SHA3_512 1 -#endif - -#if defined(PSA_WANT_ALG_PBKDF2_HMAC) -#if !defined(MBEDTLS_PSA_ACCEL_ALG_PBKDF2_HMAC) -#define MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC 1 -#define PSA_HAVE_SOFT_PBKDF2_HMAC 1 -#endif /* !MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC */ -#endif /* PSA_WANT_ALG_PBKDF2_HMAC */ - -#if defined(PSA_WANT_ALG_TLS12_PRF) -#if !defined(MBEDTLS_PSA_ACCEL_ALG_TLS12_PRF) -#define MBEDTLS_PSA_BUILTIN_ALG_TLS12_PRF 1 -#endif /* !MBEDTLS_PSA_ACCEL_ALG_TLS12_PRF */ -#endif /* PSA_WANT_ALG_TLS12_PRF */ - -#if defined(PSA_WANT_ALG_TLS12_PSK_TO_MS) -#if !defined(MBEDTLS_PSA_ACCEL_ALG_TLS12_PSK_TO_MS) -#define MBEDTLS_PSA_BUILTIN_ALG_TLS12_PSK_TO_MS 1 -#endif /* !MBEDTLS_PSA_ACCEL_ALG_TLS12_PSK_TO_MS */ -#endif /* PSA_WANT_ALG_TLS12_PSK_TO_MS */ - -#if defined(PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS) -#if !defined(MBEDTLS_PSA_ACCEL_ALG_TLS12_ECJPAKE_TO_PMS) -#define MBEDTLS_PSA_BUILTIN_ALG_TLS12_ECJPAKE_TO_PMS 1 -#endif /* !MBEDTLS_PSA_ACCEL_ALG_TLS12_ECJPAKE_TO_PMS */ -#endif /* PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS */ - -#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT) -#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_IMPORT) -// #define MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_IMPORT 1 -#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_IMPORT */ -#endif /* PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT */ - -#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT) -#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_EXPORT) -#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_EXPORT 1 -#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_EXPORT */ -#endif /* PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT */ - -#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE) -#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_GENERATE) -#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_GENERATE 1 -#define MBEDTLS_GENPRIME -#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_GENERATE */ -#endif /* PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE */ - -#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC) -#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_BASIC) -#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_KEY_PAIR_BASIC 1 -#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_KEY_PAIR_BASIC */ -#endif /* PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC */ - -#if defined(PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY) -#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_PUBLIC_KEY) -#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_RSA_PUBLIC_KEY 1 -#define MBEDTLS_RSA_C -#define MBEDTLS_BIGNUM_C -#define MBEDTLS_ASN1_PARSE_C -#define MBEDTLS_ASN1_WRITE_C -#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_RSA_PUBLIC_KEY */ -#endif /* PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY */ - -/* If any of the block modes are requested that don't have an - * associated HW assist, define PSA_HAVE_SOFT_BLOCK_MODE for checking - * in the block cipher key types. */ -#if (defined(PSA_WANT_ALG_CTR) && !defined(MBEDTLS_PSA_ACCEL_ALG_CTR)) || \ - (defined(PSA_WANT_ALG_CFB) && !defined(MBEDTLS_PSA_ACCEL_ALG_CFB)) || \ - (defined(PSA_WANT_ALG_OFB) && !defined(MBEDTLS_PSA_ACCEL_ALG_OFB)) || \ - (defined(PSA_WANT_ALG_ECB_NO_PADDING) && !defined(MBEDTLS_PSA_ACCEL_ALG_ECB_NO_PADDING)) || \ - (defined(PSA_WANT_ALG_CBC_NO_PADDING) && !defined(MBEDTLS_PSA_ACCEL_ALG_CBC_NO_PADDING)) || \ - (defined(PSA_WANT_ALG_CBC_PKCS7) && !defined(MBEDTLS_PSA_ACCEL_ALG_CBC_PKCS7)) || \ - (defined(PSA_WANT_ALG_CMAC) && !defined(MBEDTLS_PSA_ACCEL_ALG_CMAC)) -#define PSA_HAVE_SOFT_BLOCK_MODE 1 -#endif - -#if defined(PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128) -#if !defined(MBEDTLS_PSA_ACCEL_ALG_PBKDF2_AES_CMAC_PRF_128) -#define MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_AES_CMAC_PRF_128 1 -#define PSA_HAVE_SOFT_PBKDF2_CMAC 1 -#endif /* !MBEDTLS_PSA_ACCEL_ALG_PBKDF2_AES_CMAC_PRF_128 */ -#endif /* PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128 */ - -#if defined(PSA_WANT_KEY_TYPE_AES) -#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_AES) -#define PSA_HAVE_SOFT_KEY_TYPE_AES 1 -#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_AES */ -#if defined(PSA_HAVE_SOFT_KEY_TYPE_AES) || \ - defined(PSA_HAVE_SOFT_BLOCK_MODE) -#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_AES 1 -#define MBEDTLS_AES_C -#endif /* PSA_HAVE_SOFT_KEY_TYPE_AES || PSA_HAVE_SOFT_BLOCK_MODE */ -#endif /* PSA_WANT_KEY_TYPE_AES */ - -#if defined(PSA_WANT_KEY_TYPE_ARIA) -#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_ARIA) -#define PSA_HAVE_SOFT_KEY_TYPE_ARIA 1 -#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_ARIA */ -#if defined(PSA_HAVE_SOFT_KEY_TYPE_ARIA) || \ - defined(PSA_HAVE_SOFT_BLOCK_MODE) -#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_ARIA 1 -#define MBEDTLS_ARIA_C -#endif /* PSA_HAVE_SOFT_KEY_TYPE_ARIA || PSA_HAVE_SOFT_BLOCK_MODE */ -#endif /* PSA_WANT_KEY_TYPE_ARIA */ - -#if defined(PSA_WANT_KEY_TYPE_CAMELLIA) -#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_CAMELLIA) -#define PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA 1 -#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_CAMELLIA */ -#if defined(PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA) || \ - defined(PSA_HAVE_SOFT_BLOCK_MODE) -#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_CAMELLIA 1 -#define MBEDTLS_CAMELLIA_C -#endif /* PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA || PSA_HAVE_SOFT_BLOCK_MODE */ -#endif /* PSA_WANT_KEY_TYPE_CAMELLIA */ - -#if defined(PSA_WANT_KEY_TYPE_DES) -#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_DES) -#define PSA_HAVE_SOFT_KEY_TYPE_DES 1 -#endif /* !MBEDTLS_PSA_ACCEL_KEY_TYPE_DES */ -#if defined(PSA_HAVE_SOFT_KEY_TYPE_DES) || \ - defined(PSA_HAVE_SOFT_BLOCK_MODE) -#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_DES 1 -#define MBEDTLS_DES_C -#endif /*PSA_HAVE_SOFT_KEY_TYPE_DES || PSA_HAVE_SOFT_BLOCK_MODE */ -#endif /* PSA_WANT_KEY_TYPE_DES */ - -#if defined(PSA_WANT_ALG_STREAM_CIPHER) -#if !defined(MBEDTLS_PSA_ACCEL_ALG_STREAM_CIPHER) -#define MBEDTLS_PSA_BUILTIN_ALG_STREAM_CIPHER 1 -#endif /* MBEDTLS_PSA_ACCEL_ALG_STREAM_CIPHER */ -#endif /* PSA_WANT_ALG_STREAM_CIPHER */ - -#if defined(PSA_WANT_KEY_TYPE_CHACHA20) -#if !defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_CHACHA20) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_STREAM_CIPHER) -#define MBEDTLS_PSA_BUILTIN_KEY_TYPE_CHACHA20 1 -#define MBEDTLS_CHACHA20_C -#endif /*!MBEDTLS_PSA_ACCEL_KEY_TYPE_CHACHA20 */ -#endif /* PSA_WANT_KEY_TYPE_CHACHA20 */ - -/* If any of the software block ciphers are selected, define - * PSA_HAVE_SOFT_BLOCK_CIPHER, which can be used in any of these - * situations. */ -#if defined(PSA_HAVE_SOFT_KEY_TYPE_AES) || \ - defined(PSA_HAVE_SOFT_KEY_TYPE_ARIA) || \ - defined(PSA_HAVE_SOFT_KEY_TYPE_DES) || \ - defined(PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA) -#define PSA_HAVE_SOFT_BLOCK_CIPHER 1 -#endif - -#if defined(PSA_WANT_ALG_CMAC) -#if !defined(MBEDTLS_PSA_ACCEL_ALG_CMAC) || \ - defined(PSA_HAVE_SOFT_BLOCK_CIPHER) -#define MBEDTLS_PSA_BUILTIN_ALG_CMAC 1 -#define MBEDTLS_CMAC_C -#endif /* !MBEDTLS_PSA_ACCEL_ALG_CMAC */ -#endif /* PSA_WANT_ALG_CMAC */ - -#if defined(PSA_HAVE_SOFT_PBKDF2_HMAC) || \ - defined(PSA_HAVE_SOFT_PBKDF2_CMAC) -#define PSA_HAVE_SOFT_PBKDF2 1 -#endif /* PSA_HAVE_SOFT_PBKDF2_HMAC || PSA_HAVE_SOFT_PBKDF2_CMAC */ - -#if defined(PSA_WANT_ALG_CTR) -#if !defined(MBEDTLS_PSA_ACCEL_ALG_CTR) || \ - defined(PSA_HAVE_SOFT_BLOCK_CIPHER) -#define MBEDTLS_PSA_BUILTIN_ALG_CTR 1 -#define MBEDTLS_CIPHER_MODE_CTR -#endif -#endif /* PSA_WANT_ALG_CTR */ - -#if defined(PSA_WANT_ALG_CFB) -#if !defined(MBEDTLS_PSA_ACCEL_ALG_CFB) || \ - defined(PSA_HAVE_SOFT_BLOCK_CIPHER) -#define MBEDTLS_PSA_BUILTIN_ALG_CFB 1 -#define MBEDTLS_CIPHER_MODE_CFB -#endif -#endif /* PSA_WANT_ALG_CFB */ - -#if defined(PSA_WANT_ALG_OFB) -#if !defined(MBEDTLS_PSA_ACCEL_ALG_OFB) || \ - defined(PSA_HAVE_SOFT_BLOCK_CIPHER) -#define MBEDTLS_PSA_BUILTIN_ALG_OFB 1 -#define MBEDTLS_CIPHER_MODE_OFB -#endif -#endif /* PSA_WANT_ALG_OFB */ - -#if defined(PSA_WANT_ALG_ECB_NO_PADDING) && \ - !defined(MBEDTLS_PSA_ACCEL_ALG_ECB_NO_PADDING) -#define MBEDTLS_PSA_BUILTIN_ALG_ECB_NO_PADDING 1 -#endif - -#if defined(PSA_WANT_ALG_CBC_NO_PADDING) -#if !defined(MBEDTLS_PSA_ACCEL_ALG_CBC_NO_PADDING) || \ - defined(PSA_HAVE_SOFT_BLOCK_CIPHER) -#define MBEDTLS_CIPHER_MODE_CBC -#define MBEDTLS_PSA_BUILTIN_ALG_CBC_NO_PADDING 1 -#endif -#endif /* PSA_WANT_ALG_CBC_NO_PADDING */ - -#if defined(PSA_WANT_ALG_CBC_PKCS7) -#if !defined(MBEDTLS_PSA_ACCEL_ALG_CBC_PKCS7) || \ - defined(PSA_HAVE_SOFT_BLOCK_CIPHER) -#define MBEDTLS_CIPHER_MODE_CBC -#define MBEDTLS_PSA_BUILTIN_ALG_CBC_PKCS7 1 -#define MBEDTLS_CIPHER_PADDING_PKCS7 -#endif -#endif /* PSA_WANT_ALG_CBC_PKCS7 */ - -#if defined(PSA_WANT_ALG_CCM) -#if !defined(MBEDTLS_PSA_ACCEL_ALG_CCM) || \ - defined(PSA_HAVE_SOFT_KEY_TYPE_AES) || \ - defined(PSA_HAVE_SOFT_KEY_TYPE_ARIA) || \ - defined(PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA) -#define MBEDTLS_PSA_BUILTIN_ALG_CCM 1 -#define MBEDTLS_CCM_C -#endif -#endif /* PSA_WANT_ALG_CCM */ - -#if defined(PSA_WANT_ALG_CCM_STAR_NO_TAG) -#if !defined(MBEDTLS_PSA_ACCEL_ALG_CCM_STAR_NO_TAG) || \ - defined(PSA_HAVE_SOFT_KEY_TYPE_AES) || \ - defined(PSA_HAVE_SOFT_KEY_TYPE_ARIA) || \ - defined(PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA) -#define MBEDTLS_PSA_BUILTIN_ALG_CCM_STAR_NO_TAG 1 -#define MBEDTLS_CCM_C -#endif -#endif /* PSA_WANT_ALG_CCM_STAR_NO_TAG */ - -#if defined(PSA_WANT_ALG_GCM) -#if !defined(MBEDTLS_PSA_ACCEL_ALG_GCM) || \ - defined(PSA_HAVE_SOFT_KEY_TYPE_AES) || \ - defined(PSA_HAVE_SOFT_KEY_TYPE_ARIA) || \ - defined(PSA_HAVE_SOFT_KEY_TYPE_CAMELLIA) -#define MBEDTLS_PSA_BUILTIN_ALG_GCM 1 -#define MBEDTLS_GCM_C -#endif -#endif /* PSA_WANT_ALG_GCM */ - -#if defined(PSA_WANT_ALG_CHACHA20_POLY1305) -#if !defined(MBEDTLS_PSA_ACCEL_ALG_CHACHA20_POLY1305) -#if defined(PSA_WANT_KEY_TYPE_CHACHA20) -#define MBEDTLS_CHACHAPOLY_C -#define MBEDTLS_CHACHA20_C -#define MBEDTLS_POLY1305_C -#define MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 1 -#endif /* PSA_WANT_KEY_TYPE_CHACHA20 */ -#endif /* !MBEDTLS_PSA_ACCEL_ALG_CHACHA20_POLY1305 */ -#endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */ - -#endif /* MBEDTLS_CONFIG_ADJUST_LEGACY_FROM_PSA_H */ diff --git a/tf-psa-crypto/drivers/builtin/src/aes.c b/tf-psa-crypto/drivers/builtin/src/aes.c deleted file mode 100644 index 6eda30fcc1..0000000000 --- a/tf-psa-crypto/drivers/builtin/src/aes.c +++ /dev/null @@ -1,2242 +0,0 @@ -/* - * FIPS-197 compliant AES implementation - * - * Copyright The Mbed TLS Contributors - * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later - */ -/* - * The AES block cipher was designed by Vincent Rijmen and Joan Daemen. - * - * https://csrc.nist.gov/csrc/media/projects/cryptographic-standards-and-guidelines/documents/aes-development/rijndael-ammended.pdf - * http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf - */ - -#include "common.h" - -#if defined(MBEDTLS_AES_C) - -#include - -#include "mbedtls/aes.h" -#include "mbedtls/platform.h" -#include "mbedtls/platform_util.h" -#include "mbedtls/error_common.h" - -#if 0 -#if defined(MBEDTLS_AES_USE_HARDWARE_ONLY) -#if !((defined(MBEDTLS_ARCH_IS_ARMV8_A) && defined(MBEDTLS_AESCE_C)) || \ - (defined(MBEDTLS_ARCH_IS_X64) && defined(MBEDTLS_AESNI_C)) || \ - (defined(MBEDTLS_ARCH_IS_X86) && defined(MBEDTLS_AESNI_C))) -#error "MBEDTLS_AES_USE_HARDWARE_ONLY defined, but not all prerequisites" -#endif -#endif -#endif /* 0 */ - -#if defined(MBEDTLS_AESNI_C) -#include "aesni.h" -#endif -#if defined(MBEDTLS_AESCE_C) -#include "aesce.h" -#endif - -#include "mbedtls/platform.h" -#include "ctr.h" - -/* - * This is a convenience shorthand macro to check if we need reverse S-box and - * reverse tables. It's private and only defined in this file. - */ -#if !defined(MBEDTLS_BLOCK_CIPHER_NO_DECRYPT) -#define MBEDTLS_AES_NEED_REVERSE_TABLES -#endif - -#if defined(MBEDTLS_AES_ROM_TABLES) -/* - * Forward S-box - */ -MBEDTLS_MAYBE_UNUSED static const unsigned char FSb[256] = -{ - 0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, - 0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76, - 0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, - 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0, - 0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC, - 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15, - 0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, - 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75, - 0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0, - 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84, - 0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, - 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF, - 0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, - 0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8, - 0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5, - 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2, - 0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17, - 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73, - 0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, - 0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB, - 0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C, - 0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79, - 0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9, - 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08, - 0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, - 0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A, - 0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E, - 0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E, - 0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94, - 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF, - 0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, - 0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16 -}; - -/* - * Forward tables - */ -#define FT \ -\ - V(A5, 63, 63, C6), V(84, 7C, 7C, F8), V(99, 77, 77, EE), V(8D, 7B, 7B, F6), \ - V(0D, F2, F2, FF), V(BD, 6B, 6B, D6), V(B1, 6F, 6F, DE), V(54, C5, C5, 91), \ - V(50, 30, 30, 60), V(03, 01, 01, 02), V(A9, 67, 67, CE), V(7D, 2B, 2B, 56), \ - V(19, FE, FE, E7), V(62, D7, D7, B5), V(E6, AB, AB, 4D), V(9A, 76, 76, EC), \ - V(45, CA, CA, 8F), V(9D, 82, 82, 1F), V(40, C9, C9, 89), V(87, 7D, 7D, FA), \ - V(15, FA, FA, EF), V(EB, 59, 59, B2), V(C9, 47, 47, 8E), V(0B, F0, F0, FB), \ - V(EC, AD, AD, 41), V(67, D4, D4, B3), V(FD, A2, A2, 5F), V(EA, AF, AF, 45), \ - V(BF, 9C, 9C, 23), V(F7, A4, A4, 53), V(96, 72, 72, E4), V(5B, C0, C0, 9B), \ - V(C2, B7, B7, 75), V(1C, FD, FD, E1), V(AE, 93, 93, 3D), V(6A, 26, 26, 4C), \ - V(5A, 36, 36, 6C), V(41, 3F, 3F, 7E), V(02, F7, F7, F5), V(4F, CC, CC, 83), \ - V(5C, 34, 34, 68), V(F4, A5, A5, 51), V(34, E5, E5, D1), V(08, F1, F1, F9), \ - V(93, 71, 71, E2), V(73, D8, D8, AB), V(53, 31, 31, 62), V(3F, 15, 15, 2A), \ - V(0C, 04, 04, 08), V(52, C7, C7, 95), V(65, 23, 23, 46), V(5E, C3, C3, 9D), \ - V(28, 18, 18, 30), V(A1, 96, 96, 37), V(0F, 05, 05, 0A), V(B5, 9A, 9A, 2F), \ - V(09, 07, 07, 0E), V(36, 12, 12, 24), V(9B, 80, 80, 1B), V(3D, E2, E2, DF), \ - V(26, EB, EB, CD), V(69, 27, 27, 4E), V(CD, B2, B2, 7F), V(9F, 75, 75, EA), \ - V(1B, 09, 09, 12), V(9E, 83, 83, 1D), V(74, 2C, 2C, 58), V(2E, 1A, 1A, 34), \ - V(2D, 1B, 1B, 36), V(B2, 6E, 6E, DC), V(EE, 5A, 5A, B4), V(FB, A0, A0, 5B), \ - V(F6, 52, 52, A4), V(4D, 3B, 3B, 76), V(61, D6, D6, B7), V(CE, B3, B3, 7D), \ - V(7B, 29, 29, 52), V(3E, E3, E3, DD), V(71, 2F, 2F, 5E), V(97, 84, 84, 13), \ - V(F5, 53, 53, A6), V(68, D1, D1, B9), V(00, 00, 00, 00), V(2C, ED, ED, C1), \ - V(60, 20, 20, 40), V(1F, FC, FC, E3), V(C8, B1, B1, 79), V(ED, 5B, 5B, B6), \ - V(BE, 6A, 6A, D4), V(46, CB, CB, 8D), V(D9, BE, BE, 67), V(4B, 39, 39, 72), \ - V(DE, 4A, 4A, 94), V(D4, 4C, 4C, 98), V(E8, 58, 58, B0), V(4A, CF, CF, 85), \ - V(6B, D0, D0, BB), V(2A, EF, EF, C5), V(E5, AA, AA, 4F), V(16, FB, FB, ED), \ - V(C5, 43, 43, 86), V(D7, 4D, 4D, 9A), V(55, 33, 33, 66), V(94, 85, 85, 11), \ - V(CF, 45, 45, 8A), V(10, F9, F9, E9), V(06, 02, 02, 04), V(81, 7F, 7F, FE), \ - V(F0, 50, 50, A0), V(44, 3C, 3C, 78), V(BA, 9F, 9F, 25), V(E3, A8, A8, 4B), \ - V(F3, 51, 51, A2), V(FE, A3, A3, 5D), V(C0, 40, 40, 80), V(8A, 8F, 8F, 05), \ - V(AD, 92, 92, 3F), V(BC, 9D, 9D, 21), V(48, 38, 38, 70), V(04, F5, F5, F1), \ - V(DF, BC, BC, 63), V(C1, B6, B6, 77), V(75, DA, DA, AF), V(63, 21, 21, 42), \ - V(30, 10, 10, 20), V(1A, FF, FF, E5), V(0E, F3, F3, FD), V(6D, D2, D2, BF), \ - V(4C, CD, CD, 81), V(14, 0C, 0C, 18), V(35, 13, 13, 26), V(2F, EC, EC, C3), \ - V(E1, 5F, 5F, BE), V(A2, 97, 97, 35), V(CC, 44, 44, 88), V(39, 17, 17, 2E), \ - V(57, C4, C4, 93), V(F2, A7, A7, 55), V(82, 7E, 7E, FC), V(47, 3D, 3D, 7A), \ - V(AC, 64, 64, C8), V(E7, 5D, 5D, BA), V(2B, 19, 19, 32), V(95, 73, 73, E6), \ - V(A0, 60, 60, C0), V(98, 81, 81, 19), V(D1, 4F, 4F, 9E), V(7F, DC, DC, A3), \ - V(66, 22, 22, 44), V(7E, 2A, 2A, 54), V(AB, 90, 90, 3B), V(83, 88, 88, 0B), \ - V(CA, 46, 46, 8C), V(29, EE, EE, C7), V(D3, B8, B8, 6B), V(3C, 14, 14, 28), \ - V(79, DE, DE, A7), V(E2, 5E, 5E, BC), V(1D, 0B, 0B, 16), V(76, DB, DB, AD), \ - V(3B, E0, E0, DB), V(56, 32, 32, 64), V(4E, 3A, 3A, 74), V(1E, 0A, 0A, 14), \ - V(DB, 49, 49, 92), V(0A, 06, 06, 0C), V(6C, 24, 24, 48), V(E4, 5C, 5C, B8), \ - V(5D, C2, C2, 9F), V(6E, D3, D3, BD), V(EF, AC, AC, 43), V(A6, 62, 62, C4), \ - V(A8, 91, 91, 39), V(A4, 95, 95, 31), V(37, E4, E4, D3), V(8B, 79, 79, F2), \ - V(32, E7, E7, D5), V(43, C8, C8, 8B), V(59, 37, 37, 6E), V(B7, 6D, 6D, DA), \ - V(8C, 8D, 8D, 01), V(64, D5, D5, B1), V(D2, 4E, 4E, 9C), V(E0, A9, A9, 49), \ - V(B4, 6C, 6C, D8), V(FA, 56, 56, AC), V(07, F4, F4, F3), V(25, EA, EA, CF), \ - V(AF, 65, 65, CA), V(8E, 7A, 7A, F4), V(E9, AE, AE, 47), V(18, 08, 08, 10), \ - V(D5, BA, BA, 6F), V(88, 78, 78, F0), V(6F, 25, 25, 4A), V(72, 2E, 2E, 5C), \ - V(24, 1C, 1C, 38), V(F1, A6, A6, 57), V(C7, B4, B4, 73), V(51, C6, C6, 97), \ - V(23, E8, E8, CB), V(7C, DD, DD, A1), V(9C, 74, 74, E8), V(21, 1F, 1F, 3E), \ - V(DD, 4B, 4B, 96), V(DC, BD, BD, 61), V(86, 8B, 8B, 0D), V(85, 8A, 8A, 0F), \ - V(90, 70, 70, E0), V(42, 3E, 3E, 7C), V(C4, B5, B5, 71), V(AA, 66, 66, CC), \ - V(D8, 48, 48, 90), V(05, 03, 03, 06), V(01, F6, F6, F7), V(12, 0E, 0E, 1C), \ - V(A3, 61, 61, C2), V(5F, 35, 35, 6A), V(F9, 57, 57, AE), V(D0, B9, B9, 69), \ - V(91, 86, 86, 17), V(58, C1, C1, 99), V(27, 1D, 1D, 3A), V(B9, 9E, 9E, 27), \ - V(38, E1, E1, D9), V(13, F8, F8, EB), V(B3, 98, 98, 2B), V(33, 11, 11, 22), \ - V(BB, 69, 69, D2), V(70, D9, D9, A9), V(89, 8E, 8E, 07), V(A7, 94, 94, 33), \ - V(B6, 9B, 9B, 2D), V(22, 1E, 1E, 3C), V(92, 87, 87, 15), V(20, E9, E9, C9), \ - V(49, CE, CE, 87), V(FF, 55, 55, AA), V(78, 28, 28, 50), V(7A, DF, DF, A5), \ - V(8F, 8C, 8C, 03), V(F8, A1, A1, 59), V(80, 89, 89, 09), V(17, 0D, 0D, 1A), \ - V(DA, BF, BF, 65), V(31, E6, E6, D7), V(C6, 42, 42, 84), V(B8, 68, 68, D0), \ - V(C3, 41, 41, 82), V(B0, 99, 99, 29), V(77, 2D, 2D, 5A), V(11, 0F, 0F, 1E), \ - V(CB, B0, B0, 7B), V(FC, 54, 54, A8), V(D6, BB, BB, 6D), V(3A, 16, 16, 2C) - -#define V(a, b, c, d) 0x##a##b##c##d -MBEDTLS_MAYBE_UNUSED static const uint32_t FT0[256] = { FT }; -#undef V - -#define V(a, b, c, d) 0x##b##c##d##a -MBEDTLS_MAYBE_UNUSED static const uint32_t FT1[256] = { FT }; -#undef V - -#define V(a, b, c, d) 0x##c##d##a##b -MBEDTLS_MAYBE_UNUSED static const uint32_t FT2[256] = { FT }; -#undef V - -#define V(a, b, c, d) 0x##d##a##b##c -MBEDTLS_MAYBE_UNUSED static const uint32_t FT3[256] = { FT }; -#undef V - -#undef FT - -/* - * Reverse S-box - */ -MBEDTLS_MAYBE_UNUSED static const unsigned char RSb[256] = -{ - 0x52, 0x09, 0x6A, 0xD5, 0x30, 0x36, 0xA5, 0x38, - 0xBF, 0x40, 0xA3, 0x9E, 0x81, 0xF3, 0xD7, 0xFB, - 0x7C, 0xE3, 0x39, 0x82, 0x9B, 0x2F, 0xFF, 0x87, - 0x34, 0x8E, 0x43, 0x44, 0xC4, 0xDE, 0xE9, 0xCB, - 0x54, 0x7B, 0x94, 0x32, 0xA6, 0xC2, 0x23, 0x3D, - 0xEE, 0x4C, 0x95, 0x0B, 0x42, 0xFA, 0xC3, 0x4E, - 0x08, 0x2E, 0xA1, 0x66, 0x28, 0xD9, 0x24, 0xB2, - 0x76, 0x5B, 0xA2, 0x49, 0x6D, 0x8B, 0xD1, 0x25, - 0x72, 0xF8, 0xF6, 0x64, 0x86, 0x68, 0x98, 0x16, - 0xD4, 0xA4, 0x5C, 0xCC, 0x5D, 0x65, 0xB6, 0x92, - 0x6C, 0x70, 0x48, 0x50, 0xFD, 0xED, 0xB9, 0xDA, - 0x5E, 0x15, 0x46, 0x57, 0xA7, 0x8D, 0x9D, 0x84, - 0x90, 0xD8, 0xAB, 0x00, 0x8C, 0xBC, 0xD3, 0x0A, - 0xF7, 0xE4, 0x58, 0x05, 0xB8, 0xB3, 0x45, 0x06, - 0xD0, 0x2C, 0x1E, 0x8F, 0xCA, 0x3F, 0x0F, 0x02, - 0xC1, 0xAF, 0xBD, 0x03, 0x01, 0x13, 0x8A, 0x6B, - 0x3A, 0x91, 0x11, 0x41, 0x4F, 0x67, 0xDC, 0xEA, - 0x97, 0xF2, 0xCF, 0xCE, 0xF0, 0xB4, 0xE6, 0x73, - 0x96, 0xAC, 0x74, 0x22, 0xE7, 0xAD, 0x35, 0x85, - 0xE2, 0xF9, 0x37, 0xE8, 0x1C, 0x75, 0xDF, 0x6E, - 0x47, 0xF1, 0x1A, 0x71, 0x1D, 0x29, 0xC5, 0x89, - 0x6F, 0xB7, 0x62, 0x0E, 0xAA, 0x18, 0xBE, 0x1B, - 0xFC, 0x56, 0x3E, 0x4B, 0xC6, 0xD2, 0x79, 0x20, - 0x9A, 0xDB, 0xC0, 0xFE, 0x78, 0xCD, 0x5A, 0xF4, - 0x1F, 0xDD, 0xA8, 0x33, 0x88, 0x07, 0xC7, 0x31, - 0xB1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xEC, 0x5F, - 0x60, 0x51, 0x7F, 0xA9, 0x19, 0xB5, 0x4A, 0x0D, - 0x2D, 0xE5, 0x7A, 0x9F, 0x93, 0xC9, 0x9C, 0xEF, - 0xA0, 0xE0, 0x3B, 0x4D, 0xAE, 0x2A, 0xF5, 0xB0, - 0xC8, 0xEB, 0xBB, 0x3C, 0x83, 0x53, 0x99, 0x61, - 0x17, 0x2B, 0x04, 0x7E, 0xBA, 0x77, 0xD6, 0x26, - 0xE1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0C, 0x7D -}; - -/* - * Reverse tables - */ -#define RT \ -\ - V(50, A7, F4, 51), V(53, 65, 41, 7E), V(C3, A4, 17, 1A), V(96, 5E, 27, 3A), \ - V(CB, 6B, AB, 3B), V(F1, 45, 9D, 1F), V(AB, 58, FA, AC), V(93, 03, E3, 4B), \ - V(55, FA, 30, 20), V(F6, 6D, 76, AD), V(91, 76, CC, 88), V(25, 4C, 02, F5), \ - V(FC, D7, E5, 4F), V(D7, CB, 2A, C5), V(80, 44, 35, 26), V(8F, A3, 62, B5), \ - V(49, 5A, B1, DE), V(67, 1B, BA, 25), V(98, 0E, EA, 45), V(E1, C0, FE, 5D), \ - V(02, 75, 2F, C3), V(12, F0, 4C, 81), V(A3, 97, 46, 8D), V(C6, F9, D3, 6B), \ - V(E7, 5F, 8F, 03), V(95, 9C, 92, 15), V(EB, 7A, 6D, BF), V(DA, 59, 52, 95), \ - V(2D, 83, BE, D4), V(D3, 21, 74, 58), V(29, 69, E0, 49), V(44, C8, C9, 8E), \ - V(6A, 89, C2, 75), V(78, 79, 8E, F4), V(6B, 3E, 58, 99), V(DD, 71, B9, 27), \ - V(B6, 4F, E1, BE), V(17, AD, 88, F0), V(66, AC, 20, C9), V(B4, 3A, CE, 7D), \ - V(18, 4A, DF, 63), V(82, 31, 1A, E5), V(60, 33, 51, 97), V(45, 7F, 53, 62), \ - V(E0, 77, 64, B1), V(84, AE, 6B, BB), V(1C, A0, 81, FE), V(94, 2B, 08, F9), \ - V(58, 68, 48, 70), V(19, FD, 45, 8F), V(87, 6C, DE, 94), V(B7, F8, 7B, 52), \ - V(23, D3, 73, AB), V(E2, 02, 4B, 72), V(57, 8F, 1F, E3), V(2A, AB, 55, 66), \ - V(07, 28, EB, B2), V(03, C2, B5, 2F), V(9A, 7B, C5, 86), V(A5, 08, 37, D3), \ - V(F2, 87, 28, 30), V(B2, A5, BF, 23), V(BA, 6A, 03, 02), V(5C, 82, 16, ED), \ - V(2B, 1C, CF, 8A), V(92, B4, 79, A7), V(F0, F2, 07, F3), V(A1, E2, 69, 4E), \ - V(CD, F4, DA, 65), V(D5, BE, 05, 06), V(1F, 62, 34, D1), V(8A, FE, A6, C4), \ - V(9D, 53, 2E, 34), V(A0, 55, F3, A2), V(32, E1, 8A, 05), V(75, EB, F6, A4), \ - V(39, EC, 83, 0B), V(AA, EF, 60, 40), V(06, 9F, 71, 5E), V(51, 10, 6E, BD), \ - V(F9, 8A, 21, 3E), V(3D, 06, DD, 96), V(AE, 05, 3E, DD), V(46, BD, E6, 4D), \ - V(B5, 8D, 54, 91), V(05, 5D, C4, 71), V(6F, D4, 06, 04), V(FF, 15, 50, 60), \ - V(24, FB, 98, 19), V(97, E9, BD, D6), V(CC, 43, 40, 89), V(77, 9E, D9, 67), \ - V(BD, 42, E8, B0), V(88, 8B, 89, 07), V(38, 5B, 19, E7), V(DB, EE, C8, 79), \ - V(47, 0A, 7C, A1), V(E9, 0F, 42, 7C), V(C9, 1E, 84, F8), V(00, 00, 00, 00), \ - V(83, 86, 80, 09), V(48, ED, 2B, 32), V(AC, 70, 11, 1E), V(4E, 72, 5A, 6C), \ - V(FB, FF, 0E, FD), V(56, 38, 85, 0F), V(1E, D5, AE, 3D), V(27, 39, 2D, 36), \ - V(64, D9, 0F, 0A), V(21, A6, 5C, 68), V(D1, 54, 5B, 9B), V(3A, 2E, 36, 24), \ - V(B1, 67, 0A, 0C), V(0F, E7, 57, 93), V(D2, 96, EE, B4), V(9E, 91, 9B, 1B), \ - V(4F, C5, C0, 80), V(A2, 20, DC, 61), V(69, 4B, 77, 5A), V(16, 1A, 12, 1C), \ - V(0A, BA, 93, E2), V(E5, 2A, A0, C0), V(43, E0, 22, 3C), V(1D, 17, 1B, 12), \ - V(0B, 0D, 09, 0E), V(AD, C7, 8B, F2), V(B9, A8, B6, 2D), V(C8, A9, 1E, 14), \ - V(85, 19, F1, 57), V(4C, 07, 75, AF), V(BB, DD, 99, EE), V(FD, 60, 7F, A3), \ - V(9F, 26, 01, F7), V(BC, F5, 72, 5C), V(C5, 3B, 66, 44), V(34, 7E, FB, 5B), \ - V(76, 29, 43, 8B), V(DC, C6, 23, CB), V(68, FC, ED, B6), V(63, F1, E4, B8), \ - V(CA, DC, 31, D7), V(10, 85, 63, 42), V(40, 22, 97, 13), V(20, 11, C6, 84), \ - V(7D, 24, 4A, 85), V(F8, 3D, BB, D2), V(11, 32, F9, AE), V(6D, A1, 29, C7), \ - V(4B, 2F, 9E, 1D), V(F3, 30, B2, DC), V(EC, 52, 86, 0D), V(D0, E3, C1, 77), \ - V(6C, 16, B3, 2B), V(99, B9, 70, A9), V(FA, 48, 94, 11), V(22, 64, E9, 47), \ - V(C4, 8C, FC, A8), V(1A, 3F, F0, A0), V(D8, 2C, 7D, 56), V(EF, 90, 33, 22), \ - V(C7, 4E, 49, 87), V(C1, D1, 38, D9), V(FE, A2, CA, 8C), V(36, 0B, D4, 98), \ - V(CF, 81, F5, A6), V(28, DE, 7A, A5), V(26, 8E, B7, DA), V(A4, BF, AD, 3F), \ - V(E4, 9D, 3A, 2C), V(0D, 92, 78, 50), V(9B, CC, 5F, 6A), V(62, 46, 7E, 54), \ - V(C2, 13, 8D, F6), V(E8, B8, D8, 90), V(5E, F7, 39, 2E), V(F5, AF, C3, 82), \ - V(BE, 80, 5D, 9F), V(7C, 93, D0, 69), V(A9, 2D, D5, 6F), V(B3, 12, 25, CF), \ - V(3B, 99, AC, C8), V(A7, 7D, 18, 10), V(6E, 63, 9C, E8), V(7B, BB, 3B, DB), \ - V(09, 78, 26, CD), V(F4, 18, 59, 6E), V(01, B7, 9A, EC), V(A8, 9A, 4F, 83), \ - V(65, 6E, 95, E6), V(7E, E6, FF, AA), V(08, CF, BC, 21), V(E6, E8, 15, EF), \ - V(D9, 9B, E7, BA), V(CE, 36, 6F, 4A), V(D4, 09, 9F, EA), V(D6, 7C, B0, 29), \ - V(AF, B2, A4, 31), V(31, 23, 3F, 2A), V(30, 94, A5, C6), V(C0, 66, A2, 35), \ - V(37, BC, 4E, 74), V(A6, CA, 82, FC), V(B0, D0, 90, E0), V(15, D8, A7, 33), \ - V(4A, 98, 04, F1), V(F7, DA, EC, 41), V(0E, 50, CD, 7F), V(2F, F6, 91, 17), \ - V(8D, D6, 4D, 76), V(4D, B0, EF, 43), V(54, 4D, AA, CC), V(DF, 04, 96, E4), \ - V(E3, B5, D1, 9E), V(1B, 88, 6A, 4C), V(B8, 1F, 2C, C1), V(7F, 51, 65, 46), \ - V(04, EA, 5E, 9D), V(5D, 35, 8C, 01), V(73, 74, 87, FA), V(2E, 41, 0B, FB), \ - V(5A, 1D, 67, B3), V(52, D2, DB, 92), V(33, 56, 10, E9), V(13, 47, D6, 6D), \ - V(8C, 61, D7, 9A), V(7A, 0C, A1, 37), V(8E, 14, F8, 59), V(89, 3C, 13, EB), \ - V(EE, 27, A9, CE), V(35, C9, 61, B7), V(ED, E5, 1C, E1), V(3C, B1, 47, 7A), \ - V(59, DF, D2, 9C), V(3F, 73, F2, 55), V(79, CE, 14, 18), V(BF, 37, C7, 73), \ - V(EA, CD, F7, 53), V(5B, AA, FD, 5F), V(14, 6F, 3D, DF), V(86, DB, 44, 78), \ - V(81, F3, AF, CA), V(3E, C4, 68, B9), V(2C, 34, 24, 38), V(5F, 40, A3, C2), \ - V(72, C3, 1D, 16), V(0C, 25, E2, BC), V(8B, 49, 3C, 28), V(41, 95, 0D, FF), \ - V(71, 01, A8, 39), V(DE, B3, 0C, 08), V(9C, E4, B4, D8), V(90, C1, 56, 64), \ - V(61, 84, CB, 7B), V(70, B6, 32, D5), V(74, 5C, 6C, 48), V(42, 57, B8, D0) - - -#define V(a, b, c, d) 0x##a##b##c##d -MBEDTLS_MAYBE_UNUSED static const uint32_t RT0[256] = { RT }; -#undef V - -#define V(a, b, c, d) 0x##b##c##d##a -MBEDTLS_MAYBE_UNUSED static const uint32_t RT1[256] = { RT }; -#undef V - -#define V(a, b, c, d) 0x##c##d##a##b -MBEDTLS_MAYBE_UNUSED static const uint32_t RT2[256] = { RT }; -#undef V - -#define V(a, b, c, d) 0x##d##a##b##c -MBEDTLS_MAYBE_UNUSED static const uint32_t RT3[256] = { RT }; -#undef V - -#undef RT - -/* - * Round constants - */ -MBEDTLS_MAYBE_UNUSED static const uint32_t round_constants[10] = -{ - 0x00000001, 0x00000002, 0x00000004, 0x00000008, - 0x00000010, 0x00000020, 0x00000040, 0x00000080, - 0x0000001B, 0x00000036 -}; - -#else /* MBEDTLS_AES_ROM_TABLES */ - -/* - * Forward S-box & tables - */ -MBEDTLS_MAYBE_UNUSED static unsigned char FSb[256]; -MBEDTLS_MAYBE_UNUSED static uint32_t FT0[256]; -MBEDTLS_MAYBE_UNUSED static uint32_t FT1[256]; -MBEDTLS_MAYBE_UNUSED static uint32_t FT2[256]; -MBEDTLS_MAYBE_UNUSED static uint32_t FT3[256]; - -/* - * Reverse S-box & tables - */ -MBEDTLS_MAYBE_UNUSED static unsigned char RSb[256]; - -MBEDTLS_MAYBE_UNUSED static uint32_t RT0[256]; -MBEDTLS_MAYBE_UNUSED static uint32_t RT1[256]; -MBEDTLS_MAYBE_UNUSED static uint32_t RT2[256]; -MBEDTLS_MAYBE_UNUSED static uint32_t RT3[256]; - -/* - * Round constants - */ -MBEDTLS_MAYBE_UNUSED static uint32_t round_constants[10]; - -/* - * Tables generation code - */ -#define ROTL8(x) (((x) << 8) & 0xFFFFFFFF) | ((x) >> 24) -#define XTIME(x) (((x) << 1) ^ (((x) & 0x80) ? 0x1B : 0x00)) -#define MUL(x, y) (((x) && (y)) ? pow[(log[(x)]+log[(y)]) % 255] : 0) - -MBEDTLS_MAYBE_UNUSED static int aes_init_done = 0; - -MBEDTLS_MAYBE_UNUSED static void aes_gen_tables(void) -{ - int i; - uint8_t x, y, z; - uint8_t pow[256]; - uint8_t log[256]; - - /* - * compute pow and log tables over GF(2^8) - */ - for (i = 0, x = 1; i < 256; i++) { - pow[i] = x; - log[x] = (uint8_t) i; - x ^= XTIME(x); - } - - /* - * calculate the round constants - */ - for (i = 0, x = 1; i < 10; i++) { - round_constants[i] = x; - x = XTIME(x); - } - - /* - * generate the forward and reverse S-boxes - */ - FSb[0x00] = 0x63; -#if defined(MBEDTLS_AES_NEED_REVERSE_TABLES) - RSb[0x63] = 0x00; -#endif - - for (i = 1; i < 256; i++) { - x = pow[255 - log[i]]; - - y = x; y = (y << 1) | (y >> 7); - x ^= y; y = (y << 1) | (y >> 7); - x ^= y; y = (y << 1) | (y >> 7); - x ^= y; y = (y << 1) | (y >> 7); - x ^= y ^ 0x63; - - FSb[i] = x; -#if defined(MBEDTLS_AES_NEED_REVERSE_TABLES) - RSb[x] = (unsigned char) i; -#endif - } - - /* - * generate the forward and reverse tables - */ - for (i = 0; i < 256; i++) { - x = FSb[i]; - y = XTIME(x); - z = y ^ x; - - FT0[i] = ((uint32_t) y) ^ - ((uint32_t) x << 8) ^ - ((uint32_t) x << 16) ^ - ((uint32_t) z << 24); - -#if !defined(MBEDTLS_AES_FEWER_TABLES) - FT1[i] = ROTL8(FT0[i]); - FT2[i] = ROTL8(FT1[i]); - FT3[i] = ROTL8(FT2[i]); -#endif /* !MBEDTLS_AES_FEWER_TABLES */ - -#if defined(MBEDTLS_AES_NEED_REVERSE_TABLES) - x = RSb[i]; - - RT0[i] = ((uint32_t) MUL(0x0E, x)) ^ - ((uint32_t) MUL(0x09, x) << 8) ^ - ((uint32_t) MUL(0x0D, x) << 16) ^ - ((uint32_t) MUL(0x0B, x) << 24); - -#if !defined(MBEDTLS_AES_FEWER_TABLES) - RT1[i] = ROTL8(RT0[i]); - RT2[i] = ROTL8(RT1[i]); - RT3[i] = ROTL8(RT2[i]); -#endif /* !MBEDTLS_AES_FEWER_TABLES */ -#endif /* MBEDTLS_AES_NEED_REVERSE_TABLES */ - } -} - -#undef ROTL8 - -#endif /* MBEDTLS_AES_ROM_TABLES */ - -#if defined(MBEDTLS_AES_FEWER_TABLES) - -#define ROTL8(x) ((uint32_t) ((x) << 8) + (uint32_t) ((x) >> 24)) -#define ROTL16(x) ((uint32_t) ((x) << 16) + (uint32_t) ((x) >> 16)) -#define ROTL24(x) ((uint32_t) ((x) << 24) + (uint32_t) ((x) >> 8)) - -#define AES_RT0(idx) RT0[idx] -#define AES_RT1(idx) ROTL8(RT0[idx]) -#define AES_RT2(idx) ROTL16(RT0[idx]) -#define AES_RT3(idx) ROTL24(RT0[idx]) - -#define AES_FT0(idx) FT0[idx] -#define AES_FT1(idx) ROTL8(FT0[idx]) -#define AES_FT2(idx) ROTL16(FT0[idx]) -#define AES_FT3(idx) ROTL24(FT0[idx]) - -#else /* MBEDTLS_AES_FEWER_TABLES */ - -#define AES_RT0(idx) RT0[idx] -#define AES_RT1(idx) RT1[idx] -#define AES_RT2(idx) RT2[idx] -#define AES_RT3(idx) RT3[idx] - -#define AES_FT0(idx) FT0[idx] -#define AES_FT1(idx) FT1[idx] -#define AES_FT2(idx) FT2[idx] -#define AES_FT3(idx) FT3[idx] - -#endif /* MBEDTLS_AES_FEWER_TABLES */ - -void mbedtls_aes_init(mbedtls_aes_context *ctx) -{ - memset(ctx, 0, sizeof(mbedtls_aes_context)); -} - -void mbedtls_aes_free(mbedtls_aes_context *ctx) -{ - if (ctx == NULL) { - return; - } - - mbedtls_platform_zeroize(ctx, sizeof(mbedtls_aes_context)); -} - -mbedtls_aes_implementation mbedtls_aes_get_implementation(void) -{ -#if defined(MBEDTLS_AESNI_HAVE_CODE) - if (mbedtls_aesni_has_support(MBEDTLS_AESNI_AES)) { -#if MBEDTLS_AESNI_HAVE_CODE == 1 - return MBEDTLS_AES_IMP_AESNI_ASM; -#elif MBEDTLS_AESNI_HAVE_CODE == 2 - return MBEDTLS_AES_IMP_AESNI_INTRINSICS; -#endif /* MBEDTLS_AESNI_HAVE_CODE == 1 || 2 */ - } -#endif /* MBEDTLS_AESNI_HAVE_CODE */ - -#if defined(MBEDTLS_AESCE_HAVE_CODE) - if (MBEDTLS_AESCE_HAS_SUPPORT()) { - return MBEDTLS_AES_IMP_AESCE; - } -#endif - -#if !defined(MBEDTLS_AES_USE_HARDWARE_ONLY) - return MBEDTLS_AES_IMP_SOFTWARE; -#endif - return MBEDTLS_AES_IMP_UNKNOWN; -} - -#if defined(MBEDTLS_CIPHER_MODE_XTS) -void mbedtls_aes_xts_init(mbedtls_aes_xts_context *ctx) -{ - mbedtls_aes_init(&ctx->crypt); - mbedtls_aes_init(&ctx->tweak); -} - -void mbedtls_aes_xts_free(mbedtls_aes_xts_context *ctx) -{ - if (ctx == NULL) { - return; - } - - mbedtls_aes_free(&ctx->crypt); - mbedtls_aes_free(&ctx->tweak); -} -#endif /* MBEDTLS_CIPHER_MODE_XTS */ - -/* Some implementations need the round keys to be aligned. - * Return an offset to be added to buf, such that (buf + offset) is - * correctly aligned. - * Note that the offset is in units of elements of buf, i.e. 32-bit words, - * i.e. an offset of 1 means 4 bytes and so on. - */ -#if defined(MBEDTLS_AESNI_C) && MBEDTLS_AESNI_HAVE_CODE == 2 -#define MAY_NEED_TO_ALIGN -#endif - -MBEDTLS_MAYBE_UNUSED static unsigned mbedtls_aes_rk_offset(uint32_t *buf) -{ -#if defined(MAY_NEED_TO_ALIGN) - int align_16_bytes = 0; - -#if defined(MBEDTLS_AESNI_C) && MBEDTLS_AESNI_HAVE_CODE == 2 - if (mbedtls_aesni_has_support(MBEDTLS_AESNI_AES)) { - align_16_bytes = 1; - } -#endif - - if (align_16_bytes) { - /* These implementations needs 16-byte alignment - * for the round key array. */ - unsigned delta = ((uintptr_t) buf & 0x0000000fU) / 4; - if (delta == 0) { - return 0; - } else { - return 4 - delta; // 16 bytes = 4 uint32_t - } - } -#else /* MAY_NEED_TO_ALIGN */ - (void) buf; -#endif /* MAY_NEED_TO_ALIGN */ - - return 0; -} - -/* - * AES key schedule (encryption) - */ -int mbedtls_aes_setkey_enc(mbedtls_aes_context *ctx, const unsigned char *key, - unsigned int keybits) -{ - uint32_t *RK; - - switch (keybits) { - case 128: ctx->nr = 10; break; -#if !defined(MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH) - case 192: ctx->nr = 12; break; - case 256: ctx->nr = 14; break; -#endif /* !MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH */ - default: return MBEDTLS_ERR_AES_INVALID_KEY_LENGTH; - } - -#if !defined(MBEDTLS_AES_ROM_TABLES) - if (aes_init_done == 0) { - aes_gen_tables(); - aes_init_done = 1; - } -#endif - - ctx->rk_offset = mbedtls_aes_rk_offset(ctx->buf); - RK = ctx->buf + ctx->rk_offset; - -#if defined(MBEDTLS_AESNI_HAVE_CODE) - if (mbedtls_aesni_has_support(MBEDTLS_AESNI_AES)) { - return mbedtls_aesni_setkey_enc((unsigned char *) RK, key, keybits); - } -#endif - -#if defined(MBEDTLS_AESCE_HAVE_CODE) - if (MBEDTLS_AESCE_HAS_SUPPORT()) { - return mbedtls_aesce_setkey_enc((unsigned char *) RK, key, keybits); - } -#endif - -#if !defined(MBEDTLS_AES_USE_HARDWARE_ONLY) - for (unsigned int i = 0; i < (keybits >> 5); i++) { - RK[i] = MBEDTLS_GET_UINT32_LE(key, i << 2); - } - - switch (ctx->nr) { - case 10: - - for (unsigned int i = 0; i < 10; i++, RK += 4) { - RK[4] = RK[0] ^ round_constants[i] ^ - ((uint32_t) FSb[MBEDTLS_BYTE_1(RK[3])]) ^ - ((uint32_t) FSb[MBEDTLS_BYTE_2(RK[3])] << 8) ^ - ((uint32_t) FSb[MBEDTLS_BYTE_3(RK[3])] << 16) ^ - ((uint32_t) FSb[MBEDTLS_BYTE_0(RK[3])] << 24); - - RK[5] = RK[1] ^ RK[4]; - RK[6] = RK[2] ^ RK[5]; - RK[7] = RK[3] ^ RK[6]; - } - break; - -#if !defined(MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH) - case 12: - - for (unsigned int i = 0; i < 8; i++, RK += 6) { - RK[6] = RK[0] ^ round_constants[i] ^ - ((uint32_t) FSb[MBEDTLS_BYTE_1(RK[5])]) ^ - ((uint32_t) FSb[MBEDTLS_BYTE_2(RK[5])] << 8) ^ - ((uint32_t) FSb[MBEDTLS_BYTE_3(RK[5])] << 16) ^ - ((uint32_t) FSb[MBEDTLS_BYTE_0(RK[5])] << 24); - - RK[7] = RK[1] ^ RK[6]; - RK[8] = RK[2] ^ RK[7]; - RK[9] = RK[3] ^ RK[8]; - RK[10] = RK[4] ^ RK[9]; - RK[11] = RK[5] ^ RK[10]; - } - break; - - case 14: - - for (unsigned int i = 0; i < 7; i++, RK += 8) { - RK[8] = RK[0] ^ round_constants[i] ^ - ((uint32_t) FSb[MBEDTLS_BYTE_1(RK[7])]) ^ - ((uint32_t) FSb[MBEDTLS_BYTE_2(RK[7])] << 8) ^ - ((uint32_t) FSb[MBEDTLS_BYTE_3(RK[7])] << 16) ^ - ((uint32_t) FSb[MBEDTLS_BYTE_0(RK[7])] << 24); - - RK[9] = RK[1] ^ RK[8]; - RK[10] = RK[2] ^ RK[9]; - RK[11] = RK[3] ^ RK[10]; - - RK[12] = RK[4] ^ - ((uint32_t) FSb[MBEDTLS_BYTE_0(RK[11])]) ^ - ((uint32_t) FSb[MBEDTLS_BYTE_1(RK[11])] << 8) ^ - ((uint32_t) FSb[MBEDTLS_BYTE_2(RK[11])] << 16) ^ - ((uint32_t) FSb[MBEDTLS_BYTE_3(RK[11])] << 24); - - RK[13] = RK[5] ^ RK[12]; - RK[14] = RK[6] ^ RK[13]; - RK[15] = RK[7] ^ RK[14]; - } - break; -#endif /* !MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH */ - } - -#endif /* !MBEDTLS_AES_USE_HARDWARE_ONLY */ - return 0; -} - -/* - * AES key schedule (decryption) - */ -#if !defined(MBEDTLS_BLOCK_CIPHER_NO_DECRYPT) -int mbedtls_aes_setkey_dec(mbedtls_aes_context *ctx, const unsigned char *key, - unsigned int keybits) -{ -#if !defined(MBEDTLS_AES_USE_HARDWARE_ONLY) - uint32_t *SK; -#endif - int ret; - mbedtls_aes_context cty; - uint32_t *RK; - - - mbedtls_aes_init(&cty); - - ctx->rk_offset = mbedtls_aes_rk_offset(ctx->buf); - RK = ctx->buf + ctx->rk_offset; - - /* Also checks keybits */ - if ((ret = mbedtls_aes_setkey_enc(&cty, key, keybits)) != 0) { - goto exit; - } - - ctx->nr = cty.nr; - -#if defined(MBEDTLS_AESNI_HAVE_CODE) - if (mbedtls_aesni_has_support(MBEDTLS_AESNI_AES)) { - mbedtls_aesni_inverse_key((unsigned char *) RK, - (const unsigned char *) (cty.buf + cty.rk_offset), ctx->nr); - goto exit; - } -#endif - -#if defined(MBEDTLS_AESCE_HAVE_CODE) - if (MBEDTLS_AESCE_HAS_SUPPORT()) { - mbedtls_aesce_inverse_key( - (unsigned char *) RK, - (const unsigned char *) (cty.buf + cty.rk_offset), - ctx->nr); - goto exit; - } -#endif - -#if !defined(MBEDTLS_AES_USE_HARDWARE_ONLY) - SK = cty.buf + cty.rk_offset + cty.nr * 4; - - *RK++ = *SK++; - *RK++ = *SK++; - *RK++ = *SK++; - *RK++ = *SK++; - SK -= 8; - for (int i = ctx->nr - 1; i > 0; i--, SK -= 8) { - for (int j = 0; j < 4; j++, SK++) { - *RK++ = AES_RT0(FSb[MBEDTLS_BYTE_0(*SK)]) ^ - AES_RT1(FSb[MBEDTLS_BYTE_1(*SK)]) ^ - AES_RT2(FSb[MBEDTLS_BYTE_2(*SK)]) ^ - AES_RT3(FSb[MBEDTLS_BYTE_3(*SK)]); - } - } - - *RK++ = *SK++; - *RK++ = *SK++; - *RK++ = *SK++; - *RK++ = *SK++; -#endif /* !MBEDTLS_AES_USE_HARDWARE_ONLY */ -exit: - mbedtls_aes_free(&cty); - - return ret; -} -#endif /* !MBEDTLS_BLOCK_CIPHER_NO_DECRYPT */ - -#if defined(MBEDTLS_CIPHER_MODE_XTS) -static int mbedtls_aes_xts_decode_keys(const unsigned char *key, - unsigned int keybits, - const unsigned char **key1, - unsigned int *key1bits, - const unsigned char **key2, - unsigned int *key2bits) -{ - const unsigned int half_keybits = keybits / 2; - const unsigned int half_keybytes = half_keybits / 8; - - switch (keybits) { - case 256: break; - case 512: break; - default: return MBEDTLS_ERR_AES_INVALID_KEY_LENGTH; - } - - *key1bits = half_keybits; - *key2bits = half_keybits; - *key1 = &key[0]; - *key2 = &key[half_keybytes]; - - return 0; -} - -int mbedtls_aes_xts_setkey_enc(mbedtls_aes_xts_context *ctx, - const unsigned char *key, - unsigned int keybits) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - const unsigned char *key1, *key2; - unsigned int key1bits, key2bits; - - ret = mbedtls_aes_xts_decode_keys(key, keybits, &key1, &key1bits, - &key2, &key2bits); - if (ret != 0) { - return ret; - } - - /* Set the tweak key. Always set tweak key for the encryption mode. */ - ret = mbedtls_aes_setkey_enc(&ctx->tweak, key2, key2bits); - if (ret != 0) { - return ret; - } - - /* Set crypt key for encryption. */ - return mbedtls_aes_setkey_enc(&ctx->crypt, key1, key1bits); -} - -int mbedtls_aes_xts_setkey_dec(mbedtls_aes_xts_context *ctx, - const unsigned char *key, - unsigned int keybits) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - const unsigned char *key1, *key2; - unsigned int key1bits, key2bits; - - ret = mbedtls_aes_xts_decode_keys(key, keybits, &key1, &key1bits, - &key2, &key2bits); - if (ret != 0) { - return ret; - } - - /* Set the tweak key. Always set tweak key for encryption. */ - ret = mbedtls_aes_setkey_enc(&ctx->tweak, key2, key2bits); - if (ret != 0) { - return ret; - } - - /* Set crypt key for decryption. */ - return mbedtls_aes_setkey_dec(&ctx->crypt, key1, key1bits); -} -#endif /* MBEDTLS_CIPHER_MODE_XTS */ - -#define AES_FROUND(X0, X1, X2, X3, Y0, Y1, Y2, Y3) \ - do \ - { \ - (X0) = *RK++ ^ AES_FT0(MBEDTLS_BYTE_0(Y0)) ^ \ - AES_FT1(MBEDTLS_BYTE_1(Y1)) ^ \ - AES_FT2(MBEDTLS_BYTE_2(Y2)) ^ \ - AES_FT3(MBEDTLS_BYTE_3(Y3)); \ - \ - (X1) = *RK++ ^ AES_FT0(MBEDTLS_BYTE_0(Y1)) ^ \ - AES_FT1(MBEDTLS_BYTE_1(Y2)) ^ \ - AES_FT2(MBEDTLS_BYTE_2(Y3)) ^ \ - AES_FT3(MBEDTLS_BYTE_3(Y0)); \ - \ - (X2) = *RK++ ^ AES_FT0(MBEDTLS_BYTE_0(Y2)) ^ \ - AES_FT1(MBEDTLS_BYTE_1(Y3)) ^ \ - AES_FT2(MBEDTLS_BYTE_2(Y0)) ^ \ - AES_FT3(MBEDTLS_BYTE_3(Y1)); \ - \ - (X3) = *RK++ ^ AES_FT0(MBEDTLS_BYTE_0(Y3)) ^ \ - AES_FT1(MBEDTLS_BYTE_1(Y0)) ^ \ - AES_FT2(MBEDTLS_BYTE_2(Y1)) ^ \ - AES_FT3(MBEDTLS_BYTE_3(Y2)); \ - } while (0) - -#define AES_RROUND(X0, X1, X2, X3, Y0, Y1, Y2, Y3) \ - do \ - { \ - (X0) = *RK++ ^ AES_RT0(MBEDTLS_BYTE_0(Y0)) ^ \ - AES_RT1(MBEDTLS_BYTE_1(Y3)) ^ \ - AES_RT2(MBEDTLS_BYTE_2(Y2)) ^ \ - AES_RT3(MBEDTLS_BYTE_3(Y1)); \ - \ - (X1) = *RK++ ^ AES_RT0(MBEDTLS_BYTE_0(Y1)) ^ \ - AES_RT1(MBEDTLS_BYTE_1(Y0)) ^ \ - AES_RT2(MBEDTLS_BYTE_2(Y3)) ^ \ - AES_RT3(MBEDTLS_BYTE_3(Y2)); \ - \ - (X2) = *RK++ ^ AES_RT0(MBEDTLS_BYTE_0(Y2)) ^ \ - AES_RT1(MBEDTLS_BYTE_1(Y1)) ^ \ - AES_RT2(MBEDTLS_BYTE_2(Y0)) ^ \ - AES_RT3(MBEDTLS_BYTE_3(Y3)); \ - \ - (X3) = *RK++ ^ AES_RT0(MBEDTLS_BYTE_0(Y3)) ^ \ - AES_RT1(MBEDTLS_BYTE_1(Y2)) ^ \ - AES_RT2(MBEDTLS_BYTE_2(Y1)) ^ \ - AES_RT3(MBEDTLS_BYTE_3(Y0)); \ - } while (0) - -#if !defined(MBEDTLS_AES_USE_HARDWARE_ONLY) -/* - * AES-ECB block encryption - */ -MBEDTLS_CHECK_RETURN_TYPICAL -static int mbedtls_internal_aes_encrypt(mbedtls_aes_context *ctx, - const unsigned char input[16], - unsigned char output[16]) -{ - int i; - uint32_t *RK = ctx->buf + ctx->rk_offset; - struct { - uint32_t X[4]; - uint32_t Y[4]; - } t; - - t.X[0] = MBEDTLS_GET_UINT32_LE(input, 0); t.X[0] ^= *RK++; - t.X[1] = MBEDTLS_GET_UINT32_LE(input, 4); t.X[1] ^= *RK++; - t.X[2] = MBEDTLS_GET_UINT32_LE(input, 8); t.X[2] ^= *RK++; - t.X[3] = MBEDTLS_GET_UINT32_LE(input, 12); t.X[3] ^= *RK++; - - for (i = (ctx->nr >> 1) - 1; i > 0; i--) { - AES_FROUND(t.Y[0], t.Y[1], t.Y[2], t.Y[3], t.X[0], t.X[1], t.X[2], t.X[3]); - AES_FROUND(t.X[0], t.X[1], t.X[2], t.X[3], t.Y[0], t.Y[1], t.Y[2], t.Y[3]); - } - - AES_FROUND(t.Y[0], t.Y[1], t.Y[2], t.Y[3], t.X[0], t.X[1], t.X[2], t.X[3]); - - t.X[0] = *RK++ ^ \ - ((uint32_t) FSb[MBEDTLS_BYTE_0(t.Y[0])]) ^ - ((uint32_t) FSb[MBEDTLS_BYTE_1(t.Y[1])] << 8) ^ - ((uint32_t) FSb[MBEDTLS_BYTE_2(t.Y[2])] << 16) ^ - ((uint32_t) FSb[MBEDTLS_BYTE_3(t.Y[3])] << 24); - - t.X[1] = *RK++ ^ \ - ((uint32_t) FSb[MBEDTLS_BYTE_0(t.Y[1])]) ^ - ((uint32_t) FSb[MBEDTLS_BYTE_1(t.Y[2])] << 8) ^ - ((uint32_t) FSb[MBEDTLS_BYTE_2(t.Y[3])] << 16) ^ - ((uint32_t) FSb[MBEDTLS_BYTE_3(t.Y[0])] << 24); - - t.X[2] = *RK++ ^ \ - ((uint32_t) FSb[MBEDTLS_BYTE_0(t.Y[2])]) ^ - ((uint32_t) FSb[MBEDTLS_BYTE_1(t.Y[3])] << 8) ^ - ((uint32_t) FSb[MBEDTLS_BYTE_2(t.Y[0])] << 16) ^ - ((uint32_t) FSb[MBEDTLS_BYTE_3(t.Y[1])] << 24); - - t.X[3] = *RK++ ^ \ - ((uint32_t) FSb[MBEDTLS_BYTE_0(t.Y[3])]) ^ - ((uint32_t) FSb[MBEDTLS_BYTE_1(t.Y[0])] << 8) ^ - ((uint32_t) FSb[MBEDTLS_BYTE_2(t.Y[1])] << 16) ^ - ((uint32_t) FSb[MBEDTLS_BYTE_3(t.Y[2])] << 24); - - MBEDTLS_PUT_UINT32_LE(t.X[0], output, 0); - MBEDTLS_PUT_UINT32_LE(t.X[1], output, 4); - MBEDTLS_PUT_UINT32_LE(t.X[2], output, 8); - MBEDTLS_PUT_UINT32_LE(t.X[3], output, 12); - - mbedtls_platform_zeroize(&t, sizeof(t)); - - return 0; -} - -#if !defined(MBEDTLS_BLOCK_CIPHER_NO_DECRYPT) -/* - * AES-ECB block decryption - */ -MBEDTLS_CHECK_RETURN_TYPICAL -static int mbedtls_internal_aes_decrypt(mbedtls_aes_context *ctx, - const unsigned char input[16], - unsigned char output[16]) -{ - int i; - uint32_t *RK = ctx->buf + ctx->rk_offset; - struct { - uint32_t X[4]; - uint32_t Y[4]; - } t; - - t.X[0] = MBEDTLS_GET_UINT32_LE(input, 0); t.X[0] ^= *RK++; - t.X[1] = MBEDTLS_GET_UINT32_LE(input, 4); t.X[1] ^= *RK++; - t.X[2] = MBEDTLS_GET_UINT32_LE(input, 8); t.X[2] ^= *RK++; - t.X[3] = MBEDTLS_GET_UINT32_LE(input, 12); t.X[3] ^= *RK++; - - for (i = (ctx->nr >> 1) - 1; i > 0; i--) { - AES_RROUND(t.Y[0], t.Y[1], t.Y[2], t.Y[3], t.X[0], t.X[1], t.X[2], t.X[3]); - AES_RROUND(t.X[0], t.X[1], t.X[2], t.X[3], t.Y[0], t.Y[1], t.Y[2], t.Y[3]); - } - - AES_RROUND(t.Y[0], t.Y[1], t.Y[2], t.Y[3], t.X[0], t.X[1], t.X[2], t.X[3]); - - t.X[0] = *RK++ ^ \ - ((uint32_t) RSb[MBEDTLS_BYTE_0(t.Y[0])]) ^ - ((uint32_t) RSb[MBEDTLS_BYTE_1(t.Y[3])] << 8) ^ - ((uint32_t) RSb[MBEDTLS_BYTE_2(t.Y[2])] << 16) ^ - ((uint32_t) RSb[MBEDTLS_BYTE_3(t.Y[1])] << 24); - - t.X[1] = *RK++ ^ \ - ((uint32_t) RSb[MBEDTLS_BYTE_0(t.Y[1])]) ^ - ((uint32_t) RSb[MBEDTLS_BYTE_1(t.Y[0])] << 8) ^ - ((uint32_t) RSb[MBEDTLS_BYTE_2(t.Y[3])] << 16) ^ - ((uint32_t) RSb[MBEDTLS_BYTE_3(t.Y[2])] << 24); - - t.X[2] = *RK++ ^ \ - ((uint32_t) RSb[MBEDTLS_BYTE_0(t.Y[2])]) ^ - ((uint32_t) RSb[MBEDTLS_BYTE_1(t.Y[1])] << 8) ^ - ((uint32_t) RSb[MBEDTLS_BYTE_2(t.Y[0])] << 16) ^ - ((uint32_t) RSb[MBEDTLS_BYTE_3(t.Y[3])] << 24); - - t.X[3] = *RK++ ^ \ - ((uint32_t) RSb[MBEDTLS_BYTE_0(t.Y[3])]) ^ - ((uint32_t) RSb[MBEDTLS_BYTE_1(t.Y[2])] << 8) ^ - ((uint32_t) RSb[MBEDTLS_BYTE_2(t.Y[1])] << 16) ^ - ((uint32_t) RSb[MBEDTLS_BYTE_3(t.Y[0])] << 24); - - MBEDTLS_PUT_UINT32_LE(t.X[0], output, 0); - MBEDTLS_PUT_UINT32_LE(t.X[1], output, 4); - MBEDTLS_PUT_UINT32_LE(t.X[2], output, 8); - MBEDTLS_PUT_UINT32_LE(t.X[3], output, 12); - - mbedtls_platform_zeroize(&t, sizeof(t)); - - return 0; -} -#endif /* !MBEDTLS_BLOCK_CIPHER_NO_DECRYPT */ -#endif /* !MBEDTLS_AES_USE_HARDWARE_ONLY */ -/* - * Our intrinsics-based implementation of AESNI requires the round keys to be - * aligned on a 16-byte boundary. We take care of this before creating them, - * but the AES context may have moved (this can happen if the library is - * called from a language with managed memory), and in later calls it might - * have a different alignment with respect to 16-byte memory. So we may need - * to realign. - */ -#if defined(MAY_NEED_TO_ALIGN) -MBEDTLS_MAYBE_UNUSED static void aes_maybe_realign(mbedtls_aes_context *ctx) -{ - unsigned new_offset = mbedtls_aes_rk_offset(ctx->buf); - if (new_offset != ctx->rk_offset) { - memmove(ctx->buf + new_offset, // new address - ctx->buf + ctx->rk_offset, // current address - (ctx->nr + 1) * 16); // number of round keys * bytes per rk - ctx->rk_offset = new_offset; - } -} -#endif /* MAY_NEED_TO_ALIGN */ -/* - * AES-ECB block encryption/decryption - */ -int mbedtls_aes_crypt_ecb(mbedtls_aes_context *ctx, - int mode, - const unsigned char input[16], - unsigned char output[16]) -{ - if (mode != MBEDTLS_AES_ENCRYPT && mode != MBEDTLS_AES_DECRYPT) { - return MBEDTLS_ERR_AES_BAD_INPUT_DATA; - } - -#if defined(MAY_NEED_TO_ALIGN) - aes_maybe_realign(ctx); -#endif - -#if defined(MBEDTLS_AESNI_HAVE_CODE) - if (mbedtls_aesni_has_support(MBEDTLS_AESNI_AES)) { - return mbedtls_aesni_crypt_ecb(ctx, mode, input, output); - } -#endif - -#if defined(MBEDTLS_AESCE_HAVE_CODE) - if (MBEDTLS_AESCE_HAS_SUPPORT()) { - return mbedtls_aesce_crypt_ecb(ctx, mode, input, output); - } -#endif - -#if !defined(MBEDTLS_AES_USE_HARDWARE_ONLY) -#if !defined(MBEDTLS_BLOCK_CIPHER_NO_DECRYPT) - if (mode == MBEDTLS_AES_DECRYPT) { - return mbedtls_internal_aes_decrypt(ctx, input, output); - } else -#endif - { - return mbedtls_internal_aes_encrypt(ctx, input, output); - } -#endif /* !MBEDTLS_AES_USE_HARDWARE_ONLY */ - return 0; -} - -#if defined(MBEDTLS_CIPHER_MODE_CBC) - -/* - * AES-CBC buffer encryption/decryption - */ -int mbedtls_aes_crypt_cbc(mbedtls_aes_context *ctx, - int mode, - size_t length, - unsigned char iv[16], - const unsigned char *input, - unsigned char *output) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - unsigned char temp[16]; - - if (mode != MBEDTLS_AES_ENCRYPT && mode != MBEDTLS_AES_DECRYPT) { - return MBEDTLS_ERR_AES_BAD_INPUT_DATA; - } - - /* Nothing to do if length is zero. */ - if (length == 0) { - return 0; - } - - if (length % 16) { - return MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH; - } - - const unsigned char *ivp = iv; - - if (mode == MBEDTLS_AES_DECRYPT) { - while (length > 0) { - memcpy(temp, input, 16); - ret = mbedtls_aes_crypt_ecb(ctx, mode, input, output); - if (ret != 0) { - goto exit; - } - /* Avoid using the NEON implementation of mbedtls_xor. Because of the dependency on - * the result for the next block in CBC, and the cost of transferring that data from - * NEON registers, NEON is slower on aarch64. */ - mbedtls_xor_no_simd(output, output, iv, 16); - - memcpy(iv, temp, 16); - - input += 16; - output += 16; - length -= 16; - } - } else { - while (length > 0) { - mbedtls_xor_no_simd(output, input, ivp, 16); - - ret = mbedtls_aes_crypt_ecb(ctx, mode, output, output); - if (ret != 0) { - goto exit; - } - ivp = output; - - input += 16; - output += 16; - length -= 16; - } - memcpy(iv, ivp, 16); - } - ret = 0; - -exit: - return ret; -} -#endif /* MBEDTLS_CIPHER_MODE_CBC */ - -#if defined(MBEDTLS_CIPHER_MODE_XTS) - -typedef unsigned char mbedtls_be128[16]; - -/* - * GF(2^128) multiplication function - * - * This function multiplies a field element by x in the polynomial field - * representation. It uses 64-bit word operations to gain speed but compensates - * for machine endianness and hence works correctly on both big and little - * endian machines. - */ -#if defined(MBEDTLS_AESCE_C) || defined(MBEDTLS_AESNI_C) -MBEDTLS_OPTIMIZE_FOR_PERFORMANCE -#endif -static inline void mbedtls_gf128mul_x_ble(unsigned char r[16], - const unsigned char x[16]) -{ - uint64_t a, b, ra, rb; - - a = MBEDTLS_GET_UINT64_LE(x, 0); - b = MBEDTLS_GET_UINT64_LE(x, 8); - - ra = (a << 1) ^ 0x0087 >> (8 - ((b >> 63) << 3)); - rb = (a >> 63) | (b << 1); - - MBEDTLS_PUT_UINT64_LE(ra, r, 0); - MBEDTLS_PUT_UINT64_LE(rb, r, 8); -} - -/* - * AES-XTS buffer encryption/decryption - * - * Use of MBEDTLS_OPTIMIZE_FOR_PERFORMANCE here and for mbedtls_gf128mul_x_ble() - * is a 3x performance improvement for gcc -Os, if we have hardware AES support. - */ -#if defined(MBEDTLS_AESCE_C) || defined(MBEDTLS_AESNI_C) -MBEDTLS_OPTIMIZE_FOR_PERFORMANCE -#endif -int mbedtls_aes_crypt_xts(mbedtls_aes_xts_context *ctx, - int mode, - size_t length, - const unsigned char data_unit[16], - const unsigned char *input, - unsigned char *output) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - size_t blocks = length / 16; - size_t leftover = length % 16; - unsigned char tweak[16] = {0}; - unsigned char prev_tweak[16]; - unsigned char tmp[16]; - - if (mode != MBEDTLS_AES_ENCRYPT && mode != MBEDTLS_AES_DECRYPT) { - return MBEDTLS_ERR_AES_BAD_INPUT_DATA; - } - - /* Data units must be at least 16 bytes long. */ - if (length < 16) { - return MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH; - } - - /* NIST SP 800-38E disallows data units larger than 2**20 blocks. */ - if (length > (1 << 20) * 16) { - return MBEDTLS_ERR_AES_INVALID_INPUT_LENGTH; - } - - /* Compute the tweak. */ - ret = mbedtls_aes_crypt_ecb(&ctx->tweak, MBEDTLS_AES_ENCRYPT, - data_unit, tweak); - if (ret != 0) { - return ret; - } - - while (blocks--) { - if (MBEDTLS_UNLIKELY(leftover && (mode == MBEDTLS_AES_DECRYPT) && blocks == 0)) { - /* We are on the last block in a decrypt operation that has - * leftover bytes, so we need to use the next tweak for this block, - * and this tweak for the leftover bytes. Save the current tweak for - * the leftovers and then update the current tweak for use on this, - * the last full block. */ - memcpy(prev_tweak, tweak, sizeof(tweak)); - mbedtls_gf128mul_x_ble(tweak, tweak); - } - - mbedtls_xor(tmp, input, tweak, 16); - - ret = mbedtls_aes_crypt_ecb(&ctx->crypt, mode, tmp, tmp); - if (ret != 0) { - return ret; - } - - mbedtls_xor(output, tmp, tweak, 16); - - /* Update the tweak for the next block. */ - mbedtls_gf128mul_x_ble(tweak, tweak); - - output += 16; - input += 16; - } - - if (leftover) { - /* If we are on the leftover bytes in a decrypt operation, we need to - * use the previous tweak for these bytes (as saved in prev_tweak). */ - unsigned char *t = mode == MBEDTLS_AES_DECRYPT ? prev_tweak : tweak; - - /* We are now on the final part of the data unit, which doesn't divide - * evenly by 16. It's time for ciphertext stealing. */ - size_t i; - unsigned char *prev_output = output - 16; - - /* Copy ciphertext bytes from the previous block to our output for each - * byte of ciphertext we won't steal. */ - for (i = 0; i < leftover; i++) { - output[i] = prev_output[i]; - } - - /* Copy the remainder of the input for this final round. */ - mbedtls_xor(tmp, input, t, leftover); - - /* Copy ciphertext bytes from the previous block for input in this - * round. */ - mbedtls_xor(tmp + i, prev_output + i, t + i, 16 - i); - - ret = mbedtls_aes_crypt_ecb(&ctx->crypt, mode, tmp, tmp); - if (ret != 0) { - return ret; - } - - /* Write the result back to the previous block, overriding the previous - * output we copied. */ - mbedtls_xor(prev_output, tmp, t, 16); - } - - return 0; -} -#endif /* MBEDTLS_CIPHER_MODE_XTS */ - -#if defined(MBEDTLS_CIPHER_MODE_CFB) -/* - * AES-CFB128 buffer encryption/decryption - */ -int mbedtls_aes_crypt_cfb128(mbedtls_aes_context *ctx, - int mode, - size_t length, - size_t *iv_off, - unsigned char iv[16], - const unsigned char *input, - unsigned char *output) -{ - int c; - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - size_t n; - - if (mode != MBEDTLS_AES_ENCRYPT && mode != MBEDTLS_AES_DECRYPT) { - return MBEDTLS_ERR_AES_BAD_INPUT_DATA; - } - - n = *iv_off; - - if (n > 15) { - return MBEDTLS_ERR_AES_BAD_INPUT_DATA; - } - - if (mode == MBEDTLS_AES_DECRYPT) { - while (length--) { - if (n == 0) { - ret = mbedtls_aes_crypt_ecb(ctx, MBEDTLS_AES_ENCRYPT, iv, iv); - if (ret != 0) { - goto exit; - } - } - - c = *input++; - *output++ = (unsigned char) (c ^ iv[n]); - iv[n] = (unsigned char) c; - - n = (n + 1) & 0x0F; - } - } else { - while (length--) { - if (n == 0) { - ret = mbedtls_aes_crypt_ecb(ctx, MBEDTLS_AES_ENCRYPT, iv, iv); - if (ret != 0) { - goto exit; - } - } - - iv[n] = *output++ = (unsigned char) (iv[n] ^ *input++); - - n = (n + 1) & 0x0F; - } - } - - *iv_off = n; - ret = 0; - -exit: - return ret; -} - -/* - * AES-CFB8 buffer encryption/decryption - */ -int mbedtls_aes_crypt_cfb8(mbedtls_aes_context *ctx, - int mode, - size_t length, - unsigned char iv[16], - const unsigned char *input, - unsigned char *output) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - unsigned char c; - unsigned char ov[17]; - - if (mode != MBEDTLS_AES_ENCRYPT && mode != MBEDTLS_AES_DECRYPT) { - return MBEDTLS_ERR_AES_BAD_INPUT_DATA; - } - while (length--) { - memcpy(ov, iv, 16); - ret = mbedtls_aes_crypt_ecb(ctx, MBEDTLS_AES_ENCRYPT, iv, iv); - if (ret != 0) { - goto exit; - } - - if (mode == MBEDTLS_AES_DECRYPT) { - ov[16] = *input; - } - - c = *output++ = (unsigned char) (iv[0] ^ *input++); - - if (mode == MBEDTLS_AES_ENCRYPT) { - ov[16] = c; - } - - memcpy(iv, ov + 1, 16); - } - ret = 0; - -exit: - return ret; -} -#endif /* MBEDTLS_CIPHER_MODE_CFB */ - -#if defined(MBEDTLS_CIPHER_MODE_OFB) -/* - * AES-OFB (Output Feedback Mode) buffer encryption/decryption - */ -int mbedtls_aes_crypt_ofb(mbedtls_aes_context *ctx, - size_t length, - size_t *iv_off, - unsigned char iv[16], - const unsigned char *input, - unsigned char *output) -{ - int ret = 0; - size_t n; - - n = *iv_off; - - if (n > 15) { - return MBEDTLS_ERR_AES_BAD_INPUT_DATA; - } - - while (length--) { - if (n == 0) { - ret = mbedtls_aes_crypt_ecb(ctx, MBEDTLS_AES_ENCRYPT, iv, iv); - if (ret != 0) { - goto exit; - } - } - *output++ = *input++ ^ iv[n]; - - n = (n + 1) & 0x0F; - } - - *iv_off = n; - -exit: - return ret; -} -#endif /* MBEDTLS_CIPHER_MODE_OFB */ - -#if defined(MBEDTLS_CIPHER_MODE_CTR) -/* - * AES-CTR buffer encryption/decryption - */ -int mbedtls_aes_crypt_ctr(mbedtls_aes_context *ctx, - size_t length, - size_t *nc_off, - unsigned char nonce_counter[16], - unsigned char stream_block[16], - const unsigned char *input, - unsigned char *output) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - - size_t offset = *nc_off; - - if (offset > 0x0F) { - return MBEDTLS_ERR_AES_BAD_INPUT_DATA; - } - - for (size_t i = 0; i < length;) { - size_t n = 16; - if (offset == 0) { - ret = mbedtls_aes_crypt_ecb(ctx, MBEDTLS_AES_ENCRYPT, nonce_counter, stream_block); - if (ret != 0) { - goto exit; - } - mbedtls_ctr_increment_counter(nonce_counter); - } else { - n -= offset; - } - - if (n > (length - i)) { - n = (length - i); - } - mbedtls_xor(&output[i], &input[i], &stream_block[offset], n); - // offset might be non-zero for the last block, but in that case, we don't use it again - offset = 0; - i += n; - } - - // capture offset for future resumption - *nc_off = (*nc_off + length) % 16; - - ret = 0; - -exit: - return ret; -} -#endif /* MBEDTLS_CIPHER_MODE_CTR */ - -#if defined(MBEDTLS_SELF_TEST) -/* - * AES test vectors from: - * - * http://csrc.nist.gov/archive/aes/rijndael/rijndael-vals.zip - */ -#if !defined(MBEDTLS_BLOCK_CIPHER_NO_DECRYPT) -static const unsigned char aes_test_ecb_dec[][16] = -{ - { 0x44, 0x41, 0x6A, 0xC2, 0xD1, 0xF5, 0x3C, 0x58, - 0x33, 0x03, 0x91, 0x7E, 0x6B, 0xE9, 0xEB, 0xE0 }, -#if !defined(MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH) - { 0x48, 0xE3, 0x1E, 0x9E, 0x25, 0x67, 0x18, 0xF2, - 0x92, 0x29, 0x31, 0x9C, 0x19, 0xF1, 0x5B, 0xA4 }, - { 0x05, 0x8C, 0xCF, 0xFD, 0xBB, 0xCB, 0x38, 0x2D, - 0x1F, 0x6F, 0x56, 0x58, 0x5D, 0x8A, 0x4A, 0xDE } -#endif -}; -#endif - -static const unsigned char aes_test_ecb_enc[][16] = -{ - { 0xC3, 0x4C, 0x05, 0x2C, 0xC0, 0xDA, 0x8D, 0x73, - 0x45, 0x1A, 0xFE, 0x5F, 0x03, 0xBE, 0x29, 0x7F }, -#if !defined(MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH) - { 0xF3, 0xF6, 0x75, 0x2A, 0xE8, 0xD7, 0x83, 0x11, - 0x38, 0xF0, 0x41, 0x56, 0x06, 0x31, 0xB1, 0x14 }, - { 0x8B, 0x79, 0xEE, 0xCC, 0x93, 0xA0, 0xEE, 0x5D, - 0xFF, 0x30, 0xB4, 0xEA, 0x21, 0x63, 0x6D, 0xA4 } -#endif -}; - -#if defined(MBEDTLS_CIPHER_MODE_CBC) -static const unsigned char aes_test_cbc_dec[][16] = -{ - { 0xFA, 0xCA, 0x37, 0xE0, 0xB0, 0xC8, 0x53, 0x73, - 0xDF, 0x70, 0x6E, 0x73, 0xF7, 0xC9, 0xAF, 0x86 }, -#if !defined(MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH) - { 0x5D, 0xF6, 0x78, 0xDD, 0x17, 0xBA, 0x4E, 0x75, - 0xB6, 0x17, 0x68, 0xC6, 0xAD, 0xEF, 0x7C, 0x7B }, - { 0x48, 0x04, 0xE1, 0x81, 0x8F, 0xE6, 0x29, 0x75, - 0x19, 0xA3, 0xE8, 0x8C, 0x57, 0x31, 0x04, 0x13 } -#endif -}; - -static const unsigned char aes_test_cbc_enc[][16] = -{ - { 0x8A, 0x05, 0xFC, 0x5E, 0x09, 0x5A, 0xF4, 0x84, - 0x8A, 0x08, 0xD3, 0x28, 0xD3, 0x68, 0x8E, 0x3D }, -#if !defined(MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH) - { 0x7B, 0xD9, 0x66, 0xD5, 0x3A, 0xD8, 0xC1, 0xBB, - 0x85, 0xD2, 0xAD, 0xFA, 0xE8, 0x7B, 0xB1, 0x04 }, - { 0xFE, 0x3C, 0x53, 0x65, 0x3E, 0x2F, 0x45, 0xB5, - 0x6F, 0xCD, 0x88, 0xB2, 0xCC, 0x89, 0x8F, 0xF0 } -#endif -}; -#endif /* MBEDTLS_CIPHER_MODE_CBC */ - -#if defined(MBEDTLS_CIPHER_MODE_CFB) -/* - * AES-CFB128 test vectors from: - * - * http://csrc.nist.gov/publications/nistpubs/800-38a/sp800-38a.pdf - */ -static const unsigned char aes_test_cfb128_key[][32] = -{ - { 0x2B, 0x7E, 0x15, 0x16, 0x28, 0xAE, 0xD2, 0xA6, - 0xAB, 0xF7, 0x15, 0x88, 0x09, 0xCF, 0x4F, 0x3C }, -#if !defined(MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH) - { 0x8E, 0x73, 0xB0, 0xF7, 0xDA, 0x0E, 0x64, 0x52, - 0xC8, 0x10, 0xF3, 0x2B, 0x80, 0x90, 0x79, 0xE5, - 0x62, 0xF8, 0xEA, 0xD2, 0x52, 0x2C, 0x6B, 0x7B }, - { 0x60, 0x3D, 0xEB, 0x10, 0x15, 0xCA, 0x71, 0xBE, - 0x2B, 0x73, 0xAE, 0xF0, 0x85, 0x7D, 0x77, 0x81, - 0x1F, 0x35, 0x2C, 0x07, 0x3B, 0x61, 0x08, 0xD7, - 0x2D, 0x98, 0x10, 0xA3, 0x09, 0x14, 0xDF, 0xF4 } -#endif -}; - -static const unsigned char aes_test_cfb128_iv[16] = -{ - 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, - 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F -}; - -static const unsigned char aes_test_cfb128_pt[64] = -{ - 0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96, - 0xE9, 0x3D, 0x7E, 0x11, 0x73, 0x93, 0x17, 0x2A, - 0xAE, 0x2D, 0x8A, 0x57, 0x1E, 0x03, 0xAC, 0x9C, - 0x9E, 0xB7, 0x6F, 0xAC, 0x45, 0xAF, 0x8E, 0x51, - 0x30, 0xC8, 0x1C, 0x46, 0xA3, 0x5C, 0xE4, 0x11, - 0xE5, 0xFB, 0xC1, 0x19, 0x1A, 0x0A, 0x52, 0xEF, - 0xF6, 0x9F, 0x24, 0x45, 0xDF, 0x4F, 0x9B, 0x17, - 0xAD, 0x2B, 0x41, 0x7B, 0xE6, 0x6C, 0x37, 0x10 -}; - -static const unsigned char aes_test_cfb128_ct[][64] = -{ - { 0x3B, 0x3F, 0xD9, 0x2E, 0xB7, 0x2D, 0xAD, 0x20, - 0x33, 0x34, 0x49, 0xF8, 0xE8, 0x3C, 0xFB, 0x4A, - 0xC8, 0xA6, 0x45, 0x37, 0xA0, 0xB3, 0xA9, 0x3F, - 0xCD, 0xE3, 0xCD, 0xAD, 0x9F, 0x1C, 0xE5, 0x8B, - 0x26, 0x75, 0x1F, 0x67, 0xA3, 0xCB, 0xB1, 0x40, - 0xB1, 0x80, 0x8C, 0xF1, 0x87, 0xA4, 0xF4, 0xDF, - 0xC0, 0x4B, 0x05, 0x35, 0x7C, 0x5D, 0x1C, 0x0E, - 0xEA, 0xC4, 0xC6, 0x6F, 0x9F, 0xF7, 0xF2, 0xE6 }, -#if !defined(MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH) - { 0xCD, 0xC8, 0x0D, 0x6F, 0xDD, 0xF1, 0x8C, 0xAB, - 0x34, 0xC2, 0x59, 0x09, 0xC9, 0x9A, 0x41, 0x74, - 0x67, 0xCE, 0x7F, 0x7F, 0x81, 0x17, 0x36, 0x21, - 0x96, 0x1A, 0x2B, 0x70, 0x17, 0x1D, 0x3D, 0x7A, - 0x2E, 0x1E, 0x8A, 0x1D, 0xD5, 0x9B, 0x88, 0xB1, - 0xC8, 0xE6, 0x0F, 0xED, 0x1E, 0xFA, 0xC4, 0xC9, - 0xC0, 0x5F, 0x9F, 0x9C, 0xA9, 0x83, 0x4F, 0xA0, - 0x42, 0xAE, 0x8F, 0xBA, 0x58, 0x4B, 0x09, 0xFF }, - { 0xDC, 0x7E, 0x84, 0xBF, 0xDA, 0x79, 0x16, 0x4B, - 0x7E, 0xCD, 0x84, 0x86, 0x98, 0x5D, 0x38, 0x60, - 0x39, 0xFF, 0xED, 0x14, 0x3B, 0x28, 0xB1, 0xC8, - 0x32, 0x11, 0x3C, 0x63, 0x31, 0xE5, 0x40, 0x7B, - 0xDF, 0x10, 0x13, 0x24, 0x15, 0xE5, 0x4B, 0x92, - 0xA1, 0x3E, 0xD0, 0xA8, 0x26, 0x7A, 0xE2, 0xF9, - 0x75, 0xA3, 0x85, 0x74, 0x1A, 0xB9, 0xCE, 0xF8, - 0x20, 0x31, 0x62, 0x3D, 0x55, 0xB1, 0xE4, 0x71 } -#endif -}; -#endif /* MBEDTLS_CIPHER_MODE_CFB */ - -#if defined(MBEDTLS_CIPHER_MODE_OFB) -/* - * AES-OFB test vectors from: - * - * https://csrc.nist.gov/publications/detail/sp/800-38a/final - */ -static const unsigned char aes_test_ofb_key[][32] = -{ - { 0x2B, 0x7E, 0x15, 0x16, 0x28, 0xAE, 0xD2, 0xA6, - 0xAB, 0xF7, 0x15, 0x88, 0x09, 0xCF, 0x4F, 0x3C }, -#if !defined(MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH) - { 0x8E, 0x73, 0xB0, 0xF7, 0xDA, 0x0E, 0x64, 0x52, - 0xC8, 0x10, 0xF3, 0x2B, 0x80, 0x90, 0x79, 0xE5, - 0x62, 0xF8, 0xEA, 0xD2, 0x52, 0x2C, 0x6B, 0x7B }, - { 0x60, 0x3D, 0xEB, 0x10, 0x15, 0xCA, 0x71, 0xBE, - 0x2B, 0x73, 0xAE, 0xF0, 0x85, 0x7D, 0x77, 0x81, - 0x1F, 0x35, 0x2C, 0x07, 0x3B, 0x61, 0x08, 0xD7, - 0x2D, 0x98, 0x10, 0xA3, 0x09, 0x14, 0xDF, 0xF4 } -#endif -}; - -static const unsigned char aes_test_ofb_iv[16] = -{ - 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, - 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F -}; - -static const unsigned char aes_test_ofb_pt[64] = -{ - 0x6B, 0xC1, 0xBE, 0xE2, 0x2E, 0x40, 0x9F, 0x96, - 0xE9, 0x3D, 0x7E, 0x11, 0x73, 0x93, 0x17, 0x2A, - 0xAE, 0x2D, 0x8A, 0x57, 0x1E, 0x03, 0xAC, 0x9C, - 0x9E, 0xB7, 0x6F, 0xAC, 0x45, 0xAF, 0x8E, 0x51, - 0x30, 0xC8, 0x1C, 0x46, 0xA3, 0x5C, 0xE4, 0x11, - 0xE5, 0xFB, 0xC1, 0x19, 0x1A, 0x0A, 0x52, 0xEF, - 0xF6, 0x9F, 0x24, 0x45, 0xDF, 0x4F, 0x9B, 0x17, - 0xAD, 0x2B, 0x41, 0x7B, 0xE6, 0x6C, 0x37, 0x10 -}; - -static const unsigned char aes_test_ofb_ct[][64] = -{ - { 0x3B, 0x3F, 0xD9, 0x2E, 0xB7, 0x2D, 0xAD, 0x20, - 0x33, 0x34, 0x49, 0xF8, 0xE8, 0x3C, 0xFB, 0x4A, - 0x77, 0x89, 0x50, 0x8d, 0x16, 0x91, 0x8f, 0x03, - 0xf5, 0x3c, 0x52, 0xda, 0xc5, 0x4e, 0xd8, 0x25, - 0x97, 0x40, 0x05, 0x1e, 0x9c, 0x5f, 0xec, 0xf6, - 0x43, 0x44, 0xf7, 0xa8, 0x22, 0x60, 0xed, 0xcc, - 0x30, 0x4c, 0x65, 0x28, 0xf6, 0x59, 0xc7, 0x78, - 0x66, 0xa5, 0x10, 0xd9, 0xc1, 0xd6, 0xae, 0x5e }, -#if !defined(MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH) - { 0xCD, 0xC8, 0x0D, 0x6F, 0xDD, 0xF1, 0x8C, 0xAB, - 0x34, 0xC2, 0x59, 0x09, 0xC9, 0x9A, 0x41, 0x74, - 0xfc, 0xc2, 0x8b, 0x8d, 0x4c, 0x63, 0x83, 0x7c, - 0x09, 0xe8, 0x17, 0x00, 0xc1, 0x10, 0x04, 0x01, - 0x8d, 0x9a, 0x9a, 0xea, 0xc0, 0xf6, 0x59, 0x6f, - 0x55, 0x9c, 0x6d, 0x4d, 0xaf, 0x59, 0xa5, 0xf2, - 0x6d, 0x9f, 0x20, 0x08, 0x57, 0xca, 0x6c, 0x3e, - 0x9c, 0xac, 0x52, 0x4b, 0xd9, 0xac, 0xc9, 0x2a }, - { 0xDC, 0x7E, 0x84, 0xBF, 0xDA, 0x79, 0x16, 0x4B, - 0x7E, 0xCD, 0x84, 0x86, 0x98, 0x5D, 0x38, 0x60, - 0x4f, 0xeb, 0xdc, 0x67, 0x40, 0xd2, 0x0b, 0x3a, - 0xc8, 0x8f, 0x6a, 0xd8, 0x2a, 0x4f, 0xb0, 0x8d, - 0x71, 0xab, 0x47, 0xa0, 0x86, 0xe8, 0x6e, 0xed, - 0xf3, 0x9d, 0x1c, 0x5b, 0xba, 0x97, 0xc4, 0x08, - 0x01, 0x26, 0x14, 0x1d, 0x67, 0xf3, 0x7b, 0xe8, - 0x53, 0x8f, 0x5a, 0x8b, 0xe7, 0x40, 0xe4, 0x84 } -#endif -}; -#endif /* MBEDTLS_CIPHER_MODE_OFB */ - -#if defined(MBEDTLS_CIPHER_MODE_CTR) -/* - * AES-CTR test vectors from: - * - * http://www.faqs.org/rfcs/rfc3686.html - */ - -static const unsigned char aes_test_ctr_key[][16] = -{ - { 0xAE, 0x68, 0x52, 0xF8, 0x12, 0x10, 0x67, 0xCC, - 0x4B, 0xF7, 0xA5, 0x76, 0x55, 0x77, 0xF3, 0x9E }, - { 0x7E, 0x24, 0x06, 0x78, 0x17, 0xFA, 0xE0, 0xD7, - 0x43, 0xD6, 0xCE, 0x1F, 0x32, 0x53, 0x91, 0x63 }, - { 0x76, 0x91, 0xBE, 0x03, 0x5E, 0x50, 0x20, 0xA8, - 0xAC, 0x6E, 0x61, 0x85, 0x29, 0xF9, 0xA0, 0xDC } -}; - -static const unsigned char aes_test_ctr_nonce_counter[][16] = -{ - { 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01 }, - { 0x00, 0x6C, 0xB6, 0xDB, 0xC0, 0x54, 0x3B, 0x59, - 0xDA, 0x48, 0xD9, 0x0B, 0x00, 0x00, 0x00, 0x01 }, - { 0x00, 0xE0, 0x01, 0x7B, 0x27, 0x77, 0x7F, 0x3F, - 0x4A, 0x17, 0x86, 0xF0, 0x00, 0x00, 0x00, 0x01 } -}; - -static const unsigned char aes_test_ctr_pt[][48] = -{ - { 0x53, 0x69, 0x6E, 0x67, 0x6C, 0x65, 0x20, 0x62, - 0x6C, 0x6F, 0x63, 0x6B, 0x20, 0x6D, 0x73, 0x67 }, - { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, - 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, - 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, - 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F }, - - { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, - 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E, 0x0F, - 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, - 0x18, 0x19, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, - 0x20, 0x21, 0x22, 0x23 } -}; - -static const unsigned char aes_test_ctr_ct[][48] = -{ - { 0xE4, 0x09, 0x5D, 0x4F, 0xB7, 0xA7, 0xB3, 0x79, - 0x2D, 0x61, 0x75, 0xA3, 0x26, 0x13, 0x11, 0xB8 }, - { 0x51, 0x04, 0xA1, 0x06, 0x16, 0x8A, 0x72, 0xD9, - 0x79, 0x0D, 0x41, 0xEE, 0x8E, 0xDA, 0xD3, 0x88, - 0xEB, 0x2E, 0x1E, 0xFC, 0x46, 0xDA, 0x57, 0xC8, - 0xFC, 0xE6, 0x30, 0xDF, 0x91, 0x41, 0xBE, 0x28 }, - { 0xC1, 0xCF, 0x48, 0xA8, 0x9F, 0x2F, 0xFD, 0xD9, - 0xCF, 0x46, 0x52, 0xE9, 0xEF, 0xDB, 0x72, 0xD7, - 0x45, 0x40, 0xA4, 0x2B, 0xDE, 0x6D, 0x78, 0x36, - 0xD5, 0x9A, 0x5C, 0xEA, 0xAE, 0xF3, 0x10, 0x53, - 0x25, 0xB2, 0x07, 0x2F } -}; - -static const int aes_test_ctr_len[3] = -{ 16, 32, 36 }; -#endif /* MBEDTLS_CIPHER_MODE_CTR */ - -#if defined(MBEDTLS_CIPHER_MODE_XTS) -/* - * AES-XTS test vectors from: - * - * IEEE P1619/D16 Annex B - * https://web.archive.org/web/20150629024421/http://grouper.ieee.org/groups/1619/email/pdf00086.pdf - * (Archived from original at http://grouper.ieee.org/groups/1619/email/pdf00086.pdf) - */ -static const unsigned char aes_test_xts_key[][32] = -{ - { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, - { 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, - 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, - 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, - 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22 }, - { 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8, - 0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0, - 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, - 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22 }, -}; - -static const unsigned char aes_test_xts_pt32[][32] = -{ - { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, - { 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, - 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, - 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, - 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44 }, - { 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, - 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, - 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, - 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44 }, -}; - -static const unsigned char aes_test_xts_ct32[][32] = -{ - { 0x91, 0x7c, 0xf6, 0x9e, 0xbd, 0x68, 0xb2, 0xec, - 0x9b, 0x9f, 0xe9, 0xa3, 0xea, 0xdd, 0xa6, 0x92, - 0xcd, 0x43, 0xd2, 0xf5, 0x95, 0x98, 0xed, 0x85, - 0x8c, 0x02, 0xc2, 0x65, 0x2f, 0xbf, 0x92, 0x2e }, - { 0xc4, 0x54, 0x18, 0x5e, 0x6a, 0x16, 0x93, 0x6e, - 0x39, 0x33, 0x40, 0x38, 0xac, 0xef, 0x83, 0x8b, - 0xfb, 0x18, 0x6f, 0xff, 0x74, 0x80, 0xad, 0xc4, - 0x28, 0x93, 0x82, 0xec, 0xd6, 0xd3, 0x94, 0xf0 }, - { 0xaf, 0x85, 0x33, 0x6b, 0x59, 0x7a, 0xfc, 0x1a, - 0x90, 0x0b, 0x2e, 0xb2, 0x1e, 0xc9, 0x49, 0xd2, - 0x92, 0xdf, 0x4c, 0x04, 0x7e, 0x0b, 0x21, 0x53, - 0x21, 0x86, 0xa5, 0x97, 0x1a, 0x22, 0x7a, 0x89 }, -}; - -static const unsigned char aes_test_xts_data_unit[][16] = -{ - { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, - { 0x33, 0x33, 0x33, 0x33, 0x33, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, - { 0x33, 0x33, 0x33, 0x33, 0x33, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }, -}; - -#endif /* MBEDTLS_CIPHER_MODE_XTS */ - -/* - * Checkup routine - */ -int mbedtls_aes_self_test(int verbose) -{ - int ret = 0, i, j, u, mode; - unsigned int keybits; - unsigned char key[32]; - unsigned char buf[64]; - const unsigned char *aes_tests; -#if defined(MBEDTLS_CIPHER_MODE_CBC) || defined(MBEDTLS_CIPHER_MODE_CFB) || \ - defined(MBEDTLS_CIPHER_MODE_OFB) - unsigned char iv[16]; -#endif -#if defined(MBEDTLS_CIPHER_MODE_CBC) - unsigned char prv[16]; -#endif -#if defined(MBEDTLS_CIPHER_MODE_CTR) || defined(MBEDTLS_CIPHER_MODE_CFB) || \ - defined(MBEDTLS_CIPHER_MODE_OFB) - size_t offset; -#endif -#if defined(MBEDTLS_CIPHER_MODE_CTR) || defined(MBEDTLS_CIPHER_MODE_XTS) - int len; -#endif -#if defined(MBEDTLS_CIPHER_MODE_CTR) - unsigned char nonce_counter[16]; - unsigned char stream_block[16]; -#endif - mbedtls_aes_context ctx; - - memset(key, 0, 32); - mbedtls_aes_init(&ctx); - - if (verbose != 0) { -#if defined(MBEDTLS_AESNI_HAVE_CODE) -#if MBEDTLS_AESNI_HAVE_CODE == 1 - mbedtls_printf(" AES note: AESNI code present (assembly implementation).\n"); -#elif MBEDTLS_AESNI_HAVE_CODE == 2 - mbedtls_printf(" AES note: AESNI code present (intrinsics implementation).\n"); -#else -#error "Unrecognised value for MBEDTLS_AESNI_HAVE_CODE" -#endif - if (mbedtls_aesni_has_support(MBEDTLS_AESNI_AES)) { - mbedtls_printf(" AES note: using AESNI.\n"); - } else -#endif -#if defined(MBEDTLS_AESCE_HAVE_CODE) - if (MBEDTLS_AESCE_HAS_SUPPORT()) { - mbedtls_printf(" AES note: using AESCE.\n"); - } else -#endif - { -#if !defined(MBEDTLS_AES_USE_HARDWARE_ONLY) - mbedtls_printf(" AES note: built-in implementation.\n"); -#endif - } - } - - /* - * ECB mode - */ - { - static const int num_tests = - sizeof(aes_test_ecb_enc) / sizeof(*aes_test_ecb_enc); - - for (i = 0; i < num_tests << 1; i++) { - u = i >> 1; - keybits = 128 + u * 64; - mode = i & 1; - - if (verbose != 0) { - mbedtls_printf(" AES-ECB-%3u (%s): ", keybits, - (mode == MBEDTLS_AES_DECRYPT) ? "dec" : "enc"); - } -#if defined(MBEDTLS_BLOCK_CIPHER_NO_DECRYPT) - if (mode == MBEDTLS_AES_DECRYPT) { - if (verbose != 0) { - mbedtls_printf("skipped\n"); - } - continue; - } -#endif - - memset(buf, 0, 16); - -#if !defined(MBEDTLS_BLOCK_CIPHER_NO_DECRYPT) - if (mode == MBEDTLS_AES_DECRYPT) { - ret = mbedtls_aes_setkey_dec(&ctx, key, keybits); - aes_tests = aes_test_ecb_dec[u]; - } else -#endif - { - ret = mbedtls_aes_setkey_enc(&ctx, key, keybits); - aes_tests = aes_test_ecb_enc[u]; - } - - if (ret == MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED && keybits == 192) { - mbedtls_printf("skipped\n"); - continue; - } else if (ret != 0) { - goto exit; - } - - for (j = 0; j < 10000; j++) { - ret = mbedtls_aes_crypt_ecb(&ctx, mode, buf, buf); - if (ret != 0) { - goto exit; - } - } - - if (memcmp(buf, aes_tests, 16) != 0) { - ret = 1; - goto exit; - } - - if (verbose != 0) { - mbedtls_printf("passed\n"); - } - } - - if (verbose != 0) { - mbedtls_printf("\n"); - } - } - -#if defined(MBEDTLS_CIPHER_MODE_CBC) - /* - * CBC mode - */ - { - static const int num_tests = - sizeof(aes_test_cbc_dec) / sizeof(*aes_test_cbc_dec); - - for (i = 0; i < num_tests << 1; i++) { - u = i >> 1; - keybits = 128 + u * 64; - mode = i & 1; - - if (verbose != 0) { - mbedtls_printf(" AES-CBC-%3u (%s): ", keybits, - (mode == MBEDTLS_AES_DECRYPT) ? "dec" : "enc"); - } - - memset(iv, 0, 16); - memset(prv, 0, 16); - memset(buf, 0, 16); - - if (mode == MBEDTLS_AES_DECRYPT) { - ret = mbedtls_aes_setkey_dec(&ctx, key, keybits); - aes_tests = aes_test_cbc_dec[u]; - } else { - ret = mbedtls_aes_setkey_enc(&ctx, key, keybits); - aes_tests = aes_test_cbc_enc[u]; - } - - if (ret == MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED && keybits == 192) { - mbedtls_printf("skipped\n"); - continue; - } else if (ret != 0) { - goto exit; - } - - for (j = 0; j < 10000; j++) { - if (mode == MBEDTLS_AES_ENCRYPT) { - unsigned char tmp[16]; - - memcpy(tmp, prv, 16); - memcpy(prv, buf, 16); - memcpy(buf, tmp, 16); - } - - ret = mbedtls_aes_crypt_cbc(&ctx, mode, 16, iv, buf, buf); - if (ret != 0) { - goto exit; - } - - } - - if (memcmp(buf, aes_tests, 16) != 0) { - ret = 1; - goto exit; - } - - if (verbose != 0) { - mbedtls_printf("passed\n"); - } - } - - if (verbose != 0) { - mbedtls_printf("\n"); - } - } -#endif /* MBEDTLS_CIPHER_MODE_CBC */ - -#if defined(MBEDTLS_CIPHER_MODE_CFB) - /* - * CFB128 mode - */ - { - static const int num_tests = - sizeof(aes_test_cfb128_key) / sizeof(*aes_test_cfb128_key); - - for (i = 0; i < num_tests << 1; i++) { - u = i >> 1; - keybits = 128 + u * 64; - mode = i & 1; - - if (verbose != 0) { - mbedtls_printf(" AES-CFB128-%3u (%s): ", keybits, - (mode == MBEDTLS_AES_DECRYPT) ? "dec" : "enc"); - } - - memcpy(iv, aes_test_cfb128_iv, 16); - memcpy(key, aes_test_cfb128_key[u], keybits / 8); - - offset = 0; - ret = mbedtls_aes_setkey_enc(&ctx, key, keybits); - - if (ret == MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED && keybits == 192) { - mbedtls_printf("skipped\n"); - continue; - } else if (ret != 0) { - goto exit; - } - - if (mode == MBEDTLS_AES_DECRYPT) { - memcpy(buf, aes_test_cfb128_ct[u], 64); - aes_tests = aes_test_cfb128_pt; - } else { - memcpy(buf, aes_test_cfb128_pt, 64); - aes_tests = aes_test_cfb128_ct[u]; - } - - ret = mbedtls_aes_crypt_cfb128(&ctx, mode, 64, &offset, iv, buf, buf); - if (ret != 0) { - goto exit; - } - - if (memcmp(buf, aes_tests, 64) != 0) { - ret = 1; - goto exit; - } - - if (verbose != 0) { - mbedtls_printf("passed\n"); - } - } - - if (verbose != 0) { - mbedtls_printf("\n"); - } - } -#endif /* MBEDTLS_CIPHER_MODE_CFB */ - -#if defined(MBEDTLS_CIPHER_MODE_OFB) - /* - * OFB mode - */ - { - static const int num_tests = - sizeof(aes_test_ofb_key) / sizeof(*aes_test_ofb_key); - - for (i = 0; i < num_tests << 1; i++) { - u = i >> 1; - keybits = 128 + u * 64; - mode = i & 1; - - if (verbose != 0) { - mbedtls_printf(" AES-OFB-%3u (%s): ", keybits, - (mode == MBEDTLS_AES_DECRYPT) ? "dec" : "enc"); - } - - memcpy(iv, aes_test_ofb_iv, 16); - memcpy(key, aes_test_ofb_key[u], keybits / 8); - - offset = 0; - ret = mbedtls_aes_setkey_enc(&ctx, key, keybits); - - if (ret == MBEDTLS_ERR_PLATFORM_FEATURE_UNSUPPORTED && keybits == 192) { - mbedtls_printf("skipped\n"); - continue; - } else if (ret != 0) { - goto exit; - } - - if (mode == MBEDTLS_AES_DECRYPT) { - memcpy(buf, aes_test_ofb_ct[u], 64); - aes_tests = aes_test_ofb_pt; - } else { - memcpy(buf, aes_test_ofb_pt, 64); - aes_tests = aes_test_ofb_ct[u]; - } - - ret = mbedtls_aes_crypt_ofb(&ctx, 64, &offset, iv, buf, buf); - if (ret != 0) { - goto exit; - } - - if (memcmp(buf, aes_tests, 64) != 0) { - ret = 1; - goto exit; - } - - if (verbose != 0) { - mbedtls_printf("passed\n"); - } - } - - if (verbose != 0) { - mbedtls_printf("\n"); - } - } -#endif /* MBEDTLS_CIPHER_MODE_OFB */ - -#if defined(MBEDTLS_CIPHER_MODE_CTR) - /* - * CTR mode - */ - { - static const int num_tests = - sizeof(aes_test_ctr_key) / sizeof(*aes_test_ctr_key); - - for (i = 0; i < num_tests << 1; i++) { - u = i >> 1; - mode = i & 1; - - if (verbose != 0) { - mbedtls_printf(" AES-CTR-128 (%s): ", - (mode == MBEDTLS_AES_DECRYPT) ? "dec" : "enc"); - } - - memcpy(nonce_counter, aes_test_ctr_nonce_counter[u], 16); - memcpy(key, aes_test_ctr_key[u], 16); - - offset = 0; - if ((ret = mbedtls_aes_setkey_enc(&ctx, key, 128)) != 0) { - goto exit; - } - - len = aes_test_ctr_len[u]; - - if (mode == MBEDTLS_AES_DECRYPT) { - memcpy(buf, aes_test_ctr_ct[u], len); - aes_tests = aes_test_ctr_pt[u]; - } else { - memcpy(buf, aes_test_ctr_pt[u], len); - aes_tests = aes_test_ctr_ct[u]; - } - - ret = mbedtls_aes_crypt_ctr(&ctx, len, &offset, nonce_counter, - stream_block, buf, buf); - if (ret != 0) { - goto exit; - } - - if (memcmp(buf, aes_tests, len) != 0) { - ret = 1; - goto exit; - } - - if (verbose != 0) { - mbedtls_printf("passed\n"); - } - } - } - - if (verbose != 0) { - mbedtls_printf("\n"); - } -#endif /* MBEDTLS_CIPHER_MODE_CTR */ - -#if defined(MBEDTLS_CIPHER_MODE_XTS) - /* - * XTS mode - */ - { - static const int num_tests = - sizeof(aes_test_xts_key) / sizeof(*aes_test_xts_key); - mbedtls_aes_xts_context ctx_xts; - - mbedtls_aes_xts_init(&ctx_xts); - - for (i = 0; i < num_tests << 1; i++) { - const unsigned char *data_unit; - u = i >> 1; - mode = i & 1; - - if (verbose != 0) { - mbedtls_printf(" AES-XTS-128 (%s): ", - (mode == MBEDTLS_AES_DECRYPT) ? "dec" : "enc"); - } - - memset(key, 0, sizeof(key)); - memcpy(key, aes_test_xts_key[u], 32); - data_unit = aes_test_xts_data_unit[u]; - - len = sizeof(*aes_test_xts_ct32); - - if (mode == MBEDTLS_AES_DECRYPT) { - ret = mbedtls_aes_xts_setkey_dec(&ctx_xts, key, 256); - if (ret != 0) { - goto exit; - } - memcpy(buf, aes_test_xts_ct32[u], len); - aes_tests = aes_test_xts_pt32[u]; - } else { - ret = mbedtls_aes_xts_setkey_enc(&ctx_xts, key, 256); - if (ret != 0) { - goto exit; - } - memcpy(buf, aes_test_xts_pt32[u], len); - aes_tests = aes_test_xts_ct32[u]; - } - - - ret = mbedtls_aes_crypt_xts(&ctx_xts, mode, len, data_unit, - buf, buf); - if (ret != 0) { - goto exit; - } - - if (memcmp(buf, aes_tests, len) != 0) { - ret = 1; - goto exit; - } - - if (verbose != 0) { - mbedtls_printf("passed\n"); - } - } - - if (verbose != 0) { - mbedtls_printf("\n"); - } - - mbedtls_aes_xts_free(&ctx_xts); - } -#endif /* MBEDTLS_CIPHER_MODE_XTS */ - - ret = 0; - -exit: - if (ret != 0 && verbose != 0) { - mbedtls_printf("failed\n"); - } - - mbedtls_aes_free(&ctx); - - return ret; -} - -#endif /* MBEDTLS_SELF_TEST */ - -#endif /* MBEDTLS_AES_C */ diff --git a/tf-psa-crypto/drivers/builtin/src/bignum.c b/tf-psa-crypto/drivers/builtin/src/bignum.c deleted file mode 100644 index 2e2d7d11a5..0000000000 --- a/tf-psa-crypto/drivers/builtin/src/bignum.c +++ /dev/null @@ -1,2502 +0,0 @@ -/* - * Multi-precision integer library - * - * Copyright The Mbed TLS Contributors - * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later - */ - -/* - * The following sources were referenced in the design of this Multi-precision - * Integer library: - * - * [1] Handbook of Applied Cryptography - 1997 - * Menezes, van Oorschot and Vanstone - * - * [2] Multi-Precision Math - * Tom St Denis - * https://github.com/libtom/libtommath/blob/develop/tommath.pdf - * - * [3] GNU Multi-Precision Arithmetic Library - * https://gmplib.org/manual/index.html - * - */ - -#include "common.h" - -#if defined(MBEDTLS_BIGNUM_C) - -#include "mbedtls/bignum.h" -#include "bignum_core.h" -#include "bignum_internal.h" -#include "bn_mul.h" -#include "mbedtls/platform_util.h" -#include "mbedtls/error_common.h" -#include "constant_time_internal.h" - -#include -#include - -#include "mbedtls/platform.h" - -#if !defined(MBEDTLS_BIGNUM_ALT) - -/* - * Conditionally select an MPI sign in constant time. - * (MPI sign is the field s in mbedtls_mpi. It is unsigned short and only 1 and -1 are valid - * values.) - */ -static inline signed short mbedtls_ct_mpi_sign_if(mbedtls_ct_condition_t cond, - signed short sign1, signed short sign2) -{ - return (signed short) mbedtls_ct_uint_if(cond, sign1 + 1, sign2 + 1) - 1; -} - -/* - * Compare signed values in constant time - */ -int mbedtls_mpi_lt_mpi_ct(const mbedtls_mpi *X, - const mbedtls_mpi *Y, - unsigned *ret) -{ - mbedtls_ct_condition_t different_sign, X_is_negative, Y_is_negative, result; - - if (X->n != Y->n) { - return MBEDTLS_ERR_MPI_BAD_INPUT_DATA; - } - - /* - * Set N_is_negative to MBEDTLS_CT_FALSE if N >= 0, MBEDTLS_CT_TRUE if N < 0. - * We know that N->s == 1 if N >= 0 and N->s == -1 if N < 0. - */ - X_is_negative = mbedtls_ct_bool((X->s & 2) >> 1); - Y_is_negative = mbedtls_ct_bool((Y->s & 2) >> 1); - - /* - * If the signs are different, then the positive operand is the bigger. - * That is if X is negative (X_is_negative == 1), then X < Y is true and it - * is false if X is positive (X_is_negative == 0). - */ - different_sign = mbedtls_ct_bool_ne(X_is_negative, Y_is_negative); // true if different sign - result = mbedtls_ct_bool_and(different_sign, X_is_negative); - - /* - * Assuming signs are the same, compare X and Y. We switch the comparison - * order if they are negative so that we get the right result, regardles of - * sign. - */ - - /* This array is used to conditionally swap the pointers in const time */ - void * const p[2] = { X->p, Y->p }; - size_t i = mbedtls_ct_size_if_else_0(X_is_negative, 1); - mbedtls_ct_condition_t lt = mbedtls_mpi_core_lt_ct(p[i], p[i ^ 1], X->n); - - /* - * Store in result iff the signs are the same (i.e., iff different_sign == false). If - * the signs differ, result has already been set, so we don't change it. - */ - result = mbedtls_ct_bool_or(result, - mbedtls_ct_bool_and(mbedtls_ct_bool_not(different_sign), lt)); - - *ret = mbedtls_ct_uint_if_else_0(result, 1); - - return 0; -} - -/* - * Conditionally assign X = Y, without leaking information - * about whether the assignment was made or not. - * (Leaking information about the respective sizes of X and Y is ok however.) - */ -#if defined(_MSC_VER) && defined(MBEDTLS_PLATFORM_IS_WINDOWS_ON_ARM64) && \ - (_MSC_FULL_VER < 193131103) -/* - * MSVC miscompiles this function if it's inlined prior to Visual Studio 2022 version 17.1. See: - * https://developercommunity.visualstudio.com/t/c-compiler-miscompiles-part-of-mbedtls-library-on/1646989 - */ -__declspec(noinline) -#endif -int mbedtls_mpi_safe_cond_assign(mbedtls_mpi *X, - const mbedtls_mpi *Y, - unsigned char assign) -{ - int ret = 0; - - MBEDTLS_MPI_CHK(mbedtls_mpi_grow(X, Y->n)); - - { - mbedtls_ct_condition_t do_assign = mbedtls_ct_bool(assign); - - X->s = mbedtls_ct_mpi_sign_if(do_assign, Y->s, X->s); - - mbedtls_mpi_core_cond_assign(X->p, Y->p, Y->n, do_assign); - - mbedtls_ct_condition_t do_not_assign = mbedtls_ct_bool_not(do_assign); - for (size_t i = Y->n; i < X->n; i++) { - X->p[i] = mbedtls_ct_mpi_uint_if_else_0(do_not_assign, X->p[i]); - } - } - -cleanup: - return ret; -} - -/* - * Conditionally swap X and Y, without leaking information - * about whether the swap was made or not. - * Here it is not ok to simply swap the pointers, which would lead to - * different memory access patterns when X and Y are used afterwards. - */ -int mbedtls_mpi_safe_cond_swap(mbedtls_mpi *X, - mbedtls_mpi *Y, - unsigned char swap) -{ - int ret = 0; - int s; - - if (X == Y) { - return 0; - } - - mbedtls_ct_condition_t do_swap = mbedtls_ct_bool(swap); - - MBEDTLS_MPI_CHK(mbedtls_mpi_grow(X, Y->n)); - MBEDTLS_MPI_CHK(mbedtls_mpi_grow(Y, X->n)); - - s = X->s; - X->s = mbedtls_ct_mpi_sign_if(do_swap, Y->s, X->s); - Y->s = mbedtls_ct_mpi_sign_if(do_swap, s, Y->s); - - mbedtls_mpi_core_cond_swap(X->p, Y->p, X->n, do_swap); - -cleanup: - return ret; -} - -/* Implementation that should never be optimized out by the compiler */ -#define mbedtls_mpi_zeroize_and_free(v, n) mbedtls_zeroize_and_free(v, ciL * (n)) - -/* - * Initialize one MPI - */ -void mbedtls_mpi_init(mbedtls_mpi *X) -{ - X->s = 1; - X->n = 0; - X->p = NULL; -} - -/* - * Unallocate one MPI - */ -void mbedtls_mpi_free(mbedtls_mpi *X) -{ - if (X == NULL) { - return; - } - - if (X->p != NULL) { - mbedtls_mpi_zeroize_and_free(X->p, X->n); - } - - X->s = 1; - X->n = 0; - X->p = NULL; -} - -/* - * Enlarge to the specified number of limbs - */ -int mbedtls_mpi_grow(mbedtls_mpi *X, size_t nblimbs) -{ - mbedtls_mpi_uint *p; - - if (nblimbs > MBEDTLS_MPI_MAX_LIMBS) { - return MBEDTLS_ERR_MPI_ALLOC_FAILED; - } - - if (X->n < nblimbs) { - if ((p = (mbedtls_mpi_uint *) mbedtls_calloc(nblimbs, ciL)) == NULL) { - return MBEDTLS_ERR_MPI_ALLOC_FAILED; - } - - if (X->p != NULL) { - memcpy(p, X->p, X->n * ciL); - mbedtls_mpi_zeroize_and_free(X->p, X->n); - } - - /* nblimbs fits in n because we ensure that MBEDTLS_MPI_MAX_LIMBS - * fits, and we've checked that nblimbs <= MBEDTLS_MPI_MAX_LIMBS. */ - X->n = (unsigned short) nblimbs; - X->p = p; - } - - return 0; -} - -/* - * Resize down as much as possible, - * while keeping at least the specified number of limbs - */ -int mbedtls_mpi_shrink(mbedtls_mpi *X, size_t nblimbs) -{ - mbedtls_mpi_uint *p; - size_t i; - - if (nblimbs > MBEDTLS_MPI_MAX_LIMBS) { - return MBEDTLS_ERR_MPI_ALLOC_FAILED; - } - - /* Actually resize up if there are currently fewer than nblimbs limbs. */ - if (X->n <= nblimbs) { - return mbedtls_mpi_grow(X, nblimbs); - } - /* After this point, then X->n > nblimbs and in particular X->n > 0. */ - - for (i = X->n - 1; i > 0; i--) { - if (X->p[i] != 0) { - break; - } - } - i++; - - if (i < nblimbs) { - i = nblimbs; - } - - if ((p = (mbedtls_mpi_uint *) mbedtls_calloc(i, ciL)) == NULL) { - return MBEDTLS_ERR_MPI_ALLOC_FAILED; - } - - if (X->p != NULL) { - memcpy(p, X->p, i * ciL); - mbedtls_mpi_zeroize_and_free(X->p, X->n); - } - - /* i fits in n because we ensure that MBEDTLS_MPI_MAX_LIMBS - * fits, and we've checked that i <= nblimbs <= MBEDTLS_MPI_MAX_LIMBS. */ - X->n = (unsigned short) i; - X->p = p; - - return 0; -} - -/* Resize X to have exactly n limbs and set it to 0. */ -static int mbedtls_mpi_resize_clear(mbedtls_mpi *X, size_t limbs) -{ - if (limbs == 0) { - mbedtls_mpi_free(X); - return 0; - } else if (X->n == limbs) { - memset(X->p, 0, limbs * ciL); - X->s = 1; - return 0; - } else { - mbedtls_mpi_free(X); - return mbedtls_mpi_grow(X, limbs); - } -} - -/* - * Copy the contents of Y into X. - * - * This function is not constant-time. Leading zeros in Y may be removed. - * - * Ensure that X does not shrink. This is not guaranteed by the public API, - * but some code in the bignum module might still rely on this property. - */ -int mbedtls_mpi_copy(mbedtls_mpi *X, const mbedtls_mpi *Y) -{ - int ret = 0; - size_t i; - - if (X == Y) { - return 0; - } - - if (Y->n == 0) { - if (X->n != 0) { - X->s = 1; - memset(X->p, 0, X->n * ciL); - } - return 0; - } - - for (i = Y->n - 1; i > 0; i--) { - if (Y->p[i] != 0) { - break; - } - } - i++; - - X->s = Y->s; - - if (X->n < i) { - MBEDTLS_MPI_CHK(mbedtls_mpi_grow(X, i)); - } else { - memset(X->p + i, 0, (X->n - i) * ciL); - } - - memcpy(X->p, Y->p, i * ciL); - -cleanup: - - return ret; -} - -/* - * Swap the contents of X and Y - */ -void mbedtls_mpi_swap(mbedtls_mpi *X, mbedtls_mpi *Y) -{ - mbedtls_mpi T; - - memcpy(&T, X, sizeof(mbedtls_mpi)); - memcpy(X, Y, sizeof(mbedtls_mpi)); - memcpy(Y, &T, sizeof(mbedtls_mpi)); -} - -static inline mbedtls_mpi_uint mpi_sint_abs(mbedtls_mpi_sint z) -{ - if (z >= 0) { - return z; - } - /* Take care to handle the most negative value (-2^(biL-1)) correctly. - * A naive -z would have undefined behavior. - * Write this in a way that makes popular compilers happy (GCC, Clang, - * MSVC). */ - return (mbedtls_mpi_uint) 0 - (mbedtls_mpi_uint) z; -} - -/* Convert x to a sign, i.e. to 1, if x is positive, or -1, if x is negative. - * This looks awkward but generates smaller code than (x < 0 ? -1 : 1) */ -#define TO_SIGN(x) ((mbedtls_mpi_sint) (((mbedtls_mpi_uint) x) >> (biL - 1)) * -2 + 1) - -/* - * Set value from integer - */ -int mbedtls_mpi_lset(mbedtls_mpi *X, mbedtls_mpi_sint z) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - - MBEDTLS_MPI_CHK(mbedtls_mpi_grow(X, 1)); - memset(X->p, 0, X->n * ciL); - - X->p[0] = mpi_sint_abs(z); - X->s = TO_SIGN(z); - -cleanup: - - return ret; -} - -/* - * Get a specific bit - */ -int mbedtls_mpi_get_bit(const mbedtls_mpi *X, size_t pos) -{ - if (X->n * biL <= pos) { - return 0; - } - - return (X->p[pos / biL] >> (pos % biL)) & 0x01; -} - -/* - * Set a bit to a specific value of 0 or 1 - */ -int mbedtls_mpi_set_bit(mbedtls_mpi *X, size_t pos, unsigned char val) -{ - int ret = 0; - size_t off = pos / biL; - size_t idx = pos % biL; - - if (val != 0 && val != 1) { - return MBEDTLS_ERR_MPI_BAD_INPUT_DATA; - } - - if (X->n * biL <= pos) { - if (val == 0) { - return 0; - } - - MBEDTLS_MPI_CHK(mbedtls_mpi_grow(X, off + 1)); - } - - X->p[off] &= ~((mbedtls_mpi_uint) 0x01 << idx); - X->p[off] |= (mbedtls_mpi_uint) val << idx; - -cleanup: - - return ret; -} - -/* - * Return the number of less significant zero-bits - */ -size_t mbedtls_mpi_lsb(const mbedtls_mpi *X) -{ - size_t i; - -#if defined(__has_builtin) -#if (MBEDTLS_MPI_UINT_MAX == UINT_MAX) && __has_builtin(__builtin_ctz) - #define mbedtls_mpi_uint_ctz __builtin_ctz -#elif (MBEDTLS_MPI_UINT_MAX == ULONG_MAX) && __has_builtin(__builtin_ctzl) - #define mbedtls_mpi_uint_ctz __builtin_ctzl -#elif (MBEDTLS_MPI_UINT_MAX == ULLONG_MAX) && __has_builtin(__builtin_ctzll) - #define mbedtls_mpi_uint_ctz __builtin_ctzll -#endif -#endif - -#if defined(mbedtls_mpi_uint_ctz) - for (i = 0; i < X->n; i++) { - if (X->p[i] != 0) { - return i * biL + mbedtls_mpi_uint_ctz(X->p[i]); - } - } -#else - size_t count = 0; - for (i = 0; i < X->n; i++) { - for (size_t j = 0; j < biL; j++, count++) { - if (((X->p[i] >> j) & 1) != 0) { - return count; - } - } - } -#endif - - return 0; -} - -/* - * Return the number of bits - */ -size_t mbedtls_mpi_bitlen(const mbedtls_mpi *X) -{ - return mbedtls_mpi_core_bitlen(X->p, X->n); -} - -/* - * Return the total size in bytes - */ -size_t mbedtls_mpi_size(const mbedtls_mpi *X) -{ - return (mbedtls_mpi_bitlen(X) + 7) >> 3; -} - -/* - * Convert an ASCII character to digit value - */ -static int mpi_get_digit(mbedtls_mpi_uint *d, int radix, char c) -{ - *d = 255; - - if (c >= 0x30 && c <= 0x39) { - *d = c - 0x30; - } - if (c >= 0x41 && c <= 0x46) { - *d = c - 0x37; - } - if (c >= 0x61 && c <= 0x66) { - *d = c - 0x57; - } - - if (*d >= (mbedtls_mpi_uint) radix) { - return MBEDTLS_ERR_MPI_INVALID_CHARACTER; - } - - return 0; -} - -/* - * Import from an ASCII string - */ -int mbedtls_mpi_read_string(mbedtls_mpi *X, int radix, const char *s) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - size_t i, j, slen, n; - int sign = 1; - mbedtls_mpi_uint d; - mbedtls_mpi T; - - if (radix < 2 || radix > 16) { - return MBEDTLS_ERR_MPI_BAD_INPUT_DATA; - } - - mbedtls_mpi_init(&T); - - if (s[0] == 0) { - mbedtls_mpi_free(X); - return 0; - } - - if (s[0] == '-') { - ++s; - sign = -1; - } - - slen = strlen(s); - - if (radix == 16) { - if (slen > SIZE_MAX >> 2) { - return MBEDTLS_ERR_MPI_BAD_INPUT_DATA; - } - - n = BITS_TO_LIMBS(slen << 2); - - MBEDTLS_MPI_CHK(mbedtls_mpi_grow(X, n)); - MBEDTLS_MPI_CHK(mbedtls_mpi_lset(X, 0)); - - for (i = slen, j = 0; i > 0; i--, j++) { - MBEDTLS_MPI_CHK(mpi_get_digit(&d, radix, s[i - 1])); - X->p[j / (2 * ciL)] |= d << ((j % (2 * ciL)) << 2); - } - } else { - MBEDTLS_MPI_CHK(mbedtls_mpi_lset(X, 0)); - - for (i = 0; i < slen; i++) { - MBEDTLS_MPI_CHK(mpi_get_digit(&d, radix, s[i])); - MBEDTLS_MPI_CHK(mbedtls_mpi_mul_int(&T, X, radix)); - MBEDTLS_MPI_CHK(mbedtls_mpi_add_int(X, &T, d)); - } - } - - if (sign < 0 && mbedtls_mpi_bitlen(X) != 0) { - X->s = -1; - } - -cleanup: - - mbedtls_mpi_free(&T); - - return ret; -} - -/* - * Helper to write the digits high-order first. - */ -static int mpi_write_hlp(mbedtls_mpi *X, int radix, - char **p, const size_t buflen) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - mbedtls_mpi_uint r; - size_t length = 0; - char *p_end = *p + buflen; - - do { - if (length >= buflen) { - return MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL; - } - - MBEDTLS_MPI_CHK(mbedtls_mpi_mod_int(&r, X, radix)); - MBEDTLS_MPI_CHK(mbedtls_mpi_div_int(X, NULL, X, radix)); - /* - * Write the residue in the current position, as an ASCII character. - */ - if (r < 0xA) { - *(--p_end) = (char) ('0' + r); - } else { - *(--p_end) = (char) ('A' + (r - 0xA)); - } - - length++; - } while (mbedtls_mpi_cmp_int(X, 0) != 0); - - memmove(*p, p_end, length); - *p += length; - -cleanup: - - return ret; -} - -/* - * Export into an ASCII string - */ -int mbedtls_mpi_write_string(const mbedtls_mpi *X, int radix, - char *buf, size_t buflen, size_t *olen) -{ - int ret = 0; - size_t n; - char *p; - mbedtls_mpi T; - - if (radix < 2 || radix > 16) { - return MBEDTLS_ERR_MPI_BAD_INPUT_DATA; - } - - n = mbedtls_mpi_bitlen(X); /* Number of bits necessary to present `n`. */ - if (radix >= 4) { - n >>= 1; /* Number of 4-adic digits necessary to present - * `n`. If radix > 4, this might be a strict - * overapproximation of the number of - * radix-adic digits needed to present `n`. */ - } - if (radix >= 16) { - n >>= 1; /* Number of hexadecimal digits necessary to - * present `n`. */ - - } - n += 1; /* Terminating null byte */ - n += 1; /* Compensate for the divisions above, which round down `n` - * in case it's not even. */ - n += 1; /* Potential '-'-sign. */ - n += (n & 1); /* Make n even to have enough space for hexadecimal writing, - * which always uses an even number of hex-digits. */ - - if (buflen < n) { - *olen = n; - return MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL; - } - - p = buf; - mbedtls_mpi_init(&T); - - if (X->s == -1) { - *p++ = '-'; - buflen--; - } - - if (radix == 16) { - int c; - size_t i, j, k; - - for (i = X->n, k = 0; i > 0; i--) { - for (j = ciL; j > 0; j--) { - c = (X->p[i - 1] >> ((j - 1) << 3)) & 0xFF; - - if (c == 0 && k == 0 && (i + j) != 2) { - continue; - } - - *(p++) = "0123456789ABCDEF" [c / 16]; - *(p++) = "0123456789ABCDEF" [c % 16]; - k = 1; - } - } - } else { - MBEDTLS_MPI_CHK(mbedtls_mpi_copy(&T, X)); - - if (T.s == -1) { - T.s = 1; - } - - MBEDTLS_MPI_CHK(mpi_write_hlp(&T, radix, &p, buflen)); - } - - *p++ = '\0'; - *olen = (size_t) (p - buf); - -cleanup: - - mbedtls_mpi_free(&T); - - return ret; -} - -#if defined(MBEDTLS_FS_IO) -/* - * Read X from an opened file - */ -int mbedtls_mpi_read_file(mbedtls_mpi *X, int radix, FILE *fin) -{ - mbedtls_mpi_uint d; - size_t slen; - char *p; - /* - * Buffer should have space for (short) label and decimal formatted MPI, - * newline characters and '\0' - */ - char s[MBEDTLS_MPI_RW_BUFFER_SIZE]; - - if (radix < 2 || radix > 16) { - return MBEDTLS_ERR_MPI_BAD_INPUT_DATA; - } - - memset(s, 0, sizeof(s)); - if (fgets(s, sizeof(s) - 1, fin) == NULL) { - return MBEDTLS_ERR_MPI_FILE_IO_ERROR; - } - - slen = strlen(s); - if (slen == sizeof(s) - 2) { - return MBEDTLS_ERR_MPI_BUFFER_TOO_SMALL; - } - - if (slen > 0 && s[slen - 1] == '\n') { - slen--; s[slen] = '\0'; - } - if (slen > 0 && s[slen - 1] == '\r') { - slen--; s[slen] = '\0'; - } - - p = s + slen; - while (p-- > s) { - if (mpi_get_digit(&d, radix, *p) != 0) { - break; - } - } - - return mbedtls_mpi_read_string(X, radix, p + 1); -} - -/* - * Write X into an opened file (or stdout if fout == NULL) - */ -int mbedtls_mpi_write_file(const char *p, const mbedtls_mpi *X, int radix, FILE *fout) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - size_t n, slen, plen; - /* - * Buffer should have space for (short) label and decimal formatted MPI, - * newline characters and '\0' - */ - char s[MBEDTLS_MPI_RW_BUFFER_SIZE]; - - if (radix < 2 || radix > 16) { - return MBEDTLS_ERR_MPI_BAD_INPUT_DATA; - } - - memset(s, 0, sizeof(s)); - - MBEDTLS_MPI_CHK(mbedtls_mpi_write_string(X, radix, s, sizeof(s) - 2, &n)); - - if (p == NULL) { - p = ""; - } - - plen = strlen(p); - slen = strlen(s); - s[slen++] = '\r'; - s[slen++] = '\n'; - - if (fout != NULL) { - if (fwrite(p, 1, plen, fout) != plen || - fwrite(s, 1, slen, fout) != slen) { - return MBEDTLS_ERR_MPI_FILE_IO_ERROR; - } - } else { - mbedtls_printf("%s%s", p, s); - } - -cleanup: - - return ret; -} -#endif /* MBEDTLS_FS_IO */ - -/* - * Import X from unsigned binary data, little endian - * - * This function is guaranteed to return an MPI with exactly the necessary - * number of limbs (in particular, it does not skip 0s in the input). - */ -int mbedtls_mpi_read_binary_le(mbedtls_mpi *X, - const unsigned char *buf, size_t buflen) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - const size_t limbs = CHARS_TO_LIMBS(buflen); - - /* Ensure that target MPI has exactly the necessary number of limbs */ - MBEDTLS_MPI_CHK(mbedtls_mpi_resize_clear(X, limbs)); - - MBEDTLS_MPI_CHK(mbedtls_mpi_core_read_le(X->p, X->n, buf, buflen)); - -cleanup: - - /* - * This function is also used to import keys. However, wiping the buffers - * upon failure is not necessary because failure only can happen before any - * input is copied. - */ - return ret; -} - -/* - * Import X from unsigned binary data, big endian - * - * This function is guaranteed to return an MPI with exactly the necessary - * number of limbs (in particular, it does not skip 0s in the input). - */ -int mbedtls_mpi_read_binary(mbedtls_mpi *X, const unsigned char *buf, size_t buflen) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - const size_t limbs = CHARS_TO_LIMBS(buflen); - - /* Ensure that target MPI has exactly the necessary number of limbs */ - MBEDTLS_MPI_CHK(mbedtls_mpi_resize_clear(X, limbs)); - - MBEDTLS_MPI_CHK(mbedtls_mpi_core_read_be(X->p, X->n, buf, buflen)); - -cleanup: - - /* - * This function is also used to import keys. However, wiping the buffers - * upon failure is not necessary because failure only can happen before any - * input is copied. - */ - return ret; -} - -/* - * Export X into unsigned binary data, little endian - */ -int mbedtls_mpi_write_binary_le(const mbedtls_mpi *X, - unsigned char *buf, size_t buflen) -{ - return mbedtls_mpi_core_write_le(X->p, X->n, buf, buflen); -} - -/* - * Export X into unsigned binary data, big endian - */ -int mbedtls_mpi_write_binary(const mbedtls_mpi *X, - unsigned char *buf, size_t buflen) -{ - return mbedtls_mpi_core_write_be(X->p, X->n, buf, buflen); -} - -/* - * Left-shift: X <<= count - */ -int mbedtls_mpi_shift_l(mbedtls_mpi *X, size_t count) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - size_t i; - - i = mbedtls_mpi_bitlen(X) + count; - - if (X->n * biL < i) { - MBEDTLS_MPI_CHK(mbedtls_mpi_grow(X, BITS_TO_LIMBS(i))); - } - - ret = 0; - - mbedtls_mpi_core_shift_l(X->p, X->n, count); -cleanup: - - return ret; -} - -/* - * Right-shift: X >>= count - */ -int mbedtls_mpi_shift_r(mbedtls_mpi *X, size_t count) -{ - if (X->n != 0) { - mbedtls_mpi_core_shift_r(X->p, X->n, count); - } - return 0; -} - -/* - * Compare unsigned values - */ -int mbedtls_mpi_cmp_abs(const mbedtls_mpi *X, const mbedtls_mpi *Y) -{ - size_t i, j; - - for (i = X->n; i > 0; i--) { - if (X->p[i - 1] != 0) { - break; - } - } - - for (j = Y->n; j > 0; j--) { - if (Y->p[j - 1] != 0) { - break; - } - } - - /* If i == j == 0, i.e. abs(X) == abs(Y), - * we end up returning 0 at the end of the function. */ - - if (i > j) { - return 1; - } - if (j > i) { - return -1; - } - - for (; i > 0; i--) { - if (X->p[i - 1] > Y->p[i - 1]) { - return 1; - } - if (X->p[i - 1] < Y->p[i - 1]) { - return -1; - } - } - - return 0; -} - -/* - * Compare signed values - */ -int mbedtls_mpi_cmp_mpi(const mbedtls_mpi *X, const mbedtls_mpi *Y) -{ - size_t i, j; - - for (i = X->n; i > 0; i--) { - if (X->p[i - 1] != 0) { - break; - } - } - - for (j = Y->n; j > 0; j--) { - if (Y->p[j - 1] != 0) { - break; - } - } - - if (i == 0 && j == 0) { - return 0; - } - - if (i > j) { - return X->s; - } - if (j > i) { - return -Y->s; - } - - if (X->s > 0 && Y->s < 0) { - return 1; - } - if (Y->s > 0 && X->s < 0) { - return -1; - } - - for (; i > 0; i--) { - if (X->p[i - 1] > Y->p[i - 1]) { - return X->s; - } - if (X->p[i - 1] < Y->p[i - 1]) { - return -X->s; - } - } - - return 0; -} - -/* - * Compare signed values - */ -int mbedtls_mpi_cmp_int(const mbedtls_mpi *X, mbedtls_mpi_sint z) -{ - mbedtls_mpi Y; - mbedtls_mpi_uint p[1]; - - *p = mpi_sint_abs(z); - Y.s = TO_SIGN(z); - Y.n = 1; - Y.p = p; - - return mbedtls_mpi_cmp_mpi(X, &Y); -} - -/* - * Unsigned addition: X = |A| + |B| (HAC 14.7) - */ -int mbedtls_mpi_add_abs(mbedtls_mpi *X, const mbedtls_mpi *A, const mbedtls_mpi *B) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - size_t j; - mbedtls_mpi_uint *p; - mbedtls_mpi_uint c; - - if (X == B) { - const mbedtls_mpi *T = A; A = X; B = T; - } - - if (X != A) { - MBEDTLS_MPI_CHK(mbedtls_mpi_copy(X, A)); - } - - /* - * X must always be positive as a result of unsigned additions. - */ - X->s = 1; - - for (j = B->n; j > 0; j--) { - if (B->p[j - 1] != 0) { - break; - } - } - - /* Exit early to avoid undefined behavior on NULL+0 when X->n == 0 - * and B is 0 (of any size). */ - if (j == 0) { - return 0; - } - - MBEDTLS_MPI_CHK(mbedtls_mpi_grow(X, j)); - - /* j is the number of non-zero limbs of B. Add those to X. */ - - p = X->p; - - c = mbedtls_mpi_core_add(p, p, B->p, j); - - p += j; - - /* Now propagate any carry */ - - while (c != 0) { - if (j >= X->n) { - MBEDTLS_MPI_CHK(mbedtls_mpi_grow(X, j + 1)); - p = X->p + j; - } - - *p += c; c = (*p < c); j++; p++; - } - -cleanup: - - return ret; -} - -/* - * Unsigned subtraction: X = |A| - |B| (HAC 14.9, 14.10) - */ -int mbedtls_mpi_sub_abs(mbedtls_mpi *X, const mbedtls_mpi *A, const mbedtls_mpi *B) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - size_t n; - mbedtls_mpi_uint carry; - - for (n = B->n; n > 0; n--) { - if (B->p[n - 1] != 0) { - break; - } - } - if (n > A->n) { - /* B >= (2^ciL)^n > A */ - ret = MBEDTLS_ERR_MPI_NEGATIVE_VALUE; - goto cleanup; - } - - MBEDTLS_MPI_CHK(mbedtls_mpi_grow(X, A->n)); - - /* Set the high limbs of X to match A. Don't touch the lower limbs - * because X might be aliased to B, and we must not overwrite the - * significant digits of B. */ - if (A->n > n && A != X) { - memcpy(X->p + n, A->p + n, (A->n - n) * ciL); - } - if (X->n > A->n) { - memset(X->p + A->n, 0, (X->n - A->n) * ciL); - } - - carry = mbedtls_mpi_core_sub(X->p, A->p, B->p, n); - if (carry != 0) { - /* Propagate the carry through the rest of X. */ - carry = mbedtls_mpi_core_sub_int(X->p + n, X->p + n, carry, X->n - n); - - /* If we have further carry/borrow, the result is negative. */ - if (carry != 0) { - ret = MBEDTLS_ERR_MPI_NEGATIVE_VALUE; - goto cleanup; - } - } - - /* X should always be positive as a result of unsigned subtractions. */ - X->s = 1; - -cleanup: - return ret; -} - -/* Common function for signed addition and subtraction. - * Calculate A + B * flip_B where flip_B is 1 or -1. - */ -static int add_sub_mpi(mbedtls_mpi *X, - const mbedtls_mpi *A, const mbedtls_mpi *B, - int flip_B) -{ - int ret, s; - - s = A->s; - if (A->s * B->s * flip_B < 0) { - int cmp = mbedtls_mpi_cmp_abs(A, B); - if (cmp >= 0) { - MBEDTLS_MPI_CHK(mbedtls_mpi_sub_abs(X, A, B)); - /* If |A| = |B|, the result is 0 and we must set the sign bit - * to +1 regardless of which of A or B was negative. Otherwise, - * since |A| > |B|, the sign is the sign of A. */ - X->s = cmp == 0 ? 1 : s; - } else { - MBEDTLS_MPI_CHK(mbedtls_mpi_sub_abs(X, B, A)); - /* Since |A| < |B|, the sign is the opposite of A. */ - X->s = -s; - } - } else { - MBEDTLS_MPI_CHK(mbedtls_mpi_add_abs(X, A, B)); - X->s = s; - } - -cleanup: - - return ret; -} - -/* - * Signed addition: X = A + B - */ -int mbedtls_mpi_add_mpi(mbedtls_mpi *X, const mbedtls_mpi *A, const mbedtls_mpi *B) -{ - return add_sub_mpi(X, A, B, 1); -} - -/* - * Signed subtraction: X = A - B - */ -int mbedtls_mpi_sub_mpi(mbedtls_mpi *X, const mbedtls_mpi *A, const mbedtls_mpi *B) -{ - return add_sub_mpi(X, A, B, -1); -} - -/* - * Signed addition: X = A + b - */ -int mbedtls_mpi_add_int(mbedtls_mpi *X, const mbedtls_mpi *A, mbedtls_mpi_sint b) -{ - mbedtls_mpi B; - mbedtls_mpi_uint p[1]; - - p[0] = mpi_sint_abs(b); - B.s = TO_SIGN(b); - B.n = 1; - B.p = p; - - return mbedtls_mpi_add_mpi(X, A, &B); -} - -/* - * Signed subtraction: X = A - b - */ -int mbedtls_mpi_sub_int(mbedtls_mpi *X, const mbedtls_mpi *A, mbedtls_mpi_sint b) -{ - mbedtls_mpi B; - mbedtls_mpi_uint p[1]; - - p[0] = mpi_sint_abs(b); - B.s = TO_SIGN(b); - B.n = 1; - B.p = p; - - return mbedtls_mpi_sub_mpi(X, A, &B); -} - -#if !defined(MBEDTLS_MPI_MUL_MPI_ALT) -/* - * Baseline multiplication: X = A * B (HAC 14.12) - */ -int mbedtls_mpi_mul_mpi(mbedtls_mpi *X, const mbedtls_mpi *A, const mbedtls_mpi *B) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - size_t i, j; - mbedtls_mpi TA, TB; - int result_is_zero = 0; - - mbedtls_mpi_init(&TA); - mbedtls_mpi_init(&TB); - - if (X == A) { - MBEDTLS_MPI_CHK(mbedtls_mpi_copy(&TA, A)); A = &TA; - } - if (X == B) { - MBEDTLS_MPI_CHK(mbedtls_mpi_copy(&TB, B)); B = &TB; - } - - for (i = A->n; i > 0; i--) { - if (A->p[i - 1] != 0) { - break; - } - } - if (i == 0) { - result_is_zero = 1; - } - - for (j = B->n; j > 0; j--) { - if (B->p[j - 1] != 0) { - break; - } - } - if (j == 0) { - result_is_zero = 1; - } - - MBEDTLS_MPI_CHK(mbedtls_mpi_grow(X, i + j)); - MBEDTLS_MPI_CHK(mbedtls_mpi_lset(X, 0)); - - mbedtls_mpi_core_mul(X->p, A->p, i, B->p, j); - - /* If the result is 0, we don't shortcut the operation, which reduces - * but does not eliminate side channels leaking the zero-ness. We do - * need to take care to set the sign bit properly since the library does - * not fully support an MPI object with a value of 0 and s == -1. */ - if (result_is_zero) { - X->s = 1; - } else { - X->s = A->s * B->s; - } - -cleanup: - - mbedtls_mpi_free(&TB); mbedtls_mpi_free(&TA); - - return ret; -} - -/* - * Baseline multiplication: X = A * b - */ -int mbedtls_mpi_mul_int(mbedtls_mpi *X, const mbedtls_mpi *A, mbedtls_mpi_uint b) -{ - size_t n = A->n; - while (n > 0 && A->p[n - 1] == 0) { - --n; - } - - /* The general method below doesn't work if b==0. */ - if (b == 0 || n == 0) { - return mbedtls_mpi_lset(X, 0); - } - - /* Calculate A*b as A + A*(b-1) to take advantage of mbedtls_mpi_core_mla */ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - /* In general, A * b requires 1 limb more than b. If - * A->p[n - 1] * b / b == A->p[n - 1], then A * b fits in the same - * number of limbs as A and the call to grow() is not required since - * copy() will take care of the growth if needed. However, experimentally, - * making the call to grow() unconditional causes slightly fewer - * calls to calloc() in ECP code, presumably because it reuses the - * same mpi for a while and this way the mpi is more likely to directly - * grow to its final size. - * - * Note that calculating A*b as 0 + A*b doesn't work as-is because - * A,X can be the same. */ - MBEDTLS_MPI_CHK(mbedtls_mpi_grow(X, n + 1)); - MBEDTLS_MPI_CHK(mbedtls_mpi_copy(X, A)); - mbedtls_mpi_core_mla(X->p, X->n, A->p, n, b - 1); - -cleanup: - return ret; -} -#endif /* !defined(MBEDTLS_MPI_MUL_MPI_ALT) */ - -/* - * Unsigned integer divide - double mbedtls_mpi_uint dividend, u1/u0, and - * mbedtls_mpi_uint divisor, d - */ -static mbedtls_mpi_uint mbedtls_int_div_int(mbedtls_mpi_uint u1, - mbedtls_mpi_uint u0, - mbedtls_mpi_uint d, - mbedtls_mpi_uint *r) -{ -#if defined(MBEDTLS_HAVE_UDBL) - mbedtls_t_udbl dividend, quotient; -#else - const mbedtls_mpi_uint radix = (mbedtls_mpi_uint) 1 << biH; - const mbedtls_mpi_uint uint_halfword_mask = ((mbedtls_mpi_uint) 1 << biH) - 1; - mbedtls_mpi_uint d0, d1, q0, q1, rAX, r0, quotient; - mbedtls_mpi_uint u0_msw, u0_lsw; - size_t s; -#endif - - /* - * Check for overflow - */ - if (0 == d || u1 >= d) { - if (r != NULL) { - *r = ~(mbedtls_mpi_uint) 0u; - } - - return ~(mbedtls_mpi_uint) 0u; - } - -#if defined(MBEDTLS_HAVE_UDBL) - dividend = (mbedtls_t_udbl) u1 << biL; - dividend |= (mbedtls_t_udbl) u0; - quotient = dividend / d; - if (quotient > ((mbedtls_t_udbl) 1 << biL) - 1) { - quotient = ((mbedtls_t_udbl) 1 << biL) - 1; - } - - if (r != NULL) { - *r = (mbedtls_mpi_uint) (dividend - (quotient * d)); - } - - return (mbedtls_mpi_uint) quotient; -#else - - /* - * Algorithm D, Section 4.3.1 - The Art of Computer Programming - * Vol. 2 - Seminumerical Algorithms, Knuth - */ - - /* - * Normalize the divisor, d, and dividend, u0, u1 - */ - s = mbedtls_mpi_core_clz(d); - d = d << s; - - u1 = u1 << s; - u1 |= (u0 >> (biL - s)) & (-(mbedtls_mpi_sint) s >> (biL - 1)); - u0 = u0 << s; - - d1 = d >> biH; - d0 = d & uint_halfword_mask; - - u0_msw = u0 >> biH; - u0_lsw = u0 & uint_halfword_mask; - - /* - * Find the first quotient and remainder - */ - q1 = u1 / d1; - r0 = u1 - d1 * q1; - - while (q1 >= radix || (q1 * d0 > radix * r0 + u0_msw)) { - q1 -= 1; - r0 += d1; - - if (r0 >= radix) { - break; - } - } - - rAX = (u1 * radix) + (u0_msw - q1 * d); - q0 = rAX / d1; - r0 = rAX - q0 * d1; - - while (q0 >= radix || (q0 * d0 > radix * r0 + u0_lsw)) { - q0 -= 1; - r0 += d1; - - if (r0 >= radix) { - break; - } - } - - if (r != NULL) { - *r = (rAX * radix + u0_lsw - q0 * d) >> s; - } - - quotient = q1 * radix + q0; - - return quotient; -#endif -} - -/* - * Division by mbedtls_mpi: A = Q * B + R (HAC 14.20) - */ -int mbedtls_mpi_div_mpi(mbedtls_mpi *Q, mbedtls_mpi *R, const mbedtls_mpi *A, - const mbedtls_mpi *B) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - size_t i, n, t, k; - mbedtls_mpi X, Y, Z, T1, T2; - mbedtls_mpi_uint TP2[3]; - - if (mbedtls_mpi_cmp_int(B, 0) == 0) { - return MBEDTLS_ERR_MPI_DIVISION_BY_ZERO; - } - - mbedtls_mpi_init(&X); mbedtls_mpi_init(&Y); mbedtls_mpi_init(&Z); - mbedtls_mpi_init(&T1); - /* - * Avoid dynamic memory allocations for constant-size T2. - * - * T2 is used for comparison only and the 3 limbs are assigned explicitly, - * so nobody increase the size of the MPI and we're safe to use an on-stack - * buffer. - */ - T2.s = 1; - T2.n = sizeof(TP2) / sizeof(*TP2); - T2.p = TP2; - - if (mbedtls_mpi_cmp_abs(A, B) < 0) { - if (Q != NULL) { - MBEDTLS_MPI_CHK(mbedtls_mpi_lset(Q, 0)); - } - if (R != NULL) { - MBEDTLS_MPI_CHK(mbedtls_mpi_copy(R, A)); - } - return 0; - } - - MBEDTLS_MPI_CHK(mbedtls_mpi_copy(&X, A)); - MBEDTLS_MPI_CHK(mbedtls_mpi_copy(&Y, B)); - X.s = Y.s = 1; - - MBEDTLS_MPI_CHK(mbedtls_mpi_grow(&Z, A->n + 2)); - MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&Z, 0)); - MBEDTLS_MPI_CHK(mbedtls_mpi_grow(&T1, A->n + 2)); - - k = mbedtls_mpi_bitlen(&Y) % biL; - if (k < biL - 1) { - k = biL - 1 - k; - MBEDTLS_MPI_CHK(mbedtls_mpi_shift_l(&X, k)); - MBEDTLS_MPI_CHK(mbedtls_mpi_shift_l(&Y, k)); - } else { - k = 0; - } - - n = X.n - 1; - t = Y.n - 1; - MBEDTLS_MPI_CHK(mbedtls_mpi_shift_l(&Y, biL * (n - t))); - - while (mbedtls_mpi_cmp_mpi(&X, &Y) >= 0) { - Z.p[n - t]++; - MBEDTLS_MPI_CHK(mbedtls_mpi_sub_mpi(&X, &X, &Y)); - } - MBEDTLS_MPI_CHK(mbedtls_mpi_shift_r(&Y, biL * (n - t))); - - for (i = n; i > t; i--) { - if (X.p[i] >= Y.p[t]) { - Z.p[i - t - 1] = ~(mbedtls_mpi_uint) 0u; - } else { - Z.p[i - t - 1] = mbedtls_int_div_int(X.p[i], X.p[i - 1], - Y.p[t], NULL); - } - - T2.p[0] = (i < 2) ? 0 : X.p[i - 2]; - T2.p[1] = (i < 1) ? 0 : X.p[i - 1]; - T2.p[2] = X.p[i]; - - Z.p[i - t - 1]++; - do { - Z.p[i - t - 1]--; - - MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&T1, 0)); - T1.p[0] = (t < 1) ? 0 : Y.p[t - 1]; - T1.p[1] = Y.p[t]; - MBEDTLS_MPI_CHK(mbedtls_mpi_mul_int(&T1, &T1, Z.p[i - t - 1])); - } while (mbedtls_mpi_cmp_mpi(&T1, &T2) > 0); - - MBEDTLS_MPI_CHK(mbedtls_mpi_mul_int(&T1, &Y, Z.p[i - t - 1])); - MBEDTLS_MPI_CHK(mbedtls_mpi_shift_l(&T1, biL * (i - t - 1))); - MBEDTLS_MPI_CHK(mbedtls_mpi_sub_mpi(&X, &X, &T1)); - - if (mbedtls_mpi_cmp_int(&X, 0) < 0) { - MBEDTLS_MPI_CHK(mbedtls_mpi_copy(&T1, &Y)); - MBEDTLS_MPI_CHK(mbedtls_mpi_shift_l(&T1, biL * (i - t - 1))); - MBEDTLS_MPI_CHK(mbedtls_mpi_add_mpi(&X, &X, &T1)); - Z.p[i - t - 1]--; - } - } - - if (Q != NULL) { - MBEDTLS_MPI_CHK(mbedtls_mpi_copy(Q, &Z)); - Q->s = A->s * B->s; - } - - if (R != NULL) { - MBEDTLS_MPI_CHK(mbedtls_mpi_shift_r(&X, k)); - X.s = A->s; - MBEDTLS_MPI_CHK(mbedtls_mpi_copy(R, &X)); - - if (mbedtls_mpi_cmp_int(R, 0) == 0) { - R->s = 1; - } - } - -cleanup: - - mbedtls_mpi_free(&X); mbedtls_mpi_free(&Y); mbedtls_mpi_free(&Z); - mbedtls_mpi_free(&T1); - mbedtls_platform_zeroize(TP2, sizeof(TP2)); - - return ret; -} - -/* - * Division by int: A = Q * b + R - */ -int mbedtls_mpi_div_int(mbedtls_mpi *Q, mbedtls_mpi *R, - const mbedtls_mpi *A, - mbedtls_mpi_sint b) -{ - mbedtls_mpi B; - mbedtls_mpi_uint p[1]; - - p[0] = mpi_sint_abs(b); - B.s = TO_SIGN(b); - B.n = 1; - B.p = p; - - return mbedtls_mpi_div_mpi(Q, R, A, &B); -} - -/* - * Modulo: R = A mod B - */ -int mbedtls_mpi_mod_mpi(mbedtls_mpi *R, const mbedtls_mpi *A, const mbedtls_mpi *B) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - - if (mbedtls_mpi_cmp_int(B, 0) < 0) { - return MBEDTLS_ERR_MPI_NEGATIVE_VALUE; - } - - MBEDTLS_MPI_CHK(mbedtls_mpi_div_mpi(NULL, R, A, B)); - - while (mbedtls_mpi_cmp_int(R, 0) < 0) { - MBEDTLS_MPI_CHK(mbedtls_mpi_add_mpi(R, R, B)); - } - - while (mbedtls_mpi_cmp_mpi(R, B) >= 0) { - MBEDTLS_MPI_CHK(mbedtls_mpi_sub_mpi(R, R, B)); - } - -cleanup: - - return ret; -} - -/* - * Modulo: r = A mod b - */ -int mbedtls_mpi_mod_int(mbedtls_mpi_uint *r, const mbedtls_mpi *A, mbedtls_mpi_sint b) -{ - size_t i; - mbedtls_mpi_uint x, y, z; - - if (b == 0) { - return MBEDTLS_ERR_MPI_DIVISION_BY_ZERO; - } - - if (b < 0) { - return MBEDTLS_ERR_MPI_NEGATIVE_VALUE; - } - - /* - * handle trivial cases - */ - if (b == 1 || A->n == 0) { - *r = 0; - return 0; - } - - if (b == 2) { - *r = A->p[0] & 1; - return 0; - } - - /* - * general case - */ - for (i = A->n, y = 0; i > 0; i--) { - x = A->p[i - 1]; - y = (y << biH) | (x >> biH); - z = y / b; - y -= z * b; - - x <<= biH; - y = (y << biH) | (x >> biH); - z = y / b; - y -= z * b; - } - - /* - * If A is negative, then the current y represents a negative value. - * Flipping it to the positive side. - */ - if (A->s < 0 && y != 0) { - y = b - y; - } - - *r = y; - - return 0; -} - -#if !defined(MBEDTLS_MPI_EXP_MOD_ALT) -/* - * Warning! If the parameter E_public has MBEDTLS_MPI_IS_PUBLIC as its value, - * this function is not constant time with respect to the exponent (parameter E). - */ -static int mbedtls_mpi_exp_mod_optionally_safe(mbedtls_mpi *X, const mbedtls_mpi *A, - const mbedtls_mpi *E, int E_public, - const mbedtls_mpi *N, mbedtls_mpi *prec_RR) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - - if (mbedtls_mpi_cmp_int(N, 0) <= 0 || (N->p[0] & 1) == 0) { - return MBEDTLS_ERR_MPI_BAD_INPUT_DATA; - } - - if (mbedtls_mpi_cmp_int(E, 0) < 0) { - return MBEDTLS_ERR_MPI_BAD_INPUT_DATA; - } - - if (mbedtls_mpi_bitlen(E) > MBEDTLS_MPI_MAX_BITS || - mbedtls_mpi_bitlen(N) > MBEDTLS_MPI_MAX_BITS) { - return MBEDTLS_ERR_MPI_BAD_INPUT_DATA; - } - - /* - * Ensure that the exponent that we are passing to the core is not NULL. - */ - if (E->n == 0) { - ret = mbedtls_mpi_lset(X, 1); - return ret; - } - - /* - * Allocate working memory for mbedtls_mpi_core_exp_mod() - */ - size_t T_limbs = mbedtls_mpi_core_exp_mod_working_limbs(N->n, E->n); - mbedtls_mpi_uint *T = (mbedtls_mpi_uint *) mbedtls_calloc(T_limbs, sizeof(mbedtls_mpi_uint)); - if (T == NULL) { - return MBEDTLS_ERR_MPI_ALLOC_FAILED; - } - - mbedtls_mpi RR; - mbedtls_mpi_init(&RR); - - /* - * If 1st call, pre-compute R^2 mod N - */ - if (prec_RR == NULL || prec_RR->p == NULL) { - MBEDTLS_MPI_CHK(mbedtls_mpi_core_get_mont_r2_unsafe(&RR, N)); - - if (prec_RR != NULL) { - *prec_RR = RR; - } - } else { - MBEDTLS_MPI_CHK(mbedtls_mpi_grow(prec_RR, N->n)); - RR = *prec_RR; - } - - /* - * To preserve constness we need to make a copy of A. Using X for this to - * save memory. - */ - MBEDTLS_MPI_CHK(mbedtls_mpi_copy(X, A)); - - /* - * Compensate for negative A (and correct at the end). - */ - X->s = 1; - - /* - * Make sure that X is in a form that is safe for consumption by - * the core functions. - * - * - The core functions will not touch the limbs of X above N->n. The - * result will be correct if those limbs are 0, which the mod call - * ensures. - * - Also, X must have at least as many limbs as N for the calls to the - * core functions. - */ - if (mbedtls_mpi_cmp_mpi(X, N) >= 0) { - MBEDTLS_MPI_CHK(mbedtls_mpi_mod_mpi(X, X, N)); - } - MBEDTLS_MPI_CHK(mbedtls_mpi_grow(X, N->n)); - - /* - * Convert to and from Montgomery around mbedtls_mpi_core_exp_mod(). - */ - { - mbedtls_mpi_uint mm = mbedtls_mpi_core_montmul_init(N->p); - mbedtls_mpi_core_to_mont_rep(X->p, X->p, N->p, N->n, mm, RR.p, T); - if (E_public == MBEDTLS_MPI_IS_PUBLIC) { - mbedtls_mpi_core_exp_mod_unsafe(X->p, X->p, N->p, N->n, E->p, E->n, RR.p, T); - } else { - mbedtls_mpi_core_exp_mod(X->p, X->p, N->p, N->n, E->p, E->n, RR.p, T); - } - mbedtls_mpi_core_from_mont_rep(X->p, X->p, N->p, N->n, mm, T); - } - - /* - * Correct for negative A. - */ - if (A->s == -1 && (E->p[0] & 1) != 0) { - mbedtls_ct_condition_t is_x_non_zero = mbedtls_mpi_core_check_zero_ct(X->p, X->n); - X->s = mbedtls_ct_mpi_sign_if(is_x_non_zero, -1, 1); - - MBEDTLS_MPI_CHK(mbedtls_mpi_add_mpi(X, N, X)); - } - -cleanup: - - mbedtls_mpi_zeroize_and_free(T, T_limbs); - - if (prec_RR == NULL || prec_RR->p == NULL) { - mbedtls_mpi_free(&RR); - } - - return ret; -} - -#if !defined(MBEDTLS_MPI_EXP_MOD_ALT_FALLBACK) -int mbedtls_mpi_exp_mod(mbedtls_mpi *X, const mbedtls_mpi *A, - const mbedtls_mpi *E, const mbedtls_mpi *N, - mbedtls_mpi *prec_RR) -#else -int mbedtls_mpi_exp_mod_soft(mbedtls_mpi *X, const mbedtls_mpi *A, - const mbedtls_mpi *E, const mbedtls_mpi *N, - mbedtls_mpi *prec_RR) -#endif -{ - return mbedtls_mpi_exp_mod_optionally_safe(X, A, E, MBEDTLS_MPI_IS_SECRET, N, prec_RR); -} -#endif /* !MBEDTLS_MPI_EXP_MOD_ALT */ - -int mbedtls_mpi_exp_mod_unsafe(mbedtls_mpi *X, const mbedtls_mpi *A, - const mbedtls_mpi *E, const mbedtls_mpi *N, - mbedtls_mpi *prec_RR) -{ -#if defined(MBEDTLS_MPI_EXP_MOD_ALT) - return mbedtls_mpi_exp_mod(X, A, E, N, prec_RR); -#else - return mbedtls_mpi_exp_mod_optionally_safe(X, A, E, MBEDTLS_MPI_IS_PUBLIC, N, prec_RR); -#endif -} - -/* - * Greatest common divisor: G = gcd(A, B) (HAC 14.54) - */ -int mbedtls_mpi_gcd(mbedtls_mpi *G, const mbedtls_mpi *A, const mbedtls_mpi *B) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - size_t lz, lzt; - mbedtls_mpi TA, TB; - - mbedtls_mpi_init(&TA); mbedtls_mpi_init(&TB); - - MBEDTLS_MPI_CHK(mbedtls_mpi_copy(&TA, A)); - MBEDTLS_MPI_CHK(mbedtls_mpi_copy(&TB, B)); - - lz = mbedtls_mpi_lsb(&TA); - lzt = mbedtls_mpi_lsb(&TB); - - /* The loop below gives the correct result when A==0 but not when B==0. - * So have a special case for B==0. Leverage the fact that we just - * calculated the lsb and lsb(B)==0 iff B is odd or 0 to make the test - * slightly more efficient than cmp_int(). */ - if (lzt == 0 && mbedtls_mpi_get_bit(&TB, 0) == 0) { - ret = mbedtls_mpi_copy(G, A); - goto cleanup; - } - - if (lzt < lz) { - lz = lzt; - } - - TA.s = TB.s = 1; - - /* We mostly follow the procedure described in HAC 14.54, but with some - * minor differences: - * - Sequences of multiplications or divisions by 2 are grouped into a - * single shift operation. - * - The procedure in HAC assumes that 0 < TB <= TA. - * - The condition TB <= TA is not actually necessary for correctness. - * TA and TB have symmetric roles except for the loop termination - * condition, and the shifts at the beginning of the loop body - * remove any significance from the ordering of TA vs TB before - * the shifts. - * - If TA = 0, the loop goes through 0 iterations and the result is - * correctly TB. - * - The case TB = 0 was short-circuited above. - * - * For the correctness proof below, decompose the original values of - * A and B as - * A = sa * 2^a * A' with A'=0 or A' odd, and sa = +-1 - * B = sb * 2^b * B' with B'=0 or B' odd, and sb = +-1 - * Then gcd(A, B) = 2^{min(a,b)} * gcd(A',B'), - * and gcd(A',B') is odd or 0. - * - * At the beginning, we have TA = |A| and TB = |B| so gcd(A,B) = gcd(TA,TB). - * The code maintains the following invariant: - * gcd(A,B) = 2^k * gcd(TA,TB) for some k (I) - */ - - /* Proof that the loop terminates: - * At each iteration, either the right-shift by 1 is made on a nonzero - * value and the nonnegative integer bitlen(TA) + bitlen(TB) decreases - * by at least 1, or the right-shift by 1 is made on zero and then - * TA becomes 0 which ends the loop (TB cannot be 0 if it is right-shifted - * since in that case TB is calculated from TB-TA with the condition TB>TA). - */ - while (mbedtls_mpi_cmp_int(&TA, 0) != 0) { - /* Divisions by 2 preserve the invariant (I). */ - MBEDTLS_MPI_CHK(mbedtls_mpi_shift_r(&TA, mbedtls_mpi_lsb(&TA))); - MBEDTLS_MPI_CHK(mbedtls_mpi_shift_r(&TB, mbedtls_mpi_lsb(&TB))); - - /* Set either TA or TB to |TA-TB|/2. Since TA and TB are both odd, - * TA-TB is even so the division by 2 has an integer result. - * Invariant (I) is preserved since any odd divisor of both TA and TB - * also divides |TA-TB|/2, and any odd divisor of both TA and |TA-TB|/2 - * also divides TB, and any odd divisor of both TB and |TA-TB|/2 also - * divides TA. - */ - if (mbedtls_mpi_cmp_mpi(&TA, &TB) >= 0) { - MBEDTLS_MPI_CHK(mbedtls_mpi_sub_abs(&TA, &TA, &TB)); - MBEDTLS_MPI_CHK(mbedtls_mpi_shift_r(&TA, 1)); - } else { - MBEDTLS_MPI_CHK(mbedtls_mpi_sub_abs(&TB, &TB, &TA)); - MBEDTLS_MPI_CHK(mbedtls_mpi_shift_r(&TB, 1)); - } - /* Note that one of TA or TB is still odd. */ - } - - /* By invariant (I), gcd(A,B) = 2^k * gcd(TA,TB) for some k. - * At the loop exit, TA = 0, so gcd(TA,TB) = TB. - * - If there was at least one loop iteration, then one of TA or TB is odd, - * and TA = 0, so TB is odd and gcd(TA,TB) = gcd(A',B'). In this case, - * lz = min(a,b) so gcd(A,B) = 2^lz * TB. - * - If there was no loop iteration, then A was 0, and gcd(A,B) = B. - * In this case, lz = 0 and B = TB so gcd(A,B) = B = 2^lz * TB as well. - */ - - MBEDTLS_MPI_CHK(mbedtls_mpi_shift_l(&TB, lz)); - MBEDTLS_MPI_CHK(mbedtls_mpi_copy(G, &TB)); - -cleanup: - - mbedtls_mpi_free(&TA); mbedtls_mpi_free(&TB); - - return ret; -} - -/* - * Fill X with size bytes of random. - * The bytes returned from the RNG are used in a specific order which - * is suitable for deterministic ECDSA (see the specification of - * mbedtls_mpi_random() and the implementation in mbedtls_mpi_fill_random()). - */ -int mbedtls_mpi_fill_random(mbedtls_mpi *X, size_t size, - int (*f_rng)(void *, unsigned char *, size_t), - void *p_rng) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - const size_t limbs = CHARS_TO_LIMBS(size); - - /* Ensure that target MPI has exactly the necessary number of limbs */ - MBEDTLS_MPI_CHK(mbedtls_mpi_resize_clear(X, limbs)); - if (size == 0) { - return 0; - } - - ret = mbedtls_mpi_core_fill_random(X->p, X->n, size, f_rng, p_rng); - -cleanup: - return ret; -} - -int mbedtls_mpi_random(mbedtls_mpi *X, - mbedtls_mpi_sint min, - const mbedtls_mpi *N, - int (*f_rng)(void *, unsigned char *, size_t), - void *p_rng) -{ - if (min < 0) { - return MBEDTLS_ERR_MPI_BAD_INPUT_DATA; - } - if (mbedtls_mpi_cmp_int(N, min) <= 0) { - return MBEDTLS_ERR_MPI_BAD_INPUT_DATA; - } - - /* Ensure that target MPI has exactly the same number of limbs - * as the upper bound, even if the upper bound has leading zeros. - * This is necessary for mbedtls_mpi_core_random. */ - int ret = mbedtls_mpi_resize_clear(X, N->n); - if (ret != 0) { - return ret; - } - - return mbedtls_mpi_core_random(X->p, min, N->p, X->n, f_rng, p_rng); -} - -/* - * Modular inverse: X = A^-1 mod N (HAC 14.61 / 14.64) - */ -int mbedtls_mpi_inv_mod(mbedtls_mpi *X, const mbedtls_mpi *A, const mbedtls_mpi *N) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - mbedtls_mpi G, TA, TU, U1, U2, TB, TV, V1, V2; - - if (mbedtls_mpi_cmp_int(N, 1) <= 0) { - return MBEDTLS_ERR_MPI_BAD_INPUT_DATA; - } - - mbedtls_mpi_init(&TA); mbedtls_mpi_init(&TU); mbedtls_mpi_init(&U1); mbedtls_mpi_init(&U2); - mbedtls_mpi_init(&G); mbedtls_mpi_init(&TB); mbedtls_mpi_init(&TV); - mbedtls_mpi_init(&V1); mbedtls_mpi_init(&V2); - - MBEDTLS_MPI_CHK(mbedtls_mpi_gcd(&G, A, N)); - - if (mbedtls_mpi_cmp_int(&G, 1) != 0) { - ret = MBEDTLS_ERR_MPI_NOT_ACCEPTABLE; - goto cleanup; - } - - MBEDTLS_MPI_CHK(mbedtls_mpi_mod_mpi(&TA, A, N)); - MBEDTLS_MPI_CHK(mbedtls_mpi_copy(&TU, &TA)); - MBEDTLS_MPI_CHK(mbedtls_mpi_copy(&TB, N)); - MBEDTLS_MPI_CHK(mbedtls_mpi_copy(&TV, N)); - - MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&U1, 1)); - MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&U2, 0)); - MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&V1, 0)); - MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&V2, 1)); - - do { - while ((TU.p[0] & 1) == 0) { - MBEDTLS_MPI_CHK(mbedtls_mpi_shift_r(&TU, 1)); - - if ((U1.p[0] & 1) != 0 || (U2.p[0] & 1) != 0) { - MBEDTLS_MPI_CHK(mbedtls_mpi_add_mpi(&U1, &U1, &TB)); - MBEDTLS_MPI_CHK(mbedtls_mpi_sub_mpi(&U2, &U2, &TA)); - } - - MBEDTLS_MPI_CHK(mbedtls_mpi_shift_r(&U1, 1)); - MBEDTLS_MPI_CHK(mbedtls_mpi_shift_r(&U2, 1)); - } - - while ((TV.p[0] & 1) == 0) { - MBEDTLS_MPI_CHK(mbedtls_mpi_shift_r(&TV, 1)); - - if ((V1.p[0] & 1) != 0 || (V2.p[0] & 1) != 0) { - MBEDTLS_MPI_CHK(mbedtls_mpi_add_mpi(&V1, &V1, &TB)); - MBEDTLS_MPI_CHK(mbedtls_mpi_sub_mpi(&V2, &V2, &TA)); - } - - MBEDTLS_MPI_CHK(mbedtls_mpi_shift_r(&V1, 1)); - MBEDTLS_MPI_CHK(mbedtls_mpi_shift_r(&V2, 1)); - } - - if (mbedtls_mpi_cmp_mpi(&TU, &TV) >= 0) { - MBEDTLS_MPI_CHK(mbedtls_mpi_sub_mpi(&TU, &TU, &TV)); - MBEDTLS_MPI_CHK(mbedtls_mpi_sub_mpi(&U1, &U1, &V1)); - MBEDTLS_MPI_CHK(mbedtls_mpi_sub_mpi(&U2, &U2, &V2)); - } else { - MBEDTLS_MPI_CHK(mbedtls_mpi_sub_mpi(&TV, &TV, &TU)); - MBEDTLS_MPI_CHK(mbedtls_mpi_sub_mpi(&V1, &V1, &U1)); - MBEDTLS_MPI_CHK(mbedtls_mpi_sub_mpi(&V2, &V2, &U2)); - } - } while (mbedtls_mpi_cmp_int(&TU, 0) != 0); - - while (mbedtls_mpi_cmp_int(&V1, 0) < 0) { - MBEDTLS_MPI_CHK(mbedtls_mpi_add_mpi(&V1, &V1, N)); - } - - while (mbedtls_mpi_cmp_mpi(&V1, N) >= 0) { - MBEDTLS_MPI_CHK(mbedtls_mpi_sub_mpi(&V1, &V1, N)); - } - - MBEDTLS_MPI_CHK(mbedtls_mpi_copy(X, &V1)); - -cleanup: - - mbedtls_mpi_free(&TA); mbedtls_mpi_free(&TU); mbedtls_mpi_free(&U1); mbedtls_mpi_free(&U2); - mbedtls_mpi_free(&G); mbedtls_mpi_free(&TB); mbedtls_mpi_free(&TV); - mbedtls_mpi_free(&V1); mbedtls_mpi_free(&V2); - - return ret; -} - -#if defined(MBEDTLS_GENPRIME) - -/* Gaps between primes, starting at 3. https://oeis.org/A001223 */ -static const unsigned char small_prime_gaps[] = { - 2, 2, 4, 2, 4, 2, 4, 6, - 2, 6, 4, 2, 4, 6, 6, 2, - 6, 4, 2, 6, 4, 6, 8, 4, - 2, 4, 2, 4, 14, 4, 6, 2, - 10, 2, 6, 6, 4, 6, 6, 2, - 10, 2, 4, 2, 12, 12, 4, 2, - 4, 6, 2, 10, 6, 6, 6, 2, - 6, 4, 2, 10, 14, 4, 2, 4, - 14, 6, 10, 2, 4, 6, 8, 6, - 6, 4, 6, 8, 4, 8, 10, 2, - 10, 2, 6, 4, 6, 8, 4, 2, - 4, 12, 8, 4, 8, 4, 6, 12, - 2, 18, 6, 10, 6, 6, 2, 6, - 10, 6, 6, 2, 6, 6, 4, 2, - 12, 10, 2, 4, 6, 6, 2, 12, - 4, 6, 8, 10, 8, 10, 8, 6, - 6, 4, 8, 6, 4, 8, 4, 14, - 10, 12, 2, 10, 2, 4, 2, 10, - 14, 4, 2, 4, 14, 4, 2, 4, - 20, 4, 8, 10, 8, 4, 6, 6, - 14, 4, 6, 6, 8, 6, /*reaches 997*/ - 0 /* the last entry is effectively unused */ -}; - -/* - * Small divisors test (X must be positive) - * - * Return values: - * 0: no small factor (possible prime, more tests needed) - * 1: certain prime - * MBEDTLS_ERR_MPI_NOT_ACCEPTABLE: certain non-prime - * other negative: error - */ -static int mpi_check_small_factors(const mbedtls_mpi *X) -{ - int ret = 0; - size_t i; - mbedtls_mpi_uint r; - unsigned p = 3; /* The first odd prime */ - - if ((X->p[0] & 1) == 0) { - return MBEDTLS_ERR_MPI_NOT_ACCEPTABLE; - } - - for (i = 0; i < sizeof(small_prime_gaps); p += small_prime_gaps[i], i++) { - MBEDTLS_MPI_CHK(mbedtls_mpi_mod_int(&r, X, p)); - if (r == 0) { - if (mbedtls_mpi_cmp_int(X, p) == 0) { - return 1; - } else { - return MBEDTLS_ERR_MPI_NOT_ACCEPTABLE; - } - } - } - -cleanup: - return ret; -} - -/* - * Miller-Rabin pseudo-primality test (HAC 4.24) - */ -static int mpi_miller_rabin(const mbedtls_mpi *X, size_t rounds, - int (*f_rng)(void *, unsigned char *, size_t), - void *p_rng) -{ - int ret, count; - size_t i, j, k, s; - mbedtls_mpi W, R, T, A, RR; - - mbedtls_mpi_init(&W); mbedtls_mpi_init(&R); - mbedtls_mpi_init(&T); mbedtls_mpi_init(&A); - mbedtls_mpi_init(&RR); - - /* - * W = |X| - 1 - * R = W >> lsb( W ) - */ - MBEDTLS_MPI_CHK(mbedtls_mpi_sub_int(&W, X, 1)); - s = mbedtls_mpi_lsb(&W); - MBEDTLS_MPI_CHK(mbedtls_mpi_copy(&R, &W)); - MBEDTLS_MPI_CHK(mbedtls_mpi_shift_r(&R, s)); - - for (i = 0; i < rounds; i++) { - /* - * pick a random A, 1 < A < |X| - 1 - */ - count = 0; - do { - MBEDTLS_MPI_CHK(mbedtls_mpi_fill_random(&A, X->n * ciL, f_rng, p_rng)); - - j = mbedtls_mpi_bitlen(&A); - k = mbedtls_mpi_bitlen(&W); - if (j > k) { - A.p[A.n - 1] &= ((mbedtls_mpi_uint) 1 << (k - (A.n - 1) * biL - 1)) - 1; - } - - if (count++ > 30) { - ret = MBEDTLS_ERR_MPI_NOT_ACCEPTABLE; - goto cleanup; - } - - } while (mbedtls_mpi_cmp_mpi(&A, &W) >= 0 || - mbedtls_mpi_cmp_int(&A, 1) <= 0); - - /* - * A = A^R mod |X| - */ - MBEDTLS_MPI_CHK(mbedtls_mpi_exp_mod(&A, &A, &R, X, &RR)); - - if (mbedtls_mpi_cmp_mpi(&A, &W) == 0 || - mbedtls_mpi_cmp_int(&A, 1) == 0) { - continue; - } - - j = 1; - while (j < s && mbedtls_mpi_cmp_mpi(&A, &W) != 0) { - /* - * A = A * A mod |X| - */ - MBEDTLS_MPI_CHK(mbedtls_mpi_mul_mpi(&T, &A, &A)); - MBEDTLS_MPI_CHK(mbedtls_mpi_mod_mpi(&A, &T, X)); - - if (mbedtls_mpi_cmp_int(&A, 1) == 0) { - break; - } - - j++; - } - - /* - * not prime if A != |X| - 1 or A == 1 - */ - if (mbedtls_mpi_cmp_mpi(&A, &W) != 0 || - mbedtls_mpi_cmp_int(&A, 1) == 0) { - ret = MBEDTLS_ERR_MPI_NOT_ACCEPTABLE; - break; - } - } - -cleanup: - mbedtls_mpi_free(&W); mbedtls_mpi_free(&R); - mbedtls_mpi_free(&T); mbedtls_mpi_free(&A); - mbedtls_mpi_free(&RR); - - return ret; -} - -/* - * Pseudo-primality test: small factors, then Miller-Rabin - */ -int mbedtls_mpi_is_prime_ext(const mbedtls_mpi *X, int rounds, - int (*f_rng)(void *, unsigned char *, size_t), - void *p_rng) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - mbedtls_mpi XX; - - XX.s = 1; - XX.n = X->n; - XX.p = X->p; - - if (mbedtls_mpi_cmp_int(&XX, 0) == 0 || - mbedtls_mpi_cmp_int(&XX, 1) == 0) { - return MBEDTLS_ERR_MPI_NOT_ACCEPTABLE; - } - - if (mbedtls_mpi_cmp_int(&XX, 2) == 0) { - return 0; - } - - if ((ret = mpi_check_small_factors(&XX)) != 0) { - if (ret == 1) { - return 0; - } - - return ret; - } - - return mpi_miller_rabin(&XX, rounds, f_rng, p_rng); -} - -/* - * Prime number generation - * - * To generate an RSA key in a way recommended by FIPS 186-4, both primes must - * be either 1024 bits or 1536 bits long, and flags must contain - * MBEDTLS_MPI_GEN_PRIME_FLAG_LOW_ERR. - */ -int mbedtls_mpi_gen_prime(mbedtls_mpi *X, size_t nbits, int flags, - int (*f_rng)(void *, unsigned char *, size_t), - void *p_rng) -{ -#ifdef MBEDTLS_HAVE_INT64 -// ceil(2^63.5) -#define CEIL_MAXUINT_DIV_SQRT2 0xb504f333f9de6485ULL -#else -// ceil(2^31.5) -#define CEIL_MAXUINT_DIV_SQRT2 0xb504f334U -#endif - int ret = MBEDTLS_ERR_MPI_NOT_ACCEPTABLE; - size_t k, n; - int rounds; - mbedtls_mpi_uint r; - mbedtls_mpi Y; - - if (nbits < 3 || nbits > MBEDTLS_MPI_MAX_BITS) { - return MBEDTLS_ERR_MPI_BAD_INPUT_DATA; - } - - mbedtls_mpi_init(&Y); - - n = BITS_TO_LIMBS(nbits); - - if ((flags & MBEDTLS_MPI_GEN_PRIME_FLAG_LOW_ERR) == 0) { - /* - * 2^-80 error probability, number of rounds chosen per HAC, table 4.4 - */ - rounds = ((nbits >= 1300) ? 2 : (nbits >= 850) ? 3 : - (nbits >= 650) ? 4 : (nbits >= 350) ? 8 : - (nbits >= 250) ? 12 : (nbits >= 150) ? 18 : 27); - } else { - /* - * 2^-100 error probability, number of rounds computed based on HAC, - * fact 4.48 - */ - rounds = ((nbits >= 1450) ? 4 : (nbits >= 1150) ? 5 : - (nbits >= 1000) ? 6 : (nbits >= 850) ? 7 : - (nbits >= 750) ? 8 : (nbits >= 500) ? 13 : - (nbits >= 250) ? 28 : (nbits >= 150) ? 40 : 51); - } - - while (1) { - MBEDTLS_MPI_CHK(mbedtls_mpi_fill_random(X, n * ciL, f_rng, p_rng)); - /* make sure generated number is at least (nbits-1)+0.5 bits (FIPS 186-4 §B.3.3 steps 4.4, 5.5) */ - if (X->p[n-1] < CEIL_MAXUINT_DIV_SQRT2) { - continue; - } - - k = n * biL; - if (k > nbits) { - MBEDTLS_MPI_CHK(mbedtls_mpi_shift_r(X, k - nbits)); - } - X->p[0] |= 1; - - if ((flags & MBEDTLS_MPI_GEN_PRIME_FLAG_DH) == 0) { - ret = mbedtls_mpi_is_prime_ext(X, rounds, f_rng, p_rng); - - if (ret != MBEDTLS_ERR_MPI_NOT_ACCEPTABLE) { - goto cleanup; - } - } else { - /* - * A necessary condition for Y and X = 2Y + 1 to be prime - * is X = 2 mod 3 (which is equivalent to Y = 2 mod 3). - * Make sure it is satisfied, while keeping X = 3 mod 4 - */ - - X->p[0] |= 2; - - MBEDTLS_MPI_CHK(mbedtls_mpi_mod_int(&r, X, 3)); - if (r == 0) { - MBEDTLS_MPI_CHK(mbedtls_mpi_add_int(X, X, 8)); - } else if (r == 1) { - MBEDTLS_MPI_CHK(mbedtls_mpi_add_int(X, X, 4)); - } - - /* Set Y = (X-1) / 2, which is X / 2 because X is odd */ - MBEDTLS_MPI_CHK(mbedtls_mpi_copy(&Y, X)); - MBEDTLS_MPI_CHK(mbedtls_mpi_shift_r(&Y, 1)); - - while (1) { - /* - * First, check small factors for X and Y - * before doing Miller-Rabin on any of them - */ - if ((ret = mpi_check_small_factors(X)) == 0 && - (ret = mpi_check_small_factors(&Y)) == 0 && - (ret = mpi_miller_rabin(X, rounds, f_rng, p_rng)) - == 0 && - (ret = mpi_miller_rabin(&Y, rounds, f_rng, p_rng)) - == 0) { - goto cleanup; - } - - if (ret != MBEDTLS_ERR_MPI_NOT_ACCEPTABLE) { - goto cleanup; - } - - /* - * Next candidates. We want to preserve Y = (X-1) / 2 and - * Y = 1 mod 2 and Y = 2 mod 3 (eq X = 3 mod 4 and X = 2 mod 3) - * so up Y by 6 and X by 12. - */ - MBEDTLS_MPI_CHK(mbedtls_mpi_add_int(X, X, 12)); - MBEDTLS_MPI_CHK(mbedtls_mpi_add_int(&Y, &Y, 6)); - } - } - } - -cleanup: - - mbedtls_mpi_free(&Y); - - return ret; -} - -#endif /* MBEDTLS_GENPRIME */ -#endif /* MBEDTLS_BIGNUM_ALT */ - -#if defined(MBEDTLS_SELF_TEST) - -#define GCD_PAIR_COUNT 3 - -static const int gcd_pairs[GCD_PAIR_COUNT][3] = -{ - { 693, 609, 21 }, - { 1764, 868, 28 }, - { 768454923, 542167814, 1 } -}; - -/* - * Checkup routine - */ -int mbedtls_mpi_self_test(int verbose) -{ - int ret, i; - mbedtls_mpi A, E, N, X, Y, U, V; - - mbedtls_mpi_init(&A); mbedtls_mpi_init(&E); mbedtls_mpi_init(&N); mbedtls_mpi_init(&X); - mbedtls_mpi_init(&Y); mbedtls_mpi_init(&U); mbedtls_mpi_init(&V); - - MBEDTLS_MPI_CHK(mbedtls_mpi_read_string(&A, 16, - "EFE021C2645FD1DC586E69184AF4A31E" \ - "D5F53E93B5F123FA41680867BA110131" \ - "944FE7952E2517337780CB0DB80E61AA" \ - "E7C8DDC6C5C6AADEB34EB38A2F40D5E6")); - - MBEDTLS_MPI_CHK(mbedtls_mpi_read_string(&E, 16, - "B2E7EFD37075B9F03FF989C7C5051C20" \ - "34D2A323810251127E7BF8625A4F49A5" \ - "F3E27F4DA8BD59C47D6DAABA4C8127BD" \ - "5B5C25763222FEFCCFC38B832366C29E")); - - MBEDTLS_MPI_CHK(mbedtls_mpi_read_string(&N, 16, - "0066A198186C18C10B2F5ED9B522752A" \ - "9830B69916E535C8F047518A889A43A5" \ - "94B6BED27A168D31D4A52F88925AA8F5")); - - MBEDTLS_MPI_CHK(mbedtls_mpi_mul_mpi(&X, &A, &N)); - - MBEDTLS_MPI_CHK(mbedtls_mpi_read_string(&U, 16, - "602AB7ECA597A3D6B56FF9829A5E8B85" \ - "9E857EA95A03512E2BAE7391688D264A" \ - "A5663B0341DB9CCFD2C4C5F421FEC814" \ - "8001B72E848A38CAE1C65F78E56ABDEF" \ - "E12D3C039B8A02D6BE593F0BBBDA56F1" \ - "ECF677152EF804370C1A305CAF3B5BF1" \ - "30879B56C61DE584A0F53A2447A51E")); - - if (verbose != 0) { - mbedtls_printf(" MPI test #1 (mul_mpi): "); - } - - if (mbedtls_mpi_cmp_mpi(&X, &U) != 0) { - if (verbose != 0) { - mbedtls_printf("failed\n"); - } - - ret = 1; - goto cleanup; - } - - if (verbose != 0) { - mbedtls_printf("passed\n"); - } - - MBEDTLS_MPI_CHK(mbedtls_mpi_div_mpi(&X, &Y, &A, &N)); - - MBEDTLS_MPI_CHK(mbedtls_mpi_read_string(&U, 16, - "256567336059E52CAE22925474705F39A94")); - - MBEDTLS_MPI_CHK(mbedtls_mpi_read_string(&V, 16, - "6613F26162223DF488E9CD48CC132C7A" \ - "0AC93C701B001B092E4E5B9F73BCD27B" \ - "9EE50D0657C77F374E903CDFA4C642")); - - if (verbose != 0) { - mbedtls_printf(" MPI test #2 (div_mpi): "); - } - - if (mbedtls_mpi_cmp_mpi(&X, &U) != 0 || - mbedtls_mpi_cmp_mpi(&Y, &V) != 0) { - if (verbose != 0) { - mbedtls_printf("failed\n"); - } - - ret = 1; - goto cleanup; - } - - if (verbose != 0) { - mbedtls_printf("passed\n"); - } - - MBEDTLS_MPI_CHK(mbedtls_mpi_exp_mod(&X, &A, &E, &N, NULL)); - - MBEDTLS_MPI_CHK(mbedtls_mpi_read_string(&U, 16, - "36E139AEA55215609D2816998ED020BB" \ - "BD96C37890F65171D948E9BC7CBAA4D9" \ - "325D24D6A3C12710F10A09FA08AB87")); - - if (verbose != 0) { - mbedtls_printf(" MPI test #3 (exp_mod): "); - } - - if (mbedtls_mpi_cmp_mpi(&X, &U) != 0) { - if (verbose != 0) { - mbedtls_printf("failed\n"); - } - - ret = 1; - goto cleanup; - } - - if (verbose != 0) { - mbedtls_printf("passed\n"); - } - - MBEDTLS_MPI_CHK(mbedtls_mpi_inv_mod(&X, &A, &N)); - - MBEDTLS_MPI_CHK(mbedtls_mpi_read_string(&U, 16, - "003A0AAEDD7E784FC07D8F9EC6E3BFD5" \ - "C3DBA76456363A10869622EAC2DD84EC" \ - "C5B8A74DAC4D09E03B5E0BE779F2DF61")); - - if (verbose != 0) { - mbedtls_printf(" MPI test #4 (inv_mod): "); - } - - if (mbedtls_mpi_cmp_mpi(&X, &U) != 0) { - if (verbose != 0) { - mbedtls_printf("failed\n"); - } - - ret = 1; - goto cleanup; - } - - if (verbose != 0) { - mbedtls_printf("passed\n"); - } - - if (verbose != 0) { - mbedtls_printf(" MPI test #5 (simple gcd): "); - } - - for (i = 0; i < GCD_PAIR_COUNT; i++) { - MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&X, gcd_pairs[i][0])); - MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&Y, gcd_pairs[i][1])); - - MBEDTLS_MPI_CHK(mbedtls_mpi_gcd(&A, &X, &Y)); - - if (mbedtls_mpi_cmp_int(&A, gcd_pairs[i][2]) != 0) { - if (verbose != 0) { - mbedtls_printf("failed at %d\n", i); - } - - ret = 1; - goto cleanup; - } - } - - if (verbose != 0) { - mbedtls_printf("passed\n"); - } - -cleanup: - - if (ret != 0 && verbose != 0) { - mbedtls_printf("Unexpected error, return code = %08X\n", (unsigned int) ret); - } - - mbedtls_mpi_free(&A); mbedtls_mpi_free(&E); mbedtls_mpi_free(&N); mbedtls_mpi_free(&X); - mbedtls_mpi_free(&Y); mbedtls_mpi_free(&U); mbedtls_mpi_free(&V); - - if (verbose != 0) { - mbedtls_printf("\n"); - } - - return ret; -} - -#endif /* MBEDTLS_SELF_TEST */ - -#endif /* MBEDTLS_BIGNUM_C */ diff --git a/tf-psa-crypto/drivers/builtin/src/ecp.c b/tf-psa-crypto/drivers/builtin/src/ecp.c deleted file mode 100644 index 2fd40f1457..0000000000 --- a/tf-psa-crypto/drivers/builtin/src/ecp.c +++ /dev/null @@ -1,3587 +0,0 @@ -/* - * Elliptic curves over GF(p): generic functions - * - * Copyright The Mbed TLS Contributors - * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later - */ - -/* - * References: - * - * SEC1 https://www.secg.org/sec1-v2.pdf - * GECC = Guide to Elliptic Curve Cryptography - Hankerson, Menezes, Vanstone - * FIPS 186-3 http://csrc.nist.gov/publications/fips/fips186-3/fips_186-3.pdf - * RFC 4492 for the related TLS structures and constants - * - https://www.rfc-editor.org/rfc/rfc4492 - * RFC 7748 for the Curve448 and Curve25519 curve definitions - * - https://www.rfc-editor.org/rfc/rfc7748 - * - * [Curve25519] https://cr.yp.to/ecdh/curve25519-20060209.pdf - * - * [2] CORON, Jean-S'ebastien. Resistance against differential power analysis - * for elliptic curve cryptosystems. In : Cryptographic Hardware and - * Embedded Systems. Springer Berlin Heidelberg, 1999. p. 292-302. - * - * - * [3] HEDABOU, Mustapha, PINEL, Pierre, et B'EN'ETEAU, Lucien. A comb method to - * render ECC resistant against Side Channel Attacks. IACR Cryptology - * ePrint Archive, 2004, vol. 2004, p. 342. - * - */ - -#include "common.h" - -#if defined(MBEDTLS_ECP_LIGHT) - -#include "mbedtls/ecp.h" -#include "mbedtls/threading.h" -#include "mbedtls/platform_util.h" -#include "mbedtls/error_common.h" - -#include "bn_mul.h" -#include "ecp_invasive.h" - -#include - -#include "mbedtls/platform.h" - -#if defined(MBEDTLS_SELF_TEST) -/* - * Counts of point addition and doubling, and field multiplications. - * Used to test resistance of point multiplication to simple timing attacks. - */ -#if defined(MBEDTLS_ECP_C) -static unsigned long add_count, dbl_count; -#endif /* MBEDTLS_ECP_C */ -static unsigned long mul_count; -#endif - -#if defined(MBEDTLS_ECP_RESTARTABLE) -/* - * Maximum number of "basic operations" to be done in a row. - * - * Default value 0 means that ECC operations will not yield. - * Note that regardless of the value of ecp_max_ops, always at - * least one step is performed before yielding. - * - * Setting ecp_max_ops=1 can be suitable for testing purposes - * as it will interrupt computation at all possible points. - */ -static unsigned ecp_max_ops = 0; - -/* - * Set ecp_max_ops - */ -void mbedtls_ecp_set_max_ops(unsigned max_ops) -{ - ecp_max_ops = max_ops; -} - -/* - * Check if restart is enabled - */ -int mbedtls_ecp_restart_is_enabled(void) -{ - return ecp_max_ops != 0; -} - -/* - * Restart sub-context for ecp_mul_comb() - */ -struct mbedtls_ecp_restart_mul { - mbedtls_ecp_point R; /* current intermediate result */ - size_t i; /* current index in various loops, 0 outside */ - mbedtls_ecp_point *T; /* table for precomputed points */ - unsigned char T_size; /* number of points in table T */ - enum { /* what were we doing last time we returned? */ - ecp_rsm_init = 0, /* nothing so far, dummy initial state */ - ecp_rsm_pre_dbl, /* precompute 2^n multiples */ - ecp_rsm_pre_norm_dbl, /* normalize precomputed 2^n multiples */ - ecp_rsm_pre_add, /* precompute remaining points by adding */ - ecp_rsm_pre_norm_add, /* normalize all precomputed points */ - ecp_rsm_comb_core, /* ecp_mul_comb_core() */ - ecp_rsm_final_norm, /* do the final normalization */ - } state; -}; - -/* - * Init restart_mul sub-context - */ -static void ecp_restart_rsm_init(mbedtls_ecp_restart_mul_ctx *ctx) -{ - mbedtls_ecp_point_init(&ctx->R); - ctx->i = 0; - ctx->T = NULL; - ctx->T_size = 0; - ctx->state = ecp_rsm_init; -} - -/* - * Free the components of a restart_mul sub-context - */ -static void ecp_restart_rsm_free(mbedtls_ecp_restart_mul_ctx *ctx) -{ - unsigned char i; - - if (ctx == NULL) { - return; - } - - mbedtls_ecp_point_free(&ctx->R); - - if (ctx->T != NULL) { - for (i = 0; i < ctx->T_size; i++) { - mbedtls_ecp_point_free(ctx->T + i); - } - mbedtls_free(ctx->T); - } - - ecp_restart_rsm_init(ctx); -} - -/* - * Restart context for ecp_muladd() - */ -struct mbedtls_ecp_restart_muladd { - mbedtls_ecp_point mP; /* mP value */ - mbedtls_ecp_point R; /* R intermediate result */ - enum { /* what should we do next? */ - ecp_rsma_mul1 = 0, /* first multiplication */ - ecp_rsma_mul2, /* second multiplication */ - ecp_rsma_add, /* addition */ - ecp_rsma_norm, /* normalization */ - } state; -}; - -/* - * Init restart_muladd sub-context - */ -static void ecp_restart_ma_init(mbedtls_ecp_restart_muladd_ctx *ctx) -{ - mbedtls_ecp_point_init(&ctx->mP); - mbedtls_ecp_point_init(&ctx->R); - ctx->state = ecp_rsma_mul1; -} - -/* - * Free the components of a restart_muladd sub-context - */ -static void ecp_restart_ma_free(mbedtls_ecp_restart_muladd_ctx *ctx) -{ - if (ctx == NULL) { - return; - } - - mbedtls_ecp_point_free(&ctx->mP); - mbedtls_ecp_point_free(&ctx->R); - - ecp_restart_ma_init(ctx); -} - -/* - * Initialize a restart context - */ -void mbedtls_ecp_restart_init(mbedtls_ecp_restart_ctx *ctx) -{ - ctx->ops_done = 0; - ctx->depth = 0; - ctx->rsm = NULL; - ctx->ma = NULL; -} - -/* - * Free the components of a restart context - */ -void mbedtls_ecp_restart_free(mbedtls_ecp_restart_ctx *ctx) -{ - if (ctx == NULL) { - return; - } - - ecp_restart_rsm_free(ctx->rsm); - mbedtls_free(ctx->rsm); - - ecp_restart_ma_free(ctx->ma); - mbedtls_free(ctx->ma); - - mbedtls_ecp_restart_init(ctx); -} - -/* - * Check if we can do the next step - */ -int mbedtls_ecp_check_budget(const mbedtls_ecp_group *grp, - mbedtls_ecp_restart_ctx *rs_ctx, - unsigned ops) -{ - if (rs_ctx != NULL && ecp_max_ops != 0) { - /* scale depending on curve size: the chosen reference is 256-bit, - * and multiplication is quadratic. Round to the closest integer. */ - if (grp->pbits >= 512) { - ops *= 4; - } else if (grp->pbits >= 384) { - ops *= 2; - } - - /* Avoid infinite loops: always allow first step. - * Because of that, however, it's not generally true - * that ops_done <= ecp_max_ops, so the check - * ops_done > ecp_max_ops below is mandatory. */ - if ((rs_ctx->ops_done != 0) && - (rs_ctx->ops_done > ecp_max_ops || - ops > ecp_max_ops - rs_ctx->ops_done)) { - return MBEDTLS_ERR_ECP_IN_PROGRESS; - } - - /* update running count */ - rs_ctx->ops_done += ops; - } - - return 0; -} - -/* Call this when entering a function that needs its own sub-context */ -#define ECP_RS_ENTER(SUB) do { \ - /* reset ops count for this call if top-level */ \ - if (rs_ctx != NULL && rs_ctx->depth++ == 0) \ - rs_ctx->ops_done = 0; \ - \ - /* set up our own sub-context if needed */ \ - if (mbedtls_ecp_restart_is_enabled() && \ - rs_ctx != NULL && rs_ctx->SUB == NULL) \ - { \ - rs_ctx->SUB = mbedtls_calloc(1, sizeof(*rs_ctx->SUB)); \ - if (rs_ctx->SUB == NULL) \ - return MBEDTLS_ERR_ECP_ALLOC_FAILED; \ - \ - ecp_restart_## SUB ##_init(rs_ctx->SUB); \ - } \ -} while (0) - -/* Call this when leaving a function that needs its own sub-context */ -#define ECP_RS_LEAVE(SUB) do { \ - /* clear our sub-context when not in progress (done or error) */ \ - if (rs_ctx != NULL && rs_ctx->SUB != NULL && \ - ret != MBEDTLS_ERR_ECP_IN_PROGRESS) \ - { \ - ecp_restart_## SUB ##_free(rs_ctx->SUB); \ - mbedtls_free(rs_ctx->SUB); \ - rs_ctx->SUB = NULL; \ - } \ - \ - if (rs_ctx != NULL) \ - rs_ctx->depth--; \ -} while (0) - -#else /* MBEDTLS_ECP_RESTARTABLE */ - -#define ECP_RS_ENTER(sub) (void) rs_ctx; -#define ECP_RS_LEAVE(sub) (void) rs_ctx; - -#endif /* MBEDTLS_ECP_RESTARTABLE */ - -#if defined(MBEDTLS_ECP_C) -static void mpi_init_many(mbedtls_mpi *arr, size_t size) -{ - while (size--) { - mbedtls_mpi_init(arr++); - } -} - -static void mpi_free_many(mbedtls_mpi *arr, size_t size) -{ - while (size--) { - mbedtls_mpi_free(arr++); - } -} -#endif /* MBEDTLS_ECP_C */ - -/* - * List of supported curves: - * - internal ID - * - TLS NamedCurve ID (RFC 4492 sec. 5.1.1, RFC 7071 sec. 2, RFC 8446 sec. 4.2.7) - * - size in bits - * - readable name - * - * Curves are listed in order: largest curves first, and for a given size, - * fastest curves first. - * - * Reminder: update profiles in x509_crt.c and ssl_tls.c when adding a new curve! - */ -static const mbedtls_ecp_curve_info ecp_supported_curves[] = -{ -#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED) - { MBEDTLS_ECP_DP_SECP521R1, 25, 521, "secp521r1" }, -#endif -#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED) - { MBEDTLS_ECP_DP_BP512R1, 28, 512, "brainpoolP512r1" }, -#endif -#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED) - { MBEDTLS_ECP_DP_SECP384R1, 24, 384, "secp384r1" }, -#endif -#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED) - { MBEDTLS_ECP_DP_BP384R1, 27, 384, "brainpoolP384r1" }, -#endif -#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED) - { MBEDTLS_ECP_DP_SECP256R1, 23, 256, "secp256r1" }, -#endif -#if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED) - { MBEDTLS_ECP_DP_SECP256K1, 22, 256, "secp256k1" }, -#endif -#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED) - { MBEDTLS_ECP_DP_BP256R1, 26, 256, "brainpoolP256r1" }, -#endif -#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED) - { MBEDTLS_ECP_DP_SECP224R1, 21, 224, "secp224r1" }, -#endif -#if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED) - { MBEDTLS_ECP_DP_SECP224K1, 20, 224, "secp224k1" }, -#endif -#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) - { MBEDTLS_ECP_DP_SECP192R1, 19, 192, "secp192r1" }, -#endif -#if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED) - { MBEDTLS_ECP_DP_SECP192K1, 18, 192, "secp192k1" }, -#endif -#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) - { MBEDTLS_ECP_DP_CURVE25519, 29, 256, "x25519" }, -#endif -#if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED) - { MBEDTLS_ECP_DP_CURVE448, 30, 448, "x448" }, -#endif - { MBEDTLS_ECP_DP_NONE, 0, 0, NULL }, -}; - -#define ECP_NB_CURVES sizeof(ecp_supported_curves) / \ - sizeof(ecp_supported_curves[0]) - -static mbedtls_ecp_group_id ecp_supported_grp_id[ECP_NB_CURVES]; - -/* - * List of supported curves and associated info - */ -const mbedtls_ecp_curve_info *mbedtls_ecp_curve_list(void) -{ - return ecp_supported_curves; -} - -/* - * List of supported curves, group ID only - */ -const mbedtls_ecp_group_id *mbedtls_ecp_grp_id_list(void) -{ - static int init_done = 0; - - if (!init_done) { - size_t i = 0; - const mbedtls_ecp_curve_info *curve_info; - - for (curve_info = mbedtls_ecp_curve_list(); - curve_info->grp_id != MBEDTLS_ECP_DP_NONE; - curve_info++) { - ecp_supported_grp_id[i++] = curve_info->grp_id; - } - ecp_supported_grp_id[i] = MBEDTLS_ECP_DP_NONE; - - init_done = 1; - } - - return ecp_supported_grp_id; -} - -/* - * Get the curve info for the internal identifier - */ -const mbedtls_ecp_curve_info *mbedtls_ecp_curve_info_from_grp_id(mbedtls_ecp_group_id grp_id) -{ - const mbedtls_ecp_curve_info *curve_info; - - for (curve_info = mbedtls_ecp_curve_list(); - curve_info->grp_id != MBEDTLS_ECP_DP_NONE; - curve_info++) { - if (curve_info->grp_id == grp_id) { - return curve_info; - } - } - - return NULL; -} - -/* - * Get the curve info from the TLS identifier - */ -const mbedtls_ecp_curve_info *mbedtls_ecp_curve_info_from_tls_id(uint16_t tls_id) -{ - const mbedtls_ecp_curve_info *curve_info; - - for (curve_info = mbedtls_ecp_curve_list(); - curve_info->grp_id != MBEDTLS_ECP_DP_NONE; - curve_info++) { - if (curve_info->tls_id == tls_id) { - return curve_info; - } - } - - return NULL; -} - -/* - * Get the curve info from the name - */ -const mbedtls_ecp_curve_info *mbedtls_ecp_curve_info_from_name(const char *name) -{ - const mbedtls_ecp_curve_info *curve_info; - - if (name == NULL) { - return NULL; - } - - for (curve_info = mbedtls_ecp_curve_list(); - curve_info->grp_id != MBEDTLS_ECP_DP_NONE; - curve_info++) { - if (strcmp(curve_info->name, name) == 0) { - return curve_info; - } - } - - return NULL; -} - -/* - * Get the type of a curve - */ -mbedtls_ecp_curve_type mbedtls_ecp_get_type(const mbedtls_ecp_group *grp) -{ - if (grp->G.X.p == NULL) { - return MBEDTLS_ECP_TYPE_NONE; - } - - if (grp->G.Y.p == NULL) { - return MBEDTLS_ECP_TYPE_MONTGOMERY; - } else { - return MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS; - } -} - -/* - * Initialize (the components of) a point - */ -void mbedtls_ecp_point_init(mbedtls_ecp_point *pt) -{ - mbedtls_mpi_init(&pt->X); - mbedtls_mpi_init(&pt->Y); - mbedtls_mpi_init(&pt->Z); -} - -/* - * Initialize (the components of) a group - */ -void mbedtls_ecp_group_init(mbedtls_ecp_group *grp) -{ - grp->id = MBEDTLS_ECP_DP_NONE; - mbedtls_mpi_init(&grp->P); - mbedtls_mpi_init(&grp->A); - mbedtls_mpi_init(&grp->B); - mbedtls_ecp_point_init(&grp->G); - mbedtls_mpi_init(&grp->N); - grp->pbits = 0; - grp->nbits = 0; - grp->h = 0; - grp->modp = NULL; - grp->t_pre = NULL; - grp->t_post = NULL; - grp->t_data = NULL; - grp->T = NULL; - grp->T_size = 0; -} - -/* - * Initialize (the components of) a key pair - */ -void mbedtls_ecp_keypair_init(mbedtls_ecp_keypair *key) -{ - mbedtls_ecp_group_init(&key->grp); - mbedtls_mpi_init(&key->d); - mbedtls_ecp_point_init(&key->Q); -} - -/* - * Unallocate (the components of) a point - */ -void mbedtls_ecp_point_free(mbedtls_ecp_point *pt) -{ - if (pt == NULL) { - return; - } - - mbedtls_mpi_free(&(pt->X)); - mbedtls_mpi_free(&(pt->Y)); - mbedtls_mpi_free(&(pt->Z)); -} - -/* - * Check that the comb table (grp->T) is static initialized. - */ -static int ecp_group_is_static_comb_table(const mbedtls_ecp_group *grp) -{ -#if MBEDTLS_ECP_FIXED_POINT_OPTIM == 1 - return grp->T != NULL && grp->T_size == 0; -#else - (void) grp; - return 0; -#endif -} - -/* - * Unallocate (the components of) a group - */ -void mbedtls_ecp_group_free(mbedtls_ecp_group *grp) -{ - size_t i; - - if (grp == NULL) { - return; - } - - if (grp->h != 1) { - mbedtls_mpi_free(&grp->A); - mbedtls_mpi_free(&grp->B); - mbedtls_ecp_point_free(&grp->G); - -#if !defined(MBEDTLS_ECP_WITH_MPI_UINT) - mbedtls_mpi_free(&grp->N); - mbedtls_mpi_free(&grp->P); -#endif - } - - if (!ecp_group_is_static_comb_table(grp) && grp->T != NULL) { - for (i = 0; i < grp->T_size; i++) { - mbedtls_ecp_point_free(&grp->T[i]); - } - mbedtls_free(grp->T); - } - - mbedtls_platform_zeroize(grp, sizeof(mbedtls_ecp_group)); -} - -/* - * Unallocate (the components of) a key pair - */ -void mbedtls_ecp_keypair_free(mbedtls_ecp_keypair *key) -{ - if (key == NULL) { - return; - } - - mbedtls_ecp_group_free(&key->grp); - mbedtls_mpi_free(&key->d); - mbedtls_ecp_point_free(&key->Q); -} - -/* - * Copy the contents of a point - */ -int mbedtls_ecp_copy(mbedtls_ecp_point *P, const mbedtls_ecp_point *Q) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - MBEDTLS_MPI_CHK(mbedtls_mpi_copy(&P->X, &Q->X)); - MBEDTLS_MPI_CHK(mbedtls_mpi_copy(&P->Y, &Q->Y)); - MBEDTLS_MPI_CHK(mbedtls_mpi_copy(&P->Z, &Q->Z)); - -cleanup: - return ret; -} - -/* - * Copy the contents of a group object - */ -int mbedtls_ecp_group_copy(mbedtls_ecp_group *dst, const mbedtls_ecp_group *src) -{ - return mbedtls_ecp_group_load(dst, src->id); -} - -/* - * Set point to zero - */ -int mbedtls_ecp_set_zero(mbedtls_ecp_point *pt) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&pt->X, 1)); - MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&pt->Y, 1)); - MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&pt->Z, 0)); - -cleanup: - return ret; -} - -/* - * Tell if a point is zero - */ -int mbedtls_ecp_is_zero(mbedtls_ecp_point *pt) -{ - return mbedtls_mpi_cmp_int(&pt->Z, 0) == 0; -} - -/* - * Compare two points lazily - */ -int mbedtls_ecp_point_cmp(const mbedtls_ecp_point *P, - const mbedtls_ecp_point *Q) -{ - if (mbedtls_mpi_cmp_mpi(&P->X, &Q->X) == 0 && - mbedtls_mpi_cmp_mpi(&P->Y, &Q->Y) == 0 && - mbedtls_mpi_cmp_mpi(&P->Z, &Q->Z) == 0) { - return 0; - } - - return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; -} - -/* - * Import a non-zero point from ASCII strings - */ -int mbedtls_ecp_point_read_string(mbedtls_ecp_point *P, int radix, - const char *x, const char *y) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - MBEDTLS_MPI_CHK(mbedtls_mpi_read_string(&P->X, radix, x)); - MBEDTLS_MPI_CHK(mbedtls_mpi_read_string(&P->Y, radix, y)); - MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&P->Z, 1)); - -cleanup: - return ret; -} - -/* - * Export a point into unsigned binary data (SEC1 2.3.3 and RFC7748) - */ -int mbedtls_ecp_point_write_binary(const mbedtls_ecp_group *grp, - const mbedtls_ecp_point *P, - int format, size_t *olen, - unsigned char *buf, size_t buflen) -{ - int ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE; - size_t plen; - if (format != MBEDTLS_ECP_PF_UNCOMPRESSED && - format != MBEDTLS_ECP_PF_COMPRESSED) { - return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; - } - - plen = mbedtls_mpi_size(&grp->P); - -#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) - (void) format; /* Montgomery curves always use the same point format */ - if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_MONTGOMERY) { - *olen = plen; - if (buflen < *olen) { - return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL; - } - - MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary_le(&P->X, buf, plen)); - } -#endif -#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) - if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS) { - /* - * Common case: P == 0 - */ - if (mbedtls_mpi_cmp_int(&P->Z, 0) == 0) { - if (buflen < 1) { - return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL; - } - - buf[0] = 0x00; - *olen = 1; - - return 0; - } - - if (format == MBEDTLS_ECP_PF_UNCOMPRESSED) { - *olen = 2 * plen + 1; - - if (buflen < *olen) { - return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL; - } - - buf[0] = 0x04; - MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary(&P->X, buf + 1, plen)); - MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary(&P->Y, buf + 1 + plen, plen)); - } else if (format == MBEDTLS_ECP_PF_COMPRESSED) { - *olen = plen + 1; - - if (buflen < *olen) { - return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL; - } - - buf[0] = 0x02 + mbedtls_mpi_get_bit(&P->Y, 0); - MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary(&P->X, buf + 1, plen)); - } - } -#endif - -cleanup: - return ret; -} - -#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) -static int mbedtls_ecp_sw_derive_y(const mbedtls_ecp_group *grp, - const mbedtls_mpi *X, - mbedtls_mpi *Y, - int parity_bit); -#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */ - -/* - * Import a point from unsigned binary data (SEC1 2.3.4 and RFC7748) - */ -int mbedtls_ecp_point_read_binary(const mbedtls_ecp_group *grp, - mbedtls_ecp_point *pt, - const unsigned char *buf, size_t ilen) -{ - int ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE; - size_t plen; - if (ilen < 1) { - return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; - } - - plen = mbedtls_mpi_size(&grp->P); - -#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) - if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_MONTGOMERY) { - if (plen != ilen) { - return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; - } - - MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary_le(&pt->X, buf, plen)); - mbedtls_mpi_free(&pt->Y); - - if (grp->id == MBEDTLS_ECP_DP_CURVE25519) { - /* Set most significant bit to 0 as prescribed in RFC7748 §5 */ - MBEDTLS_MPI_CHK(mbedtls_mpi_set_bit(&pt->X, plen * 8 - 1, 0)); - } - - MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&pt->Z, 1)); - } -#endif -#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) - if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS) { - if (buf[0] == 0x00) { - if (ilen == 1) { - return mbedtls_ecp_set_zero(pt); - } else { - return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; - } - } - - if (ilen < 1 + plen) { - return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; - } - - MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary(&pt->X, buf + 1, plen)); - MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&pt->Z, 1)); - - if (buf[0] == 0x04) { - /* format == MBEDTLS_ECP_PF_UNCOMPRESSED */ - if (ilen != 1 + plen * 2) { - return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; - } - return mbedtls_mpi_read_binary(&pt->Y, buf + 1 + plen, plen); - } else if (buf[0] == 0x02 || buf[0] == 0x03) { - /* format == MBEDTLS_ECP_PF_COMPRESSED */ - if (ilen != 1 + plen) { - return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; - } - return mbedtls_ecp_sw_derive_y(grp, &pt->X, &pt->Y, - (buf[0] & 1)); - } else { - return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; - } - } -#endif - -cleanup: - return ret; -} - -/* - * Import a point from a TLS ECPoint record (RFC 4492) - * struct { - * opaque point <1..2^8-1>; - * } ECPoint; - */ -int mbedtls_ecp_tls_read_point(const mbedtls_ecp_group *grp, - mbedtls_ecp_point *pt, - const unsigned char **buf, size_t buf_len) -{ - unsigned char data_len; - const unsigned char *buf_start; - /* - * We must have at least two bytes (1 for length, at least one for data) - */ - if (buf_len < 2) { - return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; - } - - data_len = *(*buf)++; - if (data_len < 1 || data_len > buf_len - 1) { - return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; - } - - /* - * Save buffer start for read_binary and update buf - */ - buf_start = *buf; - *buf += data_len; - - return mbedtls_ecp_point_read_binary(grp, pt, buf_start, data_len); -} - -/* - * Export a point as a TLS ECPoint record (RFC 4492) - * struct { - * opaque point <1..2^8-1>; - * } ECPoint; - */ -int mbedtls_ecp_tls_write_point(const mbedtls_ecp_group *grp, const mbedtls_ecp_point *pt, - int format, size_t *olen, - unsigned char *buf, size_t blen) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - if (format != MBEDTLS_ECP_PF_UNCOMPRESSED && - format != MBEDTLS_ECP_PF_COMPRESSED) { - return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; - } - - /* - * buffer length must be at least one, for our length byte - */ - if (blen < 1) { - return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; - } - - if ((ret = mbedtls_ecp_point_write_binary(grp, pt, format, - olen, buf + 1, blen - 1)) != 0) { - return ret; - } - - /* - * write length to the first byte and update total length - */ - buf[0] = (unsigned char) *olen; - ++*olen; - - return 0; -} - -/* - * Set a group from an ECParameters record (RFC 4492) - */ -int mbedtls_ecp_tls_read_group(mbedtls_ecp_group *grp, - const unsigned char **buf, size_t len) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - mbedtls_ecp_group_id grp_id; - if ((ret = mbedtls_ecp_tls_read_group_id(&grp_id, buf, len)) != 0) { - return ret; - } - - return mbedtls_ecp_group_load(grp, grp_id); -} - -/* - * Read a group id from an ECParameters record (RFC 4492) and convert it to - * mbedtls_ecp_group_id. - */ -int mbedtls_ecp_tls_read_group_id(mbedtls_ecp_group_id *grp, - const unsigned char **buf, size_t len) -{ - uint16_t tls_id; - const mbedtls_ecp_curve_info *curve_info; - /* - * We expect at least three bytes (see below) - */ - if (len < 3) { - return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; - } - - /* - * First byte is curve_type; only named_curve is handled - */ - if (*(*buf)++ != MBEDTLS_ECP_TLS_NAMED_CURVE) { - return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; - } - - /* - * Next two bytes are the namedcurve value - */ - tls_id = MBEDTLS_GET_UINT16_BE(*buf, 0); - *buf += 2; - - if ((curve_info = mbedtls_ecp_curve_info_from_tls_id(tls_id)) == NULL) { - return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE; - } - - *grp = curve_info->grp_id; - - return 0; -} - -/* - * Write the ECParameters record corresponding to a group (RFC 4492) - */ -int mbedtls_ecp_tls_write_group(const mbedtls_ecp_group *grp, size_t *olen, - unsigned char *buf, size_t blen) -{ - const mbedtls_ecp_curve_info *curve_info; - if ((curve_info = mbedtls_ecp_curve_info_from_grp_id(grp->id)) == NULL) { - return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; - } - - /* - * We are going to write 3 bytes (see below) - */ - *olen = 3; - if (blen < *olen) { - return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL; - } - - /* - * First byte is curve_type, always named_curve - */ - *buf++ = MBEDTLS_ECP_TLS_NAMED_CURVE; - - /* - * Next two bytes are the namedcurve value - */ - MBEDTLS_PUT_UINT16_BE(curve_info->tls_id, buf, 0); - - return 0; -} - -/* - * Wrapper around fast quasi-modp functions, with fall-back to mbedtls_mpi_mod_mpi. - * See the documentation of struct mbedtls_ecp_group. - * - * This function is in the critial loop for mbedtls_ecp_mul, so pay attention to perf. - */ -static int ecp_modp(mbedtls_mpi *N, const mbedtls_ecp_group *grp) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - - if (grp->modp == NULL) { - return mbedtls_mpi_mod_mpi(N, N, &grp->P); - } - - /* N->s < 0 is a much faster test, which fails only if N is 0 */ - if ((N->s < 0 && mbedtls_mpi_cmp_int(N, 0) != 0) || - mbedtls_mpi_bitlen(N) > 2 * grp->pbits) { - return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; - } - - MBEDTLS_MPI_CHK(grp->modp(N)); - - /* N->s < 0 is a much faster test, which fails only if N is 0 */ - while (N->s < 0 && mbedtls_mpi_cmp_int(N, 0) != 0) { - MBEDTLS_MPI_CHK(mbedtls_mpi_add_mpi(N, N, &grp->P)); - } - - while (mbedtls_mpi_cmp_mpi(N, &grp->P) >= 0) { - /* we known P, N and the result are positive */ - MBEDTLS_MPI_CHK(mbedtls_mpi_sub_abs(N, N, &grp->P)); - } - -cleanup: - return ret; -} - -/* - * Fast mod-p functions expect their argument to be in the 0..p^2 range. - * - * In order to guarantee that, we need to ensure that operands of - * mbedtls_mpi_mul_mpi are in the 0..p range. So, after each operation we will - * bring the result back to this range. - * - * The following macros are shortcuts for doing that. - */ - -/* - * Reduce a mbedtls_mpi mod p in-place, general case, to use after mbedtls_mpi_mul_mpi - */ -#if defined(MBEDTLS_SELF_TEST) -#define INC_MUL_COUNT mul_count++; -#else -#define INC_MUL_COUNT -#endif - -#define MOD_MUL(N) \ - do \ - { \ - MBEDTLS_MPI_CHK(ecp_modp(&(N), grp)); \ - INC_MUL_COUNT \ - } while (0) - -static inline int mbedtls_mpi_mul_mod(const mbedtls_ecp_group *grp, - mbedtls_mpi *X, - const mbedtls_mpi *A, - const mbedtls_mpi *B) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - MBEDTLS_MPI_CHK(mbedtls_mpi_mul_mpi(X, A, B)); - MOD_MUL(*X); -cleanup: - return ret; -} - -/* - * Reduce a mbedtls_mpi mod p in-place, to use after mbedtls_mpi_sub_mpi - * N->s < 0 is a very fast test, which fails only if N is 0 - */ -#define MOD_SUB(N) \ - do { \ - while ((N)->s < 0 && mbedtls_mpi_cmp_int((N), 0) != 0) \ - MBEDTLS_MPI_CHK(mbedtls_mpi_add_mpi((N), (N), &grp->P)); \ - } while (0) - -MBEDTLS_MAYBE_UNUSED -static inline int mbedtls_mpi_sub_mod(const mbedtls_ecp_group *grp, - mbedtls_mpi *X, - const mbedtls_mpi *A, - const mbedtls_mpi *B) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - MBEDTLS_MPI_CHK(mbedtls_mpi_sub_mpi(X, A, B)); - MOD_SUB(X); -cleanup: - return ret; -} - -/* - * Reduce a mbedtls_mpi mod p in-place, to use after mbedtls_mpi_add_mpi and mbedtls_mpi_mul_int. - * We known P, N and the result are positive, so sub_abs is correct, and - * a bit faster. - */ -#define MOD_ADD(N) \ - while (mbedtls_mpi_cmp_mpi((N), &grp->P) >= 0) \ - MBEDTLS_MPI_CHK(mbedtls_mpi_sub_abs((N), (N), &grp->P)) - -static inline int mbedtls_mpi_add_mod(const mbedtls_ecp_group *grp, - mbedtls_mpi *X, - const mbedtls_mpi *A, - const mbedtls_mpi *B) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - MBEDTLS_MPI_CHK(mbedtls_mpi_add_mpi(X, A, B)); - MOD_ADD(X); -cleanup: - return ret; -} - -MBEDTLS_MAYBE_UNUSED -static inline int mbedtls_mpi_mul_int_mod(const mbedtls_ecp_group *grp, - mbedtls_mpi *X, - const mbedtls_mpi *A, - mbedtls_mpi_uint c) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - - MBEDTLS_MPI_CHK(mbedtls_mpi_mul_int(X, A, c)); - MOD_ADD(X); -cleanup: - return ret; -} - -MBEDTLS_MAYBE_UNUSED -static inline int mbedtls_mpi_sub_int_mod(const mbedtls_ecp_group *grp, - mbedtls_mpi *X, - const mbedtls_mpi *A, - mbedtls_mpi_uint c) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - - MBEDTLS_MPI_CHK(mbedtls_mpi_sub_int(X, A, c)); - MOD_SUB(X); -cleanup: - return ret; -} - -#define MPI_ECP_SUB_INT(X, A, c) \ - MBEDTLS_MPI_CHK(mbedtls_mpi_sub_int_mod(grp, X, A, c)) - -MBEDTLS_MAYBE_UNUSED -static inline int mbedtls_mpi_shift_l_mod(const mbedtls_ecp_group *grp, - mbedtls_mpi *X, - size_t count) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - MBEDTLS_MPI_CHK(mbedtls_mpi_shift_l(X, count)); - MOD_ADD(X); -cleanup: - return ret; -} - -/* - * Macro wrappers around ECP modular arithmetic - * - * Currently, these wrappers are defined via the bignum module. - */ - -#define MPI_ECP_ADD(X, A, B) \ - MBEDTLS_MPI_CHK(mbedtls_mpi_add_mod(grp, X, A, B)) - -#define MPI_ECP_SUB(X, A, B) \ - MBEDTLS_MPI_CHK(mbedtls_mpi_sub_mod(grp, X, A, B)) - -#define MPI_ECP_MUL(X, A, B) \ - MBEDTLS_MPI_CHK(mbedtls_mpi_mul_mod(grp, X, A, B)) - -#define MPI_ECP_SQR(X, A) \ - MBEDTLS_MPI_CHK(mbedtls_mpi_mul_mod(grp, X, A, A)) - -#define MPI_ECP_MUL_INT(X, A, c) \ - MBEDTLS_MPI_CHK(mbedtls_mpi_mul_int_mod(grp, X, A, c)) - -#define MPI_ECP_INV(dst, src) \ - MBEDTLS_MPI_CHK(mbedtls_mpi_inv_mod((dst), (src), &grp->P)) - -#define MPI_ECP_MOV(X, A) \ - MBEDTLS_MPI_CHK(mbedtls_mpi_copy(X, A)) - -#define MPI_ECP_SHIFT_L(X, count) \ - MBEDTLS_MPI_CHK(mbedtls_mpi_shift_l_mod(grp, X, count)) - -#define MPI_ECP_LSET(X, c) \ - MBEDTLS_MPI_CHK(mbedtls_mpi_lset(X, c)) - -#define MPI_ECP_CMP_INT(X, c) \ - mbedtls_mpi_cmp_int(X, c) - -#define MPI_ECP_CMP(X, Y) \ - mbedtls_mpi_cmp_mpi(X, Y) - -/* Needs f_rng, p_rng to be defined. */ -#define MPI_ECP_RAND(X) \ - MBEDTLS_MPI_CHK(mbedtls_mpi_random((X), 2, &grp->P, f_rng, p_rng)) - -/* Conditional negation - * Needs grp and a temporary MPI tmp to be defined. */ -#define MPI_ECP_COND_NEG(X, cond) \ - do \ - { \ - unsigned char nonzero = mbedtls_mpi_cmp_int((X), 0) != 0; \ - MBEDTLS_MPI_CHK(mbedtls_mpi_sub_mpi(&tmp, &grp->P, (X))); \ - MBEDTLS_MPI_CHK(mbedtls_mpi_safe_cond_assign((X), &tmp, \ - nonzero & cond)); \ - } while (0) - -#define MPI_ECP_NEG(X) MPI_ECP_COND_NEG((X), 1) - -#define MPI_ECP_VALID(X) \ - ((X)->p != NULL) - -#define MPI_ECP_COND_ASSIGN(X, Y, cond) \ - MBEDTLS_MPI_CHK(mbedtls_mpi_safe_cond_assign((X), (Y), (cond))) - -#define MPI_ECP_COND_SWAP(X, Y, cond) \ - MBEDTLS_MPI_CHK(mbedtls_mpi_safe_cond_swap((X), (Y), (cond))) - -#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) - -/* - * Computes the right-hand side of the Short Weierstrass equation - * RHS = X^3 + A X + B - */ -static int ecp_sw_rhs(const mbedtls_ecp_group *grp, - mbedtls_mpi *rhs, - const mbedtls_mpi *X) -{ - int ret; - - /* Compute X^3 + A X + B as X (X^2 + A) + B */ - MPI_ECP_SQR(rhs, X); - - /* Special case for A = -3 */ - if (mbedtls_ecp_group_a_is_minus_3(grp)) { - MPI_ECP_SUB_INT(rhs, rhs, 3); - } else { - MPI_ECP_ADD(rhs, rhs, &grp->A); - } - - MPI_ECP_MUL(rhs, rhs, X); - MPI_ECP_ADD(rhs, rhs, &grp->B); - -cleanup: - return ret; -} - -/* - * Derive Y from X and a parity bit - */ -static int mbedtls_ecp_sw_derive_y(const mbedtls_ecp_group *grp, - const mbedtls_mpi *X, - mbedtls_mpi *Y, - int parity_bit) -{ - /* w = y^2 = x^3 + ax + b - * y = sqrt(w) = w^((p+1)/4) mod p (for prime p where p = 3 mod 4) - * - * Note: this method for extracting square root does not validate that w - * was indeed a square so this function will return garbage in Y if X - * does not correspond to a point on the curve. - */ - - /* Check prerequisite p = 3 mod 4 */ - if (mbedtls_mpi_get_bit(&grp->P, 0) != 1 || - mbedtls_mpi_get_bit(&grp->P, 1) != 1) { - return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE; - } - - int ret; - mbedtls_mpi exp; - mbedtls_mpi_init(&exp); - - /* use Y to store intermediate result, actually w above */ - MBEDTLS_MPI_CHK(ecp_sw_rhs(grp, Y, X)); - - /* w = y^2 */ /* Y contains y^2 intermediate result */ - /* exp = ((p+1)/4) */ - MBEDTLS_MPI_CHK(mbedtls_mpi_add_int(&exp, &grp->P, 1)); - MBEDTLS_MPI_CHK(mbedtls_mpi_shift_r(&exp, 2)); - /* sqrt(w) = w^((p+1)/4) mod p (for prime p where p = 3 mod 4) */ - MBEDTLS_MPI_CHK(mbedtls_mpi_exp_mod(Y, Y /*y^2*/, &exp, &grp->P, NULL)); - - /* check parity bit match or else invert Y */ - /* This quick inversion implementation is valid because Y != 0 for all - * Short Weierstrass curves supported by mbedtls, as each supported curve - * has an order that is a large prime, so each supported curve does not - * have any point of order 2, and a point with Y == 0 would be of order 2 */ - if (mbedtls_mpi_get_bit(Y, 0) != parity_bit) { - MBEDTLS_MPI_CHK(mbedtls_mpi_sub_mpi(Y, &grp->P, Y)); - } - -cleanup: - - mbedtls_mpi_free(&exp); - return ret; -} -#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */ - -#if defined(MBEDTLS_ECP_C) -#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) -/* - * For curves in short Weierstrass form, we do all the internal operations in - * Jacobian coordinates. - * - * For multiplication, we'll use a comb method with countermeasures against - * SPA, hence timing attacks. - */ - -/* - * Normalize jacobian coordinates so that Z == 0 || Z == 1 (GECC 3.2.1) - * Cost: 1N := 1I + 3M + 1S - */ -static int ecp_normalize_jac(const mbedtls_ecp_group *grp, mbedtls_ecp_point *pt) -{ - if (MPI_ECP_CMP_INT(&pt->Z, 0) == 0) { - return 0; - } - - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - mbedtls_mpi T; - mbedtls_mpi_init(&T); - - MPI_ECP_INV(&T, &pt->Z); /* T <- 1 / Z */ - MPI_ECP_MUL(&pt->Y, &pt->Y, &T); /* Y' <- Y*T = Y / Z */ - MPI_ECP_SQR(&T, &T); /* T <- T^2 = 1 / Z^2 */ - MPI_ECP_MUL(&pt->X, &pt->X, &T); /* X <- X * T = X / Z^2 */ - MPI_ECP_MUL(&pt->Y, &pt->Y, &T); /* Y'' <- Y' * T = Y / Z^3 */ - - MPI_ECP_LSET(&pt->Z, 1); - -cleanup: - - mbedtls_mpi_free(&T); - - return ret; -} - -#if !defined(MBEDTLS_ECP_MUL_ALT) -/* - * Normalize jacobian coordinates of an array of (pointers to) points, - * using Montgomery's trick to perform only one inversion mod P. - * (See for example Cohen's "A Course in Computational Algebraic Number - * Theory", Algorithm 10.3.4.) - * - * Warning: fails (returning an error) if one of the points is zero! - * This should never happen, see choice of w in ecp_mul_comb(). - * - * Cost: 1N(t) := 1I + (6t - 3)M + 1S - */ -static int ecp_normalize_jac_many(const mbedtls_ecp_group *grp, - mbedtls_ecp_point *T[], size_t T_size) -{ - if (T_size < 2) { - return ecp_normalize_jac(grp, *T); - } - - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - size_t i; - mbedtls_mpi *c, t; - - if ((c = mbedtls_calloc(T_size, sizeof(mbedtls_mpi))) == NULL) { - return MBEDTLS_ERR_ECP_ALLOC_FAILED; - } - - mbedtls_mpi_init(&t); - - mpi_init_many(c, T_size); - /* - * c[i] = Z_0 * ... * Z_i, i = 0,..,n := T_size-1 - */ - MPI_ECP_MOV(&c[0], &T[0]->Z); - for (i = 1; i < T_size; i++) { - MPI_ECP_MUL(&c[i], &c[i-1], &T[i]->Z); - } - - /* - * c[n] = 1 / (Z_0 * ... * Z_n) mod P - */ - MPI_ECP_INV(&c[T_size-1], &c[T_size-1]); - - for (i = T_size - 1;; i--) { - /* At the start of iteration i (note that i decrements), we have - * - c[j] = Z_0 * .... * Z_j for j < i, - * - c[j] = 1 / (Z_0 * .... * Z_j) for j == i, - * - * This is maintained via - * - c[i-1] <- c[i] * Z_i - * - * We also derive 1/Z_i = c[i] * c[i-1] for i>0 and use that - * to do the actual normalization. For i==0, we already have - * c[0] = 1 / Z_0. - */ - - if (i > 0) { - /* Compute 1/Z_i and establish invariant for the next iteration. */ - MPI_ECP_MUL(&t, &c[i], &c[i-1]); - MPI_ECP_MUL(&c[i-1], &c[i], &T[i]->Z); - } else { - MPI_ECP_MOV(&t, &c[0]); - } - - /* Now t holds 1 / Z_i; normalize as in ecp_normalize_jac() */ - MPI_ECP_MUL(&T[i]->Y, &T[i]->Y, &t); - MPI_ECP_SQR(&t, &t); - MPI_ECP_MUL(&T[i]->X, &T[i]->X, &t); - MPI_ECP_MUL(&T[i]->Y, &T[i]->Y, &t); - - /* - * Post-precessing: reclaim some memory by shrinking coordinates - * - not storing Z (always 1) - * - shrinking other coordinates, but still keeping the same number of - * limbs as P, as otherwise it will too likely be regrown too fast. - */ - MBEDTLS_MPI_CHK(mbedtls_mpi_shrink(&T[i]->X, grp->P.n)); - MBEDTLS_MPI_CHK(mbedtls_mpi_shrink(&T[i]->Y, grp->P.n)); - - MPI_ECP_LSET(&T[i]->Z, 1); - - if (i == 0) { - break; - } - } - -cleanup: - - mbedtls_mpi_free(&t); - mpi_free_many(c, T_size); - mbedtls_free(c); - - return ret; -} - -/* - * Conditional point inversion: Q -> -Q = (Q.X, -Q.Y, Q.Z) without leak. - * "inv" must be 0 (don't invert) or 1 (invert) or the result will be invalid - */ -static int ecp_safe_invert_jac(const mbedtls_ecp_group *grp, - mbedtls_ecp_point *Q, - unsigned char inv) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - mbedtls_mpi tmp; - mbedtls_mpi_init(&tmp); - - MPI_ECP_COND_NEG(&Q->Y, inv); - -cleanup: - mbedtls_mpi_free(&tmp); - return ret; -} -#endif /* MBEDTLS_ECP_MUL_ALT */ - -/* - * Point doubling R = 2 P, Jacobian coordinates - * - * Based on http://www.hyperelliptic.org/EFD/g1p/auto-shortw-jacobian.html#doubling-dbl-1998-cmo-2 . - * - * We follow the variable naming fairly closely. The formula variations that trade a MUL for a SQR - * (plus a few ADDs) aren't useful as our bignum implementation doesn't distinguish squaring. - * - * Standard optimizations are applied when curve parameter A is one of { 0, -3 }. - * - * Cost: 1D := 3M + 4S (A == 0) - * 4M + 4S (A == -3) - * 3M + 6S + 1a otherwise - */ -static int ecp_double_jac(const mbedtls_ecp_group *grp, mbedtls_ecp_point *R, - const mbedtls_ecp_point *P, - mbedtls_mpi tmp[4]) -{ -#if defined(MBEDTLS_SELF_TEST) - dbl_count++; -#endif - - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - - /* Special case for A = -3 */ - if (mbedtls_ecp_group_a_is_minus_3(grp)) { - /* tmp[0] <- M = 3(X + Z^2)(X - Z^2) */ - MPI_ECP_SQR(&tmp[1], &P->Z); - MPI_ECP_ADD(&tmp[2], &P->X, &tmp[1]); - MPI_ECP_SUB(&tmp[3], &P->X, &tmp[1]); - MPI_ECP_MUL(&tmp[1], &tmp[2], &tmp[3]); - MPI_ECP_MUL_INT(&tmp[0], &tmp[1], 3); - } else { - /* tmp[0] <- M = 3.X^2 + A.Z^4 */ - MPI_ECP_SQR(&tmp[1], &P->X); - MPI_ECP_MUL_INT(&tmp[0], &tmp[1], 3); - - /* Optimize away for "koblitz" curves with A = 0 */ - if (MPI_ECP_CMP_INT(&grp->A, 0) != 0) { - /* M += A.Z^4 */ - MPI_ECP_SQR(&tmp[1], &P->Z); - MPI_ECP_SQR(&tmp[2], &tmp[1]); - MPI_ECP_MUL(&tmp[1], &tmp[2], &grp->A); - MPI_ECP_ADD(&tmp[0], &tmp[0], &tmp[1]); - } - } - - /* tmp[1] <- S = 4.X.Y^2 */ - MPI_ECP_SQR(&tmp[2], &P->Y); - MPI_ECP_SHIFT_L(&tmp[2], 1); - MPI_ECP_MUL(&tmp[1], &P->X, &tmp[2]); - MPI_ECP_SHIFT_L(&tmp[1], 1); - - /* tmp[3] <- U = 8.Y^4 */ - MPI_ECP_SQR(&tmp[3], &tmp[2]); - MPI_ECP_SHIFT_L(&tmp[3], 1); - - /* tmp[2] <- T = M^2 - 2.S */ - MPI_ECP_SQR(&tmp[2], &tmp[0]); - MPI_ECP_SUB(&tmp[2], &tmp[2], &tmp[1]); - MPI_ECP_SUB(&tmp[2], &tmp[2], &tmp[1]); - - /* tmp[1] <- S = M(S - T) - U */ - MPI_ECP_SUB(&tmp[1], &tmp[1], &tmp[2]); - MPI_ECP_MUL(&tmp[1], &tmp[1], &tmp[0]); - MPI_ECP_SUB(&tmp[1], &tmp[1], &tmp[3]); - - /* tmp[3] <- U = 2.Y.Z */ - MPI_ECP_MUL(&tmp[3], &P->Y, &P->Z); - MPI_ECP_SHIFT_L(&tmp[3], 1); - - /* Store results */ - MPI_ECP_MOV(&R->X, &tmp[2]); - MPI_ECP_MOV(&R->Y, &tmp[1]); - MPI_ECP_MOV(&R->Z, &tmp[3]); - -cleanup: - - return ret; -} - -/* - * Addition: R = P + Q, mixed affine-Jacobian coordinates (GECC 3.22) - * - * The coordinates of Q must be normalized (= affine), - * but those of P don't need to. R is not normalized. - * - * P,Q,R may alias, but only at the level of EC points: they must be either - * equal as pointers, or disjoint (including the coordinate data buffers). - * Fine-grained aliasing at the level of coordinates is not supported. - * - * Special cases: (1) P or Q is zero, (2) R is zero, (3) P == Q. - * None of these cases can happen as intermediate step in ecp_mul_comb(): - * - at each step, P, Q and R are multiples of the base point, the factor - * being less than its order, so none of them is zero; - * - Q is an odd multiple of the base point, P an even multiple, - * due to the choice of precomputed points in the modified comb method. - * So branches for these cases do not leak secret information. - * - * Cost: 1A := 8M + 3S - */ -static int ecp_add_mixed(const mbedtls_ecp_group *grp, mbedtls_ecp_point *R, - const mbedtls_ecp_point *P, const mbedtls_ecp_point *Q, - mbedtls_mpi tmp[4]) -{ -#if defined(MBEDTLS_SELF_TEST) - add_count++; -#endif - - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - - /* NOTE: Aliasing between input and output is allowed, so one has to make - * sure that at the point X,Y,Z are written, {P,Q}->{X,Y,Z} are no - * longer read from. */ - mbedtls_mpi * const X = &R->X; - mbedtls_mpi * const Y = &R->Y; - mbedtls_mpi * const Z = &R->Z; - - if (!MPI_ECP_VALID(&Q->Z)) { - return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; - } - - /* - * Trivial cases: P == 0 or Q == 0 (case 1) - */ - if (MPI_ECP_CMP_INT(&P->Z, 0) == 0) { - return mbedtls_ecp_copy(R, Q); - } - - if (MPI_ECP_CMP_INT(&Q->Z, 0) == 0) { - return mbedtls_ecp_copy(R, P); - } - - /* - * Make sure Q coordinates are normalized - */ - if (MPI_ECP_CMP_INT(&Q->Z, 1) != 0) { - return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; - } - - MPI_ECP_SQR(&tmp[0], &P->Z); - MPI_ECP_MUL(&tmp[1], &tmp[0], &P->Z); - MPI_ECP_MUL(&tmp[0], &tmp[0], &Q->X); - MPI_ECP_MUL(&tmp[1], &tmp[1], &Q->Y); - MPI_ECP_SUB(&tmp[0], &tmp[0], &P->X); - MPI_ECP_SUB(&tmp[1], &tmp[1], &P->Y); - - /* Special cases (2) and (3) */ - if (MPI_ECP_CMP_INT(&tmp[0], 0) == 0) { - if (MPI_ECP_CMP_INT(&tmp[1], 0) == 0) { - ret = ecp_double_jac(grp, R, P, tmp); - goto cleanup; - } else { - ret = mbedtls_ecp_set_zero(R); - goto cleanup; - } - } - - /* {P,Q}->Z no longer used, so OK to write to Z even if there's aliasing. */ - MPI_ECP_MUL(Z, &P->Z, &tmp[0]); - MPI_ECP_SQR(&tmp[2], &tmp[0]); - MPI_ECP_MUL(&tmp[3], &tmp[2], &tmp[0]); - MPI_ECP_MUL(&tmp[2], &tmp[2], &P->X); - - MPI_ECP_MOV(&tmp[0], &tmp[2]); - MPI_ECP_SHIFT_L(&tmp[0], 1); - - /* {P,Q}->X no longer used, so OK to write to X even if there's aliasing. */ - MPI_ECP_SQR(X, &tmp[1]); - MPI_ECP_SUB(X, X, &tmp[0]); - MPI_ECP_SUB(X, X, &tmp[3]); - MPI_ECP_SUB(&tmp[2], &tmp[2], X); - MPI_ECP_MUL(&tmp[2], &tmp[2], &tmp[1]); - MPI_ECP_MUL(&tmp[3], &tmp[3], &P->Y); - /* {P,Q}->Y no longer used, so OK to write to Y even if there's aliasing. */ - MPI_ECP_SUB(Y, &tmp[2], &tmp[3]); - -cleanup: - - return ret; -} - -#if !defined(MBEDTLS_ECP_MUL_ALT) -/* - * Randomize jacobian coordinates: - * (X, Y, Z) -> (l^2 X, l^3 Y, l Z) for random l - * This is sort of the reverse operation of ecp_normalize_jac(). - * - * This countermeasure was first suggested in [2]. - */ -static int ecp_randomize_jac(const mbedtls_ecp_group *grp, mbedtls_ecp_point *pt, - int (*f_rng)(void *, unsigned char *, size_t), void *p_rng) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - mbedtls_mpi l; - - mbedtls_mpi_init(&l); - - /* Generate l such that 1 < l < p */ - MPI_ECP_RAND(&l); - - /* Z' = l * Z */ - MPI_ECP_MUL(&pt->Z, &pt->Z, &l); - - /* Y' = l * Y */ - MPI_ECP_MUL(&pt->Y, &pt->Y, &l); - - /* X' = l^2 * X */ - MPI_ECP_SQR(&l, &l); - MPI_ECP_MUL(&pt->X, &pt->X, &l); - - /* Y'' = l^2 * Y' = l^3 * Y */ - MPI_ECP_MUL(&pt->Y, &pt->Y, &l); - -cleanup: - mbedtls_mpi_free(&l); - - if (ret == MBEDTLS_ERR_MPI_NOT_ACCEPTABLE) { - ret = MBEDTLS_ERR_ECP_RANDOM_FAILED; - } - return ret; -} - -/* - * Check and define parameters used by the comb method (see below for details) - */ -#if MBEDTLS_ECP_WINDOW_SIZE < 2 || MBEDTLS_ECP_WINDOW_SIZE > 7 -#error "MBEDTLS_ECP_WINDOW_SIZE out of bounds" -#endif - -/* d = ceil( n / w ) */ -#define COMB_MAX_D (MBEDTLS_ECP_MAX_BITS + 1) / 2 - -/* number of precomputed points */ -#define COMB_MAX_PRE (1 << (MBEDTLS_ECP_WINDOW_SIZE - 1)) - -/* - * Compute the representation of m that will be used with our comb method. - * - * The basic comb method is described in GECC 3.44 for example. We use a - * modified version that provides resistance to SPA by avoiding zero - * digits in the representation as in [3]. We modify the method further by - * requiring that all K_i be odd, which has the small cost that our - * representation uses one more K_i, due to carries, but saves on the size of - * the precomputed table. - * - * Summary of the comb method and its modifications: - * - * - The goal is to compute m*P for some w*d-bit integer m. - * - * - The basic comb method splits m into the w-bit integers - * x[0] .. x[d-1] where x[i] consists of the bits in m whose - * index has residue i modulo d, and computes m * P as - * S[x[0]] + 2 * S[x[1]] + .. + 2^(d-1) S[x[d-1]], where - * S[i_{w-1} .. i_0] := i_{w-1} 2^{(w-1)d} P + ... + i_1 2^d P + i_0 P. - * - * - If it happens that, say, x[i+1]=0 (=> S[x[i+1]]=0), one can replace the sum by - * .. + 2^{i-1} S[x[i-1]] - 2^i S[x[i]] + 2^{i+1} S[x[i]] + 2^{i+2} S[x[i+2]] .., - * thereby successively converting it into a form where all summands - * are nonzero, at the cost of negative summands. This is the basic idea of [3]. - * - * - More generally, even if x[i+1] != 0, we can first transform the sum as - * .. - 2^i S[x[i]] + 2^{i+1} ( S[x[i]] + S[x[i+1]] ) + 2^{i+2} S[x[i+2]] .., - * and then replace S[x[i]] + S[x[i+1]] = S[x[i] ^ x[i+1]] + 2 S[x[i] & x[i+1]]. - * Performing and iterating this procedure for those x[i] that are even - * (keeping track of carry), we can transform the original sum into one of the form - * S[x'[0]] +- 2 S[x'[1]] +- .. +- 2^{d-1} S[x'[d-1]] + 2^d S[x'[d]] - * with all x'[i] odd. It is therefore only necessary to know S at odd indices, - * which is why we are only computing half of it in the first place in - * ecp_precompute_comb and accessing it with index abs(i) / 2 in ecp_select_comb. - * - * - For the sake of compactness, only the seven low-order bits of x[i] - * are used to represent its absolute value (K_i in the paper), and the msb - * of x[i] encodes the sign (s_i in the paper): it is set if and only if - * if s_i == -1; - * - * Calling conventions: - * - x is an array of size d + 1 - * - w is the size, ie number of teeth, of the comb, and must be between - * 2 and 7 (in practice, between 2 and MBEDTLS_ECP_WINDOW_SIZE) - * - m is the MPI, expected to be odd and such that bitlength(m) <= w * d - * (the result will be incorrect if these assumptions are not satisfied) - */ -static void ecp_comb_recode_core(unsigned char x[], size_t d, - unsigned char w, const mbedtls_mpi *m) -{ - size_t i, j; - unsigned char c, cc, adjust; - - memset(x, 0, d+1); - - /* First get the classical comb values (except for x_d = 0) */ - for (i = 0; i < d; i++) { - for (j = 0; j < w; j++) { - x[i] |= mbedtls_mpi_get_bit(m, i + d * j) << j; - } - } - - /* Now make sure x_1 .. x_d are odd */ - c = 0; - for (i = 1; i <= d; i++) { - /* Add carry and update it */ - cc = x[i] & c; - x[i] = x[i] ^ c; - c = cc; - - /* Adjust if needed, avoiding branches */ - adjust = 1 - (x[i] & 0x01); - c |= x[i] & (x[i-1] * adjust); - x[i] = x[i] ^ (x[i-1] * adjust); - x[i-1] |= adjust << 7; - } -} - -/* - * Precompute points for the adapted comb method - * - * Assumption: T must be able to hold 2^{w - 1} elements. - * - * Operation: If i = i_{w-1} ... i_1 is the binary representation of i, - * sets T[i] = i_{w-1} 2^{(w-1)d} P + ... + i_1 2^d P + P. - * - * Cost: d(w-1) D + (2^{w-1} - 1) A + 1 N(w-1) + 1 N(2^{w-1} - 1) - * - * Note: Even comb values (those where P would be omitted from the - * sum defining T[i] above) are not needed in our adaption - * the comb method. See ecp_comb_recode_core(). - * - * This function currently works in four steps: - * (1) [dbl] Computation of intermediate T[i] for 2-power values of i - * (2) [norm_dbl] Normalization of coordinates of these T[i] - * (3) [add] Computation of all T[i] - * (4) [norm_add] Normalization of all T[i] - * - * Step 1 can be interrupted but not the others; together with the final - * coordinate normalization they are the largest steps done at once, depending - * on the window size. Here are operation counts for P-256: - * - * step (2) (3) (4) - * w = 5 142 165 208 - * w = 4 136 77 160 - * w = 3 130 33 136 - * w = 2 124 11 124 - * - * So if ECC operations are blocking for too long even with a low max_ops - * value, it's useful to set MBEDTLS_ECP_WINDOW_SIZE to a lower value in order - * to minimize maximum blocking time. - */ -static int ecp_precompute_comb(const mbedtls_ecp_group *grp, - mbedtls_ecp_point T[], const mbedtls_ecp_point *P, - unsigned char w, size_t d, - mbedtls_ecp_restart_ctx *rs_ctx) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - unsigned char i; - size_t j = 0; - const unsigned char T_size = 1U << (w - 1); - mbedtls_ecp_point *cur, *TT[COMB_MAX_PRE - 1] = { NULL }; - - mbedtls_mpi tmp[4]; - - mpi_init_many(tmp, sizeof(tmp) / sizeof(mbedtls_mpi)); - -#if defined(MBEDTLS_ECP_RESTARTABLE) - if (rs_ctx != NULL && rs_ctx->rsm != NULL) { - if (rs_ctx->rsm->state == ecp_rsm_pre_dbl) { - goto dbl; - } - if (rs_ctx->rsm->state == ecp_rsm_pre_norm_dbl) { - goto norm_dbl; - } - if (rs_ctx->rsm->state == ecp_rsm_pre_add) { - goto add; - } - if (rs_ctx->rsm->state == ecp_rsm_pre_norm_add) { - goto norm_add; - } - } -#else - (void) rs_ctx; -#endif - -#if defined(MBEDTLS_ECP_RESTARTABLE) - if (rs_ctx != NULL && rs_ctx->rsm != NULL) { - rs_ctx->rsm->state = ecp_rsm_pre_dbl; - - /* initial state for the loop */ - rs_ctx->rsm->i = 0; - } - -dbl: -#endif - /* - * Set T[0] = P and - * T[2^{l-1}] = 2^{dl} P for l = 1 .. w-1 (this is not the final value) - */ - MBEDTLS_MPI_CHK(mbedtls_ecp_copy(&T[0], P)); - -#if defined(MBEDTLS_ECP_RESTARTABLE) - if (rs_ctx != NULL && rs_ctx->rsm != NULL && rs_ctx->rsm->i != 0) { - j = rs_ctx->rsm->i; - } else -#endif - j = 0; - - for (; j < d * (w - 1); j++) { - MBEDTLS_ECP_BUDGET(MBEDTLS_ECP_OPS_DBL); - - i = 1U << (j / d); - cur = T + i; - - if (j % d == 0) { - MBEDTLS_MPI_CHK(mbedtls_ecp_copy(cur, T + (i >> 1))); - } - - MBEDTLS_MPI_CHK(ecp_double_jac(grp, cur, cur, tmp)); - } - -#if defined(MBEDTLS_ECP_RESTARTABLE) - if (rs_ctx != NULL && rs_ctx->rsm != NULL) { - rs_ctx->rsm->state = ecp_rsm_pre_norm_dbl; - } - -norm_dbl: -#endif - /* - * Normalize current elements in T to allow them to be used in - * ecp_add_mixed() below, which requires one normalized input. - * - * As T has holes, use an auxiliary array of pointers to elements in T. - * - */ - j = 0; - for (i = 1; i < T_size; i <<= 1) { - TT[j++] = T + i; - } - - MBEDTLS_ECP_BUDGET(MBEDTLS_ECP_OPS_INV + 6 * j - 2); - - MBEDTLS_MPI_CHK(ecp_normalize_jac_many(grp, TT, j)); - -#if defined(MBEDTLS_ECP_RESTARTABLE) - if (rs_ctx != NULL && rs_ctx->rsm != NULL) { - rs_ctx->rsm->state = ecp_rsm_pre_add; - } - -add: -#endif - /* - * Compute the remaining ones using the minimal number of additions - * Be careful to update T[2^l] only after using it! - */ - MBEDTLS_ECP_BUDGET((T_size - 1) * MBEDTLS_ECP_OPS_ADD); - - for (i = 1; i < T_size; i <<= 1) { - j = i; - while (j--) { - MBEDTLS_MPI_CHK(ecp_add_mixed(grp, &T[i + j], &T[j], &T[i], tmp)); - } - } - -#if defined(MBEDTLS_ECP_RESTARTABLE) - if (rs_ctx != NULL && rs_ctx->rsm != NULL) { - rs_ctx->rsm->state = ecp_rsm_pre_norm_add; - } - -norm_add: -#endif - /* - * Normalize final elements in T. Even though there are no holes now, we - * still need the auxiliary array for homogeneity with the previous - * call. Also, skip T[0] which is already normalised, being a copy of P. - */ - for (j = 0; j + 1 < T_size; j++) { - TT[j] = T + j + 1; - } - - MBEDTLS_ECP_BUDGET(MBEDTLS_ECP_OPS_INV + 6 * j - 2); - - MBEDTLS_MPI_CHK(ecp_normalize_jac_many(grp, TT, j)); - - /* Free Z coordinate (=1 after normalization) to save RAM. - * This makes T[i] invalid as mbedtls_ecp_points, but this is OK - * since from this point onwards, they are only accessed indirectly - * via the getter function ecp_select_comb() which does set the - * target's Z coordinate to 1. */ - for (i = 0; i < T_size; i++) { - mbedtls_mpi_free(&T[i].Z); - } - -cleanup: - - mpi_free_many(tmp, sizeof(tmp) / sizeof(mbedtls_mpi)); - -#if defined(MBEDTLS_ECP_RESTARTABLE) - if (rs_ctx != NULL && rs_ctx->rsm != NULL && - ret == MBEDTLS_ERR_ECP_IN_PROGRESS) { - if (rs_ctx->rsm->state == ecp_rsm_pre_dbl) { - rs_ctx->rsm->i = j; - } - } -#endif - - return ret; -} - -/* - * Select precomputed point: R = sign(i) * T[ abs(i) / 2 ] - * - * See ecp_comb_recode_core() for background - */ -static int ecp_select_comb(const mbedtls_ecp_group *grp, mbedtls_ecp_point *R, - const mbedtls_ecp_point T[], unsigned char T_size, - unsigned char i) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - unsigned char ii, j; - - /* Ignore the "sign" bit and scale down */ - ii = (i & 0x7Fu) >> 1; - - /* Read the whole table to thwart cache-based timing attacks */ - for (j = 0; j < T_size; j++) { - MPI_ECP_COND_ASSIGN(&R->X, &T[j].X, j == ii); - MPI_ECP_COND_ASSIGN(&R->Y, &T[j].Y, j == ii); - } - - /* Safely invert result if i is "negative" */ - MBEDTLS_MPI_CHK(ecp_safe_invert_jac(grp, R, i >> 7)); - - MPI_ECP_LSET(&R->Z, 1); - -cleanup: - return ret; -} - -/* - * Core multiplication algorithm for the (modified) comb method. - * This part is actually common with the basic comb method (GECC 3.44) - * - * Cost: d A + d D + 1 R - */ -static int ecp_mul_comb_core(const mbedtls_ecp_group *grp, mbedtls_ecp_point *R, - const mbedtls_ecp_point T[], unsigned char T_size, - const unsigned char x[], size_t d, - int (*f_rng)(void *, unsigned char *, size_t), - void *p_rng, - mbedtls_ecp_restart_ctx *rs_ctx) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - mbedtls_ecp_point Txi; - mbedtls_mpi tmp[4]; - size_t i; - - mbedtls_ecp_point_init(&Txi); - mpi_init_many(tmp, sizeof(tmp) / sizeof(mbedtls_mpi)); - -#if !defined(MBEDTLS_ECP_RESTARTABLE) - (void) rs_ctx; -#endif - -#if defined(MBEDTLS_ECP_RESTARTABLE) - if (rs_ctx != NULL && rs_ctx->rsm != NULL && - rs_ctx->rsm->state != ecp_rsm_comb_core) { - rs_ctx->rsm->i = 0; - rs_ctx->rsm->state = ecp_rsm_comb_core; - } - - /* new 'if' instead of nested for the sake of the 'else' branch */ - if (rs_ctx != NULL && rs_ctx->rsm != NULL && rs_ctx->rsm->i != 0) { - /* restore current index (R already pointing to rs_ctx->rsm->R) */ - i = rs_ctx->rsm->i; - } else -#endif - { - /* Start with a non-zero point and randomize its coordinates */ - i = d; - MBEDTLS_MPI_CHK(ecp_select_comb(grp, R, T, T_size, x[i])); - if (f_rng != 0) { - MBEDTLS_MPI_CHK(ecp_randomize_jac(grp, R, f_rng, p_rng)); - } - } - - while (i != 0) { - MBEDTLS_ECP_BUDGET(MBEDTLS_ECP_OPS_DBL + MBEDTLS_ECP_OPS_ADD); - --i; - - MBEDTLS_MPI_CHK(ecp_double_jac(grp, R, R, tmp)); - MBEDTLS_MPI_CHK(ecp_select_comb(grp, &Txi, T, T_size, x[i])); - MBEDTLS_MPI_CHK(ecp_add_mixed(grp, R, R, &Txi, tmp)); - } - -cleanup: - - mbedtls_ecp_point_free(&Txi); - mpi_free_many(tmp, sizeof(tmp) / sizeof(mbedtls_mpi)); - -#if defined(MBEDTLS_ECP_RESTARTABLE) - if (rs_ctx != NULL && rs_ctx->rsm != NULL && - ret == MBEDTLS_ERR_ECP_IN_PROGRESS) { - rs_ctx->rsm->i = i; - /* no need to save R, already pointing to rs_ctx->rsm->R */ - } -#endif - - return ret; -} - -/* - * Recode the scalar to get constant-time comb multiplication - * - * As the actual scalar recoding needs an odd scalar as a starting point, - * this wrapper ensures that by replacing m by N - m if necessary, and - * informs the caller that the result of multiplication will be negated. - * - * This works because we only support large prime order for Short Weierstrass - * curves, so N is always odd hence either m or N - m is. - * - * See ecp_comb_recode_core() for background. - */ -static int ecp_comb_recode_scalar(const mbedtls_ecp_group *grp, - const mbedtls_mpi *m, - unsigned char k[COMB_MAX_D + 1], - size_t d, - unsigned char w, - unsigned char *parity_trick) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - mbedtls_mpi M, mm; - - mbedtls_mpi_init(&M); - mbedtls_mpi_init(&mm); - - /* N is always odd (see above), just make extra sure */ - if (mbedtls_mpi_get_bit(&grp->N, 0) != 1) { - return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; - } - - /* do we need the parity trick? */ - *parity_trick = (mbedtls_mpi_get_bit(m, 0) == 0); - - /* execute parity fix in constant time */ - MBEDTLS_MPI_CHK(mbedtls_mpi_copy(&M, m)); - MBEDTLS_MPI_CHK(mbedtls_mpi_sub_mpi(&mm, &grp->N, m)); - MBEDTLS_MPI_CHK(mbedtls_mpi_safe_cond_assign(&M, &mm, *parity_trick)); - - /* actual scalar recoding */ - ecp_comb_recode_core(k, d, w, &M); - -cleanup: - mbedtls_mpi_free(&mm); - mbedtls_mpi_free(&M); - - return ret; -} - -/* - * Perform comb multiplication (for short Weierstrass curves) - * once the auxiliary table has been pre-computed. - * - * Scalar recoding may use a parity trick that makes us compute -m * P, - * if that is the case we'll need to recover m * P at the end. - */ -static int ecp_mul_comb_after_precomp(const mbedtls_ecp_group *grp, - mbedtls_ecp_point *R, - const mbedtls_mpi *m, - const mbedtls_ecp_point *T, - unsigned char T_size, - unsigned char w, - size_t d, - int (*f_rng)(void *, unsigned char *, size_t), - void *p_rng, - mbedtls_ecp_restart_ctx *rs_ctx) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - unsigned char parity_trick; - unsigned char k[COMB_MAX_D + 1]; - mbedtls_ecp_point *RR = R; - -#if defined(MBEDTLS_ECP_RESTARTABLE) - if (rs_ctx != NULL && rs_ctx->rsm != NULL) { - RR = &rs_ctx->rsm->R; - - if (rs_ctx->rsm->state == ecp_rsm_final_norm) { - goto final_norm; - } - } -#endif - - MBEDTLS_MPI_CHK(ecp_comb_recode_scalar(grp, m, k, d, w, - &parity_trick)); - MBEDTLS_MPI_CHK(ecp_mul_comb_core(grp, RR, T, T_size, k, d, - f_rng, p_rng, rs_ctx)); - MBEDTLS_MPI_CHK(ecp_safe_invert_jac(grp, RR, parity_trick)); - -#if defined(MBEDTLS_ECP_RESTARTABLE) - if (rs_ctx != NULL && rs_ctx->rsm != NULL) { - rs_ctx->rsm->state = ecp_rsm_final_norm; - } - -final_norm: - MBEDTLS_ECP_BUDGET(MBEDTLS_ECP_OPS_INV); -#endif - /* - * Knowledge of the jacobian coordinates may leak the last few bits of the - * scalar [1], and since our MPI implementation isn't constant-flow, - * inversion (used for coordinate normalization) may leak the full value - * of its input via side-channels [2]. - * - * [1] https://eprint.iacr.org/2003/191 - * [2] https://eprint.iacr.org/2020/055 - * - * Avoid the leak by randomizing coordinates before we normalize them. - */ - if (f_rng != 0) { - MBEDTLS_MPI_CHK(ecp_randomize_jac(grp, RR, f_rng, p_rng)); - } - - MBEDTLS_MPI_CHK(ecp_normalize_jac(grp, RR)); - -#if defined(MBEDTLS_ECP_RESTARTABLE) - if (rs_ctx != NULL && rs_ctx->rsm != NULL) { - MBEDTLS_MPI_CHK(mbedtls_ecp_copy(R, RR)); - } -#endif - -cleanup: - return ret; -} - -/* - * Pick window size based on curve size and whether we optimize for base point - */ -static unsigned char ecp_pick_window_size(const mbedtls_ecp_group *grp, - unsigned char p_eq_g) -{ - unsigned char w; - - /* - * Minimize the number of multiplications, that is minimize - * 10 * d * w + 18 * 2^(w-1) + 11 * d + 7 * w, with d = ceil( nbits / w ) - * (see costs of the various parts, with 1S = 1M) - */ - w = grp->nbits >= 384 ? 5 : 4; - - /* - * If P == G, pre-compute a bit more, since this may be re-used later. - * Just adding one avoids upping the cost of the first mul too much, - * and the memory cost too. - */ - if (p_eq_g) { - w++; - } - - /* - * If static comb table may not be used (!p_eq_g) or static comb table does - * not exists, make sure w is within bounds. - * (The last test is useful only for very small curves in the test suite.) - * - * The user reduces MBEDTLS_ECP_WINDOW_SIZE does not changes the size of - * static comb table, because the size of static comb table is fixed when - * it is generated. - */ -#if (MBEDTLS_ECP_WINDOW_SIZE < 6) - if ((!p_eq_g || !ecp_group_is_static_comb_table(grp)) && w > MBEDTLS_ECP_WINDOW_SIZE) { - w = MBEDTLS_ECP_WINDOW_SIZE; - } -#endif - if (w >= grp->nbits) { - w = 2; - } - - return w; -} - -/* - * Multiplication using the comb method - for curves in short Weierstrass form - * - * This function is mainly responsible for administrative work: - * - managing the restart context if enabled - * - managing the table of precomputed points (passed between the below two - * functions): allocation, computation, ownership transfer, freeing. - * - * It delegates the actual arithmetic work to: - * ecp_precompute_comb() and ecp_mul_comb_with_precomp() - * - * See comments on ecp_comb_recode_core() regarding the computation strategy. - */ -static int ecp_mul_comb(mbedtls_ecp_group *grp, mbedtls_ecp_point *R, - const mbedtls_mpi *m, const mbedtls_ecp_point *P, - int (*f_rng)(void *, unsigned char *, size_t), - void *p_rng, - mbedtls_ecp_restart_ctx *rs_ctx) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - unsigned char w, p_eq_g, i; - size_t d; - unsigned char T_size = 0, T_ok = 0; - mbedtls_ecp_point *T = NULL; - - ECP_RS_ENTER(rsm); - - /* Is P the base point ? */ -#if MBEDTLS_ECP_FIXED_POINT_OPTIM == 1 - p_eq_g = (MPI_ECP_CMP(&P->Y, &grp->G.Y) == 0 && - MPI_ECP_CMP(&P->X, &grp->G.X) == 0); -#else - p_eq_g = 0; -#endif - - /* Pick window size and deduce related sizes */ - w = ecp_pick_window_size(grp, p_eq_g); - T_size = 1U << (w - 1); - d = (grp->nbits + w - 1) / w; - - /* Pre-computed table: do we have it already for the base point? */ - if (p_eq_g && grp->T != NULL) { - /* second pointer to the same table, will be deleted on exit */ - T = grp->T; - T_ok = 1; - } else -#if defined(MBEDTLS_ECP_RESTARTABLE) - /* Pre-computed table: do we have one in progress? complete? */ - if (rs_ctx != NULL && rs_ctx->rsm != NULL && rs_ctx->rsm->T != NULL) { - /* transfer ownership of T from rsm to local function */ - T = rs_ctx->rsm->T; - rs_ctx->rsm->T = NULL; - rs_ctx->rsm->T_size = 0; - - /* This effectively jumps to the call to mul_comb_after_precomp() */ - T_ok = rs_ctx->rsm->state >= ecp_rsm_comb_core; - } else -#endif - /* Allocate table if we didn't have any */ - { - T = mbedtls_calloc(T_size, sizeof(mbedtls_ecp_point)); - if (T == NULL) { - ret = MBEDTLS_ERR_ECP_ALLOC_FAILED; - goto cleanup; - } - - for (i = 0; i < T_size; i++) { - mbedtls_ecp_point_init(&T[i]); - } - - T_ok = 0; - } - - /* Compute table (or finish computing it) if not done already */ - if (!T_ok) { - MBEDTLS_MPI_CHK(ecp_precompute_comb(grp, T, P, w, d, rs_ctx)); - - if (p_eq_g) { - /* almost transfer ownership of T to the group, but keep a copy of - * the pointer to use for calling the next function more easily */ - grp->T = T; - grp->T_size = T_size; - } - } - - /* Actual comb multiplication using precomputed points */ - MBEDTLS_MPI_CHK(ecp_mul_comb_after_precomp(grp, R, m, - T, T_size, w, d, - f_rng, p_rng, rs_ctx)); - -cleanup: - - /* does T belong to the group? */ - if (T == grp->T) { - T = NULL; - } - - /* does T belong to the restart context? */ -#if defined(MBEDTLS_ECP_RESTARTABLE) - if (rs_ctx != NULL && rs_ctx->rsm != NULL && ret == MBEDTLS_ERR_ECP_IN_PROGRESS && T != NULL) { - /* transfer ownership of T from local function to rsm */ - rs_ctx->rsm->T_size = T_size; - rs_ctx->rsm->T = T; - T = NULL; - } -#endif - - /* did T belong to us? then let's destroy it! */ - if (T != NULL) { - for (i = 0; i < T_size; i++) { - mbedtls_ecp_point_free(&T[i]); - } - mbedtls_free(T); - } - - /* prevent caller from using invalid value */ - int should_free_R = (ret != 0); -#if defined(MBEDTLS_ECP_RESTARTABLE) - /* don't free R while in progress in case R == P */ - if (ret == MBEDTLS_ERR_ECP_IN_PROGRESS) { - should_free_R = 0; - } -#endif - if (should_free_R) { - mbedtls_ecp_point_free(R); - } - - ECP_RS_LEAVE(rsm); - - return ret; -} - -#endif /* MBEDTLS_ECP_MUL_ALT */ - -#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */ - -#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) -/* - * For Montgomery curves, we do all the internal arithmetic in projective - * coordinates. Import/export of points uses only the x coordinates, which is - * internally represented as X / Z. - * - * For scalar multiplication, we'll use a Montgomery ladder. - */ - - #if !defined(MBEDTLS_ECP_MUL_ALT) -/* - * Normalize Montgomery x/z coordinates: X = X/Z, Z = 1 - * Cost: 1M + 1I - */ -static int ecp_normalize_mxz(const mbedtls_ecp_group *grp, mbedtls_ecp_point *P) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - MPI_ECP_INV(&P->Z, &P->Z); - MPI_ECP_MUL(&P->X, &P->X, &P->Z); - MPI_ECP_LSET(&P->Z, 1); - -cleanup: - return ret; -} - -/* - * Randomize projective x/z coordinates: - * (X, Z) -> (l X, l Z) for random l - * This is sort of the reverse operation of ecp_normalize_mxz(). - * - * This countermeasure was first suggested in [2]. - * Cost: 2M - */ -static int ecp_randomize_mxz(const mbedtls_ecp_group *grp, mbedtls_ecp_point *P, - int (*f_rng)(void *, unsigned char *, size_t), void *p_rng) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - mbedtls_mpi l; - mbedtls_mpi_init(&l); - - /* Generate l such that 1 < l < p */ - MPI_ECP_RAND(&l); - - MPI_ECP_MUL(&P->X, &P->X, &l); - MPI_ECP_MUL(&P->Z, &P->Z, &l); - -cleanup: - mbedtls_mpi_free(&l); - - if (ret == MBEDTLS_ERR_MPI_NOT_ACCEPTABLE) { - ret = MBEDTLS_ERR_ECP_RANDOM_FAILED; - } - return ret; -} - -/* - * Double-and-add: R = 2P, S = P + Q, with d = X(P - Q), - * for Montgomery curves in x/z coordinates. - * - * http://www.hyperelliptic.org/EFD/g1p/auto-code/montgom/xz/ladder/mladd-1987-m.op3 - * with - * d = X1 - * P = (X2, Z2) - * Q = (X3, Z3) - * R = (X4, Z4) - * S = (X5, Z5) - * and eliminating temporary variables tO, ..., t4. - * - * Cost: 5M + 4S - */ -static int ecp_double_add_mxz(const mbedtls_ecp_group *grp, - mbedtls_ecp_point *R, mbedtls_ecp_point *S, - const mbedtls_ecp_point *P, const mbedtls_ecp_point *Q, - const mbedtls_mpi *d, - mbedtls_mpi T[4]) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - - MPI_ECP_ADD(&T[0], &P->X, &P->Z); /* Pp := PX + PZ */ - MPI_ECP_SUB(&T[1], &P->X, &P->Z); /* Pm := PX - PZ */ - MPI_ECP_ADD(&T[2], &Q->X, &Q->Z); /* Qp := QX + XZ */ - MPI_ECP_SUB(&T[3], &Q->X, &Q->Z); /* Qm := QX - QZ */ - MPI_ECP_MUL(&T[3], &T[3], &T[0]); /* Qm * Pp */ - MPI_ECP_MUL(&T[2], &T[2], &T[1]); /* Qp * Pm */ - MPI_ECP_SQR(&T[0], &T[0]); /* Pp^2 */ - MPI_ECP_SQR(&T[1], &T[1]); /* Pm^2 */ - MPI_ECP_MUL(&R->X, &T[0], &T[1]); /* Pp^2 * Pm^2 */ - MPI_ECP_SUB(&T[0], &T[0], &T[1]); /* Pp^2 - Pm^2 */ - MPI_ECP_MUL(&R->Z, &grp->A, &T[0]); /* A * (Pp^2 - Pm^2) */ - MPI_ECP_ADD(&R->Z, &T[1], &R->Z); /* [ A * (Pp^2-Pm^2) ] + Pm^2 */ - MPI_ECP_ADD(&S->X, &T[3], &T[2]); /* Qm*Pp + Qp*Pm */ - MPI_ECP_SQR(&S->X, &S->X); /* (Qm*Pp + Qp*Pm)^2 */ - MPI_ECP_SUB(&S->Z, &T[3], &T[2]); /* Qm*Pp - Qp*Pm */ - MPI_ECP_SQR(&S->Z, &S->Z); /* (Qm*Pp - Qp*Pm)^2 */ - MPI_ECP_MUL(&S->Z, d, &S->Z); /* d * ( Qm*Pp - Qp*Pm )^2 */ - MPI_ECP_MUL(&R->Z, &T[0], &R->Z); /* [A*(Pp^2-Pm^2)+Pm^2]*(Pp^2-Pm^2) */ - -cleanup: - - return ret; -} - -/* - * Multiplication with Montgomery ladder in x/z coordinates, - * for curves in Montgomery form - */ -static int ecp_mul_mxz(mbedtls_ecp_group *grp, mbedtls_ecp_point *R, - const mbedtls_mpi *m, const mbedtls_ecp_point *P, - int (*f_rng)(void *, unsigned char *, size_t), - void *p_rng) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - size_t i; - unsigned char b; - mbedtls_ecp_point RP; - mbedtls_mpi PX; - mbedtls_mpi tmp[4]; - mbedtls_ecp_point_init(&RP); mbedtls_mpi_init(&PX); - - mpi_init_many(tmp, sizeof(tmp) / sizeof(mbedtls_mpi)); - - if (f_rng == NULL) { - return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; - } - - /* Save PX and read from P before writing to R, in case P == R */ - MPI_ECP_MOV(&PX, &P->X); - MBEDTLS_MPI_CHK(mbedtls_ecp_copy(&RP, P)); - - /* Set R to zero in modified x/z coordinates */ - MPI_ECP_LSET(&R->X, 1); - MPI_ECP_LSET(&R->Z, 0); - mbedtls_mpi_free(&R->Y); - - /* RP.X might be slightly larger than P, so reduce it */ - MOD_ADD(&RP.X); - - /* Randomize coordinates of the starting point */ - MBEDTLS_MPI_CHK(ecp_randomize_mxz(grp, &RP, f_rng, p_rng)); - - /* Loop invariant: R = result so far, RP = R + P */ - i = grp->nbits + 1; /* one past the (zero-based) required msb for private keys */ - while (i-- > 0) { - b = mbedtls_mpi_get_bit(m, i); - /* - * if (b) R = 2R + P else R = 2R, - * which is: - * if (b) double_add( RP, R, RP, R ) - * else double_add( R, RP, R, RP ) - * but using safe conditional swaps to avoid leaks - */ - MPI_ECP_COND_SWAP(&R->X, &RP.X, b); - MPI_ECP_COND_SWAP(&R->Z, &RP.Z, b); - MBEDTLS_MPI_CHK(ecp_double_add_mxz(grp, R, &RP, R, &RP, &PX, tmp)); - MPI_ECP_COND_SWAP(&R->X, &RP.X, b); - MPI_ECP_COND_SWAP(&R->Z, &RP.Z, b); - } - - /* - * Knowledge of the projective coordinates may leak the last few bits of the - * scalar [1], and since our MPI implementation isn't constant-flow, - * inversion (used for coordinate normalization) may leak the full value - * of its input via side-channels [2]. - * - * [1] https://eprint.iacr.org/2003/191 - * [2] https://eprint.iacr.org/2020/055 - * - * Avoid the leak by randomizing coordinates before we normalize them. - */ - MBEDTLS_MPI_CHK(ecp_randomize_mxz(grp, R, f_rng, p_rng)); - MBEDTLS_MPI_CHK(ecp_normalize_mxz(grp, R)); - -cleanup: - mbedtls_ecp_point_free(&RP); mbedtls_mpi_free(&PX); - - mpi_free_many(tmp, sizeof(tmp) / sizeof(mbedtls_mpi)); - return ret; -} -#endif /* MBEDTLS_ECP_MUL_ALT */ -#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */ - -#if !defined(MBEDTLS_ECP_MUL_ALT) -/* - * Restartable multiplication R = m * P - * - * This internal function can be called without an RNG in case where we know - * the inputs are not sensitive. - */ -#if defined(MBEDTLS_ECP_MUL_ALT_SOFT_FALLBACK) -int ecp_mul_restartable_internal_soft(mbedtls_ecp_group *grp, mbedtls_ecp_point *R, - const mbedtls_mpi *m, const mbedtls_ecp_point *P, - int (*f_rng)(void *, unsigned char *, size_t), void *p_rng, - mbedtls_ecp_restart_ctx *rs_ctx) -#else -static int ecp_mul_restartable_internal(mbedtls_ecp_group *grp, mbedtls_ecp_point *R, - const mbedtls_mpi *m, const mbedtls_ecp_point *P, - int (*f_rng)(void *, unsigned char *, size_t), void *p_rng, - mbedtls_ecp_restart_ctx *rs_ctx) -#endif -{ - int ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA; - -#if defined(MBEDTLS_ECP_RESTARTABLE) - /* reset ops count for this call if top-level */ - if (rs_ctx != NULL && rs_ctx->depth++ == 0) { - rs_ctx->ops_done = 0; - } -#else - (void) rs_ctx; -#endif - - int restarting = 0; -#if defined(MBEDTLS_ECP_RESTARTABLE) - restarting = (rs_ctx != NULL && rs_ctx->rsm != NULL); -#endif - /* skip argument check when restarting */ - if (!restarting) { - /* check_privkey is free */ - MBEDTLS_ECP_BUDGET(MBEDTLS_ECP_OPS_CHK); - - /* Common sanity checks */ - MBEDTLS_MPI_CHK(mbedtls_ecp_check_privkey(grp, m)); - MBEDTLS_MPI_CHK(mbedtls_ecp_check_pubkey(grp, P)); - } - - ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA; -#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) - if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_MONTGOMERY) { - MBEDTLS_MPI_CHK(ecp_mul_mxz(grp, R, m, P, f_rng, p_rng)); - } -#endif -#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) - if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS) { - MBEDTLS_MPI_CHK(ecp_mul_comb(grp, R, m, P, f_rng, p_rng, rs_ctx)); - } -#endif - -cleanup: - -#if defined(MBEDTLS_ECP_RESTARTABLE) - if (rs_ctx != NULL) { - rs_ctx->depth--; - } -#endif - - return ret; -} -#endif /* !MBEDTLS_ECP_MUL_ALT */ - -/* - * Restartable multiplication R = m * P - */ -int mbedtls_ecp_mul_restartable(mbedtls_ecp_group *grp, mbedtls_ecp_point *R, - const mbedtls_mpi *m, const mbedtls_ecp_point *P, - int (*f_rng)(void *, unsigned char *, size_t), void *p_rng, - mbedtls_ecp_restart_ctx *rs_ctx) -{ - if (f_rng == NULL) { - return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; - } - - return ecp_mul_restartable_internal(grp, R, m, P, f_rng, p_rng, rs_ctx); -} - -/* - * Multiplication R = m * P - */ -int mbedtls_ecp_mul(mbedtls_ecp_group *grp, mbedtls_ecp_point *R, - const mbedtls_mpi *m, const mbedtls_ecp_point *P, - int (*f_rng)(void *, unsigned char *, size_t), void *p_rng) -{ - return mbedtls_ecp_mul_restartable(grp, R, m, P, f_rng, p_rng, NULL); -} -#endif /* MBEDTLS_ECP_C */ - -#if !defined(MBEDTLS_ECP_VERIFY_ALT) - -#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) -/* - * Check that an affine point is valid as a public key, - * short weierstrass curves (SEC1 3.2.3.1) - */ -static int ecp_check_pubkey_sw(const mbedtls_ecp_group *grp, const mbedtls_ecp_point *pt) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - mbedtls_mpi YY, RHS; - - /* pt coordinates must be normalized for our checks */ - if (mbedtls_mpi_cmp_int(&pt->X, 0) < 0 || - mbedtls_mpi_cmp_int(&pt->Y, 0) < 0 || - mbedtls_mpi_cmp_mpi(&pt->X, &grp->P) >= 0 || - mbedtls_mpi_cmp_mpi(&pt->Y, &grp->P) >= 0) { - return MBEDTLS_ERR_ECP_INVALID_KEY; - } - - mbedtls_mpi_init(&YY); mbedtls_mpi_init(&RHS); - - /* - * YY = Y^2 - * RHS = X^3 + A X + B - */ - MPI_ECP_SQR(&YY, &pt->Y); - MBEDTLS_MPI_CHK(ecp_sw_rhs(grp, &RHS, &pt->X)); - - if (MPI_ECP_CMP(&YY, &RHS) != 0) { - ret = MBEDTLS_ERR_ECP_INVALID_KEY; - } - -cleanup: - - mbedtls_mpi_free(&YY); mbedtls_mpi_free(&RHS); - - return ret; -} -#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */ -#endif /* MBEDTLS_ECP_VERIFY_ALT */ - -#if defined(MBEDTLS_ECP_C) -#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) -/* - * R = m * P with shortcuts for m == 0, m == 1 and m == -1 - * NOT constant-time - ONLY for short Weierstrass! - */ -static int mbedtls_ecp_mul_shortcuts(mbedtls_ecp_group *grp, - mbedtls_ecp_point *R, - const mbedtls_mpi *m, - const mbedtls_ecp_point *P, - mbedtls_ecp_restart_ctx *rs_ctx) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - mbedtls_mpi tmp; - mbedtls_mpi_init(&tmp); - - if (mbedtls_mpi_cmp_int(m, 0) == 0) { - MBEDTLS_MPI_CHK(mbedtls_ecp_check_pubkey(grp, P)); - MBEDTLS_MPI_CHK(mbedtls_ecp_set_zero(R)); - } else if (mbedtls_mpi_cmp_int(m, 1) == 0) { - MBEDTLS_MPI_CHK(mbedtls_ecp_check_pubkey(grp, P)); - MBEDTLS_MPI_CHK(mbedtls_ecp_copy(R, P)); - } else if (mbedtls_mpi_cmp_int(m, -1) == 0) { - MBEDTLS_MPI_CHK(mbedtls_ecp_check_pubkey(grp, P)); - MBEDTLS_MPI_CHK(mbedtls_ecp_copy(R, P)); - MPI_ECP_NEG(&R->Y); - } else { - MBEDTLS_MPI_CHK(ecp_mul_restartable_internal(grp, R, m, P, - NULL, NULL, rs_ctx)); - } - -cleanup: - mbedtls_mpi_free(&tmp); - - return ret; -} - -/* - * Restartable linear combination - * NOT constant-time - */ -int mbedtls_ecp_muladd_restartable( - mbedtls_ecp_group *grp, mbedtls_ecp_point *R, - const mbedtls_mpi *m, const mbedtls_ecp_point *P, - const mbedtls_mpi *n, const mbedtls_ecp_point *Q, - mbedtls_ecp_restart_ctx *rs_ctx) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - mbedtls_ecp_point mP; - mbedtls_ecp_point *pmP = &mP; - mbedtls_ecp_point *pR = R; - mbedtls_mpi tmp[4]; - if (mbedtls_ecp_get_type(grp) != MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS) { - return MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE; - } - - mbedtls_ecp_point_init(&mP); - mpi_init_many(tmp, sizeof(tmp) / sizeof(mbedtls_mpi)); - - ECP_RS_ENTER(ma); - -#if defined(MBEDTLS_ECP_RESTARTABLE) - if (rs_ctx != NULL && rs_ctx->ma != NULL) { - /* redirect intermediate results to restart context */ - pmP = &rs_ctx->ma->mP; - pR = &rs_ctx->ma->R; - - /* jump to next operation */ - if (rs_ctx->ma->state == ecp_rsma_mul2) { - goto mul2; - } - if (rs_ctx->ma->state == ecp_rsma_add) { - goto add; - } - if (rs_ctx->ma->state == ecp_rsma_norm) { - goto norm; - } - } -#endif /* MBEDTLS_ECP_RESTARTABLE */ - - MBEDTLS_MPI_CHK(mbedtls_ecp_mul_shortcuts(grp, pmP, m, P, rs_ctx)); -#if defined(MBEDTLS_ECP_RESTARTABLE) - if (rs_ctx != NULL && rs_ctx->ma != NULL) { - rs_ctx->ma->state = ecp_rsma_mul2; - } - -mul2: -#endif - MBEDTLS_MPI_CHK(mbedtls_ecp_mul_shortcuts(grp, pR, n, Q, rs_ctx)); - -#if defined(MBEDTLS_ECP_RESTARTABLE) - if (rs_ctx != NULL && rs_ctx->ma != NULL) { - rs_ctx->ma->state = ecp_rsma_add; - } - -add: -#endif - MBEDTLS_ECP_BUDGET(MBEDTLS_ECP_OPS_ADD); - MBEDTLS_MPI_CHK(ecp_add_mixed(grp, pR, pmP, pR, tmp)); -#if defined(MBEDTLS_ECP_RESTARTABLE) - if (rs_ctx != NULL && rs_ctx->ma != NULL) { - rs_ctx->ma->state = ecp_rsma_norm; - } - -norm: -#endif - MBEDTLS_ECP_BUDGET(MBEDTLS_ECP_OPS_INV); - MBEDTLS_MPI_CHK(ecp_normalize_jac(grp, pR)); - -#if defined(MBEDTLS_ECP_RESTARTABLE) - if (rs_ctx != NULL && rs_ctx->ma != NULL) { - MBEDTLS_MPI_CHK(mbedtls_ecp_copy(R, pR)); - } -#endif - -cleanup: - - mpi_free_many(tmp, sizeof(tmp) / sizeof(mbedtls_mpi)); - - mbedtls_ecp_point_free(&mP); - - ECP_RS_LEAVE(ma); - - return ret; -} - -/* - * Linear combination - * NOT constant-time - */ -int mbedtls_ecp_muladd(mbedtls_ecp_group *grp, mbedtls_ecp_point *R, - const mbedtls_mpi *m, const mbedtls_ecp_point *P, - const mbedtls_mpi *n, const mbedtls_ecp_point *Q) -{ - return mbedtls_ecp_muladd_restartable(grp, R, m, P, n, Q, NULL); -} -#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */ -#endif /* MBEDTLS_ECP_C */ - -#if !defined(MBEDTLS_ECP_VERIFY_ALT) - -#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) -#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) -#define ECP_MPI_INIT(_p, _n) { .p = (mbedtls_mpi_uint *) (_p), .s = 1, .n = (_n) } -#define ECP_MPI_INIT_ARRAY(x) \ - ECP_MPI_INIT(x, sizeof(x) / sizeof(mbedtls_mpi_uint)) -/* - * Constants for the two points other than 0, 1, -1 (mod p) in - * https://cr.yp.to/ecdh.html#validate - * See ecp_check_pubkey_x25519(). - */ -static const mbedtls_mpi_uint x25519_bad_point_1[] = { - MBEDTLS_BYTES_TO_T_UINT_8(0xe0, 0xeb, 0x7a, 0x7c, 0x3b, 0x41, 0xb8, 0xae), - MBEDTLS_BYTES_TO_T_UINT_8(0x16, 0x56, 0xe3, 0xfa, 0xf1, 0x9f, 0xc4, 0x6a), - MBEDTLS_BYTES_TO_T_UINT_8(0xda, 0x09, 0x8d, 0xeb, 0x9c, 0x32, 0xb1, 0xfd), - MBEDTLS_BYTES_TO_T_UINT_8(0x86, 0x62, 0x05, 0x16, 0x5f, 0x49, 0xb8, 0x00), -}; -static const mbedtls_mpi_uint x25519_bad_point_2[] = { - MBEDTLS_BYTES_TO_T_UINT_8(0x5f, 0x9c, 0x95, 0xbc, 0xa3, 0x50, 0x8c, 0x24), - MBEDTLS_BYTES_TO_T_UINT_8(0xb1, 0xd0, 0xb1, 0x55, 0x9c, 0x83, 0xef, 0x5b), - MBEDTLS_BYTES_TO_T_UINT_8(0x04, 0x44, 0x5c, 0xc4, 0x58, 0x1c, 0x8e, 0x86), - MBEDTLS_BYTES_TO_T_UINT_8(0xd8, 0x22, 0x4e, 0xdd, 0xd0, 0x9f, 0x11, 0x57), -}; -static const mbedtls_mpi ecp_x25519_bad_point_1 = ECP_MPI_INIT_ARRAY( - x25519_bad_point_1); -static const mbedtls_mpi ecp_x25519_bad_point_2 = ECP_MPI_INIT_ARRAY( - x25519_bad_point_2); -#endif /* MBEDTLS_ECP_DP_CURVE25519_ENABLED */ - -/* - * Check that the input point is not one of the low-order points. - * This is recommended by the "May the Fourth" paper: - * https://eprint.iacr.org/2017/806.pdf - * Those points are never sent by an honest peer. - */ -static int ecp_check_bad_points_mx(const mbedtls_mpi *X, const mbedtls_mpi *P, - const mbedtls_ecp_group_id grp_id) -{ - int ret; - mbedtls_mpi XmP; - - mbedtls_mpi_init(&XmP); - - /* Reduce X mod P so that we only need to check values less than P. - * We know X < 2^256 so we can proceed by subtraction. */ - MBEDTLS_MPI_CHK(mbedtls_mpi_copy(&XmP, X)); - while (mbedtls_mpi_cmp_mpi(&XmP, P) >= 0) { - MBEDTLS_MPI_CHK(mbedtls_mpi_sub_mpi(&XmP, &XmP, P)); - } - - /* Check against the known bad values that are less than P. For Curve448 - * these are 0, 1 and -1. For Curve25519 we check the values less than P - * from the following list: https://cr.yp.to/ecdh.html#validate */ - if (mbedtls_mpi_cmp_int(&XmP, 1) <= 0) { /* takes care of 0 and 1 */ - ret = MBEDTLS_ERR_ECP_INVALID_KEY; - goto cleanup; - } - -#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) - if (grp_id == MBEDTLS_ECP_DP_CURVE25519) { - if (mbedtls_mpi_cmp_mpi(&XmP, &ecp_x25519_bad_point_1) == 0) { - ret = MBEDTLS_ERR_ECP_INVALID_KEY; - goto cleanup; - } - - if (mbedtls_mpi_cmp_mpi(&XmP, &ecp_x25519_bad_point_2) == 0) { - ret = MBEDTLS_ERR_ECP_INVALID_KEY; - goto cleanup; - } - } -#else - (void) grp_id; -#endif - - /* Final check: check if XmP + 1 is P (final because it changes XmP!) */ - MBEDTLS_MPI_CHK(mbedtls_mpi_add_int(&XmP, &XmP, 1)); - if (mbedtls_mpi_cmp_mpi(&XmP, P) == 0) { - ret = MBEDTLS_ERR_ECP_INVALID_KEY; - goto cleanup; - } - - ret = 0; - -cleanup: - mbedtls_mpi_free(&XmP); - - return ret; -} - -/* - * Check validity of a public key for Montgomery curves with x-only schemes - */ -static int ecp_check_pubkey_mx(const mbedtls_ecp_group *grp, const mbedtls_ecp_point *pt) -{ - /* [Curve25519 p. 5] Just check X is the correct number of bytes */ - /* Allow any public value, if it's too big then we'll just reduce it mod p - * (RFC 7748 sec. 5 para. 3). */ - if (mbedtls_mpi_size(&pt->X) > (grp->nbits + 7) / 8) { - return MBEDTLS_ERR_ECP_INVALID_KEY; - } - - /* Implicit in all standards (as they don't consider negative numbers): - * X must be non-negative. This is normally ensured by the way it's - * encoded for transmission, but let's be extra sure. */ - if (mbedtls_mpi_cmp_int(&pt->X, 0) < 0) { - return MBEDTLS_ERR_ECP_INVALID_KEY; - } - - return ecp_check_bad_points_mx(&pt->X, &grp->P, grp->id); -} -#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */ - -#endif /* MBEDTLS_ECP_VERIFY_ALT */ - -#if !defined(MBEDTLS_ECP_VERIFY_ALT) -/* - * Check that a point is valid as a public key - */ -#if defined(MBEDTLS_ECP_VERIFY_ALT_SOFT_FALLBACK) -int mbedtls_ecp_check_pubkey_soft(const mbedtls_ecp_group *grp, - const mbedtls_ecp_point *pt) -#else -int mbedtls_ecp_check_pubkey(const mbedtls_ecp_group *grp, - const mbedtls_ecp_point *pt) -#endif -{ - /* Must use affine coordinates */ - if (mbedtls_mpi_cmp_int(&pt->Z, 1) != 0) { - return MBEDTLS_ERR_ECP_INVALID_KEY; - } - -#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) - if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_MONTGOMERY) { - return ecp_check_pubkey_mx(grp, pt); - } -#endif -#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) - if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS) { - return ecp_check_pubkey_sw(grp, pt); - } -#endif - return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; -} -#endif /* MBEDTLS_ECP_VERIFY_ALT */ - -/* - * Check that an mbedtls_mpi is valid as a private key - */ -int mbedtls_ecp_check_privkey(const mbedtls_ecp_group *grp, - const mbedtls_mpi *d) -{ -#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) - if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_MONTGOMERY) { - /* see RFC 7748 sec. 5 para. 5 */ - if (mbedtls_mpi_get_bit(d, 0) != 0 || - mbedtls_mpi_get_bit(d, 1) != 0 || - mbedtls_mpi_bitlen(d) != grp->nbits + 1) { /* mbedtls_mpi_bitlen is one-based! */ - return MBEDTLS_ERR_ECP_INVALID_KEY; - } - - /* see [Curve25519] page 5 */ - if (grp->nbits == 254 && mbedtls_mpi_get_bit(d, 2) != 0) { - return MBEDTLS_ERR_ECP_INVALID_KEY; - } - - return 0; - } -#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */ -#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) - if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS) { - /* see SEC1 3.2 */ - if (mbedtls_mpi_cmp_int(d, 1) < 0 || - mbedtls_mpi_cmp_mpi(d, &grp->N) >= 0) { - return MBEDTLS_ERR_ECP_INVALID_KEY; - } else { - return 0; - } - } -#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */ - - return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; -} - -#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) -MBEDTLS_STATIC_TESTABLE -int mbedtls_ecp_gen_privkey_mx(size_t high_bit, - mbedtls_mpi *d, - int (*f_rng)(void *, unsigned char *, size_t), - void *p_rng) -{ - int ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA; - size_t n_random_bytes = high_bit / 8 + 1; - - /* [Curve25519] page 5 */ - /* Generate a (high_bit+1)-bit random number by generating just enough - * random bytes, then shifting out extra bits from the top (necessary - * when (high_bit+1) is not a multiple of 8). */ - MBEDTLS_MPI_CHK(mbedtls_mpi_fill_random(d, n_random_bytes, - f_rng, p_rng)); - MBEDTLS_MPI_CHK(mbedtls_mpi_shift_r(d, 8 * n_random_bytes - high_bit - 1)); - - MBEDTLS_MPI_CHK(mbedtls_mpi_set_bit(d, high_bit, 1)); - - /* Make sure the last two bits are unset for Curve448, three bits for - Curve25519 */ - MBEDTLS_MPI_CHK(mbedtls_mpi_set_bit(d, 0, 0)); - MBEDTLS_MPI_CHK(mbedtls_mpi_set_bit(d, 1, 0)); - if (high_bit == 254) { - MBEDTLS_MPI_CHK(mbedtls_mpi_set_bit(d, 2, 0)); - } - -cleanup: - return ret; -} -#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */ - -#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) -static int mbedtls_ecp_gen_privkey_sw( - const mbedtls_mpi *N, mbedtls_mpi *d, - int (*f_rng)(void *, unsigned char *, size_t), void *p_rng) -{ - int ret = mbedtls_mpi_random(d, 1, N, f_rng, p_rng); - switch (ret) { - case MBEDTLS_ERR_MPI_NOT_ACCEPTABLE: - return MBEDTLS_ERR_ECP_RANDOM_FAILED; - default: - return ret; - } -} -#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */ - -/* - * Generate a private key - */ -int mbedtls_ecp_gen_privkey(const mbedtls_ecp_group *grp, - mbedtls_mpi *d, - int (*f_rng)(void *, unsigned char *, size_t), - void *p_rng) -{ -#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) - if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_MONTGOMERY) { - return mbedtls_ecp_gen_privkey_mx(grp->nbits, d, f_rng, p_rng); - } -#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */ - -#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) - if (mbedtls_ecp_get_type(grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS) { - return mbedtls_ecp_gen_privkey_sw(&grp->N, d, f_rng, p_rng); - } -#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */ - - return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; -} - -#if defined(MBEDTLS_ECP_C) -/* - * Generate a keypair with configurable base point - */ -int mbedtls_ecp_gen_keypair_base(mbedtls_ecp_group *grp, - const mbedtls_ecp_point *G, - mbedtls_mpi *d, mbedtls_ecp_point *Q, - int (*f_rng)(void *, unsigned char *, size_t), - void *p_rng) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - MBEDTLS_MPI_CHK(mbedtls_ecp_gen_privkey(grp, d, f_rng, p_rng)); - MBEDTLS_MPI_CHK(mbedtls_ecp_mul(grp, Q, d, G, f_rng, p_rng)); - -cleanup: - return ret; -} - -/* - * Generate key pair, wrapper for conventional base point - */ -int mbedtls_ecp_gen_keypair(mbedtls_ecp_group *grp, - mbedtls_mpi *d, mbedtls_ecp_point *Q, - int (*f_rng)(void *, unsigned char *, size_t), - void *p_rng) -{ - return mbedtls_ecp_gen_keypair_base(grp, &grp->G, d, Q, f_rng, p_rng); -} - -/* - * Generate a keypair, prettier wrapper - */ -int mbedtls_ecp_gen_key(mbedtls_ecp_group_id grp_id, mbedtls_ecp_keypair *key, - int (*f_rng)(void *, unsigned char *, size_t), void *p_rng) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - if ((ret = mbedtls_ecp_group_load(&key->grp, grp_id)) != 0) { - return ret; - } - - return mbedtls_ecp_gen_keypair(&key->grp, &key->d, &key->Q, f_rng, p_rng); -} -#endif /* MBEDTLS_ECP_C */ - -int mbedtls_ecp_set_public_key(mbedtls_ecp_group_id grp_id, - mbedtls_ecp_keypair *key, - const mbedtls_ecp_point *Q) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - - if (key->grp.id == MBEDTLS_ECP_DP_NONE) { - /* Group not set yet */ - if ((ret = mbedtls_ecp_group_load(&key->grp, grp_id)) != 0) { - return ret; - } - } else if (key->grp.id != grp_id) { - /* Group mismatch */ - return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; - } - return mbedtls_ecp_copy(&key->Q, Q); -} - - -#define ECP_CURVE25519_KEY_SIZE 32 -#define ECP_CURVE448_KEY_SIZE 56 -/* - * Read a private key. - */ -int mbedtls_ecp_read_key(mbedtls_ecp_group_id grp_id, mbedtls_ecp_keypair *key, - const unsigned char *buf, size_t buflen) -{ - int ret = 0; - - if ((ret = mbedtls_ecp_group_load(&key->grp, grp_id)) != 0) { - return ret; - } - - ret = MBEDTLS_ERR_ECP_FEATURE_UNAVAILABLE; - -#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) - if (mbedtls_ecp_get_type(&key->grp) == MBEDTLS_ECP_TYPE_MONTGOMERY) { - /* - * Mask the key as mandated by RFC7748 for Curve25519 and Curve448. - */ - if (grp_id == MBEDTLS_ECP_DP_CURVE25519) { - if (buflen != ECP_CURVE25519_KEY_SIZE) { - return MBEDTLS_ERR_ECP_INVALID_KEY; - } - - MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary_le(&key->d, buf, buflen)); - - /* Set the three least significant bits to 0 */ - MBEDTLS_MPI_CHK(mbedtls_mpi_set_bit(&key->d, 0, 0)); - MBEDTLS_MPI_CHK(mbedtls_mpi_set_bit(&key->d, 1, 0)); - MBEDTLS_MPI_CHK(mbedtls_mpi_set_bit(&key->d, 2, 0)); - - /* Set the most significant bit to 0 */ - MBEDTLS_MPI_CHK( - mbedtls_mpi_set_bit(&key->d, - ECP_CURVE25519_KEY_SIZE * 8 - 1, 0) - ); - - /* Set the second most significant bit to 1 */ - MBEDTLS_MPI_CHK( - mbedtls_mpi_set_bit(&key->d, - ECP_CURVE25519_KEY_SIZE * 8 - 2, 1) - ); - } else if (grp_id == MBEDTLS_ECP_DP_CURVE448) { - if (buflen != ECP_CURVE448_KEY_SIZE) { - return MBEDTLS_ERR_ECP_INVALID_KEY; - } - - MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary_le(&key->d, buf, buflen)); - - /* Set the two least significant bits to 0 */ - MBEDTLS_MPI_CHK(mbedtls_mpi_set_bit(&key->d, 0, 0)); - MBEDTLS_MPI_CHK(mbedtls_mpi_set_bit(&key->d, 1, 0)); - - /* Set the most significant bit to 1 */ - MBEDTLS_MPI_CHK( - mbedtls_mpi_set_bit(&key->d, - ECP_CURVE448_KEY_SIZE * 8 - 1, 1) - ); - } - } -#endif -#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) - if (mbedtls_ecp_get_type(&key->grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS) { - MBEDTLS_MPI_CHK(mbedtls_mpi_read_binary(&key->d, buf, buflen)); - } -#endif - - if (ret == 0) { - MBEDTLS_MPI_CHK(mbedtls_ecp_check_privkey(&key->grp, &key->d)); - } - -cleanup: - - if (ret != 0) { - mbedtls_mpi_free(&key->d); - } - - return ret; -} - -/* - * Write a private key. - */ -#if !defined MBEDTLS_DEPRECATED_REMOVED -int mbedtls_ecp_write_key(mbedtls_ecp_keypair *key, - unsigned char *buf, size_t buflen) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - -#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) - if (mbedtls_ecp_get_type(&key->grp) == MBEDTLS_ECP_TYPE_MONTGOMERY) { - if (key->grp.id == MBEDTLS_ECP_DP_CURVE25519) { - if (buflen < ECP_CURVE25519_KEY_SIZE) { - return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL; - } - - } else if (key->grp.id == MBEDTLS_ECP_DP_CURVE448) { - if (buflen < ECP_CURVE448_KEY_SIZE) { - return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL; - } - } - MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary_le(&key->d, buf, buflen)); - } -#endif -#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) - if (mbedtls_ecp_get_type(&key->grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS) { - MBEDTLS_MPI_CHK(mbedtls_mpi_write_binary(&key->d, buf, buflen)); - } - -#endif -cleanup: - - return ret; -} -#endif /* MBEDTLS_DEPRECATED_REMOVED */ - -int mbedtls_ecp_write_key_ext(const mbedtls_ecp_keypair *key, - size_t *olen, unsigned char *buf, size_t buflen) -{ - size_t len = (key->grp.nbits + 7) / 8; - if (len > buflen) { - /* For robustness, ensure *olen <= buflen even on error. */ - *olen = 0; - return MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL; - } - *olen = len; - - /* Private key not set */ - if (key->d.n == 0) { - return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; - } - -#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) - if (mbedtls_ecp_get_type(&key->grp) == MBEDTLS_ECP_TYPE_MONTGOMERY) { - return mbedtls_mpi_write_binary_le(&key->d, buf, len); - } -#endif - -#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) - if (mbedtls_ecp_get_type(&key->grp) == MBEDTLS_ECP_TYPE_SHORT_WEIERSTRASS) { - return mbedtls_mpi_write_binary(&key->d, buf, len); - } -#endif - - /* Private key set but no recognized curve type? This shouldn't happen. */ - return MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; -} - -/* - * Write a public key. - */ -int mbedtls_ecp_write_public_key(const mbedtls_ecp_keypair *key, - int format, size_t *olen, - unsigned char *buf, size_t buflen) -{ - return mbedtls_ecp_point_write_binary(&key->grp, &key->Q, - format, olen, buf, buflen); -} - - -#if defined(MBEDTLS_ECP_C) -/* - * Check a public-private key pair - */ -int mbedtls_ecp_check_pub_priv( - const mbedtls_ecp_keypair *pub, const mbedtls_ecp_keypair *prv, - int (*f_rng)(void *, unsigned char *, size_t), void *p_rng) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - mbedtls_ecp_point Q; - mbedtls_ecp_group grp; - if (pub->grp.id == MBEDTLS_ECP_DP_NONE || - pub->grp.id != prv->grp.id || - mbedtls_mpi_cmp_mpi(&pub->Q.X, &prv->Q.X) || - mbedtls_mpi_cmp_mpi(&pub->Q.Y, &prv->Q.Y) || - mbedtls_mpi_cmp_mpi(&pub->Q.Z, &prv->Q.Z)) { - return MBEDTLS_ERR_ECP_BAD_INPUT_DATA; - } - - mbedtls_ecp_point_init(&Q); - mbedtls_ecp_group_init(&grp); - - /* mbedtls_ecp_mul() needs a non-const group... */ - mbedtls_ecp_group_copy(&grp, &prv->grp); - - /* Also checks d is valid */ - MBEDTLS_MPI_CHK(mbedtls_ecp_mul(&grp, &Q, &prv->d, &prv->grp.G, f_rng, p_rng)); - - if (mbedtls_mpi_cmp_mpi(&Q.X, &prv->Q.X) || - mbedtls_mpi_cmp_mpi(&Q.Y, &prv->Q.Y) || - mbedtls_mpi_cmp_mpi(&Q.Z, &prv->Q.Z)) { - ret = MBEDTLS_ERR_ECP_BAD_INPUT_DATA; - goto cleanup; - } - -cleanup: - mbedtls_ecp_point_free(&Q); - mbedtls_ecp_group_free(&grp); - - return ret; -} - -int mbedtls_ecp_keypair_calc_public(mbedtls_ecp_keypair *key, - int (*f_rng)(void *, unsigned char *, size_t), - void *p_rng) -{ - return mbedtls_ecp_mul(&key->grp, &key->Q, &key->d, &key->grp.G, - f_rng, p_rng); -} -#endif /* MBEDTLS_ECP_C */ - -mbedtls_ecp_group_id mbedtls_ecp_keypair_get_group_id( - const mbedtls_ecp_keypair *key) -{ - return key->grp.id; -} - -/* - * Export generic key-pair parameters. - */ -int mbedtls_ecp_export(const mbedtls_ecp_keypair *key, mbedtls_ecp_group *grp, - mbedtls_mpi *d, mbedtls_ecp_point *Q) -{ - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - - if (grp != NULL && (ret = mbedtls_ecp_group_copy(grp, &key->grp)) != 0) { - return ret; - } - - if (d != NULL && (ret = mbedtls_mpi_copy(d, &key->d)) != 0) { - return ret; - } - - if (Q != NULL && (ret = mbedtls_ecp_copy(Q, &key->Q)) != 0) { - return ret; - } - - return 0; -} - -#if defined(MBEDTLS_SELF_TEST) - -#if defined(MBEDTLS_ECP_C) -/* - * PRNG for test - !!!INSECURE NEVER USE IN PRODUCTION!!! - * - * This is the linear congruential generator from numerical recipes, - * except we only use the low byte as the output. See - * https://en.wikipedia.org/wiki/Linear_congruential_generator#Parameters_in_common_use - */ -static int self_test_rng(void *ctx, unsigned char *out, size_t len) -{ - static uint32_t state = 42; - - (void) ctx; - - for (size_t i = 0; i < len; i++) { - state = state * 1664525u + 1013904223u; - out[i] = (unsigned char) state; - } - - return 0; -} - -/* Adjust the exponent to be a valid private point for the specified curve. - * This is sometimes necessary because we use a single set of exponents - * for all curves but the validity of values depends on the curve. */ -static int self_test_adjust_exponent(const mbedtls_ecp_group *grp, - mbedtls_mpi *m) -{ - int ret = 0; - switch (grp->id) { - /* If Curve25519 is available, then that's what we use for the - * Montgomery test, so we don't need the adjustment code. */ -#if !defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) -#if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED) - case MBEDTLS_ECP_DP_CURVE448: - /* Move highest bit from 254 to N-1. Setting bit N-1 is - * necessary to enforce the highest-bit-set constraint. */ - MBEDTLS_MPI_CHK(mbedtls_mpi_set_bit(m, 254, 0)); - MBEDTLS_MPI_CHK(mbedtls_mpi_set_bit(m, grp->nbits, 1)); - /* Copy second-highest bit from 253 to N-2. This is not - * necessary but improves the test variety a bit. */ - MBEDTLS_MPI_CHK( - mbedtls_mpi_set_bit(m, grp->nbits - 1, - mbedtls_mpi_get_bit(m, 253))); - break; -#endif -#endif /* ! defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) */ - default: - /* Non-Montgomery curves and Curve25519 need no adjustment. */ - (void) grp; - (void) m; - goto cleanup; - } -cleanup: - return ret; -} - -/* Calculate R = m.P for each m in exponents. Check that the number of - * basic operations doesn't depend on the value of m. */ -static int self_test_point(int verbose, - mbedtls_ecp_group *grp, - mbedtls_ecp_point *R, - mbedtls_mpi *m, - const mbedtls_ecp_point *P, - const char *const *exponents, - size_t n_exponents) -{ - int ret = 0; - size_t i = 0; - unsigned long add_c_prev, dbl_c_prev, mul_c_prev; - add_count = 0; - dbl_count = 0; - mul_count = 0; - - MBEDTLS_MPI_CHK(mbedtls_mpi_read_string(m, 16, exponents[0])); - MBEDTLS_MPI_CHK(self_test_adjust_exponent(grp, m)); - MBEDTLS_MPI_CHK(mbedtls_ecp_mul(grp, R, m, P, self_test_rng, NULL)); - - for (i = 1; i < n_exponents; i++) { - add_c_prev = add_count; - dbl_c_prev = dbl_count; - mul_c_prev = mul_count; - add_count = 0; - dbl_count = 0; - mul_count = 0; - - MBEDTLS_MPI_CHK(mbedtls_mpi_read_string(m, 16, exponents[i])); - MBEDTLS_MPI_CHK(self_test_adjust_exponent(grp, m)); - MBEDTLS_MPI_CHK(mbedtls_ecp_mul(grp, R, m, P, self_test_rng, NULL)); - - if (add_count != add_c_prev || - dbl_count != dbl_c_prev || - mul_count != mul_c_prev) { - ret = 1; - break; - } - } - -cleanup: - if (verbose != 0) { - if (ret != 0) { - mbedtls_printf("failed (%u)\n", (unsigned int) i); - } else { - mbedtls_printf("passed\n"); - } - } - return ret; -} -#endif /* MBEDTLS_ECP_C */ - -/* - * Checkup routine - */ -int mbedtls_ecp_self_test(int verbose) -{ -#if defined(MBEDTLS_ECP_C) - int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; - mbedtls_ecp_group grp; - mbedtls_ecp_point R, P; - mbedtls_mpi m; - -#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) - /* Exponents especially adapted for secp192k1, which has the lowest - * order n of all supported curves (secp192r1 is in a slightly larger - * field but the order of its base point is slightly smaller). */ - const char *sw_exponents[] = - { - "000000000000000000000000000000000000000000000001", /* one */ - "FFFFFFFFFFFFFFFFFFFFFFFE26F2FC170F69466A74DEFD8C", /* n - 1 */ - "5EA6F389A38B8BC81E767753B15AA5569E1782E30ABE7D25", /* random */ - "400000000000000000000000000000000000000000000000", /* one and zeros */ - "7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF", /* all ones */ - "555555555555555555555555555555555555555555555555", /* 101010... */ - }; -#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */ -#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) - const char *m_exponents[] = - { - /* Valid private values for Curve25519. In a build with Curve448 - * but not Curve25519, they will be adjusted in - * self_test_adjust_exponent(). */ - "4000000000000000000000000000000000000000000000000000000000000000", - "5C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C30", - "5715ECCE24583F7A7023C24164390586842E816D7280A49EF6DF4EAE6B280BF8", - "41A2B017516F6D254E1F002BCCBADD54BE30F8CEC737A0E912B4963B6BA74460", - "5555555555555555555555555555555555555555555555555555555555555550", - "7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF8", - }; -#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */ - - mbedtls_ecp_group_init(&grp); - mbedtls_ecp_point_init(&R); - mbedtls_ecp_point_init(&P); - mbedtls_mpi_init(&m); - -#if defined(MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED) - /* Use secp192r1 if available, or any available curve */ -#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED) - MBEDTLS_MPI_CHK(mbedtls_ecp_group_load(&grp, MBEDTLS_ECP_DP_SECP192R1)); -#else - MBEDTLS_MPI_CHK(mbedtls_ecp_group_load(&grp, mbedtls_ecp_curve_list()->grp_id)); -#endif - - if (verbose != 0) { - mbedtls_printf(" ECP SW test #1 (constant op_count, base point G): "); - } - /* Do a dummy multiplication first to trigger precomputation */ - MBEDTLS_MPI_CHK(mbedtls_mpi_lset(&m, 2)); - MBEDTLS_MPI_CHK(mbedtls_ecp_mul(&grp, &P, &m, &grp.G, self_test_rng, NULL)); - ret = self_test_point(verbose, - &grp, &R, &m, &grp.G, - sw_exponents, - sizeof(sw_exponents) / sizeof(sw_exponents[0])); - if (ret != 0) { - goto cleanup; - } - - if (verbose != 0) { - mbedtls_printf(" ECP SW test #2 (constant op_count, other point): "); - } - /* We computed P = 2G last time, use it */ - ret = self_test_point(verbose, - &grp, &R, &m, &P, - sw_exponents, - sizeof(sw_exponents) / sizeof(sw_exponents[0])); - if (ret != 0) { - goto cleanup; - } - - mbedtls_ecp_group_free(&grp); - mbedtls_ecp_point_free(&R); -#endif /* MBEDTLS_ECP_SHORT_WEIERSTRASS_ENABLED */ - -#if defined(MBEDTLS_ECP_MONTGOMERY_ENABLED) - if (verbose != 0) { - mbedtls_printf(" ECP Montgomery test (constant op_count): "); - } -#if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED) - MBEDTLS_MPI_CHK(mbedtls_ecp_group_load(&grp, MBEDTLS_ECP_DP_CURVE25519)); -#elif defined(MBEDTLS_ECP_DP_CURVE448_ENABLED) - MBEDTLS_MPI_CHK(mbedtls_ecp_group_load(&grp, MBEDTLS_ECP_DP_CURVE448)); -#else -#error "MBEDTLS_ECP_MONTGOMERY_ENABLED is defined, but no curve is supported for self-test" -#endif - ret = self_test_point(verbose, - &grp, &R, &m, &grp.G, - m_exponents, - sizeof(m_exponents) / sizeof(m_exponents[0])); - if (ret != 0) { - goto cleanup; - } -#endif /* MBEDTLS_ECP_MONTGOMERY_ENABLED */ - -cleanup: - - if (ret < 0 && verbose != 0) { - mbedtls_printf("Unexpected error, return code = %08X\n", (unsigned int) ret); - } - - mbedtls_ecp_group_free(&grp); - mbedtls_ecp_point_free(&R); - mbedtls_ecp_point_free(&P); - mbedtls_mpi_free(&m); - - if (verbose != 0) { - mbedtls_printf("\n"); - } - - return ret; -#else /* MBEDTLS_ECP_C */ - (void) verbose; - return 0; -#endif /* MBEDTLS_ECP_C */ -} - -#endif /* MBEDTLS_SELF_TEST */ - -#endif /* MBEDTLS_ECP_LIGHT */ diff --git a/tf-psa-crypto/include/psa/crypto_builtin_composites.h b/tf-psa-crypto/include/psa/crypto_builtin_composites.h deleted file mode 100644 index b95b4ef920..0000000000 --- a/tf-psa-crypto/include/psa/crypto_builtin_composites.h +++ /dev/null @@ -1,278 +0,0 @@ -/** - * \file crypto_builtin_composites.h - * - * \brief Context structure declaration of the Mbed TLS software-based PSA - * drivers called through the PSA Crypto driver dispatch layer. This file - * contains the context structures of those algorithms which need to rely on - * other algorithms, i.e. are 'composite' algorithms. - * - * \note This file may not be included directly. Applications must - * include psa/crypto.h. - * - * \note This header and its content are not part of the Mbed TLS API and - * applications must not depend on it. Its main purpose is to define the - * multi-part state objects of the Mbed TLS software-based PSA drivers. The - * definitions of these objects are then used by crypto_struct.h to define the - * implementation-defined types of PSA multi-part state objects. - */ -/* - * Copyright The Mbed TLS Contributors - * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later - */ - -#ifndef PSA_CRYPTO_BUILTIN_COMPOSITES_H -#define PSA_CRYPTO_BUILTIN_COMPOSITES_H -#include "mbedtls/private_access.h" - -#include - -#include "mbedtls/cmac.h" -#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM) -#include "mbedtls/gcm.h" -#endif -#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM) -#include "mbedtls/ccm.h" -#endif -#include "mbedtls/chachapoly.h" - -#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH) -#include "mbedtls/ecdh.h" -#endif - -#if defined(ESP_AES_DRIVER_ENABLED) -#include "psa_crypto_driver_esp_cmac_contexts.h" -#endif - -/* - * MAC multi-part operation definitions. - */ -#if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC) -#define MBEDTLS_PSA_BUILTIN_MAC -#endif - -#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC) || defined(PSA_CRYPTO_DRIVER_TEST) -typedef struct { - /** The HMAC algorithm in use */ - psa_algorithm_t MBEDTLS_PRIVATE(alg); - /** The hash context. */ - struct psa_hash_operation_s hash_ctx; - /** The HMAC part of the context. */ - uint8_t MBEDTLS_PRIVATE(opad)[PSA_HMAC_MAX_HASH_BLOCK_SIZE]; -} mbedtls_psa_hmac_operation_t; - -#define MBEDTLS_PSA_HMAC_OPERATION_INIT { 0, PSA_HASH_OPERATION_INIT, { 0 } } -#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */ - -typedef struct { - psa_algorithm_t MBEDTLS_PRIVATE(alg); - union { - unsigned MBEDTLS_PRIVATE(dummy); /* Make the union non-empty even with no supported algorithms. */ -#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC) || defined(PSA_CRYPTO_DRIVER_TEST) - mbedtls_psa_hmac_operation_t MBEDTLS_PRIVATE(hmac); -#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */ -#if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC) || defined(PSA_CRYPTO_DRIVER_TEST) - mbedtls_cipher_context_t MBEDTLS_PRIVATE(cmac); -#endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */ -#if defined(ESP_AES_DRIVER_ENABLED) - esp_cmac_operation_t MBEDTLS_PRIVATE(esp_cmac); -#endif /* ESP_AES_DRIVER_ENABLED */ - } MBEDTLS_PRIVATE(ctx); -} mbedtls_psa_mac_operation_t; - -#define MBEDTLS_PSA_MAC_OPERATION_INIT { 0, { 0 } } - -#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_CCM) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305) -#define MBEDTLS_PSA_BUILTIN_AEAD 1 -#endif - -/* Context structure for the Mbed TLS AEAD implementation. */ -typedef struct { - psa_algorithm_t MBEDTLS_PRIVATE(alg); - psa_key_type_t MBEDTLS_PRIVATE(key_type); - - unsigned int MBEDTLS_PRIVATE(is_encrypt) : 1; - - uint8_t MBEDTLS_PRIVATE(tag_length); - - union { - unsigned dummy; /* Enable easier initializing of the union. */ -#if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM) - mbedtls_ccm_context MBEDTLS_PRIVATE(ccm); -#endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */ -#if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM) - mbedtls_gcm_context MBEDTLS_PRIVATE(gcm); -#endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */ -#if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305) - mbedtls_chachapoly_context MBEDTLS_PRIVATE(chachapoly); -#endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */ - - } ctx; - -} mbedtls_psa_aead_operation_t; - -#define MBEDTLS_PSA_AEAD_OPERATION_INIT { 0, 0, 0, 0, { 0 } } - -#include "mbedtls/ecdsa.h" - -/* Context structure for the Mbed TLS interruptible sign hash implementation. */ -typedef struct { -#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \ - defined(MBEDTLS_ECP_RESTARTABLE) - mbedtls_ecdsa_context *MBEDTLS_PRIVATE(ctx); - mbedtls_ecdsa_restart_ctx MBEDTLS_PRIVATE(restart_ctx); - - uint32_t MBEDTLS_PRIVATE(num_ops); - - size_t MBEDTLS_PRIVATE(coordinate_bytes); - psa_algorithm_t MBEDTLS_PRIVATE(alg); - mbedtls_md_type_t MBEDTLS_PRIVATE(md_alg); - uint8_t MBEDTLS_PRIVATE(hash)[PSA_BITS_TO_BYTES(PSA_VENDOR_ECC_MAX_CURVE_BITS)]; - size_t MBEDTLS_PRIVATE(hash_length); - -#else - /* Make the struct non-empty if algs not supported. */ - unsigned MBEDTLS_PRIVATE(dummy); - -#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || - * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) && - * defined( MBEDTLS_ECP_RESTARTABLE ) */ -} mbedtls_psa_sign_hash_interruptible_operation_t; - -#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \ - defined(MBEDTLS_ECP_RESTARTABLE) -#define MBEDTLS_PSA_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT { { 0 }, { 0 }, 0, 0, 0, 0, 0, 0 } -#else -#define MBEDTLS_PSA_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT { 0 } -#endif - -/* Context structure for the Mbed TLS interruptible verify hash - * implementation.*/ -typedef struct { -#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \ - defined(MBEDTLS_ECP_RESTARTABLE) - - mbedtls_ecdsa_context *MBEDTLS_PRIVATE(ctx); - mbedtls_ecdsa_restart_ctx MBEDTLS_PRIVATE(restart_ctx); - - uint32_t MBEDTLS_PRIVATE(num_ops); - - uint8_t MBEDTLS_PRIVATE(hash)[PSA_BITS_TO_BYTES(PSA_VENDOR_ECC_MAX_CURVE_BITS)]; - size_t MBEDTLS_PRIVATE(hash_length); - - mbedtls_mpi MBEDTLS_PRIVATE(r); - mbedtls_mpi MBEDTLS_PRIVATE(s); - -#else - /* Make the struct non-empty if algs not supported. */ - unsigned MBEDTLS_PRIVATE(dummy); - -#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || - * defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA) && - * defined( MBEDTLS_ECP_RESTARTABLE ) */ - -} mbedtls_psa_verify_hash_interruptible_operation_t; - -#if (defined(MBEDTLS_PSA_BUILTIN_ALG_ECDSA) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_DETERMINISTIC_ECDSA)) && \ - defined(MBEDTLS_ECP_RESTARTABLE) -#define MBEDTLS_VERIFY_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT { { 0 }, { 0 }, 0, 0, 0, 0, { 0 }, \ - { 0 } } -#else -#define MBEDTLS_VERIFY_SIGN_HASH_INTERRUPTIBLE_OPERATION_INIT { 0 } -#endif - - -/* EC-JPAKE operation definitions */ - -#include "mbedtls/ecjpake.h" - -#if defined(MBEDTLS_PSA_BUILTIN_ALG_JPAKE) -#define MBEDTLS_PSA_BUILTIN_PAKE 1 -#endif - -/* Note: the format for mbedtls_ecjpake_read/write function has an extra - * length byte for each step, plus an extra 3 bytes for ECParameters in the - * server's 2nd round. */ -#define MBEDTLS_PSA_JPAKE_BUFFER_SIZE ((3 + 1 + 65 + 1 + 65 + 1 + 32) * 2) - -typedef struct { - psa_algorithm_t MBEDTLS_PRIVATE(alg); - - uint8_t *MBEDTLS_PRIVATE(password); - size_t MBEDTLS_PRIVATE(password_len); -#if defined(MBEDTLS_PSA_BUILTIN_ALG_JPAKE) - mbedtls_ecjpake_role MBEDTLS_PRIVATE(role); - uint8_t MBEDTLS_PRIVATE(buffer[MBEDTLS_PSA_JPAKE_BUFFER_SIZE]); - size_t MBEDTLS_PRIVATE(buffer_length); - size_t MBEDTLS_PRIVATE(buffer_offset); -#endif - /* Context structure for the Mbed TLS EC-JPAKE implementation. */ - union { - unsigned int MBEDTLS_PRIVATE(dummy); -#if defined(MBEDTLS_PSA_BUILTIN_ALG_JPAKE) - mbedtls_ecjpake_context MBEDTLS_PRIVATE(jpake); -#endif - } MBEDTLS_PRIVATE(ctx); - -} mbedtls_psa_pake_operation_t; - -#define MBEDTLS_PSA_PAKE_OPERATION_INIT { { 0 } } - -typedef struct { -#if defined(MBEDTLS_ECP_C) - mbedtls_ecp_keypair MBEDTLS_PRIVATE(ecp); - uint32_t num_ops; -#else - /* Make the struct non-empty if algs not supported. */ - unsigned MBEDTLS_PRIVATE(dummy); -#endif -} mbedtls_psa_generate_key_iop_t; - -#if defined(MBEDTLS_ECP_C) -#define MBEDTLS_PSA_GENERATE_KEY_IOP_INIT { MBEDTLS_ECP_KEYPAIR_INIT, 0 } -#else -#define MBEDTLS_PSA_GENERATE_KEY_IOP_INIT { 0 } -#endif - -/* Context structure for the Mbed TLS interruptible key agreement implementation. */ -typedef struct { -#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH) && defined(MBEDTLS_ECP_RESTARTABLE) - mbedtls_ecdh_context MBEDTLS_PRIVATE(ctx); - uint32_t MBEDTLS_PRIVATE(num_ops); -#else - /* Make the struct non-empty if algs not supported. */ - unsigned MBEDTLS_PRIVATE(dummy); -#endif -} mbedtls_psa_key_agreement_interruptible_operation_t; - -#if defined(MBEDTLS_PSA_BUILTIN_ALG_ECDH) && defined(MBEDTLS_ECP_RESTARTABLE) -#define MBEDTLS_PSA_KEY_AGREEMENT_IOP_INIT { MBEDTLS_ECDH_CONTEXT_INIT, 0 } -#else -#define MBEDTLS_PSA_KEY_AGREEMENT_IOP_INIT { 0 } -#endif - -/* Context structure for the Mbed TLS interruptible export public-key implementation. */ -typedef struct { -#if defined(MBEDTLS_ECP_C) && defined(MBEDTLS_ECP_RESTARTABLE) - mbedtls_ecp_keypair *MBEDTLS_PRIVATE(key); - mbedtls_ecp_restart_ctx MBEDTLS_PRIVATE(restart_ctx); - uint32_t MBEDTLS_PRIVATE(num_ops); -#else - /* Make the struct non-empty if algs not supported. */ - unsigned MBEDTLS_PRIVATE(dummy); -#endif -} mbedtls_psa_export_public_key_iop_t; - -#if defined(MBEDTLS_ECP_C) && defined(MBEDTLS_ECP_RESTARTABLE) -#define MBEDTLS_PSA_EXPORT_PUBLIC_KEY_IOP_INIT { NULL, MBEDTLS_ECP_RESTART_INIT, 0 } -#else -#define MBEDTLS_PSA_EXPORT_PUBLIC_KEY_IOP_INIT { 0 } -#endif - -#endif /* PSA_CRYPTO_BUILTIN_COMPOSITES_H */ diff --git a/tf-psa-crypto/include/psa/crypto_builtin_primitives.h b/tf-psa-crypto/include/psa/crypto_builtin_primitives.h deleted file mode 100644 index d092604c33..0000000000 --- a/tf-psa-crypto/include/psa/crypto_builtin_primitives.h +++ /dev/null @@ -1,116 +0,0 @@ -/** - * \file crypto_builtin_primitives.h - * - * \brief Context structure declaration of the Mbed TLS software-based PSA - * drivers called through the PSA Crypto driver dispatch layer. This file - * contains the context structures of those algorithms which do not rely on - * other algorithms, i.e. are 'primitive' algorithms. - * - * \note This file may not be included directly. Applications must - * include psa/crypto.h. - * - * \note This header and its content are not part of the Mbed TLS API and - * applications must not depend on it. Its main purpose is to define the - * multi-part state objects of the Mbed TLS software-based PSA drivers. The - * definitions of these objects are then used by crypto_struct.h to define the - * implementation-defined types of PSA multi-part state objects. - */ -/* - * Copyright The Mbed TLS Contributors - * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later - */ - -#ifndef PSA_CRYPTO_BUILTIN_PRIMITIVES_H -#define PSA_CRYPTO_BUILTIN_PRIMITIVES_H -#include "mbedtls/private_access.h" - -#include - -/* - * Hash multi-part operation definitions. - */ - -#include "mbedtls/md5.h" -#include "mbedtls/ripemd160.h" -#include "mbedtls/sha1.h" -#include "mbedtls/sha256.h" -#include "mbedtls/sha512.h" -#include "mbedtls/sha3.h" - -#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD5) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_1) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_224) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_256) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_384) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_512) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_224) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_256) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_384) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_512) -#define MBEDTLS_PSA_BUILTIN_HASH -#endif - -typedef struct { - psa_algorithm_t MBEDTLS_PRIVATE(alg); - union { - unsigned dummy; /* Make the union non-empty even with no supported algorithms. */ -#if defined(MBEDTLS_PSA_BUILTIN_ALG_MD5) - mbedtls_md5_context md5; -#endif -#if defined(MBEDTLS_PSA_BUILTIN_ALG_RIPEMD160) - mbedtls_ripemd160_context ripemd160; -#endif -#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_1) - mbedtls_sha1_context sha1; -#endif -#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_256) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_224) - mbedtls_sha256_context sha256; -#endif -#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_512) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_SHA_384) - mbedtls_sha512_context sha512; -#endif -#if defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_224) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_256) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_384) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_SHA3_512) - mbedtls_sha3_context sha3; -#endif - } MBEDTLS_PRIVATE(ctx); -} mbedtls_psa_hash_operation_t; - -#define MBEDTLS_PSA_HASH_OPERATION_INIT { 0, { 0 } } - -/* - * Cipher multi-part operation definitions. - */ - -#include "mbedtls/cipher.h" - -#if defined(MBEDTLS_PSA_BUILTIN_ALG_STREAM_CIPHER) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_CTR) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_CFB) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_OFB) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_ECB_NO_PADDING) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_CBC_NO_PADDING) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_CBC_PKCS7) || \ - defined(MBEDTLS_PSA_BUILTIN_ALG_CCM_STAR_NO_TAG) -// #define MBEDTLS_PSA_BUILTIN_CIPHER 1 -#endif - -typedef struct { - /* Context structure for the Mbed TLS cipher implementation. */ - psa_algorithm_t MBEDTLS_PRIVATE(alg); - uint8_t MBEDTLS_PRIVATE(iv_length); - uint8_t MBEDTLS_PRIVATE(block_length); - union { - unsigned int MBEDTLS_PRIVATE(dummy); - mbedtls_cipher_context_t MBEDTLS_PRIVATE(cipher); - } MBEDTLS_PRIVATE(ctx); -} mbedtls_psa_cipher_operation_t; - -#define MBEDTLS_PSA_CIPHER_OPERATION_INIT { 0, 0, 0, { 0 } } - -#endif /* PSA_CRYPTO_BUILTIN_PRIMITIVES_H */ diff --git a/tf-psa-crypto/include/psa/crypto_config.h b/tf-psa-crypto/include/psa/crypto_config.h deleted file mode 100644 index 3157812ace..0000000000 --- a/tf-psa-crypto/include/psa/crypto_config.h +++ /dev/null @@ -1,2519 +0,0 @@ -/** - * \file psa/crypto_config.h - * \brief PSA crypto configuration options (set of defines) - * - */ -/** - * This file determines which cryptographic mechanisms are enabled - * through the PSA Cryptography API (\c psa_xxx() functions). - * - * To enable a cryptographic mechanism, uncomment the definition of - * the corresponding \c PSA_WANT_xxx preprocessor symbol. - * To disable a cryptographic mechanism, comment out the definition of - * the corresponding \c PSA_WANT_xxx preprocessor symbol. - * The names of cryptographic mechanisms correspond to values - * defined in psa/crypto_values.h, with the prefix \c PSA_WANT_ instead - * of \c PSA_. - * - * Note that many cryptographic mechanisms involve two symbols: one for - * the key type (\c PSA_WANT_KEY_TYPE_xxx) and one for the algorithm - * (\c PSA_WANT_ALG_xxx). Mechanisms with additional parameters may involve - * additional symbols. - */ - -/* - * Copyright The Mbed TLS Contributors - * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later - */ - -#ifndef PSA_CRYPTO_CONFIG_H -#define PSA_CRYPTO_CONFIG_H - -/** - * \name SECTION: SECTION Cryptographic mechanism selection (PSA API) - * - * This section sets PSA API settings. - * \{ - */ - -#define PSA_WANT_ALG_CBC_NO_PADDING 1 -#define PSA_WANT_ALG_CBC_PKCS7 1 -#define PSA_WANT_ALG_CCM 1 -#define PSA_WANT_ALG_CCM_STAR_NO_TAG 1 -#define PSA_WANT_ALG_CMAC 1 -#define PSA_WANT_ALG_CFB 1 -#define PSA_WANT_ALG_CHACHA20_POLY1305 1 -#define PSA_WANT_ALG_CTR 1 -#define PSA_WANT_ALG_DETERMINISTIC_ECDSA 1 -#define PSA_WANT_ALG_ECB_NO_PADDING 1 -#define PSA_WANT_ALG_ECDH 1 -#define PSA_WANT_ALG_FFDH 1 -#define PSA_WANT_ALG_ECDSA 1 -#define PSA_WANT_ALG_JPAKE 1 -#define PSA_WANT_ALG_GCM 1 -#define PSA_WANT_ALG_HKDF 1 -#define PSA_WANT_ALG_HKDF_EXTRACT 1 -#define PSA_WANT_ALG_HKDF_EXPAND 1 -#define PSA_WANT_ALG_HMAC 1 -#define PSA_WANT_ALG_MD5 1 -#define PSA_WANT_ALG_OFB 1 -#define PSA_WANT_ALG_PBKDF2_HMAC 1 -#define PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128 1 -#define PSA_WANT_ALG_RIPEMD160 1 -#define PSA_WANT_ALG_RSA_OAEP 1 -#define PSA_WANT_ALG_RSA_PKCS1V15_CRYPT 1 -#define PSA_WANT_ALG_RSA_PKCS1V15_SIGN 1 -#define PSA_WANT_ALG_RSA_PSS 1 -#define PSA_WANT_ALG_SHA_1 1 -#define PSA_WANT_ALG_SHA_224 1 -#define PSA_WANT_ALG_SHA_256 1 -#define PSA_WANT_ALG_SHA_384 1 -#define PSA_WANT_ALG_SHA_512 1 -#define PSA_WANT_ALG_SHA3_224 1 -#define PSA_WANT_ALG_SHA3_256 1 -#define PSA_WANT_ALG_SHA3_384 1 -#define PSA_WANT_ALG_SHA3_512 1 -#define PSA_WANT_ALG_STREAM_CIPHER 1 -#define PSA_WANT_ALG_TLS12_PRF 1 -#define PSA_WANT_ALG_TLS12_PSK_TO_MS 1 -#define PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS 1 - -#define PSA_WANT_ECC_BRAINPOOL_P_R1_256 1 -#define PSA_WANT_ECC_BRAINPOOL_P_R1_384 1 -#define PSA_WANT_ECC_BRAINPOOL_P_R1_512 1 -#define PSA_WANT_ECC_MONTGOMERY_255 1 -#define PSA_WANT_ECC_MONTGOMERY_448 1 -#define PSA_WANT_ECC_SECP_K1_192 1 -#define PSA_WANT_ECC_SECP_K1_256 1 -#define PSA_WANT_ECC_SECP_R1_192 1 -#define PSA_WANT_ECC_SECP_R1_224 1 -/* For secp256r1, consider enabling #MBEDTLS_PSA_P256M_DRIVER_ENABLED - * (see the description in mbedtls/mbedtls_config.h for details). */ -#define PSA_WANT_ECC_SECP_R1_256 1 -#define PSA_WANT_ECC_SECP_R1_384 1 -#define PSA_WANT_ECC_SECP_R1_521 1 - -#define PSA_WANT_DH_RFC7919_2048 1 -#define PSA_WANT_DH_RFC7919_3072 1 -#define PSA_WANT_DH_RFC7919_4096 1 -#define PSA_WANT_DH_RFC7919_6144 1 -#define PSA_WANT_DH_RFC7919_8192 1 - -#define PSA_WANT_KEY_TYPE_DERIVE 1 -#define PSA_WANT_KEY_TYPE_PASSWORD 1 -#define PSA_WANT_KEY_TYPE_PASSWORD_HASH 1 -#define PSA_WANT_KEY_TYPE_HMAC 1 -#define PSA_WANT_KEY_TYPE_AES 1 -#define PSA_WANT_KEY_TYPE_ARIA 1 -#define PSA_WANT_KEY_TYPE_CAMELLIA 1 -#define PSA_WANT_KEY_TYPE_CHACHA20 1 -// #define PSA_WANT_KEY_TYPE_DES 1 -//#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR 1 /* Deprecated */ -#define PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY 1 -#define PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY 1 -#define PSA_WANT_KEY_TYPE_RAW_DATA 1 -//#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR 1 /* Deprecated */ -#define PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY 1 - -/* - * The following symbols extend and deprecate the legacy - * PSA_WANT_KEY_TYPE_xxx_KEY_PAIR ones. They include the usage of that key in - * the name's suffix. "_USE" is the most generic and it can be used to describe - * a generic suport, whereas other ones add more features on top of that and - * they are more specific. - */ -#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC 1 -#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT 1 -#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT 1 -#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE 1 -#define PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE 1 - -#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_BASIC 1 -#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT 1 -#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT 1 -#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE 1 -//#define PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_DERIVE 1 /* Not supported */ - -#define PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC 1 -#define PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT 1 -#define PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT 1 -#define PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE 1 -//#define PSA_WANT_KEY_TYPE_DH_KEY_PAIR_DERIVE 1 /* Not supported */ -/** \} name SECTION Cryptographic mechanism selection (PSA API) */ - -/** - * \name SECTION: Platform abstraction layer - * - * This section sets platform specific settings. - * \{ - */ - -/** - * \def MBEDTLS_MEMORY_BUFFER_ALLOC_C - * - * Enable the buffer allocator implementation that makes use of a (stack) - * based buffer to 'allocate' dynamic memory. (replaces calloc() and free() - * calls) - * - * Module: library/memory_buffer_alloc.c - * - * Requires: MBEDTLS_PLATFORM_C - * MBEDTLS_PLATFORM_MEMORY (to use it within Mbed TLS) - * - * Enable this module to enable the buffer memory allocator. - */ -//#define MBEDTLS_MEMORY_BUFFER_ALLOC_C - -/** - * \def MBEDTLS_FS_IO - * - * Enable functions that use the filesystem. - */ -#define MBEDTLS_FS_IO - -/** - * \def MBEDTLS_HAVE_TIME - * - * System has time.h and time(). - * The time does not need to be correct, only time differences are used, - * by contrast with MBEDTLS_HAVE_TIME_DATE - * - * Defining MBEDTLS_HAVE_TIME allows you to specify MBEDTLS_PLATFORM_TIME_ALT, - * MBEDTLS_PLATFORM_TIME_MACRO, MBEDTLS_PLATFORM_TIME_TYPE_MACRO and - * MBEDTLS_PLATFORM_STD_TIME. - * - * Comment if your system does not support time functions. - */ -#define MBEDTLS_HAVE_TIME - -/** - * \def MBEDTLS_HAVE_TIME_DATE - * - * System has time.h, time(), and an implementation for - * mbedtls_platform_gmtime_r() (see below). - * The time needs to be correct (not necessarily very accurate, but at least - * the date should be correct). This is used to verify the validity period of - * X.509 certificates. - * - * Comment if your system does not have a correct clock. - * - * \note mbedtls_platform_gmtime_r() is an abstraction in platform_util.h that - * behaves similarly to the gmtime_r() function from the C standard. Refer to - * the documentation for mbedtls_platform_gmtime_r() for more information. - * - * \note It is possible to configure an implementation for - * mbedtls_platform_gmtime_r() at compile-time by using the macro - * MBEDTLS_PLATFORM_GMTIME_R_ALT. - */ -#define MBEDTLS_HAVE_TIME_DATE - -/** - * \def MBEDTLS_MEMORY_DEBUG - * - * Enable debugging of buffer allocator memory issues. Automatically prints - * (to stderr) all (fatal) messages on memory allocation issues. Enables - * function for 'debug output' of allocated memory. - * - * Requires: MBEDTLS_MEMORY_BUFFER_ALLOC_C - * - * Uncomment this macro to let the buffer allocator print out error messages. - */ -//#define MBEDTLS_MEMORY_DEBUG - -/** - * \def MBEDTLS_MEMORY_BACKTRACE - * - * Include backtrace information with each allocated block. - * - * Requires: MBEDTLS_MEMORY_BUFFER_ALLOC_C - * GLIBC-compatible backtrace() and backtrace_symbols() support - * - * Uncomment this macro to include backtrace information - */ -//#define MBEDTLS_MEMORY_BACKTRACE - -/** - * \def MBEDTLS_PLATFORM_C - * - * Enable the platform abstraction layer that allows you to re-assign - * functions like calloc(), free(), snprintf(), printf(), fprintf(), exit(). - * - * Enabling MBEDTLS_PLATFORM_C enables to use of MBEDTLS_PLATFORM_XXX_ALT - * or MBEDTLS_PLATFORM_XXX_MACRO directives, allowing the functions mentioned - * above to be specified at runtime or compile time respectively. - * - * \note This abstraction layer must be enabled on Windows (including MSYS2) - * as other modules rely on it for a fixed snprintf implementation. - * - * Module: library/platform.c - * Caller: Most other .c files - * - * This module enables abstraction of common (libc) functions. - */ -#define MBEDTLS_PLATFORM_C - -/** - * \def MBEDTLS_PLATFORM_EXIT_ALT - * - * MBEDTLS_PLATFORM_XXX_ALT: Uncomment a macro to let Mbed TLS support the - * function in the platform abstraction layer. - * - * Example: In case you uncomment MBEDTLS_PLATFORM_PRINTF_ALT, Mbed TLS will - * provide a function "mbedtls_platform_set_printf()" that allows you to set an - * alternative printf function pointer. - * - * All these define require MBEDTLS_PLATFORM_C to be defined! - * - * \note MBEDTLS_PLATFORM_SNPRINTF_ALT is required on Windows; - * it will be enabled automatically by check_config.h - * - * \warning MBEDTLS_PLATFORM_XXX_ALT cannot be defined at the same time as - * MBEDTLS_PLATFORM_XXX_MACRO! - * - * Requires: MBEDTLS_PLATFORM_TIME_ALT requires MBEDTLS_HAVE_TIME - * - * Uncomment a macro to enable alternate implementation of specific base - * platform function - */ -//#define MBEDTLS_PLATFORM_SETBUF_ALT -//#define MBEDTLS_PLATFORM_EXIT_ALT -//#define MBEDTLS_PLATFORM_TIME_ALT -//#define MBEDTLS_PLATFORM_FPRINTF_ALT -//#define MBEDTLS_PLATFORM_PRINTF_ALT -//#define MBEDTLS_PLATFORM_SNPRINTF_ALT -//#define MBEDTLS_PLATFORM_VSNPRINTF_ALT -//#define MBEDTLS_PLATFORM_NV_SEED_ALT -//#define MBEDTLS_PLATFORM_SETUP_TEARDOWN_ALT -#define MBEDTLS_PLATFORM_MS_TIME_ALT - -/** - * Uncomment the macro to let Mbed TLS use your alternate implementation of - * mbedtls_platform_gmtime_r(). This replaces the default implementation in - * platform_util.c. - * - * gmtime() is not a thread-safe function as defined in the C standard. The - * library will try to use safer implementations of this function, such as - * gmtime_r() when available. However, if Mbed TLS cannot identify the target - * system, the implementation of mbedtls_platform_gmtime_r() will default to - * using the standard gmtime(). In this case, calls from the library to - * gmtime() will be guarded by the global mutex mbedtls_threading_gmtime_mutex - * if MBEDTLS_THREADING_C is enabled. We recommend that calls from outside the - * library are also guarded with this mutex to avoid race conditions. However, - * if the macro MBEDTLS_PLATFORM_GMTIME_R_ALT is defined, Mbed TLS will - * unconditionally use the implementation for mbedtls_platform_gmtime_r() - * supplied at compile time. - */ -//#define MBEDTLS_PLATFORM_GMTIME_R_ALT - -/** - * \def MBEDTLS_PLATFORM_MEMORY - * - * Enable the memory allocation layer. - * - * By default Mbed TLS uses the system-provided calloc() and free(). - * This allows different allocators (self-implemented or provided) to be - * provided to the platform abstraction layer. - * - * Enabling #MBEDTLS_PLATFORM_MEMORY without the - * MBEDTLS_PLATFORM_{FREE,CALLOC}_MACROs will provide - * "mbedtls_platform_set_calloc_free()" allowing you to set an alternative calloc() and - * free() function pointer at runtime. - * - * Enabling #MBEDTLS_PLATFORM_MEMORY and specifying - * MBEDTLS_PLATFORM_{CALLOC,FREE}_MACROs will allow you to specify the - * alternate function at compile time. - * - * An overview of how the value of mbedtls_calloc is determined: - * - * - if !MBEDTLS_PLATFORM_MEMORY - * - mbedtls_calloc = calloc - * - if MBEDTLS_PLATFORM_MEMORY - * - if (MBEDTLS_PLATFORM_CALLOC_MACRO && MBEDTLS_PLATFORM_FREE_MACRO): - * - mbedtls_calloc = MBEDTLS_PLATFORM_CALLOC_MACRO - * - if !(MBEDTLS_PLATFORM_CALLOC_MACRO && MBEDTLS_PLATFORM_FREE_MACRO): - * - Dynamic setup via mbedtls_platform_set_calloc_free is now possible with a default value MBEDTLS_PLATFORM_STD_CALLOC. - * - How is MBEDTLS_PLATFORM_STD_CALLOC handled? - * - if MBEDTLS_PLATFORM_NO_STD_FUNCTIONS: - * - MBEDTLS_PLATFORM_STD_CALLOC is not set to anything; - * - MBEDTLS_PLATFORM_STD_MEM_HDR can be included if present; - * - if !MBEDTLS_PLATFORM_NO_STD_FUNCTIONS: - * - if MBEDTLS_PLATFORM_STD_CALLOC is present: - * - User-defined MBEDTLS_PLATFORM_STD_CALLOC is respected; - * - if !MBEDTLS_PLATFORM_STD_CALLOC: - * - MBEDTLS_PLATFORM_STD_CALLOC = calloc - * - * - At this point the presence of MBEDTLS_PLATFORM_STD_CALLOC is checked. - * - if !MBEDTLS_PLATFORM_STD_CALLOC - * - MBEDTLS_PLATFORM_STD_CALLOC = uninitialized_calloc - * - * - mbedtls_calloc = MBEDTLS_PLATFORM_STD_CALLOC. - * - * Defining MBEDTLS_PLATFORM_CALLOC_MACRO and #MBEDTLS_PLATFORM_STD_CALLOC at the same time is not possible. - * MBEDTLS_PLATFORM_CALLOC_MACRO and MBEDTLS_PLATFORM_FREE_MACRO must both be defined or undefined at the same time. - * #MBEDTLS_PLATFORM_STD_CALLOC and #MBEDTLS_PLATFORM_STD_FREE do not have to be defined at the same time, as, if they are used, - * dynamic setup of these functions is possible. See the tree above to see how are they handled in all cases. - * An uninitialized #MBEDTLS_PLATFORM_STD_CALLOC always fails, returning a null pointer. - * An uninitialized #MBEDTLS_PLATFORM_STD_FREE does not do anything. - * - * Requires: MBEDTLS_PLATFORM_C - * - * Enable this layer to allow use of alternative memory allocators. - */ -#define MBEDTLS_PLATFORM_MEMORY - -/** - * \def MBEDTLS_PLATFORM_NO_STD_FUNCTIONS - * - * Do not assign standard functions in the platform layer (e.g. calloc() to - * MBEDTLS_PLATFORM_STD_CALLOC and printf() to MBEDTLS_PLATFORM_STD_PRINTF) - * - * This makes sure there are no linking errors on platforms that do not support - * these functions. You will HAVE to provide alternatives, either at runtime - * via the platform_set_xxx() functions or at compile time by setting - * the MBEDTLS_PLATFORM_STD_XXX defines, or enabling a - * MBEDTLS_PLATFORM_XXX_MACRO. - * - * Requires: MBEDTLS_PLATFORM_C - * - * Uncomment to prevent default assignment of standard functions in the - * platform layer. - */ -//#define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS - -/** - * Uncomment the macro to let Mbed TLS use your alternate implementation of - * mbedtls_platform_zeroize(), to wipe sensitive data in memory. This replaces - * the default implementation in platform_util.c. - * - * By default, the library uses a system function such as memset_s() - * (optional feature of C11), explicit_bzero() (BSD and compatible), or - * SecureZeroMemory (Windows). If no such function is detected, the library - * falls back to a plain C implementation. Compilers are technically - * permitted to optimize this implementation out, meaning that the memory is - * not actually wiped. The library tries to prevent that, but the C language - * makes it impossible to guarantee that the memory will always be wiped. - * - * If your platform provides a guaranteed method to wipe memory which - * `platform_util.c` does not detect, define this macro to the name of - * a function that takes two arguments, a `void *` pointer and a length, - * and wipes that many bytes starting at the specified address. For example, - * if your platform has explicit_bzero() but `platform_util.c` does not - * detect its presence, define `MBEDTLS_PLATFORM_ZEROIZE_ALT` to be - * `explicit_bzero` to use that function as mbedtls_platform_zeroize(). - */ -//#define MBEDTLS_PLATFORM_ZEROIZE_ALT - -/** - * \def MBEDTLS_THREADING_ALT - * - * Provide your own alternate threading implementation. - * - * Requires: MBEDTLS_THREADING_C - * - * Uncomment this to allow your own alternate threading implementation. - */ -//#define MBEDTLS_THREADING_ALT - -/** - * \def MBEDTLS_THREADING_PTHREAD - * - * Enable the pthread wrapper layer for the threading layer. - * - * Requires: MBEDTLS_THREADING_C - * - * Uncomment this to enable pthread mutexes. - */ -//#define MBEDTLS_THREADING_PTHREAD - -/** - * \def MBEDTLS_THREADING_C - * - * Enable the threading abstraction layer. - * - * \note You must enable this option if TF-PSA-Crypto runs in a - * multithreaded environment. Otherwise the PSA cryptography subsystem is - * not thread-safe. As an exception, this option can be disabled if all - * PSA crypto functions are ever called from a single thread. Note that - * this includes indirect calls, for example through PK. - * - * Module: library/threading.c - * - * This allows different threading implementations (self-implemented or - * provided). - * - * You will have to enable either MBEDTLS_THREADING_ALT or - * MBEDTLS_THREADING_PTHREAD. - * - * Enable this layer to allow use of mutexes within Mbed TLS - */ -//#define MBEDTLS_THREADING_C - -/* Memory buffer allocator options */ -//#define MBEDTLS_MEMORY_ALIGN_MULTIPLE 4 /**< Align on multiples of this value */ - -/* To use the following function macros, MBEDTLS_PLATFORM_C must be enabled. */ -/* MBEDTLS_PLATFORM_XXX_MACRO and MBEDTLS_PLATFORM_XXX_ALT cannot both be defined */ -// #define MBEDTLS_PLATFORM_CALLOC_MACRO calloc /**< Default allocator macro to use, can be undefined. See MBEDTLS_PLATFORM_STD_CALLOC for requirements. */ -//#define MBEDTLS_PLATFORM_EXIT_MACRO exit /**< Default exit macro to use, can be undefined */ -// #define MBEDTLS_PLATFORM_FREE_MACRO free /**< Default free macro to use, can be undefined. See MBEDTLS_PLATFORM_STD_FREE for requirements. */ -//#define MBEDTLS_PLATFORM_FPRINTF_MACRO fprintf /**< Default fprintf macro to use, can be undefined */ -//#define MBEDTLS_PLATFORM_MS_TIME_TYPE_MACRO int64_t //#define MBEDTLS_PLATFORM_MS_TIME_TYPE_MACRO int64_t /**< Default milliseconds time macro to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled. It must be signed, and at least 64 bits. If it is changed from the default, MBEDTLS_PRINTF_MS_TIME must be updated to match.*/ -//#define MBEDTLS_PLATFORM_NV_SEED_READ_MACRO mbedtls_platform_std_nv_seed_read /**< Default nv_seed_read function to use, can be undefined */ -//#define MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO mbedtls_platform_std_nv_seed_write /**< Default nv_seed_write function to use, can be undefined */ -//#define MBEDTLS_PLATFORM_PRINTF_MACRO printf /**< Default printf macro to use, can be undefined */ -//#define MBEDTLS_PLATFORM_SETBUF_MACRO setbuf /**< Default setbuf macro to use, can be undefined */ -/* Note: your snprintf must correctly zero-terminate the buffer! */ -//#define MBEDTLS_PLATFORM_SNPRINTF_MACRO snprintf /**< Default snprintf macro to use, can be undefined */ - -/** \def MBEDTLS_PLATFORM_STD_CALLOC - * - * Default allocator to use, can be undefined. - * It must initialize the allocated buffer memory to zeroes. - * The size of the buffer is the product of the two parameters. - * The calloc function returns either a null pointer or a pointer to the allocated space. - * If the product is 0, the function may either return NULL or a valid pointer to an array of size 0 which is a valid input to the deallocation function. - * An uninitialized #MBEDTLS_PLATFORM_STD_CALLOC always fails, returning a null pointer. - * See the description of #MBEDTLS_PLATFORM_MEMORY for more details. - * The corresponding deallocation function is #MBEDTLS_PLATFORM_STD_FREE. - */ -//#define MBEDTLS_PLATFORM_STD_CALLOC calloc - -//#define MBEDTLS_PLATFORM_STD_EXIT exit /**< Default exit to use, can be undefined */ -//#define MBEDTLS_PLATFORM_STD_EXIT_FAILURE 1 /**< Default exit value to use, can be undefined */ -//#define MBEDTLS_PLATFORM_STD_EXIT_SUCCESS 0 /**< Default exit value to use, can be undefined */ -//#define MBEDTLS_PLATFORM_STD_FPRINTF fprintf /**< Default fprintf to use, can be undefined */ - -/** \def MBEDTLS_PLATFORM_STD_FREE - * - * Default free to use, can be undefined. - * NULL is a valid parameter, and the function must do nothing. - * A non-null parameter will always be a pointer previously returned by #MBEDTLS_PLATFORM_STD_CALLOC and not yet freed. - * An uninitialized #MBEDTLS_PLATFORM_STD_FREE does not do anything. - * See the description of #MBEDTLS_PLATFORM_MEMORY for more details (same principles as for MBEDTLS_PLATFORM_STD_CALLOC apply). - */ -//#define MBEDTLS_PLATFORM_STD_FREE free - -//#define MBEDTLS_PLATFORM_STD_MEM_HDR /**< Header to include if MBEDTLS_PLATFORM_NO_STD_FUNCTIONS is defined. Don't define if no header is needed. */ -//#define MBEDTLS_PLATFORM_STD_NV_SEED_FILE "seedfile" /**< Seed file to read/write with default implementation */ -//#define MBEDTLS_PLATFORM_STD_NV_SEED_READ mbedtls_platform_std_nv_seed_read /**< Default nv_seed_read function to use, can be undefined */ -//#define MBEDTLS_PLATFORM_STD_NV_SEED_WRITE mbedtls_platform_std_nv_seed_write /**< Default nv_seed_write function to use, can be undefined */ -//#define MBEDTLS_PLATFORM_STD_PRINTF printf /**< Default printf to use, can be undefined */ -//#define MBEDTLS_PLATFORM_STD_SETBUF setbuf /**< Default setbuf to use, can be undefined */ -/* Note: your snprintf must correctly zero-terminate the buffer! */ -//#define MBEDTLS_PLATFORM_STD_SNPRINTF snprintf /**< Default snprintf to use, can be undefined */ -//#define MBEDTLS_PLATFORM_STD_TIME time /**< Default time to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */ -//#define MBEDTLS_PLATFORM_TIME_MACRO time /**< Default time macro to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */ -//#define MBEDTLS_PLATFORM_TIME_TYPE_MACRO time_t /**< Default time macro to use, can be undefined. MBEDTLS_HAVE_TIME must be enabled */ -//#define MBEDTLS_PLATFORM_VSNPRINTF_MACRO vsnprintf /**< Default vsnprintf macro to use, can be undefined */ -//#define MBEDTLS_PRINTF_MS_TIME PRId64 /**< Default fmt for printf. That's avoid compiler warning if mbedtls_ms_time_t is redefined */ - -/** \} name SECTION: Platform abstraction layer */ - -/** - * \name SECTION: General and test configuration options - * - * This section sets test specific settings. - * \{ - */ - -/** - * \def MBEDTLS_CHECK_RETURN_WARNING - * - * If this macro is defined, emit a compile-time warning if application code - * calls a function without checking its return value, but the return value - * should generally be checked in portable applications. - * - * This is only supported on platforms where #MBEDTLS_CHECK_RETURN is - * implemented. Otherwise this option has no effect. - * - * Uncomment to get warnings on using fallible functions without checking - * their return value. - * - * \note This feature is a work in progress. - * Warnings will be added to more functions in the future. - * - * \note A few functions are considered critical, and ignoring the return - * value of these functions will trigger a warning even if this - * macro is not defined. To completely disable return value check - * warnings, define #MBEDTLS_CHECK_RETURN with an empty expansion. - */ -//#define MBEDTLS_CHECK_RETURN_WARNING - -/** - * \def MBEDTLS_DEPRECATED_WARNING - * - * Mark deprecated functions and features so that they generate a warning if - * used. Functionality deprecated in one version will usually be removed in the - * next version. You can enable this to help you prepare the transition to a - * new major version by making sure your code is not using this functionality. - * - * This only works with GCC and Clang. With other compilers, you may want to - * use MBEDTLS_DEPRECATED_REMOVED - * - * Uncomment to get warnings on using deprecated functions and features. - */ -//#define MBEDTLS_DEPRECATED_WARNING - -/** - * \def MBEDTLS_DEPRECATED_REMOVED - * - * Remove deprecated functions and features so that they generate an error if - * used. Functionality deprecated in one version will usually be removed in the - * next version. You can enable this to help you prepare the transition to a - * new major version by making sure your code is not using this functionality. - * - * Uncomment to get errors on using deprecated functions and features. - */ -//#define MBEDTLS_DEPRECATED_REMOVED - -/** \def MBEDTLS_CHECK_RETURN - * - * This macro is used at the beginning of the declaration of a function - * to indicate that its return value should be checked. It should - * instruct the compiler to emit a warning or an error if the function - * is called without checking its return value. - * - * There is a default implementation for popular compilers in platform_util.h. - * You can override the default implementation by defining your own here. - * - * If the implementation here is empty, this will effectively disable the - * checking of functions' return values. - */ -//#define MBEDTLS_CHECK_RETURN __attribute__((__warn_unused_result__)) - -/** \def MBEDTLS_IGNORE_RETURN - * - * This macro requires one argument, which should be a C function call. - * If that function call would cause a #MBEDTLS_CHECK_RETURN warning, this - * warning is suppressed. - */ -//#define MBEDTLS_IGNORE_RETURN( result ) ((void) !(result)) - -/** - * \def TF_PSA_CRYPTO_CONFIG_FILE - * - * If defined, this is a header which will be included instead of - * `"psa/crypto_config.h"`. - * This header file specifies which cryptographic mechanisms are available - * through the PSA API. - * - * This macro is expanded after an \#include directive. This is a popular but - * non-standard feature of the C language, so this feature is only available - * with compilers that perform macro expansion on an \#include line. - * - * The value of this symbol is typically a path in double quotes, either - * absolute or relative to a directory on the include search path. - */ -//#define TF_PSA_CRYPTO_CONFIG_FILE "psa/crypto_config.h" - -/** - * \def TF_PSA_CRYPTO_USER_CONFIG_FILE - * - * If defined, this is a header which will be included after - * `"psa/crypto_config.h"` or #TF_PSA_CRYPTO_CONFIG_FILE. - * This allows you to modify the default configuration, including the ability - * to undefine options that are enabled by default. - * - * This macro is expanded after an \#include directive. This is a popular but - * non-standard feature of the C language, so this feature is only available - * with compilers that perform macro expansion on an \#include line. - * - * The value of this symbol is typically a path in double quotes, either - * absolute or relative to a directory on the include search path. - */ -//#define TF_PSA_CRYPTO_USER_CONFIG_FILE "/dev/null" - -/** - * \def MBEDTLS_SELF_TEST - * - * Enable the checkup functions (*_self_test). - */ -#define MBEDTLS_SELF_TEST - -/** - * \def MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN - * - * Enable testing of the constant-flow nature of some sensitive functions with - * clang's MemorySanitizer. This causes some existing tests to also test - * this non-functional property of the code under test. - * - * This setting requires compiling with clang -fsanitize=memory. The test - * suites can then be run normally. - * - * \warning This macro is only used for extended testing; it is not considered - * part of the library's API, so it may change or disappear at any time. - * - * Uncomment to enable testing of the constant-flow nature of selected code. - */ -//#define MBEDTLS_TEST_CONSTANT_FLOW_MEMSAN - -/** - * \def MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND - * - * Enable testing of the constant-flow nature of some sensitive functions with - * valgrind's memcheck tool. This causes some existing tests to also test - * this non-functional property of the code under test. - * - * This setting requires valgrind headers for building, and is only useful for - * testing if the tests suites are run with valgrind's memcheck. This can be - * done for an individual test suite with 'valgrind ./test_suite_xxx', or when - * using CMake, this can be done for all test suites with 'make memcheck'. - * - * \warning This macro is only used for extended testing; it is not considered - * part of the library's API, so it may change or disappear at any time. - * - * Uncomment to enable testing of the constant-flow nature of selected code. - */ -//#define MBEDTLS_TEST_CONSTANT_FLOW_VALGRIND - -/** - * \def MBEDTLS_TEST_HOOKS - * - * Enable features for invasive testing such as introspection functions and - * hooks for fault injection. This enables additional unit tests. - * - * Merely enabling this feature should not change the behavior of the product. - * It only adds new code, and new branching points where the default behavior - * is the same as when this feature is disabled. - * However, this feature increases the attack surface: there is an added - * risk of vulnerabilities, and more gadgets that can make exploits easier. - * Therefore this feature must never be enabled in production. - * - * See `docs/architecture/testing/mbed-crypto-invasive-testing.md` for more - * information. - * - * Uncomment to enable invasive tests. - */ -//#define MBEDTLS_TEST_HOOKS - -/** \} name SECTION: General and test configuration options */ - -/** - * \name SECTION: Cryptographic mechanism selection (extended API) - * - * This section sets cryptographic mechanism settings. - * \{ - */ - -/** - * \def MBEDTLS_LMS_C - * - * Enable the LMS stateful-hash asymmetric signature algorithm. - * - * Module: library/lms.c - * Caller: - * - * Requires: MBEDTLS_PSA_CRYPTO_C - * - * Uncomment to enable the LMS verification algorithm and public key operations. - */ -#define MBEDTLS_LMS_C - -/** - * \def MBEDTLS_LMS_PRIVATE - * - * Enable LMS private-key operations and signing code. Functions enabled by this - * option are experimental, and should not be used in production. - * - * Requires: MBEDTLS_LMS_C - * - * Uncomment to enable the LMS signature algorithm and private key operations. - */ -//#define MBEDTLS_LMS_PRIVATE - -/** - * \def MBEDTLS_MD_C - * - * Enable the generic layer for message digest (hashing) and HMAC. - * - * Requires: one of: MBEDTLS_MD5_C, MBEDTLS_RIPEMD160_C, MBEDTLS_SHA1_C, - * MBEDTLS_SHA224_C, MBEDTLS_SHA256_C, MBEDTLS_SHA384_C, - * MBEDTLS_SHA512_C, or MBEDTLS_PSA_CRYPTO_C with at least - * one hash. - * Module: library/md.c - * Caller: library/constant_time.c - * library/ecdsa.c - * library/ecjpake.c - * library/hkdf.c - * library/hmac_drbg.c - * library/pk.c - * library/pkcs5.c - * library/pkcs12.c - * library/psa_crypto_ecp.c - * library/psa_crypto_rsa.c - * library/rsa.c - * library/ssl_cookie.c - * library/ssl_msg.c - * library/ssl_tls.c - * library/x509.c - * library/x509_crt.c - * library/x509write_crt.c - * library/x509write_csr.c - * - * Uncomment to enable generic message digest wrappers. - */ -#define MBEDTLS_MD_C - -/** - * \def MBEDTLS_NIST_KW_C - * - * Enable the 128-bit key wrapping modes from NIST SP 800-38F: - * KW (also known as RFC 3394) and KWP (RFC 5649). - * Currently these modes are only supported with AES. - * - * Module: library/nist_kw.c - * - * Auto enables: PSA_WANT_ALG_ECB_NO_PADDING - */ -#define MBEDTLS_NIST_KW_C - -/** - * \def MBEDTLS_PK_C - * - * Enable the generic public (asymmetric) key layer. - * - * Module: library/pk.c - * Caller: library/psa_crypto_rsa.c - * library/ssl_tls.c - * library/ssl*_client.c - * library/ssl*_server.c - * library/x509.c - * - * Requires: MBEDTLS_MD_C, MBEDTLS_RSA_C or MBEDTLS_ECP_C - * - * Uncomment to enable generic public key wrappers. - */ -#define MBEDTLS_PK_C - -/** - * \def MBEDTLS_PKCS5_C - * - * Enable PKCS#5 functions. - * - * Module: library/pkcs5.c - * - * Auto-enables: MBEDTLS_MD_C - * - * \warning If using a hash that is only provided by PSA drivers, you must - * call psa_crypto_init() before doing any PKCS5 operations. - * - * This module adds support for the PKCS#5 functions. - */ -#define MBEDTLS_PKCS5_C - -/** - * \def MBEDTLS_PKCS12_C - * - * Enable PKCS#12 PBE functions. - * Adds algorithms for parsing PKCS#8 encrypted private keys - * - * Module: library/pkcs12.c - * Caller: library/pkparse.c - * - * Requires: MBEDTLS_ASN1_PARSE_C and either MBEDTLS_MD_C or - * MBEDTLS_PSA_CRYPTO_C. - * - * \warning If using a hash that is only provided by PSA drivers, you must - * call psa_crypto_init() before doing any PKCS12 operations. - * - * This module enables PKCS#12 functions. - */ -#define MBEDTLS_PKCS12_C - -/** - * \def MBEDTLS_PK_PARSE_C - * - * Enable the generic public (asymmetric) key parser. - * - * Module: library/pkparse.c - * Caller: library/x509_crt.c - * library/x509_csr.c - * - * Requires: MBEDTLS_ASN1_PARSE_C, MBEDTLS_PK_C - * - * Uncomment to enable generic public key parse functions. - */ -#define MBEDTLS_PK_PARSE_C - -/** - * \def MBEDTLS_PK_PARSE_EC_EXTENDED - * - * Enhance support for reading EC keys using variants of SEC1 not allowed by - * RFC 5915 and RFC 5480. - * - * Currently this means parsing the SpecifiedECDomain choice of EC - * parameters (only known groups are supported, not arbitrary domains, to - * avoid validation issues). - * - * Disable if you only need to support RFC 5915 + 5480 key formats. - */ -#define MBEDTLS_PK_PARSE_EC_EXTENDED - -/** - * \def MBEDTLS_PK_PARSE_EC_COMPRESSED - * - * Enable the support for parsing public keys of type Short Weierstrass - * (MBEDTLS_ECP_DP_SECP_XXX and MBEDTLS_ECP_DP_BP_XXX) which are using the - * compressed point format. This parsing is done through ECP module's functions. - * - * \note As explained in the description of MBEDTLS_ECP_PF_COMPRESSED (in ecp.h) - * the only unsupported curves are MBEDTLS_ECP_DP_SECP224R1 and - * MBEDTLS_ECP_DP_SECP224K1. - */ -#define MBEDTLS_PK_PARSE_EC_COMPRESSED - -/** - * \def MBEDTLS_PK_WRITE_C - * - * Enable the generic public (asymmetric) key writer. - * - * Module: library/pkwrite.c - * Caller: library/x509write.c - * - * Requires: MBEDTLS_ASN1_WRITE_C, MBEDTLS_PK_C - * - * Uncomment to enable generic public key write functions. - */ -#define MBEDTLS_PK_WRITE_C - -/* CTR_DRBG options */ -//#define MBEDTLS_CTR_DRBG_ENTROPY_LEN 48 /**< Amount of entropy used per seed by default (48 with SHA-512, 32 with SHA-256) */ -//#define MBEDTLS_CTR_DRBG_MAX_INPUT 256 /**< Maximum number of additional input bytes */ -//#define MBEDTLS_CTR_DRBG_MAX_REQUEST 1024 /**< Maximum number of requested bytes per call */ -//#define MBEDTLS_CTR_DRBG_MAX_SEED_INPUT 384 /**< Maximum size of (re)seed buffer */ -//#define MBEDTLS_CTR_DRBG_RESEED_INTERVAL 10000 /**< Interval before reseed is performed by default */ - -/* HMAC_DRBG options */ -//#define MBEDTLS_HMAC_DRBG_MAX_INPUT 256 /**< Maximum number of additional input bytes */ -//#define MBEDTLS_HMAC_DRBG_MAX_REQUEST 1024 /**< Maximum number of requested bytes per call */ -//#define MBEDTLS_HMAC_DRBG_MAX_SEED_INPUT 384 /**< Maximum size of (re)seed buffer */ -//#define MBEDTLS_HMAC_DRBG_RESEED_INTERVAL 10000 /**< Interval before reseed is performed by default */ - -/* PSA options */ -/** - * Use HMAC_DRBG with the specified hash algorithm for HMAC_DRBG for the - * PSA crypto subsystem. - * - * If this option is unset, the library chooses a hash (currently between - * SHA512 and SHA256) based on availability and unspecified heuristics. - * - * \note The PSA crypto subsystem uses the first available mechanism amongst - * the following: - * - #MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG if enabled; - * - Entropy from #MBEDTLS_ENTROPY_C plus CTR_DRBG with AES - * if #MBEDTLS_CTR_DRBG_C is enabled; - * - Entropy from #MBEDTLS_ENTROPY_C plus HMAC_DRBG. - * - * A future version may reevaluate the prioritization of DRBG mechanisms. - */ -//#define MBEDTLS_PSA_HMAC_DRBG_MD_TYPE MBEDTLS_MD_SHA256 - -/** \} name SECTION: Cryptographic mechanism selection (extended API) */ - -/** - * \name SECTION: Data format support - * - * This section sets data-format specific settings. - * \{ - */ - -/** - * \def MBEDTLS_ASN1_PARSE_C - * - * Enable the generic ASN1 parser. - * - * Module: library/asn1.c - * Caller: library/x509.c - * library/pkcs12.c - * library/pkcs5.c - * library/pkparse.c - */ -#define MBEDTLS_ASN1_PARSE_C - -/** - * \def MBEDTLS_ASN1_WRITE_C - * - * Enable the generic ASN1 writer. - * - * Module: library/asn1write.c - * Caller: library/ecdsa.c - * library/pkwrite.c - * library/x509_create.c - * library/x509write_crt.c - * library/x509write_csr.c - */ -#define MBEDTLS_ASN1_WRITE_C - -/** - * \def MBEDTLS_BASE64_C - * - * Enable the Base64 module. - * - * Module: library/base64.c - * Caller: library/pem.c - * - * This module is required for PEM support (required by X.509). - */ -#define MBEDTLS_BASE64_C - -/** - * \def MBEDTLS_PEM_PARSE_C - * - * Enable PEM decoding / parsing. - * - * Module: library/pem.c - * Caller: library/pkparse.c - * library/x509_crl.c - * library/x509_crt.c - * library/x509_csr.c - * - * Requires: MBEDTLS_BASE64_C - * optionally MBEDTLS_MD5_C, or PSA Crypto with MD5 (see below) - * - * \warning When parsing password-protected files, if MD5 is provided only by - * a PSA driver, you must call psa_crypto_init() before the first file. - * - * This modules adds support for decoding / parsing PEM files. - */ -#define MBEDTLS_PEM_PARSE_C - -/** - * \def MBEDTLS_PEM_WRITE_C - * - * Enable PEM encoding / writing. - * - * Module: library/pem.c - * Caller: library/pkwrite.c - * library/x509write_crt.c - * library/x509write_csr.c - * - * Requires: MBEDTLS_BASE64_C - * - * This modules adds support for encoding / writing PEM files. - */ -#define MBEDTLS_PEM_WRITE_C - -/** \} name SECTION: Data format support */ - -/** - * \name SECTION: PSA core - * - * This section sets PSA specific settings. - * \{ - */ - -/** - * \def MBEDTLS_ENTROPY_C - * - * Enable the platform-specific entropy code. - * - * Module: library/entropy.c - * Caller: - * - * Requires: MBEDTLS_SHA512_C or MBEDTLS_SHA256_C - * - * This module provides a generic entropy pool - */ -#define MBEDTLS_ENTROPY_C - -/** - * \def MBEDTLS_ENTROPY_FORCE_SHA256 - * - * Force the entropy accumulator to use a SHA-256 accumulator instead of the - * default SHA-512 based one (if both are available). - * - * Requires: MBEDTLS_SHA256_C - * - * On 32-bit systems SHA-256 can be much faster than SHA-512. Use this option - * if you have performance concerns. - * - * This option is only useful if both MBEDTLS_SHA256_C and - * MBEDTLS_SHA512_C are defined. Otherwise the available hash module is used. - */ -//#define MBEDTLS_ENTROPY_FORCE_SHA256 - -/** - * \def MBEDTLS_PLATFORM_GET_ENTROPY_ALT - * - * By default TF-PSA-Crypto uses platform-specific sources such as `getrandom()`, - * `/dev/urandom` or `BCryptGenRandom()` to gather entropy data. If these - * functions are not available on your platform, the following symbol allows - * you to define a custom callback function named mbedtls_platform_get_entropy() - * that Mbed TLS will use to gather entropy data. - * The public header mbedtls/platform.h provides the prototype for this - * callback function and also the documentation for its parameters. - */ -#define MBEDTLS_PLATFORM_GET_ENTROPY_ALT - -/** - * \def MBEDTLS_ENTROPY_NV_SEED - * - * Enable the non-volatile (NV) seed file-based entropy source. - * (Also enables the NV seed read/write functions in the platform layer) - * - * This is crucial (if not required) on systems that do not have a - * cryptographic entropy source (in hardware or kernel) available. - * - * Requires: MBEDTLS_ENTROPY_C, MBEDTLS_PLATFORM_C - * - * \note The read/write functions that are used by the entropy source are - * determined in the platform layer, and can be modified at runtime and/or - * compile-time depending on the flags (MBEDTLS_PLATFORM_NV_SEED_*) used. - * - * \note If you use the default implementation functions that read a seedfile - * with regular fopen(), please make sure you make a seedfile with the - * proper name (defined in MBEDTLS_PLATFORM_STD_NV_SEED_FILE) and at - * least MBEDTLS_ENTROPY_BLOCK_SIZE bytes in size that can be read from - * and written to or you will get an entropy source error! The default - * implementation will only use the first MBEDTLS_ENTROPY_BLOCK_SIZE - * bytes from the file. - * - * \note The entropy collector will write to the seed file before entropy is - * given to an external source, to update it. - */ -//#define MBEDTLS_ENTROPY_NV_SEED - -/** - * \def MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES - * - * Do not add default entropy sources in mbedtls_entropy_init(). - * - * This is useful to have more control over the added entropy sources in an - * application. - * - * Uncomment this macro to prevent loading of default entropy functions. - */ -//#define MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES - -/** - * \def MBEDTLS_PSA_CRYPTO_C - * - * Enable the Platform Security Architecture cryptography API. - * - * Module: library/psa_crypto.c - * - * Requires: either MBEDTLS_CTR_DRBG_C and MBEDTLS_ENTROPY_C, - * or MBEDTLS_HMAC_DRBG_C and MBEDTLS_ENTROPY_C, - * or MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG. - * Auto-enables: MBEDTLS_CIPHER_C if any unauthenticated (ie, non-AEAD) cipher - * is enabled in PSA (unless it's fully accelerated, see - * docs/driver-only-builds.md about that). - */ -#define MBEDTLS_PSA_CRYPTO_C - -/** - * \def MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS - * - * Assume all buffers passed to PSA functions are owned exclusively by the - * PSA function and are not stored in shared memory. - * - * This option may be enabled if all buffers passed to any PSA function reside - * in memory that is accessible only to the PSA function during its execution. - * - * This option MUST be disabled whenever buffer arguments are in memory shared - * with an untrusted party, for example where arguments to PSA calls are passed - * across a trust boundary. - * - * \note Enabling this option reduces memory usage and code size. - * - * \note Enabling this option causes overlap of input and output buffers - * not to be supported by PSA functions. - */ -#define MBEDTLS_PSA_ASSUME_EXCLUSIVE_BUFFERS - -/** \def MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS - * - * Enable support for platform built-in keys. If you enable this feature, - * you must implement the function mbedtls_psa_platform_get_builtin_key(). - * See the documentation of that function for more information. - * - * Built-in keys are typically derived from a hardware unique key or - * stored in a secure element. - * - * Requires: MBEDTLS_PSA_CRYPTO_C. - * - * \warning This interface is experimental and may change or be removed - * without notice. - */ -//#define MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS - -/** \def MBEDTLS_PSA_CRYPTO_CLIENT - * - * Enable support for PSA crypto client. - * - * \note This option allows to include the code necessary for a PSA - * crypto client when the PSA crypto implementation is not included in - * the library (MBEDTLS_PSA_CRYPTO_C disabled). The code included is the - * code to set and get PSA key attributes. - * The development of PSA drivers partially relying on the library to - * fulfill the hardware gaps is another possible usage of this option. - * - * \warning This interface is experimental and may change or be removed - * without notice. - */ -//#define MBEDTLS_PSA_CRYPTO_CLIENT - -/** \def MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG - * - * Make the PSA Crypto module use an external random generator provided - * by a driver, instead of Mbed TLS's entropy and DRBG modules. - * - * \note This random generator must deliver random numbers with cryptographic - * quality and high performance. It must supply unpredictable numbers - * with a uniform distribution. The implementation of this function - * is responsible for ensuring that the random generator is seeded - * with sufficient entropy. If you have a hardware TRNG which is slow - * or delivers non-uniform output, declare it as an entropy source - * with mbedtls_entropy_add_source() instead of enabling this option. - * - * If you enable this option, you must configure the type - * ::mbedtls_psa_external_random_context_t in psa/crypto_platform.h - * and define a function called mbedtls_psa_external_get_random() - * with the following prototype: - * ``` - * psa_status_t mbedtls_psa_external_get_random( - * mbedtls_psa_external_random_context_t *context, - * uint8_t *output, size_t output_size, size_t *output_length); - * ); - * ``` - * The \c context value is initialized to 0 before the first call. - * The function must fill the \c output buffer with \c output_size bytes - * of random data and set \c *output_length to \c output_size. - * - * Requires: MBEDTLS_PSA_CRYPTO_C - * - * \warning If you enable this option, code that uses the PSA cryptography - * interface will not use any of the entropy sources set up for - * the entropy module, nor the NV seed that MBEDTLS_ENTROPY_NV_SEED - * enables. - * - * \note This option is experimental and may be removed without notice. - */ -//#define MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG - -/* MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER - * - * Enable key identifiers that encode a key owner identifier. - * - * The owner of a key is identified by a value of type ::mbedtls_key_owner_id_t - * which is currently hard-coded to be int32_t. - * - * Note that this option is meant for internal use only and may be removed - * without notice. - */ -//#define MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER - -/** - * \def MBEDTLS_PSA_CRYPTO_SPM - * - * When MBEDTLS_PSA_CRYPTO_SPM is defined, the code is built for SPM (Secure - * Partition Manager) integration which separates the code into two parts: a - * NSPE (Non-Secure Process Environment) and an SPE (Secure Process - * Environment). - * - * If you enable this option, your build environment must include a header - * file `"crypto_spe.h"` (either in the `psa` subdirectory of the Mbed TLS - * header files, or in another directory on the compiler's include search - * path). Alternatively, your platform may customize the header - * `psa/crypto_platform.h`, in which case it can skip or replace the - * inclusion of `"crypto_spe.h"`. - * - * Module: library/psa_crypto.c - * Requires: MBEDTLS_PSA_CRYPTO_C - * - */ -//#define MBEDTLS_PSA_CRYPTO_SPM - -/** - * \def MBEDTLS_PSA_CRYPTO_STORAGE_C - * - * Enable the Platform Security Architecture persistent key storage. - * - * Module: library/psa_crypto_storage.c - * - * Requires: MBEDTLS_PSA_CRYPTO_C, - * either MBEDTLS_PSA_ITS_FILE_C or a native implementation of - * the PSA ITS interface - */ -#define MBEDTLS_PSA_CRYPTO_STORAGE_C - -/** - * \def MBEDTLS_PSA_ITS_FILE_C - * - * Enable the emulation of the Platform Security Architecture - * Internal Trusted Storage (PSA ITS) over files. - * - * Module: library/psa_its_file.c - * - * Requires: MBEDTLS_FS_IO - */ -#define MBEDTLS_PSA_ITS_FILE_C - -/** - * \def MBEDTLS_PSA_KEY_STORE_DYNAMIC - * - * Dynamically resize the PSA key store to accommodate any number of - * volatile keys (until the heap memory is exhausted). - * - * If this option is disabled, the key store has a fixed size - * #MBEDTLS_PSA_KEY_SLOT_COUNT for volatile keys and loaded persistent keys - * together. - * - * This option has no effect when #MBEDTLS_PSA_CRYPTO_C is disabled. - * - * Module: library/psa_crypto.c - * Requires: MBEDTLS_PSA_CRYPTO_C - */ -#define MBEDTLS_PSA_KEY_STORE_DYNAMIC - -/** - * \def MBEDTLS_PSA_STATIC_KEY_SLOTS - * - * Statically preallocate memory to store keys' material in PSA instead - * of allocating it dynamically when required. This allows builds without a - * heap, if none of the enabled cryptographic implementations or other features - * require it. - * This feature affects both volatile and persistent keys which means that - * it's not possible to persistently store a key which is larger than - * #MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE. - * - * \note This feature comes with a (potentially) higher RAM usage since: - * - All the key slots are allocated no matter if they are used or not. - * - Each key buffer's length is #MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE bytes. - * - * Requires: MBEDTLS_PSA_CRYPTO_C - * - */ -//#define MBEDTLS_PSA_STATIC_KEY_SLOTS - -/* Entropy options */ -//#define MBEDTLS_ENTROPY_MAX_GATHER 128 /**< Maximum amount requested from entropy sources */ -//#define MBEDTLS_ENTROPY_MAX_SOURCES 20 /**< Maximum number of sources supported */ - -/** - * \def MBEDTLS_PSA_CRYPTO_PLATFORM_FILE - * - * If defined, this is a header which will be included instead of - * `"psa/crypto_platform.h"`. This file should declare the same identifiers - * as the one in Mbed TLS, but with definitions adapted to the platform on - * which the library code will run. - * - * \note The required content of this header can vary from one version of - * Mbed TLS to the next. Integrators who provide an alternative file - * should review the changes in the original file whenever they - * upgrade Mbed TLS. - * - * This macro is expanded after an \#include directive. This is a popular but - * non-standard feature of the C language, so this feature is only available - * with compilers that perform macro expansion on an \#include line. - * - * The value of this symbol is typically a path in double quotes, either - * absolute or relative to a directory on the include search path. - */ -//#define MBEDTLS_PSA_CRYPTO_PLATFORM_FILE "psa/crypto_platform_alt.h" - -/** - * \def MBEDTLS_PSA_CRYPTO_STRUCT_FILE - * - * If defined, this is a header which will be included instead of - * `"psa/crypto_struct.h"`. This file should declare the same identifiers - * as the one in Mbed TLS, but with definitions adapted to the environment - * in which the library code will run. The typical use for this feature - * is to provide alternative type definitions on the client side in - * client-server integrations of PSA crypto, where operation structures - * contain handles instead of cryptographic data. - * - * \note The required content of this header can vary from one version of - * Mbed TLS to the next. Integrators who provide an alternative file - * should review the changes in the original file whenever they - * upgrade Mbed TLS. - * - * This macro is expanded after an \#include directive. This is a popular but - * non-standard feature of the C language, so this feature is only available - * with compilers that perform macro expansion on an \#include line. - * - * The value of this symbol is typically a path in double quotes, either - * absolute or relative to a directory on the include search path. - */ -//#define MBEDTLS_PSA_CRYPTO_STRUCT_FILE "psa/crypto_struct_alt.h" - -/** \def MBEDTLS_PSA_KEY_SLOT_COUNT - * - * When #MBEDTLS_PSA_KEY_STORE_DYNAMIC is disabled, - * the maximum amount of PSA keys simultaneously in memory. This counts all - * volatile keys, plus loaded persistent keys. - * - * When #MBEDTLS_PSA_KEY_STORE_DYNAMIC is enabled, - * the maximum number of loaded persistent keys. - * - * Currently, persistent keys do not need to be loaded all the time while - * a multipart operation is in progress, only while the operation is being - * set up. This may change in future versions of the library. - * - * Currently, the library traverses of the whole table on each access to a - * persistent key. Therefore large values may cause poor performance. - * - * This option has no effect when #MBEDTLS_PSA_CRYPTO_C is disabled. - */ -//#define MBEDTLS_PSA_KEY_SLOT_COUNT 32 - -/** - * \def MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE - * - * Define the size (in bytes) of each static key buffer when - * #MBEDTLS_PSA_STATIC_KEY_SLOTS is set. If not - * explicitly defined then it's automatically guessed from available PSA keys - * enabled in the build through PSA_WANT_xxx symbols. - * If required by the application this parameter can be set to higher values - * in order to store larger objects (ex: raw keys), but please note that this - * will increase RAM usage. - */ -//#define MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE 256 - -/** \} name SECTION: PSA core */ - -/** - * \name SECTION: Builtin drivers - * - * This section sets driver specific settings. - * \{ - */ - -/** - * \def MBEDTLS_AESNI_C - * - * Enable AES-NI support on x86-64 or x86-32. - * - * \note AESNI is only supported with certain compilers and target options: - * - Visual Studio: supported - * - GCC, x86-64, target not explicitly supporting AESNI: - * requires MBEDTLS_HAVE_ASM. - * - GCC, x86-32, target not explicitly supporting AESNI: - * not supported. - * - GCC, x86-64 or x86-32, target supporting AESNI: supported. - * For this assembly-less implementation, you must currently compile - * `library/aesni.c` and `library/aes.c` with machine options to enable - * SSE2 and AESNI instructions: `gcc -msse2 -maes -mpclmul` or - * `clang -maes -mpclmul`. - * - Non-x86 targets: this option is silently ignored. - * - Other compilers: this option is silently ignored. - * - * \note - * Above, "GCC" includes compatible compilers such as Clang. - * The limitations on target support are likely to be relaxed in the future. - * - * Module: library/aesni.c - * Caller: library/aes.c - * - * Requires: MBEDTLS_HAVE_ASM (on some platforms, see note) - * - * This modules adds support for the AES-NI instructions on x86. - */ -#define MBEDTLS_AESNI_C - -/** - * \def MBEDTLS_AESCE_C - * - * Enable AES cryptographic extension support on Armv8. - * - * Module: library/aesce.c - * Caller: library/aes.c - * - * Requires: MBEDTLS_AES_C - * - * \warning Runtime detection only works on Linux. For non-Linux operating - * system, Armv8-A Cryptographic Extensions must be supported by - * the CPU when this option is enabled. - * - * \note Minimum compiler versions for this feature when targeting aarch64 - * are Clang 4.0; armclang 6.6; GCC 6.0; or MSVC 2019 version 16.11.2. - * Minimum compiler versions for this feature when targeting 32-bit - * Arm or Thumb are Clang 11.0; armclang 6.20; or GCC 6.0. - * - * \note \c CFLAGS must be set to a minimum of \c -march=armv8-a+crypto for - * armclang <= 6.9 - * - * This module adds support for the AES Armv8-A Cryptographic Extensions on Armv8 systems. - */ -#define MBEDTLS_AESCE_C - -/** - * \def MBEDTLS_AES_ROM_TABLES - * - * Use precomputed AES tables stored in ROM. - * - * Uncomment this macro to use precomputed AES tables stored in ROM. - * Comment this macro to generate AES tables in RAM at runtime. - * - * Tradeoff: Using precomputed ROM tables reduces RAM usage by ~8kb - * (or ~2kb if \c MBEDTLS_AES_FEWER_TABLES is used) and reduces the - * initialization time before the first AES operation can be performed. - * It comes at the cost of additional ~8kb ROM use (resp. ~2kb if \c - * MBEDTLS_AES_FEWER_TABLES below is used), and potentially degraded - * performance if ROM access is slower than RAM access. - * - * This option is independent of \c MBEDTLS_AES_FEWER_TABLES. - */ -//#define MBEDTLS_AES_ROM_TABLES - -/** - * \def MBEDTLS_AES_FEWER_TABLES - * - * Use less ROM/RAM for AES tables. - * - * Uncommenting this macro omits 75% of the AES tables from - * ROM / RAM (depending on the value of \c MBEDTLS_AES_ROM_TABLES) - * by computing their values on the fly during operations - * (the tables are entry-wise rotations of one another). - * - * Tradeoff: Uncommenting this reduces the RAM / ROM footprint - * by ~6kb but at the cost of more arithmetic operations during - * runtime. Specifically, one has to compare 4 accesses within - * different tables to 4 accesses with additional arithmetic - * operations within the same table. The performance gain/loss - * depends on the system and memory details. - * - * This option is independent of \c MBEDTLS_AES_ROM_TABLES. - */ -//#define MBEDTLS_AES_FEWER_TABLES - -/** - * \def MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH - * - * Use only 128-bit keys in AES operations to save ROM. - * - * Uncomment this macro to remove support for AES operations that use 192- - * or 256-bit keys. - * - * Uncommenting this macro reduces the size of AES code by ~300 bytes - * on v8-M/Thumb2. - * - * Module: library/aes.c - * - * Requires: MBEDTLS_AES_C - */ -//#define MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH - -/* - * Disable plain C implementation for AES. - * - * When the plain C implementation is enabled, and an implementation using a - * special CPU feature (such as MBEDTLS_AESCE_C) is also enabled, runtime - * detection will be used to select between them. - * - * If only one implementation is present, runtime detection will not be used. - * This configuration will crash at runtime if running on a CPU without the - * necessary features. It will not build unless at least one of MBEDTLS_AESCE_C - * and/or MBEDTLS_AESNI_C is enabled & present in the build. - */ -// #define MBEDTLS_AES_USE_HARDWARE_ONLY - -/** - * \def MBEDTLS_BLOCK_CIPHER_NO_DECRYPT - * - * Remove decryption operation for AES, ARIA and Camellia block cipher. - * - * \note This feature is incompatible with insecure block cipher, - * MBEDTLS_DES_C, and cipher modes which always require decryption - * operation, MBEDTLS_CIPHER_MODE_CBC, MBEDTLS_CIPHER_MODE_XTS and - * MBEDTLS_NIST_KW_C. This feature is incompatible with following - * supported PSA equivalence PSA_WANT_ALG_ECB_NO_PADDING, - * PSA_WANT_ALG_CBC_NO_PADDING, PSA_WANT_ALG_CBC_PKCS7 and - * PSA_WANT_KEY_TYPE_DES. - * - * Module: library/aes.c - * library/aesce.c - * library/aesni.c - * library/aria.c - * library/camellia.c - * library/cipher.c - */ -//#define MBEDTLS_BLOCK_CIPHER_NO_DECRYPT - -/** - * \def MBEDTLS_CAMELLIA_SMALL_MEMORY - * - * Use less ROM for the Camellia implementation (saves about 768 bytes). - * - * Uncomment this macro to use less memory for Camellia. - */ -//#define MBEDTLS_CAMELLIA_SMALL_MEMORY - -/** - * Enable the verified implementations of ECDH primitives from Project Everest - * (currently only Curve25519). This feature changes the layout of ECDH - * contexts and therefore is a compatibility break for applications that access - * fields of a mbedtls_ecdh_context structure directly. See also - * MBEDTLS_ECDH_LEGACY_CONTEXT in include/mbedtls/ecdh.h. - * - * The Everest code is provided under the Apache 2.0 license only; therefore enabling this - * option is not compatible with taking the library under the GPL v2.0-or-later license. - */ -//#define MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED - -/** - * \def MBEDTLS_ECP_NIST_OPTIM - * - * Enable specific 'modulo p' routines for each NIST prime. - * Depending on the prime and architecture, makes operations 4 to 8 times - * faster on the corresponding curve. - * - * Comment this macro to disable NIST curves optimisation. - */ -#define MBEDTLS_ECP_NIST_OPTIM - -/** - * \def MBEDTLS_ECP_RESTARTABLE - * - * Enable "non-blocking" ECC operations that can return early and be resumed. - * - * This allows various functions to pause by returning - * #PSA_OPERATION_INCOMPLETE and then be called later again in - * order to further progress and eventually complete their operation. This is - * controlled through mbedtls_ecp_set_max_ops() which limits the maximum - * number of ECC operations a function may perform before pausing; see - * mbedtls_ecp_set_max_ops() for more information. - * - * This is useful in non-threaded environments if you want to avoid blocking - * for too long on ECC (and, hence, X.509 or SSL/TLS) operations. - * - * This option: - * - Adds xxx_restartable() variants of existing operations in the - * following modules, with corresponding restart context types: - * - ECP (for Short Weierstrass curves only): scalar multiplication (mul), - * linear combination (muladd); - * - ECDSA: signature generation & verification; - * - PK: signature generation & verification; - * - X509: certificate chain verification. - * - Adds mbedtls_ecdh_enable_restart() in the ECDH module. - * - Changes the behaviour of TLS 1.2 clients (not servers) when using the - * ECDHE-ECDSA key exchange (not other key exchanges) to make all ECC - * computations restartable: - * - verification of the server's key exchange signature; - * - verification of the server's certificate chain; - * - generation of the client's signature if client authentication is used, - * with an ECC key/certificate. - * - * \note When this option is enabled, restartable operations in PK, X.509 - * and TLS (see above) are not using PSA. On the other hand, ECDH - * computations in TLS are using PSA, and are not restartable. These - * are temporary limitations that should be lifted in the future. (See - * https://github.com/Mbed-TLS/mbedtls/issues/9784 and - * https://github.com/Mbed-TLS/mbedtls/issues/9817) - * - * Requires: MBEDTLS_ECP_C - * - * Uncomment this macro to enable restartable ECC computations. - */ -//#define MBEDTLS_ECP_RESTARTABLE - -/** - * Uncomment to enable using new bignum code in the ECC modules. - * - * \warning This is currently experimental, incomplete and therefore should not - * be used in production. - */ -//#define MBEDTLS_ECP_WITH_MPI_UINT - -/** - * \def MBEDTLS_GCM_LARGE_TABLE - * - * Enable large pre-computed tables for Galois/Counter Mode (GCM). - * Can significantly increase throughput on systems without GCM hardware - * acceleration (e.g., AESNI, AESCE). - * - * The mbedtls_gcm_context size will increase by 3840 bytes. - * The code size will increase by roughly 344 bytes. - * - * Module: library/gcm.c - * - * Requires: MBEDTLS_GCM_C - */ -//#define MBEDTLS_GCM_LARGE_TABLE - -/** - * \def MBEDTLS_HAVE_ASM - * - * The compiler has support for asm(). - * - * Requires support for asm() in compiler. - * - * Used in: - * library/aesni.h - * library/aria.c - * library/bn_mul.h - * library/constant_time.c - * - * Required by: - * MBEDTLS_AESCE_C - * MBEDTLS_AESNI_C (on some platforms) - * - * Comment to disable the use of assembly code. - */ -#define MBEDTLS_HAVE_ASM - -/** - * \def MBEDTLS_HAVE_SSE2 - * - * CPU supports SSE2 instruction set. - * - * Uncomment if the CPU supports SSE2 (IA-32 specific). - */ -//#define MBEDTLS_HAVE_SSE2 - -/** - * \def MBEDTLS_NO_UDBL_DIVISION - * - * The platform lacks support for double-width integer division (64-bit - * division on a 32-bit platform, 128-bit division on a 64-bit platform). - * - * Used in: - * include/mbedtls/bignum.h - * library/bignum.c - * - * The bignum code uses double-width division to speed up some operations. - * Double-width division is often implemented in software that needs to - * be linked with the program. The presence of a double-width integer - * type is usually detected automatically through preprocessor macros, - * but the automatic detection cannot know whether the code needs to - * and can be linked with an implementation of division for that type. - * By default division is assumed to be usable if the type is present. - * Uncomment this option to prevent the use of double-width division. - * - * Note that division for the native integer type is always required. - * Furthermore, a 64-bit type is always required even on a 32-bit - * platform, but it need not support multiplication or division. In some - * cases it is also desirable to disable some double-width operations. For - * example, if double-width division is implemented in software, disabling - * it can reduce code size in some embedded targets. - */ -//#define MBEDTLS_NO_UDBL_DIVISION - -/** - * \def MBEDTLS_NO_64BIT_MULTIPLICATION - * - * The platform lacks support for 32x32 -> 64-bit multiplication. - * - * Used in: - * library/poly1305.c - * - * Some parts of the library may use multiplication of two unsigned 32-bit - * operands with a 64-bit result in order to speed up computations. On some - * platforms, this is not available in hardware and has to be implemented in - * software, usually in a library provided by the toolchain. - * - * Sometimes it is not desirable to have to link to that library. This option - * removes the dependency of that library on platforms that lack a hardware - * 64-bit multiplier by embedding a software implementation in Mbed TLS. - * - * Note that depending on the compiler, this may decrease performance compared - * to using the library function provided by the toolchain. - */ -//#define MBEDTLS_NO_64BIT_MULTIPLICATION - -/** - * Uncomment to enable p256-m. This is an alternative implementation of - * key generation, ECDH and (randomized) ECDSA on the curve SECP256R1. - * Compared to the default implementation: - * - * - p256-m has a much smaller code size and RAM footprint. - * - p256-m is only available via the PSA API. This includes the pk module. - * - p256-m does not support deterministic ECDSA, EC-JPAKE, custom protocols - * over the core arithmetic, or deterministic derivation of keys. - * - * We recommend enabling this option if your application uses the PSA API - * and the only elliptic curve support it needs is ECDH and ECDSA over - * SECP256R1. - * - * If you enable this option, you do not need to enable any ECC-related - * MBEDTLS_xxx option. You do need to separately request support for the - * cryptographic mechanisms through the PSA API: - * - #MBEDTLS_PSA_CRYPTO_C for PSA-based configuration; - * - #PSA_WANT_ECC_SECP_R1_256; - * - #PSA_WANT_ALG_ECDH and/or #PSA_WANT_ALG_ECDSA as needed; - * - #PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY, #PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_BASIC, - * #PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT, - * #PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT and/or - * #PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE as needed. - * - * \note To benefit from the smaller code size of p256-m, make sure that you - * do not enable any ECC-related option not supported by p256-m: this - * would cause the built-in ECC implementation to be built as well, in - * order to provide the required option. - * Make sure #PSA_WANT_ALG_DETERMINISTIC_ECDSA, #PSA_WANT_ALG_JPAKE and - * #PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_DERIVE, and curves other than - * SECP256R1 are disabled as they are not supported by this driver. - * Also, avoid defining #MBEDTLS_PK_PARSE_EC_COMPRESSED or - * #MBEDTLS_PK_PARSE_EC_EXTENDED as those currently require a subset of - * the built-in ECC implementation, see docs/driver-only-builds.md. - */ -//#define MBEDTLS_PSA_P256M_DRIVER_ENABLED - -/** - * \def MBEDTLS_RSA_NO_CRT - * - * Do not use the Chinese Remainder Theorem - * for the RSA private operation. - * - * Uncomment this macro to disable the use of CRT in RSA. - * - */ -//#define MBEDTLS_RSA_NO_CRT - -/** - * \def MBEDTLS_SHA256_SMALLER - * - * Enable an implementation of SHA-256 that has lower ROM footprint but also - * lower performance. - * - * The default implementation is meant to be a reasonable compromise between - * performance and size. This version optimizes more aggressively for size at - * the expense of performance. Eg on Cortex-M4 it reduces the size of - * mbedtls_sha256_process() from ~2KB to ~0.5KB for a performance hit of about - * 30%. - * - * Uncomment to enable the smaller implementation of SHA256. - */ -//#define MBEDTLS_SHA256_SMALLER - -/** - * \def MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT - * - * Enable acceleration of the SHA-256 and SHA-224 cryptographic hash algorithms - * with the ARMv8 cryptographic extensions if they are available at runtime. - * If not, the library will fall back to the C implementation. - * - * \note If MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT is defined when building - * for a non-Armv8-A build it will be silently ignored. - * - * \note Minimum compiler versions for this feature are Clang 4.0, - * armclang 6.6 or GCC 6.0. - * - * \note \c CFLAGS must be set to a minimum of \c -march=armv8-a+crypto for - * armclang <= 6.9 - * - * \note This was previously known as MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT. - * That name is deprecated, but may still be used as an alternative form for this - * option. - * - * \warning MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT cannot be defined at the - * same time as MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY. - * - * Requires: MBEDTLS_SHA256_C. - * - * Module: library/sha256.c - * - * Uncomment to have the library check for the Armv8-A SHA-256 crypto extensions - * and use them if available. - */ -//#define MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT - -/** - * \def MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT - * - * \deprecated This is now known as MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT. - * This name is now deprecated, but may still be used as an alternative form for - * this option. - */ -//#define MBEDTLS_SHA256_USE_A64_CRYPTO_IF_PRESENT - -/** - * \def MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY - * - * Enable acceleration of the SHA-256 and SHA-224 cryptographic hash algorithms - * with the ARMv8 cryptographic extensions, which must be available at runtime - * or else an illegal instruction fault will occur. - * - * \note This allows builds with a smaller code size than with - * MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT - * - * \note Minimum compiler versions for this feature are Clang 4.0, - * armclang 6.6 or GCC 6.0. - * - * \note \c CFLAGS must be set to a minimum of \c -march=armv8-a+crypto for - * armclang <= 6.9 - * - * \note This was previously known as MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY. - * That name is deprecated, but may still be used as an alternative form for this - * option. - * - * \warning MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY cannot be defined at the same - * time as MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT. - * - * Requires: MBEDTLS_SHA256_C. - * - * Module: library/sha256.c - * - * Uncomment to have the library use the Armv8-A SHA-256 crypto extensions - * unconditionally. - */ -//#define MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY - -/** - * \def MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY - * - * \deprecated This is now known as MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY. - * This name is now deprecated, but may still be used as an alternative form for - * this option. - */ -//#define MBEDTLS_SHA256_USE_A64_CRYPTO_ONLY - -/** - * \def MBEDTLS_SHA512_SMALLER - * - * Enable an implementation of SHA-512 that has lower ROM footprint but also - * lower performance. - * - * Uncomment to enable the smaller implementation of SHA512. - */ -//#define MBEDTLS_SHA512_SMALLER - -/** - * \def MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT - * - * Enable acceleration of the SHA-512 and SHA-384 cryptographic hash algorithms - * with the ARMv8 cryptographic extensions if they are available at runtime. - * If not, the library will fall back to the C implementation. - * - * \note If MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT is defined when building - * for a non-Aarch64 build it will be silently ignored. - * - * \note Minimum compiler versions for this feature are Clang 7.0, - * armclang 6.9 or GCC 8.0. - * - * \note \c CFLAGS must be set to a minimum of \c -march=armv8.2-a+sha3 for - * armclang 6.9 - * - * \warning MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT cannot be defined at the - * same time as MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY. - * - * Requires: MBEDTLS_SHA512_C. - * - * Module: library/sha512.c - * - * Uncomment to have the library check for the A64 SHA-512 crypto extensions - * and use them if available. - */ -//#define MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT - -/** - * \def MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY - * - * Enable acceleration of the SHA-512 and SHA-384 cryptographic hash algorithms - * with the ARMv8 cryptographic extensions, which must be available at runtime - * or else an illegal instruction fault will occur. - * - * \note This allows builds with a smaller code size than with - * MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT - * - * \note Minimum compiler versions for this feature are Clang 7.0, - * armclang 6.9 or GCC 8.0. - * - * \note \c CFLAGS must be set to a minimum of \c -march=armv8.2-a+sha3 for - * armclang 6.9 - * - * \warning MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY cannot be defined at the same - * time as MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT. - * - * Requires: MBEDTLS_SHA512_C. - * - * Module: library/sha512.c - * - * Uncomment to have the library use the A64 SHA-512 crypto extensions - * unconditionally. - */ -//#define MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY - -/* ECP options */ -//#define MBEDTLS_ECP_FIXED_POINT_OPTIM 1 /**< Enable fixed-point speed-up */ -//#define MBEDTLS_ECP_WINDOW_SIZE 4 /**< Maximum window size used */ - -/* MPI / BIGNUM options */ -//#define MBEDTLS_MPI_MAX_SIZE 1024 /**< Maximum number of bytes for usable MPIs. */ -//#define MBEDTLS_MPI_WINDOW_SIZE 2 /**< Maximum window size used. */ - -/* RSA OPTIONS */ -//#define MBEDTLS_RSA_GEN_KEY_MIN_BITS 1024 /**< Minimum RSA key size that can be generated in bits (Minimum possible value is 128 bits) */ - -/** \} name SECTION: Builtin drivers */ - -/** - * \name SECTION: Legacy cryptography - * - * This section sets legacy settings. - * \{ - */ - -/** - * \def MBEDTLS_AES_C - * - * Enable the AES block cipher. - * - * Module: library/aes.c - * Caller: library/cipher.c - * library/pem.c - * library/ctr_drbg.c - * - * PEM_PARSE uses AES for decrypting encrypted keys. - */ -#define MBEDTLS_AES_C - -/** - * \def MBEDTLS_ARIA_C - * - * Enable the ARIA block cipher. - * - * Module: library/aria.c - * Caller: library/cipher.c - */ -#define MBEDTLS_ARIA_C - -/** - * \def MBEDTLS_BIGNUM_C - * - * Enable the multi-precision integer library. - * - * Module: library/bignum.c - * library/bignum_core.c - * library/bignum_mod.c - * library/bignum_mod_raw.c - * Caller: library/ecp.c - * library/ecdsa.c - * library/rsa.c - * library/rsa_alt_helpers.c - * library/ssl_tls.c - * - * This module is required for RSA and ECC (ECDH, ECDSA) support. - */ -#define MBEDTLS_BIGNUM_C - -/** - * \def MBEDTLS_CAMELLIA_C - * - * Enable the Camellia block cipher. - * - * Module: library/camellia.c - * Caller: library/cipher.c - */ -#define MBEDTLS_CAMELLIA_C - -/** - * \def MBEDTLS_CCM_C - * - * Enable the Counter with CBC-MAC (CCM) mode for 128-bit block cipher. - * - * Module: library/ccm.c - * - * Requires: MBEDTLS_CIPHER_C, MBEDTLS_AES_C or MBEDTLS_CAMELLIA_C or - * MBEDTLS_ARIA_C - * - * This module enables the AES-CCM ciphersuites, if other requisites are - * enabled as well. - */ -#define MBEDTLS_CCM_C - -/** - * \def MBEDTLS_CHACHA20_C - * - * Enable the ChaCha20 stream cipher. - * - * Module: library/chacha20.c - */ -#define MBEDTLS_CHACHA20_C - -/** - * \def MBEDTLS_CHACHAPOLY_C - * - * Enable the ChaCha20-Poly1305 AEAD algorithm. - * - * Module: library/chachapoly.c - * - * This module requires: MBEDTLS_CHACHA20_C, MBEDTLS_POLY1305_C - */ -#define MBEDTLS_CHACHAPOLY_C - -/** - * \def MBEDTLS_CIPHER_C - * - * Enable the generic cipher layer. - * - * Module: library/cipher.c - * Caller: library/ccm.c - * library/cmac.c - * library/gcm.c - * library/nist_kw.c - * library/pkcs12.c - * library/pkcs5.c - * library/psa_crypto_aead.c - * library/psa_crypto_mac.c - * library/ssl_ciphersuites.c - * library/ssl_msg.c - * Auto-enabled by: MBEDTLS_PSA_CRYPTO_C depending on which ciphers are enabled - * (see the documentation of that option for details). - * - * Uncomment to enable generic cipher wrappers. - */ -#define MBEDTLS_CIPHER_C - -/** - * \def MBEDTLS_CIPHER_MODE_CBC - * - * Enable Cipher Block Chaining mode (CBC) for symmetric ciphers. - */ -#define MBEDTLS_CIPHER_MODE_CBC - -/** - * \def MBEDTLS_CIPHER_MODE_CFB - * - * Enable Cipher Feedback mode (CFB) for symmetric ciphers. - */ -#define MBEDTLS_CIPHER_MODE_CFB - -/** - * \def MBEDTLS_CIPHER_MODE_CTR - * - * Enable Counter Block Cipher mode (CTR) for symmetric ciphers. - */ -#define MBEDTLS_CIPHER_MODE_CTR - -/** - * \def MBEDTLS_CIPHER_MODE_OFB - * - * Enable Output Feedback mode (OFB) for symmetric ciphers. - */ -#define MBEDTLS_CIPHER_MODE_OFB - -/** - * \def MBEDTLS_CIPHER_MODE_XTS - * - * Enable Xor-encrypt-xor with ciphertext stealing mode (XTS) for AES. - */ -#define MBEDTLS_CIPHER_MODE_XTS - -/** - * \def MBEDTLS_CIPHER_NULL_CIPHER - * - * Enable NULL cipher. - * Warning: Only do so when you know what you are doing. This allows for - * encryption or channels without any security! - * - * Uncomment this macro to enable the NULL cipher and ciphersuites - */ -//#define MBEDTLS_CIPHER_NULL_CIPHER - -/** - * \def MBEDTLS_CIPHER_PADDING_PKCS7 - * - * MBEDTLS_CIPHER_PADDING_XXX: Uncomment or comment macros to add support for - * specific padding modes in the cipher layer with cipher modes that support - * padding (e.g. CBC) - * - * If you disable all padding modes, only full blocks can be used with CBC. - * - * Enable padding modes in the cipher layer. - */ -#define MBEDTLS_CIPHER_PADDING_PKCS7 -#define MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS -#define MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN -#define MBEDTLS_CIPHER_PADDING_ZEROS - -/** - * \def MBEDTLS_CMAC_C - * - * Enable the CMAC (Cipher-based Message Authentication Code) mode for block - * ciphers. - * - * Module: library/cmac.c - * - * Requires: MBEDTLS_CIPHER_C, MBEDTLS_AES_C or MBEDTLS_DES_C - * - */ -#define MBEDTLS_CMAC_C - -/** - * \def MBEDTLS_CTR_DRBG_C - * - * Enable the CTR_DRBG AES-based random generator. - * The CTR_DRBG generator uses AES-256 by default. - * To use AES-128 instead, enable \c MBEDTLS_CTR_DRBG_USE_128_BIT_KEY above. - * - * AES support can either be achieved through builtin (MBEDTLS_AES_C) or PSA. - * Builtin is the default option when MBEDTLS_AES_C is defined otherwise PSA - * is used. - * - * \warning When using PSA, the user should call `psa_crypto_init()` before - * using any CTR_DRBG operation (except `mbedtls_ctr_drbg_init()`). - * - * \note AES-128 will be used if \c MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH is set. - * - * \note To achieve a 256-bit security strength with CTR_DRBG, - * you must use AES-256 *and* use sufficient entropy. - * See ctr_drbg.h for more details. - * - * Module: library/ctr_drbg.c - * Caller: - * - * Requires: MBEDTLS_AES_C or - * (PSA_WANT_KEY_TYPE_AES and PSA_WANT_ALG_ECB_NO_PADDING and - * MBEDTLS_PSA_CRYPTO_C) - * - * This module provides the CTR_DRBG AES random number generator. - */ -#define MBEDTLS_CTR_DRBG_C - -/** \def MBEDTLS_CTR_DRBG_USE_128_BIT_KEY - * - * Uncomment this macro to use a 128-bit key in the CTR_DRBG module. - * Without this, CTR_DRBG uses a 256-bit key - * unless \c MBEDTLS_AES_ONLY_128_BIT_KEY_LENGTH is set. - */ -//#define MBEDTLS_CTR_DRBG_USE_128_BIT_KEY - -/** - * \def MBEDTLS_DES_C - * - * Enable the DES block cipher. - * - * Module: library/des.c - * Caller: library/pem.c - * library/cipher.c - * - * PEM_PARSE uses DES/3DES for decrypting encrypted keys. - * - * \warning DES/3DES are considered weak ciphers and their use constitutes a - * security risk. We recommend considering stronger ciphers instead. - */ -#define MBEDTLS_DES_C - -/** - * \def MBEDTLS_ECDH_C - * - * Enable the elliptic curve Diffie-Hellman library. - * - * Module: library/ecdh.c - * Caller: library/psa_crypto.c - * library/ssl_tls.c - * library/ssl*_client.c - * library/ssl*_server.c - * - * This module is used by the following key exchanges: - * ECDHE-ECDSA, ECDHE-RSA - * - * Requires: MBEDTLS_ECP_C - */ -#define MBEDTLS_ECDH_C - -/** - * \def MBEDTLS_ECP_C - * - * Enable the elliptic curve over GF(p) library. - * - * Module: library/ecp.c - * Caller: library/ecdh.c - * library/ecdsa.c - * library/ecjpake.c - * - * Requires: MBEDTLS_BIGNUM_C and at least one MBEDTLS_ECP_DP_XXX_ENABLED - */ -#define MBEDTLS_ECP_C - -/** - * \def MBEDTLS_ECP_DP_SECP192R1_ENABLED - * - * MBEDTLS_ECP_XXXX_ENABLED: Enables specific curves within the Elliptic Curve - * module. By default all supported curves are enabled. - * - * Comment macros to disable the curve and functions for it - */ -/* Short Weierstrass curves (supporting ECP, ECDH, ECDSA) */ -#define MBEDTLS_ECP_DP_SECP192R1_ENABLED -#define MBEDTLS_ECP_DP_SECP224R1_ENABLED -#define MBEDTLS_ECP_DP_SECP256R1_ENABLED -#define MBEDTLS_ECP_DP_SECP384R1_ENABLED -#define MBEDTLS_ECP_DP_SECP521R1_ENABLED -#define MBEDTLS_ECP_DP_SECP192K1_ENABLED -#define MBEDTLS_ECP_DP_SECP224K1_ENABLED -#define MBEDTLS_ECP_DP_SECP256K1_ENABLED -#define MBEDTLS_ECP_DP_BP256R1_ENABLED -#define MBEDTLS_ECP_DP_BP384R1_ENABLED -#define MBEDTLS_ECP_DP_BP512R1_ENABLED -/* Montgomery curves (supporting ECP) */ -#define MBEDTLS_ECP_DP_CURVE25519_ENABLED -#define MBEDTLS_ECP_DP_CURVE448_ENABLED - -/** - * \def MBEDTLS_ECDSA_C - * - * Enable the elliptic curve DSA library. - * - * Module: library/ecdsa.c - * Caller: - * - * This module is used by the following key exchanges: - * ECDHE-ECDSA - * - * Requires: MBEDTLS_ECP_C, MBEDTLS_ASN1_WRITE_C, MBEDTLS_ASN1_PARSE_C, - * and at least one MBEDTLS_ECP_DP_XXX_ENABLED for a - * short Weierstrass curve. - */ -#define MBEDTLS_ECDSA_C - -/** - * \def MBEDTLS_ECDSA_DETERMINISTIC - * - * Enable deterministic ECDSA (RFC 6979). - * Standard ECDSA is "fragile" in the sense that lack of entropy when signing - * may result in a compromise of the long-term signing key. This is avoided by - * the deterministic variant. - * - * Requires: MBEDTLS_HMAC_DRBG_C, MBEDTLS_ECDSA_C - * - * Comment this macro to disable deterministic ECDSA. - */ -#define MBEDTLS_ECDSA_DETERMINISTIC - -/** - * \def MBEDTLS_ECJPAKE_C - * - * Enable the elliptic curve J-PAKE library. - * - * \note EC J-PAKE support is based on the Thread v1.0.0 specification. - * It has not been reviewed for compliance with newer standards such as - * Thread v1.1 or RFC 8236. - * - * Module: library/ecjpake.c - * Caller: - * - * This module is used by the following key exchanges: - * ECJPAKE - * - * Requires: MBEDTLS_ECP_C and either MBEDTLS_MD_C or MBEDTLS_PSA_CRYPTO_C - * - * \warning If using a hash that is only provided by PSA drivers, you must - * call psa_crypto_init() before doing any EC J-PAKE operations. - */ -#define MBEDTLS_ECJPAKE_C - -/** - * \def MBEDTLS_GCM_C - * - * Enable the Galois/Counter Mode (GCM). - * - * Module: library/gcm.c - * - * Requires: MBEDTLS_CIPHER_C, MBEDTLS_AES_C or MBEDTLS_CAMELLIA_C or - * MBEDTLS_ARIA_C - * - * This module enables the AES-GCM and CAMELLIA-GCM ciphersuites, if other - * requisites are enabled as well. - */ -#define MBEDTLS_GCM_C - -/** - * \def MBEDTLS_GENPRIME - * - * Enable the prime-number generation code. - * - * Requires: MBEDTLS_BIGNUM_C - */ -#define MBEDTLS_GENPRIME - -/** - * \def MBEDTLS_HKDF_C - * - * Enable the HKDF algorithm (RFC 5869). - * - * Module: library/hkdf.c - * Caller: - * - * Requires: MBEDTLS_MD_C - * - * This module adds support for the Hashed Message Authentication Code - * (HMAC)-based key derivation function (HKDF). - */ -#define MBEDTLS_HKDF_C - -/** - * \def MBEDTLS_HMAC_DRBG_C - * - * Enable the HMAC_DRBG random generator. - * - * Module: library/hmac_drbg.c - * Caller: - * - * Requires: MBEDTLS_MD_C - * - * Uncomment to enable the HMAC_DRBG random number generator. - */ -#define MBEDTLS_HMAC_DRBG_C - -/** - * \def MBEDTLS_MD5_C - * - * Enable the MD5 hash algorithm. - * - * Module: library/md5.c - * Caller: library/md.c - * library/pem.c - * library/ssl_tls.c - * - * This module is required for TLS 1.2 depending on the handshake parameters. - * Further, it is used for checking MD5-signed certificates, and for PBKDF1 - * when decrypting PEM-encoded encrypted keys. - * - * \warning MD5 is considered a weak message digest and its use constitutes a - * security risk. If possible, we recommend avoiding dependencies on - * it, and considering stronger message digests instead. - * - */ -#define MBEDTLS_MD5_C - -/** - * \def MBEDTLS_PKCS1_V15 - * - * Enable support for PKCS#1 v1.5 encoding. - * - * Requires: MBEDTLS_RSA_C - * - * This enables support for PKCS#1 v1.5 operations. - */ -#define MBEDTLS_PKCS1_V15 - -/** - * \def MBEDTLS_PKCS1_V21 - * - * Enable support for PKCS#1 v2.1 encoding. - * - * Requires: MBEDTLS_RSA_C - * - * \warning If using a hash that is only provided by PSA drivers, you must - * call psa_crypto_init() before doing any PKCS#1 v2.1 operation. - * - * This enables support for RSAES-OAEP and RSASSA-PSS operations. - */ -#define MBEDTLS_PKCS1_V21 - -/** - * \def MBEDTLS_POLY1305_C - * - * Enable the Poly1305 MAC algorithm. - * - * Module: library/poly1305.c - * Caller: library/chachapoly.c - */ -#define MBEDTLS_POLY1305_C - -/** - * \def MBEDTLS_RIPEMD160_C - * - * Enable the RIPEMD-160 hash algorithm. - * - * Module: library/ripemd160.c - * Caller: library/md.c - * - */ -#define MBEDTLS_RIPEMD160_C - -/** - * \def MBEDTLS_RSA_C - * - * Enable the RSA public-key cryptosystem. - * - * Module: library/rsa.c - * library/rsa_alt_helpers.c - * Caller: library/pk.c - * library/psa_crypto.c - * library/ssl_tls.c - * library/ssl*_client.c - * library/ssl*_server.c - * - * This module is used by the following key exchanges: - * RSA, ECDHE-RSA - * - * Requires: MBEDTLS_BIGNUM_C - */ -#define MBEDTLS_RSA_C - -/** - * \def MBEDTLS_SHA1_C - * - * Enable the SHA1 cryptographic hash algorithm. - * - * Module: library/sha1.c - * Caller: library/md.c - * library/psa_crypto_hash.c - * - * This module is required for TLS 1.2 depending on the handshake parameters, - * and for SHA1-signed certificates. - * - * \warning SHA-1 is considered a weak message digest and its use constitutes - * a security risk. If possible, we recommend avoiding dependencies - * on it, and considering stronger message digests instead. - * - */ -#define MBEDTLS_SHA1_C - -/** - * \def MBEDTLS_SHA224_C - * - * Enable the SHA-224 cryptographic hash algorithm. - * - * Module: library/sha256.c - * Caller: library/md.c - * library/ssl_cookie.c - * - * This module adds support for SHA-224. - */ -#define MBEDTLS_SHA224_C - -/** - * \def MBEDTLS_SHA256_C - * - * Enable the SHA-256 cryptographic hash algorithm. - * - * Module: library/sha256.c - * Caller: library/entropy.c - * library/md.c - * library/ssl_tls.c - * library/ssl*_client.c - * library/ssl*_server.c - * - * This module adds support for SHA-256. - * This module is required for the SSL/TLS 1.2 PRF function. - */ -#define MBEDTLS_SHA256_C - -/** - * \def MBEDTLS_SHA384_C - * - * Enable the SHA-384 cryptographic hash algorithm. - * - * Module: library/sha512.c - * Caller: library/md.c - * library/psa_crypto_hash.c - * library/ssl_tls.c - * library/ssl*_client.c - * library/ssl*_server.c - * - * Comment to disable SHA-384 - */ -#define MBEDTLS_SHA384_C - -/** - * \def MBEDTLS_SHA512_C - * - * Enable SHA-512 cryptographic hash algorithms. - * - * Module: library/sha512.c - * Caller: library/entropy.c - * library/md.c - * library/ssl_tls.c - * library/ssl_cookie.c - * - * This module adds support for SHA-512. - */ -#define MBEDTLS_SHA512_C - -/** \} name SECTION: Legacy cryptography */ - -#endif /* PSA_CRYPTO_CONFIG_H */ diff --git a/tf-psa-crypto/include/psa/crypto_driver_contexts_composites.h b/tf-psa-crypto/include/psa/crypto_driver_contexts_composites.h deleted file mode 100644 index 9f019f037c..0000000000 --- a/tf-psa-crypto/include/psa/crypto_driver_contexts_composites.h +++ /dev/null @@ -1,159 +0,0 @@ -/** - * \file crypto_driver_contexts_composites.h - * - * \brief Declaration of context structures for use with the PSA driver wrapper - * interface. This file contains the context structures for 'composite' - * operations, i.e. those operations which need to make use of other operations - * from the primitives (crypto_driver_contexts_primitives.h) - * - * \warning This file will be auto-generated in the future. - * - * \note This file may not be included directly. Applications must - * include psa/crypto.h. - * - * \note This header and its content are not part of the Mbed TLS API and - * applications must not depend on it. Its main purpose is to define the - * multi-part state objects of the PSA drivers included in the cryptographic - * library. The definitions of these objects are then used by crypto_struct.h - * to define the implementation-defined types of PSA multi-part state objects. - */ -/* Copyright The Mbed TLS Contributors - * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later - */ - -#ifndef PSA_CRYPTO_DRIVER_CONTEXTS_COMPOSITES_H -#define PSA_CRYPTO_DRIVER_CONTEXTS_COMPOSITES_H - -#include "psa/crypto_driver_common.h" - -/* Include the context structure definitions for the Mbed TLS software drivers */ -#include "psa/crypto_builtin_composites.h" - -/* Include the context structure definitions for those drivers that were - * declared during the autogeneration process. */ - -#if defined(MBEDTLS_TEST_LIBTESTDRIVER1) -#include -#endif - -#if defined(PSA_CRYPTO_DRIVER_TEST) -#if defined(MBEDTLS_TEST_LIBTESTDRIVER1) && \ - defined(LIBTESTDRIVER1_MBEDTLS_PSA_BUILTIN_MAC) -typedef libtestdriver1_mbedtls_psa_mac_operation_t - mbedtls_transparent_test_driver_mac_operation_t; -typedef libtestdriver1_mbedtls_psa_mac_operation_t - mbedtls_opaque_test_driver_mac_operation_t; - -#define MBEDTLS_TRANSPARENT_TEST_DRIVER_MAC_OPERATION_INIT \ - LIBTESTDRIVER1_MBEDTLS_PSA_MAC_OPERATION_INIT -#define MBEDTLS_OPAQUE_TEST_DRIVER_MAC_OPERATION_INIT \ - LIBTESTDRIVER1_MBEDTLS_PSA_MAC_OPERATION_INIT - -#else -typedef mbedtls_psa_mac_operation_t - mbedtls_transparent_test_driver_mac_operation_t; -typedef mbedtls_psa_mac_operation_t - mbedtls_opaque_test_driver_mac_operation_t; - -#define MBEDTLS_TRANSPARENT_TEST_DRIVER_MAC_OPERATION_INIT \ - MBEDTLS_PSA_MAC_OPERATION_INIT -#define MBEDTLS_OPAQUE_TEST_DRIVER_MAC_OPERATION_INIT \ - MBEDTLS_PSA_MAC_OPERATION_INIT - -#endif /* MBEDTLS_TEST_LIBTESTDRIVER1 && LIBTESTDRIVER1_MBEDTLS_PSA_BUILTIN_MAC */ - -#if defined(MBEDTLS_TEST_LIBTESTDRIVER1) && \ - defined(LIBTESTDRIVER1_MBEDTLS_PSA_BUILTIN_AEAD) -typedef libtestdriver1_mbedtls_psa_aead_operation_t - mbedtls_transparent_test_driver_aead_operation_t; - -#define MBEDTLS_TRANSPARENT_TEST_DRIVER_AEAD_OPERATION_INIT \ - LIBTESTDRIVER1_MBEDTLS_PSA_AEAD_OPERATION_INIT -#else -typedef mbedtls_psa_aead_operation_t - mbedtls_transparent_test_driver_aead_operation_t; - -#define MBEDTLS_TRANSPARENT_TEST_DRIVER_AEAD_OPERATION_INIT \ - MBEDTLS_PSA_AEAD_OPERATION_INIT - -#endif /* MBEDTLS_TEST_LIBTESTDRIVER1 && LIBTESTDRIVER1_MBEDTLS_PSA_BUILTIN_AEAD */ - -#if defined(MBEDTLS_TEST_LIBTESTDRIVER1) && \ - defined(LIBTESTDRIVER1_MBEDTLS_PSA_BUILTIN_PAKE) - -typedef libtestdriver1_mbedtls_psa_pake_operation_t - mbedtls_transparent_test_driver_pake_operation_t; -typedef libtestdriver1_mbedtls_psa_pake_operation_t - mbedtls_opaque_test_driver_pake_operation_t; - -#define MBEDTLS_TRANSPARENT_TEST_DRIVER_PAKE_OPERATION_INIT \ - LIBTESTDRIVER1_MBEDTLS_PSA_PAKE_OPERATION_INIT -#define MBEDTLS_OPAQUE_TEST_DRIVER_PAKE_OPERATION_INIT \ - LIBTESTDRIVER1_MBEDTLS_PSA_PAKE_OPERATION_INIT - -#else -typedef mbedtls_psa_pake_operation_t - mbedtls_transparent_test_driver_pake_operation_t; -typedef mbedtls_psa_pake_operation_t - mbedtls_opaque_test_driver_pake_operation_t; - -#define MBEDTLS_TRANSPARENT_TEST_DRIVER_PAKE_OPERATION_INIT \ - MBEDTLS_PSA_PAKE_OPERATION_INIT -#define MBEDTLS_OPAQUE_TEST_DRIVER_PAKE_OPERATION_INIT \ - MBEDTLS_PSA_PAKE_OPERATION_INIT - -#endif /* MBEDTLS_TEST_LIBTESTDRIVER1 && LIBTESTDRIVER1_MBEDTLS_PSA_BUILTIN_PAKE */ - -#endif /* PSA_CRYPTO_DRIVER_TEST */ - -/* Define the context to be used for an operation that is executed through the - * PSA Driver wrapper layer as the union of all possible driver's contexts. - * - * The union members are the driver's context structures, and the member names - * are formatted as `'drivername'_ctx`. This allows for procedural generation - * of both this file and the content of psa_crypto_driver_wrappers.h */ - -typedef union { - unsigned dummy; /* Make sure this union is always non-empty */ - mbedtls_psa_mac_operation_t mbedtls_ctx; -#if defined(PSA_CRYPTO_DRIVER_TEST) - mbedtls_transparent_test_driver_mac_operation_t transparent_test_driver_ctx; - mbedtls_opaque_test_driver_mac_operation_t opaque_test_driver_ctx; -#endif -#if defined(ESP_AES_DRIVER_ENABLED) - esp_cmac_operation_t esp_cmac_ctx; -#endif /* ESP_AES_DRIVER_ENABLED */ -} psa_driver_mac_context_t; - -typedef union { - unsigned dummy; /* Make sure this union is always non-empty */ - mbedtls_psa_aead_operation_t mbedtls_ctx; -#if defined(PSA_CRYPTO_DRIVER_TEST) - mbedtls_transparent_test_driver_aead_operation_t transparent_test_driver_ctx; -#endif -#if defined(ESP_AES_DRIVER_ENABLED) - esp_aes_gcm_operation_t esp_aes_gcm_ctx; -#endif -} psa_driver_aead_context_t; - -typedef union { - unsigned dummy; /* Make sure this union is always non-empty */ - mbedtls_psa_sign_hash_interruptible_operation_t mbedtls_ctx; -} psa_driver_sign_hash_interruptible_context_t; - -typedef union { - unsigned dummy; /* Make sure this union is always non-empty */ - mbedtls_psa_verify_hash_interruptible_operation_t mbedtls_ctx; -} psa_driver_verify_hash_interruptible_context_t; - -typedef union { - unsigned dummy; /* Make sure this union is always non-empty */ - mbedtls_psa_pake_operation_t mbedtls_ctx; -#if defined(PSA_CRYPTO_DRIVER_TEST) - mbedtls_transparent_test_driver_pake_operation_t transparent_test_driver_ctx; - mbedtls_opaque_test_driver_pake_operation_t opaque_test_driver_ctx; -#endif -} psa_driver_pake_context_t; - -#endif /* PSA_CRYPTO_DRIVER_CONTEXTS_COMPOSITES_H */ -/* End of automatically generated file. */ diff --git a/tf-psa-crypto/include/psa/crypto_driver_contexts_primitives.h b/tf-psa-crypto/include/psa/crypto_driver_contexts_primitives.h deleted file mode 100644 index 31fdc1266e..0000000000 --- a/tf-psa-crypto/include/psa/crypto_driver_contexts_primitives.h +++ /dev/null @@ -1,121 +0,0 @@ -/** - * \file crypto_driver_contexts_primitives.h - * - * \brief Declaration of context structures for use with the PSA driver wrapper - * interface. This file contains the context structures for 'primitive' - * operations, i.e. those operations which do not rely on other contexts. - * - * \warning This file will be auto-generated in the future. - * - * \note This file may not be included directly. Applications must - * include psa/crypto.h. - * - * \note This header and its content are not part of the Mbed TLS API and - * applications must not depend on it. Its main purpose is to define the - * multi-part state objects of the PSA drivers included in the cryptographic - * library. The definitions of these objects are then used by crypto_struct.h - * to define the implementation-defined types of PSA multi-part state objects. - */ -/* Copyright The Mbed TLS Contributors - * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later - */ - -#ifndef PSA_CRYPTO_DRIVER_CONTEXTS_PRIMITIVES_H -#define PSA_CRYPTO_DRIVER_CONTEXTS_PRIMITIVES_H - -#include "psa/crypto_driver_common.h" - -/* Include the context structure definitions for the Mbed TLS software drivers */ -#include "psa/crypto_builtin_primitives.h" - -/* Include the context structure definitions for those drivers that were - * declared during the autogeneration process. */ - -#if defined(MBEDTLS_TEST_LIBTESTDRIVER1) -#include -#endif - -#if defined(ESP_SHA_DRIVER_ENABLED) -#include "psa_crypto_driver_esp_sha_contexts.h" -#endif - -#if defined(ESP_AES_DRIVER_ENABLED) -#include "psa_crypto_driver_esp_aes_contexts.h" -#endif - -#if defined(PSA_CRYPTO_DRIVER_TEST) - -#if defined(MBEDTLS_TEST_LIBTESTDRIVER1) && \ - defined(LIBTESTDRIVER1_MBEDTLS_PSA_BUILTIN_CIPHER) -typedef libtestdriver1_mbedtls_psa_cipher_operation_t - mbedtls_transparent_test_driver_cipher_operation_t; - -#define MBEDTLS_TRANSPARENT_TEST_DRIVER_CIPHER_OPERATION_INIT \ - LIBTESTDRIVER1_MBEDTLS_PSA_CIPHER_OPERATION_INIT -#else -typedef mbedtls_psa_cipher_operation_t - mbedtls_transparent_test_driver_cipher_operation_t; - -#define MBEDTLS_TRANSPARENT_TEST_DRIVER_CIPHER_OPERATION_INIT \ - MBEDTLS_PSA_CIPHER_OPERATION_INIT -#endif /* MBEDTLS_TEST_LIBTESTDRIVER1 && - LIBTESTDRIVER1_MBEDTLS_PSA_BUILTIN_CIPHER */ - -#if defined(MBEDTLS_TEST_LIBTESTDRIVER1) && \ - defined(LIBTESTDRIVER1_MBEDTLS_PSA_BUILTIN_HASH) -typedef libtestdriver1_mbedtls_psa_hash_operation_t - mbedtls_transparent_test_driver_hash_operation_t; - -#define MBEDTLS_TRANSPARENT_TEST_DRIVER_HASH_OPERATION_INIT \ - LIBTESTDRIVER1_MBEDTLS_PSA_HASH_OPERATION_INIT -#else -typedef mbedtls_psa_hash_operation_t - mbedtls_transparent_test_driver_hash_operation_t; - -#define MBEDTLS_TRANSPARENT_TEST_DRIVER_HASH_OPERATION_INIT \ - MBEDTLS_PSA_HASH_OPERATION_INIT -#endif /* MBEDTLS_TEST_LIBTESTDRIVER1 && - LIBTESTDRIVER1_MBEDTLS_PSA_BUILTIN_HASH */ - -typedef struct { - unsigned int initialised : 1; - mbedtls_transparent_test_driver_cipher_operation_t ctx; -} mbedtls_opaque_test_driver_cipher_operation_t; - -#define MBEDTLS_OPAQUE_TEST_DRIVER_CIPHER_OPERATION_INIT \ - { 0, MBEDTLS_TRANSPARENT_TEST_DRIVER_CIPHER_OPERATION_INIT } - -#endif /* PSA_CRYPTO_DRIVER_TEST */ - -/* Define the context to be used for an operation that is executed through the - * PSA Driver wrapper layer as the union of all possible driver's contexts. - * - * The union members are the driver's context structures, and the member names - * are formatted as `'drivername'_ctx`. This allows for procedural generation - * of both this file and the content of psa_crypto_driver_wrappers.h */ - -typedef union { - unsigned dummy; /* Make sure this union is always non-empty */ - mbedtls_psa_hash_operation_t mbedtls_ctx; -#if defined(PSA_CRYPTO_DRIVER_TEST) - mbedtls_transparent_test_driver_hash_operation_t test_driver_ctx; -#endif -#if defined(ESP_SHA_DRIVER_ENABLED) - esp_sha_hash_operation_t esp_ctx; -#endif -} psa_driver_hash_context_t; - -typedef union { - unsigned dummy; /* Make sure this union is always non-empty */ - mbedtls_psa_cipher_operation_t mbedtls_ctx; -#if defined(PSA_CRYPTO_DRIVER_TEST) - mbedtls_transparent_test_driver_cipher_operation_t transparent_test_driver_ctx; - mbedtls_opaque_test_driver_cipher_operation_t opaque_test_driver_ctx; -#endif -#if defined(ESP_AES_DRIVER_ENABLED) - esp_aes_operation_t esp_aes_ctx; -#endif -} psa_driver_cipher_context_t; - -#endif /* PSA_CRYPTO_DRIVER_CONTEXTS_PRIMITIVES_H */ -/* End of automatically generated file. */ diff --git a/tf-psa-crypto/scripts/data_files/driver_jsons/driverlist.json b/tf-psa-crypto/scripts/data_files/driver_jsons/driverlist.json deleted file mode 100644 index ad7800fbdf..0000000000 --- a/tf-psa-crypto/scripts/data_files/driver_jsons/driverlist.json +++ /dev/null @@ -1 +0,0 @@ -["mbedtls_test_opaque_driver.json","mbedtls_test_transparent_driver.json","p256_transparent_driver.json", "esp_sha_driver.json", "esp_aes_driver.json", "esp_cmac_driver.json"] diff --git a/tf-psa-crypto/scripts/data_files/driver_jsons/esp_aes_driver.json b/tf-psa-crypto/scripts/data_files/driver_jsons/esp_aes_driver.json deleted file mode 100644 index 2abe58de99..0000000000 --- a/tf-psa-crypto/scripts/data_files/driver_jsons/esp_aes_driver.json +++ /dev/null @@ -1,15 +0,0 @@ -{ - "prefix": "esp_aes", - "type": "transparent", - "mbedtls/h_condition": "defined(ESP_AES_DRIVER_ENABLED)", - "headers": ["../../../port/psa_driver/include/psa_crypto_driver_esp_aes.h", "../../../port/psa_driver/include/psa_crypto_driver_esp_aes_gcm.h"], - "capabilities": [ - { - "mbedtls/c_condition": "defined(ESP_AES_DRIVER_ENABLED)", - "_comment": "This driver will support AES operations using the ESP hardware accelerator.", - "entry_points": ["cipher_encrypt", "cipher_decrypt", "cipher_encrypt_setup", "cipher_decrypt_setup", "cipher_set_iv", "cipher_update", "cipher_finish", "cipher_abort"], - "algorithms": ["PSA_ALG_AES_CBC", "PSA_ALG_AES_GCM"], - "fallback": false - } - ] -} diff --git a/tf-psa-crypto/scripts/data_files/driver_jsons/esp_cmac_driver.json b/tf-psa-crypto/scripts/data_files/driver_jsons/esp_cmac_driver.json deleted file mode 100644 index 326ec036d5..0000000000 --- a/tf-psa-crypto/scripts/data_files/driver_jsons/esp_cmac_driver.json +++ /dev/null @@ -1,15 +0,0 @@ -{ - "prefix": "esp_cmac", - "type": "transparent", - "mbedtls/h_condition": "defined(ESP_AES_DRIVER_ENABLED)", - "headers": ["../../../port/psa_driver/include/psa_crypto_driver_esp_cmac.h"], - "capabilities": [ - { - "mbedtls/c_condition": "defined(ESP_AES_DRIVER_ENABLED)", - "_comment": "This driver will support CMAC operations using the ESP hardware accelerator.", - "entry_points": ["mac_setup", "mac_update", "mac_finish", "mac_abort", "mac_compute"], - "algorithms": ["PSA_ALG_CMAC"], - "fallback": false - } - ] -} diff --git a/tf-psa-crypto/scripts/data_files/driver_jsons/esp_sha_driver.json b/tf-psa-crypto/scripts/data_files/driver_jsons/esp_sha_driver.json deleted file mode 100644 index 4f6b651876..0000000000 --- a/tf-psa-crypto/scripts/data_files/driver_jsons/esp_sha_driver.json +++ /dev/null @@ -1,15 +0,0 @@ -{ - "prefix": "esp_sha", - "type": "transparent", - "mbedtls/h_condition": "defined(ESP_SHA_DRIVER_ENABLED)", - "headers": ["../../../port/psa_driver/include/psa_crypto_driver_esp_sha.h"], - "capabilities": [ - { - "mbedtls/c_condition": "defined(ESP_SHA_DRIVER_ENABLED)", - "_comment": "This driver will support SHA operations using the ESP hardware accelerator.", - "entry_points": ["hash_setup", "hash_update", "hash_finish", "hash_abort", "hash_compute"], - "algorithms": ["PSA_ALG_SHA_1", "PSA_ALG_SHA_256"], - "fallback": false - } - ] -} diff --git a/tf-psa-crypto/scripts/data_files/driver_templates/psa_crypto_driver_wrappers.h.jinja b/tf-psa-crypto/scripts/data_files/driver_templates/psa_crypto_driver_wrappers.h.jinja deleted file mode 100644 index 126b40f2fb..0000000000 --- a/tf-psa-crypto/scripts/data_files/driver_templates/psa_crypto_driver_wrappers.h.jinja +++ /dev/null @@ -1,3002 +0,0 @@ -/* - * Functions to delegate cryptographic operations to an available - * and appropriate accelerator. - * Warning: This file is now auto-generated. - */ -/* Copyright The Mbed TLS Contributors - * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later - */ - - -/* BEGIN-common headers */ -#include "common.h" -#include "psa_crypto_aead.h" -#include "psa_crypto_cipher.h" -#include "psa_crypto_core.h" -#include "psa_crypto_driver_wrappers_no_static.h" -#include "psa_crypto_hash.h" -#include "psa_crypto_mac.h" -#include "psa_crypto_pake.h" -#include "psa_crypto_rsa.h" - -#include "mbedtls/platform.h" -#include "mbedtls/constant_time.h" -/* END-common headers */ - -#if defined(MBEDTLS_PSA_CRYPTO_C) - -/* BEGIN-driver headers */ -{% for driver in drivers -%} -/* Headers for {{driver.prefix}} {{driver.type}} driver */ -{% if driver['mbedtls/h_condition'] is defined -%} -#if {{ driver['mbedtls/h_condition'] }} -{% endif -%} -{% for header in driver.headers -%} -#include "{{ header }}" -{% endfor %} -{% if driver['mbedtls/h_condition'] is defined -%} -#endif -{% endif -%} -{% endfor %} -/* END-driver headers */ - -/* Auto-generated values depending on which drivers are registered. - * ID 0 is reserved for unallocated operations. - * ID 1 is reserved for the Mbed TLS software driver. */ -/* BEGIN-driver id definition */ -#define PSA_CRYPTO_MBED_TLS_DRIVER_ID (1) -{% for driver in drivers -%} -#define {{(driver.prefix + "_" + driver.type + "_driver_id").upper()}} ({{ loop.index + 1 }}) -{% endfor %} -/* END-driver id */ - -/* BEGIN-Common Macro definitions */ -{% macro entry_point_name(capability, entry_point, driver) -%} - {% if capability.name is defined and entry_point in capability.names.keys() -%} - {{ capability.names[entry_point]}} - {% else -%} - {{driver.prefix}}_{{driver.type}}_{{entry_point}} - {% endif -%} -{% endmacro %} -/* END-Common Macro definitions */ - -static inline psa_status_t psa_driver_wrapper_init( void ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_init( ); - if( status != PSA_SUCCESS ) - return( status ); - - status = mbedtls_test_opaque_init( ); - if( status != PSA_SUCCESS ) - return( status ); -#endif - - (void) status; - return( PSA_SUCCESS ); -} - -static inline void psa_driver_wrapper_free( void ) -{ -#if defined(PSA_CRYPTO_DRIVER_TEST) - mbedtls_test_transparent_free( ); - mbedtls_test_opaque_free( ); -#endif -} - -/* Start delegation functions */ -static inline psa_status_t psa_driver_wrapper_sign_message( - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, - size_t key_buffer_size, - psa_algorithm_t alg, - const uint8_t *input, - size_t input_length, - uint8_t *signature, - size_t signature_size, - size_t *signature_length ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_signature_sign_message( - attributes, - key_buffer, - key_buffer_size, - alg, - input, - input_length, - signature, - signature_size, - signature_length ); - /* Declared with fallback == true */ - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - break; - - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: - status = mbedtls_test_opaque_signature_sign_message( - attributes, - key_buffer, - key_buffer_size, - alg, - input, - input_length, - signature, - signature_size, - signature_length ); - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); - break; -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - /* Key is declared with a lifetime not known to us */ - (void)status; - break; - } - - return( psa_sign_message_builtin( attributes, - key_buffer, - key_buffer_size, - alg, - input, - input_length, - signature, - signature_size, - signature_length ) ); -} - -static inline psa_status_t psa_driver_wrapper_verify_message( - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, - size_t key_buffer_size, - psa_algorithm_t alg, - const uint8_t *input, - size_t input_length, - const uint8_t *signature, - size_t signature_length ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_signature_verify_message( - attributes, - key_buffer, - key_buffer_size, - alg, - input, - input_length, - signature, - signature_length ); - /* Declared with fallback == true */ - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - break; - - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: - return( mbedtls_test_opaque_signature_verify_message( - attributes, - key_buffer, - key_buffer_size, - alg, - input, - input_length, - signature, - signature_length ) ); - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); - break; -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - /* Key is declared with a lifetime not known to us */ - (void)status; - break; - } - - return( psa_verify_message_builtin( attributes, - key_buffer, - key_buffer_size, - alg, - input, - input_length, - signature, - signature_length ) ); -} - -static inline psa_status_t psa_driver_wrapper_sign_hash( - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, size_t key_buffer_size, - psa_algorithm_t alg, const uint8_t *hash, size_t hash_length, - uint8_t *signature, size_t signature_size, size_t *signature_length ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_signature_sign_hash( attributes, - key_buffer, - key_buffer_size, - alg, - hash, - hash_length, - signature, - signature_size, - signature_length ); - /* Declared with fallback == true */ - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#if defined (MBEDTLS_PSA_P256M_DRIVER_ENABLED) - if( PSA_KEY_TYPE_IS_ECC( psa_get_key_type(attributes) ) && - PSA_ALG_IS_RANDOMIZED_ECDSA(alg) && - PSA_KEY_TYPE_ECC_GET_FAMILY(psa_get_key_type(attributes)) == PSA_ECC_FAMILY_SECP_R1 && - psa_get_key_bits(attributes) == 256 ) - { - status = p256_transparent_sign_hash( attributes, - key_buffer, - key_buffer_size, - alg, - hash, - hash_length, - signature, - signature_size, - signature_length ); - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); - } -#endif /* MBEDTLS_PSA_P256M_DRIVER_ENABLED */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - /* Fell through, meaning no accelerator supports this operation */ - return( psa_sign_hash_builtin( attributes, - key_buffer, - key_buffer_size, - alg, - hash, - hash_length, - signature, - signature_size, - signature_length ) ); - - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: - return( mbedtls_test_opaque_signature_sign_hash( attributes, - key_buffer, - key_buffer_size, - alg, - hash, - hash_length, - signature, - signature_size, - signature_length ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - /* Key is declared with a lifetime not known to us */ - (void)status; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_verify_hash( - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, size_t key_buffer_size, - psa_algorithm_t alg, const uint8_t *hash, size_t hash_length, - const uint8_t *signature, size_t signature_length ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_signature_verify_hash( - attributes, - key_buffer, - key_buffer_size, - alg, - hash, - hash_length, - signature, - signature_length ); - /* Declared with fallback == true */ - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#if defined (MBEDTLS_PSA_P256M_DRIVER_ENABLED) - if( PSA_KEY_TYPE_IS_ECC( psa_get_key_type(attributes) ) && - PSA_ALG_IS_ECDSA(alg) && - PSA_KEY_TYPE_ECC_GET_FAMILY(psa_get_key_type(attributes)) == PSA_ECC_FAMILY_SECP_R1 && - psa_get_key_bits(attributes) == 256 ) - { - status = p256_transparent_verify_hash( attributes, - key_buffer, - key_buffer_size, - alg, - hash, - hash_length, - signature, - signature_length ); - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); - } -#endif /* MBEDTLS_PSA_P256M_DRIVER_ENABLED */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - return( psa_verify_hash_builtin( attributes, - key_buffer, - key_buffer_size, - alg, - hash, - hash_length, - signature, - signature_length ) ); - - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: - return( mbedtls_test_opaque_signature_verify_hash( attributes, - key_buffer, - key_buffer_size, - alg, - hash, - hash_length, - signature, - signature_length ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - /* Key is declared with a lifetime not known to us */ - (void)status; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline uint32_t psa_driver_wrapper_sign_hash_get_num_ops( - psa_sign_hash_interruptible_operation_t *operation ) -{ - switch( operation->id ) - { - /* If uninitialised, return 0, as no work can have been done. */ - case 0: - return 0; - - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return(mbedtls_psa_sign_hash_get_num_ops(&operation->ctx.mbedtls_ctx)); - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - /* Add test driver tests here */ - -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - } - - /* Can't happen (see discussion in #8271) */ - return 0; -} - -static inline uint32_t psa_driver_wrapper_verify_hash_get_num_ops( - psa_verify_hash_interruptible_operation_t *operation ) -{ - switch( operation->id ) - { - /* If uninitialised, return 0, as no work can have been done. */ - case 0: - return 0; - - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return (mbedtls_psa_verify_hash_get_num_ops(&operation->ctx.mbedtls_ctx)); - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - /* Add test driver tests here */ - -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - } - - /* Can't happen (see discussion in #8271) */ - return 0; -} - -static inline psa_status_t psa_driver_wrapper_sign_hash_start( - psa_sign_hash_interruptible_operation_t *operation, - const psa_key_attributes_t *attributes, const uint8_t *key_buffer, - size_t key_buffer_size, psa_algorithm_t alg, - const uint8_t *hash, size_t hash_length ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION( - psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - - /* Add test driver tests here */ - - /* Declared with fallback == true */ - -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - /* Fell through, meaning no accelerator supports this operation */ - operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; - status = mbedtls_psa_sign_hash_start( &operation->ctx.mbedtls_ctx, - attributes, - key_buffer, key_buffer_size, - alg, hash, hash_length ); - break; - - /* Add cases for opaque driver here */ - - default: - /* Key is declared with a lifetime not known to us */ - status = PSA_ERROR_INVALID_ARGUMENT; - break; - } - - return( status ); -} - -static inline psa_status_t psa_driver_wrapper_sign_hash_complete( - psa_sign_hash_interruptible_operation_t *operation, - uint8_t *signature, size_t signature_size, - size_t *signature_length ) -{ - switch( operation->id ) - { - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_sign_hash_complete( &operation->ctx.mbedtls_ctx, - signature, signature_size, - signature_length ) ); - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - /* Add test driver tests here */ - -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - } - - ( void ) signature; - ( void ) signature_size; - ( void ) signature_length; - - return( PSA_ERROR_INVALID_ARGUMENT ); -} - -static inline psa_status_t psa_driver_wrapper_sign_hash_abort( - psa_sign_hash_interruptible_operation_t *operation ) -{ - switch( operation->id ) - { - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_sign_hash_abort( &operation->ctx.mbedtls_ctx ) ); - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - /* Add test driver tests here */ - -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - } - - return( PSA_ERROR_INVALID_ARGUMENT ); -} - -static inline psa_status_t psa_driver_wrapper_verify_hash_start( - psa_verify_hash_interruptible_operation_t *operation, - const psa_key_attributes_t *attributes, const uint8_t *key_buffer, - size_t key_buffer_size, psa_algorithm_t alg, - const uint8_t *hash, size_t hash_length, - const uint8_t *signature, size_t signature_length ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION( - psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - - /* Add test driver tests here */ - - /* Declared with fallback == true */ - -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - /* Fell through, meaning no accelerator supports this operation */ - operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; - status = mbedtls_psa_verify_hash_start( &operation->ctx.mbedtls_ctx, - attributes, - key_buffer, key_buffer_size, - alg, hash, hash_length, - signature, signature_length ); - break; - - /* Add cases for opaque driver here */ - - default: - /* Key is declared with a lifetime not known to us */ - status = PSA_ERROR_INVALID_ARGUMENT; - break; - } - - return( status ); -} - -static inline psa_status_t psa_driver_wrapper_verify_hash_complete( - psa_verify_hash_interruptible_operation_t *operation ) -{ - switch( operation->id ) - { - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_verify_hash_complete( - &operation->ctx.mbedtls_ctx - ) ); - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - /* Add test driver tests here */ - -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - } - - return( PSA_ERROR_INVALID_ARGUMENT ); -} - -static inline psa_status_t psa_driver_wrapper_verify_hash_abort( - psa_verify_hash_interruptible_operation_t *operation ) -{ - switch( operation->id ) - { - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_verify_hash_abort( &operation->ctx.mbedtls_ctx - ) ); - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - /* Add test driver tests here */ - -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - } - - return( PSA_ERROR_INVALID_ARGUMENT ); -} - -/** Calculate the key buffer size required to store the key material of a key - * associated with an opaque driver from input key data. - * - * \param[in] attributes The key attributes - * \param[in] data The input key data. - * \param[in] data_length The input data length. - * \param[out] key_buffer_size Minimum buffer size to contain the key material. - * - * \retval #PSA_SUCCESS \emptydescription - * \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription - * \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription - */ -static inline psa_status_t psa_driver_wrapper_get_key_buffer_size_from_key_data( - const psa_key_attributes_t *attributes, - const uint8_t *data, - size_t data_length, - size_t *key_buffer_size ) -{ - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - psa_key_type_t key_type = psa_get_key_type(attributes); - - *key_buffer_size = 0; - switch( location ) - { -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: - *key_buffer_size = mbedtls_test_opaque_size_function( key_type, - PSA_BYTES_TO_BITS( data_length ) ); - return( ( *key_buffer_size != 0 ) ? - PSA_SUCCESS : PSA_ERROR_NOT_SUPPORTED ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ - - default: - (void)key_type; - (void)data; - (void)data_length; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_generate_key( - const psa_key_attributes_t *attributes, - const psa_custom_key_parameters_t *custom, - const uint8_t *custom_data, size_t custom_data_length, - uint8_t *key_buffer, size_t key_buffer_size, size_t *key_buffer_length ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)); - -#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE) - int is_default_production = - psa_custom_key_parameters_are_default(custom, custom_data_length); - if( location != PSA_KEY_LOCATION_LOCAL_STORAGE && !is_default_production ) - { - /* We don't support passing custom production parameters - * to drivers yet. */ - return PSA_ERROR_NOT_SUPPORTED; - } -#else - int is_default_production = 1; - (void) is_default_production; -#endif - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) - /* Transparent drivers are limited to generating asymmetric keys. */ - /* We don't support passing custom production parameters - * to drivers yet. */ - if( PSA_KEY_TYPE_IS_ASYMMETRIC( psa_get_key_type(attributes) ) && - is_default_production ) - { - /* Cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_generate_key( - attributes, key_buffer, key_buffer_size, - key_buffer_length ); - /* Declared with fallback == true */ - if( status != PSA_ERROR_NOT_SUPPORTED ) - break; -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#if defined(MBEDTLS_PSA_P256M_DRIVER_ENABLED) - if( PSA_KEY_TYPE_IS_ECC( psa_get_key_type(attributes) ) && - psa_get_key_type(attributes) == PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1) && - psa_get_key_bits(attributes) == 256 ) - { - status = p256_transparent_generate_key( attributes, - key_buffer, - key_buffer_size, - key_buffer_length ); - if( status != PSA_ERROR_NOT_SUPPORTED ) - break; - } - -#endif /* MBEDTLS_PSA_P256M_DRIVER_ENABLED */ - } -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - /* Software fallback */ - status = psa_generate_key_internal( - attributes, custom, custom_data, custom_data_length, - key_buffer, key_buffer_size, key_buffer_length ); - break; - - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: - status = mbedtls_test_opaque_generate_key( - attributes, key_buffer, key_buffer_size, key_buffer_length ); - break; -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - default: - /* Key is declared with a lifetime not known to us */ - status = PSA_ERROR_INVALID_ARGUMENT; - break; - } - - return( status ); -} - -static inline psa_status_t psa_driver_wrapper_import_key( - const psa_key_attributes_t *attributes, - const uint8_t *data, - size_t data_length, - uint8_t *key_buffer, - size_t key_buffer_size, - size_t *key_buffer_length, - size_t *bits ) -{ -{% with entry_point = "import_key" -%} -{% macro entry_point_param(driver) -%} -attributes, -data, -data_length, -key_buffer, -key_buffer_size, -key_buffer_length, -bits -{% endmacro %} - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION( - psa_get_key_lifetime( attributes ) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -{% with nest_indent=12 %} -{% include "OS-template-transparent.jinja" -%} -{% endwith -%} -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - /* Fell through, meaning no accelerator supports this operation */ - return( psa_import_key_into_slot( attributes, - data, data_length, - key_buffer, key_buffer_size, - key_buffer_length, bits ) ); - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -{% with nest_indent=8 %} -{% include "OS-template-opaque.jinja" -%} -{% endwith -%} -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - (void)status; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -{% endwith %} -} - -static inline psa_status_t psa_driver_wrapper_export_key( - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, size_t key_buffer_size, - uint8_t *data, size_t data_size, size_t *data_length ) - -{ -{% with entry_point = "export_key" -%} -{% macro entry_point_param(driver) -%} -attributes, -key_buffer, -key_buffer_size, -data, -data_size, -data_length -{% endmacro %} - psa_status_t status = PSA_ERROR_INVALID_ARGUMENT; - psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION( - psa_get_key_lifetime( attributes ) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - return( psa_export_key_internal( attributes, - key_buffer, - key_buffer_size, - data, - data_size, - data_length ) ); - - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -{% with nest_indent=8 %} -{% include "OS-template-opaque.jinja" -%} -{% endwith -%} -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - /* Key is declared with a lifetime not known to us */ - return( status ); - } -{% endwith %} -} - -static inline psa_status_t psa_driver_wrapper_copy_key( - psa_key_attributes_t *attributes, - const uint8_t *source_key, size_t source_key_length, - uint8_t *target_key_buffer, size_t target_key_buffer_size, - size_t *target_key_buffer_length ) -{ -{% with entry_point = "copy_key" -%} -{% macro entry_point_param(driver) -%} -attributes, -source_key, -source_key_length, -target_key_buffer, -target_key_buffer_size, -target_key_buffer_length -{% endmacro %} - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -{% with nest_indent=8 %} -{% include "OS-template-opaque.jinja" -%} -{% endwith -%} -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - (void)source_key; - (void)source_key_length; - (void)target_key_buffer; - (void)target_key_buffer_size; - (void)target_key_buffer_length; - status = PSA_ERROR_INVALID_ARGUMENT; - } - return( status ); -{% endwith %} -} - -/* - * Cipher functions - */ -static inline psa_status_t psa_driver_wrapper_cipher_encrypt( - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, - size_t key_buffer_size, - psa_algorithm_t alg, - const uint8_t *iv, - size_t iv_length, - const uint8_t *input, - size_t input_length, - uint8_t *output, - size_t output_size, - size_t *output_length ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_cipher_encrypt( attributes, - key_buffer, - key_buffer_size, - alg, - iv, - iv_length, - input, - input_length, - output, - output_size, - output_length ); - /* Declared with fallback == true */ - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#if defined(ESP_AES_DRIVER_ENABLED) - return esp_aes_cipher_encrypt(attributes, - key_buffer, - key_buffer_size, - alg, - iv, - iv_length, - input, - input_length, - output, - output_size, - output_length ); -#endif /* ESP_AES_DRIVER_ENABLED */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - -#if defined(MBEDTLS_PSA_BUILTIN_CIPHER) - return( mbedtls_psa_cipher_encrypt( attributes, - key_buffer, - key_buffer_size, - alg, - iv, - iv_length, - input, - input_length, - output, - output_size, - output_length ) ); -#else - return( PSA_ERROR_NOT_SUPPORTED ); -#endif /* MBEDTLS_PSA_BUILTIN_CIPHER */ - - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: - return( mbedtls_test_opaque_cipher_encrypt( attributes, - key_buffer, - key_buffer_size, - alg, - iv, - iv_length, - input, - input_length, - output, - output_size, - output_length ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - default: - /* Key is declared with a lifetime not known to us */ - (void)status; - (void)key_buffer; - (void)key_buffer_size; - (void)alg; - (void)iv; - (void)iv_length; - (void)input; - (void)input_length; - (void)output; - (void)output_size; - (void)output_length; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_cipher_decrypt( - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, - size_t key_buffer_size, - psa_algorithm_t alg, - const uint8_t *input, - size_t input_length, - uint8_t *output, - size_t output_size, - size_t *output_length ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(ESP_AES_DRIVER_ENABLED) - return esp_aes_cipher_decrypt(attributes, - key_buffer, - key_buffer_size, - alg, - input, - input_length, - output, - output_size, - output_length ); -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_cipher_decrypt( attributes, - key_buffer, - key_buffer_size, - alg, - input, - input_length, - output, - output_size, - output_length ); - /* Declared with fallback == true */ - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - -#if defined(MBEDTLS_PSA_BUILTIN_CIPHER) - return( mbedtls_psa_cipher_decrypt( attributes, - key_buffer, - key_buffer_size, - alg, - input, - input_length, - output, - output_size, - output_length ) ); -#else - return( PSA_ERROR_NOT_SUPPORTED ); -#endif /* MBEDTLS_PSA_BUILTIN_CIPHER */ - - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: - return( mbedtls_test_opaque_cipher_decrypt( attributes, - key_buffer, - key_buffer_size, - alg, - input, - input_length, - output, - output_size, - output_length ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - default: - /* Key is declared with a lifetime not known to us */ - (void)status; - (void)key_buffer; - (void)key_buffer_size; - (void)alg; - (void)input; - (void)input_length; - (void)output; - (void)output_size; - (void)output_length; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_cipher_encrypt_setup( - psa_cipher_operation_t *operation, - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, size_t key_buffer_size, - psa_algorithm_t alg ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(ESP_AES_DRIVER_ENABLED) - status = esp_aes_cipher_encrypt_setup( &operation->ctx.esp_aes_ctx, - attributes, - key_buffer, - key_buffer_size, - alg ); - if (status == PSA_SUCCESS) { - operation->id = ESP_AES_TRANSPARENT_DRIVER_ID; - } - return status; -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_cipher_encrypt_setup( - &operation->ctx.transparent_test_driver_ctx, - attributes, - key_buffer, - key_buffer_size, - alg ); - /* Declared with fallback == true */ - if( status == PSA_SUCCESS ) - operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID; - - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ -#if defined(MBEDTLS_PSA_BUILTIN_CIPHER) - /* Fell through, meaning no accelerator supports this operation */ - status = mbedtls_psa_cipher_encrypt_setup( &operation->ctx.mbedtls_ctx, - attributes, - key_buffer, - key_buffer_size, - alg ); - if( status == PSA_SUCCESS ) - operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; - - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* MBEDTLS_PSA_BUILTIN_CIPHER */ - return( PSA_ERROR_NOT_SUPPORTED ); - - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: - status = mbedtls_test_opaque_cipher_encrypt_setup( - &operation->ctx.opaque_test_driver_ctx, - attributes, - key_buffer, key_buffer_size, - alg ); - - if( status == PSA_SUCCESS ) - operation->id = MBEDTLS_TEST_OPAQUE_DRIVER_ID; - - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - /* Key is declared with a lifetime not known to us */ - (void)status; - (void)operation; - (void)key_buffer; - (void)key_buffer_size; - (void)alg; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_cipher_decrypt_setup( - psa_cipher_operation_t *operation, - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, size_t key_buffer_size, - psa_algorithm_t alg ) -{ - psa_status_t status = PSA_ERROR_INVALID_ARGUMENT; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(ESP_AES_DRIVER_ENABLED) - status = esp_aes_cipher_decrypt_setup( &operation->ctx.esp_aes_ctx, - attributes, - key_buffer, - key_buffer_size, - alg ); - if (status == PSA_SUCCESS) { - operation->id = ESP_AES_TRANSPARENT_DRIVER_ID; - } - return status; -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_cipher_decrypt_setup( - &operation->ctx.transparent_test_driver_ctx, - attributes, - key_buffer, - key_buffer_size, - alg ); - /* Declared with fallback == true */ - if( status == PSA_SUCCESS ) - operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID; - - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ -#if defined(MBEDTLS_PSA_BUILTIN_CIPHER) - /* Fell through, meaning no accelerator supports this operation */ - status = mbedtls_psa_cipher_decrypt_setup( &operation->ctx.mbedtls_ctx, - attributes, - key_buffer, - key_buffer_size, - alg ); - if( status == PSA_SUCCESS ) - operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; - - return( status ); -#else /* MBEDTLS_PSA_BUILTIN_CIPHER */ - return( PSA_ERROR_NOT_SUPPORTED ); -#endif /* MBEDTLS_PSA_BUILTIN_CIPHER */ - - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: - status = mbedtls_test_opaque_cipher_decrypt_setup( - &operation->ctx.opaque_test_driver_ctx, - attributes, - key_buffer, key_buffer_size, - alg ); - - if( status == PSA_SUCCESS ) - operation->id = MBEDTLS_TEST_OPAQUE_DRIVER_ID; - - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - /* Key is declared with a lifetime not known to us */ - (void)status; - (void)operation; - (void)key_buffer; - (void)key_buffer_size; - (void)alg; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_cipher_set_iv( - psa_cipher_operation_t *operation, - const uint8_t *iv, - size_t iv_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_CIPHER) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_cipher_set_iv( &operation->ctx.mbedtls_ctx, - iv, - iv_length ) ); -#endif /* MBEDTLS_PSA_BUILTIN_CIPHER */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(ESP_AES_DRIVER_ENABLED) - case ESP_AES_TRANSPARENT_DRIVER_ID: - return( esp_aes_cipher_set_iv( - &operation->ctx.esp_aes_ctx, - iv, iv_length ) ); -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_cipher_set_iv( - &operation->ctx.transparent_test_driver_ctx, - iv, iv_length ) ); - - case MBEDTLS_TEST_OPAQUE_DRIVER_ID: - return( mbedtls_test_opaque_cipher_set_iv( - &operation->ctx.opaque_test_driver_ctx, - iv, iv_length ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - } - - (void)iv; - (void)iv_length; - - return( PSA_ERROR_INVALID_ARGUMENT ); -} - -static inline psa_status_t psa_driver_wrapper_cipher_update( - psa_cipher_operation_t *operation, - const uint8_t *input, - size_t input_length, - uint8_t *output, - size_t output_size, - size_t *output_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_CIPHER) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_cipher_update( &operation->ctx.mbedtls_ctx, - input, - input_length, - output, - output_size, - output_length ) ); -#endif /* MBEDTLS_PSA_BUILTIN_CIPHER */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(ESP_AES_DRIVER_ENABLED) - case ESP_AES_TRANSPARENT_DRIVER_ID: - return( esp_aes_cipher_update( &operation->ctx.esp_aes_ctx, - input, - input_length, - output, - output_size, - output_length ) ); -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_cipher_update( - &operation->ctx.transparent_test_driver_ctx, - input, input_length, - output, output_size, output_length ) ); - - case MBEDTLS_TEST_OPAQUE_DRIVER_ID: - return( mbedtls_test_opaque_cipher_update( - &operation->ctx.opaque_test_driver_ctx, - input, input_length, - output, output_size, output_length ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - } - - (void)input; - (void)input_length; - (void)output; - (void)output_size; - (void)output_length; - - return( PSA_ERROR_INVALID_ARGUMENT ); -} - -static inline psa_status_t psa_driver_wrapper_cipher_finish( - psa_cipher_operation_t *operation, - uint8_t *output, - size_t output_size, - size_t *output_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_CIPHER) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_cipher_finish( &operation->ctx.mbedtls_ctx, - output, - output_size, - output_length ) ); -#endif /* MBEDTLS_PSA_BUILTIN_CIPHER */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(ESP_AES_DRIVER_ENABLED) - case ESP_AES_TRANSPARENT_DRIVER_ID: - return( esp_aes_cipher_finish( &operation->ctx.esp_aes_ctx, - output, - output_size, - output_length ) ); -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_cipher_finish( - &operation->ctx.transparent_test_driver_ctx, - output, output_size, output_length ) ); - - case MBEDTLS_TEST_OPAQUE_DRIVER_ID: - return( mbedtls_test_opaque_cipher_finish( - &operation->ctx.opaque_test_driver_ctx, - output, output_size, output_length ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - } - - (void)output; - (void)output_size; - (void)output_length; - - return( PSA_ERROR_INVALID_ARGUMENT ); -} - -static inline psa_status_t psa_driver_wrapper_cipher_abort( - psa_cipher_operation_t *operation ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_CIPHER) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_cipher_abort( &operation->ctx.mbedtls_ctx ) ); -#endif /* MBEDTLS_PSA_BUILTIN_CIPHER */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(ESP_AES_DRIVER_ENABLED) - case ESP_AES_TRANSPARENT_DRIVER_ID: - return( esp_aes_cipher_abort( &operation->ctx.esp_aes_ctx ) ); -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - status = mbedtls_test_transparent_cipher_abort( - &operation->ctx.transparent_test_driver_ctx ); - mbedtls_platform_zeroize( - &operation->ctx.transparent_test_driver_ctx, - sizeof( operation->ctx.transparent_test_driver_ctx ) ); - return( status ); - - case MBEDTLS_TEST_OPAQUE_DRIVER_ID: - status = mbedtls_test_opaque_cipher_abort( - &operation->ctx.opaque_test_driver_ctx ); - mbedtls_platform_zeroize( - &operation->ctx.opaque_test_driver_ctx, - sizeof( operation->ctx.opaque_test_driver_ctx ) ); - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - } - - (void)status; - return( PSA_ERROR_INVALID_ARGUMENT ); -} - -/* - * Hashing functions - */ -static inline psa_status_t psa_driver_wrapper_hash_compute( - psa_algorithm_t alg, - const uint8_t *input, - size_t input_length, - uint8_t *hash, - size_t hash_size, - size_t *hash_length) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - /* Try accelerators first */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_hash_compute( - alg, input, input_length, hash, hash_size, hash_length ); - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ - -#if defined(ESP_SHA_DRIVER_ENABLED) - status = esp_sha_hash_compute(alg, input, input_length, - hash, hash_size, hash_length ); - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* ESP_SHA_DRIVER_ENABLED */ - -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - /* If software fallback is compiled in, try fallback */ -#if defined(MBEDTLS_PSA_BUILTIN_HASH) - status = mbedtls_psa_hash_compute( alg, input, input_length, - hash, hash_size, hash_length ); - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif - (void) status; - (void) alg; - (void) input; - (void) input_length; - (void) hash; - (void) hash_size; - (void) hash_length; - - return( PSA_ERROR_NOT_SUPPORTED ); -} - -static inline psa_status_t psa_driver_wrapper_hash_setup( - psa_hash_operation_t *operation, - psa_algorithm_t alg ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - /* Try setup on accelerators first */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_hash_setup( - &operation->ctx.test_driver_ctx, alg ); - if( status == PSA_SUCCESS ) - operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID; - - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif - -#if defined(ESP_SHA_DRIVER_ENABLED) - status = esp_sha_hash_setup(&operation->ctx.esp_ctx, alg); - if( status == PSA_SUCCESS ) - operation->id = ESP_SHA_TRANSPARENT_DRIVER_ID; - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* ESP_SHA_DRIVER_ENABLED */ - -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - /* If software fallback is compiled in, try fallback */ -#if defined(MBEDTLS_PSA_BUILTIN_HASH) - status = mbedtls_psa_hash_setup( &operation->ctx.mbedtls_ctx, alg ); - if( status == PSA_SUCCESS ) - operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; - - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif - /* Nothing left to try if we fall through here */ - (void) status; - (void) operation; - (void) alg; - return( PSA_ERROR_NOT_SUPPORTED ); -} - -static inline psa_status_t psa_driver_wrapper_hash_clone( - const psa_hash_operation_t *source_operation, - psa_hash_operation_t *target_operation ) -{ - switch( source_operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_HASH) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - target_operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; - return( mbedtls_psa_hash_clone( &source_operation->ctx.mbedtls_ctx, - &target_operation->ctx.mbedtls_ctx ) ); -#endif -#if defined(PSA_CRYPTO_DRIVER_TEST) -#if defined(ESP_SHA_DRIVER_ENABLED) - case ESP_SHA_TRANSPARENT_DRIVER_ID: - target_operation->id = ESP_SHA_TRANSPARENT_DRIVER_ID; - return( esp_sha_hash_clone( - &source_operation->ctx.esp_ctx, - &target_operation->ctx.esp_ctx ) ); -#endif /* ESP_SHA_DRIVER_ENABLED */ - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - target_operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID; - return( mbedtls_test_transparent_hash_clone( - &source_operation->ctx.test_driver_ctx, - &target_operation->ctx.test_driver_ctx ) ); -#endif - default: - (void) target_operation; - return( PSA_ERROR_BAD_STATE ); - } -} - -static inline psa_status_t psa_driver_wrapper_hash_update( - psa_hash_operation_t *operation, - const uint8_t *input, - size_t input_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_HASH) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_hash_update( &operation->ctx.mbedtls_ctx, - input, input_length ) ); -#endif -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_hash_update( - &operation->ctx.test_driver_ctx, - input, input_length ) ); -#endif -#if defined(ESP_SHA_DRIVER_ENABLED) - case ESP_SHA_TRANSPARENT_DRIVER_ID: - return( esp_sha_hash_update( - &operation->ctx.esp_ctx, - input, input_length ) ); -#endif /* ESP_SHA_DRIVER_ENABLED */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - (void) input; - (void) input_length; - return( PSA_ERROR_BAD_STATE ); - } -} - -static inline psa_status_t psa_driver_wrapper_hash_finish( - psa_hash_operation_t *operation, - uint8_t *hash, - size_t hash_size, - size_t *hash_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_HASH) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_hash_finish( &operation->ctx.mbedtls_ctx, - hash, hash_size, hash_length ) ); -#endif -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_hash_finish( - &operation->ctx.test_driver_ctx, - hash, hash_size, hash_length ) ); -#endif -#if defined(ESP_SHA_DRIVER_ENABLED) - case ESP_SHA_TRANSPARENT_DRIVER_ID: - return( esp_sha_hash_finish( - &operation->ctx.esp_ctx, - hash, hash_size, hash_length ) ); -#endif /* ESP_SHA_DRIVER_ENABLED */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - (void) hash; - (void) hash_size; - (void) hash_length; - return( PSA_ERROR_BAD_STATE ); - } -} - -static inline psa_status_t psa_driver_wrapper_hash_abort( - psa_hash_operation_t *operation ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_HASH) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_hash_abort( &operation->ctx.mbedtls_ctx ) ); -#endif -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_hash_abort( - &operation->ctx.test_driver_ctx ) ); -#endif -#if defined(ESP_SHA_DRIVER_ENABLED) - case ESP_SHA_TRANSPARENT_DRIVER_ID: - return( esp_sha_hash_abort( - &operation->ctx.esp_ctx ) ); -#endif /* ESP_SHA_DRIVER_ENABLED */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - return( PSA_ERROR_BAD_STATE ); - } -} - -static inline psa_status_t psa_driver_wrapper_aead_encrypt( - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, size_t key_buffer_size, - psa_algorithm_t alg, - const uint8_t *nonce, size_t nonce_length, - const uint8_t *additional_data, size_t additional_data_length, - const uint8_t *plaintext, size_t plaintext_length, - uint8_t *ciphertext, size_t ciphertext_size, size_t *ciphertext_length ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if (defined(ESP_AES_DRIVER_ENABLED) && (MBEDTLS_HARDWARE_GCM)) - status = esp_crypto_aes_gcm_encrypt( - attributes, key_buffer, key_buffer_size, - alg, - nonce, nonce_length, - additional_data, additional_data_length, - plaintext, plaintext_length, - ciphertext, ciphertext_size, ciphertext_length ); -#ifdef MBEDTLS_GCM_NON_AES_CIPHER_SOFT_FALLBACK - if( status != PSA_ERROR_NOT_SUPPORTED ) -#endif /* MBEDTLS_GCM_NON_AES_CIPHER_SOFT_FALLBACK */ - { - return( status ); - } -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_aead_encrypt( - attributes, key_buffer, key_buffer_size, - alg, - nonce, nonce_length, - additional_data, additional_data_length, - plaintext, plaintext_length, - ciphertext, ciphertext_size, ciphertext_length ); - /* Declared with fallback == true */ - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - /* Fell through, meaning no accelerator supports this operation */ - return( mbedtls_psa_aead_encrypt( - attributes, key_buffer, key_buffer_size, - alg, - nonce, nonce_length, - additional_data, additional_data_length, - plaintext, plaintext_length, - ciphertext, ciphertext_size, ciphertext_length ) ); - - /* Add cases for opaque driver here */ - - default: - /* Key is declared with a lifetime not known to us */ - (void)status; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_aead_decrypt( - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, size_t key_buffer_size, - psa_algorithm_t alg, - const uint8_t *nonce, size_t nonce_length, - const uint8_t *additional_data, size_t additional_data_length, - const uint8_t *ciphertext, size_t ciphertext_length, - uint8_t *plaintext, size_t plaintext_size, size_t *plaintext_length ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if (defined(ESP_AES_DRIVER_ENABLED) && (MBEDTLS_HARDWARE_GCM)) - status = esp_crypto_aes_gcm_decrypt( - attributes, key_buffer, key_buffer_size, - alg, - nonce, nonce_length, - additional_data, additional_data_length, - ciphertext, ciphertext_length, - plaintext, plaintext_size, plaintext_length ); -#ifdef MBEDTLS_GCM_NON_AES_CIPHER_SOFT_FALLBACK - if( status != PSA_ERROR_NOT_SUPPORTED ) -#endif /* MBEDTLS_GCM_NON_AES_CIPHER_SOFT_FALLBACK */ - { - return( status ); - } -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_aead_decrypt( - attributes, key_buffer, key_buffer_size, - alg, - nonce, nonce_length, - additional_data, additional_data_length, - ciphertext, ciphertext_length, - plaintext, plaintext_size, plaintext_length ); - /* Declared with fallback == true */ - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - /* Fell through, meaning no accelerator supports this operation */ - return( mbedtls_psa_aead_decrypt( - attributes, key_buffer, key_buffer_size, - alg, - nonce, nonce_length, - additional_data, additional_data_length, - ciphertext, ciphertext_length, - plaintext, plaintext_size, plaintext_length ) ); - - /* Add cases for opaque driver here */ - - default: - /* Key is declared with a lifetime not known to us */ - (void)status; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_aead_encrypt_setup( - psa_aead_operation_t *operation, - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, size_t key_buffer_size, - psa_algorithm_t alg ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) - -#if (defined(ESP_AES_DRIVER_ENABLED) && (MBEDTLS_HARDWARE_GCM)) - status = esp_crypto_aes_gcm_encrypt_setup( - &operation->ctx.esp_aes_gcm_ctx, - attributes, key_buffer, key_buffer_size, - alg); - - if (status == PSA_SUCCESS) { - operation->id = ESP_AES_TRANSPARENT_DRIVER_ID; - } - -#ifdef MBEDTLS_GCM_NON_AES_CIPHER_SOFT_FALLBACK - if( status != PSA_ERROR_NOT_SUPPORTED ) -#endif /* MBEDTLS_GCM_NON_AES_CIPHER_SOFT_FALLBACK */ - { - return( status ); - } -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID; - status = mbedtls_test_transparent_aead_encrypt_setup( - &operation->ctx.transparent_test_driver_ctx, - attributes, key_buffer, key_buffer_size, - alg ); - - /* Declared with fallback == true */ - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - /* Fell through, meaning no accelerator supports this operation */ - operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; - status = mbedtls_psa_aead_encrypt_setup( - &operation->ctx.mbedtls_ctx, attributes, - key_buffer, key_buffer_size, - alg ); - - return( status ); - - /* Add cases for opaque driver here */ - - default: - /* Key is declared with a lifetime not known to us */ - (void)status; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_aead_decrypt_setup( - psa_aead_operation_t *operation, - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, size_t key_buffer_size, - psa_algorithm_t alg ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if (defined(ESP_AES_DRIVER_ENABLED) && (MBEDTLS_HARDWARE_GCM)) - status = esp_crypto_aes_gcm_decrypt_setup( - &operation->ctx.esp_aes_gcm_ctx, - attributes, key_buffer, key_buffer_size, - alg); - - if (status == PSA_SUCCESS) { - operation->id = ESP_AES_TRANSPARENT_DRIVER_ID; - } - -#ifdef MBEDTLS_GCM_NON_AES_CIPHER_SOFT_FALLBACK - if( status != PSA_ERROR_NOT_SUPPORTED ) -#endif /* MBEDTLS_GCM_NON_AES_CIPHER_SOFT_FALLBACK */ - { - return( status ); - } -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID; - status = mbedtls_test_transparent_aead_decrypt_setup( - &operation->ctx.transparent_test_driver_ctx, - attributes, - key_buffer, key_buffer_size, - alg ); - - /* Declared with fallback == true */ - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - /* Fell through, meaning no accelerator supports this operation */ - operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; - status = mbedtls_psa_aead_decrypt_setup( - &operation->ctx.mbedtls_ctx, - attributes, - key_buffer, key_buffer_size, - alg ); - - return( status ); - - /* Add cases for opaque driver here */ - - default: - /* Key is declared with a lifetime not known to us */ - (void)status; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_aead_set_nonce( - psa_aead_operation_t *operation, - const uint8_t *nonce, - size_t nonce_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_AEAD) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_aead_set_nonce( &operation->ctx.mbedtls_ctx, - nonce, - nonce_length ) ); - -#endif /* MBEDTLS_PSA_BUILTIN_AEAD */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) - -#if (defined(ESP_AES_DRIVER_ENABLED) && (MBEDTLS_HARDWARE_GCM)) - case ESP_AES_TRANSPARENT_DRIVER_ID: - return esp_crypto_aes_gcm_set_nonce( - &operation->ctx.esp_aes_gcm_ctx, - nonce, - nonce_length); -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_aead_set_nonce( - &operation->ctx.transparent_test_driver_ctx, - nonce, nonce_length ) ); - - /* Add cases for opaque driver here */ - -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - } - - (void)nonce; - (void)nonce_length; - - return( PSA_ERROR_INVALID_ARGUMENT ); -} - -static inline psa_status_t psa_driver_wrapper_aead_set_lengths( - psa_aead_operation_t *operation, - size_t ad_length, - size_t plaintext_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_AEAD) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_aead_set_lengths( &operation->ctx.mbedtls_ctx, - ad_length, - plaintext_length ) ); - -#endif /* MBEDTLS_PSA_BUILTIN_AEAD */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(ESP_AES_DRIVER_ENABLED) - case ESP_AES_TRANSPARENT_DRIVER_ID: - return PSA_SUCCESS; -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_aead_set_lengths( - &operation->ctx.transparent_test_driver_ctx, - ad_length, plaintext_length ) ); - - /* Add cases for opaque driver here */ - -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - } - - (void)ad_length; - (void)plaintext_length; - - return( PSA_ERROR_INVALID_ARGUMENT ); -} - -static inline psa_status_t psa_driver_wrapper_aead_update_ad( - psa_aead_operation_t *operation, - const uint8_t *input, - size_t input_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_AEAD) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_aead_update_ad( &operation->ctx.mbedtls_ctx, - input, - input_length ) ); - -#endif /* MBEDTLS_PSA_BUILTIN_AEAD */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if (defined(ESP_AES_DRIVER_ENABLED) && (MBEDTLS_HARDWARE_GCM)) - case ESP_AES_TRANSPARENT_DRIVER_ID: - return esp_crypto_aes_gcm_update_ad( - &operation->ctx.esp_aes_gcm_ctx, - input, - input_length); -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_aead_update_ad( - &operation->ctx.transparent_test_driver_ctx, - input, input_length ) ); - - /* Add cases for opaque driver here */ - -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - } - - (void)input; - (void)input_length; - - return( PSA_ERROR_INVALID_ARGUMENT ); -} - -static inline psa_status_t psa_driver_wrapper_aead_update( - psa_aead_operation_t *operation, - const uint8_t *input, - size_t input_length, - uint8_t *output, - size_t output_size, - size_t *output_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_AEAD) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_aead_update( &operation->ctx.mbedtls_ctx, - input, input_length, - output, output_size, - output_length ) ); - -#endif /* MBEDTLS_PSA_BUILTIN_AEAD */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if (defined(ESP_AES_DRIVER_ENABLED) && (MBEDTLS_HARDWARE_GCM)) - case ESP_AES_TRANSPARENT_DRIVER_ID: - return esp_crypto_aes_gcm_update( - &operation->ctx.esp_aes_gcm_ctx, - input, input_length, output, output_size, output_length); -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_aead_update( - &operation->ctx.transparent_test_driver_ctx, - input, input_length, output, output_size, - output_length ) ); - - /* Add cases for opaque driver here */ - -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - } - - (void)input; - (void)input_length; - (void)output; - (void)output_size; - (void)output_length; - - return( PSA_ERROR_INVALID_ARGUMENT ); -} - -static inline psa_status_t psa_driver_wrapper_aead_finish( - psa_aead_operation_t *operation, - uint8_t *ciphertext, - size_t ciphertext_size, - size_t *ciphertext_length, - uint8_t *tag, - size_t tag_size, - size_t *tag_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_AEAD) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_aead_finish( &operation->ctx.mbedtls_ctx, - ciphertext, - ciphertext_size, - ciphertext_length, tag, - tag_size, tag_length ) ); - -#endif /* MBEDTLS_PSA_BUILTIN_AEAD */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) - -#if (defined(ESP_AES_DRIVER_ENABLED) && (MBEDTLS_HARDWARE_GCM)) - case ESP_AES_TRANSPARENT_DRIVER_ID: - return esp_crypto_aes_gcm_finish( - &operation->ctx.esp_aes_gcm_ctx, - ciphertext, ciphertext_size, ciphertext_length, tag, tag_size, tag_length); -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_aead_finish( - &operation->ctx.transparent_test_driver_ctx, - ciphertext, ciphertext_size, - ciphertext_length, tag, tag_size, tag_length ) ); - - /* Add cases for opaque driver here */ - -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - } - - (void)ciphertext; - (void)ciphertext_size; - (void)ciphertext_length; - (void)tag; - (void)tag_size; - (void)tag_length; - - return( PSA_ERROR_INVALID_ARGUMENT ); -} - -static inline psa_status_t psa_driver_wrapper_aead_verify( - psa_aead_operation_t *operation, - uint8_t *plaintext, - size_t plaintext_size, - size_t *plaintext_length, - const uint8_t *tag, - size_t tag_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_AEAD) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - { - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - uint8_t check_tag[PSA_AEAD_TAG_MAX_SIZE]; - size_t check_tag_length; - - status = mbedtls_psa_aead_finish( &operation->ctx.mbedtls_ctx, - plaintext, - plaintext_size, - plaintext_length, - check_tag, - sizeof( check_tag ), - &check_tag_length ); - - if( status == PSA_SUCCESS ) - { - if( tag_length != check_tag_length || - mbedtls_ct_memcmp( tag, check_tag, tag_length ) - != 0 ) - status = PSA_ERROR_INVALID_SIGNATURE; - } - - mbedtls_platform_zeroize( check_tag, sizeof( check_tag ) ); - - return( status ); - } - -#endif /* MBEDTLS_PSA_BUILTIN_AEAD */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if (defined(ESP_AES_DRIVER_ENABLED) && (MBEDTLS_HARDWARE_GCM)) - case ESP_AES_TRANSPARENT_DRIVER_ID: - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - uint8_t check_tag[PSA_AEAD_TAG_MAX_SIZE]; - size_t check_tag_length; - - status = esp_crypto_aes_gcm_finish(&operation->ctx.esp_aes_gcm_ctx, - plaintext, plaintext_size, plaintext_length, check_tag, sizeof(check_tag), &check_tag_length); - - if(status == PSA_SUCCESS) { - if(tag_length != check_tag_length || mbedtls_ct_memcmp(tag, check_tag, tag_length) != 0) { - status = PSA_ERROR_INVALID_SIGNATURE; - } - } - - mbedtls_platform_zeroize(check_tag, sizeof(check_tag)); - - return(status); -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_aead_verify( - &operation->ctx.transparent_test_driver_ctx, - plaintext, plaintext_size, - plaintext_length, tag, tag_length ) ); - - /* Add cases for opaque driver here */ - -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - } - - (void)plaintext; - (void)plaintext_size; - (void)plaintext_length; - (void)tag; - (void)tag_length; - - return( PSA_ERROR_INVALID_ARGUMENT ); -} - -static inline psa_status_t psa_driver_wrapper_aead_abort( - psa_aead_operation_t *operation ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_AEAD) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_aead_abort( &operation->ctx.mbedtls_ctx ) ); - -#endif /* MBEDTLS_PSA_BUILTIN_AEAD */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) - -#if (defined(ESP_AES_DRIVER_ENABLED) && (MBEDTLS_HARDWARE_GCM)) - case ESP_AES_TRANSPARENT_DRIVER_ID: - return (esp_crypto_aes_gcm_abort(&operation->ctx.esp_aes_gcm_ctx)); -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_aead_abort( - &operation->ctx.transparent_test_driver_ctx ) ); - - /* Add cases for opaque driver here */ - -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - } - - return( PSA_ERROR_INVALID_ARGUMENT ); -} - -/* - * MAC functions - */ -static inline psa_status_t psa_driver_wrapper_mac_compute( - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, - size_t key_buffer_size, - psa_algorithm_t alg, - const uint8_t *input, - size_t input_length, - uint8_t *mac, - size_t mac_size, - size_t *mac_length ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(ESP_AES_DRIVER_ENABLED) - return (esp_cmac_mac_compute(attributes, key_buffer, key_buffer_size, alg, - input, input_length, - mac, mac_size, mac_length )); -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_mac_compute( - attributes, key_buffer, key_buffer_size, alg, - input, input_length, - mac, mac_size, mac_length ); - /* Declared with fallback == true */ - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ -#if defined(MBEDTLS_PSA_BUILTIN_MAC) - /* Fell through, meaning no accelerator supports this operation */ - status = mbedtls_psa_mac_compute( - attributes, key_buffer, key_buffer_size, alg, - input, input_length, - mac, mac_size, mac_length ); - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* MBEDTLS_PSA_BUILTIN_MAC */ - return( PSA_ERROR_NOT_SUPPORTED ); - - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: - status = mbedtls_test_opaque_mac_compute( - attributes, key_buffer, key_buffer_size, alg, - input, input_length, - mac, mac_size, mac_length ); - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - /* Key is declared with a lifetime not known to us */ - (void) key_buffer; - (void) key_buffer_size; - (void) alg; - (void) input; - (void) input_length; - (void) mac; - (void) mac_size; - (void) mac_length; - (void) status; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_mac_sign_setup( - psa_mac_operation_t *operation, - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, - size_t key_buffer_size, - psa_algorithm_t alg ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_mac_sign_setup( - &operation->ctx.transparent_test_driver_ctx, - attributes, - key_buffer, key_buffer_size, - alg ); - /* Declared with fallback == true */ - if( status == PSA_SUCCESS ) - operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID; - - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#if defined(ESP_AES_DRIVER_ENABLED) - status = (esp_cmac_mac_setup( &operation->ctx.esp_cmac_ctx, - attributes, - key_buffer, key_buffer_size, - alg )); - if( status == PSA_SUCCESS ) - operation->id = ESP_CMAC_TRANSPARENT_DRIVER_ID; - return status; -#endif /* ESP_AES_DRIVER_ENABLED */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ -#if defined(MBEDTLS_PSA_BUILTIN_MAC) - /* Fell through, meaning no accelerator supports this operation */ - status = mbedtls_psa_mac_sign_setup( &operation->ctx.mbedtls_ctx, - attributes, - key_buffer, key_buffer_size, - alg ); - if( status == PSA_SUCCESS ) - operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; - - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* MBEDTLS_PSA_BUILTIN_MAC */ - return( PSA_ERROR_NOT_SUPPORTED ); - - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: - status = mbedtls_test_opaque_mac_sign_setup( - &operation->ctx.opaque_test_driver_ctx, - attributes, - key_buffer, key_buffer_size, - alg ); - - if( status == PSA_SUCCESS ) - operation->id = MBEDTLS_TEST_OPAQUE_DRIVER_ID; - - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - /* Key is declared with a lifetime not known to us */ - (void) status; - (void) operation; - (void) key_buffer; - (void) key_buffer_size; - (void) alg; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_mac_verify_setup( - psa_mac_operation_t *operation, - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, - size_t key_buffer_size, - psa_algorithm_t alg ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_mac_verify_setup( - &operation->ctx.transparent_test_driver_ctx, - attributes, - key_buffer, key_buffer_size, - alg ); - /* Declared with fallback == true */ - if( status == PSA_SUCCESS ) - operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID; - - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#if defined(ESP_AES_DRIVER_ENABLED) - status = (esp_cmac_mac_setup( &operation->ctx.esp_cmac_ctx, - attributes, - key_buffer, key_buffer_size, - alg )); - if( status == PSA_SUCCESS ) - operation->id = ESP_CMAC_TRANSPARENT_DRIVER_ID; - return status; -#endif /* ESP_AES_DRIVER_ENABLED */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ -#if defined(MBEDTLS_PSA_BUILTIN_MAC) - /* Fell through, meaning no accelerator supports this operation */ - status = mbedtls_psa_mac_verify_setup( &operation->ctx.mbedtls_ctx, - attributes, - key_buffer, key_buffer_size, - alg ); - if( status == PSA_SUCCESS ) - operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; - - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* MBEDTLS_PSA_BUILTIN_MAC */ - return( PSA_ERROR_NOT_SUPPORTED ); - - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: - status = mbedtls_test_opaque_mac_verify_setup( - &operation->ctx.opaque_test_driver_ctx, - attributes, - key_buffer, key_buffer_size, - alg ); - - if( status == PSA_SUCCESS ) - operation->id = MBEDTLS_TEST_OPAQUE_DRIVER_ID; - - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - /* Key is declared with a lifetime not known to us */ - (void) status; - (void) operation; - (void) key_buffer; - (void) key_buffer_size; - (void) alg; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_mac_update( - psa_mac_operation_t *operation, - const uint8_t *input, - size_t input_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_MAC) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_mac_update( &operation->ctx.mbedtls_ctx, - input, input_length ) ); -#endif /* MBEDTLS_PSA_BUILTIN_MAC */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(ESP_AES_DRIVER_ENABLED) - case ESP_CMAC_TRANSPARENT_DRIVER_ID: - return (esp_cmac_mac_update( &operation->ctx.esp_cmac_ctx, - input, input_length )); -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_mac_update( - &operation->ctx.transparent_test_driver_ctx, - input, input_length ) ); - - case MBEDTLS_TEST_OPAQUE_DRIVER_ID: - return( mbedtls_test_opaque_mac_update( - &operation->ctx.opaque_test_driver_ctx, - input, input_length ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - (void) input; - (void) input_length; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_mac_sign_finish( - psa_mac_operation_t *operation, - uint8_t *mac, - size_t mac_size, - size_t *mac_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_MAC) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_mac_sign_finish( &operation->ctx.mbedtls_ctx, - mac, mac_size, mac_length ) ); -#endif /* MBEDTLS_PSA_BUILTIN_MAC */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(ESP_AES_DRIVER_ENABLED) - case ESP_CMAC_TRANSPARENT_DRIVER_ID: - return (esp_cmac_mac_finish( &operation->ctx.esp_cmac_ctx, - mac, mac_size, mac_length )); -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_mac_sign_finish( - &operation->ctx.transparent_test_driver_ctx, - mac, mac_size, mac_length ) ); - - case MBEDTLS_TEST_OPAQUE_DRIVER_ID: - return( mbedtls_test_opaque_mac_sign_finish( - &operation->ctx.opaque_test_driver_ctx, - mac, mac_size, mac_length ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - (void) mac; - (void) mac_size; - (void) mac_length; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_mac_verify_finish( - psa_mac_operation_t *operation, - const uint8_t *mac, - size_t mac_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_MAC) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_mac_verify_finish( &operation->ctx.mbedtls_ctx, - mac, mac_length ) ); -#endif /* MBEDTLS_PSA_BUILTIN_MAC */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(ESP_AES_DRIVER_ENABLED) - case ESP_CMAC_TRANSPARENT_DRIVER_ID: - return (esp_cmac_mac_verify_finish( &operation->ctx.esp_cmac_ctx, - mac, mac_length )); -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_mac_verify_finish( - &operation->ctx.transparent_test_driver_ctx, - mac, mac_length ) ); - - case MBEDTLS_TEST_OPAQUE_DRIVER_ID: - return( mbedtls_test_opaque_mac_verify_finish( - &operation->ctx.opaque_test_driver_ctx, - mac, mac_length ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - (void) mac; - (void) mac_length; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_mac_abort( - psa_mac_operation_t *operation ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_MAC) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_mac_abort( &operation->ctx.mbedtls_ctx ) ); -#endif /* MBEDTLS_PSA_BUILTIN_MAC */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(ESP_AES_DRIVER_ENABLED) - case ESP_CMAC_TRANSPARENT_DRIVER_ID: - return (esp_cmac_mac_abort( &operation->ctx.esp_cmac_ctx )); -#endif /* ESP_AES_DRIVER_ENABLED */ -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_mac_abort( - &operation->ctx.transparent_test_driver_ctx ) ); - case MBEDTLS_TEST_OPAQUE_DRIVER_ID: - return( mbedtls_test_opaque_mac_abort( - &operation->ctx.opaque_test_driver_ctx ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -/* - * Asymmetric cryptography - */ -static inline psa_status_t psa_driver_wrapper_asymmetric_encrypt( - const psa_key_attributes_t *attributes, const uint8_t *key_buffer, - size_t key_buffer_size, psa_algorithm_t alg, const uint8_t *input, - size_t input_length, const uint8_t *salt, size_t salt_length, - uint8_t *output, size_t output_size, size_t *output_length ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_asymmetric_encrypt( attributes, - key_buffer, key_buffer_size, alg, input, input_length, - salt, salt_length, output, output_size, - output_length ); - /* Declared with fallback == true */ - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - return( mbedtls_psa_asymmetric_encrypt( attributes, - key_buffer, key_buffer_size, alg, input, input_length, - salt, salt_length, output, output_size, output_length ) - ); - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: - return( mbedtls_test_opaque_asymmetric_encrypt( attributes, - key_buffer, key_buffer_size, alg, input, input_length, - salt, salt_length, output, output_size, output_length ) - ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - default: - /* Key is declared with a lifetime not known to us */ - (void)status; - (void)key_buffer; - (void)key_buffer_size; - (void)alg; - (void)input; - (void)input_length; - (void)salt; - (void)salt_length; - (void)output; - (void)output_size; - (void)output_length; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_asymmetric_decrypt( - const psa_key_attributes_t *attributes, const uint8_t *key_buffer, - size_t key_buffer_size, psa_algorithm_t alg, const uint8_t *input, - size_t input_length, const uint8_t *salt, size_t salt_length, - uint8_t *output, size_t output_size, size_t *output_length ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_asymmetric_decrypt( attributes, - key_buffer, key_buffer_size, alg, input, input_length, - salt, salt_length, output, output_size, - output_length ); - /* Declared with fallback == true */ - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - return( mbedtls_psa_asymmetric_decrypt( attributes, - key_buffer, key_buffer_size, alg,input, input_length, - salt, salt_length, output, output_size, - output_length ) ); - /* Add cases for opaque driver here */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: - return( mbedtls_test_opaque_asymmetric_decrypt( attributes, - key_buffer, key_buffer_size, alg, input, input_length, - salt, salt_length, output, output_size, - output_length ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - default: - /* Key is declared with a lifetime not known to us */ - (void)status; - (void)key_buffer; - (void)key_buffer_size; - (void)alg; - (void)input; - (void)input_length; - (void)salt; - (void)salt_length; - (void)output; - (void)output_size; - (void)output_length; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_key_agreement( - const psa_key_attributes_t *attributes, - const uint8_t *key_buffer, - size_t key_buffer_size, - psa_algorithm_t alg, - const uint8_t *peer_key, - size_t peer_key_length, - uint8_t *shared_secret, - size_t shared_secret_size, - size_t *shared_secret_length - ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime(attributes) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = - mbedtls_test_transparent_key_agreement( attributes, - key_buffer, key_buffer_size, alg, peer_key, - peer_key_length, shared_secret, shared_secret_size, - shared_secret_length ); - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#if defined(MBEDTLS_PSA_P256M_DRIVER_ENABLED) - if( PSA_KEY_TYPE_IS_ECC( psa_get_key_type(attributes) ) && - PSA_ALG_IS_ECDH(alg) && - PSA_KEY_TYPE_ECC_GET_FAMILY(psa_get_key_type(attributes)) == PSA_ECC_FAMILY_SECP_R1 && - psa_get_key_bits(attributes) == 256 ) - { - status = p256_transparent_key_agreement( attributes, - key_buffer, - key_buffer_size, - alg, - peer_key, - peer_key_length, - shared_secret, - shared_secret_size, - shared_secret_length ); - if( status != PSA_ERROR_NOT_SUPPORTED) - return( status ); - } -#endif /* MBEDTLS_PSA_P256M_DRIVER_ENABLED */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - /* Software Fallback */ - status = psa_key_agreement_raw_builtin( attributes, - key_buffer, - key_buffer_size, - alg, - peer_key, - peer_key_length, - shared_secret, - shared_secret_size, - shared_secret_length ); - return( status ); -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case PSA_CRYPTO_TEST_DRIVER_LOCATION: - return( mbedtls_test_opaque_key_agreement( attributes, - key_buffer, key_buffer_size, alg, peer_key, - peer_key_length, shared_secret, shared_secret_size, - shared_secret_length ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - - default: - (void) attributes; - (void) key_buffer; - (void) key_buffer_size; - (void) peer_key; - (void) peer_key_length; - (void) shared_secret; - (void) shared_secret_size; - (void) shared_secret_length; - return( PSA_ERROR_NOT_SUPPORTED ); - - } -} - -static inline psa_status_t psa_driver_wrapper_pake_setup( - psa_pake_operation_t *operation, - const psa_crypto_driver_pake_inputs_t *inputs ) -{ - psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; - - psa_key_location_t location = - PSA_KEY_LIFETIME_GET_LOCATION( psa_get_key_lifetime( &inputs->attributes ) ); - - switch( location ) - { - case PSA_KEY_LOCATION_LOCAL_STORAGE: - /* Key is stored in the slot in export representation, so - * cycle through all known transparent accelerators */ - status = PSA_ERROR_NOT_SUPPORTED; -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - status = mbedtls_test_transparent_pake_setup( - &operation->data.ctx.transparent_test_driver_ctx, - inputs ); - if( status == PSA_SUCCESS ) - operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID; - /* Declared with fallback == true */ - if( status != PSA_ERROR_NOT_SUPPORTED ) - return( status ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ -#if defined(MBEDTLS_PSA_BUILTIN_PAKE) - status = mbedtls_psa_pake_setup( &operation->data.ctx.mbedtls_ctx, - inputs ); - if( status == PSA_SUCCESS ) - operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; -#endif - return status; - /* Add cases for opaque driver here */ - default: - /* Key is declared with a lifetime not known to us */ - (void)operation; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_pake_output( - psa_pake_operation_t *operation, - psa_crypto_driver_pake_step_t step, - uint8_t *output, - size_t output_size, - size_t *output_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_PAKE) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_pake_output( &operation->data.ctx.mbedtls_ctx, step, - output, output_size, output_length ) ); -#endif /* MBEDTLS_PSA_BUILTIN_PAKE */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_pake_output( - &operation->data.ctx.transparent_test_driver_ctx, - step, output, output_size, output_length ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - (void) step; - (void) output; - (void) output_size; - (void) output_length; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_pake_input( - psa_pake_operation_t *operation, - psa_crypto_driver_pake_step_t step, - const uint8_t *input, - size_t input_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_PAKE) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_pake_input( &operation->data.ctx.mbedtls_ctx, - step, input, - input_length ) ); -#endif /* MBEDTLS_PSA_BUILTIN_PAKE */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_pake_input( - &operation->data.ctx.transparent_test_driver_ctx, - step, - input, input_length ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - (void) step; - (void) input; - (void) input_length; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_pake_get_implicit_key( - psa_pake_operation_t *operation, - uint8_t *output, size_t output_size, - size_t *output_length ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_PAKE) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_pake_get_implicit_key( &operation->data.ctx.mbedtls_ctx, - output, output_size, output_length ) ); -#endif /* MBEDTLS_PSA_BUILTIN_PAKE */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_pake_get_implicit_key( - &operation->data.ctx.transparent_test_driver_ctx, - output, output_size, output_length ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - (void) output; - (void) output_size; - (void) output_length; - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -static inline psa_status_t psa_driver_wrapper_pake_abort( - psa_pake_operation_t * operation ) -{ - switch( operation->id ) - { -#if defined(MBEDTLS_PSA_BUILTIN_PAKE) - case PSA_CRYPTO_MBED_TLS_DRIVER_ID: - return( mbedtls_psa_pake_abort( &operation->data.ctx.mbedtls_ctx ) ); -#endif /* MBEDTLS_PSA_BUILTIN_PAKE */ - -#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) -#if defined(PSA_CRYPTO_DRIVER_TEST) - case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: - return( mbedtls_test_transparent_pake_abort( - &operation->data.ctx.transparent_test_driver_ctx ) ); -#endif /* PSA_CRYPTO_DRIVER_TEST */ -#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ - default: - return( PSA_ERROR_INVALID_ARGUMENT ); - } -} - -#endif /* MBEDTLS_PSA_CRYPTO_C */