1/* 2 * Functions to delegate cryptographic operations to an available 3 * and appropriate accelerator. 4 * Warning: This file is now auto-generated. 5 */ 6/* Copyright The Mbed TLS Contributors 7 * SPDX-License-Identifier: Apache-2.0 8 * 9 * Licensed under the Apache License, Version 2.0 (the "License"); you may 10 * not use this file except in compliance with the License. 11 * You may obtain a copy of the License at 12 * 13 * http://www.apache.org/licenses/LICENSE-2.0 14 * 15 * Unless required by applicable law or agreed to in writing, software 16 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT 17 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 18 * See the License for the specific language governing permissions and 19 * limitations under the License. 20 */ 21 22/* BEGIN-common headers */ 23#include "common.h" 24#include "psa_crypto_aead.h" 25#include "psa_crypto_cipher.h" 26#include "psa_crypto_core.h" 27#include "psa_crypto_driver_wrappers.h" 28#include "psa_crypto_hash.h" 29#include "psa_crypto_mac.h" 30#include "psa_crypto_pake.h" 31#include "psa_crypto_rsa.h" 32 33#include "mbedtls/constant_time.h" 34#include "mbedtls/platform.h" 35/* END-common headers */ 36 37#if defined(MBEDTLS_PSA_CRYPTO_C) 38 39/* BEGIN-driver headers */ 40/* Headers for mbedtls_test opaque driver */ 41#if defined(PSA_CRYPTO_DRIVER_TEST) 42#include "test/drivers/test_driver.h" 43 44#endif 45/* Headers for mbedtls_test transparent driver */ 46#if defined(PSA_CRYPTO_DRIVER_TEST) 47#include "test/drivers/test_driver.h" 48 49#endif 50/* Headers for p256 transparent driver */ 51#if defined(MBEDTLS_PSA_P256M_DRIVER_ENABLED) 52#include "../3rdparty/p256-m/p256-m_driver_entrypoints.h" 53 54#endif 55 56/* END-driver headers */ 57 58/* Auto-generated values depending on which drivers are registered. 59 * ID 0 is reserved for unallocated operations. 60 * ID 1 is reserved for the Mbed TLS software driver. */ 61/* BEGIN-driver id definition */ 62#define PSA_CRYPTO_MBED_TLS_DRIVER_ID (1) 63#define MBEDTLS_TEST_OPAQUE_DRIVER_ID (2) 64#define MBEDTLS_TEST_TRANSPARENT_DRIVER_ID (3) 65#define P256_TRANSPARENT_DRIVER_ID (4) 66 67/* END-driver id */ 68 69/* BEGIN-Common Macro definitions */ 70 71/* END-Common Macro definitions */ 72 73/* Support the 'old' SE interface when asked to */ 74#if defined(MBEDTLS_PSA_CRYPTO_SE_C) 75/* PSA_CRYPTO_DRIVER_PRESENT is defined when either a new-style or old-style 76 * SE driver is present, to avoid unused argument errors at compile time. */ 77#ifndef PSA_CRYPTO_DRIVER_PRESENT 78#define PSA_CRYPTO_DRIVER_PRESENT 79#endif 80#include "psa_crypto_se.h" 81#endif 82 83psa_status_t psa_driver_wrapper_init(void) 84{ 85 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 86 87#if defined(MBEDTLS_PSA_CRYPTO_SE_C) 88 status = psa_init_all_se_drivers(); 89 if (status != PSA_SUCCESS) 90 return (status); 91#endif 92 93#if defined(PSA_CRYPTO_DRIVER_TEST) 94 status = mbedtls_test_transparent_init(); 95 if (status != PSA_SUCCESS) 96 return (status); 97 98 status = mbedtls_test_opaque_init(); 99 if (status != PSA_SUCCESS) 100 return (status); 101#endif 102 103 (void)status; 104 return (PSA_SUCCESS); 105} 106 107void psa_driver_wrapper_free(void) 108{ 109#if defined(MBEDTLS_PSA_CRYPTO_SE_C) 110 /* Unregister all secure element drivers, so that we restart from 111 * a pristine state. */ 112 psa_unregister_all_se_drivers(); 113#endif /* MBEDTLS_PSA_CRYPTO_SE_C */ 114 115#if defined(PSA_CRYPTO_DRIVER_TEST) 116 mbedtls_test_transparent_free(); 117 mbedtls_test_opaque_free(); 118#endif 119} 120 121/* Start delegation functions */ 122psa_status_t psa_driver_wrapper_sign_message(const psa_key_attributes_t *attributes, const uint8_t *key_buffer, 123 size_t key_buffer_size, psa_algorithm_t alg, const uint8_t *input, 124 size_t input_length, uint8_t *signature, size_t signature_size, 125 size_t *signature_length) 126{ 127 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 128 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)); 129 130 switch (location) { 131 case PSA_KEY_LOCATION_LOCAL_STORAGE: 132 /* Key is stored in the slot in export representation, so 133 * cycle through all known transparent accelerators */ 134#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 135#if defined(PSA_CRYPTO_DRIVER_TEST) 136 status = mbedtls_test_transparent_signature_sign_message(attributes, key_buffer, key_buffer_size, alg, 137 input, input_length, signature, signature_size, 138 signature_length); 139 /* Declared with fallback == true */ 140 if (status != PSA_ERROR_NOT_SUPPORTED) 141 return (status); 142#endif /* PSA_CRYPTO_DRIVER_TEST */ 143#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 144 break; 145 146 /* Add cases for opaque driver here */ 147#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 148#if defined(PSA_CRYPTO_DRIVER_TEST) 149 case PSA_CRYPTO_TEST_DRIVER_LOCATION: 150 status = 151 mbedtls_test_opaque_signature_sign_message(attributes, key_buffer, key_buffer_size, alg, input, 152 input_length, signature, signature_size, signature_length); 153 if (status != PSA_ERROR_NOT_SUPPORTED) 154 return (status); 155 break; 156#endif /* PSA_CRYPTO_DRIVER_TEST */ 157#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 158 default: 159 /* Key is declared with a lifetime not known to us */ 160 (void)status; 161 break; 162 } 163 164 return (psa_sign_message_builtin(attributes, key_buffer, key_buffer_size, alg, input, input_length, signature, 165 signature_size, signature_length)); 166} 167 168psa_status_t psa_driver_wrapper_verify_message(const psa_key_attributes_t *attributes, const uint8_t *key_buffer, 169 size_t key_buffer_size, psa_algorithm_t alg, const uint8_t *input, 170 size_t input_length, const uint8_t *signature, size_t signature_length) 171{ 172 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 173 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)); 174 175 switch (location) { 176 case PSA_KEY_LOCATION_LOCAL_STORAGE: 177 /* Key is stored in the slot in export representation, so 178 * cycle through all known transparent accelerators */ 179#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 180#if defined(PSA_CRYPTO_DRIVER_TEST) 181 status = mbedtls_test_transparent_signature_verify_message( 182 attributes, key_buffer, key_buffer_size, alg, input, input_length, signature, signature_length); 183 /* Declared with fallback == true */ 184 if (status != PSA_ERROR_NOT_SUPPORTED) 185 return (status); 186#endif /* PSA_CRYPTO_DRIVER_TEST */ 187#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 188 break; 189 190 /* Add cases for opaque driver here */ 191#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 192#if defined(PSA_CRYPTO_DRIVER_TEST) 193 case PSA_CRYPTO_TEST_DRIVER_LOCATION: 194 return (mbedtls_test_opaque_signature_verify_message(attributes, key_buffer, key_buffer_size, alg, input, 195 input_length, signature, signature_length)); 196 if (status != PSA_ERROR_NOT_SUPPORTED) 197 return (status); 198 break; 199#endif /* PSA_CRYPTO_DRIVER_TEST */ 200#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 201 default: 202 /* Key is declared with a lifetime not known to us */ 203 (void)status; 204 break; 205 } 206 207 return (psa_verify_message_builtin(attributes, key_buffer, key_buffer_size, alg, input, input_length, signature, 208 signature_length)); 209} 210 211psa_status_t psa_driver_wrapper_sign_hash(const psa_key_attributes_t *attributes, const uint8_t *key_buffer, 212 size_t key_buffer_size, psa_algorithm_t alg, const uint8_t *hash, 213 size_t hash_length, uint8_t *signature, size_t signature_size, 214 size_t *signature_length) 215{ 216 /* Try dynamically-registered SE interface first */ 217#if defined(MBEDTLS_PSA_CRYPTO_SE_C) 218 const psa_drv_se_t *drv; 219 psa_drv_se_context_t *drv_context; 220 221 if (psa_get_se_driver(psa_get_key_lifetime(attributes), &drv, &drv_context)) { 222 if (drv->asymmetric == NULL || drv->asymmetric->p_sign == NULL) { 223 /* Key is defined in SE, but we have no way to exercise it */ 224 return (PSA_ERROR_NOT_SUPPORTED); 225 } 226 return (drv->asymmetric->p_sign(drv_context, *((psa_key_slot_number_t *)key_buffer), alg, hash, hash_length, 227 signature, signature_size, signature_length)); 228 } 229#endif /* MBEDTLS_PSA_CRYPTO_SE_C */ 230 231 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 232 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)); 233 234 switch (location) { 235 case PSA_KEY_LOCATION_LOCAL_STORAGE: 236 /* Key is stored in the slot in export representation, so 237 * cycle through all known transparent accelerators */ 238#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 239#if defined(PSA_CRYPTO_DRIVER_TEST) 240 status = 241 mbedtls_test_transparent_signature_sign_hash(attributes, key_buffer, key_buffer_size, alg, hash, 242 hash_length, signature, signature_size, signature_length); 243 /* Declared with fallback == true */ 244 if (status != PSA_ERROR_NOT_SUPPORTED) 245 return (status); 246#endif /* PSA_CRYPTO_DRIVER_TEST */ 247#if defined(MBEDTLS_PSA_P256M_DRIVER_ENABLED) 248 if (PSA_KEY_TYPE_IS_ECC(psa_get_key_type(attributes)) && PSA_ALG_IS_ECDSA(alg) && 249 !PSA_ALG_ECDSA_IS_DETERMINISTIC(alg) && 250 PSA_KEY_TYPE_ECC_GET_FAMILY(psa_get_key_type(attributes)) == PSA_ECC_FAMILY_SECP_R1 && 251 psa_get_key_bits(attributes) == 256) { 252 status = p256_transparent_sign_hash(attributes, key_buffer, key_buffer_size, alg, hash, hash_length, 253 signature, signature_size, signature_length); 254 if (status != PSA_ERROR_NOT_SUPPORTED) 255 return (status); 256 } 257#endif /* MBEDTLS_PSA_P256M_DRIVER_ENABLED */ 258#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 259 /* Fell through, meaning no accelerator supports this operation */ 260 return (psa_sign_hash_builtin(attributes, key_buffer, key_buffer_size, alg, hash, hash_length, signature, 261 signature_size, signature_length)); 262 263 /* Add cases for opaque driver here */ 264#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 265#if defined(PSA_CRYPTO_DRIVER_TEST) 266 case PSA_CRYPTO_TEST_DRIVER_LOCATION: 267 return (mbedtls_test_opaque_signature_sign_hash(attributes, key_buffer, key_buffer_size, alg, hash, 268 hash_length, signature, signature_size, signature_length)); 269#endif /* PSA_CRYPTO_DRIVER_TEST */ 270#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 271 default: 272 /* Key is declared with a lifetime not known to us */ 273 (void)status; 274 return (PSA_ERROR_INVALID_ARGUMENT); 275 } 276} 277 278psa_status_t psa_driver_wrapper_verify_hash(const psa_key_attributes_t *attributes, const uint8_t *key_buffer, 279 size_t key_buffer_size, psa_algorithm_t alg, const uint8_t *hash, 280 size_t hash_length, const uint8_t *signature, size_t signature_length) 281{ 282 /* Try dynamically-registered SE interface first */ 283#if defined(MBEDTLS_PSA_CRYPTO_SE_C) 284 const psa_drv_se_t *drv; 285 psa_drv_se_context_t *drv_context; 286 287 if (psa_get_se_driver(psa_get_key_lifetime(attributes), &drv, &drv_context)) { 288 if (drv->asymmetric == NULL || drv->asymmetric->p_verify == NULL) { 289 /* Key is defined in SE, but we have no way to exercise it */ 290 return (PSA_ERROR_NOT_SUPPORTED); 291 } 292 return (drv->asymmetric->p_verify(drv_context, *((psa_key_slot_number_t *)key_buffer), alg, hash, hash_length, 293 signature, signature_length)); 294 } 295#endif /* MBEDTLS_PSA_CRYPTO_SE_C */ 296 297 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 298 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)); 299 300 switch (location) { 301 case PSA_KEY_LOCATION_LOCAL_STORAGE: 302 /* Key is stored in the slot in export representation, so 303 * cycle through all known transparent accelerators */ 304#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 305#if defined(PSA_CRYPTO_DRIVER_TEST) 306 status = mbedtls_test_transparent_signature_verify_hash(attributes, key_buffer, key_buffer_size, alg, hash, 307 hash_length, signature, signature_length); 308 /* Declared with fallback == true */ 309 if (status != PSA_ERROR_NOT_SUPPORTED) 310 return (status); 311#endif /* PSA_CRYPTO_DRIVER_TEST */ 312#if defined(MBEDTLS_PSA_P256M_DRIVER_ENABLED) 313 if (PSA_KEY_TYPE_IS_ECC(psa_get_key_type(attributes)) && PSA_ALG_IS_ECDSA(alg) && 314 !PSA_ALG_ECDSA_IS_DETERMINISTIC(alg) && 315 PSA_KEY_TYPE_ECC_GET_FAMILY(psa_get_key_type(attributes)) == PSA_ECC_FAMILY_SECP_R1 && 316 psa_get_key_bits(attributes) == 256) { 317 status = p256_transparent_verify_hash(attributes, key_buffer, key_buffer_size, alg, hash, hash_length, 318 signature, signature_length); 319 if (status != PSA_ERROR_NOT_SUPPORTED) 320 return (status); 321 } 322#endif /* MBEDTLS_PSA_P256M_DRIVER_ENABLED */ 323#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 324 325 return (psa_verify_hash_builtin(attributes, key_buffer, key_buffer_size, alg, hash, hash_length, signature, 326 signature_length)); 327 328 /* Add cases for opaque driver here */ 329#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 330#if defined(PSA_CRYPTO_DRIVER_TEST) 331 case PSA_CRYPTO_TEST_DRIVER_LOCATION: 332 return (mbedtls_test_opaque_signature_verify_hash(attributes, key_buffer, key_buffer_size, alg, hash, 333 hash_length, signature, signature_length)); 334#endif /* PSA_CRYPTO_DRIVER_TEST */ 335#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 336 default: 337 /* Key is declared with a lifetime not known to us */ 338 (void)status; 339 return (PSA_ERROR_INVALID_ARGUMENT); 340 } 341} 342 343uint32_t psa_driver_wrapper_sign_hash_get_num_ops(psa_sign_hash_interruptible_operation_t *operation) 344{ 345 switch (operation->id) { 346 /* If uninitialised, return 0, as no work can have been done. */ 347 case 0: 348 return 0; 349 350 case PSA_CRYPTO_MBED_TLS_DRIVER_ID: 351 return (mbedtls_psa_sign_hash_get_num_ops(&operation->ctx.mbedtls_ctx)); 352 353#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 354#if defined(PSA_CRYPTO_DRIVER_TEST) 355 /* Add test driver tests here */ 356 357#endif /* PSA_CRYPTO_DRIVER_TEST */ 358#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 359 } 360 361 /* Can't happen (see discussion in #8271) */ 362 return 0; 363} 364 365uint32_t psa_driver_wrapper_verify_hash_get_num_ops(psa_verify_hash_interruptible_operation_t *operation) 366{ 367 switch (operation->id) { 368 /* If uninitialised, return 0, as no work can have been done. */ 369 case 0: 370 return 0; 371 372 case PSA_CRYPTO_MBED_TLS_DRIVER_ID: 373 return (mbedtls_psa_verify_hash_get_num_ops(&operation->ctx.mbedtls_ctx)); 374 375#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 376#if defined(PSA_CRYPTO_DRIVER_TEST) 377 /* Add test driver tests here */ 378 379#endif /* PSA_CRYPTO_DRIVER_TEST */ 380#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 381 } 382 383 /* Can't happen (see discussion in #8271) */ 384 return 0; 385} 386 387psa_status_t psa_driver_wrapper_sign_hash_start(psa_sign_hash_interruptible_operation_t *operation, 388 const psa_key_attributes_t *attributes, const uint8_t *key_buffer, 389 size_t key_buffer_size, psa_algorithm_t alg, const uint8_t *hash, 390 size_t hash_length) 391{ 392 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 393 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)); 394 395 switch (location) { 396 case PSA_KEY_LOCATION_LOCAL_STORAGE: 397 /* Key is stored in the slot in export representation, so 398 * cycle through all known transparent accelerators */ 399 400#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 401#if defined(PSA_CRYPTO_DRIVER_TEST) 402 403 /* Add test driver tests here */ 404 405 /* Declared with fallback == true */ 406 407#endif /* PSA_CRYPTO_DRIVER_TEST */ 408#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 409 410 /* Fell through, meaning no accelerator supports this operation */ 411 operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; 412 status = mbedtls_psa_sign_hash_start(&operation->ctx.mbedtls_ctx, attributes, key_buffer, key_buffer_size, 413 alg, hash, hash_length); 414 break; 415 416 /* Add cases for opaque driver here */ 417 418 default: 419 /* Key is declared with a lifetime not known to us */ 420 status = PSA_ERROR_INVALID_ARGUMENT; 421 break; 422 } 423 424 return (status); 425} 426 427psa_status_t psa_driver_wrapper_sign_hash_complete(psa_sign_hash_interruptible_operation_t *operation, 428 uint8_t *signature, size_t signature_size, size_t *signature_length) 429{ 430 switch (operation->id) { 431 case PSA_CRYPTO_MBED_TLS_DRIVER_ID: 432 return (mbedtls_psa_sign_hash_complete(&operation->ctx.mbedtls_ctx, signature, signature_size, 433 signature_length)); 434 435#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 436#if defined(PSA_CRYPTO_DRIVER_TEST) 437 /* Add test driver tests here */ 438 439#endif /* PSA_CRYPTO_DRIVER_TEST */ 440#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 441 } 442 443 (void)signature; 444 (void)signature_size; 445 (void)signature_length; 446 447 return (PSA_ERROR_INVALID_ARGUMENT); 448} 449 450psa_status_t psa_driver_wrapper_sign_hash_abort(psa_sign_hash_interruptible_operation_t *operation) 451{ 452 switch (operation->id) { 453 case PSA_CRYPTO_MBED_TLS_DRIVER_ID: 454 return (mbedtls_psa_sign_hash_abort(&operation->ctx.mbedtls_ctx)); 455 456#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 457#if defined(PSA_CRYPTO_DRIVER_TEST) 458 /* Add test driver tests here */ 459 460#endif /* PSA_CRYPTO_DRIVER_TEST */ 461#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 462 } 463 464 return (PSA_ERROR_INVALID_ARGUMENT); 465} 466 467psa_status_t psa_driver_wrapper_verify_hash_start(psa_verify_hash_interruptible_operation_t *operation, 468 const psa_key_attributes_t *attributes, const uint8_t *key_buffer, 469 size_t key_buffer_size, psa_algorithm_t alg, const uint8_t *hash, 470 size_t hash_length, const uint8_t *signature, size_t signature_length) 471{ 472 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 473 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)); 474 475 switch (location) { 476 case PSA_KEY_LOCATION_LOCAL_STORAGE: 477 /* Key is stored in the slot in export representation, so 478 * cycle through all known transparent accelerators */ 479 480#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 481#if defined(PSA_CRYPTO_DRIVER_TEST) 482 483 /* Add test driver tests here */ 484 485 /* Declared with fallback == true */ 486 487#endif /* PSA_CRYPTO_DRIVER_TEST */ 488#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 489 490 /* Fell through, meaning no accelerator supports this operation */ 491 operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; 492 status = mbedtls_psa_verify_hash_start(&operation->ctx.mbedtls_ctx, attributes, key_buffer, key_buffer_size, 493 alg, hash, hash_length, signature, signature_length); 494 break; 495 496 /* Add cases for opaque driver here */ 497 498 default: 499 /* Key is declared with a lifetime not known to us */ 500 status = PSA_ERROR_INVALID_ARGUMENT; 501 break; 502 } 503 504 return (status); 505} 506 507psa_status_t psa_driver_wrapper_verify_hash_complete(psa_verify_hash_interruptible_operation_t *operation) 508{ 509 switch (operation->id) { 510 case PSA_CRYPTO_MBED_TLS_DRIVER_ID: 511 return (mbedtls_psa_verify_hash_complete(&operation->ctx.mbedtls_ctx)); 512 513#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 514#if defined(PSA_CRYPTO_DRIVER_TEST) 515 /* Add test driver tests here */ 516 517#endif /* PSA_CRYPTO_DRIVER_TEST */ 518#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 519 } 520 521 return (PSA_ERROR_INVALID_ARGUMENT); 522} 523 524psa_status_t psa_driver_wrapper_verify_hash_abort(psa_verify_hash_interruptible_operation_t *operation) 525{ 526 switch (operation->id) { 527 case PSA_CRYPTO_MBED_TLS_DRIVER_ID: 528 return (mbedtls_psa_verify_hash_abort(&operation->ctx.mbedtls_ctx)); 529 530#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 531#if defined(PSA_CRYPTO_DRIVER_TEST) 532 /* Add test driver tests here */ 533 534#endif /* PSA_CRYPTO_DRIVER_TEST */ 535#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 536 } 537 538 return (PSA_ERROR_INVALID_ARGUMENT); 539} 540 541/** Calculate the key buffer size required to store the key material of a key 542 * associated with an opaque driver from input key data. 543 * 544 * \param[in] attributes The key attributes 545 * \param[in] data The input key data. 546 * \param[in] data_length The input data length. 547 * \param[out] key_buffer_size Minimum buffer size to contain the key material. 548 * 549 * \retval #PSA_SUCCESS \emptydescription 550 * \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription 551 * \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription 552 */ 553psa_status_t psa_driver_wrapper_get_key_buffer_size_from_key_data(const psa_key_attributes_t *attributes, 554 const uint8_t *data, size_t data_length, 555 size_t *key_buffer_size) 556{ 557 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)); 558 psa_key_type_t key_type = psa_get_key_type(attributes); 559 560 *key_buffer_size = 0; 561 switch (location) { 562#if defined(PSA_CRYPTO_DRIVER_TEST) 563 case PSA_CRYPTO_TEST_DRIVER_LOCATION: 564 *key_buffer_size = mbedtls_test_opaque_size_function(key_type, PSA_BYTES_TO_BITS(data_length)); 565 return ((*key_buffer_size != 0) ? PSA_SUCCESS : PSA_ERROR_NOT_SUPPORTED); 566#endif /* PSA_CRYPTO_DRIVER_TEST */ 567 568 default: 569 (void)key_type; 570 (void)data; 571 (void)data_length; 572 return (PSA_ERROR_INVALID_ARGUMENT); 573 } 574} 575 576/** Get the key buffer size required to store the key material of a key 577 * associated with an opaque driver. 578 * 579 * \param[in] attributes The key attributes. 580 * \param[out] key_buffer_size Minimum buffer size to contain the key material 581 * 582 * \retval #PSA_SUCCESS 583 * The minimum size for a buffer to contain the key material has been 584 * returned successfully. 585 * \retval #PSA_ERROR_NOT_SUPPORTED 586 * The type and/or the size in bits of the key or the combination of 587 * the two is not supported. 588 * \retval #PSA_ERROR_INVALID_ARGUMENT 589 * The key is declared with a lifetime not known to us. 590 */ 591psa_status_t psa_driver_wrapper_get_key_buffer_size(const psa_key_attributes_t *attributes, size_t *key_buffer_size) 592{ 593 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)); 594 psa_key_type_t key_type = psa_get_key_type(attributes); 595 size_t key_bits = psa_get_key_bits(attributes); 596 597 *key_buffer_size = 0; 598 switch (location) { 599#if defined(PSA_CRYPTO_DRIVER_TEST) 600 case PSA_CRYPTO_TEST_DRIVER_LOCATION: 601#if defined(MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS) 602 /* Emulate property 'builtin_key_size' */ 603 if (psa_key_id_is_builtin(MBEDTLS_SVC_KEY_ID_GET_KEY_ID(psa_get_key_id(attributes)))) { 604 *key_buffer_size = sizeof(psa_drv_slot_number_t); 605 return (PSA_SUCCESS); 606 } 607#endif /* MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS */ 608 *key_buffer_size = mbedtls_test_opaque_size_function(key_type, key_bits); 609 return ((*key_buffer_size != 0) ? PSA_SUCCESS : PSA_ERROR_NOT_SUPPORTED); 610#endif /* PSA_CRYPTO_DRIVER_TEST */ 611 612 default: 613 (void)key_type; 614 (void)key_bits; 615 return (PSA_ERROR_INVALID_ARGUMENT); 616 } 617} 618 619psa_status_t psa_driver_wrapper_generate_key(const psa_key_attributes_t *attributes, 620 const psa_key_production_parameters_t *params, size_t params_data_length, 621 uint8_t *key_buffer, size_t key_buffer_size, size_t *key_buffer_length) 622{ 623 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 624 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)); 625 626#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE) 627 int is_default_production = psa_key_production_parameters_are_default(params, params_data_length); 628 if (location != PSA_KEY_LOCATION_LOCAL_STORAGE && !is_default_production) { 629 /* We don't support passing custom production parameters 630 * to drivers yet. */ 631 return PSA_ERROR_NOT_SUPPORTED; 632 } 633#else 634 int is_default_production = 1; 635 (void)is_default_production; 636#endif 637 /* Try dynamically-registered SE interface first */ 638#if defined(MBEDTLS_PSA_CRYPTO_SE_C) 639 const psa_drv_se_t *drv; 640 psa_drv_se_context_t *drv_context; 641 642 if (psa_get_se_driver(psa_get_key_lifetime(attributes), &drv, &drv_context)) { 643 size_t pubkey_length = 0; /* We don't support this feature yet */ 644 if (drv->key_management == NULL || drv->key_management->p_generate == NULL) { 645 /* Key is defined as being in SE, but we have no way to generate it */ 646 return (PSA_ERROR_NOT_SUPPORTED); 647 } 648 return (drv->key_management->p_generate(drv_context, *((psa_key_slot_number_t *)key_buffer), attributes, NULL, 649 0, &pubkey_length)); 650 } 651#endif /* MBEDTLS_PSA_CRYPTO_SE_C */ 652 653 switch (location) { 654 case PSA_KEY_LOCATION_LOCAL_STORAGE: 655#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 656 /* Transparent drivers are limited to generating asymmetric keys. */ 657 /* We don't support passing custom production parameters 658 * to drivers yet. */ 659 if (PSA_KEY_TYPE_IS_ASYMMETRIC(psa_get_key_type(attributes)) && is_default_production) { 660 /* Cycle through all known transparent accelerators */ 661#if defined(PSA_CRYPTO_DRIVER_TEST) 662 status = 663 mbedtls_test_transparent_generate_key(attributes, key_buffer, key_buffer_size, key_buffer_length); 664 /* Declared with fallback == true */ 665 if (status != PSA_ERROR_NOT_SUPPORTED) 666 break; 667#endif /* PSA_CRYPTO_DRIVER_TEST */ 668#if defined(MBEDTLS_PSA_P256M_DRIVER_ENABLED) 669 if (PSA_KEY_TYPE_IS_ECC(psa_get_key_type(attributes)) && 670 psa_get_key_type(attributes) == PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1) && 671 psa_get_key_bits(attributes) == 256) { 672 status = p256_transparent_generate_key(attributes, key_buffer, key_buffer_size, key_buffer_length); 673 if (status != PSA_ERROR_NOT_SUPPORTED) 674 break; 675 } 676 677#endif /* MBEDTLS_PSA_P256M_DRIVER_ENABLED */ 678 } 679#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 680 681 /* Software fallback */ 682 status = psa_generate_key_internal(attributes, params, params_data_length, key_buffer, key_buffer_size, 683 key_buffer_length); 684 break; 685 686 /* Add cases for opaque driver here */ 687#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 688#if defined(PSA_CRYPTO_DRIVER_TEST) 689 case PSA_CRYPTO_TEST_DRIVER_LOCATION: 690 status = mbedtls_test_opaque_generate_key(attributes, key_buffer, key_buffer_size, key_buffer_length); 691 break; 692#endif /* PSA_CRYPTO_DRIVER_TEST */ 693#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 694 695 default: 696 /* Key is declared with a lifetime not known to us */ 697 status = PSA_ERROR_INVALID_ARGUMENT; 698 break; 699 } 700 701 return (status); 702} 703 704psa_status_t psa_driver_wrapper_import_key(const psa_key_attributes_t *attributes, const uint8_t *data, 705 size_t data_length, uint8_t *key_buffer, size_t key_buffer_size, 706 size_t *key_buffer_length, size_t *bits) 707{ 708 709 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 710 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)); 711 712 /* Try dynamically-registered SE interface first */ 713#if defined(MBEDTLS_PSA_CRYPTO_SE_C) 714 const psa_drv_se_t *drv; 715 psa_drv_se_context_t *drv_context; 716 717 if (psa_get_se_driver(psa_get_key_lifetime(attributes), &drv, &drv_context)) { 718 if (drv->key_management == NULL || drv->key_management->p_import == NULL) 719 return (PSA_ERROR_NOT_SUPPORTED); 720 721 /* The driver should set the number of key bits, however in 722 * case it doesn't, we initialize bits to an invalid value. */ 723 *bits = PSA_MAX_KEY_BITS + 1; 724 status = drv->key_management->p_import(drv_context, *((psa_key_slot_number_t *)key_buffer), attributes, data, 725 data_length, bits); 726 727 if (status != PSA_SUCCESS) 728 return (status); 729 730 if ((*bits) > PSA_MAX_KEY_BITS) 731 return (PSA_ERROR_NOT_SUPPORTED); 732 733 return (PSA_SUCCESS); 734 } 735#endif /* MBEDTLS_PSA_CRYPTO_SE_C */ 736 737 switch (location) { 738 case PSA_KEY_LOCATION_LOCAL_STORAGE: 739 /* Key is stored in the slot in export representation, so 740 * cycle through all known transparent accelerators */ 741#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 742 743#if (defined(PSA_CRYPTO_DRIVER_TEST)) 744 status = mbedtls_test_transparent_import_key(attributes, data, data_length, key_buffer, key_buffer_size, 745 key_buffer_length, bits); 746 747 if (status != PSA_ERROR_NOT_SUPPORTED) 748 return (status); 749#endif 750 751#if (defined(MBEDTLS_PSA_P256M_DRIVER_ENABLED)) 752 status = p256_transparent_import_key(attributes, data, data_length, key_buffer, key_buffer_size, 753 key_buffer_length, bits); 754 755 if (status != PSA_ERROR_NOT_SUPPORTED) 756 return (status); 757#endif 758 759#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 760 761 /* Fell through, meaning no accelerator supports this operation */ 762 return (psa_import_key_into_slot(attributes, data, data_length, key_buffer, key_buffer_size, 763 key_buffer_length, bits)); 764 /* Add cases for opaque driver here */ 765#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 766 767#if (defined(PSA_CRYPTO_DRIVER_TEST)) 768 case 0x7fffff: 769 return (mbedtls_test_opaque_import_key(attributes, data, data_length, key_buffer, key_buffer_size, 770 key_buffer_length, bits)); 771#endif 772 773#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 774 default: 775 (void)status; 776 return (PSA_ERROR_INVALID_ARGUMENT); 777 } 778} 779 780psa_status_t psa_driver_wrapper_export_key(const psa_key_attributes_t *attributes, const uint8_t *key_buffer, 781 size_t key_buffer_size, uint8_t *data, size_t data_size, size_t *data_length) 782 783{ 784 785 psa_status_t status = PSA_ERROR_INVALID_ARGUMENT; 786 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)); 787 788 /* Try dynamically-registered SE interface first */ 789#if defined(MBEDTLS_PSA_CRYPTO_SE_C) 790 const psa_drv_se_t *drv; 791 psa_drv_se_context_t *drv_context; 792 793 if (psa_get_se_driver(psa_get_key_lifetime(attributes), &drv, &drv_context)) { 794 if ((drv->key_management == NULL) || (drv->key_management->p_export == NULL)) { 795 return (PSA_ERROR_NOT_SUPPORTED); 796 } 797 798 return (drv->key_management->p_export(drv_context, *((psa_key_slot_number_t *)key_buffer), data, data_size, 799 data_length)); 800 } 801#endif /* MBEDTLS_PSA_CRYPTO_SE_C */ 802 803 switch (location) { 804 case PSA_KEY_LOCATION_LOCAL_STORAGE: 805 return (psa_export_key_internal(attributes, key_buffer, key_buffer_size, data, data_size, data_length)); 806 807 /* Add cases for opaque driver here */ 808#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 809 810#if (defined(PSA_CRYPTO_DRIVER_TEST)) 811 case 0x7fffff: 812 return ( 813 mbedtls_test_opaque_export_key(attributes, key_buffer, key_buffer_size, data, data_size, data_length)); 814#endif 815 816#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 817 default: 818 /* Key is declared with a lifetime not known to us */ 819 return (status); 820 } 821} 822 823psa_status_t psa_driver_wrapper_export_public_key(const psa_key_attributes_t *attributes, const uint8_t *key_buffer, 824 size_t key_buffer_size, uint8_t *data, size_t data_size, 825 size_t *data_length) 826 827{ 828 829 psa_status_t status = PSA_ERROR_INVALID_ARGUMENT; 830 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)); 831 832 /* Try dynamically-registered SE interface first */ 833#if defined(MBEDTLS_PSA_CRYPTO_SE_C) 834 const psa_drv_se_t *drv; 835 psa_drv_se_context_t *drv_context; 836 837 if (psa_get_se_driver(attributes->core.lifetime, &drv, &drv_context)) { 838 if ((drv->key_management == NULL) || (drv->key_management->p_export_public == NULL)) { 839 return (PSA_ERROR_NOT_SUPPORTED); 840 } 841 842 return (drv->key_management->p_export_public(drv_context, *((psa_key_slot_number_t *)key_buffer), data, 843 data_size, data_length)); 844 } 845#endif /* MBEDTLS_PSA_CRYPTO_SE_C */ 846 847 switch (location) { 848 case PSA_KEY_LOCATION_LOCAL_STORAGE: 849 /* Key is stored in the slot in export representation, so 850 * cycle through all known transparent accelerators */ 851#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 852 853#if (defined(PSA_CRYPTO_DRIVER_TEST)) 854 status = mbedtls_test_transparent_export_public_key(attributes, key_buffer, key_buffer_size, data, 855 data_size, data_length); 856 857 if (status != PSA_ERROR_NOT_SUPPORTED) 858 return (status); 859#endif 860 861#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 862 /* Fell through, meaning no accelerator supports this operation */ 863 return ( 864 psa_export_public_key_internal(attributes, key_buffer, key_buffer_size, data, data_size, data_length)); 865 866 /* Add cases for opaque driver here */ 867#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 868 869#if (defined(PSA_CRYPTO_DRIVER_TEST)) 870 case 0x7fffff: 871 return (mbedtls_test_opaque_export_public_key(attributes, key_buffer, key_buffer_size, data, data_size, 872 data_length)); 873#endif 874 875#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 876 default: 877 /* Key is declared with a lifetime not known to us */ 878 return (status); 879 } 880} 881 882psa_status_t psa_driver_wrapper_get_builtin_key(psa_drv_slot_number_t slot_number, psa_key_attributes_t *attributes, 883 uint8_t *key_buffer, size_t key_buffer_size, size_t *key_buffer_length) 884{ 885 886 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)); 887 switch (location) { 888#if defined(PSA_CRYPTO_DRIVER_TEST) 889 890#if (defined(PSA_CRYPTO_DRIVER_TEST)) 891 case 0x7fffff: 892 return (mbedtls_test_opaque_get_builtin_key(slot_number, attributes, key_buffer, key_buffer_size, 893 key_buffer_length)); 894#endif 895 896#endif /* PSA_CRYPTO_DRIVER_TEST */ 897 default: 898 (void)slot_number; 899 (void)key_buffer; 900 (void)key_buffer_size; 901 (void)key_buffer_length; 902 return (PSA_ERROR_DOES_NOT_EXIST); 903 } 904} 905 906psa_status_t psa_driver_wrapper_copy_key(psa_key_attributes_t *attributes, const uint8_t *source_key, 907 size_t source_key_length, uint8_t *target_key_buffer, 908 size_t target_key_buffer_size, size_t *target_key_buffer_length) 909{ 910 911 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 912 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)); 913 914#if defined(MBEDTLS_PSA_CRYPTO_SE_C) 915 const psa_drv_se_t *drv; 916 psa_drv_se_context_t *drv_context; 917 918 if (psa_get_se_driver(psa_get_key_lifetime(attributes), &drv, &drv_context)) { 919 /* Copying to a secure element is not implemented yet. */ 920 return (PSA_ERROR_NOT_SUPPORTED); 921 } 922#endif /* MBEDTLS_PSA_CRYPTO_SE_C */ 923 924 switch (location) { 925#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 926 927#if (defined(PSA_CRYPTO_DRIVER_TEST)) 928 case 0x7fffff: 929 return (mbedtls_test_opaque_copy_key(attributes, source_key, source_key_length, target_key_buffer, 930 target_key_buffer_size, target_key_buffer_length)); 931#endif 932 933#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 934 default: 935 (void)source_key; 936 (void)source_key_length; 937 (void)target_key_buffer; 938 (void)target_key_buffer_size; 939 (void)target_key_buffer_length; 940 status = PSA_ERROR_INVALID_ARGUMENT; 941 } 942 return (status); 943} 944 945/* 946 * Cipher functions 947 */ 948psa_status_t psa_driver_wrapper_cipher_encrypt(const psa_key_attributes_t *attributes, const uint8_t *key_buffer, 949 size_t key_buffer_size, psa_algorithm_t alg, const uint8_t *iv, 950 size_t iv_length, const uint8_t *input, size_t input_length, 951 uint8_t *output, size_t output_size, size_t *output_length) 952{ 953 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 954 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)); 955 956 switch (location) { 957 case PSA_KEY_LOCATION_LOCAL_STORAGE: 958 /* Key is stored in the slot in export representation, so 959 * cycle through all known transparent accelerators */ 960#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 961#if defined(PSA_CRYPTO_DRIVER_TEST) 962 status = 963 mbedtls_test_transparent_cipher_encrypt(attributes, key_buffer, key_buffer_size, alg, iv, iv_length, 964 input, input_length, output, output_size, output_length); 965 /* Declared with fallback == true */ 966 if (status != PSA_ERROR_NOT_SUPPORTED) 967 return (status); 968#endif /* PSA_CRYPTO_DRIVER_TEST */ 969#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 970 971#if defined(MBEDTLS_PSA_BUILTIN_CIPHER) 972 return (mbedtls_psa_cipher_encrypt(attributes, key_buffer, key_buffer_size, alg, iv, iv_length, input, 973 input_length, output, output_size, output_length)); 974#else 975 return (PSA_ERROR_NOT_SUPPORTED); 976#endif /* MBEDTLS_PSA_BUILTIN_CIPHER */ 977 978 /* Add cases for opaque driver here */ 979#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 980#if defined(PSA_CRYPTO_DRIVER_TEST) 981 case PSA_CRYPTO_TEST_DRIVER_LOCATION: 982 return (mbedtls_test_opaque_cipher_encrypt(attributes, key_buffer, key_buffer_size, alg, iv, iv_length, 983 input, input_length, output, output_size, output_length)); 984#endif /* PSA_CRYPTO_DRIVER_TEST */ 985#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 986 987 default: 988 /* Key is declared with a lifetime not known to us */ 989 (void)status; 990 (void)key_buffer; 991 (void)key_buffer_size; 992 (void)alg; 993 (void)iv; 994 (void)iv_length; 995 (void)input; 996 (void)input_length; 997 (void)output; 998 (void)output_size; 999 (void)output_length; 1000 return (PSA_ERROR_INVALID_ARGUMENT); 1001 } 1002} 1003 1004psa_status_t psa_driver_wrapper_cipher_decrypt(const psa_key_attributes_t *attributes, const uint8_t *key_buffer, 1005 size_t key_buffer_size, psa_algorithm_t alg, const uint8_t *input, 1006 size_t input_length, uint8_t *output, size_t output_size, 1007 size_t *output_length) 1008{ 1009 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 1010 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)); 1011 1012 switch (location) { 1013 case PSA_KEY_LOCATION_LOCAL_STORAGE: 1014 /* Key is stored in the slot in export representation, so 1015 * cycle through all known transparent accelerators */ 1016#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 1017#if defined(PSA_CRYPTO_DRIVER_TEST) 1018 status = mbedtls_test_transparent_cipher_decrypt(attributes, key_buffer, key_buffer_size, alg, input, 1019 input_length, output, output_size, output_length); 1020 /* Declared with fallback == true */ 1021 if (status != PSA_ERROR_NOT_SUPPORTED) 1022 return (status); 1023#endif /* PSA_CRYPTO_DRIVER_TEST */ 1024#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 1025 1026#if defined(MBEDTLS_PSA_BUILTIN_CIPHER) 1027 return (mbedtls_psa_cipher_decrypt(attributes, key_buffer, key_buffer_size, alg, input, input_length, 1028 output, output_size, output_length)); 1029#else 1030 return (PSA_ERROR_NOT_SUPPORTED); 1031#endif /* MBEDTLS_PSA_BUILTIN_CIPHER */ 1032 1033 /* Add cases for opaque driver here */ 1034#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 1035#if defined(PSA_CRYPTO_DRIVER_TEST) 1036 case PSA_CRYPTO_TEST_DRIVER_LOCATION: 1037 return (mbedtls_test_opaque_cipher_decrypt(attributes, key_buffer, key_buffer_size, alg, input, 1038 input_length, output, output_size, output_length)); 1039#endif /* PSA_CRYPTO_DRIVER_TEST */ 1040#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 1041 1042 default: 1043 /* Key is declared with a lifetime not known to us */ 1044 (void)status; 1045 (void)key_buffer; 1046 (void)key_buffer_size; 1047 (void)alg; 1048 (void)input; 1049 (void)input_length; 1050 (void)output; 1051 (void)output_size; 1052 (void)output_length; 1053 return (PSA_ERROR_INVALID_ARGUMENT); 1054 } 1055} 1056 1057psa_status_t psa_driver_wrapper_cipher_encrypt_setup(psa_cipher_operation_t *operation, 1058 const psa_key_attributes_t *attributes, const uint8_t *key_buffer, 1059 size_t key_buffer_size, psa_algorithm_t alg) 1060{ 1061 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 1062 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)); 1063 1064 switch (location) { 1065 case PSA_KEY_LOCATION_LOCAL_STORAGE: 1066 /* Key is stored in the slot in export representation, so 1067 * cycle through all known transparent accelerators */ 1068#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 1069#if defined(PSA_CRYPTO_DRIVER_TEST) 1070 status = mbedtls_test_transparent_cipher_encrypt_setup(&operation->ctx.transparent_test_driver_ctx, 1071 attributes, key_buffer, key_buffer_size, alg); 1072 /* Declared with fallback == true */ 1073 if (status == PSA_SUCCESS) 1074 operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID; 1075 1076 if (status != PSA_ERROR_NOT_SUPPORTED) 1077 return (status); 1078#endif /* PSA_CRYPTO_DRIVER_TEST */ 1079#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 1080#if defined(MBEDTLS_PSA_BUILTIN_CIPHER) 1081 /* Fell through, meaning no accelerator supports this operation */ 1082 status = mbedtls_psa_cipher_encrypt_setup(&operation->ctx.mbedtls_ctx, attributes, key_buffer, 1083 key_buffer_size, alg); 1084 if (status == PSA_SUCCESS) 1085 operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; 1086 1087 if (status != PSA_ERROR_NOT_SUPPORTED) 1088 return (status); 1089#endif /* MBEDTLS_PSA_BUILTIN_CIPHER */ 1090 return (PSA_ERROR_NOT_SUPPORTED); 1091 1092 /* Add cases for opaque driver here */ 1093#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 1094#if defined(PSA_CRYPTO_DRIVER_TEST) 1095 case PSA_CRYPTO_TEST_DRIVER_LOCATION: 1096 status = mbedtls_test_opaque_cipher_encrypt_setup(&operation->ctx.opaque_test_driver_ctx, attributes, 1097 key_buffer, key_buffer_size, alg); 1098 1099 if (status == PSA_SUCCESS) 1100 operation->id = MBEDTLS_TEST_OPAQUE_DRIVER_ID; 1101 1102 return (status); 1103#endif /* PSA_CRYPTO_DRIVER_TEST */ 1104#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 1105 default: 1106 /* Key is declared with a lifetime not known to us */ 1107 (void)status; 1108 (void)operation; 1109 (void)key_buffer; 1110 (void)key_buffer_size; 1111 (void)alg; 1112 return (PSA_ERROR_INVALID_ARGUMENT); 1113 } 1114} 1115 1116psa_status_t psa_driver_wrapper_cipher_decrypt_setup(psa_cipher_operation_t *operation, 1117 const psa_key_attributes_t *attributes, const uint8_t *key_buffer, 1118 size_t key_buffer_size, psa_algorithm_t alg) 1119{ 1120 psa_status_t status = PSA_ERROR_INVALID_ARGUMENT; 1121 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)); 1122 1123 switch (location) { 1124 case PSA_KEY_LOCATION_LOCAL_STORAGE: 1125 /* Key is stored in the slot in export representation, so 1126 * cycle through all known transparent accelerators */ 1127#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 1128#if defined(PSA_CRYPTO_DRIVER_TEST) 1129 status = mbedtls_test_transparent_cipher_decrypt_setup(&operation->ctx.transparent_test_driver_ctx, 1130 attributes, key_buffer, key_buffer_size, alg); 1131 /* Declared with fallback == true */ 1132 if (status == PSA_SUCCESS) 1133 operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID; 1134 1135 if (status != PSA_ERROR_NOT_SUPPORTED) 1136 return (status); 1137#endif /* PSA_CRYPTO_DRIVER_TEST */ 1138#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 1139#if defined(MBEDTLS_PSA_BUILTIN_CIPHER) 1140 /* Fell through, meaning no accelerator supports this operation */ 1141 status = mbedtls_psa_cipher_decrypt_setup(&operation->ctx.mbedtls_ctx, attributes, key_buffer, 1142 key_buffer_size, alg); 1143 if (status == PSA_SUCCESS) 1144 operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; 1145 1146 return (status); 1147#else /* MBEDTLS_PSA_BUILTIN_CIPHER */ 1148 return (PSA_ERROR_NOT_SUPPORTED); 1149#endif /* MBEDTLS_PSA_BUILTIN_CIPHER */ 1150 1151 /* Add cases for opaque driver here */ 1152#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 1153#if defined(PSA_CRYPTO_DRIVER_TEST) 1154 case PSA_CRYPTO_TEST_DRIVER_LOCATION: 1155 status = mbedtls_test_opaque_cipher_decrypt_setup(&operation->ctx.opaque_test_driver_ctx, attributes, 1156 key_buffer, key_buffer_size, alg); 1157 1158 if (status == PSA_SUCCESS) 1159 operation->id = MBEDTLS_TEST_OPAQUE_DRIVER_ID; 1160 1161 return (status); 1162#endif /* PSA_CRYPTO_DRIVER_TEST */ 1163#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 1164 default: 1165 /* Key is declared with a lifetime not known to us */ 1166 (void)status; 1167 (void)operation; 1168 (void)key_buffer; 1169 (void)key_buffer_size; 1170 (void)alg; 1171 return (PSA_ERROR_INVALID_ARGUMENT); 1172 } 1173} 1174 1175psa_status_t psa_driver_wrapper_cipher_set_iv(psa_cipher_operation_t *operation, const uint8_t *iv, size_t iv_length) 1176{ 1177 switch (operation->id) { 1178#if defined(MBEDTLS_PSA_BUILTIN_CIPHER) 1179 case PSA_CRYPTO_MBED_TLS_DRIVER_ID: 1180 return (mbedtls_psa_cipher_set_iv(&operation->ctx.mbedtls_ctx, iv, iv_length)); 1181#endif /* MBEDTLS_PSA_BUILTIN_CIPHER */ 1182 1183#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 1184#if defined(PSA_CRYPTO_DRIVER_TEST) 1185 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: 1186 return (mbedtls_test_transparent_cipher_set_iv(&operation->ctx.transparent_test_driver_ctx, iv, iv_length)); 1187 1188 case MBEDTLS_TEST_OPAQUE_DRIVER_ID: 1189 return (mbedtls_test_opaque_cipher_set_iv(&operation->ctx.opaque_test_driver_ctx, iv, iv_length)); 1190#endif /* PSA_CRYPTO_DRIVER_TEST */ 1191#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 1192 } 1193 1194 (void)iv; 1195 (void)iv_length; 1196 1197 return (PSA_ERROR_INVALID_ARGUMENT); 1198} 1199 1200psa_status_t psa_driver_wrapper_cipher_update(psa_cipher_operation_t *operation, const uint8_t *input, 1201 size_t input_length, uint8_t *output, size_t output_size, 1202 size_t *output_length) 1203{ 1204 switch (operation->id) { 1205#if defined(MBEDTLS_PSA_BUILTIN_CIPHER) 1206 case PSA_CRYPTO_MBED_TLS_DRIVER_ID: 1207 return (mbedtls_psa_cipher_update(&operation->ctx.mbedtls_ctx, input, input_length, output, output_size, 1208 output_length)); 1209#endif /* MBEDTLS_PSA_BUILTIN_CIPHER */ 1210 1211#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 1212#if defined(PSA_CRYPTO_DRIVER_TEST) 1213 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: 1214 return (mbedtls_test_transparent_cipher_update(&operation->ctx.transparent_test_driver_ctx, input, 1215 input_length, output, output_size, output_length)); 1216 1217 case MBEDTLS_TEST_OPAQUE_DRIVER_ID: 1218 return (mbedtls_test_opaque_cipher_update(&operation->ctx.opaque_test_driver_ctx, input, input_length, 1219 output, output_size, output_length)); 1220#endif /* PSA_CRYPTO_DRIVER_TEST */ 1221#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 1222 } 1223 1224 (void)input; 1225 (void)input_length; 1226 (void)output; 1227 (void)output_size; 1228 (void)output_length; 1229 1230 return (PSA_ERROR_INVALID_ARGUMENT); 1231} 1232 1233psa_status_t psa_driver_wrapper_cipher_finish(psa_cipher_operation_t *operation, uint8_t *output, size_t output_size, 1234 size_t *output_length) 1235{ 1236 switch (operation->id) { 1237#if defined(MBEDTLS_PSA_BUILTIN_CIPHER) 1238 case PSA_CRYPTO_MBED_TLS_DRIVER_ID: 1239 return (mbedtls_psa_cipher_finish(&operation->ctx.mbedtls_ctx, output, output_size, output_length)); 1240#endif /* MBEDTLS_PSA_BUILTIN_CIPHER */ 1241 1242#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 1243#if defined(PSA_CRYPTO_DRIVER_TEST) 1244 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: 1245 return (mbedtls_test_transparent_cipher_finish(&operation->ctx.transparent_test_driver_ctx, output, 1246 output_size, output_length)); 1247 1248 case MBEDTLS_TEST_OPAQUE_DRIVER_ID: 1249 return (mbedtls_test_opaque_cipher_finish(&operation->ctx.opaque_test_driver_ctx, output, output_size, 1250 output_length)); 1251#endif /* PSA_CRYPTO_DRIVER_TEST */ 1252#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 1253 } 1254 1255 (void)output; 1256 (void)output_size; 1257 (void)output_length; 1258 1259 return (PSA_ERROR_INVALID_ARGUMENT); 1260} 1261 1262psa_status_t psa_driver_wrapper_cipher_abort(psa_cipher_operation_t *operation) 1263{ 1264 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 1265 1266 switch (operation->id) { 1267#if defined(MBEDTLS_PSA_BUILTIN_CIPHER) 1268 case PSA_CRYPTO_MBED_TLS_DRIVER_ID: 1269 return (mbedtls_psa_cipher_abort(&operation->ctx.mbedtls_ctx)); 1270#endif /* MBEDTLS_PSA_BUILTIN_CIPHER */ 1271 1272#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 1273#if defined(PSA_CRYPTO_DRIVER_TEST) 1274 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: 1275 status = mbedtls_test_transparent_cipher_abort(&operation->ctx.transparent_test_driver_ctx); 1276 mbedtls_platform_zeroize(&operation->ctx.transparent_test_driver_ctx, 1277 sizeof(operation->ctx.transparent_test_driver_ctx)); 1278 return (status); 1279 1280 case MBEDTLS_TEST_OPAQUE_DRIVER_ID: 1281 status = mbedtls_test_opaque_cipher_abort(&operation->ctx.opaque_test_driver_ctx); 1282 mbedtls_platform_zeroize(&operation->ctx.opaque_test_driver_ctx, 1283 sizeof(operation->ctx.opaque_test_driver_ctx)); 1284 return (status); 1285#endif /* PSA_CRYPTO_DRIVER_TEST */ 1286#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 1287 } 1288 1289 (void)status; 1290 return (PSA_ERROR_INVALID_ARGUMENT); 1291} 1292 1293/* 1294 * Hashing functions 1295 */ 1296psa_status_t psa_driver_wrapper_hash_compute(psa_algorithm_t alg, const uint8_t *input, size_t input_length, 1297 uint8_t *hash, size_t hash_size, size_t *hash_length) 1298{ 1299 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 1300 1301 /* Try accelerators first */ 1302#if defined(PSA_CRYPTO_DRIVER_TEST) 1303 status = mbedtls_test_transparent_hash_compute(alg, input, input_length, hash, hash_size, hash_length); 1304 if (status != PSA_ERROR_NOT_SUPPORTED) 1305 return (status); 1306#endif 1307 1308 /* If software fallback is compiled in, try fallback */ 1309#if defined(MBEDTLS_PSA_BUILTIN_HASH) 1310 status = mbedtls_psa_hash_compute(alg, input, input_length, hash, hash_size, hash_length); 1311 if (status != PSA_ERROR_NOT_SUPPORTED) 1312 return (status); 1313#endif 1314 (void)status; 1315 (void)alg; 1316 (void)input; 1317 (void)input_length; 1318 (void)hash; 1319 (void)hash_size; 1320 (void)hash_length; 1321 1322 return (PSA_ERROR_NOT_SUPPORTED); 1323} 1324 1325psa_status_t psa_driver_wrapper_hash_setup(psa_hash_operation_t *operation, psa_algorithm_t alg) 1326{ 1327 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 1328 1329 /* Try setup on accelerators first */ 1330#if defined(PSA_CRYPTO_DRIVER_TEST) 1331 status = mbedtls_test_transparent_hash_setup(&operation->ctx.test_driver_ctx, alg); 1332 if (status == PSA_SUCCESS) 1333 operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID; 1334 1335 if (status != PSA_ERROR_NOT_SUPPORTED) 1336 return (status); 1337#endif 1338 1339 /* If software fallback is compiled in, try fallback */ 1340#if defined(MBEDTLS_PSA_BUILTIN_HASH) 1341 status = mbedtls_psa_hash_setup(&operation->ctx.mbedtls_ctx, alg); 1342 if (status == PSA_SUCCESS) 1343 operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; 1344 1345 if (status != PSA_ERROR_NOT_SUPPORTED) 1346 return (status); 1347#endif 1348 /* Nothing left to try if we fall through here */ 1349 (void)status; 1350 (void)operation; 1351 (void)alg; 1352 return (PSA_ERROR_NOT_SUPPORTED); 1353} 1354 1355psa_status_t psa_driver_wrapper_hash_clone(const psa_hash_operation_t *source_operation, 1356 psa_hash_operation_t *target_operation) 1357{ 1358 switch (source_operation->id) { 1359#if defined(MBEDTLS_PSA_BUILTIN_HASH) 1360 case PSA_CRYPTO_MBED_TLS_DRIVER_ID: 1361 target_operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; 1362 return (mbedtls_psa_hash_clone(&source_operation->ctx.mbedtls_ctx, &target_operation->ctx.mbedtls_ctx)); 1363#endif 1364#if defined(PSA_CRYPTO_DRIVER_TEST) 1365 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: 1366 target_operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID; 1367 return (mbedtls_test_transparent_hash_clone(&source_operation->ctx.test_driver_ctx, 1368 &target_operation->ctx.test_driver_ctx)); 1369#endif 1370 default: 1371 (void)target_operation; 1372 return (PSA_ERROR_BAD_STATE); 1373 } 1374} 1375 1376psa_status_t psa_driver_wrapper_hash_update(psa_hash_operation_t *operation, const uint8_t *input, size_t input_length) 1377{ 1378 switch (operation->id) { 1379#if defined(MBEDTLS_PSA_BUILTIN_HASH) 1380 case PSA_CRYPTO_MBED_TLS_DRIVER_ID: 1381 return (mbedtls_psa_hash_update(&operation->ctx.mbedtls_ctx, input, input_length)); 1382#endif 1383#if defined(PSA_CRYPTO_DRIVER_TEST) 1384 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: 1385 return (mbedtls_test_transparent_hash_update(&operation->ctx.test_driver_ctx, input, input_length)); 1386#endif 1387 default: 1388 (void)input; 1389 (void)input_length; 1390 return (PSA_ERROR_BAD_STATE); 1391 } 1392} 1393 1394psa_status_t psa_driver_wrapper_hash_finish(psa_hash_operation_t *operation, uint8_t *hash, size_t hash_size, 1395 size_t *hash_length) 1396{ 1397 switch (operation->id) { 1398#if defined(MBEDTLS_PSA_BUILTIN_HASH) 1399 case PSA_CRYPTO_MBED_TLS_DRIVER_ID: 1400 return (mbedtls_psa_hash_finish(&operation->ctx.mbedtls_ctx, hash, hash_size, hash_length)); 1401#endif 1402#if defined(PSA_CRYPTO_DRIVER_TEST) 1403 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: 1404 return ( 1405 mbedtls_test_transparent_hash_finish(&operation->ctx.test_driver_ctx, hash, hash_size, hash_length)); 1406#endif 1407 default: 1408 (void)hash; 1409 (void)hash_size; 1410 (void)hash_length; 1411 return (PSA_ERROR_BAD_STATE); 1412 } 1413} 1414 1415psa_status_t psa_driver_wrapper_hash_abort(psa_hash_operation_t *operation) 1416{ 1417 switch (operation->id) { 1418#if defined(MBEDTLS_PSA_BUILTIN_HASH) 1419 case PSA_CRYPTO_MBED_TLS_DRIVER_ID: 1420 return (mbedtls_psa_hash_abort(&operation->ctx.mbedtls_ctx)); 1421#endif 1422#if defined(PSA_CRYPTO_DRIVER_TEST) 1423 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: 1424 return (mbedtls_test_transparent_hash_abort(&operation->ctx.test_driver_ctx)); 1425#endif 1426 default: 1427 return (PSA_ERROR_BAD_STATE); 1428 } 1429} 1430 1431psa_status_t psa_driver_wrapper_aead_encrypt(const psa_key_attributes_t *attributes, const uint8_t *key_buffer, 1432 size_t key_buffer_size, psa_algorithm_t alg, const uint8_t *nonce, 1433 size_t nonce_length, const uint8_t *additional_data, 1434 size_t additional_data_length, const uint8_t *plaintext, 1435 size_t plaintext_length, uint8_t *ciphertext, size_t ciphertext_size, 1436 size_t *ciphertext_length) 1437{ 1438 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 1439 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)); 1440 1441 switch (location) { 1442 case PSA_KEY_LOCATION_LOCAL_STORAGE: 1443 /* Key is stored in the slot in export representation, so 1444 * cycle through all known transparent accelerators */ 1445 1446#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 1447#if defined(PSA_CRYPTO_DRIVER_TEST) 1448 status = mbedtls_test_transparent_aead_encrypt( 1449 attributes, key_buffer, key_buffer_size, alg, nonce, nonce_length, additional_data, 1450 additional_data_length, plaintext, plaintext_length, ciphertext, ciphertext_size, ciphertext_length); 1451 /* Declared with fallback == true */ 1452 if (status != PSA_ERROR_NOT_SUPPORTED) 1453 return (status); 1454#endif /* PSA_CRYPTO_DRIVER_TEST */ 1455#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 1456 1457 /* Fell through, meaning no accelerator supports this operation */ 1458 return (mbedtls_psa_aead_encrypt(attributes, key_buffer, key_buffer_size, alg, nonce, nonce_length, 1459 additional_data, additional_data_length, plaintext, plaintext_length, 1460 ciphertext, ciphertext_size, ciphertext_length)); 1461 1462 /* Add cases for opaque driver here */ 1463 1464 default: 1465 /* Key is declared with a lifetime not known to us */ 1466 (void)status; 1467 return (PSA_ERROR_INVALID_ARGUMENT); 1468 } 1469} 1470 1471psa_status_t psa_driver_wrapper_aead_decrypt(const psa_key_attributes_t *attributes, const uint8_t *key_buffer, 1472 size_t key_buffer_size, psa_algorithm_t alg, const uint8_t *nonce, 1473 size_t nonce_length, const uint8_t *additional_data, 1474 size_t additional_data_length, const uint8_t *ciphertext, 1475 size_t ciphertext_length, uint8_t *plaintext, size_t plaintext_size, 1476 size_t *plaintext_length) 1477{ 1478 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 1479 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)); 1480 1481 switch (location) { 1482 case PSA_KEY_LOCATION_LOCAL_STORAGE: 1483 /* Key is stored in the slot in export representation, so 1484 * cycle through all known transparent accelerators */ 1485 1486#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 1487#if defined(PSA_CRYPTO_DRIVER_TEST) 1488 status = mbedtls_test_transparent_aead_decrypt( 1489 attributes, key_buffer, key_buffer_size, alg, nonce, nonce_length, additional_data, 1490 additional_data_length, ciphertext, ciphertext_length, plaintext, plaintext_size, plaintext_length); 1491 /* Declared with fallback == true */ 1492 if (status != PSA_ERROR_NOT_SUPPORTED) 1493 return (status); 1494#endif /* PSA_CRYPTO_DRIVER_TEST */ 1495#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 1496 1497 /* Fell through, meaning no accelerator supports this operation */ 1498 return (mbedtls_psa_aead_decrypt(attributes, key_buffer, key_buffer_size, alg, nonce, nonce_length, 1499 additional_data, additional_data_length, ciphertext, ciphertext_length, 1500 plaintext, plaintext_size, plaintext_length)); 1501 1502 /* Add cases for opaque driver here */ 1503 1504 default: 1505 /* Key is declared with a lifetime not known to us */ 1506 (void)status; 1507 return (PSA_ERROR_INVALID_ARGUMENT); 1508 } 1509} 1510 1511psa_status_t psa_driver_wrapper_aead_encrypt_setup(psa_aead_operation_t *operation, 1512 const psa_key_attributes_t *attributes, const uint8_t *key_buffer, 1513 size_t key_buffer_size, psa_algorithm_t alg) 1514{ 1515 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 1516 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)); 1517 1518 switch (location) { 1519 case PSA_KEY_LOCATION_LOCAL_STORAGE: 1520 /* Key is stored in the slot in export representation, so 1521 * cycle through all known transparent accelerators */ 1522 1523#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 1524#if defined(PSA_CRYPTO_DRIVER_TEST) 1525 operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID; 1526 status = mbedtls_test_transparent_aead_encrypt_setup(&operation->ctx.transparent_test_driver_ctx, 1527 attributes, key_buffer, key_buffer_size, alg); 1528 1529 /* Declared with fallback == true */ 1530 if (status != PSA_ERROR_NOT_SUPPORTED) 1531 return (status); 1532#endif /* PSA_CRYPTO_DRIVER_TEST */ 1533#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 1534 1535 /* Fell through, meaning no accelerator supports this operation */ 1536 operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; 1537 status = mbedtls_psa_aead_encrypt_setup(&operation->ctx.mbedtls_ctx, attributes, key_buffer, 1538 key_buffer_size, alg); 1539 1540 return (status); 1541 1542 /* Add cases for opaque driver here */ 1543 1544 default: 1545 /* Key is declared with a lifetime not known to us */ 1546 (void)status; 1547 return (PSA_ERROR_INVALID_ARGUMENT); 1548 } 1549} 1550 1551psa_status_t psa_driver_wrapper_aead_decrypt_setup(psa_aead_operation_t *operation, 1552 const psa_key_attributes_t *attributes, const uint8_t *key_buffer, 1553 size_t key_buffer_size, psa_algorithm_t alg) 1554{ 1555 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 1556 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)); 1557 1558 switch (location) { 1559 case PSA_KEY_LOCATION_LOCAL_STORAGE: 1560 /* Key is stored in the slot in export representation, so 1561 * cycle through all known transparent accelerators */ 1562 1563#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 1564#if defined(PSA_CRYPTO_DRIVER_TEST) 1565 operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID; 1566 status = mbedtls_test_transparent_aead_decrypt_setup(&operation->ctx.transparent_test_driver_ctx, 1567 attributes, key_buffer, key_buffer_size, alg); 1568 1569 /* Declared with fallback == true */ 1570 if (status != PSA_ERROR_NOT_SUPPORTED) 1571 return (status); 1572#endif /* PSA_CRYPTO_DRIVER_TEST */ 1573#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 1574 1575 /* Fell through, meaning no accelerator supports this operation */ 1576 operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; 1577 status = mbedtls_psa_aead_decrypt_setup(&operation->ctx.mbedtls_ctx, attributes, key_buffer, 1578 key_buffer_size, alg); 1579 1580 return (status); 1581 1582 /* Add cases for opaque driver here */ 1583 1584 default: 1585 /* Key is declared with a lifetime not known to us */ 1586 (void)status; 1587 return (PSA_ERROR_INVALID_ARGUMENT); 1588 } 1589} 1590 1591psa_status_t psa_driver_wrapper_aead_set_nonce(psa_aead_operation_t *operation, const uint8_t *nonce, 1592 size_t nonce_length) 1593{ 1594 switch (operation->id) { 1595#if defined(MBEDTLS_PSA_BUILTIN_AEAD) 1596 case PSA_CRYPTO_MBED_TLS_DRIVER_ID: 1597 return (mbedtls_psa_aead_set_nonce(&operation->ctx.mbedtls_ctx, nonce, nonce_length)); 1598 1599#endif /* MBEDTLS_PSA_BUILTIN_AEAD */ 1600 1601#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 1602#if defined(PSA_CRYPTO_DRIVER_TEST) 1603 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: 1604 return (mbedtls_test_transparent_aead_set_nonce(&operation->ctx.transparent_test_driver_ctx, nonce, 1605 nonce_length)); 1606 1607 /* Add cases for opaque driver here */ 1608 1609#endif /* PSA_CRYPTO_DRIVER_TEST */ 1610#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 1611 } 1612 1613 (void)nonce; 1614 (void)nonce_length; 1615 1616 return (PSA_ERROR_INVALID_ARGUMENT); 1617} 1618 1619psa_status_t psa_driver_wrapper_aead_set_lengths(psa_aead_operation_t *operation, size_t ad_length, 1620 size_t plaintext_length) 1621{ 1622 switch (operation->id) { 1623#if defined(MBEDTLS_PSA_BUILTIN_AEAD) 1624 case PSA_CRYPTO_MBED_TLS_DRIVER_ID: 1625 return (mbedtls_psa_aead_set_lengths(&operation->ctx.mbedtls_ctx, ad_length, plaintext_length)); 1626 1627#endif /* MBEDTLS_PSA_BUILTIN_AEAD */ 1628 1629#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 1630#if defined(PSA_CRYPTO_DRIVER_TEST) 1631 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: 1632 return (mbedtls_test_transparent_aead_set_lengths(&operation->ctx.transparent_test_driver_ctx, ad_length, 1633 plaintext_length)); 1634 1635 /* Add cases for opaque driver here */ 1636 1637#endif /* PSA_CRYPTO_DRIVER_TEST */ 1638#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 1639 } 1640 1641 (void)ad_length; 1642 (void)plaintext_length; 1643 1644 return (PSA_ERROR_INVALID_ARGUMENT); 1645} 1646 1647psa_status_t psa_driver_wrapper_aead_update_ad(psa_aead_operation_t *operation, const uint8_t *input, 1648 size_t input_length) 1649{ 1650 switch (operation->id) { 1651#if defined(MBEDTLS_PSA_BUILTIN_AEAD) 1652 case PSA_CRYPTO_MBED_TLS_DRIVER_ID: 1653 return (mbedtls_psa_aead_update_ad(&operation->ctx.mbedtls_ctx, input, input_length)); 1654 1655#endif /* MBEDTLS_PSA_BUILTIN_AEAD */ 1656 1657#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 1658#if defined(PSA_CRYPTO_DRIVER_TEST) 1659 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: 1660 return (mbedtls_test_transparent_aead_update_ad(&operation->ctx.transparent_test_driver_ctx, input, 1661 input_length)); 1662 1663 /* Add cases for opaque driver here */ 1664 1665#endif /* PSA_CRYPTO_DRIVER_TEST */ 1666#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 1667 } 1668 1669 (void)input; 1670 (void)input_length; 1671 1672 return (PSA_ERROR_INVALID_ARGUMENT); 1673} 1674 1675psa_status_t psa_driver_wrapper_aead_update(psa_aead_operation_t *operation, const uint8_t *input, size_t input_length, 1676 uint8_t *output, size_t output_size, size_t *output_length) 1677{ 1678 switch (operation->id) { 1679#if defined(MBEDTLS_PSA_BUILTIN_AEAD) 1680 case PSA_CRYPTO_MBED_TLS_DRIVER_ID: 1681 return (mbedtls_psa_aead_update(&operation->ctx.mbedtls_ctx, input, input_length, output, output_size, 1682 output_length)); 1683 1684#endif /* MBEDTLS_PSA_BUILTIN_AEAD */ 1685 1686#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 1687#if defined(PSA_CRYPTO_DRIVER_TEST) 1688 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: 1689 return (mbedtls_test_transparent_aead_update(&operation->ctx.transparent_test_driver_ctx, input, 1690 input_length, output, output_size, output_length)); 1691 1692 /* Add cases for opaque driver here */ 1693 1694#endif /* PSA_CRYPTO_DRIVER_TEST */ 1695#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 1696 } 1697 1698 (void)input; 1699 (void)input_length; 1700 (void)output; 1701 (void)output_size; 1702 (void)output_length; 1703 1704 return (PSA_ERROR_INVALID_ARGUMENT); 1705} 1706 1707psa_status_t psa_driver_wrapper_aead_finish(psa_aead_operation_t *operation, uint8_t *ciphertext, 1708 size_t ciphertext_size, size_t *ciphertext_length, uint8_t *tag, 1709 size_t tag_size, size_t *tag_length) 1710{ 1711 switch (operation->id) { 1712#if defined(MBEDTLS_PSA_BUILTIN_AEAD) 1713 case PSA_CRYPTO_MBED_TLS_DRIVER_ID: 1714 return (mbedtls_psa_aead_finish(&operation->ctx.mbedtls_ctx, ciphertext, ciphertext_size, ciphertext_length, 1715 tag, tag_size, tag_length)); 1716 1717#endif /* MBEDTLS_PSA_BUILTIN_AEAD */ 1718 1719#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 1720#if defined(PSA_CRYPTO_DRIVER_TEST) 1721 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: 1722 return (mbedtls_test_transparent_aead_finish(&operation->ctx.transparent_test_driver_ctx, ciphertext, 1723 ciphertext_size, ciphertext_length, tag, tag_size, 1724 tag_length)); 1725 1726 /* Add cases for opaque driver here */ 1727 1728#endif /* PSA_CRYPTO_DRIVER_TEST */ 1729#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 1730 } 1731 1732 (void)ciphertext; 1733 (void)ciphertext_size; 1734 (void)ciphertext_length; 1735 (void)tag; 1736 (void)tag_size; 1737 (void)tag_length; 1738 1739 return (PSA_ERROR_INVALID_ARGUMENT); 1740} 1741 1742psa_status_t psa_driver_wrapper_aead_verify(psa_aead_operation_t *operation, uint8_t *plaintext, size_t plaintext_size, 1743 size_t *plaintext_length, const uint8_t *tag, size_t tag_length) 1744{ 1745 switch (operation->id) { 1746#if defined(MBEDTLS_PSA_BUILTIN_AEAD) 1747 case PSA_CRYPTO_MBED_TLS_DRIVER_ID: { 1748 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 1749 uint8_t check_tag[PSA_AEAD_TAG_MAX_SIZE]; 1750 size_t check_tag_length; 1751 1752 status = mbedtls_psa_aead_finish(&operation->ctx.mbedtls_ctx, plaintext, plaintext_size, plaintext_length, 1753 check_tag, sizeof(check_tag), &check_tag_length); 1754 1755 if (status == PSA_SUCCESS) { 1756 if (tag_length != check_tag_length || mbedtls_ct_memcmp(tag, check_tag, tag_length) != 0) 1757 status = PSA_ERROR_INVALID_SIGNATURE; 1758 } 1759 1760 mbedtls_platform_zeroize(check_tag, sizeof(check_tag)); 1761 1762 return (status); 1763 } 1764 1765#endif /* MBEDTLS_PSA_BUILTIN_AEAD */ 1766 1767#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 1768#if defined(PSA_CRYPTO_DRIVER_TEST) 1769 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: 1770 return (mbedtls_test_transparent_aead_verify(&operation->ctx.transparent_test_driver_ctx, plaintext, 1771 plaintext_size, plaintext_length, tag, tag_length)); 1772 1773 /* Add cases for opaque driver here */ 1774 1775#endif /* PSA_CRYPTO_DRIVER_TEST */ 1776#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 1777 } 1778 1779 (void)plaintext; 1780 (void)plaintext_size; 1781 (void)plaintext_length; 1782 (void)tag; 1783 (void)tag_length; 1784 1785 return (PSA_ERROR_INVALID_ARGUMENT); 1786} 1787 1788psa_status_t psa_driver_wrapper_aead_abort(psa_aead_operation_t *operation) 1789{ 1790 switch (operation->id) { 1791#if defined(MBEDTLS_PSA_BUILTIN_AEAD) 1792 case PSA_CRYPTO_MBED_TLS_DRIVER_ID: 1793 return (mbedtls_psa_aead_abort(&operation->ctx.mbedtls_ctx)); 1794 1795#endif /* MBEDTLS_PSA_BUILTIN_AEAD */ 1796 1797#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 1798#if defined(PSA_CRYPTO_DRIVER_TEST) 1799 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: 1800 return (mbedtls_test_transparent_aead_abort(&operation->ctx.transparent_test_driver_ctx)); 1801 1802 /* Add cases for opaque driver here */ 1803 1804#endif /* PSA_CRYPTO_DRIVER_TEST */ 1805#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 1806 } 1807 1808 return (PSA_ERROR_INVALID_ARGUMENT); 1809} 1810 1811/* 1812 * MAC functions 1813 */ 1814psa_status_t psa_driver_wrapper_mac_compute(const psa_key_attributes_t *attributes, const uint8_t *key_buffer, 1815 size_t key_buffer_size, psa_algorithm_t alg, const uint8_t *input, 1816 size_t input_length, uint8_t *mac, size_t mac_size, size_t *mac_length) 1817{ 1818 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 1819 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)); 1820 1821 switch (location) { 1822 case PSA_KEY_LOCATION_LOCAL_STORAGE: 1823 /* Key is stored in the slot in export representation, so 1824 * cycle through all known transparent accelerators */ 1825#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 1826#if defined(PSA_CRYPTO_DRIVER_TEST) 1827 status = mbedtls_test_transparent_mac_compute(attributes, key_buffer, key_buffer_size, alg, input, 1828 input_length, mac, mac_size, mac_length); 1829 /* Declared with fallback == true */ 1830 if (status != PSA_ERROR_NOT_SUPPORTED) 1831 return (status); 1832#endif /* PSA_CRYPTO_DRIVER_TEST */ 1833#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 1834#if defined(MBEDTLS_PSA_BUILTIN_MAC) 1835 /* Fell through, meaning no accelerator supports this operation */ 1836 status = mbedtls_psa_mac_compute(attributes, key_buffer, key_buffer_size, alg, input, input_length, mac, 1837 mac_size, mac_length); 1838 if (status != PSA_ERROR_NOT_SUPPORTED) 1839 return (status); 1840#endif /* MBEDTLS_PSA_BUILTIN_MAC */ 1841 return (PSA_ERROR_NOT_SUPPORTED); 1842 1843 /* Add cases for opaque driver here */ 1844#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 1845#if defined(PSA_CRYPTO_DRIVER_TEST) 1846 case PSA_CRYPTO_TEST_DRIVER_LOCATION: 1847 status = mbedtls_test_opaque_mac_compute(attributes, key_buffer, key_buffer_size, alg, input, input_length, 1848 mac, mac_size, mac_length); 1849 return (status); 1850#endif /* PSA_CRYPTO_DRIVER_TEST */ 1851#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 1852 default: 1853 /* Key is declared with a lifetime not known to us */ 1854 (void)key_buffer; 1855 (void)key_buffer_size; 1856 (void)alg; 1857 (void)input; 1858 (void)input_length; 1859 (void)mac; 1860 (void)mac_size; 1861 (void)mac_length; 1862 (void)status; 1863 return (PSA_ERROR_INVALID_ARGUMENT); 1864 } 1865} 1866 1867psa_status_t psa_driver_wrapper_mac_sign_setup(psa_mac_operation_t *operation, const psa_key_attributes_t *attributes, 1868 const uint8_t *key_buffer, size_t key_buffer_size, psa_algorithm_t alg) 1869{ 1870 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 1871 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)); 1872 1873 switch (location) { 1874 case PSA_KEY_LOCATION_LOCAL_STORAGE: 1875 /* Key is stored in the slot in export representation, so 1876 * cycle through all known transparent accelerators */ 1877#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 1878#if defined(PSA_CRYPTO_DRIVER_TEST) 1879 status = mbedtls_test_transparent_mac_sign_setup(&operation->ctx.transparent_test_driver_ctx, attributes, 1880 key_buffer, key_buffer_size, alg); 1881 /* Declared with fallback == true */ 1882 if (status == PSA_SUCCESS) 1883 operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID; 1884 1885 if (status != PSA_ERROR_NOT_SUPPORTED) 1886 return (status); 1887#endif /* PSA_CRYPTO_DRIVER_TEST */ 1888#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 1889#if defined(MBEDTLS_PSA_BUILTIN_MAC) 1890 /* Fell through, meaning no accelerator supports this operation */ 1891 status = 1892 mbedtls_psa_mac_sign_setup(&operation->ctx.mbedtls_ctx, attributes, key_buffer, key_buffer_size, alg); 1893 if (status == PSA_SUCCESS) 1894 operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; 1895 1896 if (status != PSA_ERROR_NOT_SUPPORTED) 1897 return (status); 1898#endif /* MBEDTLS_PSA_BUILTIN_MAC */ 1899 return (PSA_ERROR_NOT_SUPPORTED); 1900 1901 /* Add cases for opaque driver here */ 1902#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 1903#if defined(PSA_CRYPTO_DRIVER_TEST) 1904 case PSA_CRYPTO_TEST_DRIVER_LOCATION: 1905 status = mbedtls_test_opaque_mac_sign_setup(&operation->ctx.opaque_test_driver_ctx, attributes, key_buffer, 1906 key_buffer_size, alg); 1907 1908 if (status == PSA_SUCCESS) 1909 operation->id = MBEDTLS_TEST_OPAQUE_DRIVER_ID; 1910 1911 return (status); 1912#endif /* PSA_CRYPTO_DRIVER_TEST */ 1913#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 1914 default: 1915 /* Key is declared with a lifetime not known to us */ 1916 (void)status; 1917 (void)operation; 1918 (void)key_buffer; 1919 (void)key_buffer_size; 1920 (void)alg; 1921 return (PSA_ERROR_INVALID_ARGUMENT); 1922 } 1923} 1924 1925psa_status_t psa_driver_wrapper_mac_verify_setup(psa_mac_operation_t *operation, const psa_key_attributes_t *attributes, 1926 const uint8_t *key_buffer, size_t key_buffer_size, psa_algorithm_t alg) 1927{ 1928 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 1929 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)); 1930 1931 switch (location) { 1932 case PSA_KEY_LOCATION_LOCAL_STORAGE: 1933 /* Key is stored in the slot in export representation, so 1934 * cycle through all known transparent accelerators */ 1935#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 1936#if defined(PSA_CRYPTO_DRIVER_TEST) 1937 status = mbedtls_test_transparent_mac_verify_setup(&operation->ctx.transparent_test_driver_ctx, attributes, 1938 key_buffer, key_buffer_size, alg); 1939 /* Declared with fallback == true */ 1940 if (status == PSA_SUCCESS) 1941 operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID; 1942 1943 if (status != PSA_ERROR_NOT_SUPPORTED) 1944 return (status); 1945#endif /* PSA_CRYPTO_DRIVER_TEST */ 1946#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 1947#if defined(MBEDTLS_PSA_BUILTIN_MAC) 1948 /* Fell through, meaning no accelerator supports this operation */ 1949 status = 1950 mbedtls_psa_mac_verify_setup(&operation->ctx.mbedtls_ctx, attributes, key_buffer, key_buffer_size, alg); 1951 if (status == PSA_SUCCESS) 1952 operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; 1953 1954 if (status != PSA_ERROR_NOT_SUPPORTED) 1955 return (status); 1956#endif /* MBEDTLS_PSA_BUILTIN_MAC */ 1957 return (PSA_ERROR_NOT_SUPPORTED); 1958 1959 /* Add cases for opaque driver here */ 1960#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 1961#if defined(PSA_CRYPTO_DRIVER_TEST) 1962 case PSA_CRYPTO_TEST_DRIVER_LOCATION: 1963 status = mbedtls_test_opaque_mac_verify_setup(&operation->ctx.opaque_test_driver_ctx, attributes, 1964 key_buffer, key_buffer_size, alg); 1965 1966 if (status == PSA_SUCCESS) 1967 operation->id = MBEDTLS_TEST_OPAQUE_DRIVER_ID; 1968 1969 return (status); 1970#endif /* PSA_CRYPTO_DRIVER_TEST */ 1971#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 1972 default: 1973 /* Key is declared with a lifetime not known to us */ 1974 (void)status; 1975 (void)operation; 1976 (void)key_buffer; 1977 (void)key_buffer_size; 1978 (void)alg; 1979 return (PSA_ERROR_INVALID_ARGUMENT); 1980 } 1981} 1982 1983psa_status_t psa_driver_wrapper_mac_update(psa_mac_operation_t *operation, const uint8_t *input, size_t input_length) 1984{ 1985 switch (operation->id) { 1986#if defined(MBEDTLS_PSA_BUILTIN_MAC) 1987 case PSA_CRYPTO_MBED_TLS_DRIVER_ID: 1988 return (mbedtls_psa_mac_update(&operation->ctx.mbedtls_ctx, input, input_length)); 1989#endif /* MBEDTLS_PSA_BUILTIN_MAC */ 1990 1991#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 1992#if defined(PSA_CRYPTO_DRIVER_TEST) 1993 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: 1994 return ( 1995 mbedtls_test_transparent_mac_update(&operation->ctx.transparent_test_driver_ctx, input, input_length)); 1996 1997 case MBEDTLS_TEST_OPAQUE_DRIVER_ID: 1998 return (mbedtls_test_opaque_mac_update(&operation->ctx.opaque_test_driver_ctx, input, input_length)); 1999#endif /* PSA_CRYPTO_DRIVER_TEST */ 2000#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 2001 default: 2002 (void)input; 2003 (void)input_length; 2004 return (PSA_ERROR_INVALID_ARGUMENT); 2005 } 2006} 2007 2008psa_status_t psa_driver_wrapper_mac_sign_finish(psa_mac_operation_t *operation, uint8_t *mac, size_t mac_size, 2009 size_t *mac_length) 2010{ 2011 switch (operation->id) { 2012#if defined(MBEDTLS_PSA_BUILTIN_MAC) 2013 case PSA_CRYPTO_MBED_TLS_DRIVER_ID: 2014 return (mbedtls_psa_mac_sign_finish(&operation->ctx.mbedtls_ctx, mac, mac_size, mac_length)); 2015#endif /* MBEDTLS_PSA_BUILTIN_MAC */ 2016 2017#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 2018#if defined(PSA_CRYPTO_DRIVER_TEST) 2019 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: 2020 return (mbedtls_test_transparent_mac_sign_finish(&operation->ctx.transparent_test_driver_ctx, mac, mac_size, 2021 mac_length)); 2022 2023 case MBEDTLS_TEST_OPAQUE_DRIVER_ID: 2024 return ( 2025 mbedtls_test_opaque_mac_sign_finish(&operation->ctx.opaque_test_driver_ctx, mac, mac_size, mac_length)); 2026#endif /* PSA_CRYPTO_DRIVER_TEST */ 2027#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 2028 default: 2029 (void)mac; 2030 (void)mac_size; 2031 (void)mac_length; 2032 return (PSA_ERROR_INVALID_ARGUMENT); 2033 } 2034} 2035 2036psa_status_t psa_driver_wrapper_mac_verify_finish(psa_mac_operation_t *operation, const uint8_t *mac, size_t mac_length) 2037{ 2038 switch (operation->id) { 2039#if defined(MBEDTLS_PSA_BUILTIN_MAC) 2040 case PSA_CRYPTO_MBED_TLS_DRIVER_ID: 2041 return (mbedtls_psa_mac_verify_finish(&operation->ctx.mbedtls_ctx, mac, mac_length)); 2042#endif /* MBEDTLS_PSA_BUILTIN_MAC */ 2043 2044#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 2045#if defined(PSA_CRYPTO_DRIVER_TEST) 2046 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: 2047 return (mbedtls_test_transparent_mac_verify_finish(&operation->ctx.transparent_test_driver_ctx, mac, 2048 mac_length)); 2049 2050 case MBEDTLS_TEST_OPAQUE_DRIVER_ID: 2051 return (mbedtls_test_opaque_mac_verify_finish(&operation->ctx.opaque_test_driver_ctx, mac, mac_length)); 2052#endif /* PSA_CRYPTO_DRIVER_TEST */ 2053#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 2054 default: 2055 (void)mac; 2056 (void)mac_length; 2057 return (PSA_ERROR_INVALID_ARGUMENT); 2058 } 2059} 2060 2061psa_status_t psa_driver_wrapper_mac_abort(psa_mac_operation_t *operation) 2062{ 2063 switch (operation->id) { 2064#if defined(MBEDTLS_PSA_BUILTIN_MAC) 2065 case PSA_CRYPTO_MBED_TLS_DRIVER_ID: 2066 return (mbedtls_psa_mac_abort(&operation->ctx.mbedtls_ctx)); 2067#endif /* MBEDTLS_PSA_BUILTIN_MAC */ 2068 2069#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 2070#if defined(PSA_CRYPTO_DRIVER_TEST) 2071 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: 2072 return (mbedtls_test_transparent_mac_abort(&operation->ctx.transparent_test_driver_ctx)); 2073 case MBEDTLS_TEST_OPAQUE_DRIVER_ID: 2074 return (mbedtls_test_opaque_mac_abort(&operation->ctx.opaque_test_driver_ctx)); 2075#endif /* PSA_CRYPTO_DRIVER_TEST */ 2076#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 2077 default: 2078 return (PSA_ERROR_INVALID_ARGUMENT); 2079 } 2080} 2081 2082/* 2083 * Asymmetric cryptography 2084 */ 2085psa_status_t psa_driver_wrapper_asymmetric_encrypt(const psa_key_attributes_t *attributes, const uint8_t *key_buffer, 2086 size_t key_buffer_size, psa_algorithm_t alg, const uint8_t *input, 2087 size_t input_length, const uint8_t *salt, size_t salt_length, 2088 uint8_t *output, size_t output_size, size_t *output_length) 2089{ 2090 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 2091 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)); 2092 2093 switch (location) { 2094 case PSA_KEY_LOCATION_LOCAL_STORAGE: 2095 /* Key is stored in the slot in export representation, so 2096 * cycle through all known transparent accelerators */ 2097#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 2098#if defined(PSA_CRYPTO_DRIVER_TEST) 2099 status = mbedtls_test_transparent_asymmetric_encrypt(attributes, key_buffer, key_buffer_size, alg, input, 2100 input_length, salt, salt_length, output, output_size, 2101 output_length); 2102 /* Declared with fallback == true */ 2103 if (status != PSA_ERROR_NOT_SUPPORTED) 2104 return (status); 2105#endif /* PSA_CRYPTO_DRIVER_TEST */ 2106#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 2107 return (mbedtls_psa_asymmetric_encrypt(attributes, key_buffer, key_buffer_size, alg, input, input_length, 2108 salt, salt_length, output, output_size, output_length)); 2109 /* Add cases for opaque driver here */ 2110#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 2111#if defined(PSA_CRYPTO_DRIVER_TEST) 2112 case PSA_CRYPTO_TEST_DRIVER_LOCATION: 2113 return (mbedtls_test_opaque_asymmetric_encrypt(attributes, key_buffer, key_buffer_size, alg, input, 2114 input_length, salt, salt_length, output, output_size, 2115 output_length)); 2116#endif /* PSA_CRYPTO_DRIVER_TEST */ 2117#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 2118 2119 default: 2120 /* Key is declared with a lifetime not known to us */ 2121 (void)status; 2122 (void)key_buffer; 2123 (void)key_buffer_size; 2124 (void)alg; 2125 (void)input; 2126 (void)input_length; 2127 (void)salt; 2128 (void)salt_length; 2129 (void)output; 2130 (void)output_size; 2131 (void)output_length; 2132 return (PSA_ERROR_INVALID_ARGUMENT); 2133 } 2134} 2135 2136psa_status_t psa_driver_wrapper_asymmetric_decrypt(const psa_key_attributes_t *attributes, const uint8_t *key_buffer, 2137 size_t key_buffer_size, psa_algorithm_t alg, const uint8_t *input, 2138 size_t input_length, const uint8_t *salt, size_t salt_length, 2139 uint8_t *output, size_t output_size, size_t *output_length) 2140{ 2141 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 2142 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)); 2143 2144 switch (location) { 2145 case PSA_KEY_LOCATION_LOCAL_STORAGE: 2146 /* Key is stored in the slot in export representation, so 2147 * cycle through all known transparent accelerators */ 2148#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 2149#if defined(PSA_CRYPTO_DRIVER_TEST) 2150 status = mbedtls_test_transparent_asymmetric_decrypt(attributes, key_buffer, key_buffer_size, alg, input, 2151 input_length, salt, salt_length, output, output_size, 2152 output_length); 2153 /* Declared with fallback == true */ 2154 if (status != PSA_ERROR_NOT_SUPPORTED) 2155 return (status); 2156#endif /* PSA_CRYPTO_DRIVER_TEST */ 2157#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 2158 return (mbedtls_psa_asymmetric_decrypt(attributes, key_buffer, key_buffer_size, alg, input, input_length, 2159 salt, salt_length, output, output_size, output_length)); 2160 /* Add cases for opaque driver here */ 2161#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 2162#if defined(PSA_CRYPTO_DRIVER_TEST) 2163 case PSA_CRYPTO_TEST_DRIVER_LOCATION: 2164 return (mbedtls_test_opaque_asymmetric_decrypt(attributes, key_buffer, key_buffer_size, alg, input, 2165 input_length, salt, salt_length, output, output_size, 2166 output_length)); 2167#endif /* PSA_CRYPTO_DRIVER_TEST */ 2168#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 2169 2170 default: 2171 /* Key is declared with a lifetime not known to us */ 2172 (void)status; 2173 (void)key_buffer; 2174 (void)key_buffer_size; 2175 (void)alg; 2176 (void)input; 2177 (void)input_length; 2178 (void)salt; 2179 (void)salt_length; 2180 (void)output; 2181 (void)output_size; 2182 (void)output_length; 2183 return (PSA_ERROR_INVALID_ARGUMENT); 2184 } 2185} 2186 2187psa_status_t psa_driver_wrapper_key_agreement(const psa_key_attributes_t *attributes, const uint8_t *key_buffer, 2188 size_t key_buffer_size, psa_algorithm_t alg, const uint8_t *peer_key, 2189 size_t peer_key_length, uint8_t *shared_secret, size_t shared_secret_size, 2190 size_t *shared_secret_length) 2191{ 2192 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 2193 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)); 2194 2195 switch (location) { 2196 case PSA_KEY_LOCATION_LOCAL_STORAGE: 2197 /* Key is stored in the slot in export representation, so 2198 * cycle through all known transparent accelerators */ 2199#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 2200#if defined(PSA_CRYPTO_DRIVER_TEST) 2201 status = mbedtls_test_transparent_key_agreement(attributes, key_buffer, key_buffer_size, alg, peer_key, 2202 peer_key_length, shared_secret, shared_secret_size, 2203 shared_secret_length); 2204 if (status != PSA_ERROR_NOT_SUPPORTED) 2205 return (status); 2206#endif /* PSA_CRYPTO_DRIVER_TEST */ 2207#if defined(MBEDTLS_PSA_P256M_DRIVER_ENABLED) 2208 if (PSA_KEY_TYPE_IS_ECC(psa_get_key_type(attributes)) && PSA_ALG_IS_ECDH(alg) && 2209 PSA_KEY_TYPE_ECC_GET_FAMILY(psa_get_key_type(attributes)) == PSA_ECC_FAMILY_SECP_R1 && 2210 psa_get_key_bits(attributes) == 256) { 2211 status = p256_transparent_key_agreement(attributes, key_buffer, key_buffer_size, alg, peer_key, 2212 peer_key_length, shared_secret, shared_secret_size, 2213 shared_secret_length); 2214 if (status != PSA_ERROR_NOT_SUPPORTED) 2215 return (status); 2216 } 2217#endif /* MBEDTLS_PSA_P256M_DRIVER_ENABLED */ 2218#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 2219 2220 /* Software Fallback */ 2221 status = 2222 psa_key_agreement_raw_builtin(attributes, key_buffer, key_buffer_size, alg, peer_key, peer_key_length, 2223 shared_secret, shared_secret_size, shared_secret_length); 2224 return (status); 2225#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 2226#if defined(PSA_CRYPTO_DRIVER_TEST) 2227 case PSA_CRYPTO_TEST_DRIVER_LOCATION: 2228 return (mbedtls_test_opaque_key_agreement(attributes, key_buffer, key_buffer_size, alg, peer_key, 2229 peer_key_length, shared_secret, shared_secret_size, 2230 shared_secret_length)); 2231#endif /* PSA_CRYPTO_DRIVER_TEST */ 2232#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 2233 2234 default: 2235 (void)attributes; 2236 (void)key_buffer; 2237 (void)key_buffer_size; 2238 (void)peer_key; 2239 (void)peer_key_length; 2240 (void)shared_secret; 2241 (void)shared_secret_size; 2242 (void)shared_secret_length; 2243 return (PSA_ERROR_NOT_SUPPORTED); 2244 } 2245} 2246 2247psa_status_t psa_driver_wrapper_pake_setup(psa_pake_operation_t *operation, 2248 const psa_crypto_driver_pake_inputs_t *inputs) 2249{ 2250 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; 2251 2252 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(&inputs->attributes)); 2253 2254 switch (location) { 2255 case PSA_KEY_LOCATION_LOCAL_STORAGE: 2256 /* Key is stored in the slot in export representation, so 2257 * cycle through all known transparent accelerators */ 2258 status = PSA_ERROR_NOT_SUPPORTED; 2259#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 2260#if defined(PSA_CRYPTO_DRIVER_TEST) 2261 status = mbedtls_test_transparent_pake_setup(&operation->data.ctx.transparent_test_driver_ctx, inputs); 2262 if (status == PSA_SUCCESS) 2263 operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID; 2264 /* Declared with fallback == true */ 2265 if (status != PSA_ERROR_NOT_SUPPORTED) 2266 return (status); 2267#endif /* PSA_CRYPTO_DRIVER_TEST */ 2268#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 2269#if defined(MBEDTLS_PSA_BUILTIN_PAKE) 2270 status = mbedtls_psa_pake_setup(&operation->data.ctx.mbedtls_ctx, inputs); 2271 if (status == PSA_SUCCESS) 2272 operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID; 2273#endif 2274 return status; 2275 /* Add cases for opaque driver here */ 2276 default: 2277 /* Key is declared with a lifetime not known to us */ 2278 (void)operation; 2279 return (PSA_ERROR_INVALID_ARGUMENT); 2280 } 2281} 2282psa_status_t psa_driver_wrapper_pake_output(psa_pake_operation_t *operation, psa_crypto_driver_pake_step_t step, 2283 uint8_t *output, size_t output_size, size_t *output_length) 2284{ 2285 switch (operation->id) { 2286#if defined(MBEDTLS_PSA_BUILTIN_PAKE) 2287 case PSA_CRYPTO_MBED_TLS_DRIVER_ID: 2288 return ( 2289 mbedtls_psa_pake_output(&operation->data.ctx.mbedtls_ctx, step, output, output_size, output_length)); 2290#endif /* MBEDTLS_PSA_BUILTIN_PAKE */ 2291 2292#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 2293#if defined(PSA_CRYPTO_DRIVER_TEST) 2294 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: 2295 return (mbedtls_test_transparent_pake_output(&operation->data.ctx.transparent_test_driver_ctx, step, output, 2296 output_size, output_length)); 2297#endif /* PSA_CRYPTO_DRIVER_TEST */ 2298#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 2299 default: 2300 (void)step; 2301 (void)output; 2302 (void)output_size; 2303 (void)output_length; 2304 return (PSA_ERROR_INVALID_ARGUMENT); 2305 } 2306} 2307 2308psa_status_t psa_driver_wrapper_pake_input(psa_pake_operation_t *operation, psa_crypto_driver_pake_step_t step, 2309 const uint8_t *input, size_t input_length) 2310{ 2311 switch (operation->id) { 2312#if defined(MBEDTLS_PSA_BUILTIN_PAKE) 2313 case PSA_CRYPTO_MBED_TLS_DRIVER_ID: 2314 return (mbedtls_psa_pake_input(&operation->data.ctx.mbedtls_ctx, step, input, input_length)); 2315#endif /* MBEDTLS_PSA_BUILTIN_PAKE */ 2316 2317#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 2318#if defined(PSA_CRYPTO_DRIVER_TEST) 2319 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: 2320 return (mbedtls_test_transparent_pake_input(&operation->data.ctx.transparent_test_driver_ctx, step, input, 2321 input_length)); 2322#endif /* PSA_CRYPTO_DRIVER_TEST */ 2323#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 2324 default: 2325 (void)step; 2326 (void)input; 2327 (void)input_length; 2328 return (PSA_ERROR_INVALID_ARGUMENT); 2329 } 2330} 2331 2332psa_status_t psa_driver_wrapper_pake_get_implicit_key(psa_pake_operation_t *operation, uint8_t *output, 2333 size_t output_size, size_t *output_length) 2334{ 2335 switch (operation->id) { 2336#if defined(MBEDTLS_PSA_BUILTIN_PAKE) 2337 case PSA_CRYPTO_MBED_TLS_DRIVER_ID: 2338 return (mbedtls_psa_pake_get_implicit_key(&operation->data.ctx.mbedtls_ctx, output, output_size, 2339 output_length)); 2340#endif /* MBEDTLS_PSA_BUILTIN_PAKE */ 2341 2342#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 2343#if defined(PSA_CRYPTO_DRIVER_TEST) 2344 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: 2345 return (mbedtls_test_transparent_pake_get_implicit_key(&operation->data.ctx.transparent_test_driver_ctx, 2346 output, output_size, output_length)); 2347#endif /* PSA_CRYPTO_DRIVER_TEST */ 2348#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 2349 default: 2350 (void)output; 2351 (void)output_size; 2352 (void)output_length; 2353 return (PSA_ERROR_INVALID_ARGUMENT); 2354 } 2355} 2356 2357psa_status_t psa_driver_wrapper_pake_abort(psa_pake_operation_t *operation) 2358{ 2359 switch (operation->id) { 2360#if defined(MBEDTLS_PSA_BUILTIN_PAKE) 2361 case PSA_CRYPTO_MBED_TLS_DRIVER_ID: 2362 return (mbedtls_psa_pake_abort(&operation->data.ctx.mbedtls_ctx)); 2363#endif /* MBEDTLS_PSA_BUILTIN_PAKE */ 2364 2365#if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT) 2366#if defined(PSA_CRYPTO_DRIVER_TEST) 2367 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID: 2368 return (mbedtls_test_transparent_pake_abort(&operation->data.ctx.transparent_test_driver_ctx)); 2369#endif /* PSA_CRYPTO_DRIVER_TEST */ 2370#endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */ 2371 default: 2372 return (PSA_ERROR_INVALID_ARGUMENT); 2373 } 2374} 2375 2376#endif /* MBEDTLS_PSA_CRYPTO_C */ 2377