1 /*
2 * Functions to delegate cryptographic operations to an available
3 * and appropriate accelerator.
4 * Warning: This file is now auto-generated.
5 */
6 /* Copyright The Mbed TLS Contributors
7 * SPDX-License-Identifier: Apache-2.0
8 *
9 * Licensed under the Apache License, Version 2.0 (the "License"); you may
10 * not use this file except in compliance with the License.
11 * You may obtain a copy of the License at
12 *
13 * http://www.apache.org/licenses/LICENSE-2.0
14 *
15 * Unless required by applicable law or agreed to in writing, software
16 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
17 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
18 * See the License for the specific language governing permissions and
19 * limitations under the License.
20 */
21
22 /* BEGIN-common headers */
23 #include "common.h"
24 #include "psa_crypto_aead.h"
25 #include "psa_crypto_cipher.h"
26 #include "psa_crypto_core.h"
27 #include "psa_crypto_driver_wrappers.h"
28 #include "psa_crypto_hash.h"
29 #include "psa_crypto_mac.h"
30 #include "psa_crypto_pake.h"
31 #include "psa_crypto_rsa.h"
32
33 #include "mbedtls/constant_time.h"
34 #include "mbedtls/platform.h"
35 /* END-common headers */
36
37 #if defined(MBEDTLS_PSA_CRYPTO_C)
38
39 /* BEGIN-driver headers */
40 /* Headers for mbedtls_test opaque driver */
41 #if defined(PSA_CRYPTO_DRIVER_TEST)
42 #include "test/drivers/test_driver.h"
43
44 #endif
45 /* Headers for mbedtls_test transparent driver */
46 #if defined(PSA_CRYPTO_DRIVER_TEST)
47 #include "test/drivers/test_driver.h"
48
49 #endif
50 /* Headers for p256 transparent driver */
51 #if defined(MBEDTLS_PSA_P256M_DRIVER_ENABLED)
52 #include "../3rdparty/p256-m/p256-m_driver_entrypoints.h"
53
54 #endif
55
56 /* END-driver headers */
57
58 /* Auto-generated values depending on which drivers are registered.
59 * ID 0 is reserved for unallocated operations.
60 * ID 1 is reserved for the Mbed TLS software driver. */
61 /* BEGIN-driver id definition */
62 #define PSA_CRYPTO_MBED_TLS_DRIVER_ID (1)
63 #define MBEDTLS_TEST_OPAQUE_DRIVER_ID (2)
64 #define MBEDTLS_TEST_TRANSPARENT_DRIVER_ID (3)
65 #define P256_TRANSPARENT_DRIVER_ID (4)
66
67 /* END-driver id */
68
69 /* BEGIN-Common Macro definitions */
70
71 /* END-Common Macro definitions */
72
73 /* Support the 'old' SE interface when asked to */
74 #if defined(MBEDTLS_PSA_CRYPTO_SE_C)
75 /* PSA_CRYPTO_DRIVER_PRESENT is defined when either a new-style or old-style
76 * SE driver is present, to avoid unused argument errors at compile time. */
77 #ifndef PSA_CRYPTO_DRIVER_PRESENT
78 #define PSA_CRYPTO_DRIVER_PRESENT
79 #endif
80 #include "psa_crypto_se.h"
81 #endif
82
psa_driver_wrapper_init(void)83 psa_status_t psa_driver_wrapper_init(void)
84 {
85 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
86
87 #if defined(MBEDTLS_PSA_CRYPTO_SE_C)
88 status = psa_init_all_se_drivers();
89 if (status != PSA_SUCCESS)
90 return (status);
91 #endif
92
93 #if defined(PSA_CRYPTO_DRIVER_TEST)
94 status = mbedtls_test_transparent_init();
95 if (status != PSA_SUCCESS)
96 return (status);
97
98 status = mbedtls_test_opaque_init();
99 if (status != PSA_SUCCESS)
100 return (status);
101 #endif
102
103 (void)status;
104 return (PSA_SUCCESS);
105 }
106
psa_driver_wrapper_free(void)107 void psa_driver_wrapper_free(void)
108 {
109 #if defined(MBEDTLS_PSA_CRYPTO_SE_C)
110 /* Unregister all secure element drivers, so that we restart from
111 * a pristine state. */
112 psa_unregister_all_se_drivers();
113 #endif /* MBEDTLS_PSA_CRYPTO_SE_C */
114
115 #if defined(PSA_CRYPTO_DRIVER_TEST)
116 mbedtls_test_transparent_free();
117 mbedtls_test_opaque_free();
118 #endif
119 }
120
121 /* Start delegation functions */
psa_driver_wrapper_sign_message(const psa_key_attributes_t * attributes,const uint8_t * key_buffer,size_t key_buffer_size,psa_algorithm_t alg,const uint8_t * input,size_t input_length,uint8_t * signature,size_t signature_size,size_t * signature_length)122 psa_status_t psa_driver_wrapper_sign_message(const psa_key_attributes_t *attributes, const uint8_t *key_buffer,
123 size_t key_buffer_size, psa_algorithm_t alg, const uint8_t *input,
124 size_t input_length, uint8_t *signature, size_t signature_size,
125 size_t *signature_length)
126 {
127 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
128 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes));
129
130 switch (location) {
131 case PSA_KEY_LOCATION_LOCAL_STORAGE:
132 /* Key is stored in the slot in export representation, so
133 * cycle through all known transparent accelerators */
134 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
135 #if defined(PSA_CRYPTO_DRIVER_TEST)
136 status = mbedtls_test_transparent_signature_sign_message(attributes, key_buffer, key_buffer_size, alg,
137 input, input_length, signature, signature_size,
138 signature_length);
139 /* Declared with fallback == true */
140 if (status != PSA_ERROR_NOT_SUPPORTED)
141 return (status);
142 #endif /* PSA_CRYPTO_DRIVER_TEST */
143 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
144 break;
145
146 /* Add cases for opaque driver here */
147 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
148 #if defined(PSA_CRYPTO_DRIVER_TEST)
149 case PSA_CRYPTO_TEST_DRIVER_LOCATION:
150 status =
151 mbedtls_test_opaque_signature_sign_message(attributes, key_buffer, key_buffer_size, alg, input,
152 input_length, signature, signature_size, signature_length);
153 if (status != PSA_ERROR_NOT_SUPPORTED)
154 return (status);
155 break;
156 #endif /* PSA_CRYPTO_DRIVER_TEST */
157 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
158 default:
159 /* Key is declared with a lifetime not known to us */
160 (void)status;
161 break;
162 }
163
164 return (psa_sign_message_builtin(attributes, key_buffer, key_buffer_size, alg, input, input_length, signature,
165 signature_size, signature_length));
166 }
167
psa_driver_wrapper_verify_message(const psa_key_attributes_t * attributes,const uint8_t * key_buffer,size_t key_buffer_size,psa_algorithm_t alg,const uint8_t * input,size_t input_length,const uint8_t * signature,size_t signature_length)168 psa_status_t psa_driver_wrapper_verify_message(const psa_key_attributes_t *attributes, const uint8_t *key_buffer,
169 size_t key_buffer_size, psa_algorithm_t alg, const uint8_t *input,
170 size_t input_length, const uint8_t *signature, size_t signature_length)
171 {
172 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
173 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes));
174
175 switch (location) {
176 case PSA_KEY_LOCATION_LOCAL_STORAGE:
177 /* Key is stored in the slot in export representation, so
178 * cycle through all known transparent accelerators */
179 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
180 #if defined(PSA_CRYPTO_DRIVER_TEST)
181 status = mbedtls_test_transparent_signature_verify_message(
182 attributes, key_buffer, key_buffer_size, alg, input, input_length, signature, signature_length);
183 /* Declared with fallback == true */
184 if (status != PSA_ERROR_NOT_SUPPORTED)
185 return (status);
186 #endif /* PSA_CRYPTO_DRIVER_TEST */
187 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
188 break;
189
190 /* Add cases for opaque driver here */
191 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
192 #if defined(PSA_CRYPTO_DRIVER_TEST)
193 case PSA_CRYPTO_TEST_DRIVER_LOCATION:
194 return (mbedtls_test_opaque_signature_verify_message(attributes, key_buffer, key_buffer_size, alg, input,
195 input_length, signature, signature_length));
196 if (status != PSA_ERROR_NOT_SUPPORTED)
197 return (status);
198 break;
199 #endif /* PSA_CRYPTO_DRIVER_TEST */
200 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
201 default:
202 /* Key is declared with a lifetime not known to us */
203 (void)status;
204 break;
205 }
206
207 return (psa_verify_message_builtin(attributes, key_buffer, key_buffer_size, alg, input, input_length, signature,
208 signature_length));
209 }
210
psa_driver_wrapper_sign_hash(const psa_key_attributes_t * attributes,const uint8_t * key_buffer,size_t key_buffer_size,psa_algorithm_t alg,const uint8_t * hash,size_t hash_length,uint8_t * signature,size_t signature_size,size_t * signature_length)211 psa_status_t psa_driver_wrapper_sign_hash(const psa_key_attributes_t *attributes, const uint8_t *key_buffer,
212 size_t key_buffer_size, psa_algorithm_t alg, const uint8_t *hash,
213 size_t hash_length, uint8_t *signature, size_t signature_size,
214 size_t *signature_length)
215 {
216 /* Try dynamically-registered SE interface first */
217 #if defined(MBEDTLS_PSA_CRYPTO_SE_C)
218 const psa_drv_se_t *drv;
219 psa_drv_se_context_t *drv_context;
220
221 if (psa_get_se_driver(psa_get_key_lifetime(attributes), &drv, &drv_context)) {
222 if (drv->asymmetric == NULL || drv->asymmetric->p_sign == NULL) {
223 /* Key is defined in SE, but we have no way to exercise it */
224 return (PSA_ERROR_NOT_SUPPORTED);
225 }
226 return (drv->asymmetric->p_sign(drv_context, *((psa_key_slot_number_t *)key_buffer), alg, hash, hash_length,
227 signature, signature_size, signature_length));
228 }
229 #endif /* MBEDTLS_PSA_CRYPTO_SE_C */
230
231 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
232 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes));
233
234 switch (location) {
235 case PSA_KEY_LOCATION_LOCAL_STORAGE:
236 /* Key is stored in the slot in export representation, so
237 * cycle through all known transparent accelerators */
238 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
239 #if defined(PSA_CRYPTO_DRIVER_TEST)
240 status =
241 mbedtls_test_transparent_signature_sign_hash(attributes, key_buffer, key_buffer_size, alg, hash,
242 hash_length, signature, signature_size, signature_length);
243 /* Declared with fallback == true */
244 if (status != PSA_ERROR_NOT_SUPPORTED)
245 return (status);
246 #endif /* PSA_CRYPTO_DRIVER_TEST */
247 #if defined(MBEDTLS_PSA_P256M_DRIVER_ENABLED)
248 if (PSA_KEY_TYPE_IS_ECC(psa_get_key_type(attributes)) && PSA_ALG_IS_ECDSA(alg) &&
249 !PSA_ALG_ECDSA_IS_DETERMINISTIC(alg) &&
250 PSA_KEY_TYPE_ECC_GET_FAMILY(psa_get_key_type(attributes)) == PSA_ECC_FAMILY_SECP_R1 &&
251 psa_get_key_bits(attributes) == 256) {
252 status = p256_transparent_sign_hash(attributes, key_buffer, key_buffer_size, alg, hash, hash_length,
253 signature, signature_size, signature_length);
254 if (status != PSA_ERROR_NOT_SUPPORTED)
255 return (status);
256 }
257 #endif /* MBEDTLS_PSA_P256M_DRIVER_ENABLED */
258 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
259 /* Fell through, meaning no accelerator supports this operation */
260 return (psa_sign_hash_builtin(attributes, key_buffer, key_buffer_size, alg, hash, hash_length, signature,
261 signature_size, signature_length));
262
263 /* Add cases for opaque driver here */
264 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
265 #if defined(PSA_CRYPTO_DRIVER_TEST)
266 case PSA_CRYPTO_TEST_DRIVER_LOCATION:
267 return (mbedtls_test_opaque_signature_sign_hash(attributes, key_buffer, key_buffer_size, alg, hash,
268 hash_length, signature, signature_size, signature_length));
269 #endif /* PSA_CRYPTO_DRIVER_TEST */
270 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
271 default:
272 /* Key is declared with a lifetime not known to us */
273 (void)status;
274 return (PSA_ERROR_INVALID_ARGUMENT);
275 }
276 }
277
psa_driver_wrapper_verify_hash(const psa_key_attributes_t * attributes,const uint8_t * key_buffer,size_t key_buffer_size,psa_algorithm_t alg,const uint8_t * hash,size_t hash_length,const uint8_t * signature,size_t signature_length)278 psa_status_t psa_driver_wrapper_verify_hash(const psa_key_attributes_t *attributes, const uint8_t *key_buffer,
279 size_t key_buffer_size, psa_algorithm_t alg, const uint8_t *hash,
280 size_t hash_length, const uint8_t *signature, size_t signature_length)
281 {
282 /* Try dynamically-registered SE interface first */
283 #if defined(MBEDTLS_PSA_CRYPTO_SE_C)
284 const psa_drv_se_t *drv;
285 psa_drv_se_context_t *drv_context;
286
287 if (psa_get_se_driver(psa_get_key_lifetime(attributes), &drv, &drv_context)) {
288 if (drv->asymmetric == NULL || drv->asymmetric->p_verify == NULL) {
289 /* Key is defined in SE, but we have no way to exercise it */
290 return (PSA_ERROR_NOT_SUPPORTED);
291 }
292 return (drv->asymmetric->p_verify(drv_context, *((psa_key_slot_number_t *)key_buffer), alg, hash, hash_length,
293 signature, signature_length));
294 }
295 #endif /* MBEDTLS_PSA_CRYPTO_SE_C */
296
297 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
298 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes));
299
300 switch (location) {
301 case PSA_KEY_LOCATION_LOCAL_STORAGE:
302 /* Key is stored in the slot in export representation, so
303 * cycle through all known transparent accelerators */
304 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
305 #if defined(PSA_CRYPTO_DRIVER_TEST)
306 status = mbedtls_test_transparent_signature_verify_hash(attributes, key_buffer, key_buffer_size, alg, hash,
307 hash_length, signature, signature_length);
308 /* Declared with fallback == true */
309 if (status != PSA_ERROR_NOT_SUPPORTED)
310 return (status);
311 #endif /* PSA_CRYPTO_DRIVER_TEST */
312 #if defined(MBEDTLS_PSA_P256M_DRIVER_ENABLED)
313 if (PSA_KEY_TYPE_IS_ECC(psa_get_key_type(attributes)) && PSA_ALG_IS_ECDSA(alg) &&
314 !PSA_ALG_ECDSA_IS_DETERMINISTIC(alg) &&
315 PSA_KEY_TYPE_ECC_GET_FAMILY(psa_get_key_type(attributes)) == PSA_ECC_FAMILY_SECP_R1 &&
316 psa_get_key_bits(attributes) == 256) {
317 status = p256_transparent_verify_hash(attributes, key_buffer, key_buffer_size, alg, hash, hash_length,
318 signature, signature_length);
319 if (status != PSA_ERROR_NOT_SUPPORTED)
320 return (status);
321 }
322 #endif /* MBEDTLS_PSA_P256M_DRIVER_ENABLED */
323 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
324
325 return (psa_verify_hash_builtin(attributes, key_buffer, key_buffer_size, alg, hash, hash_length, signature,
326 signature_length));
327
328 /* Add cases for opaque driver here */
329 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
330 #if defined(PSA_CRYPTO_DRIVER_TEST)
331 case PSA_CRYPTO_TEST_DRIVER_LOCATION:
332 return (mbedtls_test_opaque_signature_verify_hash(attributes, key_buffer, key_buffer_size, alg, hash,
333 hash_length, signature, signature_length));
334 #endif /* PSA_CRYPTO_DRIVER_TEST */
335 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
336 default:
337 /* Key is declared with a lifetime not known to us */
338 (void)status;
339 return (PSA_ERROR_INVALID_ARGUMENT);
340 }
341 }
342
psa_driver_wrapper_sign_hash_get_num_ops(psa_sign_hash_interruptible_operation_t * operation)343 uint32_t psa_driver_wrapper_sign_hash_get_num_ops(psa_sign_hash_interruptible_operation_t *operation)
344 {
345 switch (operation->id) {
346 /* If uninitialised, return 0, as no work can have been done. */
347 case 0:
348 return 0;
349
350 case PSA_CRYPTO_MBED_TLS_DRIVER_ID:
351 return (mbedtls_psa_sign_hash_get_num_ops(&operation->ctx.mbedtls_ctx));
352
353 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
354 #if defined(PSA_CRYPTO_DRIVER_TEST)
355 /* Add test driver tests here */
356
357 #endif /* PSA_CRYPTO_DRIVER_TEST */
358 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
359 }
360
361 /* Can't happen (see discussion in #8271) */
362 return 0;
363 }
364
psa_driver_wrapper_verify_hash_get_num_ops(psa_verify_hash_interruptible_operation_t * operation)365 uint32_t psa_driver_wrapper_verify_hash_get_num_ops(psa_verify_hash_interruptible_operation_t *operation)
366 {
367 switch (operation->id) {
368 /* If uninitialised, return 0, as no work can have been done. */
369 case 0:
370 return 0;
371
372 case PSA_CRYPTO_MBED_TLS_DRIVER_ID:
373 return (mbedtls_psa_verify_hash_get_num_ops(&operation->ctx.mbedtls_ctx));
374
375 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
376 #if defined(PSA_CRYPTO_DRIVER_TEST)
377 /* Add test driver tests here */
378
379 #endif /* PSA_CRYPTO_DRIVER_TEST */
380 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
381 }
382
383 /* Can't happen (see discussion in #8271) */
384 return 0;
385 }
386
psa_driver_wrapper_sign_hash_start(psa_sign_hash_interruptible_operation_t * operation,const psa_key_attributes_t * attributes,const uint8_t * key_buffer,size_t key_buffer_size,psa_algorithm_t alg,const uint8_t * hash,size_t hash_length)387 psa_status_t psa_driver_wrapper_sign_hash_start(psa_sign_hash_interruptible_operation_t *operation,
388 const psa_key_attributes_t *attributes, const uint8_t *key_buffer,
389 size_t key_buffer_size, psa_algorithm_t alg, const uint8_t *hash,
390 size_t hash_length)
391 {
392 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
393 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes));
394
395 switch (location) {
396 case PSA_KEY_LOCATION_LOCAL_STORAGE:
397 /* Key is stored in the slot in export representation, so
398 * cycle through all known transparent accelerators */
399
400 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
401 #if defined(PSA_CRYPTO_DRIVER_TEST)
402
403 /* Add test driver tests here */
404
405 /* Declared with fallback == true */
406
407 #endif /* PSA_CRYPTO_DRIVER_TEST */
408 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
409
410 /* Fell through, meaning no accelerator supports this operation */
411 operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID;
412 status = mbedtls_psa_sign_hash_start(&operation->ctx.mbedtls_ctx, attributes, key_buffer, key_buffer_size,
413 alg, hash, hash_length);
414 break;
415
416 /* Add cases for opaque driver here */
417
418 default:
419 /* Key is declared with a lifetime not known to us */
420 status = PSA_ERROR_INVALID_ARGUMENT;
421 break;
422 }
423
424 return (status);
425 }
426
psa_driver_wrapper_sign_hash_complete(psa_sign_hash_interruptible_operation_t * operation,uint8_t * signature,size_t signature_size,size_t * signature_length)427 psa_status_t psa_driver_wrapper_sign_hash_complete(psa_sign_hash_interruptible_operation_t *operation,
428 uint8_t *signature, size_t signature_size, size_t *signature_length)
429 {
430 switch (operation->id) {
431 case PSA_CRYPTO_MBED_TLS_DRIVER_ID:
432 return (mbedtls_psa_sign_hash_complete(&operation->ctx.mbedtls_ctx, signature, signature_size,
433 signature_length));
434
435 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
436 #if defined(PSA_CRYPTO_DRIVER_TEST)
437 /* Add test driver tests here */
438
439 #endif /* PSA_CRYPTO_DRIVER_TEST */
440 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
441 }
442
443 (void)signature;
444 (void)signature_size;
445 (void)signature_length;
446
447 return (PSA_ERROR_INVALID_ARGUMENT);
448 }
449
psa_driver_wrapper_sign_hash_abort(psa_sign_hash_interruptible_operation_t * operation)450 psa_status_t psa_driver_wrapper_sign_hash_abort(psa_sign_hash_interruptible_operation_t *operation)
451 {
452 switch (operation->id) {
453 case PSA_CRYPTO_MBED_TLS_DRIVER_ID:
454 return (mbedtls_psa_sign_hash_abort(&operation->ctx.mbedtls_ctx));
455
456 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
457 #if defined(PSA_CRYPTO_DRIVER_TEST)
458 /* Add test driver tests here */
459
460 #endif /* PSA_CRYPTO_DRIVER_TEST */
461 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
462 }
463
464 return (PSA_ERROR_INVALID_ARGUMENT);
465 }
466
psa_driver_wrapper_verify_hash_start(psa_verify_hash_interruptible_operation_t * operation,const psa_key_attributes_t * attributes,const uint8_t * key_buffer,size_t key_buffer_size,psa_algorithm_t alg,const uint8_t * hash,size_t hash_length,const uint8_t * signature,size_t signature_length)467 psa_status_t psa_driver_wrapper_verify_hash_start(psa_verify_hash_interruptible_operation_t *operation,
468 const psa_key_attributes_t *attributes, const uint8_t *key_buffer,
469 size_t key_buffer_size, psa_algorithm_t alg, const uint8_t *hash,
470 size_t hash_length, const uint8_t *signature, size_t signature_length)
471 {
472 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
473 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes));
474
475 switch (location) {
476 case PSA_KEY_LOCATION_LOCAL_STORAGE:
477 /* Key is stored in the slot in export representation, so
478 * cycle through all known transparent accelerators */
479
480 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
481 #if defined(PSA_CRYPTO_DRIVER_TEST)
482
483 /* Add test driver tests here */
484
485 /* Declared with fallback == true */
486
487 #endif /* PSA_CRYPTO_DRIVER_TEST */
488 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
489
490 /* Fell through, meaning no accelerator supports this operation */
491 operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID;
492 status = mbedtls_psa_verify_hash_start(&operation->ctx.mbedtls_ctx, attributes, key_buffer, key_buffer_size,
493 alg, hash, hash_length, signature, signature_length);
494 break;
495
496 /* Add cases for opaque driver here */
497
498 default:
499 /* Key is declared with a lifetime not known to us */
500 status = PSA_ERROR_INVALID_ARGUMENT;
501 break;
502 }
503
504 return (status);
505 }
506
psa_driver_wrapper_verify_hash_complete(psa_verify_hash_interruptible_operation_t * operation)507 psa_status_t psa_driver_wrapper_verify_hash_complete(psa_verify_hash_interruptible_operation_t *operation)
508 {
509 switch (operation->id) {
510 case PSA_CRYPTO_MBED_TLS_DRIVER_ID:
511 return (mbedtls_psa_verify_hash_complete(&operation->ctx.mbedtls_ctx));
512
513 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
514 #if defined(PSA_CRYPTO_DRIVER_TEST)
515 /* Add test driver tests here */
516
517 #endif /* PSA_CRYPTO_DRIVER_TEST */
518 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
519 }
520
521 return (PSA_ERROR_INVALID_ARGUMENT);
522 }
523
psa_driver_wrapper_verify_hash_abort(psa_verify_hash_interruptible_operation_t * operation)524 psa_status_t psa_driver_wrapper_verify_hash_abort(psa_verify_hash_interruptible_operation_t *operation)
525 {
526 switch (operation->id) {
527 case PSA_CRYPTO_MBED_TLS_DRIVER_ID:
528 return (mbedtls_psa_verify_hash_abort(&operation->ctx.mbedtls_ctx));
529
530 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
531 #if defined(PSA_CRYPTO_DRIVER_TEST)
532 /* Add test driver tests here */
533
534 #endif /* PSA_CRYPTO_DRIVER_TEST */
535 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
536 }
537
538 return (PSA_ERROR_INVALID_ARGUMENT);
539 }
540
541 /** Calculate the key buffer size required to store the key material of a key
542 * associated with an opaque driver from input key data.
543 *
544 * \param[in] attributes The key attributes
545 * \param[in] data The input key data.
546 * \param[in] data_length The input data length.
547 * \param[out] key_buffer_size Minimum buffer size to contain the key material.
548 *
549 * \retval #PSA_SUCCESS \emptydescription
550 * \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription
551 * \retval #PSA_ERROR_NOT_SUPPORTED \emptydescription
552 */
psa_driver_wrapper_get_key_buffer_size_from_key_data(const psa_key_attributes_t * attributes,const uint8_t * data,size_t data_length,size_t * key_buffer_size)553 psa_status_t psa_driver_wrapper_get_key_buffer_size_from_key_data(const psa_key_attributes_t *attributes,
554 const uint8_t *data, size_t data_length,
555 size_t *key_buffer_size)
556 {
557 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes));
558 psa_key_type_t key_type = psa_get_key_type(attributes);
559
560 *key_buffer_size = 0;
561 switch (location) {
562 #if defined(PSA_CRYPTO_DRIVER_TEST)
563 case PSA_CRYPTO_TEST_DRIVER_LOCATION:
564 *key_buffer_size = mbedtls_test_opaque_size_function(key_type, PSA_BYTES_TO_BITS(data_length));
565 return ((*key_buffer_size != 0) ? PSA_SUCCESS : PSA_ERROR_NOT_SUPPORTED);
566 #endif /* PSA_CRYPTO_DRIVER_TEST */
567
568 default:
569 (void)key_type;
570 (void)data;
571 (void)data_length;
572 return (PSA_ERROR_INVALID_ARGUMENT);
573 }
574 }
575
576 /** Get the key buffer size required to store the key material of a key
577 * associated with an opaque driver.
578 *
579 * \param[in] attributes The key attributes.
580 * \param[out] key_buffer_size Minimum buffer size to contain the key material
581 *
582 * \retval #PSA_SUCCESS
583 * The minimum size for a buffer to contain the key material has been
584 * returned successfully.
585 * \retval #PSA_ERROR_NOT_SUPPORTED
586 * The type and/or the size in bits of the key or the combination of
587 * the two is not supported.
588 * \retval #PSA_ERROR_INVALID_ARGUMENT
589 * The key is declared with a lifetime not known to us.
590 */
psa_driver_wrapper_get_key_buffer_size(const psa_key_attributes_t * attributes,size_t * key_buffer_size)591 psa_status_t psa_driver_wrapper_get_key_buffer_size(const psa_key_attributes_t *attributes, size_t *key_buffer_size)
592 {
593 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes));
594 psa_key_type_t key_type = psa_get_key_type(attributes);
595 size_t key_bits = psa_get_key_bits(attributes);
596
597 *key_buffer_size = 0;
598 switch (location) {
599 #if defined(PSA_CRYPTO_DRIVER_TEST)
600 case PSA_CRYPTO_TEST_DRIVER_LOCATION:
601 #if defined(MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS)
602 /* Emulate property 'builtin_key_size' */
603 if (psa_key_id_is_builtin(MBEDTLS_SVC_KEY_ID_GET_KEY_ID(psa_get_key_id(attributes)))) {
604 *key_buffer_size = sizeof(psa_drv_slot_number_t);
605 return (PSA_SUCCESS);
606 }
607 #endif /* MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS */
608 *key_buffer_size = mbedtls_test_opaque_size_function(key_type, key_bits);
609 return ((*key_buffer_size != 0) ? PSA_SUCCESS : PSA_ERROR_NOT_SUPPORTED);
610 #endif /* PSA_CRYPTO_DRIVER_TEST */
611
612 default:
613 (void)key_type;
614 (void)key_bits;
615 return (PSA_ERROR_INVALID_ARGUMENT);
616 }
617 }
618
psa_driver_wrapper_generate_key(const psa_key_attributes_t * attributes,const psa_key_production_parameters_t * params,size_t params_data_length,uint8_t * key_buffer,size_t key_buffer_size,size_t * key_buffer_length)619 psa_status_t psa_driver_wrapper_generate_key(const psa_key_attributes_t *attributes,
620 const psa_key_production_parameters_t *params, size_t params_data_length,
621 uint8_t *key_buffer, size_t key_buffer_size, size_t *key_buffer_length)
622 {
623 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
624 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes));
625
626 #if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE)
627 int is_default_production = psa_key_production_parameters_are_default(params, params_data_length);
628 if (location != PSA_KEY_LOCATION_LOCAL_STORAGE && !is_default_production) {
629 /* We don't support passing custom production parameters
630 * to drivers yet. */
631 return PSA_ERROR_NOT_SUPPORTED;
632 }
633 #else
634 int is_default_production = 1;
635 (void)is_default_production;
636 #endif
637 /* Try dynamically-registered SE interface first */
638 #if defined(MBEDTLS_PSA_CRYPTO_SE_C)
639 const psa_drv_se_t *drv;
640 psa_drv_se_context_t *drv_context;
641
642 if (psa_get_se_driver(psa_get_key_lifetime(attributes), &drv, &drv_context)) {
643 size_t pubkey_length = 0; /* We don't support this feature yet */
644 if (drv->key_management == NULL || drv->key_management->p_generate == NULL) {
645 /* Key is defined as being in SE, but we have no way to generate it */
646 return (PSA_ERROR_NOT_SUPPORTED);
647 }
648 return (drv->key_management->p_generate(drv_context, *((psa_key_slot_number_t *)key_buffer), attributes, NULL,
649 0, &pubkey_length));
650 }
651 #endif /* MBEDTLS_PSA_CRYPTO_SE_C */
652
653 switch (location) {
654 case PSA_KEY_LOCATION_LOCAL_STORAGE:
655 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
656 /* Transparent drivers are limited to generating asymmetric keys. */
657 /* We don't support passing custom production parameters
658 * to drivers yet. */
659 if (PSA_KEY_TYPE_IS_ASYMMETRIC(psa_get_key_type(attributes)) && is_default_production) {
660 /* Cycle through all known transparent accelerators */
661 #if defined(PSA_CRYPTO_DRIVER_TEST)
662 status =
663 mbedtls_test_transparent_generate_key(attributes, key_buffer, key_buffer_size, key_buffer_length);
664 /* Declared with fallback == true */
665 if (status != PSA_ERROR_NOT_SUPPORTED)
666 break;
667 #endif /* PSA_CRYPTO_DRIVER_TEST */
668 #if defined(MBEDTLS_PSA_P256M_DRIVER_ENABLED)
669 if (PSA_KEY_TYPE_IS_ECC(psa_get_key_type(attributes)) &&
670 psa_get_key_type(attributes) == PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1) &&
671 psa_get_key_bits(attributes) == 256) {
672 status = p256_transparent_generate_key(attributes, key_buffer, key_buffer_size, key_buffer_length);
673 if (status != PSA_ERROR_NOT_SUPPORTED)
674 break;
675 }
676
677 #endif /* MBEDTLS_PSA_P256M_DRIVER_ENABLED */
678 }
679 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
680
681 /* Software fallback */
682 status = psa_generate_key_internal(attributes, params, params_data_length, key_buffer, key_buffer_size,
683 key_buffer_length);
684 break;
685
686 /* Add cases for opaque driver here */
687 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
688 #if defined(PSA_CRYPTO_DRIVER_TEST)
689 case PSA_CRYPTO_TEST_DRIVER_LOCATION:
690 status = mbedtls_test_opaque_generate_key(attributes, key_buffer, key_buffer_size, key_buffer_length);
691 break;
692 #endif /* PSA_CRYPTO_DRIVER_TEST */
693 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
694
695 default:
696 /* Key is declared with a lifetime not known to us */
697 status = PSA_ERROR_INVALID_ARGUMENT;
698 break;
699 }
700
701 return (status);
702 }
703
psa_driver_wrapper_import_key(const psa_key_attributes_t * attributes,const uint8_t * data,size_t data_length,uint8_t * key_buffer,size_t key_buffer_size,size_t * key_buffer_length,size_t * bits)704 psa_status_t psa_driver_wrapper_import_key(const psa_key_attributes_t *attributes, const uint8_t *data,
705 size_t data_length, uint8_t *key_buffer, size_t key_buffer_size,
706 size_t *key_buffer_length, size_t *bits)
707 {
708
709 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
710 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes));
711
712 /* Try dynamically-registered SE interface first */
713 #if defined(MBEDTLS_PSA_CRYPTO_SE_C)
714 const psa_drv_se_t *drv;
715 psa_drv_se_context_t *drv_context;
716
717 if (psa_get_se_driver(psa_get_key_lifetime(attributes), &drv, &drv_context)) {
718 if (drv->key_management == NULL || drv->key_management->p_import == NULL)
719 return (PSA_ERROR_NOT_SUPPORTED);
720
721 /* The driver should set the number of key bits, however in
722 * case it doesn't, we initialize bits to an invalid value. */
723 *bits = PSA_MAX_KEY_BITS + 1;
724 status = drv->key_management->p_import(drv_context, *((psa_key_slot_number_t *)key_buffer), attributes, data,
725 data_length, bits);
726
727 if (status != PSA_SUCCESS)
728 return (status);
729
730 if ((*bits) > PSA_MAX_KEY_BITS)
731 return (PSA_ERROR_NOT_SUPPORTED);
732
733 return (PSA_SUCCESS);
734 }
735 #endif /* MBEDTLS_PSA_CRYPTO_SE_C */
736
737 switch (location) {
738 case PSA_KEY_LOCATION_LOCAL_STORAGE:
739 /* Key is stored in the slot in export representation, so
740 * cycle through all known transparent accelerators */
741 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
742
743 #if (defined(PSA_CRYPTO_DRIVER_TEST))
744 status = mbedtls_test_transparent_import_key(attributes, data, data_length, key_buffer, key_buffer_size,
745 key_buffer_length, bits);
746
747 if (status != PSA_ERROR_NOT_SUPPORTED)
748 return (status);
749 #endif
750
751 #if (defined(MBEDTLS_PSA_P256M_DRIVER_ENABLED))
752 status = p256_transparent_import_key(attributes, data, data_length, key_buffer, key_buffer_size,
753 key_buffer_length, bits);
754
755 if (status != PSA_ERROR_NOT_SUPPORTED)
756 return (status);
757 #endif
758
759 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
760
761 /* Fell through, meaning no accelerator supports this operation */
762 return (psa_import_key_into_slot(attributes, data, data_length, key_buffer, key_buffer_size,
763 key_buffer_length, bits));
764 /* Add cases for opaque driver here */
765 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
766
767 #if (defined(PSA_CRYPTO_DRIVER_TEST))
768 case 0x7fffff:
769 return (mbedtls_test_opaque_import_key(attributes, data, data_length, key_buffer, key_buffer_size,
770 key_buffer_length, bits));
771 #endif
772
773 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
774 default:
775 (void)status;
776 return (PSA_ERROR_INVALID_ARGUMENT);
777 }
778 }
779
psa_driver_wrapper_export_key(const psa_key_attributes_t * attributes,const uint8_t * key_buffer,size_t key_buffer_size,uint8_t * data,size_t data_size,size_t * data_length)780 psa_status_t psa_driver_wrapper_export_key(const psa_key_attributes_t *attributes, const uint8_t *key_buffer,
781 size_t key_buffer_size, uint8_t *data, size_t data_size, size_t *data_length)
782
783 {
784
785 psa_status_t status = PSA_ERROR_INVALID_ARGUMENT;
786 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes));
787
788 /* Try dynamically-registered SE interface first */
789 #if defined(MBEDTLS_PSA_CRYPTO_SE_C)
790 const psa_drv_se_t *drv;
791 psa_drv_se_context_t *drv_context;
792
793 if (psa_get_se_driver(psa_get_key_lifetime(attributes), &drv, &drv_context)) {
794 if ((drv->key_management == NULL) || (drv->key_management->p_export == NULL)) {
795 return (PSA_ERROR_NOT_SUPPORTED);
796 }
797
798 return (drv->key_management->p_export(drv_context, *((psa_key_slot_number_t *)key_buffer), data, data_size,
799 data_length));
800 }
801 #endif /* MBEDTLS_PSA_CRYPTO_SE_C */
802
803 switch (location) {
804 case PSA_KEY_LOCATION_LOCAL_STORAGE:
805 return (psa_export_key_internal(attributes, key_buffer, key_buffer_size, data, data_size, data_length));
806
807 /* Add cases for opaque driver here */
808 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
809
810 #if (defined(PSA_CRYPTO_DRIVER_TEST))
811 case 0x7fffff:
812 return (
813 mbedtls_test_opaque_export_key(attributes, key_buffer, key_buffer_size, data, data_size, data_length));
814 #endif
815
816 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
817 default:
818 /* Key is declared with a lifetime not known to us */
819 return (status);
820 }
821 }
822
psa_driver_wrapper_export_public_key(const psa_key_attributes_t * attributes,const uint8_t * key_buffer,size_t key_buffer_size,uint8_t * data,size_t data_size,size_t * data_length)823 psa_status_t psa_driver_wrapper_export_public_key(const psa_key_attributes_t *attributes, const uint8_t *key_buffer,
824 size_t key_buffer_size, uint8_t *data, size_t data_size,
825 size_t *data_length)
826
827 {
828
829 psa_status_t status = PSA_ERROR_INVALID_ARGUMENT;
830 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes));
831
832 /* Try dynamically-registered SE interface first */
833 #if defined(MBEDTLS_PSA_CRYPTO_SE_C)
834 const psa_drv_se_t *drv;
835 psa_drv_se_context_t *drv_context;
836
837 if (psa_get_se_driver(attributes->core.lifetime, &drv, &drv_context)) {
838 if ((drv->key_management == NULL) || (drv->key_management->p_export_public == NULL)) {
839 return (PSA_ERROR_NOT_SUPPORTED);
840 }
841
842 return (drv->key_management->p_export_public(drv_context, *((psa_key_slot_number_t *)key_buffer), data,
843 data_size, data_length));
844 }
845 #endif /* MBEDTLS_PSA_CRYPTO_SE_C */
846
847 switch (location) {
848 case PSA_KEY_LOCATION_LOCAL_STORAGE:
849 /* Key is stored in the slot in export representation, so
850 * cycle through all known transparent accelerators */
851 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
852
853 #if (defined(PSA_CRYPTO_DRIVER_TEST))
854 status = mbedtls_test_transparent_export_public_key(attributes, key_buffer, key_buffer_size, data,
855 data_size, data_length);
856
857 if (status != PSA_ERROR_NOT_SUPPORTED)
858 return (status);
859 #endif
860
861 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
862 /* Fell through, meaning no accelerator supports this operation */
863 return (
864 psa_export_public_key_internal(attributes, key_buffer, key_buffer_size, data, data_size, data_length));
865
866 /* Add cases for opaque driver here */
867 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
868
869 #if (defined(PSA_CRYPTO_DRIVER_TEST))
870 case 0x7fffff:
871 return (mbedtls_test_opaque_export_public_key(attributes, key_buffer, key_buffer_size, data, data_size,
872 data_length));
873 #endif
874
875 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
876 default:
877 /* Key is declared with a lifetime not known to us */
878 return (status);
879 }
880 }
881
psa_driver_wrapper_get_builtin_key(psa_drv_slot_number_t slot_number,psa_key_attributes_t * attributes,uint8_t * key_buffer,size_t key_buffer_size,size_t * key_buffer_length)882 psa_status_t psa_driver_wrapper_get_builtin_key(psa_drv_slot_number_t slot_number, psa_key_attributes_t *attributes,
883 uint8_t *key_buffer, size_t key_buffer_size, size_t *key_buffer_length)
884 {
885
886 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes));
887 switch (location) {
888 #if defined(PSA_CRYPTO_DRIVER_TEST)
889
890 #if (defined(PSA_CRYPTO_DRIVER_TEST))
891 case 0x7fffff:
892 return (mbedtls_test_opaque_get_builtin_key(slot_number, attributes, key_buffer, key_buffer_size,
893 key_buffer_length));
894 #endif
895
896 #endif /* PSA_CRYPTO_DRIVER_TEST */
897 default:
898 (void)slot_number;
899 (void)key_buffer;
900 (void)key_buffer_size;
901 (void)key_buffer_length;
902 return (PSA_ERROR_DOES_NOT_EXIST);
903 }
904 }
905
psa_driver_wrapper_copy_key(psa_key_attributes_t * attributes,const uint8_t * source_key,size_t source_key_length,uint8_t * target_key_buffer,size_t target_key_buffer_size,size_t * target_key_buffer_length)906 psa_status_t psa_driver_wrapper_copy_key(psa_key_attributes_t *attributes, const uint8_t *source_key,
907 size_t source_key_length, uint8_t *target_key_buffer,
908 size_t target_key_buffer_size, size_t *target_key_buffer_length)
909 {
910
911 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
912 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes));
913
914 #if defined(MBEDTLS_PSA_CRYPTO_SE_C)
915 const psa_drv_se_t *drv;
916 psa_drv_se_context_t *drv_context;
917
918 if (psa_get_se_driver(psa_get_key_lifetime(attributes), &drv, &drv_context)) {
919 /* Copying to a secure element is not implemented yet. */
920 return (PSA_ERROR_NOT_SUPPORTED);
921 }
922 #endif /* MBEDTLS_PSA_CRYPTO_SE_C */
923
924 switch (location) {
925 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
926
927 #if (defined(PSA_CRYPTO_DRIVER_TEST))
928 case 0x7fffff:
929 return (mbedtls_test_opaque_copy_key(attributes, source_key, source_key_length, target_key_buffer,
930 target_key_buffer_size, target_key_buffer_length));
931 #endif
932
933 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
934 default:
935 (void)source_key;
936 (void)source_key_length;
937 (void)target_key_buffer;
938 (void)target_key_buffer_size;
939 (void)target_key_buffer_length;
940 status = PSA_ERROR_INVALID_ARGUMENT;
941 }
942 return (status);
943 }
944
945 /*
946 * Cipher functions
947 */
psa_driver_wrapper_cipher_encrypt(const psa_key_attributes_t * attributes,const uint8_t * key_buffer,size_t key_buffer_size,psa_algorithm_t alg,const uint8_t * iv,size_t iv_length,const uint8_t * input,size_t input_length,uint8_t * output,size_t output_size,size_t * output_length)948 psa_status_t psa_driver_wrapper_cipher_encrypt(const psa_key_attributes_t *attributes, const uint8_t *key_buffer,
949 size_t key_buffer_size, psa_algorithm_t alg, const uint8_t *iv,
950 size_t iv_length, const uint8_t *input, size_t input_length,
951 uint8_t *output, size_t output_size, size_t *output_length)
952 {
953 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
954 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes));
955
956 switch (location) {
957 case PSA_KEY_LOCATION_LOCAL_STORAGE:
958 /* Key is stored in the slot in export representation, so
959 * cycle through all known transparent accelerators */
960 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
961 #if defined(PSA_CRYPTO_DRIVER_TEST)
962 status =
963 mbedtls_test_transparent_cipher_encrypt(attributes, key_buffer, key_buffer_size, alg, iv, iv_length,
964 input, input_length, output, output_size, output_length);
965 /* Declared with fallback == true */
966 if (status != PSA_ERROR_NOT_SUPPORTED)
967 return (status);
968 #endif /* PSA_CRYPTO_DRIVER_TEST */
969 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
970
971 #if defined(MBEDTLS_PSA_BUILTIN_CIPHER)
972 return (mbedtls_psa_cipher_encrypt(attributes, key_buffer, key_buffer_size, alg, iv, iv_length, input,
973 input_length, output, output_size, output_length));
974 #else
975 return (PSA_ERROR_NOT_SUPPORTED);
976 #endif /* MBEDTLS_PSA_BUILTIN_CIPHER */
977
978 /* Add cases for opaque driver here */
979 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
980 #if defined(PSA_CRYPTO_DRIVER_TEST)
981 case PSA_CRYPTO_TEST_DRIVER_LOCATION:
982 return (mbedtls_test_opaque_cipher_encrypt(attributes, key_buffer, key_buffer_size, alg, iv, iv_length,
983 input, input_length, output, output_size, output_length));
984 #endif /* PSA_CRYPTO_DRIVER_TEST */
985 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
986
987 default:
988 /* Key is declared with a lifetime not known to us */
989 (void)status;
990 (void)key_buffer;
991 (void)key_buffer_size;
992 (void)alg;
993 (void)iv;
994 (void)iv_length;
995 (void)input;
996 (void)input_length;
997 (void)output;
998 (void)output_size;
999 (void)output_length;
1000 return (PSA_ERROR_INVALID_ARGUMENT);
1001 }
1002 }
1003
psa_driver_wrapper_cipher_decrypt(const psa_key_attributes_t * attributes,const uint8_t * key_buffer,size_t key_buffer_size,psa_algorithm_t alg,const uint8_t * input,size_t input_length,uint8_t * output,size_t output_size,size_t * output_length)1004 psa_status_t psa_driver_wrapper_cipher_decrypt(const psa_key_attributes_t *attributes, const uint8_t *key_buffer,
1005 size_t key_buffer_size, psa_algorithm_t alg, const uint8_t *input,
1006 size_t input_length, uint8_t *output, size_t output_size,
1007 size_t *output_length)
1008 {
1009 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
1010 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes));
1011
1012 switch (location) {
1013 case PSA_KEY_LOCATION_LOCAL_STORAGE:
1014 /* Key is stored in the slot in export representation, so
1015 * cycle through all known transparent accelerators */
1016 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
1017 #if defined(PSA_CRYPTO_DRIVER_TEST)
1018 status = mbedtls_test_transparent_cipher_decrypt(attributes, key_buffer, key_buffer_size, alg, input,
1019 input_length, output, output_size, output_length);
1020 /* Declared with fallback == true */
1021 if (status != PSA_ERROR_NOT_SUPPORTED)
1022 return (status);
1023 #endif /* PSA_CRYPTO_DRIVER_TEST */
1024 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
1025
1026 #if defined(MBEDTLS_PSA_BUILTIN_CIPHER)
1027 return (mbedtls_psa_cipher_decrypt(attributes, key_buffer, key_buffer_size, alg, input, input_length,
1028 output, output_size, output_length));
1029 #else
1030 return (PSA_ERROR_NOT_SUPPORTED);
1031 #endif /* MBEDTLS_PSA_BUILTIN_CIPHER */
1032
1033 /* Add cases for opaque driver here */
1034 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
1035 #if defined(PSA_CRYPTO_DRIVER_TEST)
1036 case PSA_CRYPTO_TEST_DRIVER_LOCATION:
1037 return (mbedtls_test_opaque_cipher_decrypt(attributes, key_buffer, key_buffer_size, alg, input,
1038 input_length, output, output_size, output_length));
1039 #endif /* PSA_CRYPTO_DRIVER_TEST */
1040 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
1041
1042 default:
1043 /* Key is declared with a lifetime not known to us */
1044 (void)status;
1045 (void)key_buffer;
1046 (void)key_buffer_size;
1047 (void)alg;
1048 (void)input;
1049 (void)input_length;
1050 (void)output;
1051 (void)output_size;
1052 (void)output_length;
1053 return (PSA_ERROR_INVALID_ARGUMENT);
1054 }
1055 }
1056
psa_driver_wrapper_cipher_encrypt_setup(psa_cipher_operation_t * operation,const psa_key_attributes_t * attributes,const uint8_t * key_buffer,size_t key_buffer_size,psa_algorithm_t alg)1057 psa_status_t psa_driver_wrapper_cipher_encrypt_setup(psa_cipher_operation_t *operation,
1058 const psa_key_attributes_t *attributes, const uint8_t *key_buffer,
1059 size_t key_buffer_size, psa_algorithm_t alg)
1060 {
1061 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
1062 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes));
1063
1064 switch (location) {
1065 case PSA_KEY_LOCATION_LOCAL_STORAGE:
1066 /* Key is stored in the slot in export representation, so
1067 * cycle through all known transparent accelerators */
1068 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
1069 #if defined(PSA_CRYPTO_DRIVER_TEST)
1070 status = mbedtls_test_transparent_cipher_encrypt_setup(&operation->ctx.transparent_test_driver_ctx,
1071 attributes, key_buffer, key_buffer_size, alg);
1072 /* Declared with fallback == true */
1073 if (status == PSA_SUCCESS)
1074 operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID;
1075
1076 if (status != PSA_ERROR_NOT_SUPPORTED)
1077 return (status);
1078 #endif /* PSA_CRYPTO_DRIVER_TEST */
1079 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
1080 #if defined(MBEDTLS_PSA_BUILTIN_CIPHER)
1081 /* Fell through, meaning no accelerator supports this operation */
1082 status = mbedtls_psa_cipher_encrypt_setup(&operation->ctx.mbedtls_ctx, attributes, key_buffer,
1083 key_buffer_size, alg);
1084 if (status == PSA_SUCCESS)
1085 operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID;
1086
1087 if (status != PSA_ERROR_NOT_SUPPORTED)
1088 return (status);
1089 #endif /* MBEDTLS_PSA_BUILTIN_CIPHER */
1090 return (PSA_ERROR_NOT_SUPPORTED);
1091
1092 /* Add cases for opaque driver here */
1093 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
1094 #if defined(PSA_CRYPTO_DRIVER_TEST)
1095 case PSA_CRYPTO_TEST_DRIVER_LOCATION:
1096 status = mbedtls_test_opaque_cipher_encrypt_setup(&operation->ctx.opaque_test_driver_ctx, attributes,
1097 key_buffer, key_buffer_size, alg);
1098
1099 if (status == PSA_SUCCESS)
1100 operation->id = MBEDTLS_TEST_OPAQUE_DRIVER_ID;
1101
1102 return (status);
1103 #endif /* PSA_CRYPTO_DRIVER_TEST */
1104 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
1105 default:
1106 /* Key is declared with a lifetime not known to us */
1107 (void)status;
1108 (void)operation;
1109 (void)key_buffer;
1110 (void)key_buffer_size;
1111 (void)alg;
1112 return (PSA_ERROR_INVALID_ARGUMENT);
1113 }
1114 }
1115
psa_driver_wrapper_cipher_decrypt_setup(psa_cipher_operation_t * operation,const psa_key_attributes_t * attributes,const uint8_t * key_buffer,size_t key_buffer_size,psa_algorithm_t alg)1116 psa_status_t psa_driver_wrapper_cipher_decrypt_setup(psa_cipher_operation_t *operation,
1117 const psa_key_attributes_t *attributes, const uint8_t *key_buffer,
1118 size_t key_buffer_size, psa_algorithm_t alg)
1119 {
1120 psa_status_t status = PSA_ERROR_INVALID_ARGUMENT;
1121 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes));
1122
1123 switch (location) {
1124 case PSA_KEY_LOCATION_LOCAL_STORAGE:
1125 /* Key is stored in the slot in export representation, so
1126 * cycle through all known transparent accelerators */
1127 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
1128 #if defined(PSA_CRYPTO_DRIVER_TEST)
1129 status = mbedtls_test_transparent_cipher_decrypt_setup(&operation->ctx.transparent_test_driver_ctx,
1130 attributes, key_buffer, key_buffer_size, alg);
1131 /* Declared with fallback == true */
1132 if (status == PSA_SUCCESS)
1133 operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID;
1134
1135 if (status != PSA_ERROR_NOT_SUPPORTED)
1136 return (status);
1137 #endif /* PSA_CRYPTO_DRIVER_TEST */
1138 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
1139 #if defined(MBEDTLS_PSA_BUILTIN_CIPHER)
1140 /* Fell through, meaning no accelerator supports this operation */
1141 status = mbedtls_psa_cipher_decrypt_setup(&operation->ctx.mbedtls_ctx, attributes, key_buffer,
1142 key_buffer_size, alg);
1143 if (status == PSA_SUCCESS)
1144 operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID;
1145
1146 return (status);
1147 #else /* MBEDTLS_PSA_BUILTIN_CIPHER */
1148 return (PSA_ERROR_NOT_SUPPORTED);
1149 #endif /* MBEDTLS_PSA_BUILTIN_CIPHER */
1150
1151 /* Add cases for opaque driver here */
1152 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
1153 #if defined(PSA_CRYPTO_DRIVER_TEST)
1154 case PSA_CRYPTO_TEST_DRIVER_LOCATION:
1155 status = mbedtls_test_opaque_cipher_decrypt_setup(&operation->ctx.opaque_test_driver_ctx, attributes,
1156 key_buffer, key_buffer_size, alg);
1157
1158 if (status == PSA_SUCCESS)
1159 operation->id = MBEDTLS_TEST_OPAQUE_DRIVER_ID;
1160
1161 return (status);
1162 #endif /* PSA_CRYPTO_DRIVER_TEST */
1163 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
1164 default:
1165 /* Key is declared with a lifetime not known to us */
1166 (void)status;
1167 (void)operation;
1168 (void)key_buffer;
1169 (void)key_buffer_size;
1170 (void)alg;
1171 return (PSA_ERROR_INVALID_ARGUMENT);
1172 }
1173 }
1174
psa_driver_wrapper_cipher_set_iv(psa_cipher_operation_t * operation,const uint8_t * iv,size_t iv_length)1175 psa_status_t psa_driver_wrapper_cipher_set_iv(psa_cipher_operation_t *operation, const uint8_t *iv, size_t iv_length)
1176 {
1177 switch (operation->id) {
1178 #if defined(MBEDTLS_PSA_BUILTIN_CIPHER)
1179 case PSA_CRYPTO_MBED_TLS_DRIVER_ID:
1180 return (mbedtls_psa_cipher_set_iv(&operation->ctx.mbedtls_ctx, iv, iv_length));
1181 #endif /* MBEDTLS_PSA_BUILTIN_CIPHER */
1182
1183 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
1184 #if defined(PSA_CRYPTO_DRIVER_TEST)
1185 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID:
1186 return (mbedtls_test_transparent_cipher_set_iv(&operation->ctx.transparent_test_driver_ctx, iv, iv_length));
1187
1188 case MBEDTLS_TEST_OPAQUE_DRIVER_ID:
1189 return (mbedtls_test_opaque_cipher_set_iv(&operation->ctx.opaque_test_driver_ctx, iv, iv_length));
1190 #endif /* PSA_CRYPTO_DRIVER_TEST */
1191 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
1192 }
1193
1194 (void)iv;
1195 (void)iv_length;
1196
1197 return (PSA_ERROR_INVALID_ARGUMENT);
1198 }
1199
psa_driver_wrapper_cipher_update(psa_cipher_operation_t * operation,const uint8_t * input,size_t input_length,uint8_t * output,size_t output_size,size_t * output_length)1200 psa_status_t psa_driver_wrapper_cipher_update(psa_cipher_operation_t *operation, const uint8_t *input,
1201 size_t input_length, uint8_t *output, size_t output_size,
1202 size_t *output_length)
1203 {
1204 switch (operation->id) {
1205 #if defined(MBEDTLS_PSA_BUILTIN_CIPHER)
1206 case PSA_CRYPTO_MBED_TLS_DRIVER_ID:
1207 return (mbedtls_psa_cipher_update(&operation->ctx.mbedtls_ctx, input, input_length, output, output_size,
1208 output_length));
1209 #endif /* MBEDTLS_PSA_BUILTIN_CIPHER */
1210
1211 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
1212 #if defined(PSA_CRYPTO_DRIVER_TEST)
1213 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID:
1214 return (mbedtls_test_transparent_cipher_update(&operation->ctx.transparent_test_driver_ctx, input,
1215 input_length, output, output_size, output_length));
1216
1217 case MBEDTLS_TEST_OPAQUE_DRIVER_ID:
1218 return (mbedtls_test_opaque_cipher_update(&operation->ctx.opaque_test_driver_ctx, input, input_length,
1219 output, output_size, output_length));
1220 #endif /* PSA_CRYPTO_DRIVER_TEST */
1221 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
1222 }
1223
1224 (void)input;
1225 (void)input_length;
1226 (void)output;
1227 (void)output_size;
1228 (void)output_length;
1229
1230 return (PSA_ERROR_INVALID_ARGUMENT);
1231 }
1232
psa_driver_wrapper_cipher_finish(psa_cipher_operation_t * operation,uint8_t * output,size_t output_size,size_t * output_length)1233 psa_status_t psa_driver_wrapper_cipher_finish(psa_cipher_operation_t *operation, uint8_t *output, size_t output_size,
1234 size_t *output_length)
1235 {
1236 switch (operation->id) {
1237 #if defined(MBEDTLS_PSA_BUILTIN_CIPHER)
1238 case PSA_CRYPTO_MBED_TLS_DRIVER_ID:
1239 return (mbedtls_psa_cipher_finish(&operation->ctx.mbedtls_ctx, output, output_size, output_length));
1240 #endif /* MBEDTLS_PSA_BUILTIN_CIPHER */
1241
1242 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
1243 #if defined(PSA_CRYPTO_DRIVER_TEST)
1244 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID:
1245 return (mbedtls_test_transparent_cipher_finish(&operation->ctx.transparent_test_driver_ctx, output,
1246 output_size, output_length));
1247
1248 case MBEDTLS_TEST_OPAQUE_DRIVER_ID:
1249 return (mbedtls_test_opaque_cipher_finish(&operation->ctx.opaque_test_driver_ctx, output, output_size,
1250 output_length));
1251 #endif /* PSA_CRYPTO_DRIVER_TEST */
1252 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
1253 }
1254
1255 (void)output;
1256 (void)output_size;
1257 (void)output_length;
1258
1259 return (PSA_ERROR_INVALID_ARGUMENT);
1260 }
1261
psa_driver_wrapper_cipher_abort(psa_cipher_operation_t * operation)1262 psa_status_t psa_driver_wrapper_cipher_abort(psa_cipher_operation_t *operation)
1263 {
1264 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
1265
1266 switch (operation->id) {
1267 #if defined(MBEDTLS_PSA_BUILTIN_CIPHER)
1268 case PSA_CRYPTO_MBED_TLS_DRIVER_ID:
1269 return (mbedtls_psa_cipher_abort(&operation->ctx.mbedtls_ctx));
1270 #endif /* MBEDTLS_PSA_BUILTIN_CIPHER */
1271
1272 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
1273 #if defined(PSA_CRYPTO_DRIVER_TEST)
1274 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID:
1275 status = mbedtls_test_transparent_cipher_abort(&operation->ctx.transparent_test_driver_ctx);
1276 mbedtls_platform_zeroize(&operation->ctx.transparent_test_driver_ctx,
1277 sizeof(operation->ctx.transparent_test_driver_ctx));
1278 return (status);
1279
1280 case MBEDTLS_TEST_OPAQUE_DRIVER_ID:
1281 status = mbedtls_test_opaque_cipher_abort(&operation->ctx.opaque_test_driver_ctx);
1282 mbedtls_platform_zeroize(&operation->ctx.opaque_test_driver_ctx,
1283 sizeof(operation->ctx.opaque_test_driver_ctx));
1284 return (status);
1285 #endif /* PSA_CRYPTO_DRIVER_TEST */
1286 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
1287 }
1288
1289 (void)status;
1290 return (PSA_ERROR_INVALID_ARGUMENT);
1291 }
1292
1293 /*
1294 * Hashing functions
1295 */
psa_driver_wrapper_hash_compute(psa_algorithm_t alg,const uint8_t * input,size_t input_length,uint8_t * hash,size_t hash_size,size_t * hash_length)1296 psa_status_t psa_driver_wrapper_hash_compute(psa_algorithm_t alg, const uint8_t *input, size_t input_length,
1297 uint8_t *hash, size_t hash_size, size_t *hash_length)
1298 {
1299 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
1300
1301 /* Try accelerators first */
1302 #if defined(PSA_CRYPTO_DRIVER_TEST)
1303 status = mbedtls_test_transparent_hash_compute(alg, input, input_length, hash, hash_size, hash_length);
1304 if (status != PSA_ERROR_NOT_SUPPORTED)
1305 return (status);
1306 #endif
1307
1308 /* If software fallback is compiled in, try fallback */
1309 #if defined(MBEDTLS_PSA_BUILTIN_HASH)
1310 status = mbedtls_psa_hash_compute(alg, input, input_length, hash, hash_size, hash_length);
1311 if (status != PSA_ERROR_NOT_SUPPORTED)
1312 return (status);
1313 #endif
1314 (void)status;
1315 (void)alg;
1316 (void)input;
1317 (void)input_length;
1318 (void)hash;
1319 (void)hash_size;
1320 (void)hash_length;
1321
1322 return (PSA_ERROR_NOT_SUPPORTED);
1323 }
1324
psa_driver_wrapper_hash_setup(psa_hash_operation_t * operation,psa_algorithm_t alg)1325 psa_status_t psa_driver_wrapper_hash_setup(psa_hash_operation_t *operation, psa_algorithm_t alg)
1326 {
1327 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
1328
1329 /* Try setup on accelerators first */
1330 #if defined(PSA_CRYPTO_DRIVER_TEST)
1331 status = mbedtls_test_transparent_hash_setup(&operation->ctx.test_driver_ctx, alg);
1332 if (status == PSA_SUCCESS)
1333 operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID;
1334
1335 if (status != PSA_ERROR_NOT_SUPPORTED)
1336 return (status);
1337 #endif
1338
1339 /* If software fallback is compiled in, try fallback */
1340 #if defined(MBEDTLS_PSA_BUILTIN_HASH)
1341 status = mbedtls_psa_hash_setup(&operation->ctx.mbedtls_ctx, alg);
1342 if (status == PSA_SUCCESS)
1343 operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID;
1344
1345 if (status != PSA_ERROR_NOT_SUPPORTED)
1346 return (status);
1347 #endif
1348 /* Nothing left to try if we fall through here */
1349 (void)status;
1350 (void)operation;
1351 (void)alg;
1352 return (PSA_ERROR_NOT_SUPPORTED);
1353 }
1354
psa_driver_wrapper_hash_clone(const psa_hash_operation_t * source_operation,psa_hash_operation_t * target_operation)1355 psa_status_t psa_driver_wrapper_hash_clone(const psa_hash_operation_t *source_operation,
1356 psa_hash_operation_t *target_operation)
1357 {
1358 switch (source_operation->id) {
1359 #if defined(MBEDTLS_PSA_BUILTIN_HASH)
1360 case PSA_CRYPTO_MBED_TLS_DRIVER_ID:
1361 target_operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID;
1362 return (mbedtls_psa_hash_clone(&source_operation->ctx.mbedtls_ctx, &target_operation->ctx.mbedtls_ctx));
1363 #endif
1364 #if defined(PSA_CRYPTO_DRIVER_TEST)
1365 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID:
1366 target_operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID;
1367 return (mbedtls_test_transparent_hash_clone(&source_operation->ctx.test_driver_ctx,
1368 &target_operation->ctx.test_driver_ctx));
1369 #endif
1370 default:
1371 (void)target_operation;
1372 return (PSA_ERROR_BAD_STATE);
1373 }
1374 }
1375
psa_driver_wrapper_hash_update(psa_hash_operation_t * operation,const uint8_t * input,size_t input_length)1376 psa_status_t psa_driver_wrapper_hash_update(psa_hash_operation_t *operation, const uint8_t *input, size_t input_length)
1377 {
1378 switch (operation->id) {
1379 #if defined(MBEDTLS_PSA_BUILTIN_HASH)
1380 case PSA_CRYPTO_MBED_TLS_DRIVER_ID:
1381 return (mbedtls_psa_hash_update(&operation->ctx.mbedtls_ctx, input, input_length));
1382 #endif
1383 #if defined(PSA_CRYPTO_DRIVER_TEST)
1384 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID:
1385 return (mbedtls_test_transparent_hash_update(&operation->ctx.test_driver_ctx, input, input_length));
1386 #endif
1387 default:
1388 (void)input;
1389 (void)input_length;
1390 return (PSA_ERROR_BAD_STATE);
1391 }
1392 }
1393
psa_driver_wrapper_hash_finish(psa_hash_operation_t * operation,uint8_t * hash,size_t hash_size,size_t * hash_length)1394 psa_status_t psa_driver_wrapper_hash_finish(psa_hash_operation_t *operation, uint8_t *hash, size_t hash_size,
1395 size_t *hash_length)
1396 {
1397 switch (operation->id) {
1398 #if defined(MBEDTLS_PSA_BUILTIN_HASH)
1399 case PSA_CRYPTO_MBED_TLS_DRIVER_ID:
1400 return (mbedtls_psa_hash_finish(&operation->ctx.mbedtls_ctx, hash, hash_size, hash_length));
1401 #endif
1402 #if defined(PSA_CRYPTO_DRIVER_TEST)
1403 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID:
1404 return (
1405 mbedtls_test_transparent_hash_finish(&operation->ctx.test_driver_ctx, hash, hash_size, hash_length));
1406 #endif
1407 default:
1408 (void)hash;
1409 (void)hash_size;
1410 (void)hash_length;
1411 return (PSA_ERROR_BAD_STATE);
1412 }
1413 }
1414
psa_driver_wrapper_hash_abort(psa_hash_operation_t * operation)1415 psa_status_t psa_driver_wrapper_hash_abort(psa_hash_operation_t *operation)
1416 {
1417 switch (operation->id) {
1418 #if defined(MBEDTLS_PSA_BUILTIN_HASH)
1419 case PSA_CRYPTO_MBED_TLS_DRIVER_ID:
1420 return (mbedtls_psa_hash_abort(&operation->ctx.mbedtls_ctx));
1421 #endif
1422 #if defined(PSA_CRYPTO_DRIVER_TEST)
1423 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID:
1424 return (mbedtls_test_transparent_hash_abort(&operation->ctx.test_driver_ctx));
1425 #endif
1426 default:
1427 return (PSA_ERROR_BAD_STATE);
1428 }
1429 }
1430
psa_driver_wrapper_aead_encrypt(const psa_key_attributes_t * attributes,const uint8_t * key_buffer,size_t key_buffer_size,psa_algorithm_t alg,const uint8_t * nonce,size_t nonce_length,const uint8_t * additional_data,size_t additional_data_length,const uint8_t * plaintext,size_t plaintext_length,uint8_t * ciphertext,size_t ciphertext_size,size_t * ciphertext_length)1431 psa_status_t psa_driver_wrapper_aead_encrypt(const psa_key_attributes_t *attributes, const uint8_t *key_buffer,
1432 size_t key_buffer_size, psa_algorithm_t alg, const uint8_t *nonce,
1433 size_t nonce_length, const uint8_t *additional_data,
1434 size_t additional_data_length, const uint8_t *plaintext,
1435 size_t plaintext_length, uint8_t *ciphertext, size_t ciphertext_size,
1436 size_t *ciphertext_length)
1437 {
1438 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
1439 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes));
1440
1441 switch (location) {
1442 case PSA_KEY_LOCATION_LOCAL_STORAGE:
1443 /* Key is stored in the slot in export representation, so
1444 * cycle through all known transparent accelerators */
1445
1446 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
1447 #if defined(PSA_CRYPTO_DRIVER_TEST)
1448 status = mbedtls_test_transparent_aead_encrypt(
1449 attributes, key_buffer, key_buffer_size, alg, nonce, nonce_length, additional_data,
1450 additional_data_length, plaintext, plaintext_length, ciphertext, ciphertext_size, ciphertext_length);
1451 /* Declared with fallback == true */
1452 if (status != PSA_ERROR_NOT_SUPPORTED)
1453 return (status);
1454 #endif /* PSA_CRYPTO_DRIVER_TEST */
1455 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
1456
1457 /* Fell through, meaning no accelerator supports this operation */
1458 return (mbedtls_psa_aead_encrypt(attributes, key_buffer, key_buffer_size, alg, nonce, nonce_length,
1459 additional_data, additional_data_length, plaintext, plaintext_length,
1460 ciphertext, ciphertext_size, ciphertext_length));
1461
1462 /* Add cases for opaque driver here */
1463
1464 default:
1465 /* Key is declared with a lifetime not known to us */
1466 (void)status;
1467 return (PSA_ERROR_INVALID_ARGUMENT);
1468 }
1469 }
1470
psa_driver_wrapper_aead_decrypt(const psa_key_attributes_t * attributes,const uint8_t * key_buffer,size_t key_buffer_size,psa_algorithm_t alg,const uint8_t * nonce,size_t nonce_length,const uint8_t * additional_data,size_t additional_data_length,const uint8_t * ciphertext,size_t ciphertext_length,uint8_t * plaintext,size_t plaintext_size,size_t * plaintext_length)1471 psa_status_t psa_driver_wrapper_aead_decrypt(const psa_key_attributes_t *attributes, const uint8_t *key_buffer,
1472 size_t key_buffer_size, psa_algorithm_t alg, const uint8_t *nonce,
1473 size_t nonce_length, const uint8_t *additional_data,
1474 size_t additional_data_length, const uint8_t *ciphertext,
1475 size_t ciphertext_length, uint8_t *plaintext, size_t plaintext_size,
1476 size_t *plaintext_length)
1477 {
1478 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
1479 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes));
1480
1481 switch (location) {
1482 case PSA_KEY_LOCATION_LOCAL_STORAGE:
1483 /* Key is stored in the slot in export representation, so
1484 * cycle through all known transparent accelerators */
1485
1486 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
1487 #if defined(PSA_CRYPTO_DRIVER_TEST)
1488 status = mbedtls_test_transparent_aead_decrypt(
1489 attributes, key_buffer, key_buffer_size, alg, nonce, nonce_length, additional_data,
1490 additional_data_length, ciphertext, ciphertext_length, plaintext, plaintext_size, plaintext_length);
1491 /* Declared with fallback == true */
1492 if (status != PSA_ERROR_NOT_SUPPORTED)
1493 return (status);
1494 #endif /* PSA_CRYPTO_DRIVER_TEST */
1495 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
1496
1497 /* Fell through, meaning no accelerator supports this operation */
1498 return (mbedtls_psa_aead_decrypt(attributes, key_buffer, key_buffer_size, alg, nonce, nonce_length,
1499 additional_data, additional_data_length, ciphertext, ciphertext_length,
1500 plaintext, plaintext_size, plaintext_length));
1501
1502 /* Add cases for opaque driver here */
1503
1504 default:
1505 /* Key is declared with a lifetime not known to us */
1506 (void)status;
1507 return (PSA_ERROR_INVALID_ARGUMENT);
1508 }
1509 }
1510
psa_driver_wrapper_aead_encrypt_setup(psa_aead_operation_t * operation,const psa_key_attributes_t * attributes,const uint8_t * key_buffer,size_t key_buffer_size,psa_algorithm_t alg)1511 psa_status_t psa_driver_wrapper_aead_encrypt_setup(psa_aead_operation_t *operation,
1512 const psa_key_attributes_t *attributes, const uint8_t *key_buffer,
1513 size_t key_buffer_size, psa_algorithm_t alg)
1514 {
1515 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
1516 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes));
1517
1518 switch (location) {
1519 case PSA_KEY_LOCATION_LOCAL_STORAGE:
1520 /* Key is stored in the slot in export representation, so
1521 * cycle through all known transparent accelerators */
1522
1523 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
1524 #if defined(PSA_CRYPTO_DRIVER_TEST)
1525 operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID;
1526 status = mbedtls_test_transparent_aead_encrypt_setup(&operation->ctx.transparent_test_driver_ctx,
1527 attributes, key_buffer, key_buffer_size, alg);
1528
1529 /* Declared with fallback == true */
1530 if (status != PSA_ERROR_NOT_SUPPORTED)
1531 return (status);
1532 #endif /* PSA_CRYPTO_DRIVER_TEST */
1533 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
1534
1535 /* Fell through, meaning no accelerator supports this operation */
1536 operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID;
1537 status = mbedtls_psa_aead_encrypt_setup(&operation->ctx.mbedtls_ctx, attributes, key_buffer,
1538 key_buffer_size, alg);
1539
1540 return (status);
1541
1542 /* Add cases for opaque driver here */
1543
1544 default:
1545 /* Key is declared with a lifetime not known to us */
1546 (void)status;
1547 return (PSA_ERROR_INVALID_ARGUMENT);
1548 }
1549 }
1550
psa_driver_wrapper_aead_decrypt_setup(psa_aead_operation_t * operation,const psa_key_attributes_t * attributes,const uint8_t * key_buffer,size_t key_buffer_size,psa_algorithm_t alg)1551 psa_status_t psa_driver_wrapper_aead_decrypt_setup(psa_aead_operation_t *operation,
1552 const psa_key_attributes_t *attributes, const uint8_t *key_buffer,
1553 size_t key_buffer_size, psa_algorithm_t alg)
1554 {
1555 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
1556 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes));
1557
1558 switch (location) {
1559 case PSA_KEY_LOCATION_LOCAL_STORAGE:
1560 /* Key is stored in the slot in export representation, so
1561 * cycle through all known transparent accelerators */
1562
1563 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
1564 #if defined(PSA_CRYPTO_DRIVER_TEST)
1565 operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID;
1566 status = mbedtls_test_transparent_aead_decrypt_setup(&operation->ctx.transparent_test_driver_ctx,
1567 attributes, key_buffer, key_buffer_size, alg);
1568
1569 /* Declared with fallback == true */
1570 if (status != PSA_ERROR_NOT_SUPPORTED)
1571 return (status);
1572 #endif /* PSA_CRYPTO_DRIVER_TEST */
1573 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
1574
1575 /* Fell through, meaning no accelerator supports this operation */
1576 operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID;
1577 status = mbedtls_psa_aead_decrypt_setup(&operation->ctx.mbedtls_ctx, attributes, key_buffer,
1578 key_buffer_size, alg);
1579
1580 return (status);
1581
1582 /* Add cases for opaque driver here */
1583
1584 default:
1585 /* Key is declared with a lifetime not known to us */
1586 (void)status;
1587 return (PSA_ERROR_INVALID_ARGUMENT);
1588 }
1589 }
1590
psa_driver_wrapper_aead_set_nonce(psa_aead_operation_t * operation,const uint8_t * nonce,size_t nonce_length)1591 psa_status_t psa_driver_wrapper_aead_set_nonce(psa_aead_operation_t *operation, const uint8_t *nonce,
1592 size_t nonce_length)
1593 {
1594 switch (operation->id) {
1595 #if defined(MBEDTLS_PSA_BUILTIN_AEAD)
1596 case PSA_CRYPTO_MBED_TLS_DRIVER_ID:
1597 return (mbedtls_psa_aead_set_nonce(&operation->ctx.mbedtls_ctx, nonce, nonce_length));
1598
1599 #endif /* MBEDTLS_PSA_BUILTIN_AEAD */
1600
1601 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
1602 #if defined(PSA_CRYPTO_DRIVER_TEST)
1603 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID:
1604 return (mbedtls_test_transparent_aead_set_nonce(&operation->ctx.transparent_test_driver_ctx, nonce,
1605 nonce_length));
1606
1607 /* Add cases for opaque driver here */
1608
1609 #endif /* PSA_CRYPTO_DRIVER_TEST */
1610 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
1611 }
1612
1613 (void)nonce;
1614 (void)nonce_length;
1615
1616 return (PSA_ERROR_INVALID_ARGUMENT);
1617 }
1618
psa_driver_wrapper_aead_set_lengths(psa_aead_operation_t * operation,size_t ad_length,size_t plaintext_length)1619 psa_status_t psa_driver_wrapper_aead_set_lengths(psa_aead_operation_t *operation, size_t ad_length,
1620 size_t plaintext_length)
1621 {
1622 switch (operation->id) {
1623 #if defined(MBEDTLS_PSA_BUILTIN_AEAD)
1624 case PSA_CRYPTO_MBED_TLS_DRIVER_ID:
1625 return (mbedtls_psa_aead_set_lengths(&operation->ctx.mbedtls_ctx, ad_length, plaintext_length));
1626
1627 #endif /* MBEDTLS_PSA_BUILTIN_AEAD */
1628
1629 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
1630 #if defined(PSA_CRYPTO_DRIVER_TEST)
1631 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID:
1632 return (mbedtls_test_transparent_aead_set_lengths(&operation->ctx.transparent_test_driver_ctx, ad_length,
1633 plaintext_length));
1634
1635 /* Add cases for opaque driver here */
1636
1637 #endif /* PSA_CRYPTO_DRIVER_TEST */
1638 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
1639 }
1640
1641 (void)ad_length;
1642 (void)plaintext_length;
1643
1644 return (PSA_ERROR_INVALID_ARGUMENT);
1645 }
1646
psa_driver_wrapper_aead_update_ad(psa_aead_operation_t * operation,const uint8_t * input,size_t input_length)1647 psa_status_t psa_driver_wrapper_aead_update_ad(psa_aead_operation_t *operation, const uint8_t *input,
1648 size_t input_length)
1649 {
1650 switch (operation->id) {
1651 #if defined(MBEDTLS_PSA_BUILTIN_AEAD)
1652 case PSA_CRYPTO_MBED_TLS_DRIVER_ID:
1653 return (mbedtls_psa_aead_update_ad(&operation->ctx.mbedtls_ctx, input, input_length));
1654
1655 #endif /* MBEDTLS_PSA_BUILTIN_AEAD */
1656
1657 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
1658 #if defined(PSA_CRYPTO_DRIVER_TEST)
1659 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID:
1660 return (mbedtls_test_transparent_aead_update_ad(&operation->ctx.transparent_test_driver_ctx, input,
1661 input_length));
1662
1663 /* Add cases for opaque driver here */
1664
1665 #endif /* PSA_CRYPTO_DRIVER_TEST */
1666 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
1667 }
1668
1669 (void)input;
1670 (void)input_length;
1671
1672 return (PSA_ERROR_INVALID_ARGUMENT);
1673 }
1674
psa_driver_wrapper_aead_update(psa_aead_operation_t * operation,const uint8_t * input,size_t input_length,uint8_t * output,size_t output_size,size_t * output_length)1675 psa_status_t psa_driver_wrapper_aead_update(psa_aead_operation_t *operation, const uint8_t *input, size_t input_length,
1676 uint8_t *output, size_t output_size, size_t *output_length)
1677 {
1678 switch (operation->id) {
1679 #if defined(MBEDTLS_PSA_BUILTIN_AEAD)
1680 case PSA_CRYPTO_MBED_TLS_DRIVER_ID:
1681 return (mbedtls_psa_aead_update(&operation->ctx.mbedtls_ctx, input, input_length, output, output_size,
1682 output_length));
1683
1684 #endif /* MBEDTLS_PSA_BUILTIN_AEAD */
1685
1686 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
1687 #if defined(PSA_CRYPTO_DRIVER_TEST)
1688 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID:
1689 return (mbedtls_test_transparent_aead_update(&operation->ctx.transparent_test_driver_ctx, input,
1690 input_length, output, output_size, output_length));
1691
1692 /* Add cases for opaque driver here */
1693
1694 #endif /* PSA_CRYPTO_DRIVER_TEST */
1695 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
1696 }
1697
1698 (void)input;
1699 (void)input_length;
1700 (void)output;
1701 (void)output_size;
1702 (void)output_length;
1703
1704 return (PSA_ERROR_INVALID_ARGUMENT);
1705 }
1706
psa_driver_wrapper_aead_finish(psa_aead_operation_t * operation,uint8_t * ciphertext,size_t ciphertext_size,size_t * ciphertext_length,uint8_t * tag,size_t tag_size,size_t * tag_length)1707 psa_status_t psa_driver_wrapper_aead_finish(psa_aead_operation_t *operation, uint8_t *ciphertext,
1708 size_t ciphertext_size, size_t *ciphertext_length, uint8_t *tag,
1709 size_t tag_size, size_t *tag_length)
1710 {
1711 switch (operation->id) {
1712 #if defined(MBEDTLS_PSA_BUILTIN_AEAD)
1713 case PSA_CRYPTO_MBED_TLS_DRIVER_ID:
1714 return (mbedtls_psa_aead_finish(&operation->ctx.mbedtls_ctx, ciphertext, ciphertext_size, ciphertext_length,
1715 tag, tag_size, tag_length));
1716
1717 #endif /* MBEDTLS_PSA_BUILTIN_AEAD */
1718
1719 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
1720 #if defined(PSA_CRYPTO_DRIVER_TEST)
1721 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID:
1722 return (mbedtls_test_transparent_aead_finish(&operation->ctx.transparent_test_driver_ctx, ciphertext,
1723 ciphertext_size, ciphertext_length, tag, tag_size,
1724 tag_length));
1725
1726 /* Add cases for opaque driver here */
1727
1728 #endif /* PSA_CRYPTO_DRIVER_TEST */
1729 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
1730 }
1731
1732 (void)ciphertext;
1733 (void)ciphertext_size;
1734 (void)ciphertext_length;
1735 (void)tag;
1736 (void)tag_size;
1737 (void)tag_length;
1738
1739 return (PSA_ERROR_INVALID_ARGUMENT);
1740 }
1741
psa_driver_wrapper_aead_verify(psa_aead_operation_t * operation,uint8_t * plaintext,size_t plaintext_size,size_t * plaintext_length,const uint8_t * tag,size_t tag_length)1742 psa_status_t psa_driver_wrapper_aead_verify(psa_aead_operation_t *operation, uint8_t *plaintext, size_t plaintext_size,
1743 size_t *plaintext_length, const uint8_t *tag, size_t tag_length)
1744 {
1745 switch (operation->id) {
1746 #if defined(MBEDTLS_PSA_BUILTIN_AEAD)
1747 case PSA_CRYPTO_MBED_TLS_DRIVER_ID: {
1748 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
1749 uint8_t check_tag[PSA_AEAD_TAG_MAX_SIZE];
1750 size_t check_tag_length;
1751
1752 status = mbedtls_psa_aead_finish(&operation->ctx.mbedtls_ctx, plaintext, plaintext_size, plaintext_length,
1753 check_tag, sizeof(check_tag), &check_tag_length);
1754
1755 if (status == PSA_SUCCESS) {
1756 if (tag_length != check_tag_length || mbedtls_ct_memcmp(tag, check_tag, tag_length) != 0)
1757 status = PSA_ERROR_INVALID_SIGNATURE;
1758 }
1759
1760 mbedtls_platform_zeroize(check_tag, sizeof(check_tag));
1761
1762 return (status);
1763 }
1764
1765 #endif /* MBEDTLS_PSA_BUILTIN_AEAD */
1766
1767 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
1768 #if defined(PSA_CRYPTO_DRIVER_TEST)
1769 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID:
1770 return (mbedtls_test_transparent_aead_verify(&operation->ctx.transparent_test_driver_ctx, plaintext,
1771 plaintext_size, plaintext_length, tag, tag_length));
1772
1773 /* Add cases for opaque driver here */
1774
1775 #endif /* PSA_CRYPTO_DRIVER_TEST */
1776 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
1777 }
1778
1779 (void)plaintext;
1780 (void)plaintext_size;
1781 (void)plaintext_length;
1782 (void)tag;
1783 (void)tag_length;
1784
1785 return (PSA_ERROR_INVALID_ARGUMENT);
1786 }
1787
psa_driver_wrapper_aead_abort(psa_aead_operation_t * operation)1788 psa_status_t psa_driver_wrapper_aead_abort(psa_aead_operation_t *operation)
1789 {
1790 switch (operation->id) {
1791 #if defined(MBEDTLS_PSA_BUILTIN_AEAD)
1792 case PSA_CRYPTO_MBED_TLS_DRIVER_ID:
1793 return (mbedtls_psa_aead_abort(&operation->ctx.mbedtls_ctx));
1794
1795 #endif /* MBEDTLS_PSA_BUILTIN_AEAD */
1796
1797 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
1798 #if defined(PSA_CRYPTO_DRIVER_TEST)
1799 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID:
1800 return (mbedtls_test_transparent_aead_abort(&operation->ctx.transparent_test_driver_ctx));
1801
1802 /* Add cases for opaque driver here */
1803
1804 #endif /* PSA_CRYPTO_DRIVER_TEST */
1805 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
1806 }
1807
1808 return (PSA_ERROR_INVALID_ARGUMENT);
1809 }
1810
1811 /*
1812 * MAC functions
1813 */
psa_driver_wrapper_mac_compute(const psa_key_attributes_t * attributes,const uint8_t * key_buffer,size_t key_buffer_size,psa_algorithm_t alg,const uint8_t * input,size_t input_length,uint8_t * mac,size_t mac_size,size_t * mac_length)1814 psa_status_t psa_driver_wrapper_mac_compute(const psa_key_attributes_t *attributes, const uint8_t *key_buffer,
1815 size_t key_buffer_size, psa_algorithm_t alg, const uint8_t *input,
1816 size_t input_length, uint8_t *mac, size_t mac_size, size_t *mac_length)
1817 {
1818 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
1819 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes));
1820
1821 switch (location) {
1822 case PSA_KEY_LOCATION_LOCAL_STORAGE:
1823 /* Key is stored in the slot in export representation, so
1824 * cycle through all known transparent accelerators */
1825 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
1826 #if defined(PSA_CRYPTO_DRIVER_TEST)
1827 status = mbedtls_test_transparent_mac_compute(attributes, key_buffer, key_buffer_size, alg, input,
1828 input_length, mac, mac_size, mac_length);
1829 /* Declared with fallback == true */
1830 if (status != PSA_ERROR_NOT_SUPPORTED)
1831 return (status);
1832 #endif /* PSA_CRYPTO_DRIVER_TEST */
1833 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
1834 #if defined(MBEDTLS_PSA_BUILTIN_MAC)
1835 /* Fell through, meaning no accelerator supports this operation */
1836 status = mbedtls_psa_mac_compute(attributes, key_buffer, key_buffer_size, alg, input, input_length, mac,
1837 mac_size, mac_length);
1838 if (status != PSA_ERROR_NOT_SUPPORTED)
1839 return (status);
1840 #endif /* MBEDTLS_PSA_BUILTIN_MAC */
1841 return (PSA_ERROR_NOT_SUPPORTED);
1842
1843 /* Add cases for opaque driver here */
1844 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
1845 #if defined(PSA_CRYPTO_DRIVER_TEST)
1846 case PSA_CRYPTO_TEST_DRIVER_LOCATION:
1847 status = mbedtls_test_opaque_mac_compute(attributes, key_buffer, key_buffer_size, alg, input, input_length,
1848 mac, mac_size, mac_length);
1849 return (status);
1850 #endif /* PSA_CRYPTO_DRIVER_TEST */
1851 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
1852 default:
1853 /* Key is declared with a lifetime not known to us */
1854 (void)key_buffer;
1855 (void)key_buffer_size;
1856 (void)alg;
1857 (void)input;
1858 (void)input_length;
1859 (void)mac;
1860 (void)mac_size;
1861 (void)mac_length;
1862 (void)status;
1863 return (PSA_ERROR_INVALID_ARGUMENT);
1864 }
1865 }
1866
psa_driver_wrapper_mac_sign_setup(psa_mac_operation_t * operation,const psa_key_attributes_t * attributes,const uint8_t * key_buffer,size_t key_buffer_size,psa_algorithm_t alg)1867 psa_status_t psa_driver_wrapper_mac_sign_setup(psa_mac_operation_t *operation, const psa_key_attributes_t *attributes,
1868 const uint8_t *key_buffer, size_t key_buffer_size, psa_algorithm_t alg)
1869 {
1870 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
1871 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes));
1872
1873 switch (location) {
1874 case PSA_KEY_LOCATION_LOCAL_STORAGE:
1875 /* Key is stored in the slot in export representation, so
1876 * cycle through all known transparent accelerators */
1877 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
1878 #if defined(PSA_CRYPTO_DRIVER_TEST)
1879 status = mbedtls_test_transparent_mac_sign_setup(&operation->ctx.transparent_test_driver_ctx, attributes,
1880 key_buffer, key_buffer_size, alg);
1881 /* Declared with fallback == true */
1882 if (status == PSA_SUCCESS)
1883 operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID;
1884
1885 if (status != PSA_ERROR_NOT_SUPPORTED)
1886 return (status);
1887 #endif /* PSA_CRYPTO_DRIVER_TEST */
1888 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
1889 #if defined(MBEDTLS_PSA_BUILTIN_MAC)
1890 /* Fell through, meaning no accelerator supports this operation */
1891 status =
1892 mbedtls_psa_mac_sign_setup(&operation->ctx.mbedtls_ctx, attributes, key_buffer, key_buffer_size, alg);
1893 if (status == PSA_SUCCESS)
1894 operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID;
1895
1896 if (status != PSA_ERROR_NOT_SUPPORTED)
1897 return (status);
1898 #endif /* MBEDTLS_PSA_BUILTIN_MAC */
1899 return (PSA_ERROR_NOT_SUPPORTED);
1900
1901 /* Add cases for opaque driver here */
1902 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
1903 #if defined(PSA_CRYPTO_DRIVER_TEST)
1904 case PSA_CRYPTO_TEST_DRIVER_LOCATION:
1905 status = mbedtls_test_opaque_mac_sign_setup(&operation->ctx.opaque_test_driver_ctx, attributes, key_buffer,
1906 key_buffer_size, alg);
1907
1908 if (status == PSA_SUCCESS)
1909 operation->id = MBEDTLS_TEST_OPAQUE_DRIVER_ID;
1910
1911 return (status);
1912 #endif /* PSA_CRYPTO_DRIVER_TEST */
1913 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
1914 default:
1915 /* Key is declared with a lifetime not known to us */
1916 (void)status;
1917 (void)operation;
1918 (void)key_buffer;
1919 (void)key_buffer_size;
1920 (void)alg;
1921 return (PSA_ERROR_INVALID_ARGUMENT);
1922 }
1923 }
1924
psa_driver_wrapper_mac_verify_setup(psa_mac_operation_t * operation,const psa_key_attributes_t * attributes,const uint8_t * key_buffer,size_t key_buffer_size,psa_algorithm_t alg)1925 psa_status_t psa_driver_wrapper_mac_verify_setup(psa_mac_operation_t *operation, const psa_key_attributes_t *attributes,
1926 const uint8_t *key_buffer, size_t key_buffer_size, psa_algorithm_t alg)
1927 {
1928 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
1929 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes));
1930
1931 switch (location) {
1932 case PSA_KEY_LOCATION_LOCAL_STORAGE:
1933 /* Key is stored in the slot in export representation, so
1934 * cycle through all known transparent accelerators */
1935 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
1936 #if defined(PSA_CRYPTO_DRIVER_TEST)
1937 status = mbedtls_test_transparent_mac_verify_setup(&operation->ctx.transparent_test_driver_ctx, attributes,
1938 key_buffer, key_buffer_size, alg);
1939 /* Declared with fallback == true */
1940 if (status == PSA_SUCCESS)
1941 operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID;
1942
1943 if (status != PSA_ERROR_NOT_SUPPORTED)
1944 return (status);
1945 #endif /* PSA_CRYPTO_DRIVER_TEST */
1946 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
1947 #if defined(MBEDTLS_PSA_BUILTIN_MAC)
1948 /* Fell through, meaning no accelerator supports this operation */
1949 status =
1950 mbedtls_psa_mac_verify_setup(&operation->ctx.mbedtls_ctx, attributes, key_buffer, key_buffer_size, alg);
1951 if (status == PSA_SUCCESS)
1952 operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID;
1953
1954 if (status != PSA_ERROR_NOT_SUPPORTED)
1955 return (status);
1956 #endif /* MBEDTLS_PSA_BUILTIN_MAC */
1957 return (PSA_ERROR_NOT_SUPPORTED);
1958
1959 /* Add cases for opaque driver here */
1960 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
1961 #if defined(PSA_CRYPTO_DRIVER_TEST)
1962 case PSA_CRYPTO_TEST_DRIVER_LOCATION:
1963 status = mbedtls_test_opaque_mac_verify_setup(&operation->ctx.opaque_test_driver_ctx, attributes,
1964 key_buffer, key_buffer_size, alg);
1965
1966 if (status == PSA_SUCCESS)
1967 operation->id = MBEDTLS_TEST_OPAQUE_DRIVER_ID;
1968
1969 return (status);
1970 #endif /* PSA_CRYPTO_DRIVER_TEST */
1971 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
1972 default:
1973 /* Key is declared with a lifetime not known to us */
1974 (void)status;
1975 (void)operation;
1976 (void)key_buffer;
1977 (void)key_buffer_size;
1978 (void)alg;
1979 return (PSA_ERROR_INVALID_ARGUMENT);
1980 }
1981 }
1982
psa_driver_wrapper_mac_update(psa_mac_operation_t * operation,const uint8_t * input,size_t input_length)1983 psa_status_t psa_driver_wrapper_mac_update(psa_mac_operation_t *operation, const uint8_t *input, size_t input_length)
1984 {
1985 switch (operation->id) {
1986 #if defined(MBEDTLS_PSA_BUILTIN_MAC)
1987 case PSA_CRYPTO_MBED_TLS_DRIVER_ID:
1988 return (mbedtls_psa_mac_update(&operation->ctx.mbedtls_ctx, input, input_length));
1989 #endif /* MBEDTLS_PSA_BUILTIN_MAC */
1990
1991 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
1992 #if defined(PSA_CRYPTO_DRIVER_TEST)
1993 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID:
1994 return (
1995 mbedtls_test_transparent_mac_update(&operation->ctx.transparent_test_driver_ctx, input, input_length));
1996
1997 case MBEDTLS_TEST_OPAQUE_DRIVER_ID:
1998 return (mbedtls_test_opaque_mac_update(&operation->ctx.opaque_test_driver_ctx, input, input_length));
1999 #endif /* PSA_CRYPTO_DRIVER_TEST */
2000 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
2001 default:
2002 (void)input;
2003 (void)input_length;
2004 return (PSA_ERROR_INVALID_ARGUMENT);
2005 }
2006 }
2007
psa_driver_wrapper_mac_sign_finish(psa_mac_operation_t * operation,uint8_t * mac,size_t mac_size,size_t * mac_length)2008 psa_status_t psa_driver_wrapper_mac_sign_finish(psa_mac_operation_t *operation, uint8_t *mac, size_t mac_size,
2009 size_t *mac_length)
2010 {
2011 switch (operation->id) {
2012 #if defined(MBEDTLS_PSA_BUILTIN_MAC)
2013 case PSA_CRYPTO_MBED_TLS_DRIVER_ID:
2014 return (mbedtls_psa_mac_sign_finish(&operation->ctx.mbedtls_ctx, mac, mac_size, mac_length));
2015 #endif /* MBEDTLS_PSA_BUILTIN_MAC */
2016
2017 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
2018 #if defined(PSA_CRYPTO_DRIVER_TEST)
2019 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID:
2020 return (mbedtls_test_transparent_mac_sign_finish(&operation->ctx.transparent_test_driver_ctx, mac, mac_size,
2021 mac_length));
2022
2023 case MBEDTLS_TEST_OPAQUE_DRIVER_ID:
2024 return (
2025 mbedtls_test_opaque_mac_sign_finish(&operation->ctx.opaque_test_driver_ctx, mac, mac_size, mac_length));
2026 #endif /* PSA_CRYPTO_DRIVER_TEST */
2027 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
2028 default:
2029 (void)mac;
2030 (void)mac_size;
2031 (void)mac_length;
2032 return (PSA_ERROR_INVALID_ARGUMENT);
2033 }
2034 }
2035
psa_driver_wrapper_mac_verify_finish(psa_mac_operation_t * operation,const uint8_t * mac,size_t mac_length)2036 psa_status_t psa_driver_wrapper_mac_verify_finish(psa_mac_operation_t *operation, const uint8_t *mac, size_t mac_length)
2037 {
2038 switch (operation->id) {
2039 #if defined(MBEDTLS_PSA_BUILTIN_MAC)
2040 case PSA_CRYPTO_MBED_TLS_DRIVER_ID:
2041 return (mbedtls_psa_mac_verify_finish(&operation->ctx.mbedtls_ctx, mac, mac_length));
2042 #endif /* MBEDTLS_PSA_BUILTIN_MAC */
2043
2044 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
2045 #if defined(PSA_CRYPTO_DRIVER_TEST)
2046 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID:
2047 return (mbedtls_test_transparent_mac_verify_finish(&operation->ctx.transparent_test_driver_ctx, mac,
2048 mac_length));
2049
2050 case MBEDTLS_TEST_OPAQUE_DRIVER_ID:
2051 return (mbedtls_test_opaque_mac_verify_finish(&operation->ctx.opaque_test_driver_ctx, mac, mac_length));
2052 #endif /* PSA_CRYPTO_DRIVER_TEST */
2053 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
2054 default:
2055 (void)mac;
2056 (void)mac_length;
2057 return (PSA_ERROR_INVALID_ARGUMENT);
2058 }
2059 }
2060
psa_driver_wrapper_mac_abort(psa_mac_operation_t * operation)2061 psa_status_t psa_driver_wrapper_mac_abort(psa_mac_operation_t *operation)
2062 {
2063 switch (operation->id) {
2064 #if defined(MBEDTLS_PSA_BUILTIN_MAC)
2065 case PSA_CRYPTO_MBED_TLS_DRIVER_ID:
2066 return (mbedtls_psa_mac_abort(&operation->ctx.mbedtls_ctx));
2067 #endif /* MBEDTLS_PSA_BUILTIN_MAC */
2068
2069 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
2070 #if defined(PSA_CRYPTO_DRIVER_TEST)
2071 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID:
2072 return (mbedtls_test_transparent_mac_abort(&operation->ctx.transparent_test_driver_ctx));
2073 case MBEDTLS_TEST_OPAQUE_DRIVER_ID:
2074 return (mbedtls_test_opaque_mac_abort(&operation->ctx.opaque_test_driver_ctx));
2075 #endif /* PSA_CRYPTO_DRIVER_TEST */
2076 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
2077 default:
2078 return (PSA_ERROR_INVALID_ARGUMENT);
2079 }
2080 }
2081
2082 /*
2083 * Asymmetric cryptography
2084 */
psa_driver_wrapper_asymmetric_encrypt(const psa_key_attributes_t * attributes,const uint8_t * key_buffer,size_t key_buffer_size,psa_algorithm_t alg,const uint8_t * input,size_t input_length,const uint8_t * salt,size_t salt_length,uint8_t * output,size_t output_size,size_t * output_length)2085 psa_status_t psa_driver_wrapper_asymmetric_encrypt(const psa_key_attributes_t *attributes, const uint8_t *key_buffer,
2086 size_t key_buffer_size, psa_algorithm_t alg, const uint8_t *input,
2087 size_t input_length, const uint8_t *salt, size_t salt_length,
2088 uint8_t *output, size_t output_size, size_t *output_length)
2089 {
2090 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2091 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes));
2092
2093 switch (location) {
2094 case PSA_KEY_LOCATION_LOCAL_STORAGE:
2095 /* Key is stored in the slot in export representation, so
2096 * cycle through all known transparent accelerators */
2097 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
2098 #if defined(PSA_CRYPTO_DRIVER_TEST)
2099 status = mbedtls_test_transparent_asymmetric_encrypt(attributes, key_buffer, key_buffer_size, alg, input,
2100 input_length, salt, salt_length, output, output_size,
2101 output_length);
2102 /* Declared with fallback == true */
2103 if (status != PSA_ERROR_NOT_SUPPORTED)
2104 return (status);
2105 #endif /* PSA_CRYPTO_DRIVER_TEST */
2106 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
2107 return (mbedtls_psa_asymmetric_encrypt(attributes, key_buffer, key_buffer_size, alg, input, input_length,
2108 salt, salt_length, output, output_size, output_length));
2109 /* Add cases for opaque driver here */
2110 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
2111 #if defined(PSA_CRYPTO_DRIVER_TEST)
2112 case PSA_CRYPTO_TEST_DRIVER_LOCATION:
2113 return (mbedtls_test_opaque_asymmetric_encrypt(attributes, key_buffer, key_buffer_size, alg, input,
2114 input_length, salt, salt_length, output, output_size,
2115 output_length));
2116 #endif /* PSA_CRYPTO_DRIVER_TEST */
2117 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
2118
2119 default:
2120 /* Key is declared with a lifetime not known to us */
2121 (void)status;
2122 (void)key_buffer;
2123 (void)key_buffer_size;
2124 (void)alg;
2125 (void)input;
2126 (void)input_length;
2127 (void)salt;
2128 (void)salt_length;
2129 (void)output;
2130 (void)output_size;
2131 (void)output_length;
2132 return (PSA_ERROR_INVALID_ARGUMENT);
2133 }
2134 }
2135
psa_driver_wrapper_asymmetric_decrypt(const psa_key_attributes_t * attributes,const uint8_t * key_buffer,size_t key_buffer_size,psa_algorithm_t alg,const uint8_t * input,size_t input_length,const uint8_t * salt,size_t salt_length,uint8_t * output,size_t output_size,size_t * output_length)2136 psa_status_t psa_driver_wrapper_asymmetric_decrypt(const psa_key_attributes_t *attributes, const uint8_t *key_buffer,
2137 size_t key_buffer_size, psa_algorithm_t alg, const uint8_t *input,
2138 size_t input_length, const uint8_t *salt, size_t salt_length,
2139 uint8_t *output, size_t output_size, size_t *output_length)
2140 {
2141 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2142 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes));
2143
2144 switch (location) {
2145 case PSA_KEY_LOCATION_LOCAL_STORAGE:
2146 /* Key is stored in the slot in export representation, so
2147 * cycle through all known transparent accelerators */
2148 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
2149 #if defined(PSA_CRYPTO_DRIVER_TEST)
2150 status = mbedtls_test_transparent_asymmetric_decrypt(attributes, key_buffer, key_buffer_size, alg, input,
2151 input_length, salt, salt_length, output, output_size,
2152 output_length);
2153 /* Declared with fallback == true */
2154 if (status != PSA_ERROR_NOT_SUPPORTED)
2155 return (status);
2156 #endif /* PSA_CRYPTO_DRIVER_TEST */
2157 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
2158 return (mbedtls_psa_asymmetric_decrypt(attributes, key_buffer, key_buffer_size, alg, input, input_length,
2159 salt, salt_length, output, output_size, output_length));
2160 /* Add cases for opaque driver here */
2161 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
2162 #if defined(PSA_CRYPTO_DRIVER_TEST)
2163 case PSA_CRYPTO_TEST_DRIVER_LOCATION:
2164 return (mbedtls_test_opaque_asymmetric_decrypt(attributes, key_buffer, key_buffer_size, alg, input,
2165 input_length, salt, salt_length, output, output_size,
2166 output_length));
2167 #endif /* PSA_CRYPTO_DRIVER_TEST */
2168 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
2169
2170 default:
2171 /* Key is declared with a lifetime not known to us */
2172 (void)status;
2173 (void)key_buffer;
2174 (void)key_buffer_size;
2175 (void)alg;
2176 (void)input;
2177 (void)input_length;
2178 (void)salt;
2179 (void)salt_length;
2180 (void)output;
2181 (void)output_size;
2182 (void)output_length;
2183 return (PSA_ERROR_INVALID_ARGUMENT);
2184 }
2185 }
2186
psa_driver_wrapper_key_agreement(const psa_key_attributes_t * attributes,const uint8_t * key_buffer,size_t key_buffer_size,psa_algorithm_t alg,const uint8_t * peer_key,size_t peer_key_length,uint8_t * shared_secret,size_t shared_secret_size,size_t * shared_secret_length)2187 psa_status_t psa_driver_wrapper_key_agreement(const psa_key_attributes_t *attributes, const uint8_t *key_buffer,
2188 size_t key_buffer_size, psa_algorithm_t alg, const uint8_t *peer_key,
2189 size_t peer_key_length, uint8_t *shared_secret, size_t shared_secret_size,
2190 size_t *shared_secret_length)
2191 {
2192 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2193 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes));
2194
2195 switch (location) {
2196 case PSA_KEY_LOCATION_LOCAL_STORAGE:
2197 /* Key is stored in the slot in export representation, so
2198 * cycle through all known transparent accelerators */
2199 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
2200 #if defined(PSA_CRYPTO_DRIVER_TEST)
2201 status = mbedtls_test_transparent_key_agreement(attributes, key_buffer, key_buffer_size, alg, peer_key,
2202 peer_key_length, shared_secret, shared_secret_size,
2203 shared_secret_length);
2204 if (status != PSA_ERROR_NOT_SUPPORTED)
2205 return (status);
2206 #endif /* PSA_CRYPTO_DRIVER_TEST */
2207 #if defined(MBEDTLS_PSA_P256M_DRIVER_ENABLED)
2208 if (PSA_KEY_TYPE_IS_ECC(psa_get_key_type(attributes)) && PSA_ALG_IS_ECDH(alg) &&
2209 PSA_KEY_TYPE_ECC_GET_FAMILY(psa_get_key_type(attributes)) == PSA_ECC_FAMILY_SECP_R1 &&
2210 psa_get_key_bits(attributes) == 256) {
2211 status = p256_transparent_key_agreement(attributes, key_buffer, key_buffer_size, alg, peer_key,
2212 peer_key_length, shared_secret, shared_secret_size,
2213 shared_secret_length);
2214 if (status != PSA_ERROR_NOT_SUPPORTED)
2215 return (status);
2216 }
2217 #endif /* MBEDTLS_PSA_P256M_DRIVER_ENABLED */
2218 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
2219
2220 /* Software Fallback */
2221 status =
2222 psa_key_agreement_raw_builtin(attributes, key_buffer, key_buffer_size, alg, peer_key, peer_key_length,
2223 shared_secret, shared_secret_size, shared_secret_length);
2224 return (status);
2225 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
2226 #if defined(PSA_CRYPTO_DRIVER_TEST)
2227 case PSA_CRYPTO_TEST_DRIVER_LOCATION:
2228 return (mbedtls_test_opaque_key_agreement(attributes, key_buffer, key_buffer_size, alg, peer_key,
2229 peer_key_length, shared_secret, shared_secret_size,
2230 shared_secret_length));
2231 #endif /* PSA_CRYPTO_DRIVER_TEST */
2232 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
2233
2234 default:
2235 (void)attributes;
2236 (void)key_buffer;
2237 (void)key_buffer_size;
2238 (void)peer_key;
2239 (void)peer_key_length;
2240 (void)shared_secret;
2241 (void)shared_secret_size;
2242 (void)shared_secret_length;
2243 return (PSA_ERROR_NOT_SUPPORTED);
2244 }
2245 }
2246
psa_driver_wrapper_pake_setup(psa_pake_operation_t * operation,const psa_crypto_driver_pake_inputs_t * inputs)2247 psa_status_t psa_driver_wrapper_pake_setup(psa_pake_operation_t *operation,
2248 const psa_crypto_driver_pake_inputs_t *inputs)
2249 {
2250 psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
2251
2252 psa_key_location_t location = PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(&inputs->attributes));
2253
2254 switch (location) {
2255 case PSA_KEY_LOCATION_LOCAL_STORAGE:
2256 /* Key is stored in the slot in export representation, so
2257 * cycle through all known transparent accelerators */
2258 status = PSA_ERROR_NOT_SUPPORTED;
2259 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
2260 #if defined(PSA_CRYPTO_DRIVER_TEST)
2261 status = mbedtls_test_transparent_pake_setup(&operation->data.ctx.transparent_test_driver_ctx, inputs);
2262 if (status == PSA_SUCCESS)
2263 operation->id = MBEDTLS_TEST_TRANSPARENT_DRIVER_ID;
2264 /* Declared with fallback == true */
2265 if (status != PSA_ERROR_NOT_SUPPORTED)
2266 return (status);
2267 #endif /* PSA_CRYPTO_DRIVER_TEST */
2268 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
2269 #if defined(MBEDTLS_PSA_BUILTIN_PAKE)
2270 status = mbedtls_psa_pake_setup(&operation->data.ctx.mbedtls_ctx, inputs);
2271 if (status == PSA_SUCCESS)
2272 operation->id = PSA_CRYPTO_MBED_TLS_DRIVER_ID;
2273 #endif
2274 return status;
2275 /* Add cases for opaque driver here */
2276 default:
2277 /* Key is declared with a lifetime not known to us */
2278 (void)operation;
2279 return (PSA_ERROR_INVALID_ARGUMENT);
2280 }
2281 }
psa_driver_wrapper_pake_output(psa_pake_operation_t * operation,psa_crypto_driver_pake_step_t step,uint8_t * output,size_t output_size,size_t * output_length)2282 psa_status_t psa_driver_wrapper_pake_output(psa_pake_operation_t *operation, psa_crypto_driver_pake_step_t step,
2283 uint8_t *output, size_t output_size, size_t *output_length)
2284 {
2285 switch (operation->id) {
2286 #if defined(MBEDTLS_PSA_BUILTIN_PAKE)
2287 case PSA_CRYPTO_MBED_TLS_DRIVER_ID:
2288 return (
2289 mbedtls_psa_pake_output(&operation->data.ctx.mbedtls_ctx, step, output, output_size, output_length));
2290 #endif /* MBEDTLS_PSA_BUILTIN_PAKE */
2291
2292 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
2293 #if defined(PSA_CRYPTO_DRIVER_TEST)
2294 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID:
2295 return (mbedtls_test_transparent_pake_output(&operation->data.ctx.transparent_test_driver_ctx, step, output,
2296 output_size, output_length));
2297 #endif /* PSA_CRYPTO_DRIVER_TEST */
2298 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
2299 default:
2300 (void)step;
2301 (void)output;
2302 (void)output_size;
2303 (void)output_length;
2304 return (PSA_ERROR_INVALID_ARGUMENT);
2305 }
2306 }
2307
psa_driver_wrapper_pake_input(psa_pake_operation_t * operation,psa_crypto_driver_pake_step_t step,const uint8_t * input,size_t input_length)2308 psa_status_t psa_driver_wrapper_pake_input(psa_pake_operation_t *operation, psa_crypto_driver_pake_step_t step,
2309 const uint8_t *input, size_t input_length)
2310 {
2311 switch (operation->id) {
2312 #if defined(MBEDTLS_PSA_BUILTIN_PAKE)
2313 case PSA_CRYPTO_MBED_TLS_DRIVER_ID:
2314 return (mbedtls_psa_pake_input(&operation->data.ctx.mbedtls_ctx, step, input, input_length));
2315 #endif /* MBEDTLS_PSA_BUILTIN_PAKE */
2316
2317 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
2318 #if defined(PSA_CRYPTO_DRIVER_TEST)
2319 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID:
2320 return (mbedtls_test_transparent_pake_input(&operation->data.ctx.transparent_test_driver_ctx, step, input,
2321 input_length));
2322 #endif /* PSA_CRYPTO_DRIVER_TEST */
2323 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
2324 default:
2325 (void)step;
2326 (void)input;
2327 (void)input_length;
2328 return (PSA_ERROR_INVALID_ARGUMENT);
2329 }
2330 }
2331
psa_driver_wrapper_pake_get_implicit_key(psa_pake_operation_t * operation,uint8_t * output,size_t output_size,size_t * output_length)2332 psa_status_t psa_driver_wrapper_pake_get_implicit_key(psa_pake_operation_t *operation, uint8_t *output,
2333 size_t output_size, size_t *output_length)
2334 {
2335 switch (operation->id) {
2336 #if defined(MBEDTLS_PSA_BUILTIN_PAKE)
2337 case PSA_CRYPTO_MBED_TLS_DRIVER_ID:
2338 return (mbedtls_psa_pake_get_implicit_key(&operation->data.ctx.mbedtls_ctx, output, output_size,
2339 output_length));
2340 #endif /* MBEDTLS_PSA_BUILTIN_PAKE */
2341
2342 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
2343 #if defined(PSA_CRYPTO_DRIVER_TEST)
2344 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID:
2345 return (mbedtls_test_transparent_pake_get_implicit_key(&operation->data.ctx.transparent_test_driver_ctx,
2346 output, output_size, output_length));
2347 #endif /* PSA_CRYPTO_DRIVER_TEST */
2348 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
2349 default:
2350 (void)output;
2351 (void)output_size;
2352 (void)output_length;
2353 return (PSA_ERROR_INVALID_ARGUMENT);
2354 }
2355 }
2356
psa_driver_wrapper_pake_abort(psa_pake_operation_t * operation)2357 psa_status_t psa_driver_wrapper_pake_abort(psa_pake_operation_t *operation)
2358 {
2359 switch (operation->id) {
2360 #if defined(MBEDTLS_PSA_BUILTIN_PAKE)
2361 case PSA_CRYPTO_MBED_TLS_DRIVER_ID:
2362 return (mbedtls_psa_pake_abort(&operation->data.ctx.mbedtls_ctx));
2363 #endif /* MBEDTLS_PSA_BUILTIN_PAKE */
2364
2365 #if defined(PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT)
2366 #if defined(PSA_CRYPTO_DRIVER_TEST)
2367 case MBEDTLS_TEST_TRANSPARENT_DRIVER_ID:
2368 return (mbedtls_test_transparent_pake_abort(&operation->data.ctx.transparent_test_driver_ctx));
2369 #endif /* PSA_CRYPTO_DRIVER_TEST */
2370 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
2371 default:
2372 return (PSA_ERROR_INVALID_ARGUMENT);
2373 }
2374 }
2375
2376 #endif /* MBEDTLS_PSA_CRYPTO_C */
2377