1/* BEGIN_HEADER */ 2#include <stdint.h> 3 4#include "psa/crypto.h" 5 6typedef enum 7{ 8 ERR_NONE = 0, 9 /* errors forced internally in the code */ 10 ERR_INJECT_UNINITIALIZED_ACCESS, 11 ERR_INJECT_DUPLICATE_SETUP, 12 ERR_INJECT_INVALID_USER, 13 ERR_INJECT_INVALID_PEER, 14 ERR_INJECT_SET_USER, 15 ERR_INJECT_SET_PEER, 16 ERR_INJECT_EMPTY_IO_BUFFER, 17 ERR_INJECT_UNKNOWN_STEP, 18 ERR_INJECT_INVALID_FIRST_STEP, 19 ERR_INJECT_WRONG_BUFFER_SIZE, 20 ERR_INJECT_VALID_OPERATION_AFTER_FAILURE, 21 ERR_INJECT_ANTICIPATE_KEY_DERIVATION_1, 22 ERR_INJECT_ANTICIPATE_KEY_DERIVATION_2, 23 ERR_INJECT_ROUND1_CLIENT_KEY_SHARE_PART1, 24 ERR_INJECT_ROUND1_CLIENT_ZK_PUBLIC_PART1, 25 ERR_INJECT_ROUND1_CLIENT_ZK_PROOF_PART1, 26 ERR_INJECT_ROUND1_CLIENT_KEY_SHARE_PART2, 27 ERR_INJECT_ROUND1_CLIENT_ZK_PUBLIC_PART2, 28 ERR_INJECT_ROUND1_CLIENT_ZK_PROOF_PART2, 29 ERR_INJECT_ROUND2_CLIENT_KEY_SHARE, 30 ERR_INJECT_ROUND2_CLIENT_ZK_PUBLIC, 31 ERR_INJECT_ROUND2_CLIENT_ZK_PROOF, 32 ERR_INJECT_ROUND1_SERVER_KEY_SHARE_PART1, 33 ERR_INJECT_ROUND1_SERVER_ZK_PUBLIC_PART1, 34 ERR_INJECT_ROUND1_SERVER_ZK_PROOF_PART1, 35 ERR_INJECT_ROUND1_SERVER_KEY_SHARE_PART2, 36 ERR_INJECT_ROUND1_SERVER_ZK_PUBLIC_PART2, 37 ERR_INJECT_ROUND1_SERVER_ZK_PROOF_PART2, 38 ERR_INJECT_ROUND2_SERVER_KEY_SHARE, 39 ERR_INJECT_ROUND2_SERVER_ZK_PUBLIC, 40 ERR_INJECT_ROUND2_SERVER_ZK_PROOF, 41 /* erros issued from the .data file */ 42 ERR_IN_SETUP, 43 ERR_IN_SET_ROLE, 44 ERR_IN_SET_PASSWORD_KEY, 45 ERR_IN_INPUT, 46 ERR_IN_OUTPUT, 47} ecjpake_error_stage_t; 48 49typedef enum 50{ 51 PAKE_ROUND_ONE, 52 PAKE_ROUND_TWO 53} pake_round_t; 54 55/* 56 * Inject an error on the specified buffer ONLY it this is the correct stage. 57 * Offset 7 is arbitrary, but chosen because it's "in the middle" of the part 58 * we're corrupting. 59 */ 60#define DO_ROUND_CONDITIONAL_INJECT( this_stage, buf ) \ 61 if ( this_stage == err_stage ) \ 62 { \ 63 *( buf + 7) ^= 1; \ 64 } 65 66#define DO_ROUND_UPDATE_OFFSETS( main_buf_offset, step_offset, step_size ) \ 67 { \ 68 step_offset = main_buf_offset; \ 69 main_buf_offset += step_size; \ 70 } 71 72#define DO_ROUND_CHECK_FAILURE( ) \ 73 if( err_stage != ERR_NONE && status != PSA_SUCCESS ) \ 74 { \ 75 TEST_EQUAL( status, expected_error_arg ); \ 76 break; \ 77 } \ 78 else \ 79 { \ 80 TEST_EQUAL( status, PSA_SUCCESS ); \ 81 } 82 83#if defined(PSA_WANT_ALG_JPAKE) 84static void ecjpake_do_round( psa_algorithm_t alg, unsigned int primitive, 85 psa_pake_operation_t *server, 86 psa_pake_operation_t *client, 87 int client_input_first, 88 pake_round_t round, 89 ecjpake_error_stage_t err_stage, 90 int expected_error_arg ) 91{ 92 unsigned char *buffer0 = NULL, *buffer1 = NULL; 93 size_t buffer_length = ( 94 PSA_PAKE_OUTPUT_SIZE(alg, primitive, PSA_PAKE_STEP_KEY_SHARE) + 95 PSA_PAKE_OUTPUT_SIZE(alg, primitive, PSA_PAKE_STEP_ZK_PUBLIC) + 96 PSA_PAKE_OUTPUT_SIZE(alg, primitive, PSA_PAKE_STEP_ZK_PROOF)) * 2; 97 /* The output should be exactly this size according to the spec */ 98 const size_t expected_size_key_share = 99 PSA_PAKE_OUTPUT_SIZE(alg, primitive, PSA_PAKE_STEP_KEY_SHARE); 100 /* The output should be exactly this size according to the spec */ 101 const size_t expected_size_zk_public = 102 PSA_PAKE_OUTPUT_SIZE(alg, primitive, PSA_PAKE_STEP_ZK_PUBLIC); 103 /* The output can be smaller: the spec allows stripping leading zeroes */ 104 const size_t max_expected_size_zk_proof = 105 PSA_PAKE_OUTPUT_SIZE(alg, primitive, PSA_PAKE_STEP_ZK_PROOF); 106 size_t buffer0_off = 0; 107 size_t buffer1_off = 0; 108 size_t s_g1_len, s_g2_len, s_a_len; 109 size_t s_g1_off, s_g2_off, s_a_off; 110 size_t s_x1_pk_len, s_x2_pk_len, s_x2s_pk_len; 111 size_t s_x1_pk_off, s_x2_pk_off, s_x2s_pk_off; 112 size_t s_x1_pr_len, s_x2_pr_len, s_x2s_pr_len; 113 size_t s_x1_pr_off, s_x2_pr_off, s_x2s_pr_off; 114 size_t c_g1_len, c_g2_len, c_a_len; 115 size_t c_g1_off, c_g2_off, c_a_off; 116 size_t c_x1_pk_len, c_x2_pk_len, c_x2s_pk_len; 117 size_t c_x1_pk_off, c_x2_pk_off, c_x2s_pk_off; 118 size_t c_x1_pr_len, c_x2_pr_len, c_x2s_pr_len; 119 size_t c_x1_pr_off, c_x2_pr_off, c_x2s_pr_off; 120 psa_status_t status; 121 122 ASSERT_ALLOC( buffer0, buffer_length ); 123 ASSERT_ALLOC( buffer1, buffer_length ); 124 125 switch( round ) 126 { 127 case PAKE_ROUND_ONE: 128 /* Server first round Output */ 129 PSA_ASSERT( psa_pake_output( server, PSA_PAKE_STEP_KEY_SHARE, 130 buffer0 + buffer0_off, 131 512 - buffer0_off, &s_g1_len ) ); 132 TEST_EQUAL( s_g1_len, expected_size_key_share ); 133 DO_ROUND_CONDITIONAL_INJECT( 134 ERR_INJECT_ROUND1_SERVER_KEY_SHARE_PART1, 135 buffer0 + buffer0_off ); 136 DO_ROUND_UPDATE_OFFSETS( buffer0_off, s_g1_off, s_g1_len ); 137 138 PSA_ASSERT( psa_pake_output( server, PSA_PAKE_STEP_ZK_PUBLIC, 139 buffer0 + buffer0_off, 140 512 - buffer0_off, &s_x1_pk_len ) ); 141 TEST_EQUAL( s_x1_pk_len, expected_size_zk_public ); 142 DO_ROUND_CONDITIONAL_INJECT( 143 ERR_INJECT_ROUND1_SERVER_ZK_PUBLIC_PART1, 144 buffer0 + buffer0_off ); 145 DO_ROUND_UPDATE_OFFSETS( buffer0_off, s_x1_pk_off, s_x1_pk_len ); 146 147 PSA_ASSERT( psa_pake_output( server, PSA_PAKE_STEP_ZK_PROOF, 148 buffer0 + buffer0_off, 149 512 - buffer0_off, &s_x1_pr_len ) ); 150 TEST_LE_U( s_x1_pr_len, max_expected_size_zk_proof ); 151 DO_ROUND_CONDITIONAL_INJECT( 152 ERR_INJECT_ROUND1_SERVER_ZK_PROOF_PART1, 153 buffer0 + buffer0_off ); 154 DO_ROUND_UPDATE_OFFSETS( buffer0_off, s_x1_pr_off, s_x1_pr_len ); 155 156 PSA_ASSERT( psa_pake_output( server, PSA_PAKE_STEP_KEY_SHARE, 157 buffer0 + buffer0_off, 158 512 - buffer0_off, &s_g2_len ) ); 159 TEST_EQUAL( s_g2_len, expected_size_key_share ); 160 DO_ROUND_CONDITIONAL_INJECT( 161 ERR_INJECT_ROUND1_SERVER_KEY_SHARE_PART2, 162 buffer0 + buffer0_off ); 163 DO_ROUND_UPDATE_OFFSETS( buffer0_off, s_g2_off, s_g2_len ); 164 165 PSA_ASSERT( psa_pake_output( server, PSA_PAKE_STEP_ZK_PUBLIC, 166 buffer0 + buffer0_off, 167 512 - buffer0_off, &s_x2_pk_len ) ); 168 TEST_EQUAL( s_x2_pk_len, expected_size_zk_public ); 169 DO_ROUND_CONDITIONAL_INJECT( 170 ERR_INJECT_ROUND1_SERVER_ZK_PUBLIC_PART2, 171 buffer0 + buffer0_off ); 172 DO_ROUND_UPDATE_OFFSETS( buffer0_off, s_x2_pk_off, s_x2_pk_len ); 173 174 PSA_ASSERT( psa_pake_output( server, PSA_PAKE_STEP_ZK_PROOF, 175 buffer0 + buffer0_off, 176 512 - buffer0_off, &s_x2_pr_len ) ); 177 TEST_LE_U( s_x2_pr_len, max_expected_size_zk_proof ); 178 DO_ROUND_CONDITIONAL_INJECT( 179 ERR_INJECT_ROUND1_SERVER_ZK_PROOF_PART2, 180 buffer0 + buffer0_off ); 181 DO_ROUND_UPDATE_OFFSETS( buffer0_off, s_x2_pr_off, s_x2_pr_len ); 182 183 /* 184 * When injecting errors in inputs, the implementation is 185 * free to detect it right away of with a delay. 186 * This permits delaying the error until the end of the input 187 * sequence, if no error appears then, this will be treated 188 * as an error. 189 */ 190 if( client_input_first == 1 ) 191 { 192 /* Client first round Input */ 193 status = psa_pake_input( client, PSA_PAKE_STEP_KEY_SHARE, 194 buffer0 + s_g1_off, s_g1_len ); 195 DO_ROUND_CHECK_FAILURE( ); 196 197 status = psa_pake_input( client, PSA_PAKE_STEP_ZK_PUBLIC, 198 buffer0 + s_x1_pk_off, 199 s_x1_pk_len ); 200 DO_ROUND_CHECK_FAILURE( ); 201 202 status = psa_pake_input( client, PSA_PAKE_STEP_ZK_PROOF, 203 buffer0 + s_x1_pr_off, 204 s_x1_pr_len ); 205 DO_ROUND_CHECK_FAILURE( ); 206 207 status = psa_pake_input( client, PSA_PAKE_STEP_KEY_SHARE, 208 buffer0 + s_g2_off, 209 s_g2_len ); 210 DO_ROUND_CHECK_FAILURE( ); 211 212 status = psa_pake_input( client, PSA_PAKE_STEP_ZK_PUBLIC, 213 buffer0 + s_x2_pk_off, 214 s_x2_pk_len ); 215 DO_ROUND_CHECK_FAILURE( ); 216 217 status = psa_pake_input( client, PSA_PAKE_STEP_ZK_PROOF, 218 buffer0 + s_x2_pr_off, 219 s_x2_pr_len ); 220 DO_ROUND_CHECK_FAILURE( ); 221 222 /* Error didn't trigger, make test fail */ 223 if( ( err_stage >= ERR_INJECT_ROUND1_SERVER_KEY_SHARE_PART1 ) && 224 ( err_stage <= ERR_INJECT_ROUND1_SERVER_ZK_PROOF_PART2 ) ) 225 { 226 TEST_ASSERT( ! "One of the last psa_pake_input() calls should have returned the expected error." ); 227 } 228 } 229 230 /* Client first round Output */ 231 PSA_ASSERT( psa_pake_output( client, PSA_PAKE_STEP_KEY_SHARE, 232 buffer1 + buffer1_off, 233 512 - buffer1_off, &c_g1_len ) ); 234 TEST_EQUAL( c_g1_len, expected_size_key_share ); 235 DO_ROUND_CONDITIONAL_INJECT( 236 ERR_INJECT_ROUND1_CLIENT_KEY_SHARE_PART1, 237 buffer1 + buffer1_off ); 238 DO_ROUND_UPDATE_OFFSETS( buffer1_off, c_g1_off, c_g1_len ); 239 240 PSA_ASSERT( psa_pake_output( client, PSA_PAKE_STEP_ZK_PUBLIC, 241 buffer1 + buffer1_off, 242 512 - buffer1_off, &c_x1_pk_len ) ); 243 TEST_EQUAL( c_x1_pk_len, expected_size_zk_public ); 244 DO_ROUND_CONDITIONAL_INJECT( 245 ERR_INJECT_ROUND1_CLIENT_ZK_PUBLIC_PART1, 246 buffer1 + buffer1_off ); 247 DO_ROUND_UPDATE_OFFSETS( buffer1_off, c_x1_pk_off, c_x1_pk_len ); 248 249 PSA_ASSERT( psa_pake_output( client, PSA_PAKE_STEP_ZK_PROOF, 250 buffer1 + buffer1_off, 251 512 - buffer1_off, &c_x1_pr_len ) ); 252 TEST_LE_U( c_x1_pr_len, max_expected_size_zk_proof ); 253 DO_ROUND_CONDITIONAL_INJECT( 254 ERR_INJECT_ROUND1_CLIENT_ZK_PROOF_PART1, 255 buffer1 + buffer1_off ); 256 DO_ROUND_UPDATE_OFFSETS( buffer1_off, c_x1_pr_off, c_x1_pr_len ); 257 258 PSA_ASSERT( psa_pake_output( client, PSA_PAKE_STEP_KEY_SHARE, 259 buffer1 + buffer1_off, 260 512 - buffer1_off, &c_g2_len ) ); 261 TEST_EQUAL( c_g2_len, expected_size_key_share ); 262 DO_ROUND_CONDITIONAL_INJECT( 263 ERR_INJECT_ROUND1_CLIENT_KEY_SHARE_PART2, 264 buffer1 + buffer1_off ); 265 DO_ROUND_UPDATE_OFFSETS( buffer1_off, c_g2_off, c_g2_len ); 266 267 PSA_ASSERT( psa_pake_output( client, PSA_PAKE_STEP_ZK_PUBLIC, 268 buffer1 + buffer1_off, 269 512 - buffer1_off, &c_x2_pk_len ) ); 270 TEST_EQUAL( c_x2_pk_len, expected_size_zk_public ); 271 DO_ROUND_CONDITIONAL_INJECT( 272 ERR_INJECT_ROUND1_CLIENT_ZK_PUBLIC_PART2, 273 buffer1 + buffer1_off ); 274 DO_ROUND_UPDATE_OFFSETS( buffer1_off, c_x2_pk_off, c_x2_pk_len ); 275 276 PSA_ASSERT( psa_pake_output( client, PSA_PAKE_STEP_ZK_PROOF, 277 buffer1 + buffer1_off, 278 512 - buffer1_off, &c_x2_pr_len ) ); 279 TEST_LE_U( c_x2_pr_len, max_expected_size_zk_proof ); 280 DO_ROUND_CONDITIONAL_INJECT( 281 ERR_INJECT_ROUND1_CLIENT_ZK_PROOF_PART2, 282 buffer1 + buffer1_off ); 283 DO_ROUND_UPDATE_OFFSETS( buffer1_off, c_x2_pr_off, buffer1_off ); 284 285 if( client_input_first == 0 ) 286 { 287 /* Client first round Input */ 288 status = psa_pake_input( client, PSA_PAKE_STEP_KEY_SHARE, 289 buffer0 + s_g1_off, s_g1_len ); 290 DO_ROUND_CHECK_FAILURE( ); 291 292 status = psa_pake_input( client, PSA_PAKE_STEP_ZK_PUBLIC, 293 buffer0 + s_x1_pk_off, 294 s_x1_pk_len ); 295 DO_ROUND_CHECK_FAILURE( ); 296 297 status = psa_pake_input( client, PSA_PAKE_STEP_ZK_PROOF, 298 buffer0 + s_x1_pr_off, 299 s_x1_pr_len ); 300 DO_ROUND_CHECK_FAILURE( ); 301 302 status = psa_pake_input( client, PSA_PAKE_STEP_KEY_SHARE, 303 buffer0 + s_g2_off, 304 s_g2_len ); 305 DO_ROUND_CHECK_FAILURE( ); 306 307 status = psa_pake_input( client, PSA_PAKE_STEP_ZK_PUBLIC, 308 buffer0 + s_x2_pk_off, 309 s_x2_pk_len ); 310 DO_ROUND_CHECK_FAILURE( ); 311 312 status = psa_pake_input( client, PSA_PAKE_STEP_ZK_PROOF, 313 buffer0 + s_x2_pr_off, 314 s_x2_pr_len ); 315 DO_ROUND_CHECK_FAILURE( ); 316 317 /* Error didn't trigger, make test fail */ 318 if( ( err_stage >= ERR_INJECT_ROUND1_SERVER_KEY_SHARE_PART1 ) && 319 ( err_stage <= ERR_INJECT_ROUND1_SERVER_ZK_PROOF_PART2 ) ) 320 { 321 TEST_ASSERT( ! "One of the last psa_pake_input() calls should have returned the expected error." ); 322 } 323 } 324 325 /* Server first round Input */ 326 status = psa_pake_input( server, PSA_PAKE_STEP_KEY_SHARE, 327 buffer1 + c_g1_off, c_g1_len ); 328 DO_ROUND_CHECK_FAILURE( ); 329 330 status = psa_pake_input( server, PSA_PAKE_STEP_ZK_PUBLIC, 331 buffer1 + c_x1_pk_off, c_x1_pk_len ); 332 DO_ROUND_CHECK_FAILURE( ); 333 334 status = psa_pake_input( server, PSA_PAKE_STEP_ZK_PROOF, 335 buffer1 + c_x1_pr_off, c_x1_pr_len ); 336 DO_ROUND_CHECK_FAILURE( ); 337 338 status = psa_pake_input( server, PSA_PAKE_STEP_KEY_SHARE, 339 buffer1 + c_g2_off, c_g2_len ); 340 DO_ROUND_CHECK_FAILURE( ); 341 342 status = psa_pake_input( server, PSA_PAKE_STEP_ZK_PUBLIC, 343 buffer1 + c_x2_pk_off, c_x2_pk_len ); 344 DO_ROUND_CHECK_FAILURE( ); 345 346 status = psa_pake_input( server, PSA_PAKE_STEP_ZK_PROOF, 347 buffer1 + c_x2_pr_off, c_x2_pr_len ); 348 DO_ROUND_CHECK_FAILURE( ); 349 350 /* Error didn't trigger, make test fail */ 351 if( ( err_stage >= ERR_INJECT_ROUND1_CLIENT_KEY_SHARE_PART1 ) && 352 ( err_stage <= ERR_INJECT_ROUND1_CLIENT_ZK_PROOF_PART2 ) ) 353 { 354 TEST_ASSERT( ! "One of the last psa_pake_input() calls should have returned the expected error." ); 355 } 356 357 break; 358 359 case PAKE_ROUND_TWO: 360 /* Server second round Output */ 361 buffer0_off = 0; 362 363 PSA_ASSERT( psa_pake_output( server, PSA_PAKE_STEP_KEY_SHARE, 364 buffer0 + buffer0_off, 365 512 - buffer0_off, &s_a_len ) ); 366 TEST_EQUAL( s_a_len, expected_size_key_share ); 367 DO_ROUND_CONDITIONAL_INJECT( 368 ERR_INJECT_ROUND2_SERVER_KEY_SHARE, 369 buffer0 + buffer0_off ); 370 DO_ROUND_UPDATE_OFFSETS( buffer0_off, s_a_off, s_a_len ); 371 372 PSA_ASSERT( psa_pake_output( server, PSA_PAKE_STEP_ZK_PUBLIC, 373 buffer0 + buffer0_off, 374 512 - buffer0_off, &s_x2s_pk_len ) ); 375 TEST_EQUAL( s_x2s_pk_len, expected_size_zk_public ); 376 DO_ROUND_CONDITIONAL_INJECT( 377 ERR_INJECT_ROUND2_SERVER_ZK_PUBLIC, 378 buffer0 + buffer0_off ); 379 DO_ROUND_UPDATE_OFFSETS( buffer0_off, s_x2s_pk_off, s_x2s_pk_len ); 380 381 PSA_ASSERT( psa_pake_output( server, PSA_PAKE_STEP_ZK_PROOF, 382 buffer0 + buffer0_off, 383 512 - buffer0_off, &s_x2s_pr_len ) ); 384 TEST_LE_U( s_x2s_pr_len, max_expected_size_zk_proof ); 385 DO_ROUND_CONDITIONAL_INJECT( 386 ERR_INJECT_ROUND2_SERVER_ZK_PROOF, 387 buffer0 + buffer0_off ); 388 DO_ROUND_UPDATE_OFFSETS( buffer0_off, s_x2s_pr_off, s_x2s_pr_len ); 389 390 if( client_input_first == 1 ) 391 { 392 /* Client second round Input */ 393 status = psa_pake_input( client, PSA_PAKE_STEP_KEY_SHARE, 394 buffer0 + s_a_off, s_a_len ); 395 DO_ROUND_CHECK_FAILURE( ); 396 397 status = psa_pake_input( client, PSA_PAKE_STEP_ZK_PUBLIC, 398 buffer0 + s_x2s_pk_off, 399 s_x2s_pk_len ); 400 DO_ROUND_CHECK_FAILURE( ); 401 402 status = psa_pake_input( client, PSA_PAKE_STEP_ZK_PROOF, 403 buffer0 + s_x2s_pr_off, 404 s_x2s_pr_len ); 405 DO_ROUND_CHECK_FAILURE( ); 406 407 /* Error didn't trigger, make test fail */ 408 if( ( err_stage >= ERR_INJECT_ROUND2_SERVER_KEY_SHARE ) && 409 ( err_stage <= ERR_INJECT_ROUND2_SERVER_ZK_PROOF ) ) 410 { 411 TEST_ASSERT( ! "One of the last psa_pake_input() calls should have returned the expected error." ); 412 } 413 } 414 415 /* Client second round Output */ 416 buffer1_off = 0; 417 418 PSA_ASSERT( psa_pake_output( client, PSA_PAKE_STEP_KEY_SHARE, 419 buffer1 + buffer1_off, 420 512 - buffer1_off, &c_a_len ) ); 421 TEST_EQUAL( c_a_len, expected_size_key_share ); 422 DO_ROUND_CONDITIONAL_INJECT( 423 ERR_INJECT_ROUND2_CLIENT_KEY_SHARE, 424 buffer1 + buffer1_off ); 425 DO_ROUND_UPDATE_OFFSETS( buffer1_off, c_a_off, c_a_len ); 426 427 PSA_ASSERT( psa_pake_output( client, PSA_PAKE_STEP_ZK_PUBLIC, 428 buffer1 + buffer1_off, 429 512 - buffer1_off, &c_x2s_pk_len ) ); 430 TEST_EQUAL( c_x2s_pk_len, expected_size_zk_public ); 431 DO_ROUND_CONDITIONAL_INJECT( 432 ERR_INJECT_ROUND2_CLIENT_ZK_PUBLIC, 433 buffer1 + buffer1_off ); 434 DO_ROUND_UPDATE_OFFSETS( buffer1_off, c_x2s_pk_off, c_x2s_pk_len ); 435 436 PSA_ASSERT( psa_pake_output( client, PSA_PAKE_STEP_ZK_PROOF, 437 buffer1 + buffer1_off, 438 512 - buffer1_off, &c_x2s_pr_len ) ); 439 TEST_LE_U( c_x2s_pr_len, max_expected_size_zk_proof ); 440 DO_ROUND_CONDITIONAL_INJECT( 441 ERR_INJECT_ROUND2_CLIENT_ZK_PROOF, 442 buffer1 + buffer1_off ); 443 DO_ROUND_UPDATE_OFFSETS( buffer1_off, c_x2s_pr_off, c_x2s_pr_len ); 444 445 if( client_input_first == 0 ) 446 { 447 /* Client second round Input */ 448 status = psa_pake_input( client, PSA_PAKE_STEP_KEY_SHARE, 449 buffer0 + s_a_off, s_a_len ); 450 DO_ROUND_CHECK_FAILURE( ); 451 452 status = psa_pake_input( client, PSA_PAKE_STEP_ZK_PUBLIC, 453 buffer0 + s_x2s_pk_off, 454 s_x2s_pk_len ); 455 DO_ROUND_CHECK_FAILURE( ); 456 457 status = psa_pake_input( client, PSA_PAKE_STEP_ZK_PROOF, 458 buffer0 + s_x2s_pr_off, 459 s_x2s_pr_len ); 460 DO_ROUND_CHECK_FAILURE( ); 461 462 /* Error didn't trigger, make test fail */ 463 if( ( err_stage >= ERR_INJECT_ROUND2_SERVER_KEY_SHARE ) && 464 ( err_stage <= ERR_INJECT_ROUND2_SERVER_ZK_PROOF ) ) 465 { 466 TEST_ASSERT( ! "One of the last psa_pake_input() calls should have returned the expected error." ); 467 } 468 } 469 470 /* Server second round Input */ 471 status = psa_pake_input( server, PSA_PAKE_STEP_KEY_SHARE, 472 buffer1 + c_a_off, c_a_len ); 473 DO_ROUND_CHECK_FAILURE( ); 474 475 status = psa_pake_input( server, PSA_PAKE_STEP_ZK_PUBLIC, 476 buffer1 + c_x2s_pk_off, c_x2s_pk_len ); 477 DO_ROUND_CHECK_FAILURE( ); 478 479 status = psa_pake_input( server, PSA_PAKE_STEP_ZK_PROOF, 480 buffer1 + c_x2s_pr_off, c_x2s_pr_len ); 481 DO_ROUND_CHECK_FAILURE( ); 482 483 /* Error didn't trigger, make test fail */ 484 if( ( err_stage >= ERR_INJECT_ROUND2_CLIENT_KEY_SHARE ) && 485 ( err_stage <= ERR_INJECT_ROUND2_CLIENT_ZK_PROOF ) ) 486 { 487 TEST_ASSERT( ! "One of the last psa_pake_input() calls should have returned the expected error." ); 488 } 489 490 break; 491 492 } 493 494exit: 495 mbedtls_free( buffer0 ); 496 mbedtls_free( buffer1 ); 497} 498#endif /* PSA_WANT_ALG_JPAKE */ 499 500/* 501 * This check is used for functions that might either succeed or fail depending 502 * on the parameters that are passed in from the *.data file: 503 * - in case of success following functions depend on the current one 504 * - in case of failure the test is always terminated. There are two options 505 * here 506 * - terminated successfully if this exact error was expected at this stage 507 * - terminated with failure otherwise (either no error was expected at this 508 * stage or a different error code was expected) 509 */ 510#define SETUP_ALWAYS_CHECK_STEP( test_function, this_check_err_stage ) \ 511 status = test_function; \ 512 if( err_stage != this_check_err_stage ) \ 513 { \ 514 PSA_ASSERT( status ); \ 515 } \ 516 else \ 517 { \ 518 TEST_EQUAL( status, expected_error ); \ 519 goto exit; \ 520 } 521 522/* 523 * This check is used for failures that are injected at code level. There's only 524 * 1 input parameter that is relevant in this case and it's the stage at which 525 * the error should be injected. 526 * The check is conditional in this case because, once the error is triggered, 527 * the pake's context structure is compromised and the setup function cannot 528 * proceed further. As a consequence the test is terminated. 529 * The test succeeds if the returned error is exactly the expected one, 530 * otherwise it fails. 531 */ 532#define SETUP_CONDITIONAL_CHECK_STEP( test_function, this_check_err_stage ) \ 533 if( err_stage == this_check_err_stage ) \ 534 { \ 535 TEST_EQUAL( test_function, expected_error ); \ 536 goto exit; \ 537 } 538/* END_HEADER */ 539 540/* BEGIN_DEPENDENCIES 541 * depends_on:MBEDTLS_PSA_CRYPTO_C 542 * END_DEPENDENCIES 543 */ 544 545/* BEGIN_CASE depends_on:PSA_WANT_ALG_JPAKE */ 546void ecjpake_setup( int alg_arg, int key_type_pw_arg, int key_usage_pw_arg, 547 int primitive_arg, int hash_arg, int role_arg, 548 int test_input, 549 int err_stage_arg, 550 int expected_error_arg) 551{ 552 psa_pake_cipher_suite_t cipher_suite = psa_pake_cipher_suite_init(); 553 psa_pake_operation_t operation = psa_pake_operation_init(); 554 psa_algorithm_t alg = alg_arg; 555 psa_pake_primitive_t primitive = primitive_arg; 556 psa_key_type_t key_type_pw = key_type_pw_arg; 557 psa_key_usage_t key_usage_pw = key_usage_pw_arg; 558 psa_algorithm_t hash_alg = hash_arg; 559 psa_pake_role_t role = role_arg; 560 mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT; 561 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; 562 ecjpake_error_stage_t err_stage = err_stage_arg; 563 psa_status_t expected_error = expected_error_arg; 564 psa_status_t status; 565 unsigned char *output_buffer = NULL; 566 size_t output_len = 0; 567 const uint8_t unsupp_id[] = "abcd"; 568 const uint8_t password[] = "abcd"; 569 psa_key_derivation_operation_t key_derivation = 570 PSA_KEY_DERIVATION_OPERATION_INIT; 571 572 PSA_INIT( ); 573 574 size_t buf_size = PSA_PAKE_OUTPUT_SIZE( alg, primitive_arg, 575 PSA_PAKE_STEP_KEY_SHARE ); 576 ASSERT_ALLOC( output_buffer, buf_size ); 577 578 psa_set_key_usage_flags( &attributes, key_usage_pw ); 579 psa_set_key_algorithm( &attributes, alg ); 580 psa_set_key_type( &attributes, key_type_pw ); 581 PSA_ASSERT( psa_import_key( &attributes, password, sizeof( password ), 582 &key ) ); 583 584 psa_pake_cs_set_algorithm( &cipher_suite, alg ); 585 psa_pake_cs_set_primitive( &cipher_suite, primitive ); 586 psa_pake_cs_set_hash( &cipher_suite, hash_alg ); 587 588 PSA_ASSERT( psa_pake_abort( &operation ) ); 589 590 if ( err_stage == ERR_INJECT_UNINITIALIZED_ACCESS ) 591 { 592 TEST_EQUAL( psa_pake_set_user( &operation, NULL, 0 ), 593 expected_error ); 594 TEST_EQUAL( psa_pake_set_peer( &operation, NULL, 0 ), 595 expected_error ); 596 TEST_EQUAL( psa_pake_set_password_key( &operation, key ), 597 expected_error ); 598 TEST_EQUAL( psa_pake_set_role( &operation, role ), 599 expected_error ); 600 TEST_EQUAL( psa_pake_output( &operation, PSA_PAKE_STEP_KEY_SHARE, 601 NULL, 0, NULL ), 602 expected_error ); 603 TEST_EQUAL( psa_pake_input( &operation, PSA_PAKE_STEP_KEY_SHARE, 604 NULL, 0 ), 605 expected_error ); 606 TEST_EQUAL( psa_pake_get_implicit_key( &operation, &key_derivation ), 607 expected_error ); 608 goto exit; 609 } 610 611 SETUP_ALWAYS_CHECK_STEP( psa_pake_setup( &operation, &cipher_suite ), 612 ERR_IN_SETUP ); 613 614 SETUP_CONDITIONAL_CHECK_STEP( psa_pake_setup( &operation, &cipher_suite ), 615 ERR_INJECT_DUPLICATE_SETUP); 616 617 SETUP_ALWAYS_CHECK_STEP( psa_pake_set_role( &operation, role), 618 ERR_IN_SET_ROLE ); 619 620 SETUP_ALWAYS_CHECK_STEP( psa_pake_set_password_key( &operation, key ), 621 ERR_IN_SET_PASSWORD_KEY ); 622 623 SETUP_CONDITIONAL_CHECK_STEP( psa_pake_set_user( &operation, NULL, 0 ), 624 ERR_INJECT_INVALID_USER ); 625 626 SETUP_CONDITIONAL_CHECK_STEP( psa_pake_set_peer( &operation, NULL, 0 ), 627 ERR_INJECT_INVALID_PEER ); 628 629 SETUP_CONDITIONAL_CHECK_STEP( psa_pake_set_user( &operation, unsupp_id, 4 ), 630 ERR_INJECT_SET_USER ); 631 632 SETUP_CONDITIONAL_CHECK_STEP( psa_pake_set_peer( &operation, unsupp_id, 4 ), 633 ERR_INJECT_SET_PEER ); 634 635 const size_t size_key_share = PSA_PAKE_INPUT_SIZE( alg, primitive, 636 PSA_PAKE_STEP_KEY_SHARE ); 637 const size_t size_zk_public = PSA_PAKE_INPUT_SIZE( alg, primitive, 638 PSA_PAKE_STEP_ZK_PUBLIC ); 639 const size_t size_zk_proof = PSA_PAKE_INPUT_SIZE( alg, primitive, 640 PSA_PAKE_STEP_ZK_PROOF ); 641 642 if ( test_input ) 643 { 644 SETUP_CONDITIONAL_CHECK_STEP( psa_pake_input( &operation, 645 PSA_PAKE_STEP_ZK_PROOF, NULL, 0 ), 646 ERR_INJECT_EMPTY_IO_BUFFER ); 647 648 SETUP_CONDITIONAL_CHECK_STEP( psa_pake_input( &operation, 649 PSA_PAKE_STEP_ZK_PROOF + 10, 650 output_buffer, size_zk_proof ), 651 ERR_INJECT_UNKNOWN_STEP ); 652 653 SETUP_CONDITIONAL_CHECK_STEP( psa_pake_input( &operation, 654 PSA_PAKE_STEP_ZK_PROOF, 655 output_buffer, size_zk_proof ), 656 ERR_INJECT_INVALID_FIRST_STEP ) 657 658 SETUP_ALWAYS_CHECK_STEP( psa_pake_input( &operation, 659 PSA_PAKE_STEP_KEY_SHARE, 660 output_buffer, size_key_share ), 661 ERR_IN_INPUT ); 662 663 SETUP_CONDITIONAL_CHECK_STEP( psa_pake_input( &operation, 664 PSA_PAKE_STEP_ZK_PUBLIC, 665 output_buffer, size_zk_public + 1 ), 666 ERR_INJECT_WRONG_BUFFER_SIZE ); 667 668 SETUP_CONDITIONAL_CHECK_STEP( 669 ( psa_pake_input( &operation, PSA_PAKE_STEP_ZK_PUBLIC, 670 output_buffer, size_zk_public + 1 ), 671 psa_pake_input( &operation, PSA_PAKE_STEP_ZK_PUBLIC, 672 output_buffer, size_zk_public ) ), 673 ERR_INJECT_VALID_OPERATION_AFTER_FAILURE ); 674 } else { 675 SETUP_CONDITIONAL_CHECK_STEP( psa_pake_output( &operation, 676 PSA_PAKE_STEP_ZK_PROOF, 677 NULL, 0, NULL ), 678 ERR_INJECT_EMPTY_IO_BUFFER ); 679 680 SETUP_CONDITIONAL_CHECK_STEP( psa_pake_output( &operation, 681 PSA_PAKE_STEP_ZK_PROOF + 10, 682 output_buffer, buf_size, &output_len ), 683 ERR_INJECT_UNKNOWN_STEP ); 684 685 SETUP_CONDITIONAL_CHECK_STEP( psa_pake_output( &operation, 686 PSA_PAKE_STEP_ZK_PROOF, 687 output_buffer, buf_size, &output_len ), 688 ERR_INJECT_INVALID_FIRST_STEP ); 689 690 SETUP_ALWAYS_CHECK_STEP( psa_pake_output( &operation, 691 PSA_PAKE_STEP_KEY_SHARE, 692 output_buffer, buf_size, &output_len ), 693 ERR_IN_OUTPUT ); 694 695 TEST_ASSERT( output_len > 0 ); 696 697 SETUP_CONDITIONAL_CHECK_STEP( psa_pake_output( &operation, 698 PSA_PAKE_STEP_ZK_PUBLIC, 699 output_buffer, size_zk_public - 1, 700 &output_len ), 701 ERR_INJECT_WRONG_BUFFER_SIZE ); 702 703 SETUP_CONDITIONAL_CHECK_STEP( 704 ( psa_pake_output( &operation, PSA_PAKE_STEP_ZK_PUBLIC, 705 output_buffer, size_zk_public - 1, &output_len ), 706 psa_pake_output( &operation, PSA_PAKE_STEP_ZK_PUBLIC, 707 output_buffer, buf_size, &output_len ) ), 708 ERR_INJECT_VALID_OPERATION_AFTER_FAILURE ); 709 } 710 711exit: 712 PSA_ASSERT( psa_destroy_key( key ) ); 713 PSA_ASSERT( psa_pake_abort( &operation ) ); 714 mbedtls_free( output_buffer ); 715 PSA_DONE( ); 716} 717/* END_CASE */ 718 719/* BEGIN_CASE depends_on:PSA_WANT_ALG_JPAKE */ 720void ecjpake_rounds_inject( int alg_arg, int primitive_arg, int hash_arg, 721 int client_input_first, 722 data_t *pw_data, 723 int err_stage_arg, 724 int expected_error_arg ) 725{ 726 psa_pake_cipher_suite_t cipher_suite = psa_pake_cipher_suite_init(); 727 psa_pake_operation_t server = psa_pake_operation_init(); 728 psa_pake_operation_t client = psa_pake_operation_init(); 729 psa_algorithm_t alg = alg_arg; 730 psa_algorithm_t hash_alg = hash_arg; 731 mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT; 732 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; 733 ecjpake_error_stage_t err_stage = err_stage_arg; 734 735 PSA_INIT( ); 736 737 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DERIVE ); 738 psa_set_key_algorithm( &attributes, alg ); 739 psa_set_key_type( &attributes, PSA_KEY_TYPE_PASSWORD ); 740 PSA_ASSERT( psa_import_key( &attributes, pw_data->x, pw_data->len, 741 &key ) ); 742 743 psa_pake_cs_set_algorithm( &cipher_suite, alg ); 744 psa_pake_cs_set_primitive( &cipher_suite, primitive_arg ); 745 psa_pake_cs_set_hash( &cipher_suite, hash_alg ); 746 747 PSA_ASSERT( psa_pake_setup( &server, &cipher_suite ) ); 748 PSA_ASSERT( psa_pake_setup( &client, &cipher_suite ) ); 749 750 PSA_ASSERT( psa_pake_set_role( &server, PSA_PAKE_ROLE_SERVER ) ); 751 PSA_ASSERT( psa_pake_set_role( &client, PSA_PAKE_ROLE_CLIENT ) ); 752 753 PSA_ASSERT( psa_pake_set_password_key( &server, key ) ); 754 PSA_ASSERT( psa_pake_set_password_key( &client, key ) ); 755 756 ecjpake_do_round( alg, primitive_arg, &server, &client, 757 client_input_first, PAKE_ROUND_ONE, 758 err_stage, expected_error_arg ); 759 760 if( err_stage != ERR_NONE ) 761 goto exit; 762 763 ecjpake_do_round( alg, primitive_arg, &server, &client, 764 client_input_first, PAKE_ROUND_TWO, 765 err_stage, expected_error_arg ); 766 767exit: 768 psa_destroy_key( key ); 769 psa_pake_abort( &server ); 770 psa_pake_abort( &client ); 771 PSA_DONE( ); 772} 773/* END_CASE */ 774 775/* BEGIN_CASE depends_on:PSA_WANT_ALG_JPAKE */ 776void ecjpake_rounds( int alg_arg, int primitive_arg, int hash_arg, 777 int derive_alg_arg, data_t *pw_data, 778 int client_input_first, int destroy_key, 779 int err_stage_arg ) 780{ 781 psa_pake_cipher_suite_t cipher_suite = psa_pake_cipher_suite_init(); 782 psa_pake_operation_t server = psa_pake_operation_init(); 783 psa_pake_operation_t client = psa_pake_operation_init(); 784 psa_algorithm_t alg = alg_arg; 785 psa_algorithm_t hash_alg = hash_arg; 786 psa_algorithm_t derive_alg = derive_alg_arg; 787 mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT; 788 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; 789 psa_key_derivation_operation_t server_derive = 790 PSA_KEY_DERIVATION_OPERATION_INIT; 791 psa_key_derivation_operation_t client_derive = 792 PSA_KEY_DERIVATION_OPERATION_INIT; 793 ecjpake_error_stage_t err_stage = err_stage_arg; 794 795 PSA_INIT( ); 796 797 psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_DERIVE ); 798 psa_set_key_algorithm( &attributes, alg ); 799 psa_set_key_type( &attributes, PSA_KEY_TYPE_PASSWORD ); 800 PSA_ASSERT( psa_import_key( &attributes, pw_data->x, pw_data->len, 801 &key ) ); 802 803 psa_pake_cs_set_algorithm( &cipher_suite, alg ); 804 psa_pake_cs_set_primitive( &cipher_suite, primitive_arg ); 805 psa_pake_cs_set_hash( &cipher_suite, hash_alg ); 806 807 /* Get shared key */ 808 PSA_ASSERT( psa_key_derivation_setup( &server_derive, derive_alg ) ); 809 PSA_ASSERT( psa_key_derivation_setup( &client_derive, derive_alg ) ); 810 811 if( PSA_ALG_IS_TLS12_PRF( derive_alg ) || 812 PSA_ALG_IS_TLS12_PSK_TO_MS( derive_alg ) ) 813 { 814 PSA_ASSERT( psa_key_derivation_input_bytes( &server_derive, 815 PSA_KEY_DERIVATION_INPUT_SEED, 816 (const uint8_t*) "", 0) ); 817 PSA_ASSERT( psa_key_derivation_input_bytes( &client_derive, 818 PSA_KEY_DERIVATION_INPUT_SEED, 819 (const uint8_t*) "", 0) ); 820 } 821 822 PSA_ASSERT( psa_pake_setup( &server, &cipher_suite ) ); 823 PSA_ASSERT( psa_pake_setup( &client, &cipher_suite ) ); 824 825 PSA_ASSERT( psa_pake_set_role( &server, PSA_PAKE_ROLE_SERVER ) ); 826 PSA_ASSERT( psa_pake_set_role( &client, PSA_PAKE_ROLE_CLIENT ) ); 827 828 PSA_ASSERT( psa_pake_set_password_key( &server, key ) ); 829 PSA_ASSERT( psa_pake_set_password_key( &client, key ) ); 830 831 if( destroy_key == 1 ) 832 psa_destroy_key( key ); 833 834 if( err_stage == ERR_INJECT_ANTICIPATE_KEY_DERIVATION_1 ) 835 { 836 TEST_EQUAL( psa_pake_get_implicit_key( &server, &server_derive ), 837 PSA_ERROR_BAD_STATE ); 838 TEST_EQUAL( psa_pake_get_implicit_key( &client, &client_derive ), 839 PSA_ERROR_BAD_STATE ); 840 goto exit; 841 } 842 843 /* First round */ 844 ecjpake_do_round( alg, primitive_arg, &server, &client, 845 client_input_first, PAKE_ROUND_ONE, 846 ERR_NONE, PSA_SUCCESS ); 847 848 if ( err_stage == ERR_INJECT_ANTICIPATE_KEY_DERIVATION_2 ) 849 { 850 TEST_EQUAL( psa_pake_get_implicit_key( &server, &server_derive ), 851 PSA_ERROR_BAD_STATE ); 852 TEST_EQUAL( psa_pake_get_implicit_key( &client, &client_derive ), 853 PSA_ERROR_BAD_STATE ); 854 goto exit; 855 } 856 857 /* Second round */ 858 ecjpake_do_round( alg, primitive_arg, &server, &client, 859 client_input_first, PAKE_ROUND_TWO, 860 ERR_NONE, PSA_SUCCESS ); 861 862 PSA_ASSERT( psa_pake_get_implicit_key( &server, &server_derive ) ); 863 PSA_ASSERT( psa_pake_get_implicit_key( &client, &client_derive ) ); 864 865exit: 866 psa_key_derivation_abort( &server_derive ); 867 psa_key_derivation_abort( &client_derive ); 868 psa_destroy_key( key ); 869 psa_pake_abort( &server ); 870 psa_pake_abort( &client ); 871 PSA_DONE( ); 872} 873/* END_CASE */ 874 875/* BEGIN_CASE */ 876void ecjpake_size_macros( ) 877{ 878 const psa_algorithm_t alg = PSA_ALG_JPAKE; 879 const size_t bits = 256; 880 const psa_pake_primitive_t prim = PSA_PAKE_PRIMITIVE( 881 PSA_PAKE_PRIMITIVE_TYPE_ECC, PSA_ECC_FAMILY_SECP_R1, bits ); 882 const psa_key_type_t key_type = PSA_KEY_TYPE_ECC_KEY_PAIR( 883 PSA_ECC_FAMILY_SECP_R1 ); 884 885 // https://armmbed.github.io/mbed-crypto/1.1_PAKE_Extension.0-bet.0/html/pake.html#pake-step-types 886 /* The output for KEY_SHARE and ZK_PUBLIC is the same as a public key */ 887 TEST_EQUAL( PSA_PAKE_OUTPUT_SIZE(alg, prim, PSA_PAKE_STEP_KEY_SHARE), 888 PSA_EXPORT_PUBLIC_KEY_OUTPUT_SIZE( key_type, bits ) ); 889 TEST_EQUAL( PSA_PAKE_OUTPUT_SIZE(alg, prim, PSA_PAKE_STEP_ZK_PUBLIC), 890 PSA_EXPORT_PUBLIC_KEY_OUTPUT_SIZE( key_type, bits ) ); 891 /* The output for ZK_PROOF is the same bitsize as the curve */ 892 TEST_EQUAL( PSA_PAKE_OUTPUT_SIZE(alg, prim, PSA_PAKE_STEP_ZK_PROOF), 893 PSA_BITS_TO_BYTES( bits ) ); 894 895 /* Input sizes are the same as output sizes */ 896 TEST_EQUAL( PSA_PAKE_OUTPUT_SIZE(alg, prim, PSA_PAKE_STEP_KEY_SHARE), 897 PSA_PAKE_INPUT_SIZE(alg, prim, PSA_PAKE_STEP_KEY_SHARE) ); 898 TEST_EQUAL( PSA_PAKE_OUTPUT_SIZE(alg, prim, PSA_PAKE_STEP_ZK_PUBLIC), 899 PSA_PAKE_INPUT_SIZE(alg, prim, PSA_PAKE_STEP_ZK_PUBLIC) ); 900 TEST_EQUAL( PSA_PAKE_OUTPUT_SIZE(alg, prim, PSA_PAKE_STEP_ZK_PROOF), 901 PSA_PAKE_INPUT_SIZE(alg, prim, PSA_PAKE_STEP_ZK_PROOF) ); 902 903 /* These inequalities will always hold even when other PAKEs are added */ 904 TEST_LE_U( PSA_PAKE_OUTPUT_SIZE(alg, prim, PSA_PAKE_STEP_KEY_SHARE), 905 PSA_PAKE_OUTPUT_MAX_SIZE ); 906 TEST_LE_U( PSA_PAKE_OUTPUT_SIZE(alg, prim, PSA_PAKE_STEP_ZK_PUBLIC), 907 PSA_PAKE_OUTPUT_MAX_SIZE ); 908 TEST_LE_U( PSA_PAKE_OUTPUT_SIZE(alg, prim, PSA_PAKE_STEP_ZK_PROOF), 909 PSA_PAKE_OUTPUT_MAX_SIZE ); 910 TEST_LE_U( PSA_PAKE_INPUT_SIZE(alg, prim, PSA_PAKE_STEP_KEY_SHARE), 911 PSA_PAKE_INPUT_MAX_SIZE ); 912 TEST_LE_U( PSA_PAKE_INPUT_SIZE(alg, prim, PSA_PAKE_STEP_ZK_PUBLIC), 913 PSA_PAKE_INPUT_MAX_SIZE ); 914 TEST_LE_U( PSA_PAKE_INPUT_SIZE(alg, prim, PSA_PAKE_STEP_ZK_PROOF), 915 PSA_PAKE_INPUT_MAX_SIZE ); 916} 917/* END_CASE */ 918