| /* |
| * PSA AEAD entry points |
| */ |
| /* |
| * Copyright The Mbed TLS Contributors |
| * SPDX-License-Identifier: Apache-2.0 |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); you may |
| * not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
| * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| #include "common.h" |
| |
| #if defined(MBEDTLS_PSA_CRYPTO_C) |
| |
| #include "psa_crypto_aead.h" |
| #include "psa_crypto_core.h" |
| |
| #include "mbedtls/ccm.h" |
| #include "mbedtls/chachapoly.h" |
| #include "mbedtls/cipher.h" |
| #include "mbedtls/gcm.h" |
| |
| typedef struct |
| { |
| union |
| { |
| unsigned dummy; /* Make the union non-empty even with no supported algorithms. */ |
| #if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM) |
| mbedtls_ccm_context ccm; |
| #endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */ |
| #if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM) |
| mbedtls_gcm_context gcm; |
| #endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */ |
| #if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305) |
| mbedtls_chachapoly_context chachapoly; |
| #endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */ |
| } ctx; |
| psa_algorithm_t core_alg; |
| uint8_t tag_length; |
| } aead_operation_t; |
| |
| #define AEAD_OPERATION_INIT {{0}, 0, 0} |
| |
| static void psa_aead_abort_internal( aead_operation_t *operation ) |
| { |
| switch( operation->core_alg ) |
| { |
| #if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM) |
| case PSA_ALG_CCM: |
| mbedtls_ccm_free( &operation->ctx.ccm ); |
| break; |
| #endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */ |
| #if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM) |
| case PSA_ALG_GCM: |
| mbedtls_gcm_free( &operation->ctx.gcm ); |
| break; |
| #endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */ |
| #if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305) |
| case PSA_ALG_CHACHA20_POLY1305: |
| mbedtls_chachapoly_free( &operation->ctx.chachapoly ); |
| break; |
| #endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */ |
| } |
| } |
| |
| static psa_status_t psa_aead_setup( |
| aead_operation_t *operation, |
| const psa_key_attributes_t *attributes, |
| const uint8_t *key_buffer, |
| psa_algorithm_t alg ) |
| { |
| psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| size_t key_bits; |
| const mbedtls_cipher_info_t *cipher_info; |
| mbedtls_cipher_id_t cipher_id; |
| size_t full_tag_length = 0; |
| |
| key_bits = attributes->core.bits; |
| |
| cipher_info = mbedtls_cipher_info_from_psa( alg, |
| attributes->core.type, key_bits, |
| &cipher_id ); |
| if( cipher_info == NULL ) |
| return( PSA_ERROR_NOT_SUPPORTED ); |
| |
| switch( PSA_ALG_AEAD_WITH_SHORTENED_TAG( alg, 0 ) ) |
| { |
| #if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM) |
| case PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CCM, 0 ): |
| operation->core_alg = PSA_ALG_CCM; |
| full_tag_length = 16; |
| /* CCM allows the following tag lengths: 4, 6, 8, 10, 12, 14, 16. |
| * The call to mbedtls_ccm_encrypt_and_tag or |
| * mbedtls_ccm_auth_decrypt will validate the tag length. */ |
| if( PSA_BLOCK_CIPHER_BLOCK_LENGTH( attributes->core.type ) != 16 ) |
| return( PSA_ERROR_INVALID_ARGUMENT ); |
| |
| mbedtls_ccm_init( &operation->ctx.ccm ); |
| status = mbedtls_to_psa_error( |
| mbedtls_ccm_setkey( &operation->ctx.ccm, cipher_id, |
| key_buffer, (unsigned int) key_bits ) ); |
| if( status != PSA_SUCCESS ) |
| return( status ); |
| break; |
| #endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */ |
| |
| #if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM) |
| case PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_GCM, 0 ): |
| operation->core_alg = PSA_ALG_GCM; |
| full_tag_length = 16; |
| /* GCM allows the following tag lengths: 4, 8, 12, 13, 14, 15, 16. |
| * The call to mbedtls_gcm_crypt_and_tag or |
| * mbedtls_gcm_auth_decrypt will validate the tag length. */ |
| if( PSA_BLOCK_CIPHER_BLOCK_LENGTH( attributes->core.type ) != 16 ) |
| return( PSA_ERROR_INVALID_ARGUMENT ); |
| |
| mbedtls_gcm_init( &operation->ctx.gcm ); |
| status = mbedtls_to_psa_error( |
| mbedtls_gcm_setkey( &operation->ctx.gcm, cipher_id, |
| key_buffer, (unsigned int) key_bits ) ); |
| if( status != PSA_SUCCESS ) |
| return( status ); |
| break; |
| #endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */ |
| |
| #if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305) |
| case PSA_ALG_AEAD_WITH_SHORTENED_TAG( PSA_ALG_CHACHA20_POLY1305, 0 ): |
| operation->core_alg = PSA_ALG_CHACHA20_POLY1305; |
| full_tag_length = 16; |
| /* We only support the default tag length. */ |
| if( alg != PSA_ALG_CHACHA20_POLY1305 ) |
| return( PSA_ERROR_NOT_SUPPORTED ); |
| |
| mbedtls_chachapoly_init( &operation->ctx.chachapoly ); |
| status = mbedtls_to_psa_error( |
| mbedtls_chachapoly_setkey( &operation->ctx.chachapoly, |
| key_buffer ) ); |
| if( status != PSA_SUCCESS ) |
| return( status ); |
| break; |
| #endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */ |
| |
| default: |
| return( PSA_ERROR_NOT_SUPPORTED ); |
| } |
| |
| if( PSA_AEAD_TAG_LENGTH( attributes->core.type, |
| key_bits, alg ) |
| > full_tag_length ) |
| return( PSA_ERROR_INVALID_ARGUMENT ); |
| |
| operation->tag_length = PSA_AEAD_TAG_LENGTH( attributes->core.type, |
| key_bits, |
| alg ); |
| |
| return( PSA_SUCCESS ); |
| } |
| |
| psa_status_t mbedtls_psa_aead_encrypt( |
| const psa_key_attributes_t *attributes, |
| const uint8_t *key_buffer, size_t key_buffer_size, |
| psa_algorithm_t alg, |
| const uint8_t *nonce, size_t nonce_length, |
| const uint8_t *additional_data, size_t additional_data_length, |
| const uint8_t *plaintext, size_t plaintext_length, |
| uint8_t *ciphertext, size_t ciphertext_size, size_t *ciphertext_length ) |
| { |
| psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| aead_operation_t operation = AEAD_OPERATION_INIT; |
| uint8_t *tag; |
| (void) key_buffer_size; |
| |
| status = psa_aead_setup( &operation, attributes, key_buffer, alg ); |
| if( status != PSA_SUCCESS ) |
| goto exit; |
| |
| /* For all currently supported modes, the tag is at the end of the |
| * ciphertext. */ |
| if( ciphertext_size < ( plaintext_length + operation.tag_length ) ) |
| { |
| status = PSA_ERROR_BUFFER_TOO_SMALL; |
| goto exit; |
| } |
| tag = ciphertext + plaintext_length; |
| |
| #if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM) |
| if( operation.core_alg == PSA_ALG_CCM ) |
| { |
| status = mbedtls_to_psa_error( |
| mbedtls_ccm_encrypt_and_tag( &operation.ctx.ccm, |
| plaintext_length, |
| nonce, nonce_length, |
| additional_data, |
| additional_data_length, |
| plaintext, ciphertext, |
| tag, operation.tag_length ) ); |
| } |
| else |
| #endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */ |
| #if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM) |
| if( operation.core_alg == PSA_ALG_GCM ) |
| { |
| status = mbedtls_to_psa_error( |
| mbedtls_gcm_crypt_and_tag( &operation.ctx.gcm, |
| MBEDTLS_GCM_ENCRYPT, |
| plaintext_length, |
| nonce, nonce_length, |
| additional_data, additional_data_length, |
| plaintext, ciphertext, |
| operation.tag_length, tag ) ); |
| } |
| else |
| #endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */ |
| #if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305) |
| if( operation.core_alg == PSA_ALG_CHACHA20_POLY1305 ) |
| { |
| if( nonce_length != 12 || operation.tag_length != 16 ) |
| { |
| status = PSA_ERROR_NOT_SUPPORTED; |
| goto exit; |
| } |
| status = mbedtls_to_psa_error( |
| mbedtls_chachapoly_encrypt_and_tag( &operation.ctx.chachapoly, |
| plaintext_length, |
| nonce, |
| additional_data, |
| additional_data_length, |
| plaintext, |
| ciphertext, |
| tag ) ); |
| } |
| else |
| #endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */ |
| { |
| (void) tag; |
| return( PSA_ERROR_NOT_SUPPORTED ); |
| } |
| |
| if( status == PSA_SUCCESS ) |
| *ciphertext_length = plaintext_length + operation.tag_length; |
| |
| exit: |
| psa_aead_abort_internal( &operation ); |
| |
| return( status ); |
| } |
| |
| /* Locate the tag in a ciphertext buffer containing the encrypted data |
| * followed by the tag. Return the length of the part preceding the tag in |
| * *plaintext_length. This is the size of the plaintext in modes where |
| * the encrypted data has the same size as the plaintext, such as |
| * CCM and GCM. */ |
| static psa_status_t psa_aead_unpadded_locate_tag( size_t tag_length, |
| const uint8_t *ciphertext, |
| size_t ciphertext_length, |
| size_t plaintext_size, |
| const uint8_t **p_tag ) |
| { |
| size_t payload_length; |
| if( tag_length > ciphertext_length ) |
| return( PSA_ERROR_INVALID_ARGUMENT ); |
| payload_length = ciphertext_length - tag_length; |
| if( payload_length > plaintext_size ) |
| return( PSA_ERROR_BUFFER_TOO_SMALL ); |
| *p_tag = ciphertext + payload_length; |
| return( PSA_SUCCESS ); |
| } |
| |
| psa_status_t mbedtls_psa_aead_decrypt( |
| const psa_key_attributes_t *attributes, |
| const uint8_t *key_buffer, size_t key_buffer_size, |
| psa_algorithm_t alg, |
| const uint8_t *nonce, size_t nonce_length, |
| const uint8_t *additional_data, size_t additional_data_length, |
| const uint8_t *ciphertext, size_t ciphertext_length, |
| uint8_t *plaintext, size_t plaintext_size, size_t *plaintext_length ) |
| { |
| psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
| aead_operation_t operation = AEAD_OPERATION_INIT; |
| const uint8_t *tag = NULL; |
| (void) key_buffer_size; |
| |
| status = psa_aead_setup( &operation, attributes, key_buffer, alg ); |
| if( status != PSA_SUCCESS ) |
| goto exit; |
| |
| status = psa_aead_unpadded_locate_tag( operation.tag_length, |
| ciphertext, ciphertext_length, |
| plaintext_size, &tag ); |
| if( status != PSA_SUCCESS ) |
| goto exit; |
| |
| #if defined(MBEDTLS_PSA_BUILTIN_ALG_CCM) |
| if( operation.core_alg == PSA_ALG_CCM ) |
| { |
| status = mbedtls_to_psa_error( |
| mbedtls_ccm_auth_decrypt( &operation.ctx.ccm, |
| ciphertext_length - operation.tag_length, |
| nonce, nonce_length, |
| additional_data, |
| additional_data_length, |
| ciphertext, plaintext, |
| tag, operation.tag_length ) ); |
| } |
| else |
| #endif /* MBEDTLS_PSA_BUILTIN_ALG_CCM */ |
| #if defined(MBEDTLS_PSA_BUILTIN_ALG_GCM) |
| if( operation.core_alg == PSA_ALG_GCM ) |
| { |
| status = mbedtls_to_psa_error( |
| mbedtls_gcm_auth_decrypt( &operation.ctx.gcm, |
| ciphertext_length - operation.tag_length, |
| nonce, nonce_length, |
| additional_data, |
| additional_data_length, |
| tag, operation.tag_length, |
| ciphertext, plaintext ) ); |
| } |
| else |
| #endif /* MBEDTLS_PSA_BUILTIN_ALG_GCM */ |
| #if defined(MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305) |
| if( operation.core_alg == PSA_ALG_CHACHA20_POLY1305 ) |
| { |
| if( nonce_length != 12 || operation.tag_length != 16 ) |
| { |
| status = PSA_ERROR_NOT_SUPPORTED; |
| goto exit; |
| } |
| status = mbedtls_to_psa_error( |
| mbedtls_chachapoly_auth_decrypt( &operation.ctx.chachapoly, |
| ciphertext_length - operation.tag_length, |
| nonce, |
| additional_data, |
| additional_data_length, |
| tag, |
| ciphertext, |
| plaintext ) ); |
| } |
| else |
| #endif /* MBEDTLS_PSA_BUILTIN_ALG_CHACHA20_POLY1305 */ |
| { |
| return( PSA_ERROR_NOT_SUPPORTED ); |
| } |
| |
| if( status == PSA_SUCCESS ) |
| *plaintext_length = ciphertext_length - operation.tag_length; |
| |
| exit: |
| psa_aead_abort_internal( &operation ); |
| |
| if( status == PSA_SUCCESS ) |
| *plaintext_length = ciphertext_length - operation.tag_length; |
| return( status ); |
| } |
| |
| #endif /* MBEDTLS_PSA_CRYPTO_C */ |
| |
