Djam/arm-trusted-firmware
1
0
Fork 0
mirror of https://github.com/ARM-software/arm-trusted-firmware.git synced 2025-04-27 15:24:54 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge "refactor(mbedtls): use PSA API for auth_decrypt" into integration

Browse source
This commit is contained in:
Manish V Badarkhe 2024-09-19 14:43:04 +02:00 • committed by TrustedFirmware Code Review
commit 49b9545ef5
2 changed files with 38 additions and 55 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
drivers/auth/mbedtls/mbedtls_common.mk
View file

@ -74,6 +74,8 @@ LIBMBEDTLS_SRCS += $(addprefix ${MBEDTLS_DIR}/library/, \
psa_crypto_rsa.c \ psa_crypto_rsa.c \
psa_crypto_ecp.c \ psa_crypto_ecp.c \
psa_crypto_slot_management.c \ psa_crypto_slot_management.c \
psa_crypto_aead.c \
psa_crypto_cipher.c \
psa_util.c \ psa_util.c \
) )
endif endif

91
drivers/auth/mbedtls/mbedtls_psa_crypto.c
View file

@ -9,13 +9,11 @@
#include <string.h> #include <string.h>
/* mbed TLS headers */ /* mbed TLS headers */
#include <mbedtls/gcm.h>
#include <mbedtls/md.h> #include <mbedtls/md.h>
#include <mbedtls/memory_buffer_alloc.h> #include <mbedtls/memory_buffer_alloc.h>
#include <mbedtls/oid.h> #include <mbedtls/oid.h>
#include <mbedtls/platform.h> #include <mbedtls/platform.h>
#include <mbedtls/psa_util.h> #include <mbedtls/psa_util.h>
#include <mbedtls/version.h>
#include <mbedtls/x509.h> #include <mbedtls/x509.h>
#include <psa/crypto.h> #include <psa/crypto.h>
#include <psa/crypto_platform.h> #include <psa/crypto_platform.h>
@ -433,78 +431,61 @@ static int aes_gcm_decrypt(void *data_ptr, size_t len, const void *key,
unsigned int iv_len, const void *tag, unsigned int iv_len, const void *tag,
unsigned int tag_len) unsigned int tag_len)
{ {
mbedtls_gcm_context ctx; mbedtls_svc_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT;
mbedtls_cipher_id_t cipher = MBEDTLS_CIPHER_ID_AES; psa_aead_operation_t operation = PSA_AEAD_OPERATION_INIT;
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
psa_status_t psa_status = PSA_ERROR_GENERIC_ERROR;
unsigned char buf[DEC_OP_BUF_SIZE]; unsigned char buf[DEC_OP_BUF_SIZE];
unsigned char tag_buf[CRYPTO_MAX_TAG_SIZE];
unsigned char *pt = data_ptr; unsigned char *pt = data_ptr;
size_t dec_len; size_t dec_len;
int diff, i, rc; size_t output_length;
size_t output_length __unused;
mbedtls_gcm_init(&ctx); /* Load the key into the PSA key store. */
psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_DECRYPT);
psa_set_key_algorithm(&attributes, PSA_ALG_GCM);
psa_set_key_type(&attributes, PSA_KEY_TYPE_AES);
rc = mbedtls_gcm_setkey(&ctx, cipher, key, key_len * 8); psa_status = psa_import_key(&attributes, key, key_len, &key_id);
if (rc != 0) { if (psa_status != PSA_SUCCESS) {
rc = CRYPTO_ERR_DECRYPTION; return CRYPTO_ERR_DECRYPTION;
goto exit_gcm;
} }
#if (MBEDTLS_VERSION_MAJOR < 3) /* Perform the decryption. */
rc = mbedtls_gcm_starts(&ctx, MBEDTLS_GCM_DECRYPT, iv, iv_len, NULL, 0); psa_status = psa_aead_decrypt_setup(&operation, key_id, PSA_ALG_GCM);
#else if (psa_status != PSA_SUCCESS) {
rc = mbedtls_gcm_starts(&ctx, MBEDTLS_GCM_DECRYPT, iv, iv_len); goto err;
#endif }
if (rc != 0) {
rc = CRYPTO_ERR_DECRYPTION; psa_status = psa_aead_set_nonce(&operation, iv, iv_len);
goto exit_gcm; if (psa_status != PSA_SUCCESS) {
goto err;
} }
while (len > 0) { while (len > 0) {
dec_len = MIN(sizeof(buf), len); dec_len = MIN(sizeof(buf), len);
#if (MBEDTLS_VERSION_MAJOR < 3) psa_status = psa_aead_update(&operation, pt, dec_len, buf,
rc = mbedtls_gcm_update(&ctx, dec_len, pt, buf); sizeof(buf), &output_length);
#else if (psa_status != PSA_SUCCESS) {
rc = mbedtls_gcm_update(&ctx, pt, dec_len, buf, sizeof(buf), &output_length); goto err;
#endif
if (rc != 0) {
rc = CRYPTO_ERR_DECRYPTION;
goto exit_gcm;
} }
memcpy(pt, buf, dec_len); memcpy(pt, buf, output_length);
pt += dec_len; pt += output_length;
len -= dec_len; len -= dec_len;
} }
#if (MBEDTLS_VERSION_MAJOR < 3) /* Verify the tag. */
rc = mbedtls_gcm_finish(&ctx, tag_buf, sizeof(tag_buf)); psa_status = psa_aead_verify(&operation, NULL, 0, &output_length, tag, tag_len);
#else if (psa_status == PSA_SUCCESS) {
rc = mbedtls_gcm_finish(&ctx, NULL, 0, &output_length, tag_buf, sizeof(tag_buf)); psa_destroy_key(key_id);
#endif return CRYPTO_SUCCESS;
if (rc != 0) {
rc = CRYPTO_ERR_DECRYPTION;
goto exit_gcm;
} }
/* Check tag in "constant-time" */ err:
for (diff = 0, i = 0; i < tag_len; i++) psa_aead_abort(&operation);
diff |= ((const unsigned char *)tag)[i] ^ tag_buf[i]; psa_destroy_key(key_id);
return CRYPTO_ERR_DECRYPTION;
if (diff != 0) {
rc = CRYPTO_ERR_DECRYPTION;
goto exit_gcm;
}
/* GCM decryption success */
rc = CRYPTO_SUCCESS;
exit_gcm:
mbedtls_gcm_free(&ctx);
return rc;
} }
/* /*