From 985456820493e34fa0a3cd14186930f8e7e2f883 Mon Sep 17 00:00:00 2001 From: Neil Armstrong Date: Tue, 22 Feb 2022 16:12:51 +0100 Subject: [PATCH 1/7] PK: RSA signing PSA wrap implementation Signed-off-by: Neil Armstrong --- library/pk_wrap.c | 68 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 68 insertions(+) diff --git a/library/pk_wrap.c b/library/pk_wrap.c index f7480c63b..290845136 100644 --- a/library/pk_wrap.c +++ b/library/pk_wrap.c @@ -191,6 +191,73 @@ static int rsa_verify_wrap( void *ctx, mbedtls_md_type_t md_alg, return( 0 ); } +#if defined(MBEDTLS_USE_PSA_CRYPTO) +static int rsa_sign_wrap( void *ctx, mbedtls_md_type_t md_alg, + const unsigned char *hash, size_t hash_len, + unsigned char *sig, size_t sig_size, size_t *sig_len, + int (*f_rng)(void *, unsigned char *, size_t), void *p_rng ) +{ + mbedtls_rsa_context * rsa = (mbedtls_rsa_context *) ctx; + int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; + psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; + mbedtls_svc_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT; + psa_status_t status; + mbedtls_pk_context key; + int key_len; + /* see RSA_PRV_DER_MAX_BYTES in pkwrite.c */ + unsigned char buf[47 + 3 * MBEDTLS_MPI_MAX_SIZE + \ + 5 * ( MBEDTLS_MPI_MAX_SIZE / 2 + MBEDTLS_MPI_MAX_SIZE % 2 )]; + mbedtls_pk_info_t pk_info = mbedtls_rsa_info; + psa_algorithm_t psa_alg_md = PSA_ALG_RSA_PKCS1V15_SIGN( mbedtls_psa_translate_md( md_alg ) ); + + ((void) f_rng); + ((void) p_rng); + +#if SIZE_MAX > UINT_MAX + if( md_alg == MBEDTLS_MD_NONE && UINT_MAX < hash_len ) + return( MBEDTLS_ERR_PK_BAD_INPUT_DATA ); +#endif /* SIZE_MAX > UINT_MAX */ + + *sig_len = mbedtls_rsa_get_len( rsa ); + if( sig_size < *sig_len ) + return( MBEDTLS_ERR_PK_BUFFER_TOO_SMALL ); + + /* mbedtls_pk_write_pubkey() expects a full PK context; + * re-construct one to make it happy */ + key.pk_info = &pk_info; + key.pk_ctx = ctx; + key_len = mbedtls_pk_write_key_der( &key, buf, sizeof( buf ) ); + if( key_len <= 0 ) + return( MBEDTLS_ERR_PK_BAD_INPUT_DATA ); + + psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_SIGN_HASH ); + psa_set_key_algorithm( &attributes, psa_alg_md ); + psa_set_key_type( &attributes, PSA_KEY_TYPE_RSA_KEY_PAIR ); + + status = psa_import_key( &attributes, + buf + sizeof( buf ) - key_len, key_len, + &key_id ); + if( status != PSA_SUCCESS ) + { + ret = mbedtls_psa_err_translate_pk( status ); + goto cleanup; + } + + status = psa_sign_hash( key_id, psa_alg_md, hash, hash_len, + sig, sig_size, sig_len ); + if( status != PSA_SUCCESS ) + { + ret = mbedtls_psa_err_translate_pk( status ); + goto cleanup; + } + + ret = 0; + +cleanup: + psa_destroy_key( key_id ); + return( ret ); +} +#else static int rsa_sign_wrap( void *ctx, mbedtls_md_type_t md_alg, const unsigned char *hash, size_t hash_len, unsigned char *sig, size_t sig_size, size_t *sig_len, @@ -211,6 +278,7 @@ static int rsa_sign_wrap( void *ctx, mbedtls_md_type_t md_alg, md_alg, (unsigned int) hash_len, hash, sig ) ); } +#endif static int rsa_decrypt_wrap( void *ctx, const unsigned char *input, size_t ilen, From 5f8328b2f6f8825f77a2ea8fb3b05fb89c8253d0 Mon Sep 17 00:00:00 2001 From: Neil Armstrong Date: Tue, 22 Feb 2022 17:32:00 +0100 Subject: [PATCH 2/7] Initialize PSA crypto in test_suite_x509write for RSA signing tests Signed-off-by: Neil Armstrong --- tests/suites/test_suite_x509write.function | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/tests/suites/test_suite_x509write.function b/tests/suites/test_suite_x509write.function index 261794c7f..1e8819137 100644 --- a/tests/suites/test_suite_x509write.function +++ b/tests/suites/test_suite_x509write.function @@ -93,6 +93,8 @@ void x509_csr_check( char * key_file, char * cert_req_check_file, int md_type, memset( &rnd_info, 0x2a, sizeof( mbedtls_test_rnd_pseudo_info ) ); + USE_PSA_INIT( ); + mbedtls_pk_init( &key ); TEST_ASSERT( mbedtls_pk_parse_keyfile( &key, key_file, NULL, mbedtls_test_rnd_std_rand, NULL ) == 0 ); @@ -140,6 +142,7 @@ void x509_csr_check( char * key_file, char * cert_req_check_file, int md_type, exit: mbedtls_x509write_csr_free( &req ); mbedtls_pk_free( &key ); + USE_PSA_DONE( ); } /* END_CASE */ @@ -220,6 +223,8 @@ void x509_crt_check( char *subject_key_file, char *subject_pwd, memset( &rnd_info, 0x2a, sizeof( mbedtls_test_rnd_pseudo_info ) ); mbedtls_mpi_init( &serial ); + USE_PSA_INIT( ); + mbedtls_pk_init( &subject_key ); mbedtls_pk_init( &issuer_key ); mbedtls_pk_init( &issuer_key_alt ); @@ -316,6 +321,7 @@ exit: mbedtls_pk_free( &subject_key ); mbedtls_pk_free( &issuer_key ); mbedtls_mpi_free( &serial ); + USE_PSA_DONE( ); } /* END_CASE */ From e4f28688fd656cf32e0949bc66ea80722a6e9382 Mon Sep 17 00:00:00 2001 From: Neil Armstrong Date: Thu, 24 Feb 2022 15:41:39 +0100 Subject: [PATCH 3/7] Fix comment typo in rsa_sign_wrap() Signed-off-by: Neil Armstrong --- library/pk_wrap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/library/pk_wrap.c b/library/pk_wrap.c index 290845136..c30b5219a 100644 --- a/library/pk_wrap.c +++ b/library/pk_wrap.c @@ -222,7 +222,7 @@ static int rsa_sign_wrap( void *ctx, mbedtls_md_type_t md_alg, if( sig_size < *sig_len ) return( MBEDTLS_ERR_PK_BUFFER_TOO_SMALL ); - /* mbedtls_pk_write_pubkey() expects a full PK context; + /* mbedtls_pk_write_key_der() expects a full PK context; * re-construct one to make it happy */ key.pk_info = &pk_info; key.pk_ctx = ctx; From 48a9833cdf840ad981a6182c2892eb5ecb5a5b2b Mon Sep 17 00:00:00 2001 From: Neil Armstrong Date: Thu, 24 Feb 2022 16:56:46 +0100 Subject: [PATCH 4/7] Check psa_destroy_key() return in rsa_sign_wrap() Signed-off-by: Neil Armstrong --- library/pk_wrap.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/library/pk_wrap.c b/library/pk_wrap.c index c30b5219a..678020c32 100644 --- a/library/pk_wrap.c +++ b/library/pk_wrap.c @@ -254,7 +254,10 @@ static int rsa_sign_wrap( void *ctx, mbedtls_md_type_t md_alg, ret = 0; cleanup: - psa_destroy_key( key_id ); + status = psa_destroy_key( key_id ); + if( ret == 0 && status != PSA_SUCCESS ) + ret = mbedtls_psa_err_translate_pk( status ); + return( ret ); } #else From 4b1a059f7d75e5dfd36b9aa3b3bff0e31e9fcfba Mon Sep 17 00:00:00 2001 From: Neil Armstrong Date: Fri, 25 Feb 2022 08:58:12 +0100 Subject: [PATCH 5/7] Use now shared RSA_PRV_DER_MAX_BYTES define in pk_wrap.c Signed-off-by: Neil Armstrong --- library/pk_wrap.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/library/pk_wrap.c b/library/pk_wrap.c index 678020c32..59c41824d 100644 --- a/library/pk_wrap.c +++ b/library/pk_wrap.c @@ -204,9 +204,7 @@ static int rsa_sign_wrap( void *ctx, mbedtls_md_type_t md_alg, psa_status_t status; mbedtls_pk_context key; int key_len; - /* see RSA_PRV_DER_MAX_BYTES in pkwrite.c */ - unsigned char buf[47 + 3 * MBEDTLS_MPI_MAX_SIZE + \ - 5 * ( MBEDTLS_MPI_MAX_SIZE / 2 + MBEDTLS_MPI_MAX_SIZE % 2 )]; + unsigned char buf[MBEDTLS_PK_RSA_PRV_DER_MAX_BYTES]; mbedtls_pk_info_t pk_info = mbedtls_rsa_info; psa_algorithm_t psa_alg_md = PSA_ALG_RSA_PKCS1V15_SIGN( mbedtls_psa_translate_md( md_alg ) ); From 66fa769ae84d2ae9a6d674ab4b8e173200fb37d9 Mon Sep 17 00:00:00 2001 From: Neil Armstrong Date: Thu, 3 Mar 2022 12:32:15 +0100 Subject: [PATCH 6/7] Fix 80 characters indentation in rsa_sign_wrap() Signed-off-by: Neil Armstrong --- library/pk_wrap.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/library/pk_wrap.c b/library/pk_wrap.c index 59c41824d..2427e6c54 100644 --- a/library/pk_wrap.c +++ b/library/pk_wrap.c @@ -206,7 +206,8 @@ static int rsa_sign_wrap( void *ctx, mbedtls_md_type_t md_alg, int key_len; unsigned char buf[MBEDTLS_PK_RSA_PRV_DER_MAX_BYTES]; mbedtls_pk_info_t pk_info = mbedtls_rsa_info; - psa_algorithm_t psa_alg_md = PSA_ALG_RSA_PKCS1V15_SIGN( mbedtls_psa_translate_md( md_alg ) ); + psa_algorithm_t psa_alg_md = + PSA_ALG_RSA_PKCS1V15_SIGN( mbedtls_psa_translate_md( md_alg ) ); ((void) f_rng); ((void) p_rng); From db69c5213f42486cf64b994089444a618b1d4533 Mon Sep 17 00:00:00 2001 From: Neil Armstrong Date: Thu, 3 Mar 2022 16:41:23 +0100 Subject: [PATCH 7/7] Use new PSA to mbedtls PK error mapping functions in rsa_sign_wrap() Signed-off-by: Neil Armstrong --- library/pk_wrap.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/library/pk_wrap.c b/library/pk_wrap.c index 2427e6c54..03516b5f0 100644 --- a/library/pk_wrap.c +++ b/library/pk_wrap.c @@ -238,7 +238,7 @@ static int rsa_sign_wrap( void *ctx, mbedtls_md_type_t md_alg, &key_id ); if( status != PSA_SUCCESS ) { - ret = mbedtls_psa_err_translate_pk( status ); + ret = mbedtls_pk_error_from_psa( status ); goto cleanup; } @@ -246,7 +246,7 @@ static int rsa_sign_wrap( void *ctx, mbedtls_md_type_t md_alg, sig, sig_size, sig_len ); if( status != PSA_SUCCESS ) { - ret = mbedtls_psa_err_translate_pk( status ); + ret = mbedtls_pk_error_from_psa_rsa( status ); goto cleanup; } @@ -255,7 +255,7 @@ static int rsa_sign_wrap( void *ctx, mbedtls_md_type_t md_alg, cleanup: status = psa_destroy_key( key_id ); if( ret == 0 && status != PSA_SUCCESS ) - ret = mbedtls_psa_err_translate_pk( status ); + ret = mbedtls_pk_error_from_psa( status ); return( ret ); }