1 /* 2 * Public Key abstraction layer 3 * 4 * Copyright The Mbed TLS Contributors 5 * SPDX-License-Identifier: Apache-2.0 6 * 7 * Licensed under the Apache License, Version 2.0 (the "License"); you may 8 * not use this file except in compliance with the License. 9 * You may obtain a copy of the License at 10 * 11 * http://www.apache.org/licenses/LICENSE-2.0 12 * 13 * Unless required by applicable law or agreed to in writing, software 14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT 15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 16 * See the License for the specific language governing permissions and 17 * limitations under the License. 18 */ 19 20 #include "common.h" 21 22 #if defined(MBEDTLS_PK_C) 23 #include "mbedtls/pk.h" 24 #include "pk_wrap.h" 25 #include "pkwrite.h" 26 27 #include "hash_info.h" 28 29 #include "mbedtls/platform_util.h" 30 #include "mbedtls/error.h" 31 32 #if defined(MBEDTLS_RSA_C) 33 #include "mbedtls/rsa.h" 34 #endif 35 #if defined(MBEDTLS_ECP_C) 36 #include "mbedtls/ecp.h" 37 #endif 38 #if defined(MBEDTLS_ECDSA_C) 39 #include "mbedtls/ecdsa.h" 40 #endif 41 42 #if defined(MBEDTLS_PSA_CRYPTO_C) 43 #include "mbedtls/psa_util.h" 44 #define PSA_PK_TO_MBEDTLS_ERR(status) psa_pk_status_to_mbedtls(status) 45 #define PSA_PK_RSA_TO_MBEDTLS_ERR(status) PSA_TO_MBEDTLS_ERR_LIST(status, \ 46 psa_to_pk_rsa_errors, \ 47 psa_pk_status_to_mbedtls) 48 #define PSA_PK_ECDSA_TO_MBEDTLS_ERR(status) PSA_TO_MBEDTLS_ERR_LIST(status, \ 49 psa_to_pk_ecdsa_errors, \ 50 psa_pk_status_to_mbedtls) 51 #endif 52 53 #include <limits.h> 54 #include <stdint.h> 55 56 /* 57 * Initialise a mbedtls_pk_context 58 */ 59 void mbedtls_pk_init(mbedtls_pk_context *ctx) 60 { 61 ctx->pk_info = NULL; 62 ctx->pk_ctx = NULL; 63 } 64 65 /* 66 * Free (the components of) a mbedtls_pk_context 67 */ 68 void mbedtls_pk_free(mbedtls_pk_context *ctx) 69 { 70 if (ctx == NULL) { 71 return; 72 } 73 74 if (ctx->pk_info != NULL) { 75 ctx->pk_info->ctx_free_func(ctx->pk_ctx); 76 } 77 78 mbedtls_platform_zeroize(ctx, sizeof(mbedtls_pk_context)); 79 } 80 81 #if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE) 82 /* 83 * Initialize a restart context 84 */ 85 void mbedtls_pk_restart_init(mbedtls_pk_restart_ctx *ctx) 86 { 87 ctx->pk_info = NULL; 88 ctx->rs_ctx = NULL; 89 } 90 91 /* 92 * Free the components of a restart context 93 */ 94 void mbedtls_pk_restart_free(mbedtls_pk_restart_ctx *ctx) 95 { 96 if (ctx == NULL || ctx->pk_info == NULL || 97 ctx->pk_info->rs_free_func == NULL) { 98 return; 99 } 100 101 ctx->pk_info->rs_free_func(ctx->rs_ctx); 102 103 ctx->pk_info = NULL; 104 ctx->rs_ctx = NULL; 105 } 106 #endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */ 107 108 /* 109 * Get pk_info structure from type 110 */ 111 const mbedtls_pk_info_t *mbedtls_pk_info_from_type(mbedtls_pk_type_t pk_type) 112 { 113 switch (pk_type) { 114 #if defined(MBEDTLS_RSA_C) 115 case MBEDTLS_PK_RSA: 116 return &mbedtls_rsa_info; 117 #endif 118 #if defined(MBEDTLS_ECP_C) 119 case MBEDTLS_PK_ECKEY: 120 return &mbedtls_eckey_info; 121 case MBEDTLS_PK_ECKEY_DH: 122 return &mbedtls_eckeydh_info; 123 #endif 124 #if defined(MBEDTLS_PK_CAN_ECDSA_SOME) 125 case MBEDTLS_PK_ECDSA: 126 return &mbedtls_ecdsa_info; 127 #endif 128 /* MBEDTLS_PK_RSA_ALT omitted on purpose */ 129 default: 130 return NULL; 131 } 132 } 133 134 /* 135 * Initialise context 136 */ 137 int mbedtls_pk_setup(mbedtls_pk_context *ctx, const mbedtls_pk_info_t *info) 138 { 139 if (info == NULL || ctx->pk_info != NULL) { 140 return MBEDTLS_ERR_PK_BAD_INPUT_DATA; 141 } 142 143 if ((ctx->pk_ctx = info->ctx_alloc_func()) == NULL) { 144 return MBEDTLS_ERR_PK_ALLOC_FAILED; 145 } 146 147 ctx->pk_info = info; 148 149 return 0; 150 } 151 152 #if defined(MBEDTLS_USE_PSA_CRYPTO) 153 /* 154 * Initialise a PSA-wrapping context 155 */ 156 int mbedtls_pk_setup_opaque(mbedtls_pk_context *ctx, 157 const mbedtls_svc_key_id_t key) 158 { 159 const mbedtls_pk_info_t *info = NULL; 160 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; 161 mbedtls_svc_key_id_t *pk_ctx; 162 psa_key_type_t type; 163 164 if (ctx == NULL || ctx->pk_info != NULL) { 165 return MBEDTLS_ERR_PK_BAD_INPUT_DATA; 166 } 167 168 if (PSA_SUCCESS != psa_get_key_attributes(key, &attributes)) { 169 return MBEDTLS_ERR_PK_BAD_INPUT_DATA; 170 } 171 type = psa_get_key_type(&attributes); 172 psa_reset_key_attributes(&attributes); 173 174 if (PSA_KEY_TYPE_IS_ECC_KEY_PAIR(type)) { 175 info = &mbedtls_pk_ecdsa_opaque_info; 176 } else if (type == PSA_KEY_TYPE_RSA_KEY_PAIR) { 177 info = &mbedtls_pk_rsa_opaque_info; 178 } else { 179 return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE; 180 } 181 182 if ((ctx->pk_ctx = info->ctx_alloc_func()) == NULL) { 183 return MBEDTLS_ERR_PK_ALLOC_FAILED; 184 } 185 186 ctx->pk_info = info; 187 188 pk_ctx = (mbedtls_svc_key_id_t *) ctx->pk_ctx; 189 *pk_ctx = key; 190 191 return 0; 192 } 193 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 194 195 #if defined(MBEDTLS_PK_RSA_ALT_SUPPORT) 196 /* 197 * Initialize an RSA-alt context 198 */ 199 int mbedtls_pk_setup_rsa_alt(mbedtls_pk_context *ctx, void *key, 200 mbedtls_pk_rsa_alt_decrypt_func decrypt_func, 201 mbedtls_pk_rsa_alt_sign_func sign_func, 202 mbedtls_pk_rsa_alt_key_len_func key_len_func) 203 { 204 mbedtls_rsa_alt_context *rsa_alt; 205 const mbedtls_pk_info_t *info = &mbedtls_rsa_alt_info; 206 207 if (ctx->pk_info != NULL) { 208 return MBEDTLS_ERR_PK_BAD_INPUT_DATA; 209 } 210 211 if ((ctx->pk_ctx = info->ctx_alloc_func()) == NULL) { 212 return MBEDTLS_ERR_PK_ALLOC_FAILED; 213 } 214 215 ctx->pk_info = info; 216 217 rsa_alt = (mbedtls_rsa_alt_context *) ctx->pk_ctx; 218 219 rsa_alt->key = key; 220 rsa_alt->decrypt_func = decrypt_func; 221 rsa_alt->sign_func = sign_func; 222 rsa_alt->key_len_func = key_len_func; 223 224 return 0; 225 } 226 #endif /* MBEDTLS_PK_RSA_ALT_SUPPORT */ 227 228 /* 229 * Tell if a PK can do the operations of the given type 230 */ 231 int mbedtls_pk_can_do(const mbedtls_pk_context *ctx, mbedtls_pk_type_t type) 232 { 233 /* A context with null pk_info is not set up yet and can't do anything. 234 * For backward compatibility, also accept NULL instead of a context 235 * pointer. */ 236 if (ctx == NULL || ctx->pk_info == NULL) { 237 return 0; 238 } 239 240 return ctx->pk_info->can_do(type); 241 } 242 243 #if defined(MBEDTLS_USE_PSA_CRYPTO) 244 /* 245 * Tell if a PK can do the operations of the given PSA algorithm 246 */ 247 int mbedtls_pk_can_do_ext(const mbedtls_pk_context *ctx, psa_algorithm_t alg, 248 psa_key_usage_t usage) 249 { 250 psa_key_usage_t key_usage; 251 252 /* A context with null pk_info is not set up yet and can't do anything. 253 * For backward compatibility, also accept NULL instead of a context 254 * pointer. */ 255 if (ctx == NULL || ctx->pk_info == NULL) { 256 return 0; 257 } 258 259 /* Filter out non allowed algorithms */ 260 if (PSA_ALG_IS_ECDSA(alg) == 0 && 261 PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) == 0 && 262 PSA_ALG_IS_RSA_PSS(alg) == 0 && 263 alg != PSA_ALG_RSA_PKCS1V15_CRYPT && 264 PSA_ALG_IS_ECDH(alg) == 0) { 265 return 0; 266 } 267 268 /* Filter out non allowed usage flags */ 269 if (usage == 0 || 270 (usage & ~(PSA_KEY_USAGE_SIGN_HASH | 271 PSA_KEY_USAGE_DECRYPT | 272 PSA_KEY_USAGE_DERIVE)) != 0) { 273 return 0; 274 } 275 276 /* Wildcard hash is not allowed */ 277 if (PSA_ALG_IS_SIGN_HASH(alg) && 278 PSA_ALG_SIGN_GET_HASH(alg) == PSA_ALG_ANY_HASH) { 279 return 0; 280 } 281 282 if (mbedtls_pk_get_type(ctx) != MBEDTLS_PK_OPAQUE) { 283 mbedtls_pk_type_t type; 284 285 if (PSA_ALG_IS_ECDSA(alg) || PSA_ALG_IS_ECDH(alg)) { 286 type = MBEDTLS_PK_ECKEY; 287 } else if (PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) || 288 alg == PSA_ALG_RSA_PKCS1V15_CRYPT) { 289 type = MBEDTLS_PK_RSA; 290 } else if (PSA_ALG_IS_RSA_PSS(alg)) { 291 type = MBEDTLS_PK_RSASSA_PSS; 292 } else { 293 return 0; 294 } 295 296 if (ctx->pk_info->can_do(type) == 0) { 297 return 0; 298 } 299 300 switch (type) { 301 case MBEDTLS_PK_ECKEY: 302 key_usage = PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_DERIVE; 303 break; 304 case MBEDTLS_PK_RSA: 305 case MBEDTLS_PK_RSASSA_PSS: 306 key_usage = PSA_KEY_USAGE_SIGN_HASH | 307 PSA_KEY_USAGE_SIGN_MESSAGE | 308 PSA_KEY_USAGE_DECRYPT; 309 break; 310 default: 311 /* Should never happen */ 312 return 0; 313 } 314 315 return (key_usage & usage) == usage; 316 } 317 318 const mbedtls_svc_key_id_t *key = (const mbedtls_svc_key_id_t *) ctx->pk_ctx; 319 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; 320 psa_algorithm_t key_alg, key_alg2; 321 psa_status_t status; 322 323 status = psa_get_key_attributes(*key, &attributes); 324 if (status != PSA_SUCCESS) { 325 return 0; 326 } 327 328 key_alg = psa_get_key_algorithm(&attributes); 329 key_alg2 = psa_get_key_enrollment_algorithm(&attributes); 330 key_usage = psa_get_key_usage_flags(&attributes); 331 psa_reset_key_attributes(&attributes); 332 333 if ((key_usage & usage) != usage) { 334 return 0; 335 } 336 337 /* 338 * Common case: the key alg or alg2 only allows alg. 339 * This will match PSA_ALG_RSA_PKCS1V15_CRYPT & PSA_ALG_IS_ECDH 340 * directly. 341 * This would also match ECDSA/RSA_PKCS1V15_SIGN/RSA_PSS with 342 * a fixed hash on key_alg/key_alg2. 343 */ 344 if (alg == key_alg || alg == key_alg2) { 345 return 1; 346 } 347 348 /* 349 * If key_alg or key_alg2 is a hash-and-sign with a wildcard for the hash, 350 * and alg is the same hash-and-sign family with any hash, 351 * then alg is compliant with this key alg 352 */ 353 if (PSA_ALG_IS_SIGN_HASH(alg)) { 354 355 if (PSA_ALG_IS_SIGN_HASH(key_alg) && 356 PSA_ALG_SIGN_GET_HASH(key_alg) == PSA_ALG_ANY_HASH && 357 (alg & ~PSA_ALG_HASH_MASK) == (key_alg & ~PSA_ALG_HASH_MASK)) { 358 return 1; 359 } 360 361 if (PSA_ALG_IS_SIGN_HASH(key_alg2) && 362 PSA_ALG_SIGN_GET_HASH(key_alg2) == PSA_ALG_ANY_HASH && 363 (alg & ~PSA_ALG_HASH_MASK) == (key_alg2 & ~PSA_ALG_HASH_MASK)) { 364 return 1; 365 } 366 } 367 368 return 0; 369 } 370 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 371 372 /* 373 * Helper for mbedtls_pk_sign and mbedtls_pk_verify 374 */ 375 static inline int pk_hashlen_helper(mbedtls_md_type_t md_alg, size_t *hash_len) 376 { 377 if (*hash_len != 0) { 378 return 0; 379 } 380 381 *hash_len = mbedtls_hash_info_get_size(md_alg); 382 383 if (*hash_len == 0) { 384 return -1; 385 } 386 387 return 0; 388 } 389 390 #if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE) 391 /* 392 * Helper to set up a restart context if needed 393 */ 394 static int pk_restart_setup(mbedtls_pk_restart_ctx *ctx, 395 const mbedtls_pk_info_t *info) 396 { 397 /* Don't do anything if already set up or invalid */ 398 if (ctx == NULL || ctx->pk_info != NULL) { 399 return 0; 400 } 401 402 /* Should never happen when we're called */ 403 if (info->rs_alloc_func == NULL || info->rs_free_func == NULL) { 404 return MBEDTLS_ERR_PK_BAD_INPUT_DATA; 405 } 406 407 if ((ctx->rs_ctx = info->rs_alloc_func()) == NULL) { 408 return MBEDTLS_ERR_PK_ALLOC_FAILED; 409 } 410 411 ctx->pk_info = info; 412 413 return 0; 414 } 415 #endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */ 416 417 /* 418 * Verify a signature (restartable) 419 */ 420 int mbedtls_pk_verify_restartable(mbedtls_pk_context *ctx, 421 mbedtls_md_type_t md_alg, 422 const unsigned char *hash, size_t hash_len, 423 const unsigned char *sig, size_t sig_len, 424 mbedtls_pk_restart_ctx *rs_ctx) 425 { 426 if ((md_alg != MBEDTLS_MD_NONE || hash_len != 0) && hash == NULL) { 427 return MBEDTLS_ERR_PK_BAD_INPUT_DATA; 428 } 429 430 if (ctx->pk_info == NULL || 431 pk_hashlen_helper(md_alg, &hash_len) != 0) { 432 return MBEDTLS_ERR_PK_BAD_INPUT_DATA; 433 } 434 435 #if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE) 436 /* optimization: use non-restartable version if restart disabled */ 437 if (rs_ctx != NULL && 438 mbedtls_ecp_restart_is_enabled() && 439 ctx->pk_info->verify_rs_func != NULL) { 440 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 441 442 if ((ret = pk_restart_setup(rs_ctx, ctx->pk_info)) != 0) { 443 return ret; 444 } 445 446 ret = ctx->pk_info->verify_rs_func(ctx->pk_ctx, 447 md_alg, hash, hash_len, sig, sig_len, rs_ctx->rs_ctx); 448 449 if (ret != MBEDTLS_ERR_ECP_IN_PROGRESS) { 450 mbedtls_pk_restart_free(rs_ctx); 451 } 452 453 return ret; 454 } 455 #else /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */ 456 (void) rs_ctx; 457 #endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */ 458 459 if (ctx->pk_info->verify_func == NULL) { 460 return MBEDTLS_ERR_PK_TYPE_MISMATCH; 461 } 462 463 return ctx->pk_info->verify_func(ctx->pk_ctx, md_alg, hash, hash_len, 464 sig, sig_len); 465 } 466 467 /* 468 * Verify a signature 469 */ 470 int mbedtls_pk_verify(mbedtls_pk_context *ctx, mbedtls_md_type_t md_alg, 471 const unsigned char *hash, size_t hash_len, 472 const unsigned char *sig, size_t sig_len) 473 { 474 return mbedtls_pk_verify_restartable(ctx, md_alg, hash, hash_len, 475 sig, sig_len, NULL); 476 } 477 478 /* 479 * Verify a signature with options 480 */ 481 int mbedtls_pk_verify_ext(mbedtls_pk_type_t type, const void *options, 482 mbedtls_pk_context *ctx, mbedtls_md_type_t md_alg, 483 const unsigned char *hash, size_t hash_len, 484 const unsigned char *sig, size_t sig_len) 485 { 486 if ((md_alg != MBEDTLS_MD_NONE || hash_len != 0) && hash == NULL) { 487 return MBEDTLS_ERR_PK_BAD_INPUT_DATA; 488 } 489 490 if (ctx->pk_info == NULL) { 491 return MBEDTLS_ERR_PK_BAD_INPUT_DATA; 492 } 493 494 if (!mbedtls_pk_can_do(ctx, type)) { 495 return MBEDTLS_ERR_PK_TYPE_MISMATCH; 496 } 497 498 if (type != MBEDTLS_PK_RSASSA_PSS) { 499 /* General case: no options */ 500 if (options != NULL) { 501 return MBEDTLS_ERR_PK_BAD_INPUT_DATA; 502 } 503 504 return mbedtls_pk_verify(ctx, md_alg, hash, hash_len, sig, sig_len); 505 } 506 507 #if defined(MBEDTLS_RSA_C) && defined(MBEDTLS_PKCS1_V21) 508 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 509 const mbedtls_pk_rsassa_pss_options *pss_opts; 510 511 if (md_alg == MBEDTLS_MD_NONE && UINT_MAX < hash_len) { 512 return MBEDTLS_ERR_PK_BAD_INPUT_DATA; 513 } 514 515 if (options == NULL) { 516 return MBEDTLS_ERR_PK_BAD_INPUT_DATA; 517 } 518 519 pss_opts = (const mbedtls_pk_rsassa_pss_options *) options; 520 521 #if defined(MBEDTLS_USE_PSA_CRYPTO) 522 if (pss_opts->mgf1_hash_id == md_alg) { 523 unsigned char buf[MBEDTLS_PK_RSA_PUB_DER_MAX_BYTES]; 524 unsigned char *p; 525 int key_len; 526 size_t signature_length; 527 psa_status_t status = PSA_ERROR_DATA_CORRUPT; 528 psa_status_t destruction_status = PSA_ERROR_DATA_CORRUPT; 529 530 psa_algorithm_t psa_md_alg = mbedtls_hash_info_psa_from_md(md_alg); 531 mbedtls_svc_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT; 532 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; 533 psa_algorithm_t psa_sig_alg = PSA_ALG_RSA_PSS_ANY_SALT(psa_md_alg); 534 p = buf + sizeof(buf); 535 key_len = mbedtls_pk_write_pubkey(&p, buf, ctx); 536 537 if (key_len < 0) { 538 return key_len; 539 } 540 541 psa_set_key_type(&attributes, PSA_KEY_TYPE_RSA_PUBLIC_KEY); 542 psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_VERIFY_HASH); 543 psa_set_key_algorithm(&attributes, psa_sig_alg); 544 545 status = psa_import_key(&attributes, 546 buf + sizeof(buf) - key_len, key_len, 547 &key_id); 548 if (status != PSA_SUCCESS) { 549 psa_destroy_key(key_id); 550 return PSA_PK_TO_MBEDTLS_ERR(status); 551 } 552 553 /* This function requires returning MBEDTLS_ERR_PK_SIG_LEN_MISMATCH 554 * on a valid signature with trailing data in a buffer, but 555 * mbedtls_psa_rsa_verify_hash requires the sig_len to be exact, 556 * so for this reason the passed sig_len is overwritten. Smaller 557 * signature lengths should not be accepted for verification. */ 558 signature_length = sig_len > mbedtls_pk_get_len(ctx) ? 559 mbedtls_pk_get_len(ctx) : sig_len; 560 status = psa_verify_hash(key_id, psa_sig_alg, hash, 561 hash_len, sig, signature_length); 562 destruction_status = psa_destroy_key(key_id); 563 564 if (status == PSA_SUCCESS && sig_len > mbedtls_pk_get_len(ctx)) { 565 return MBEDTLS_ERR_PK_SIG_LEN_MISMATCH; 566 } 567 568 if (status == PSA_SUCCESS) { 569 status = destruction_status; 570 } 571 572 return PSA_PK_RSA_TO_MBEDTLS_ERR(status); 573 } else 574 #endif 575 { 576 if (sig_len < mbedtls_pk_get_len(ctx)) { 577 return MBEDTLS_ERR_RSA_VERIFY_FAILED; 578 } 579 580 ret = mbedtls_rsa_rsassa_pss_verify_ext(mbedtls_pk_rsa(*ctx), 581 md_alg, (unsigned int) hash_len, hash, 582 pss_opts->mgf1_hash_id, 583 pss_opts->expected_salt_len, 584 sig); 585 if (ret != 0) { 586 return ret; 587 } 588 589 if (sig_len > mbedtls_pk_get_len(ctx)) { 590 return MBEDTLS_ERR_PK_SIG_LEN_MISMATCH; 591 } 592 593 return 0; 594 } 595 #else 596 return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE; 597 #endif /* MBEDTLS_RSA_C && MBEDTLS_PKCS1_V21 */ 598 } 599 600 /* 601 * Make a signature (restartable) 602 */ 603 int mbedtls_pk_sign_restartable(mbedtls_pk_context *ctx, 604 mbedtls_md_type_t md_alg, 605 const unsigned char *hash, size_t hash_len, 606 unsigned char *sig, size_t sig_size, size_t *sig_len, 607 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng, 608 mbedtls_pk_restart_ctx *rs_ctx) 609 { 610 if ((md_alg != MBEDTLS_MD_NONE || hash_len != 0) && hash == NULL) { 611 return MBEDTLS_ERR_PK_BAD_INPUT_DATA; 612 } 613 614 if (ctx->pk_info == NULL || pk_hashlen_helper(md_alg, &hash_len) != 0) { 615 return MBEDTLS_ERR_PK_BAD_INPUT_DATA; 616 } 617 618 #if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE) 619 /* optimization: use non-restartable version if restart disabled */ 620 if (rs_ctx != NULL && 621 mbedtls_ecp_restart_is_enabled() && 622 ctx->pk_info->sign_rs_func != NULL) { 623 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 624 625 if ((ret = pk_restart_setup(rs_ctx, ctx->pk_info)) != 0) { 626 return ret; 627 } 628 629 ret = ctx->pk_info->sign_rs_func(ctx->pk_ctx, md_alg, 630 hash, hash_len, 631 sig, sig_size, sig_len, 632 f_rng, p_rng, rs_ctx->rs_ctx); 633 634 if (ret != MBEDTLS_ERR_ECP_IN_PROGRESS) { 635 mbedtls_pk_restart_free(rs_ctx); 636 } 637 638 return ret; 639 } 640 #else /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */ 641 (void) rs_ctx; 642 #endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */ 643 644 if (ctx->pk_info->sign_func == NULL) { 645 return MBEDTLS_ERR_PK_TYPE_MISMATCH; 646 } 647 648 return ctx->pk_info->sign_func(ctx->pk_ctx, md_alg, 649 hash, hash_len, 650 sig, sig_size, sig_len, 651 f_rng, p_rng); 652 } 653 654 /* 655 * Make a signature 656 */ 657 int mbedtls_pk_sign(mbedtls_pk_context *ctx, mbedtls_md_type_t md_alg, 658 const unsigned char *hash, size_t hash_len, 659 unsigned char *sig, size_t sig_size, size_t *sig_len, 660 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng) 661 { 662 return mbedtls_pk_sign_restartable(ctx, md_alg, hash, hash_len, 663 sig, sig_size, sig_len, 664 f_rng, p_rng, NULL); 665 } 666 667 #if defined(MBEDTLS_PSA_CRYPTO_C) 668 /* 669 * Make a signature given a signature type. 670 */ 671 int mbedtls_pk_sign_ext(mbedtls_pk_type_t pk_type, 672 mbedtls_pk_context *ctx, 673 mbedtls_md_type_t md_alg, 674 const unsigned char *hash, size_t hash_len, 675 unsigned char *sig, size_t sig_size, size_t *sig_len, 676 int (*f_rng)(void *, unsigned char *, size_t), 677 void *p_rng) 678 { 679 #if defined(MBEDTLS_RSA_C) 680 psa_algorithm_t psa_md_alg; 681 #endif /* MBEDTLS_RSA_C */ 682 *sig_len = 0; 683 684 if (ctx->pk_info == NULL) { 685 return MBEDTLS_ERR_PK_BAD_INPUT_DATA; 686 } 687 688 if (!mbedtls_pk_can_do(ctx, pk_type)) { 689 return MBEDTLS_ERR_PK_TYPE_MISMATCH; 690 } 691 692 if (pk_type != MBEDTLS_PK_RSASSA_PSS) { 693 return mbedtls_pk_sign(ctx, md_alg, hash, hash_len, 694 sig, sig_size, sig_len, f_rng, p_rng); 695 } 696 697 #if defined(MBEDTLS_RSA_C) 698 psa_md_alg = mbedtls_hash_info_psa_from_md(md_alg); 699 if (psa_md_alg == 0) { 700 return MBEDTLS_ERR_PK_BAD_INPUT_DATA; 701 } 702 703 if (mbedtls_pk_get_type(ctx) == MBEDTLS_PK_OPAQUE) { 704 const mbedtls_svc_key_id_t *key = (const mbedtls_svc_key_id_t *) ctx->pk_ctx; 705 psa_status_t status; 706 707 status = psa_sign_hash(*key, PSA_ALG_RSA_PSS(psa_md_alg), 708 hash, hash_len, 709 sig, sig_size, sig_len); 710 return PSA_PK_RSA_TO_MBEDTLS_ERR(status); 711 } 712 713 return mbedtls_pk_psa_rsa_sign_ext(PSA_ALG_RSA_PSS(psa_md_alg), 714 ctx->pk_ctx, hash, hash_len, 715 sig, sig_size, sig_len); 716 #else /* MBEDTLS_RSA_C */ 717 return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE; 718 #endif /* !MBEDTLS_RSA_C */ 719 720 } 721 #endif /* MBEDTLS_PSA_CRYPTO_C */ 722 723 /* 724 * Decrypt message 725 */ 726 int mbedtls_pk_decrypt(mbedtls_pk_context *ctx, 727 const unsigned char *input, size_t ilen, 728 unsigned char *output, size_t *olen, size_t osize, 729 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng) 730 { 731 if (ctx->pk_info == NULL) { 732 return MBEDTLS_ERR_PK_BAD_INPUT_DATA; 733 } 734 735 if (ctx->pk_info->decrypt_func == NULL) { 736 return MBEDTLS_ERR_PK_TYPE_MISMATCH; 737 } 738 739 return ctx->pk_info->decrypt_func(ctx->pk_ctx, input, ilen, 740 output, olen, osize, f_rng, p_rng); 741 } 742 743 /* 744 * Encrypt message 745 */ 746 int mbedtls_pk_encrypt(mbedtls_pk_context *ctx, 747 const unsigned char *input, size_t ilen, 748 unsigned char *output, size_t *olen, size_t osize, 749 int (*f_rng)(void *, unsigned char *, size_t), void *p_rng) 750 { 751 if (ctx->pk_info == NULL) { 752 return MBEDTLS_ERR_PK_BAD_INPUT_DATA; 753 } 754 755 if (ctx->pk_info->encrypt_func == NULL) { 756 return MBEDTLS_ERR_PK_TYPE_MISMATCH; 757 } 758 759 return ctx->pk_info->encrypt_func(ctx->pk_ctx, input, ilen, 760 output, olen, osize, f_rng, p_rng); 761 } 762 763 /* 764 * Check public-private key pair 765 */ 766 int mbedtls_pk_check_pair(const mbedtls_pk_context *pub, 767 const mbedtls_pk_context *prv, 768 int (*f_rng)(void *, unsigned char *, size_t), 769 void *p_rng) 770 { 771 if (pub->pk_info == NULL || 772 prv->pk_info == NULL) { 773 return MBEDTLS_ERR_PK_BAD_INPUT_DATA; 774 } 775 776 if (f_rng == NULL) { 777 return MBEDTLS_ERR_PK_BAD_INPUT_DATA; 778 } 779 780 if (prv->pk_info->check_pair_func == NULL) { 781 return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE; 782 } 783 784 if (prv->pk_info->type == MBEDTLS_PK_RSA_ALT) { 785 if (pub->pk_info->type != MBEDTLS_PK_RSA) { 786 return MBEDTLS_ERR_PK_TYPE_MISMATCH; 787 } 788 } else { 789 if (pub->pk_info != prv->pk_info) { 790 return MBEDTLS_ERR_PK_TYPE_MISMATCH; 791 } 792 } 793 794 return prv->pk_info->check_pair_func(pub->pk_ctx, prv->pk_ctx, f_rng, p_rng); 795 } 796 797 /* 798 * Get key size in bits 799 */ 800 size_t mbedtls_pk_get_bitlen(const mbedtls_pk_context *ctx) 801 { 802 /* For backward compatibility, accept NULL or a context that 803 * isn't set up yet, and return a fake value that should be safe. */ 804 if (ctx == NULL || ctx->pk_info == NULL) { 805 return 0; 806 } 807 808 return ctx->pk_info->get_bitlen(ctx->pk_ctx); 809 } 810 811 /* 812 * Export debug information 813 */ 814 int mbedtls_pk_debug(const mbedtls_pk_context *ctx, mbedtls_pk_debug_item *items) 815 { 816 if (ctx->pk_info == NULL) { 817 return MBEDTLS_ERR_PK_BAD_INPUT_DATA; 818 } 819 820 if (ctx->pk_info->debug_func == NULL) { 821 return MBEDTLS_ERR_PK_TYPE_MISMATCH; 822 } 823 824 ctx->pk_info->debug_func(ctx->pk_ctx, items); 825 return 0; 826 } 827 828 /* 829 * Access the PK type name 830 */ 831 const char *mbedtls_pk_get_name(const mbedtls_pk_context *ctx) 832 { 833 if (ctx == NULL || ctx->pk_info == NULL) { 834 return "invalid PK"; 835 } 836 837 return ctx->pk_info->name; 838 } 839 840 /* 841 * Access the PK type 842 */ 843 mbedtls_pk_type_t mbedtls_pk_get_type(const mbedtls_pk_context *ctx) 844 { 845 if (ctx == NULL || ctx->pk_info == NULL) { 846 return MBEDTLS_PK_NONE; 847 } 848 849 return ctx->pk_info->type; 850 } 851 852 #if defined(MBEDTLS_USE_PSA_CRYPTO) 853 /* 854 * Load the key to a PSA key slot, 855 * then turn the PK context into a wrapper for that key slot. 856 * 857 * Currently only works for EC & RSA private keys. 858 */ 859 int mbedtls_pk_wrap_as_opaque(mbedtls_pk_context *pk, 860 mbedtls_svc_key_id_t *key, 861 psa_algorithm_t alg, 862 psa_key_usage_t usage, 863 psa_algorithm_t alg2) 864 { 865 #if !defined(MBEDTLS_ECP_C) && !defined(MBEDTLS_RSA_C) 866 ((void) pk); 867 ((void) key); 868 ((void) alg); 869 ((void) usage); 870 ((void) alg2); 871 #else 872 #if defined(MBEDTLS_ECP_C) 873 if (mbedtls_pk_get_type(pk) == MBEDTLS_PK_ECKEY) { 874 const mbedtls_ecp_keypair *ec; 875 unsigned char d[MBEDTLS_ECP_MAX_BYTES]; 876 size_t d_len; 877 psa_ecc_family_t curve_id; 878 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; 879 psa_key_type_t key_type; 880 size_t bits; 881 int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; 882 psa_status_t status; 883 884 /* export the private key material in the format PSA wants */ 885 ec = mbedtls_pk_ec(*pk); 886 d_len = PSA_BITS_TO_BYTES(ec->grp.nbits); 887 if ((ret = mbedtls_mpi_write_binary(&ec->d, d, d_len)) != 0) { 888 return ret; 889 } 890 891 curve_id = mbedtls_ecc_group_to_psa(ec->grp.id, &bits); 892 key_type = PSA_KEY_TYPE_ECC_KEY_PAIR(curve_id); 893 894 /* prepare the key attributes */ 895 psa_set_key_type(&attributes, key_type); 896 psa_set_key_bits(&attributes, bits); 897 psa_set_key_usage_flags(&attributes, usage); 898 psa_set_key_algorithm(&attributes, alg); 899 if (alg2 != PSA_ALG_NONE) { 900 psa_set_key_enrollment_algorithm(&attributes, alg2); 901 } 902 903 /* import private key into PSA */ 904 status = psa_import_key(&attributes, d, d_len, key); 905 if (status != PSA_SUCCESS) { 906 return PSA_PK_TO_MBEDTLS_ERR(status); 907 } 908 909 /* make PK context wrap the key slot */ 910 mbedtls_pk_free(pk); 911 mbedtls_pk_init(pk); 912 913 return mbedtls_pk_setup_opaque(pk, *key); 914 } else 915 #endif /* MBEDTLS_ECP_C */ 916 #if defined(MBEDTLS_RSA_C) 917 if (mbedtls_pk_get_type(pk) == MBEDTLS_PK_RSA) { 918 unsigned char buf[MBEDTLS_PK_RSA_PRV_DER_MAX_BYTES]; 919 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; 920 int key_len; 921 psa_status_t status; 922 923 /* export the private key material in the format PSA wants */ 924 key_len = mbedtls_pk_write_key_der(pk, buf, sizeof(buf)); 925 if (key_len <= 0) { 926 return MBEDTLS_ERR_PK_BAD_INPUT_DATA; 927 } 928 929 /* prepare the key attributes */ 930 psa_set_key_type(&attributes, PSA_KEY_TYPE_RSA_KEY_PAIR); 931 psa_set_key_bits(&attributes, mbedtls_pk_get_bitlen(pk)); 932 psa_set_key_usage_flags(&attributes, usage); 933 psa_set_key_algorithm(&attributes, alg); 934 if (alg2 != PSA_ALG_NONE) { 935 psa_set_key_enrollment_algorithm(&attributes, alg2); 936 } 937 938 /* import private key into PSA */ 939 status = psa_import_key(&attributes, 940 buf + sizeof(buf) - key_len, 941 key_len, key); 942 943 mbedtls_platform_zeroize(buf, sizeof(buf)); 944 945 if (status != PSA_SUCCESS) { 946 return PSA_PK_TO_MBEDTLS_ERR(status); 947 } 948 949 /* make PK context wrap the key slot */ 950 mbedtls_pk_free(pk); 951 mbedtls_pk_init(pk); 952 953 return mbedtls_pk_setup_opaque(pk, *key); 954 } else 955 #endif /* MBEDTLS_RSA_C */ 956 #endif /* !MBEDTLS_ECP_C && !MBEDTLS_RSA_C */ 957 return MBEDTLS_ERR_PK_TYPE_MISMATCH; 958 } 959 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 960 #endif /* MBEDTLS_PK_C */ 961