Skip to content

Commit 0dc4ea9

Browse files
PataterPatater
committed
psa: Disallow use of invalid cipher contexts
Ensure that when doing cipher operations out of order, PSA_ERROR_BAD_STATE is returned as documented in crypto.h and the PSA Crypto specification.
1 parent 3ec7b9a commit 0dc4ea9

File tree

3 files changed

+170
-0
lines changed

3 files changed

+170
-0
lines changed

‎library/psa_crypto.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3073,6 +3073,12 @@ psa_status_t psa_cipher_update( psa_cipher_operation_t *operation,
30733073
psa_status_t status;
30743074
int ret;
30753075
size_t expected_output_size;
3076+
3077+
if( operation->alg == 0)
3078+
{
3079+
return( PSA_ERROR_BAD_STATE );
3080+
}
3081+
30763082
if( ! PSA_ALG_IS_STREAM_CIPHER( operation->alg ) )
30773083
{
30783084
/* Take the unprocessed partial block left over from previous

‎tests/suites/test_suite_psa_crypto.data

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -925,6 +925,9 @@ depends_on:MBEDTLS_ARC4_C:MBEDTLS_CIPHER_MODE_CTR
925925
# Either INVALID_ARGUMENT or NOT_SUPPORTED would be reasonable here
926926
cipher_setup:PSA_KEY_TYPE_ARC4:"000102030405060708090a0b0c0d0e0f":PSA_ALG_CTR:PSA_ERROR_NOT_SUPPORTED
927927

928+
PSA cipher: bad order function calls
929+
cipher_bad_order:
930+
928931
PSA symmetric encrypt: AES-CBC-nopad, 16 bytes, good
929932
depends_on:MBEDTLS_AES_C:MBEDTLS_CIPHER_MODE_CBC
930933
cipher_encrypt:PSA_ALG_CBC_NO_PADDING:PSA_KEY_TYPE_AES:"2b7e151628aed2a6abf7158809cf4f3c":"6bc1bee22e409f96e93d7e117393172a":"a076ec9dfbe47d52afc357336f20743b":PSA_SUCCESS

‎tests/suites/test_suite_psa_crypto.function

Lines changed: 161 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2453,6 +2453,9 @@ exit:
24532453
/* BEGIN_CASE */
24542454
void cipher_operation_init( )
24552455
{
2456+
const uint8_t input[1] = { 0 };
2457+
unsigned char output[1] = { 0 };
2458+
size_t output_length;
24562459
/* Test each valid way of initializing the object, except for `= {0}`, as
24572460
* Clang 5 complains when `-Wmissing-field-initializers` is used, even
24582461
* though it's OK by the C standard. We could test for this, but we'd need
@@ -2463,6 +2466,23 @@ void cipher_operation_init( )
24632466

24642467
memset( &zero, 0, sizeof( zero ) );
24652468

2469+
/* A default cipher operation should not be usable. */
2470+
TEST_EQUAL( psa_cipher_update( &func,
2471+
input, sizeof( input ),
2472+
output, sizeof( output ),
2473+
&output_length ),
2474+
PSA_ERROR_BAD_STATE );
2475+
TEST_EQUAL( psa_cipher_update( &init,
2476+
input, sizeof( input ),
2477+
output, sizeof( output ),
2478+
&output_length ),
2479+
PSA_ERROR_BAD_STATE );
2480+
TEST_EQUAL( psa_cipher_update( &zero,
2481+
input, sizeof( input ),
2482+
output, sizeof( output ),
2483+
&output_length ),
2484+
PSA_ERROR_BAD_STATE );
2485+
24662486
/* A default cipher operation should be abortable without error. */
24672487
PSA_ASSERT( psa_cipher_abort( &func ) );
24682488
PSA_ASSERT( psa_cipher_abort( &init ) );
@@ -2503,6 +2523,147 @@ exit:
25032523
}
25042524
/* END_CASE */
25052525

2526+
/* BEGIN_CASE */
2527+
void cipher_bad_order( )
2528+
{
2529+
psa_key_handle_t handle = 0;
2530+
psa_key_type_t key_type = PSA_KEY_TYPE_AES;
2531+
psa_algorithm_t alg = PSA_ALG_CBC_PKCS7;
2532+
psa_key_policy_t policy = PSA_KEY_POLICY_INIT;
2533+
psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT;
2534+
unsigned char iv[PSA_BLOCK_CIPHER_BLOCK_SIZE(PSA_KEY_TYPE_AES)] = { 0 };
2535+
const uint8_t key[] = {
2536+
0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
2537+
0xaa, 0xaa, 0xaa, 0xaa };
2538+
const uint8_t text[] = {
2539+
0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0xbb,
2540+
0xbb, 0xbb, 0xbb, 0xbb };
2541+
uint8_t buffer[PSA_BLOCK_CIPHER_BLOCK_SIZE(PSA_KEY_TYPE_AES)] = { 0 };
2542+
size_t length = 0;
2543+
2544+
PSA_ASSERT( psa_crypto_init( ) );
2545+
PSA_ASSERT( psa_allocate_key( &handle ) );
2546+
psa_key_policy_set_usage( &policy,
2547+
PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT,
2548+
alg );
2549+
PSA_ASSERT( psa_set_key_policy( handle, &policy ) );
2550+
PSA_ASSERT( psa_import_key( handle, key_type,
2551+
key, sizeof(key) ) );
2552+
2553+
2554+
/* Generate an IV without calling setup beforehand. */
2555+
TEST_EQUAL( psa_cipher_generate_iv( &operation,
2556+
buffer, sizeof( buffer ),
2557+
&length ),
2558+
PSA_ERROR_BAD_STATE );
2559+
PSA_ASSERT( psa_cipher_abort( &operation ) );
2560+
2561+
/* Generate an IV twice in a row. */
2562+
PSA_ASSERT( psa_cipher_encrypt_setup( &operation, handle, alg ) );
2563+
PSA_ASSERT( psa_cipher_generate_iv( &operation,
2564+
buffer, sizeof( buffer ),
2565+
&length ) );
2566+
TEST_EQUAL( psa_cipher_generate_iv( &operation,
2567+
buffer, sizeof( buffer ),
2568+
&length ),
2569+
PSA_ERROR_BAD_STATE );
2570+
PSA_ASSERT( psa_cipher_abort( &operation ) );
2571+
2572+
/* Generate an IV after it's already set. */
2573+
PSA_ASSERT( psa_cipher_encrypt_setup( &operation, handle, alg ) );
2574+
PSA_ASSERT( psa_cipher_set_iv( &operation,
2575+
iv, sizeof( iv ) ) );
2576+
TEST_EQUAL( psa_cipher_generate_iv( &operation,
2577+
buffer, sizeof( buffer ),
2578+
&length ),
2579+
PSA_ERROR_BAD_STATE );
2580+
PSA_ASSERT( psa_cipher_abort( &operation ) );
2581+
2582+
/* Set an IV without calling setup beforehand. */
2583+
TEST_EQUAL( psa_cipher_set_iv( &operation,
2584+
iv, sizeof( iv ) ),
2585+
PSA_ERROR_BAD_STATE );
2586+
PSA_ASSERT( psa_cipher_abort( &operation ) );
2587+
2588+
/* Set an IV after it's already set. */
2589+
PSA_ASSERT( psa_cipher_encrypt_setup( &operation, handle, alg ) );
2590+
PSA_ASSERT( psa_cipher_set_iv( &operation,
2591+
iv, sizeof( iv ) ) );
2592+
TEST_EQUAL( psa_cipher_set_iv( &operation,
2593+
iv, sizeof( iv ) ),
2594+
PSA_ERROR_BAD_STATE );
2595+
PSA_ASSERT( psa_cipher_abort( &operation ) );
2596+
2597+
/* Set an IV after it's already generated. */
2598+
PSA_ASSERT( psa_cipher_encrypt_setup( &operation, handle, alg ) );
2599+
PSA_ASSERT( psa_cipher_generate_iv( &operation,
2600+
buffer, sizeof( buffer ),
2601+
&length ) );
2602+
TEST_EQUAL( psa_cipher_set_iv( &operation,
2603+
iv, sizeof( iv ) ),
2604+
PSA_ERROR_BAD_STATE );
2605+
PSA_ASSERT( psa_cipher_abort( &operation ) );
2606+
2607+
/* Call update without calling setup beforehand. */
2608+
TEST_EQUAL( psa_cipher_update( &operation,
2609+
text, sizeof( text ),
2610+
buffer, sizeof( buffer ),
2611+
&length ),
2612+
PSA_ERROR_BAD_STATE );
2613+
PSA_ASSERT( psa_cipher_abort( &operation ) );
2614+
2615+
/* Call update without an IV where an IV is required. */
2616+
TEST_EQUAL( psa_cipher_update( &operation,
2617+
text, sizeof( text ),
2618+
buffer, sizeof( buffer ),
2619+
&length ),
2620+
PSA_ERROR_BAD_STATE );
2621+
PSA_ASSERT( psa_cipher_abort( &operation ) );
2622+
2623+
/* Call update after finish. */
2624+
PSA_ASSERT( psa_cipher_encrypt_setup( &operation, handle, alg ) );
2625+
PSA_ASSERT( psa_cipher_set_iv( &operation,
2626+
iv, sizeof( iv ) ) );
2627+
PSA_ASSERT( psa_cipher_finish( &operation,
2628+
buffer, sizeof( buffer ), &length ) );
2629+
TEST_EQUAL( psa_cipher_update( &operation,
2630+
text, sizeof( text ),
2631+
buffer, sizeof( buffer ),
2632+
&length ),
2633+
PSA_ERROR_BAD_STATE );
2634+
PSA_ASSERT( psa_cipher_abort( &operation ) );
2635+
2636+
/* Call finish without calling setup beforehand. */
2637+
TEST_EQUAL( psa_cipher_finish( &operation,
2638+
buffer, sizeof( buffer ), &length ),
2639+
PSA_ERROR_BAD_STATE );
2640+
PSA_ASSERT( psa_cipher_abort( &operation ) );
2641+
2642+
/* Call finish without an IV where an IV is required. */
2643+
PSA_ASSERT( psa_cipher_encrypt_setup( &operation, handle, alg ) );
2644+
/* Not calling update means we are encrypting an empty buffer, which is OK
2645+
* for cipher modes with padding. */
2646+
TEST_EQUAL( psa_cipher_finish( &operation,
2647+
buffer, sizeof( buffer ), &length ),
2648+
PSA_ERROR_BAD_STATE );
2649+
PSA_ASSERT( psa_cipher_abort( &operation ) );
2650+
2651+
/* Call finish twice in a row. */
2652+
PSA_ASSERT( psa_cipher_encrypt_setup( &operation, handle, alg ) );
2653+
PSA_ASSERT( psa_cipher_set_iv( &operation,
2654+
iv, sizeof( iv ) ) );
2655+
PSA_ASSERT( psa_cipher_finish( &operation,
2656+
buffer, sizeof( buffer ), &length ) );
2657+
TEST_EQUAL( psa_cipher_finish( &operation,
2658+
buffer, sizeof( buffer ), &length ),
2659+
PSA_ERROR_BAD_STATE );
2660+
PSA_ASSERT( psa_cipher_abort( &operation ) );
2661+
2662+
exit:
2663+
mbedtls_psa_crypto_free( );
2664+
}
2665+
/* END_CASE */
2666+
25062667
/* BEGIN_CASE */
25072668
void cipher_encrypt( int alg_arg, int key_type_arg,
25082669
data_t *key,

0 commit comments

Comments
 (0)