Skip to content

Commit 3ec7b9a

Browse files
PataterPatater
committed
psa: Disallow use of invalid MAC contexts
Ensure that when doing MAC operations out of order, PSA_ERROR_BAD_STATE is returned as documented in crypto.h and the PSA Crypto specification.
1 parent 0574e6a commit 3ec7b9a

File tree

3 files changed

+148
-0
lines changed

3 files changed

+148
-0
lines changed

‎library/psa_crypto.c

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2238,6 +2238,11 @@ psa_status_t psa_mac_sign_finish( psa_mac_operation_t *operation,
22382238
{
22392239
psa_status_t status;
22402240

2241+
if( operation->alg == 0)
2242+
{
2243+
return( PSA_ERROR_BAD_STATE );
2244+
}
2245+
22412246
/* Fill the output buffer with something that isn't a valid mac
22422247
* (barring an attack on the mac and deliberately-crafted input),
22432248
* in case the caller doesn't check the return status properly. */
@@ -2276,6 +2281,11 @@ psa_status_t psa_mac_verify_finish( psa_mac_operation_t *operation,
22762281
uint8_t actual_mac[PSA_MAC_MAX_SIZE];
22772282
psa_status_t status;
22782283

2284+
if( operation->alg == 0)
2285+
{
2286+
return( PSA_ERROR_BAD_STATE );
2287+
}
2288+
22792289
if( operation->is_sign )
22802290
{
22812291
status = PSA_ERROR_BAD_STATE;

‎tests/suites/test_suite_psa_crypto.data

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -705,6 +705,9 @@ depends_on:MBEDTLS_CMAC_C
705705
# Either INVALID_ARGUMENT or NOT_SUPPORTED would be reasonable here
706706
mac_setup:PSA_KEY_TYPE_HMAC:"000102030405060708090a0b0c0d0e0f":PSA_ALG_CMAC:PSA_ERROR_NOT_SUPPORTED
707707

708+
PSA MAC: bad order function calls
709+
mac_bad_order:
710+
708711
PSA MAC sign: RFC4231 Test case 1 - HMAC-SHA-224
709712
depends_on:MBEDTLS_MD_C:MBEDTLS_SHA256_C
710713
mac_sign:PSA_KEY_TYPE_HMAC:"0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b":PSA_ALG_HMAC(PSA_ALG_SHA_224):"4869205468657265":"896fb1128abbdf196832107cd49df33f47b4b1169912ba4f53684b22"

‎tests/suites/test_suite_psa_crypto.function

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2168,6 +2168,8 @@ exit:
21682168
/* BEGIN_CASE */
21692169
void mac_operation_init( )
21702170
{
2171+
const uint8_t input[1] = { 0 };
2172+
21712173
/* Test each valid way of initializing the object, except for `= {0}`, as
21722174
* Clang 5 complains when `-Wmissing-field-initializers` is used, even
21732175
* though it's OK by the C standard. We could test for this, but we'd need
@@ -2178,6 +2180,17 @@ void mac_operation_init( )
21782180

21792181
memset( &zero, 0, sizeof( zero ) );
21802182

2183+
/* A default MAC operation should not be usable. */
2184+
TEST_EQUAL( psa_mac_update( &func,
2185+
input, sizeof( input ) ),
2186+
PSA_ERROR_BAD_STATE );
2187+
TEST_EQUAL( psa_mac_update( &init,
2188+
input, sizeof( input ) ),
2189+
PSA_ERROR_BAD_STATE );
2190+
TEST_EQUAL( psa_mac_update( &zero,
2191+
input, sizeof( input ) ),
2192+
PSA_ERROR_BAD_STATE );
2193+
21812194
/* A default MAC operation should be abortable without error. */
21822195
PSA_ASSERT( psa_mac_abort( &func ) );
21832196
PSA_ASSERT( psa_mac_abort( &init ) );
@@ -2220,6 +2233,122 @@ exit:
22202233
}
22212234
/* END_CASE */
22222235

2236+
/* BEGIN_CASE */
2237+
void mac_bad_order( )
2238+
{
2239+
psa_key_handle_t handle = 0;
2240+
psa_key_type_t key_type = PSA_KEY_TYPE_HMAC;
2241+
psa_algorithm_t alg = PSA_ALG_HMAC(PSA_ALG_SHA_256);
2242+
const uint8_t key[] = {
2243+
0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
2244+
0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
2245+
0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa };
2246+
psa_key_policy_t policy = PSA_KEY_POLICY_INIT;
2247+
psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT;
2248+
uint8_t sign_mac[PSA_MAC_MAX_SIZE + 10] = { 0 };
2249+
size_t sign_mac_length = 0;
2250+
const uint8_t input[] = { 0xbb, 0xbb, 0xbb, 0xbb };
2251+
const uint8_t verify_mac[] = {
2252+
0x74, 0x65, 0x93, 0x8c, 0xeb, 0x1d, 0xb3, 0x76, 0x5a, 0x38, 0xe7, 0xdd,
2253+
0x85, 0xc5, 0xad, 0x4f, 0x07, 0xe7, 0xd5, 0xb2, 0x64, 0xf0, 0x1a, 0x1a,
2254+
0x2c, 0xf9, 0x18, 0xca, 0x59, 0x7e, 0x5d, 0xf6 };
2255+
2256+
PSA_ASSERT( psa_crypto_init( ) );
2257+
PSA_ASSERT( psa_allocate_key( &handle ) );
2258+
psa_key_policy_set_usage( &policy,
2259+
PSA_KEY_USAGE_SIGN | PSA_KEY_USAGE_VERIFY,
2260+
alg );
2261+
PSA_ASSERT( psa_set_key_policy( handle, &policy ) );
2262+
2263+
PSA_ASSERT( psa_import_key( handle, key_type,
2264+
key, sizeof(key) ) );
2265+
2266+
/* Call update without calling setup beforehand. */
2267+
TEST_EQUAL( psa_mac_update( &operation, input, sizeof( input ) ),
2268+
PSA_ERROR_BAD_STATE );
2269+
PSA_ASSERT( psa_mac_abort( &operation ) );
2270+
2271+
/* Call sign finish without calling setup beforehand. */
2272+
TEST_EQUAL( psa_mac_sign_finish( &operation, sign_mac, sizeof( sign_mac ),
2273+
&sign_mac_length),
2274+
PSA_ERROR_BAD_STATE );
2275+
PSA_ASSERT( psa_mac_abort( &operation ) );
2276+
2277+
/* Call verify finish without calling setup beforehand. */
2278+
TEST_EQUAL( psa_mac_verify_finish( &operation,
2279+
verify_mac, sizeof( verify_mac ) ),
2280+
PSA_ERROR_BAD_STATE );
2281+
PSA_ASSERT( psa_mac_abort( &operation ) );
2282+
2283+
/* Call update after sign finish. */
2284+
PSA_ASSERT( psa_mac_sign_setup( &operation,
2285+
handle, alg ) );
2286+
PSA_ASSERT( psa_mac_update( &operation, input, sizeof( input ) ) );
2287+
PSA_ASSERT( psa_mac_sign_finish( &operation,
2288+
sign_mac, sizeof( sign_mac ),
2289+
&sign_mac_length ) );
2290+
TEST_EQUAL( psa_mac_update( &operation, input, sizeof( input ) ),
2291+
PSA_ERROR_BAD_STATE );
2292+
PSA_ASSERT( psa_mac_abort( &operation ) );
2293+
2294+
/* Call update after verify finish. */
2295+
PSA_ASSERT( psa_mac_verify_setup( &operation,
2296+
handle, alg ) );
2297+
PSA_ASSERT( psa_mac_update( &operation, input, sizeof( input ) ) );
2298+
PSA_ASSERT( psa_mac_verify_finish( &operation,
2299+
verify_mac, sizeof( verify_mac ) ) );
2300+
TEST_EQUAL( psa_mac_update( &operation, input, sizeof( input ) ),
2301+
PSA_ERROR_BAD_STATE );
2302+
PSA_ASSERT( psa_mac_abort( &operation ) );
2303+
2304+
/* Call sign finish twice in a row. */
2305+
PSA_ASSERT( psa_mac_sign_setup( &operation,
2306+
handle, alg ) );
2307+
PSA_ASSERT( psa_mac_update( &operation, input, sizeof( input ) ) );
2308+
PSA_ASSERT( psa_mac_sign_finish( &operation,
2309+
sign_mac, sizeof( sign_mac ),
2310+
&sign_mac_length ) );
2311+
TEST_EQUAL( psa_mac_sign_finish( &operation,
2312+
sign_mac, sizeof( sign_mac ),
2313+
&sign_mac_length ),
2314+
PSA_ERROR_BAD_STATE );
2315+
PSA_ASSERT( psa_mac_abort( &operation ) );
2316+
2317+
/* Call verify finish twice in a row. */
2318+
PSA_ASSERT( psa_mac_verify_setup( &operation,
2319+
handle, alg ) );
2320+
PSA_ASSERT( psa_mac_update( &operation, input, sizeof( input ) ) );
2321+
PSA_ASSERT( psa_mac_verify_finish( &operation,
2322+
verify_mac, sizeof( verify_mac ) ) );
2323+
TEST_EQUAL( psa_mac_verify_finish( &operation,
2324+
verify_mac, sizeof( verify_mac ) ),
2325+
PSA_ERROR_BAD_STATE );
2326+
PSA_ASSERT( psa_mac_abort( &operation ) );
2327+
2328+
/* Setup sign but try verify. */
2329+
PSA_ASSERT( psa_mac_sign_setup( &operation,
2330+
handle, alg ) );
2331+
PSA_ASSERT( psa_mac_update( &operation, input, sizeof( input ) ) );
2332+
TEST_EQUAL( psa_mac_verify_finish( &operation,
2333+
verify_mac, sizeof( verify_mac ) ),
2334+
PSA_ERROR_BAD_STATE );
2335+
PSA_ASSERT( psa_mac_abort( &operation ) );
2336+
2337+
/* Setup verify but try sign. */
2338+
PSA_ASSERT( psa_mac_verify_setup( &operation,
2339+
handle, alg ) );
2340+
PSA_ASSERT( psa_mac_update( &operation, input, sizeof( input ) ) );
2341+
TEST_EQUAL( psa_mac_sign_finish( &operation,
2342+
sign_mac, sizeof( sign_mac ),
2343+
&sign_mac_length ),
2344+
PSA_ERROR_BAD_STATE );
2345+
PSA_ASSERT( psa_mac_abort( &operation ) );
2346+
2347+
exit:
2348+
mbedtls_psa_crypto_free( );
2349+
}
2350+
/* END_CASE */
2351+
22232352
/* BEGIN_CASE */
22242353
void mac_sign( int key_type_arg,
22252354
data_t *key,
@@ -2309,6 +2438,12 @@ void mac_verify( int key_type_arg,
23092438
expected_mac->x,
23102439
expected_mac->len ) );
23112440

2441+
/* Ensure double verify fails properly. */
2442+
TEST_EQUAL( psa_mac_verify_finish( &operation,
2443+
expected_mac->x,
2444+
expected_mac->len ),
2445+
PSA_ERROR_BAD_STATE );
2446+
23122447
exit:
23132448
psa_destroy_key( handle );
23142449
mbedtls_psa_crypto_free( );

0 commit comments

Comments
 (0)