Skip to content

Commit 4d18f94

Browse files
PataterPatater
committed
psa: Disallow use of invalid MAC contexts
Ensure that when doing MAC operations out of order, PSA_ERROR_BAD_STATE is returned as documented in crypto.h and the PSA Crypto specification.
1 parent 0574e6a commit 4d18f94

File tree

3 files changed

+149
-0
lines changed

3 files changed

+149
-0
lines changed

‎library/psa_crypto.c

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2238,6 +2238,12 @@ psa_status_t psa_mac_sign_finish( psa_mac_operation_t *operation,
22382238
{
22392239
psa_status_t status;
22402240

2241+
if( operation->alg == 0)
2242+
{
2243+
status = PSA_ERROR_BAD_STATE;
2244+
goto cleanup;
2245+
}
2246+
22412247
/* Fill the output buffer with something that isn't a valid mac
22422248
* (barring an attack on the mac and deliberately-crafted input),
22432249
* in case the caller doesn't check the return status properly. */
@@ -2276,6 +2282,12 @@ psa_status_t psa_mac_verify_finish( psa_mac_operation_t *operation,
22762282
uint8_t actual_mac[PSA_MAC_MAX_SIZE];
22772283
psa_status_t status;
22782284

2285+
if( operation->alg == 0)
2286+
{
2287+
status = PSA_ERROR_BAD_STATE;
2288+
goto cleanup;
2289+
}
2290+
22792291
if( operation->is_sign )
22802292
{
22812293
status = PSA_ERROR_BAD_STATE;

‎tests/suites/test_suite_psa_crypto.data

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -705,6 +705,9 @@ depends_on:MBEDTLS_CMAC_C
705705
# Either INVALID_ARGUMENT or NOT_SUPPORTED would be reasonable here
706706
mac_setup:PSA_KEY_TYPE_HMAC:"000102030405060708090a0b0c0d0e0f":PSA_ALG_CMAC:PSA_ERROR_NOT_SUPPORTED
707707

708+
PSA MAC: bad order function calls
709+
mac_bad_order:
710+
708711
PSA MAC sign: RFC4231 Test case 1 - HMAC-SHA-224
709712
depends_on:MBEDTLS_MD_C:MBEDTLS_SHA256_C
710713
mac_sign:PSA_KEY_TYPE_HMAC:"0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b":PSA_ALG_HMAC(PSA_ALG_SHA_224):"4869205468657265":"896fb1128abbdf196832107cd49df33f47b4b1169912ba4f53684b22"

‎tests/suites/test_suite_psa_crypto.function

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2168,6 +2168,8 @@ exit:
21682168
/* BEGIN_CASE */
21692169
void mac_operation_init( )
21702170
{
2171+
const uint8_t input[1];
2172+
21712173
/* Test each valid way of initializing the object, except for `= {0}`, as
21722174
* Clang 5 complains when `-Wmissing-field-initializers` is used, even
21732175
* though it's OK by the C standard. We could test for this, but we'd need
@@ -2178,6 +2180,17 @@ void mac_operation_init( )
21782180

21792181
memset( &zero, 0, sizeof( zero ) );
21802182

2183+
/* A default MAC operation should not be usable. */
2184+
TEST_EQUAL( psa_mac_update( &func,
2185+
input, sizeof( input ) ),
2186+
PSA_ERROR_BAD_STATE );
2187+
TEST_EQUAL( psa_mac_update( &init,
2188+
input, sizeof( input ) ),
2189+
PSA_ERROR_BAD_STATE );
2190+
TEST_EQUAL( psa_mac_update( &zero,
2191+
input, sizeof( input ) ),
2192+
PSA_ERROR_BAD_STATE );
2193+
21812194
/* A default MAC operation should be abortable without error. */
21822195
PSA_ASSERT( psa_mac_abort( &func ) );
21832196
PSA_ASSERT( psa_mac_abort( &init ) );
@@ -2220,6 +2233,119 @@ exit:
22202233
}
22212234
/* END_CASE */
22222235

2236+
/* BEGIN_CASE */
2237+
void mac_bad_order( )
2238+
{
2239+
psa_key_handle_t handle = 0;
2240+
psa_key_type_t key_type = PSA_KEY_TYPE_HMAC;
2241+
psa_algorithm_t alg = PSA_ALG_HMAC(PSA_ALG_SHA_256);
2242+
const uint8_t key[] = {
2243+
0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
2244+
0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
2245+
0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa };
2246+
psa_key_policy_t policy = PSA_KEY_POLICY_INIT;
2247+
psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT;
2248+
uint8_t sign_mac[PSA_MAC_MAX_SIZE + 10] = { 0 };
2249+
size_t sign_mac_length = 0;
2250+
const uint8_t input[] = { 0xbb, 0xbb, 0xbb, 0xbb };
2251+
const uint8_t verify_mac[] = {
2252+
0x74, 0x65, 0x93, 0x8c, 0xeb, 0x1d, 0xb3, 0x76, 0x5a, 0x38, 0xe7, 0xdd,
2253+
0x85, 0xc5, 0xad, 0x4f, 0x07, 0xe7, 0xd5, 0xb2, 0x64, 0xf0, 0x1a, 0x1a,
2254+
0x2c, 0xf9, 0x18, 0xca, 0x59, 0x7e, 0x5d, 0xf6 };
2255+
2256+
PSA_ASSERT( psa_crypto_init( ) );
2257+
PSA_ASSERT( psa_allocate_key( &handle ) );
2258+
psa_key_policy_set_usage( &policy,
2259+
PSA_KEY_USAGE_SIGN | PSA_KEY_USAGE_VERIFY,
2260+
alg );
2261+
PSA_ASSERT( psa_set_key_policy( handle, &policy ) );
2262+
2263+
PSA_ASSERT( psa_import_key( handle, key_type,
2264+
key, sizeof(key) ) );
2265+
2266+
/* Call update without calling setup beforehand. */
2267+
TEST_EQUAL( psa_mac_update( &operation, input, sizeof( input ) ),
2268+
PSA_ERROR_BAD_STATE );
2269+
2270+
/* Call finish without calling setup beforehand. */
2271+
memset( &operation, 0, sizeof( operation ) );
2272+
TEST_EQUAL( psa_mac_sign_finish( &operation, sign_mac, sizeof( sign_mac ),
2273+
&sign_mac_length),
2274+
PSA_ERROR_BAD_STATE );
2275+
memset( &operation, 0, sizeof( operation ) );
2276+
TEST_EQUAL( psa_mac_verify_finish( &operation,
2277+
verify_mac, sizeof( verify_mac ) ),
2278+
PSA_ERROR_BAD_STATE );
2279+
2280+
/* Call update after sign finish. */
2281+
memset( &operation, 0, sizeof( operation ) );
2282+
PSA_ASSERT( psa_mac_sign_setup( &operation,
2283+
handle, alg ) );
2284+
PSA_ASSERT( psa_mac_update( &operation, input, sizeof( input ) ) );
2285+
PSA_ASSERT( psa_mac_sign_finish( &operation,
2286+
sign_mac, sizeof( sign_mac ),
2287+
&sign_mac_length ) );
2288+
TEST_EQUAL( psa_mac_update( &operation, input, sizeof( input ) ),
2289+
PSA_ERROR_BAD_STATE );
2290+
2291+
/* Call update after verify finish. */
2292+
memset( &operation, 0, sizeof( operation ) );
2293+
PSA_ASSERT( psa_mac_verify_setup( &operation,
2294+
handle, alg ) );
2295+
PSA_ASSERT( psa_mac_update( &operation, input, sizeof( input ) ) );
2296+
PSA_ASSERT( psa_mac_verify_finish( &operation,
2297+
verify_mac, sizeof( verify_mac ) ) );
2298+
TEST_EQUAL( psa_mac_update( &operation, input, sizeof( input ) ),
2299+
PSA_ERROR_BAD_STATE );
2300+
2301+
/* Call sign finish twice in a row. */
2302+
memset( &operation, 0, sizeof( operation ) );
2303+
PSA_ASSERT( psa_mac_sign_setup( &operation,
2304+
handle, alg ) );
2305+
PSA_ASSERT( psa_mac_update( &operation, input, sizeof( input ) ) );
2306+
PSA_ASSERT( psa_mac_sign_finish( &operation,
2307+
sign_mac, sizeof( sign_mac ),
2308+
&sign_mac_length ) );
2309+
TEST_EQUAL( psa_mac_sign_finish( &operation,
2310+
sign_mac, sizeof( sign_mac ),
2311+
&sign_mac_length ),
2312+
PSA_ERROR_BAD_STATE );
2313+
2314+
/* Call verify finish twice in a row. */
2315+
memset( &operation, 0, sizeof( operation ) );
2316+
PSA_ASSERT( psa_mac_verify_setup( &operation,
2317+
handle, alg ) );
2318+
PSA_ASSERT( psa_mac_update( &operation, input, sizeof( input ) ) );
2319+
PSA_ASSERT( psa_mac_verify_finish( &operation,
2320+
verify_mac, sizeof( verify_mac ) ) );
2321+
TEST_EQUAL( psa_mac_verify_finish( &operation,
2322+
verify_mac, sizeof( verify_mac ) ),
2323+
PSA_ERROR_BAD_STATE );
2324+
2325+
/* Setup sign but try verify. */
2326+
memset( &operation, 0, sizeof( operation ) );
2327+
PSA_ASSERT( psa_mac_sign_setup( &operation,
2328+
handle, alg ) );
2329+
PSA_ASSERT( psa_mac_update( &operation, input, sizeof( input ) ) );
2330+
TEST_EQUAL( psa_mac_verify_finish( &operation,
2331+
verify_mac, sizeof( verify_mac ) ),
2332+
PSA_ERROR_BAD_STATE );
2333+
2334+
/* Setup verify but try sign. */
2335+
memset( &operation, 0, sizeof( operation ) );
2336+
PSA_ASSERT( psa_mac_verify_setup( &operation,
2337+
handle, alg ) );
2338+
PSA_ASSERT( psa_mac_update( &operation, input, sizeof( input ) ) );
2339+
TEST_EQUAL( psa_mac_sign_finish( &operation,
2340+
sign_mac, sizeof( sign_mac ),
2341+
&sign_mac_length ),
2342+
PSA_ERROR_BAD_STATE );
2343+
2344+
exit:
2345+
mbedtls_psa_crypto_free( );
2346+
}
2347+
/* END_CASE */
2348+
22232349
/* BEGIN_CASE */
22242350
void mac_sign( int key_type_arg,
22252351
data_t *key,
@@ -2262,6 +2388,8 @@ void mac_sign( int key_type_arg,
22622388
actual_mac, mac_buffer_size,
22632389
&mac_length ) );
22642390

2391+
/* Ensure double sign fails properly. */
2392+
22652393
/* Compare with the expected value. */
22662394
ASSERT_COMPARE( expected_mac->x, expected_mac->len,
22672395
actual_mac, mac_length );
@@ -2309,6 +2437,12 @@ void mac_verify( int key_type_arg,
23092437
expected_mac->x,
23102438
expected_mac->len ) );
23112439

2440+
/* Ensure double verify fails properly. */
2441+
TEST_EQUAL( psa_mac_verify_finish( &operation,
2442+
expected_mac->x,
2443+
expected_mac->len ),
2444+
PSA_ERROR_BAD_STATE );
2445+
23122446
exit:
23132447
psa_destroy_key( handle );
23142448
mbedtls_psa_crypto_free( );

0 commit comments

Comments
 (0)