Skip to content

Commit 73ddd05

Browse files
PataterPatater
committed
psa: Disallow use of invalid cipher contexts
Ensure that when doing cipher operations out of order, PSA_ERROR_BAD_STATE is returned as documented in crypto.h and the PSA Crypto specification.
1 parent ef04983 commit 73ddd05

File tree

3 files changed

+171
-0
lines changed

3 files changed

+171
-0
lines changed

‎library/psa_crypto.c

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3075,6 +3075,13 @@ psa_status_t psa_cipher_update( psa_cipher_operation_t *operation,
30753075
psa_status_t status;
30763076
int ret;
30773077
size_t expected_output_size;
3078+
3079+
if( operation->alg == 0)
3080+
{
3081+
status = PSA_ERROR_BAD_STATE;
3082+
goto exit;
3083+
}
3084+
30783085
if( ! PSA_ALG_IS_STREAM_CIPHER( operation->alg ) )
30793086
{
30803087
/* Take the unprocessed partial block left over from previous

‎tests/suites/test_suite_psa_crypto.data

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -925,6 +925,9 @@ depends_on:MBEDTLS_ARC4_C:MBEDTLS_CIPHER_MODE_CTR
925925
# Either INVALID_ARGUMENT or NOT_SUPPORTED would be reasonable here
926926
cipher_setup:PSA_KEY_TYPE_ARC4:"000102030405060708090a0b0c0d0e0f":PSA_ALG_CTR:PSA_ERROR_NOT_SUPPORTED
927927

928+
PSA cipher: bad order function calls
929+
cipher_bad_order:
930+
928931
PSA symmetric encrypt: AES-CBC-nopad, 16 bytes, good
929932
depends_on:MBEDTLS_AES_C:MBEDTLS_CIPHER_MODE_CBC
930933
cipher_encrypt:PSA_ALG_CBC_NO_PADDING:PSA_KEY_TYPE_AES:"2b7e151628aed2a6abf7158809cf4f3c":"6bc1bee22e409f96e93d7e117393172a":"a076ec9dfbe47d52afc357336f20743b":PSA_SUCCESS

‎tests/suites/test_suite_psa_crypto.function

Lines changed: 161 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2455,6 +2455,9 @@ exit:
24552455
/* BEGIN_CASE */
24562456
void cipher_operation_init( )
24572457
{
2458+
const uint8_t input[1];
2459+
unsigned char output[1];
2460+
size_t output_length;
24582461
/* Test each valid way of initializing the object, except for `= {0}`, as
24592462
* Clang 5 complains when `-Wmissing-field-initializers` is used, even
24602463
* though it's OK by the C standard. We could test for this, but we'd need
@@ -2465,6 +2468,23 @@ void cipher_operation_init( )
24652468

24662469
memset( &zero, 0, sizeof( zero ) );
24672470

2471+
/* A default cipher operation should not be usable. */
2472+
TEST_EQUAL( psa_cipher_update( &func,
2473+
input, sizeof( input ),
2474+
output, sizeof( output ),
2475+
&output_length ),
2476+
PSA_ERROR_BAD_STATE );
2477+
TEST_EQUAL( psa_cipher_update( &init,
2478+
input, sizeof( input ),
2479+
output, sizeof( output ),
2480+
&output_length ),
2481+
PSA_ERROR_BAD_STATE );
2482+
TEST_EQUAL( psa_cipher_update( &zero,
2483+
input, sizeof( input ),
2484+
output, sizeof( output ),
2485+
&output_length ),
2486+
PSA_ERROR_BAD_STATE );
2487+
24682488
/* A default cipher operation should be abortable without error. */
24692489
PSA_ASSERT( psa_cipher_abort( &func ) );
24702490
PSA_ASSERT( psa_cipher_abort( &init ) );
@@ -2505,6 +2525,147 @@ exit:
25052525
}
25062526
/* END_CASE */
25072527

2528+
/* BEGIN_CASE */
2529+
void cipher_bad_order( )
2530+
{
2531+
psa_key_handle_t handle = 0;
2532+
psa_key_type_t key_type = PSA_KEY_TYPE_AES;
2533+
psa_algorithm_t alg = PSA_ALG_CBC_PKCS7;
2534+
psa_key_policy_t policy = PSA_KEY_POLICY_INIT;
2535+
psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT;
2536+
unsigned char iv[PSA_BLOCK_CIPHER_BLOCK_SIZE(PSA_KEY_TYPE_AES)] = { 0 };
2537+
const uint8_t key[] = {
2538+
0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa, 0xaa,
2539+
0xaa, 0xaa, 0xaa, 0xaa };
2540+
const uint8_t text[] = {
2541+
0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0xbb,
2542+
0xbb, 0xbb, 0xbb, 0xbb };
2543+
uint8_t buffer[PSA_BLOCK_CIPHER_BLOCK_SIZE(PSA_KEY_TYPE_AES)] = { 0 };
2544+
size_t length = 0;
2545+
2546+
PSA_ASSERT( psa_crypto_init( ) );
2547+
PSA_ASSERT( psa_allocate_key( &handle ) );
2548+
psa_key_policy_set_usage( &policy,
2549+
PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT,
2550+
alg );
2551+
PSA_ASSERT( psa_set_key_policy( handle, &policy ) );
2552+
PSA_ASSERT( psa_import_key( handle, key_type,
2553+
key, sizeof(key) ) );
2554+
2555+
2556+
/* Generate an IV without calling setup beforehand. */
2557+
TEST_EQUAL( psa_cipher_generate_iv( &operation,
2558+
buffer, sizeof( buffer ),
2559+
&length ),
2560+
PSA_ERROR_BAD_STATE );
2561+
PSA_ASSERT( psa_cipher_abort( &operation ) );
2562+
2563+
/* Generate an IV twice in a row. */
2564+
PSA_ASSERT( psa_cipher_encrypt_setup( &operation, handle, alg ) );
2565+
PSA_ASSERT( psa_cipher_generate_iv( &operation,
2566+
buffer, sizeof( buffer ),
2567+
&length ) );
2568+
TEST_EQUAL( psa_cipher_generate_iv( &operation,
2569+
buffer, sizeof( buffer ),
2570+
&length ),
2571+
PSA_ERROR_BAD_STATE );
2572+
PSA_ASSERT( psa_cipher_abort( &operation ) );
2573+
2574+
/* Generate an IV after it's already set. */
2575+
PSA_ASSERT( psa_cipher_encrypt_setup( &operation, handle, alg ) );
2576+
PSA_ASSERT( psa_cipher_set_iv( &operation,
2577+
iv, sizeof( iv ) ) );
2578+
TEST_EQUAL( psa_cipher_generate_iv( &operation,
2579+
buffer, sizeof( buffer ),
2580+
&length ),
2581+
PSA_ERROR_BAD_STATE );
2582+
PSA_ASSERT( psa_cipher_abort( &operation ) );
2583+
2584+
/* Set an IV without calling setup beforehand. */
2585+
TEST_EQUAL( psa_cipher_set_iv( &operation,
2586+
iv, sizeof( iv ) ),
2587+
PSA_ERROR_BAD_STATE );
2588+
PSA_ASSERT( psa_cipher_abort( &operation ) );
2589+
2590+
/* Set an IV after it's already set. */
2591+
PSA_ASSERT( psa_cipher_encrypt_setup( &operation, handle, alg ) );
2592+
PSA_ASSERT( psa_cipher_set_iv( &operation,
2593+
iv, sizeof( iv ) ) );
2594+
TEST_EQUAL( psa_cipher_set_iv( &operation,
2595+
iv, sizeof( iv ) ),
2596+
PSA_ERROR_BAD_STATE );
2597+
PSA_ASSERT( psa_cipher_abort( &operation ) );
2598+
2599+
/* Set an IV after it's already generated. */
2600+
PSA_ASSERT( psa_cipher_encrypt_setup( &operation, handle, alg ) );
2601+
PSA_ASSERT( psa_cipher_generate_iv( &operation,
2602+
buffer, sizeof( buffer ),
2603+
&length ) );
2604+
TEST_EQUAL( psa_cipher_set_iv( &operation,
2605+
iv, sizeof( iv ) ),
2606+
PSA_ERROR_BAD_STATE );
2607+
PSA_ASSERT( psa_cipher_abort( &operation ) );
2608+
2609+
/* Call update without calling setup beforehand. */
2610+
TEST_EQUAL( psa_cipher_update( &operation,
2611+
text, sizeof( text ),
2612+
buffer, sizeof( buffer ),
2613+
&length ),
2614+
PSA_ERROR_BAD_STATE );
2615+
PSA_ASSERT( psa_cipher_abort( &operation ) );
2616+
2617+
/* Call update without an IV where an IV is required. */
2618+
TEST_EQUAL( psa_cipher_update( &operation,
2619+
text, sizeof( text ),
2620+
buffer, sizeof( buffer ),
2621+
&length ),
2622+
PSA_ERROR_BAD_STATE );
2623+
PSA_ASSERT( psa_cipher_abort( &operation ) );
2624+
2625+
/* Call update after finish. */
2626+
PSA_ASSERT( psa_cipher_encrypt_setup( &operation, handle, alg ) );
2627+
PSA_ASSERT( psa_cipher_set_iv( &operation,
2628+
iv, sizeof( iv ) ) );
2629+
PSA_ASSERT( psa_cipher_finish( &operation,
2630+
buffer, sizeof( buffer ), &length ) );
2631+
TEST_EQUAL( psa_cipher_update( &operation,
2632+
text, sizeof( text ),
2633+
buffer, sizeof( buffer ),
2634+
&length ),
2635+
PSA_ERROR_BAD_STATE );
2636+
PSA_ASSERT( psa_cipher_abort( &operation ) );
2637+
2638+
/* Call finish without calling setup beforehand. */
2639+
TEST_EQUAL( psa_cipher_finish( &operation,
2640+
buffer, sizeof( buffer ), &length ),
2641+
PSA_ERROR_BAD_STATE );
2642+
PSA_ASSERT( psa_cipher_abort( &operation ) );
2643+
2644+
/* Call finish without an IV where an IV is required. */
2645+
PSA_ASSERT( psa_cipher_encrypt_setup( &operation, handle, alg ) );
2646+
/* Not calling update means we are encrypting an empty buffer, which is OK
2647+
* for cipher modes with padding. */
2648+
TEST_EQUAL( psa_cipher_finish( &operation,
2649+
buffer, sizeof( buffer ), &length ),
2650+
PSA_ERROR_BAD_STATE );
2651+
PSA_ASSERT( psa_cipher_abort( &operation ) );
2652+
2653+
/* Call finish twice in a row. */
2654+
PSA_ASSERT( psa_cipher_encrypt_setup( &operation, handle, alg ) );
2655+
PSA_ASSERT( psa_cipher_set_iv( &operation,
2656+
iv, sizeof( iv ) ) );
2657+
PSA_ASSERT( psa_cipher_finish( &operation,
2658+
buffer, sizeof( buffer ), &length ) );
2659+
TEST_EQUAL( psa_cipher_finish( &operation,
2660+
buffer, sizeof( buffer ), &length ),
2661+
PSA_ERROR_BAD_STATE );
2662+
PSA_ASSERT( psa_cipher_abort( &operation ) );
2663+
2664+
exit:
2665+
mbedtls_psa_crypto_free( );
2666+
}
2667+
/* END_CASE */
2668+
25082669
/* BEGIN_CASE */
25092670
void cipher_encrypt( int alg_arg, int key_type_arg,
25102671
data_t *key,

0 commit comments

Comments
 (0)