Skip to content

Commit 86016a0

Browse files
PataterPatater
committed
Merge remote-tracking branch 'origin/pr/2338' into development
2 parents e895342 + 85fd913 commit 86016a0

File tree

7 files changed

+441
-45
lines changed

7 files changed

+441
-45
lines changed

‎include/mbedtls/check_config.h

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -114,14 +114,15 @@
114114
#endif
115115

116116
#if defined(MBEDTLS_ECP_RESTARTABLE) && \
117-
( defined(MBEDTLS_ECDH_COMPUTE_SHARED_ALT) || \
117+
( defined(MBEDTLS_USE_PSA_CRYPTO) || \
118+
defined(MBEDTLS_ECDH_COMPUTE_SHARED_ALT) || \
118119
defined(MBEDTLS_ECDH_GEN_PUBLIC_ALT) || \
119120
defined(MBEDTLS_ECDSA_SIGN_ALT) || \
120121
defined(MBEDTLS_ECDSA_VERIFY_ALT) || \
121122
defined(MBEDTLS_ECDSA_GENKEY_ALT) || \
122123
defined(MBEDTLS_ECP_INTERNAL_ALT) || \
123124
defined(MBEDTLS_ECP_ALT) )
124-
#error "MBEDTLS_ECP_RESTARTABLE defined, but it cannot coexist with an alternative ECP implementation"
125+
#error "MBEDTLS_ECP_RESTARTABLE defined, but it cannot coexist with an alternative or PSA-based ECP implementation"
125126
#endif
126127

127128
#if defined(MBEDTLS_ECDSA_DETERMINISTIC) && !defined(MBEDTLS_HMAC_DRBG_C)

‎include/mbedtls/psa_util.h

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,8 @@
4343
#include "pk.h"
4444
#include "oid.h"
4545

46+
#include <string.h>
47+
4648
/* Translations for symmetric crypto. */
4749

4850
static inline psa_key_type_t mbedtls_psa_translate_cipher_type(
@@ -233,6 +235,86 @@ static inline int mbedtls_psa_get_ecc_oid_from_id(
233235
return( -1 );
234236
}
235237

238+
#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH 1
239+
240+
#if defined(MBEDTLS_ECP_DP_SECP192R1_ENABLED)
241+
#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 192 + 7 ) / 8 ) + 1 )
242+
#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH
243+
#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 192 + 7 ) / 8 ) + 1 )
244+
#endif
245+
#endif /* MBEDTLS_ECP_DP_SECP192R1_ENABLED */
246+
247+
#if defined(MBEDTLS_ECP_DP_SECP224R1_ENABLED)
248+
#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 224 + 7 ) / 8 ) + 1 )
249+
#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH
250+
#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 224 + 7 ) / 8 ) + 1 )
251+
#endif
252+
#endif /* MBEDTLS_ECP_DP_SECP224R1_ENABLED */
253+
254+
#if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
255+
#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 256 + 7 ) / 8 ) + 1 )
256+
#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH
257+
#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 256 + 7 ) / 8 ) + 1 )
258+
#endif
259+
#endif /* MBEDTLS_ECP_DP_SECP256R1_ENABLED */
260+
261+
#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
262+
#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 384 + 7 ) / 8 ) + 1 )
263+
#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH
264+
#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 384 + 7 ) / 8 ) + 1 )
265+
#endif
266+
#endif /* MBEDTLS_ECP_DP_SECP384R1_ENABLED */
267+
268+
#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
269+
#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 521 + 7 ) / 8 ) + 1 )
270+
#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH
271+
#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 521 + 7 ) / 8 ) + 1 )
272+
#endif
273+
#endif /* MBEDTLS_ECP_DP_SECP521R1_ENABLED */
274+
275+
#if defined(MBEDTLS_ECP_DP_SECP192K1_ENABLED)
276+
#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 192 + 7 ) / 8 ) + 1 )
277+
#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH
278+
#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 192 + 7 ) / 8 ) + 1 )
279+
#endif
280+
#endif /* MBEDTLS_ECP_DP_SECP192K1_ENABLED */
281+
282+
#if defined(MBEDTLS_ECP_DP_SECP224K1_ENABLED)
283+
#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 224 + 7 ) / 8 ) + 1 )
284+
#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH
285+
#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 224 + 7 ) / 8 ) + 1 )
286+
#endif
287+
#endif /* MBEDTLS_ECP_DP_SECP224K1_ENABLED */
288+
289+
#if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
290+
#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 256 + 7 ) / 8 ) + 1 )
291+
#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH
292+
#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 256 + 7 ) / 8 ) + 1 )
293+
#endif
294+
#endif /* MBEDTLS_ECP_DP_SECP256K1_ENABLED */
295+
296+
#if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
297+
#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 256 + 7 ) / 8 ) + 1 )
298+
#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH
299+
#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 256 + 7 ) / 8 ) + 1 )
300+
#endif
301+
#endif /* MBEDTLS_ECP_DP_BP256R1_ENABLED */
302+
303+
#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
304+
#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 384 + 7 ) / 8 ) + 1 )
305+
#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH
306+
#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 384 + 7 ) / 8 ) + 1 )
307+
#endif
308+
#endif /* MBEDTLS_ECP_DP_BP384R1_ENABLED */
309+
310+
#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
311+
#if MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH < ( 2 * ( ( 512 + 7 ) / 8 ) + 1 )
312+
#undef MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH
313+
#define MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH ( 2 * ( ( 512 + 7 ) / 8 ) + 1 )
314+
#endif
315+
#endif /* MBEDTLS_ECP_DP_BP512R1_ENABLED */
316+
317+
236318
static inline psa_ecc_curve_t mbedtls_psa_translate_ecc_group( mbedtls_ecp_group_id grpid )
237319
{
238320
switch( grpid )
@@ -294,6 +376,7 @@ static inline psa_ecc_curve_t mbedtls_psa_translate_ecc_group( mbedtls_ecp_group
294376
}
295377
}
296378

379+
297380
#define MBEDTLS_PSA_ECC_KEY_BITS_OF_CURVE( curve ) \
298381
( curve == PSA_ECC_CURVE_SECP192R1 ? 192 : \
299382
curve == PSA_ECC_CURVE_SECP224R1 ? 224 : \
@@ -352,6 +435,48 @@ static inline psa_ecc_curve_t mbedtls_psa_parse_tls_ecc_group(
352435
return( (psa_ecc_curve_t) tls_ecc_grp_reg_id );
353436
}
354437

438+
/* This function takes a buffer holding an EC public key
439+
* exported through psa_export_public_key(), and converts
440+
* it into an ECPoint structure to be put into a ClientKeyExchange
441+
* message in an ECDHE exchange.
442+
*
443+
* Both the present and the foreseeable future format of EC public keys
444+
* used by PSA have the ECPoint structure contained in the exported key
445+
* as a subbuffer, and the function merely selects this subbuffer instead
446+
* of making a copy.
447+
*/
448+
static inline int mbedtls_psa_tls_psa_ec_to_ecpoint( unsigned char *src,
449+
size_t srclen,
450+
unsigned char **dst,
451+
size_t *dstlen )
452+
{
453+
*dst = src;
454+
*dstlen = srclen;
455+
return( 0 );
456+
}
457+
458+
/* This function takes a buffer holding an ECPoint structure
459+
* (as contained in a TLS ServerKeyExchange message for ECDHE
460+
* exchanges) and converts it into a format that the PSA key
461+
* agreement API understands.
462+
*/
463+
static inline int mbedtls_psa_tls_ecpoint_to_psa_ec( psa_ecc_curve_t curve,
464+
unsigned char const *src,
465+
size_t srclen,
466+
unsigned char *dst,
467+
size_t dstlen,
468+
size_t *olen )
469+
{
470+
((void) curve);
471+
472+
if( srclen > dstlen )
473+
return( MBEDTLS_ERR_ECP_BUFFER_TOO_SMALL );
474+
475+
memcpy( dst, src, srclen );
476+
*olen = srclen;
477+
return( 0 );
478+
}
479+
355480
#endif /* MBEDTLS_USE_PSA_CRYPTO */
356481

357482
#endif /* MBEDTLS_PSA_UTIL_H */

‎include/mbedtls/ssl_internal.h

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,11 @@
5757
#include "ecjpake.h"
5858
#endif
5959

60+
#if defined(MBEDTLS_USE_PSA_CRYPTO)
61+
#include "psa/crypto.h"
62+
#include "psa_util.h"
63+
#endif /* MBEDTLS_USE_PSA_CRYPTO */
64+
6065
#if ( defined(__ARMCC_VERSION) || defined(_MSC_VER) ) && \
6166
!defined(inline) && !defined(__cplusplus)
6267
#define inline __inline
@@ -280,7 +285,15 @@ struct mbedtls_ssl_handshake_params
280285
#endif
281286
#if defined(MBEDTLS_ECDH_C)
282287
mbedtls_ecdh_context ecdh_ctx; /*!< ECDH key exchange */
283-
#endif
288+
289+
#if defined(MBEDTLS_USE_PSA_CRYPTO)
290+
psa_ecc_curve_t ecdh_psa_curve;
291+
psa_key_handle_t ecdh_psa_privkey;
292+
unsigned char ecdh_psa_peerkey[MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH];
293+
size_t ecdh_psa_peerkey_len;
294+
#endif /* MBEDTLS_USE_PSA_CRYPTO */
295+
#endif /* MBEDTLS_ECDH_C */
296+
284297
#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
285298
mbedtls_ecjpake_context ecjpake_ctx; /*!< EC J-PAKE key exchange */
286299
#if defined(MBEDTLS_SSL_CLI_C)

0 commit comments

Comments
 (0)