From 72d7bb4bca913a5ef46f3b992e1a9416ea2cfc39 Mon Sep 17 00:00:00 2001
From: Yanray Wang <yanray.wang@arm.com>
Date: Wed, 30 Aug 2023 13:58:15 +0800
Subject: [PATCH] check_config.h: add checks for CIPHER_ENCRYPT_ONLY

MBEDTLS_CIPHER_ENCRYPT_ONLY is an internal configuration which is
automatically enabled via the PSA. Typically,
once MBEDTLS_CIPHER_ENCRYPT_ONLY is enabled,
MBEDTLS_PSA_CRYPTO_CONFIG must be enabled. This check is only used
to prevent user explicitly enabling MBEDTLS_CIPHER_ENCRYPT_ONLY.

In addition, we shouldn't enable MBEDTLS_CIPHER_ENCRYPT_ONLY if
either CIPHER_MODE_CBC, CIPHER_MODE_XTS or NIST_KW_C is enabled.
Since three of them always need AES-decrypt.

Signed-off-by: Yanray Wang <yanray.wang@arm.com>
---
 include/mbedtls/check_config.h |  8 ++++++++
 include/mbedtls/config_psa.h   | 13 ++++++++-----
 2 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/include/mbedtls/check_config.h b/include/mbedtls/check_config.h
index ca267bdd8..c64e9c3de 100644
--- a/include/mbedtls/check_config.h
+++ b/include/mbedtls/check_config.h
@@ -84,6 +84,14 @@
 #error "MBEDTLS_NIST_KW_C defined, but not all prerequisites"
 #endif
 
+#if defined(MBEDTLS_CIPHER_ENCRYPT_ONLY) && \
+    (!defined(MBEDTLS_PSA_CRYPTO_CONFIG) || \
+    (defined(MBEDTLS_CIPHER_MODE_CBC) || \
+     defined(MBEDTLS_CIPHER_MODE_XTS) || \
+     defined(MBEDTLS_NIST_KW_C)))
+#error "MBEDTLS_CIPHER_ENCRYPT_ONLY defined, but not all prerequisites"
+#endif
+
 #if defined(MBEDTLS_ECDH_C) && !defined(MBEDTLS_ECP_C)
 #error "MBEDTLS_ECDH_C defined, but not all prerequisites"
 #endif
diff --git a/include/mbedtls/config_psa.h b/include/mbedtls/config_psa.h
index f558ed82b..9d68a3428 100644
--- a/include/mbedtls/config_psa.h
+++ b/include/mbedtls/config_psa.h
@@ -599,15 +599,18 @@
 #endif /* PSA_WANT_ALG_CHACHA20_POLY1305 */
 
 /*
- * ECB, CBC, XTS modes require both ENCRYPT and DECRYPT directions.
- * CIPHER_ENCRYPT_ONLY is only enabled when those modes are not requested
- * via the PSA API.
+ * ECB, CBC, XTS, KW modes require both ENCRYPT and DECRYPT directions.
+ * MBEDTLS_CIPHER_ENCRYPT_ONLY is only enabled when those modes
+ * are not requested via the PSA API and are not enabled in the legacy API.
  *
- * Note: XTS is not yet supported via the PSA API in Mbed TLS.
+ * Note: XTS, KW are not yet supported via the PSA API in Mbed TLS.
  */
 #if !defined(PSA_WANT_ALG_ECB_NO_PADDING) && \
     !defined(PSA_WANT_ALG_CBC_NO_PADDING) && \
-    !defined(PSA_WANT_ALG_CBC_PKCS7)
+    !defined(PSA_WANT_ALG_CBC_PKCS7) && \
+    !defined(MBEDTLS_CIPHER_MODE_CBC) && \
+    !defined(MBEDTLS_CIPHER_MODE_XTS) && \
+    !defined(MBEDTLS_NIST_KW_C)
 #define MBEDTLS_CIPHER_ENCRYPT_ONLY 1
 #endif