eden-emu/mbedtls
15
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

generate/derive key ext: pass method_data_length rather than method_length

Browse source 
Instead of passing the size of the whole structure, just pass the data
length and let the implementation worry about adding the size of the
structure. The intent with passing the structure size was to allow
the client code in a client-server implementation to know nothing
about the structure and just copy the bytes to the server. But that was not
really a useful consideration since the application has to know the
structure layout, so it has to be available in the client implementation's
headers. Passing the method data length makes life simpler for everyone by
not having to worry about possible padding at the end of the structure, and
removes a potential error condition
(method_length < sizeof(psa_key_generation_method_t)).

Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
This commit is contained in:
Gilles Peskine 2024-02-14 20:51:28 +01:00
parent 7a18f9645c
commit c81393b2ed
7 changed files with 56 additions and 95 deletions
Download patch file Download diff file Expand all files Collapse all files

41
library/psa_crypto.c
View file

@ -6027,12 +6027,12 @@ static const psa_key_generation_method_t default_method = PSA_KEY_GENERATION_MET
static int psa_key_generation_method_is_default(
const psa_key_generation_method_t *method,
size_t method_length)
size_t method_data_length)
{
if (method_length != sizeof(*method)) {
if (method->flags != 0) {
return 0;
}
if (method->flags != 0) {
if (method_data_length != 0) {
return 0;
}
return 1;
@ -6042,7 +6042,7 @@ psa_status_t psa_key_derivation_output_key_ext(
const psa_key_attributes_t *attributes,
psa_key_derivation_operation_t *operation,
const psa_key_generation_method_t *method,
size_t method_length,
size_t method_data_length,
mbedtls_svc_key_id_t *key)
{
psa_status_t status;
@ -6057,10 +6057,7 @@ psa_status_t psa_key_derivation_output_key_ext(
return PSA_ERROR_INVALID_ARGUMENT;
}
if (method_length < sizeof(*method)) {
return PSA_ERROR_INVALID_ARGUMENT;
}
if (!psa_key_generation_method_is_default(method, method_length)) {
if (!psa_key_generation_method_is_default(method, method_data_length)) {
return PSA_ERROR_INVALID_ARGUMENT;
}
@ -6100,10 +6097,9 @@ psa_status_t psa_key_derivation_output_key(
psa_key_derivation_operation_t *operation,
mbedtls_svc_key_id_t *key)
{
return psa_key_derivation_output_key_ext(
attributes, operation,
&default_method, sizeof(default_method),
key);
return psa_key_derivation_output_key_ext(attributes, operation,
&default_method, 0,
key);
}
@ -7501,7 +7497,7 @@ static psa_status_t psa_validate_key_type_and_size_for_key_generation(
psa_status_t psa_generate_key_internal(
const psa_key_attributes_t *attributes,
const psa_key_generation_method_t *method, size_t method_length,
const psa_key_generation_method_t *method, size_t method_data_length,
uint8_t *key_buffer, size_t key_buffer_size, size_t *key_buffer_length)
{
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
@ -7509,7 +7505,7 @@ psa_status_t psa_generate_key_internal(
/* Only used for RSA */
(void) method;
(void) method_length;
(void) method_data_length;
if ((attributes->domain_parameters == NULL) &&
(attributes->domain_parameters_size != 0)) {
@ -7536,9 +7532,8 @@ psa_status_t psa_generate_key_internal(
* that mbedtls_psa_rsa_generate_key() gets e via a new
* parameter instead. */
psa_key_attributes_t override_attributes = *attributes;
if (method_length > sizeof(*method)) {
override_attributes.domain_parameters_size =
method_length - offsetof(psa_key_generation_method_t, data);
if (method_data_length != 0) {
override_attributes.domain_parameters_size = method_data_length;
override_attributes.domain_parameters = (uint8_t *) &method->data;
}
return mbedtls_psa_rsa_generate_key(&override_attributes,
@ -7575,7 +7570,7 @@ psa_status_t psa_generate_key_internal(
psa_status_t psa_generate_key_ext(const psa_key_attributes_t *attributes,
const psa_key_generation_method_t *method,
size_t method_length,
size_t method_data_length,
mbedtls_svc_key_id_t *key)
{
psa_status_t status;
@ -7596,10 +7591,6 @@ psa_status_t psa_generate_key_ext(const psa_key_attributes_t *attributes,
return PSA_ERROR_INVALID_ARGUMENT;
}
if (method_length < sizeof(*method)) {
return PSA_ERROR_INVALID_ARGUMENT;
}
#if defined(PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE)
if (attributes->core.type == PSA_KEY_TYPE_RSA_KEY_PAIR) {
if (method->flags != 0) {
@ -7607,7 +7598,7 @@ psa_status_t psa_generate_key_ext(const psa_key_attributes_t *attributes,
}
} else
#endif
if (!psa_key_generation_method_is_default(method, method_length)) {
if (!psa_key_generation_method_is_default(method, method_data_length)) {
return PSA_ERROR_INVALID_ARGUMENT;
}
@ -7648,7 +7639,7 @@ psa_status_t psa_generate_key_ext(const psa_key_attributes_t *attributes,
}
status = psa_driver_wrapper_generate_key(attributes,
method, method_length,
method, method_data_length,
slot->key.data, slot->key.bytes,
&slot->key.bytes);
if (status != PSA_SUCCESS) {
@ -7670,7 +7661,7 @@ psa_status_t psa_generate_key(const psa_key_attributes_t *attributes,
mbedtls_svc_key_id_t *key)
{
return psa_generate_key_ext(attributes,
&default_method, sizeof(default_method),
&default_method, 0,
key);
}

5
library/psa_crypto_core.h
View file

@ -405,8 +405,7 @@ psa_status_t psa_export_public_key_internal(
* \param[in] attributes The attributes for the key to generate.
* \param[in] method The generation method from
* psa_generate_key_ext().
* This can be \c NULL if \p method_length is 0.
* \param method_length The size of \p method in bytes.
* \param method_data_length The size of `method.data` in bytes.
* \param[out] key_buffer Buffer where the key data is to be written.
* \param[in] key_buffer_size Size of \p key_buffer in bytes.
* \param[out] key_buffer_length On success, the number of bytes written in
@ -422,7 +421,7 @@ psa_status_t psa_export_public_key_internal(
*/
psa_status_t psa_generate_key_internal(const psa_key_attributes_t *attributes,
const psa_key_generation_method_t *method,
size_t method_length,
size_t method_data_length,
uint8_t *key_buffer,
size_t key_buffer_size,
size_t *key_buffer_length);