Kenji Arai / mbed-os_TYBLE16

mbed-os5 only for TYBLE16

Dependents:   TYBLE16_simple_data_logger TYBLE16_MP3_Air

features/mbedtls/mbed-crypto/src/cipher.c@1:9db0e321a9f4, 2019-12-31 (annotated)

Committer:
kenjiArai
Date:
Tue Dec 31 06:02:27 2019 +0000
Revision:
1:9db0e321a9f4
Parent:
0:5b88d5760320 
updated based on mbed-os5.15.0

Who changed what in which revision?

UserRevisionLine numberNew contents of line
kenjiArai 0:5b88d5760320 1 /**
kenjiArai 0:5b88d5760320 2 * \file cipher.c
kenjiArai 0:5b88d5760320 3 *
kenjiArai 0:5b88d5760320 4 * \brief Generic cipher wrapper for mbed TLS
kenjiArai 0:5b88d5760320 5 *
kenjiArai 0:5b88d5760320 6 * \author Adriaan de Jong <dejong@fox-it.com>
kenjiArai 0:5b88d5760320 7 *
kenjiArai 0:5b88d5760320 8 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
kenjiArai 0:5b88d5760320 9 * SPDX-License-Identifier: Apache-2.0
kenjiArai 0:5b88d5760320 10 *
kenjiArai 0:5b88d5760320 11 * Licensed under the Apache License, Version 2.0 (the "License"); you may
kenjiArai 0:5b88d5760320 12 * not use this file except in compliance with the License.
kenjiArai 0:5b88d5760320 13 * You may obtain a copy of the License at
kenjiArai 0:5b88d5760320 14 *
kenjiArai 0:5b88d5760320 15 * http://www.apache.org/licenses/LICENSE-2.0
kenjiArai 0:5b88d5760320 16 *
kenjiArai 0:5b88d5760320 17 * Unless required by applicable law or agreed to in writing, software
kenjiArai 0:5b88d5760320 18 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
kenjiArai 0:5b88d5760320 19 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
kenjiArai 0:5b88d5760320 20 * See the License for the specific language governing permissions and
kenjiArai 0:5b88d5760320 21 * limitations under the License.
kenjiArai 0:5b88d5760320 22 *
kenjiArai 0:5b88d5760320 23 * This file is part of mbed TLS (https://tls.mbed.org)
kenjiArai 0:5b88d5760320 24 */
kenjiArai 0:5b88d5760320 25
kenjiArai 0:5b88d5760320 26 #if !defined(MBEDTLS_CONFIG_FILE)
kenjiArai 0:5b88d5760320 27 #include "mbedtls/config.h"
kenjiArai 0:5b88d5760320 28 #else
kenjiArai 0:5b88d5760320 29 #include MBEDTLS_CONFIG_FILE
kenjiArai 0:5b88d5760320 30 #endif
kenjiArai 0:5b88d5760320 31
kenjiArai 0:5b88d5760320 32 #if defined(MBEDTLS_CIPHER_C)
kenjiArai 0:5b88d5760320 33
kenjiArai 0:5b88d5760320 34 #include "mbedtls/cipher.h"
kenjiArai 0:5b88d5760320 35 #include "mbedtls/cipher_internal.h"
kenjiArai 0:5b88d5760320 36 #include "mbedtls/platform_util.h"
kenjiArai 0:5b88d5760320 37
kenjiArai 0:5b88d5760320 38 #include <stdlib.h>
kenjiArai 0:5b88d5760320 39 #include <string.h>
kenjiArai 0:5b88d5760320 40
kenjiArai 0:5b88d5760320 41 #if defined(MBEDTLS_CHACHAPOLY_C)
kenjiArai 0:5b88d5760320 42 #include "mbedtls/chachapoly.h"
kenjiArai 0:5b88d5760320 43 #endif
kenjiArai 0:5b88d5760320 44
kenjiArai 0:5b88d5760320 45 #if defined(MBEDTLS_GCM_C)
kenjiArai 0:5b88d5760320 46 #include "mbedtls/gcm.h"
kenjiArai 0:5b88d5760320 47 #endif
kenjiArai 0:5b88d5760320 48
kenjiArai 0:5b88d5760320 49 #if defined(MBEDTLS_CCM_C)
kenjiArai 0:5b88d5760320 50 #include "mbedtls/ccm.h"
kenjiArai 0:5b88d5760320 51 #endif
kenjiArai 0:5b88d5760320 52
kenjiArai 0:5b88d5760320 53 #if defined(MBEDTLS_CHACHA20_C)
kenjiArai 0:5b88d5760320 54 #include "mbedtls/chacha20.h"
kenjiArai 0:5b88d5760320 55 #endif
kenjiArai 0:5b88d5760320 56
kenjiArai 0:5b88d5760320 57 #if defined(MBEDTLS_CMAC_C)
kenjiArai 0:5b88d5760320 58 #include "mbedtls/cmac.h"
kenjiArai 0:5b88d5760320 59 #endif
kenjiArai 0:5b88d5760320 60
kenjiArai 0:5b88d5760320 61 #if defined(MBEDTLS_USE_PSA_CRYPTO)
kenjiArai 0:5b88d5760320 62 #include "psa/crypto.h"
kenjiArai 0:5b88d5760320 63 #include "mbedtls/psa_util.h"
kenjiArai 0:5b88d5760320 64 #endif /* MBEDTLS_USE_PSA_CRYPTO */
kenjiArai 0:5b88d5760320 65
kenjiArai 0:5b88d5760320 66 #if defined(MBEDTLS_NIST_KW_C)
kenjiArai 0:5b88d5760320 67 #include "mbedtls/nist_kw.h"
kenjiArai 0:5b88d5760320 68 #endif
kenjiArai 0:5b88d5760320 69
kenjiArai 0:5b88d5760320 70 #if defined(MBEDTLS_PLATFORM_C)
kenjiArai 0:5b88d5760320 71 #include "mbedtls/platform.h"
kenjiArai 0:5b88d5760320 72 #else
kenjiArai 0:5b88d5760320 73 #define mbedtls_calloc calloc
kenjiArai 0:5b88d5760320 74 #define mbedtls_free free
kenjiArai 0:5b88d5760320 75 #endif
kenjiArai 0:5b88d5760320 76
kenjiArai 0:5b88d5760320 77 #define CIPHER_VALIDATE_RET( cond ) \
kenjiArai 0:5b88d5760320 78 MBEDTLS_INTERNAL_VALIDATE_RET( cond, MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA )
kenjiArai 0:5b88d5760320 79 #define CIPHER_VALIDATE( cond ) \
kenjiArai 0:5b88d5760320 80 MBEDTLS_INTERNAL_VALIDATE( cond )
kenjiArai 0:5b88d5760320 81
kenjiArai 0:5b88d5760320 82 #if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C)
kenjiArai 0:5b88d5760320 83 /* Compare the contents of two buffers in constant time.
kenjiArai 0:5b88d5760320 84 * Returns 0 if the contents are bitwise identical, otherwise returns
kenjiArai 0:5b88d5760320 85 * a non-zero value.
kenjiArai 0:5b88d5760320 86 * This is currently only used by GCM and ChaCha20+Poly1305.
kenjiArai 0:5b88d5760320 87 */
kenjiArai 0:5b88d5760320 88 static int mbedtls_constant_time_memcmp( const void *v1, const void *v2,
kenjiArai 0:5b88d5760320 89 size_t len )
kenjiArai 0:5b88d5760320 90 {
kenjiArai 0:5b88d5760320 91 const unsigned char *p1 = (const unsigned char*) v1;
kenjiArai 0:5b88d5760320 92 const unsigned char *p2 = (const unsigned char*) v2;
kenjiArai 0:5b88d5760320 93 size_t i;
kenjiArai 0:5b88d5760320 94 unsigned char diff;
kenjiArai 0:5b88d5760320 95
kenjiArai 0:5b88d5760320 96 for( diff = 0, i = 0; i < len; i++ )
kenjiArai 0:5b88d5760320 97 diff |= p1[i] ^ p2[i];
kenjiArai 0:5b88d5760320 98
kenjiArai 0:5b88d5760320 99 return( (int)diff );
kenjiArai 0:5b88d5760320 100 }
kenjiArai 0:5b88d5760320 101 #endif /* MBEDTLS_GCM_C || MBEDTLS_CHACHAPOLY_C */
kenjiArai 0:5b88d5760320 102
kenjiArai 0:5b88d5760320 103 static int supported_init = 0;
kenjiArai 0:5b88d5760320 104
kenjiArai 0:5b88d5760320 105 const int *mbedtls_cipher_list( void )
kenjiArai 0:5b88d5760320 106 {
kenjiArai 0:5b88d5760320 107 const mbedtls_cipher_definition_t *def;
kenjiArai 0:5b88d5760320 108 int *type;
kenjiArai 0:5b88d5760320 109
kenjiArai 0:5b88d5760320 110 if( ! supported_init )
kenjiArai 0:5b88d5760320 111 {
kenjiArai 0:5b88d5760320 112 def = mbedtls_cipher_definitions;
kenjiArai 0:5b88d5760320 113 type = mbedtls_cipher_supported;
kenjiArai 0:5b88d5760320 114
kenjiArai 0:5b88d5760320 115 while( def->type != 0 )
kenjiArai 0:5b88d5760320 116 *type++ = (*def++).type;
kenjiArai 0:5b88d5760320 117
kenjiArai 0:5b88d5760320 118 *type = 0;
kenjiArai 0:5b88d5760320 119
kenjiArai 0:5b88d5760320 120 supported_init = 1;
kenjiArai 0:5b88d5760320 121 }
kenjiArai 0:5b88d5760320 122
kenjiArai 0:5b88d5760320 123 return( mbedtls_cipher_supported );
kenjiArai 0:5b88d5760320 124 }
kenjiArai 0:5b88d5760320 125
kenjiArai 0:5b88d5760320 126 const mbedtls_cipher_info_t *mbedtls_cipher_info_from_type(
kenjiArai 0:5b88d5760320 127 const mbedtls_cipher_type_t cipher_type )
kenjiArai 0:5b88d5760320 128 {
kenjiArai 0:5b88d5760320 129 const mbedtls_cipher_definition_t *def;
kenjiArai 0:5b88d5760320 130
kenjiArai 0:5b88d5760320 131 for( def = mbedtls_cipher_definitions; def->info != NULL; def++ )
kenjiArai 0:5b88d5760320 132 if( def->type == cipher_type )
kenjiArai 0:5b88d5760320 133 return( def->info );
kenjiArai 0:5b88d5760320 134
kenjiArai 0:5b88d5760320 135 return( NULL );
kenjiArai 0:5b88d5760320 136 }
kenjiArai 0:5b88d5760320 137
kenjiArai 0:5b88d5760320 138 const mbedtls_cipher_info_t *mbedtls_cipher_info_from_string(
kenjiArai 0:5b88d5760320 139 const char *cipher_name )
kenjiArai 0:5b88d5760320 140 {
kenjiArai 0:5b88d5760320 141 const mbedtls_cipher_definition_t *def;
kenjiArai 0:5b88d5760320 142
kenjiArai 0:5b88d5760320 143 if( NULL == cipher_name )
kenjiArai 0:5b88d5760320 144 return( NULL );
kenjiArai 0:5b88d5760320 145
kenjiArai 0:5b88d5760320 146 for( def = mbedtls_cipher_definitions; def->info != NULL; def++ )
kenjiArai 0:5b88d5760320 147 if( ! strcmp( def->info->name, cipher_name ) )
kenjiArai 0:5b88d5760320 148 return( def->info );
kenjiArai 0:5b88d5760320 149
kenjiArai 0:5b88d5760320 150 return( NULL );
kenjiArai 0:5b88d5760320 151 }
kenjiArai 0:5b88d5760320 152
kenjiArai 0:5b88d5760320 153 const mbedtls_cipher_info_t *mbedtls_cipher_info_from_values(
kenjiArai 0:5b88d5760320 154 const mbedtls_cipher_id_t cipher_id,
kenjiArai 0:5b88d5760320 155 int key_bitlen,
kenjiArai 0:5b88d5760320 156 const mbedtls_cipher_mode_t mode )
kenjiArai 0:5b88d5760320 157 {
kenjiArai 0:5b88d5760320 158 const mbedtls_cipher_definition_t *def;
kenjiArai 0:5b88d5760320 159
kenjiArai 0:5b88d5760320 160 for( def = mbedtls_cipher_definitions; def->info != NULL; def++ )
kenjiArai 0:5b88d5760320 161 if( def->info->base->cipher == cipher_id &&
kenjiArai 0:5b88d5760320 162 def->info->key_bitlen == (unsigned) key_bitlen &&
kenjiArai 0:5b88d5760320 163 def->info->mode == mode )
kenjiArai 0:5b88d5760320 164 return( def->info );
kenjiArai 0:5b88d5760320 165
kenjiArai 0:5b88d5760320 166 return( NULL );
kenjiArai 0:5b88d5760320 167 }
kenjiArai 0:5b88d5760320 168
kenjiArai 0:5b88d5760320 169 void mbedtls_cipher_init( mbedtls_cipher_context_t *ctx )
kenjiArai 0:5b88d5760320 170 {
kenjiArai 0:5b88d5760320 171 CIPHER_VALIDATE( ctx != NULL );
kenjiArai 0:5b88d5760320 172 memset( ctx, 0, sizeof( mbedtls_cipher_context_t ) );
kenjiArai 0:5b88d5760320 173 }
kenjiArai 0:5b88d5760320 174
kenjiArai 0:5b88d5760320 175 void mbedtls_cipher_free( mbedtls_cipher_context_t *ctx )
kenjiArai 0:5b88d5760320 176 {
kenjiArai 0:5b88d5760320 177 if( ctx == NULL )
kenjiArai 0:5b88d5760320 178 return;
kenjiArai 0:5b88d5760320 179
kenjiArai 0:5b88d5760320 180 #if defined(MBEDTLS_USE_PSA_CRYPTO)
kenjiArai 0:5b88d5760320 181 if( ctx->psa_enabled == 1 )
kenjiArai 0:5b88d5760320 182 {
kenjiArai 0:5b88d5760320 183 if( ctx->cipher_ctx != NULL )
kenjiArai 0:5b88d5760320 184 {
kenjiArai 0:5b88d5760320 185 mbedtls_cipher_context_psa * const cipher_psa =
kenjiArai 0:5b88d5760320 186 (mbedtls_cipher_context_psa *) ctx->cipher_ctx;
kenjiArai 0:5b88d5760320 187
kenjiArai 0:5b88d5760320 188 if( cipher_psa->slot_state == MBEDTLS_CIPHER_PSA_KEY_OWNED )
kenjiArai 0:5b88d5760320 189 {
kenjiArai 0:5b88d5760320 190 /* xxx_free() doesn't allow to return failures. */
kenjiArai 0:5b88d5760320 191 (void) psa_destroy_key( cipher_psa->slot );
kenjiArai 0:5b88d5760320 192 }
kenjiArai 0:5b88d5760320 193
kenjiArai 0:5b88d5760320 194 mbedtls_platform_zeroize( cipher_psa, sizeof( *cipher_psa ) );
kenjiArai 0:5b88d5760320 195 mbedtls_free( cipher_psa );
kenjiArai 0:5b88d5760320 196 }
kenjiArai 0:5b88d5760320 197
kenjiArai 0:5b88d5760320 198 mbedtls_platform_zeroize( ctx, sizeof(mbedtls_cipher_context_t) );
kenjiArai 0:5b88d5760320 199 return;
kenjiArai 0:5b88d5760320 200 }
kenjiArai 0:5b88d5760320 201 #endif /* MBEDTLS_USE_PSA_CRYPTO */
kenjiArai 0:5b88d5760320 202
kenjiArai 0:5b88d5760320 203 #if defined(MBEDTLS_CMAC_C)
kenjiArai 0:5b88d5760320 204 if( ctx->cmac_ctx )
kenjiArai 0:5b88d5760320 205 {
kenjiArai 0:5b88d5760320 206 mbedtls_platform_zeroize( ctx->cmac_ctx,
kenjiArai 0:5b88d5760320 207 sizeof( mbedtls_cmac_context_t ) );
kenjiArai 0:5b88d5760320 208 mbedtls_free( ctx->cmac_ctx );
kenjiArai 0:5b88d5760320 209 }
kenjiArai 0:5b88d5760320 210 #endif
kenjiArai 0:5b88d5760320 211
kenjiArai 0:5b88d5760320 212 if( ctx->cipher_ctx )
kenjiArai 0:5b88d5760320 213 ctx->cipher_info->base->ctx_free_func( ctx->cipher_ctx );
kenjiArai 0:5b88d5760320 214
kenjiArai 0:5b88d5760320 215 mbedtls_platform_zeroize( ctx, sizeof(mbedtls_cipher_context_t) );
kenjiArai 0:5b88d5760320 216 }
kenjiArai 0:5b88d5760320 217
kenjiArai 0:5b88d5760320 218 int mbedtls_cipher_setup( mbedtls_cipher_context_t *ctx,
kenjiArai 0:5b88d5760320 219 const mbedtls_cipher_info_t *cipher_info )
kenjiArai 0:5b88d5760320 220 {
kenjiArai 0:5b88d5760320 221 CIPHER_VALIDATE_RET( ctx != NULL );
kenjiArai 0:5b88d5760320 222 if( cipher_info == NULL )
kenjiArai 0:5b88d5760320 223 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 224
kenjiArai 0:5b88d5760320 225 memset( ctx, 0, sizeof( mbedtls_cipher_context_t ) );
kenjiArai 0:5b88d5760320 226
kenjiArai 0:5b88d5760320 227 if( NULL == ( ctx->cipher_ctx = cipher_info->base->ctx_alloc_func() ) )
kenjiArai 0:5b88d5760320 228 return( MBEDTLS_ERR_CIPHER_ALLOC_FAILED );
kenjiArai 0:5b88d5760320 229
kenjiArai 0:5b88d5760320 230 ctx->cipher_info = cipher_info;
kenjiArai 0:5b88d5760320 231
kenjiArai 0:5b88d5760320 232 #if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING)
kenjiArai 0:5b88d5760320 233 /*
kenjiArai 0:5b88d5760320 234 * Ignore possible errors caused by a cipher mode that doesn't use padding
kenjiArai 0:5b88d5760320 235 */
kenjiArai 0:5b88d5760320 236 #if defined(MBEDTLS_CIPHER_PADDING_PKCS7)
kenjiArai 0:5b88d5760320 237 (void) mbedtls_cipher_set_padding_mode( ctx, MBEDTLS_PADDING_PKCS7 );
kenjiArai 0:5b88d5760320 238 #else
kenjiArai 0:5b88d5760320 239 (void) mbedtls_cipher_set_padding_mode( ctx, MBEDTLS_PADDING_NONE );
kenjiArai 0:5b88d5760320 240 #endif
kenjiArai 0:5b88d5760320 241 #endif /* MBEDTLS_CIPHER_MODE_WITH_PADDING */
kenjiArai 0:5b88d5760320 242
kenjiArai 0:5b88d5760320 243 return( 0 );
kenjiArai 0:5b88d5760320 244 }
kenjiArai 0:5b88d5760320 245
kenjiArai 0:5b88d5760320 246 #if defined(MBEDTLS_USE_PSA_CRYPTO)
kenjiArai 0:5b88d5760320 247 int mbedtls_cipher_setup_psa( mbedtls_cipher_context_t *ctx,
kenjiArai 0:5b88d5760320 248 const mbedtls_cipher_info_t *cipher_info,
kenjiArai 0:5b88d5760320 249 size_t taglen )
kenjiArai 0:5b88d5760320 250 {
kenjiArai 0:5b88d5760320 251 psa_algorithm_t alg;
kenjiArai 0:5b88d5760320 252 mbedtls_cipher_context_psa *cipher_psa;
kenjiArai 0:5b88d5760320 253
kenjiArai 0:5b88d5760320 254 if( NULL == cipher_info || NULL == ctx )
kenjiArai 0:5b88d5760320 255 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 256
kenjiArai 0:5b88d5760320 257 /* Check that the underlying cipher mode and cipher type are
kenjiArai 0:5b88d5760320 258 * supported by the underlying PSA Crypto implementation. */
kenjiArai 0:5b88d5760320 259 alg = mbedtls_psa_translate_cipher_mode( cipher_info->mode, taglen );
kenjiArai 0:5b88d5760320 260 if( alg == 0 )
kenjiArai 0:5b88d5760320 261 return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
kenjiArai 0:5b88d5760320 262 if( mbedtls_psa_translate_cipher_type( cipher_info->type ) == 0 )
kenjiArai 0:5b88d5760320 263 return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
kenjiArai 0:5b88d5760320 264
kenjiArai 0:5b88d5760320 265 memset( ctx, 0, sizeof( mbedtls_cipher_context_t ) );
kenjiArai 0:5b88d5760320 266
kenjiArai 0:5b88d5760320 267 cipher_psa = mbedtls_calloc( 1, sizeof(mbedtls_cipher_context_psa ) );
kenjiArai 0:5b88d5760320 268 if( cipher_psa == NULL )
kenjiArai 0:5b88d5760320 269 return( MBEDTLS_ERR_CIPHER_ALLOC_FAILED );
kenjiArai 0:5b88d5760320 270 cipher_psa->alg = alg;
kenjiArai 0:5b88d5760320 271 ctx->cipher_ctx = cipher_psa;
kenjiArai 0:5b88d5760320 272 ctx->cipher_info = cipher_info;
kenjiArai 0:5b88d5760320 273 ctx->psa_enabled = 1;
kenjiArai 0:5b88d5760320 274 return( 0 );
kenjiArai 0:5b88d5760320 275 }
kenjiArai 0:5b88d5760320 276 #endif /* MBEDTLS_USE_PSA_CRYPTO */
kenjiArai 0:5b88d5760320 277
kenjiArai 0:5b88d5760320 278 int mbedtls_cipher_setkey( mbedtls_cipher_context_t *ctx,
kenjiArai 0:5b88d5760320 279 const unsigned char *key,
kenjiArai 0:5b88d5760320 280 int key_bitlen,
kenjiArai 0:5b88d5760320 281 const mbedtls_operation_t operation )
kenjiArai 0:5b88d5760320 282 {
kenjiArai 0:5b88d5760320 283 CIPHER_VALIDATE_RET( ctx != NULL );
kenjiArai 0:5b88d5760320 284 CIPHER_VALIDATE_RET( key != NULL );
kenjiArai 0:5b88d5760320 285 CIPHER_VALIDATE_RET( operation == MBEDTLS_ENCRYPT ||
kenjiArai 0:5b88d5760320 286 operation == MBEDTLS_DECRYPT );
kenjiArai 0:5b88d5760320 287 if( ctx->cipher_info == NULL )
kenjiArai 0:5b88d5760320 288 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 289
kenjiArai 0:5b88d5760320 290 #if defined(MBEDTLS_USE_PSA_CRYPTO)
kenjiArai 0:5b88d5760320 291 if( ctx->psa_enabled == 1 )
kenjiArai 0:5b88d5760320 292 {
kenjiArai 0:5b88d5760320 293 mbedtls_cipher_context_psa * const cipher_psa =
kenjiArai 0:5b88d5760320 294 (mbedtls_cipher_context_psa *) ctx->cipher_ctx;
kenjiArai 0:5b88d5760320 295
kenjiArai 0:5b88d5760320 296 size_t const key_bytelen = ( (size_t) key_bitlen + 7 ) / 8;
kenjiArai 0:5b88d5760320 297
kenjiArai 0:5b88d5760320 298 psa_status_t status;
kenjiArai 0:5b88d5760320 299 psa_key_type_t key_type;
kenjiArai 1:9db0e321a9f4 300 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
kenjiArai 0:5b88d5760320 301
kenjiArai 0:5b88d5760320 302 /* PSA Crypto API only accepts byte-aligned keys. */
kenjiArai 0:5b88d5760320 303 if( key_bitlen % 8 != 0 )
kenjiArai 0:5b88d5760320 304 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 305
kenjiArai 0:5b88d5760320 306 /* Don't allow keys to be set multiple times. */
kenjiArai 0:5b88d5760320 307 if( cipher_psa->slot_state != MBEDTLS_CIPHER_PSA_KEY_UNSET )
kenjiArai 0:5b88d5760320 308 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 309
kenjiArai 0:5b88d5760320 310 key_type = mbedtls_psa_translate_cipher_type(
kenjiArai 0:5b88d5760320 311 ctx->cipher_info->type );
kenjiArai 0:5b88d5760320 312 if( key_type == 0 )
kenjiArai 0:5b88d5760320 313 return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
kenjiArai 1:9db0e321a9f4 314 psa_set_key_type( &attributes, key_type );
kenjiArai 0:5b88d5760320 315
kenjiArai 0:5b88d5760320 316 /* Mbed TLS' cipher layer doesn't enforce the mode of operation
kenjiArai 0:5b88d5760320 317 * (encrypt vs. decrypt): it is possible to setup a key for encryption
kenjiArai 0:5b88d5760320 318 * and use it for AEAD decryption. Until tests relying on this
kenjiArai 0:5b88d5760320 319 * are changed, allow any usage in PSA. */
kenjiArai 1:9db0e321a9f4 320 psa_set_key_usage_flags( &attributes,
kenjiArai 1:9db0e321a9f4 321 /* mbedtls_psa_translate_cipher_operation( operation ); */
kenjiArai 1:9db0e321a9f4 322 PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT );
kenjiArai 1:9db0e321a9f4 323 psa_set_key_algorithm( &attributes, cipher_psa->alg );
kenjiArai 0:5b88d5760320 324
kenjiArai 1:9db0e321a9f4 325 status = psa_import_key( &attributes, key, key_bytelen,
kenjiArai 1:9db0e321a9f4 326 &cipher_psa->slot );
kenjiArai 1:9db0e321a9f4 327 switch( status )
kenjiArai 1:9db0e321a9f4 328 {
kenjiArai 1:9db0e321a9f4 329 case PSA_SUCCESS:
kenjiArai 1:9db0e321a9f4 330 break;
kenjiArai 1:9db0e321a9f4 331 case PSA_ERROR_INSUFFICIENT_MEMORY:
kenjiArai 1:9db0e321a9f4 332 return( MBEDTLS_ERR_CIPHER_ALLOC_FAILED );
kenjiArai 1:9db0e321a9f4 333 case PSA_ERROR_NOT_SUPPORTED:
kenjiArai 1:9db0e321a9f4 334 return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
kenjiArai 1:9db0e321a9f4 335 default:
kenjiArai 1:9db0e321a9f4 336 return( MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED );
kenjiArai 1:9db0e321a9f4 337 }
kenjiArai 1:9db0e321a9f4 338 /* Indicate that we own the key slot and need to
kenjiArai 1:9db0e321a9f4 339 * destroy it in mbedtls_cipher_free(). */
kenjiArai 1:9db0e321a9f4 340 cipher_psa->slot_state = MBEDTLS_CIPHER_PSA_KEY_OWNED;
kenjiArai 0:5b88d5760320 341
kenjiArai 0:5b88d5760320 342 ctx->key_bitlen = key_bitlen;
kenjiArai 0:5b88d5760320 343 ctx->operation = operation;
kenjiArai 0:5b88d5760320 344 return( 0 );
kenjiArai 0:5b88d5760320 345 }
kenjiArai 0:5b88d5760320 346 #endif /* MBEDTLS_USE_PSA_CRYPTO */
kenjiArai 0:5b88d5760320 347
kenjiArai 0:5b88d5760320 348 if( ( ctx->cipher_info->flags & MBEDTLS_CIPHER_VARIABLE_KEY_LEN ) == 0 &&
kenjiArai 0:5b88d5760320 349 (int) ctx->cipher_info->key_bitlen != key_bitlen )
kenjiArai 0:5b88d5760320 350 {
kenjiArai 0:5b88d5760320 351 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 352 }
kenjiArai 0:5b88d5760320 353
kenjiArai 0:5b88d5760320 354 ctx->key_bitlen = key_bitlen;
kenjiArai 0:5b88d5760320 355 ctx->operation = operation;
kenjiArai 0:5b88d5760320 356
kenjiArai 0:5b88d5760320 357 /*
kenjiArai 0:5b88d5760320 358 * For OFB, CFB and CTR mode always use the encryption key schedule
kenjiArai 0:5b88d5760320 359 */
kenjiArai 0:5b88d5760320 360 if( MBEDTLS_ENCRYPT == operation ||
kenjiArai 0:5b88d5760320 361 MBEDTLS_MODE_CFB == ctx->cipher_info->mode ||
kenjiArai 0:5b88d5760320 362 MBEDTLS_MODE_OFB == ctx->cipher_info->mode ||
kenjiArai 0:5b88d5760320 363 MBEDTLS_MODE_CTR == ctx->cipher_info->mode )
kenjiArai 0:5b88d5760320 364 {
kenjiArai 0:5b88d5760320 365 return( ctx->cipher_info->base->setkey_enc_func( ctx->cipher_ctx, key,
kenjiArai 0:5b88d5760320 366 ctx->key_bitlen ) );
kenjiArai 0:5b88d5760320 367 }
kenjiArai 0:5b88d5760320 368
kenjiArai 0:5b88d5760320 369 if( MBEDTLS_DECRYPT == operation )
kenjiArai 0:5b88d5760320 370 return( ctx->cipher_info->base->setkey_dec_func( ctx->cipher_ctx, key,
kenjiArai 0:5b88d5760320 371 ctx->key_bitlen ) );
kenjiArai 0:5b88d5760320 372
kenjiArai 0:5b88d5760320 373 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 374 }
kenjiArai 0:5b88d5760320 375
kenjiArai 0:5b88d5760320 376 int mbedtls_cipher_set_iv( mbedtls_cipher_context_t *ctx,
kenjiArai 0:5b88d5760320 377 const unsigned char *iv,
kenjiArai 0:5b88d5760320 378 size_t iv_len )
kenjiArai 0:5b88d5760320 379 {
kenjiArai 0:5b88d5760320 380 size_t actual_iv_size;
kenjiArai 0:5b88d5760320 381
kenjiArai 0:5b88d5760320 382 CIPHER_VALIDATE_RET( ctx != NULL );
kenjiArai 0:5b88d5760320 383 CIPHER_VALIDATE_RET( iv_len == 0 || iv != NULL );
kenjiArai 0:5b88d5760320 384 if( ctx->cipher_info == NULL )
kenjiArai 0:5b88d5760320 385 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 386 #if defined(MBEDTLS_USE_PSA_CRYPTO)
kenjiArai 0:5b88d5760320 387 if( ctx->psa_enabled == 1 )
kenjiArai 0:5b88d5760320 388 {
kenjiArai 0:5b88d5760320 389 /* While PSA Crypto has an API for multipart
kenjiArai 0:5b88d5760320 390 * operations, we currently don't make it
kenjiArai 0:5b88d5760320 391 * accessible through the cipher layer. */
kenjiArai 0:5b88d5760320 392 return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
kenjiArai 0:5b88d5760320 393 }
kenjiArai 0:5b88d5760320 394 #endif /* MBEDTLS_USE_PSA_CRYPTO */
kenjiArai 0:5b88d5760320 395
kenjiArai 0:5b88d5760320 396 /* avoid buffer overflow in ctx->iv */
kenjiArai 0:5b88d5760320 397 if( iv_len > MBEDTLS_MAX_IV_LENGTH )
kenjiArai 0:5b88d5760320 398 return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
kenjiArai 0:5b88d5760320 399
kenjiArai 0:5b88d5760320 400 if( ( ctx->cipher_info->flags & MBEDTLS_CIPHER_VARIABLE_IV_LEN ) != 0 )
kenjiArai 0:5b88d5760320 401 actual_iv_size = iv_len;
kenjiArai 0:5b88d5760320 402 else
kenjiArai 0:5b88d5760320 403 {
kenjiArai 0:5b88d5760320 404 actual_iv_size = ctx->cipher_info->iv_size;
kenjiArai 0:5b88d5760320 405
kenjiArai 0:5b88d5760320 406 /* avoid reading past the end of input buffer */
kenjiArai 0:5b88d5760320 407 if( actual_iv_size > iv_len )
kenjiArai 0:5b88d5760320 408 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 409 }
kenjiArai 0:5b88d5760320 410
kenjiArai 0:5b88d5760320 411 #if defined(MBEDTLS_CHACHA20_C)
kenjiArai 0:5b88d5760320 412 if ( ctx->cipher_info->type == MBEDTLS_CIPHER_CHACHA20 )
kenjiArai 0:5b88d5760320 413 {
kenjiArai 0:5b88d5760320 414 if ( 0 != mbedtls_chacha20_starts( (mbedtls_chacha20_context*)ctx->cipher_ctx,
kenjiArai 0:5b88d5760320 415 iv,
kenjiArai 0:5b88d5760320 416 0U ) ) /* Initial counter value */
kenjiArai 0:5b88d5760320 417 {
kenjiArai 0:5b88d5760320 418 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 419 }
kenjiArai 0:5b88d5760320 420 }
kenjiArai 0:5b88d5760320 421 #endif
kenjiArai 0:5b88d5760320 422
kenjiArai 0:5b88d5760320 423 if ( actual_iv_size != 0 )
kenjiArai 0:5b88d5760320 424 {
kenjiArai 0:5b88d5760320 425 memcpy( ctx->iv, iv, actual_iv_size );
kenjiArai 0:5b88d5760320 426 ctx->iv_size = actual_iv_size;
kenjiArai 0:5b88d5760320 427 }
kenjiArai 0:5b88d5760320 428
kenjiArai 0:5b88d5760320 429 return( 0 );
kenjiArai 0:5b88d5760320 430 }
kenjiArai 0:5b88d5760320 431
kenjiArai 0:5b88d5760320 432 int mbedtls_cipher_reset( mbedtls_cipher_context_t *ctx )
kenjiArai 0:5b88d5760320 433 {
kenjiArai 0:5b88d5760320 434 CIPHER_VALIDATE_RET( ctx != NULL );
kenjiArai 0:5b88d5760320 435 if( ctx->cipher_info == NULL )
kenjiArai 0:5b88d5760320 436 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 437
kenjiArai 0:5b88d5760320 438 #if defined(MBEDTLS_USE_PSA_CRYPTO)
kenjiArai 0:5b88d5760320 439 if( ctx->psa_enabled == 1 )
kenjiArai 0:5b88d5760320 440 {
kenjiArai 0:5b88d5760320 441 /* We don't support resetting PSA-based
kenjiArai 0:5b88d5760320 442 * cipher contexts, yet. */
kenjiArai 0:5b88d5760320 443 return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
kenjiArai 0:5b88d5760320 444 }
kenjiArai 0:5b88d5760320 445 #endif /* MBEDTLS_USE_PSA_CRYPTO */
kenjiArai 0:5b88d5760320 446
kenjiArai 0:5b88d5760320 447 ctx->unprocessed_len = 0;
kenjiArai 0:5b88d5760320 448
kenjiArai 0:5b88d5760320 449 return( 0 );
kenjiArai 0:5b88d5760320 450 }
kenjiArai 0:5b88d5760320 451
kenjiArai 0:5b88d5760320 452 #if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C)
kenjiArai 0:5b88d5760320 453 int mbedtls_cipher_update_ad( mbedtls_cipher_context_t *ctx,
kenjiArai 0:5b88d5760320 454 const unsigned char *ad, size_t ad_len )
kenjiArai 0:5b88d5760320 455 {
kenjiArai 0:5b88d5760320 456 CIPHER_VALIDATE_RET( ctx != NULL );
kenjiArai 0:5b88d5760320 457 CIPHER_VALIDATE_RET( ad_len == 0 || ad != NULL );
kenjiArai 0:5b88d5760320 458 if( ctx->cipher_info == NULL )
kenjiArai 0:5b88d5760320 459 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 460
kenjiArai 0:5b88d5760320 461 #if defined(MBEDTLS_USE_PSA_CRYPTO)
kenjiArai 0:5b88d5760320 462 if( ctx->psa_enabled == 1 )
kenjiArai 0:5b88d5760320 463 {
kenjiArai 0:5b88d5760320 464 /* While PSA Crypto has an API for multipart
kenjiArai 0:5b88d5760320 465 * operations, we currently don't make it
kenjiArai 0:5b88d5760320 466 * accessible through the cipher layer. */
kenjiArai 0:5b88d5760320 467 return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
kenjiArai 0:5b88d5760320 468 }
kenjiArai 0:5b88d5760320 469 #endif /* MBEDTLS_USE_PSA_CRYPTO */
kenjiArai 0:5b88d5760320 470
kenjiArai 0:5b88d5760320 471 #if defined(MBEDTLS_GCM_C)
kenjiArai 0:5b88d5760320 472 if( MBEDTLS_MODE_GCM == ctx->cipher_info->mode )
kenjiArai 0:5b88d5760320 473 {
kenjiArai 0:5b88d5760320 474 return( mbedtls_gcm_starts( (mbedtls_gcm_context *) ctx->cipher_ctx, ctx->operation,
kenjiArai 0:5b88d5760320 475 ctx->iv, ctx->iv_size, ad, ad_len ) );
kenjiArai 0:5b88d5760320 476 }
kenjiArai 0:5b88d5760320 477 #endif
kenjiArai 0:5b88d5760320 478
kenjiArai 0:5b88d5760320 479 #if defined(MBEDTLS_CHACHAPOLY_C)
kenjiArai 0:5b88d5760320 480 if (MBEDTLS_CIPHER_CHACHA20_POLY1305 == ctx->cipher_info->type )
kenjiArai 0:5b88d5760320 481 {
kenjiArai 0:5b88d5760320 482 int result;
kenjiArai 0:5b88d5760320 483 mbedtls_chachapoly_mode_t mode;
kenjiArai 0:5b88d5760320 484
kenjiArai 0:5b88d5760320 485 mode = ( ctx->operation == MBEDTLS_ENCRYPT )
kenjiArai 0:5b88d5760320 486 ? MBEDTLS_CHACHAPOLY_ENCRYPT
kenjiArai 0:5b88d5760320 487 : MBEDTLS_CHACHAPOLY_DECRYPT;
kenjiArai 0:5b88d5760320 488
kenjiArai 0:5b88d5760320 489 result = mbedtls_chachapoly_starts( (mbedtls_chachapoly_context*) ctx->cipher_ctx,
kenjiArai 0:5b88d5760320 490 ctx->iv,
kenjiArai 0:5b88d5760320 491 mode );
kenjiArai 0:5b88d5760320 492 if ( result != 0 )
kenjiArai 0:5b88d5760320 493 return( result );
kenjiArai 0:5b88d5760320 494
kenjiArai 0:5b88d5760320 495 return( mbedtls_chachapoly_update_aad( (mbedtls_chachapoly_context*) ctx->cipher_ctx,
kenjiArai 0:5b88d5760320 496 ad, ad_len ) );
kenjiArai 0:5b88d5760320 497 }
kenjiArai 0:5b88d5760320 498 #endif
kenjiArai 0:5b88d5760320 499
kenjiArai 0:5b88d5760320 500 return( 0 );
kenjiArai 0:5b88d5760320 501 }
kenjiArai 0:5b88d5760320 502 #endif /* MBEDTLS_GCM_C || MBEDTLS_CHACHAPOLY_C */
kenjiArai 0:5b88d5760320 503
kenjiArai 0:5b88d5760320 504 int mbedtls_cipher_update( mbedtls_cipher_context_t *ctx, const unsigned char *input,
kenjiArai 0:5b88d5760320 505 size_t ilen, unsigned char *output, size_t *olen )
kenjiArai 0:5b88d5760320 506 {
kenjiArai 0:5b88d5760320 507 int ret;
kenjiArai 0:5b88d5760320 508 size_t block_size;
kenjiArai 0:5b88d5760320 509
kenjiArai 0:5b88d5760320 510 CIPHER_VALIDATE_RET( ctx != NULL );
kenjiArai 0:5b88d5760320 511 CIPHER_VALIDATE_RET( ilen == 0 || input != NULL );
kenjiArai 0:5b88d5760320 512 CIPHER_VALIDATE_RET( output != NULL );
kenjiArai 0:5b88d5760320 513 CIPHER_VALIDATE_RET( olen != NULL );
kenjiArai 0:5b88d5760320 514 if( ctx->cipher_info == NULL )
kenjiArai 0:5b88d5760320 515 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 516
kenjiArai 0:5b88d5760320 517 #if defined(MBEDTLS_USE_PSA_CRYPTO)
kenjiArai 0:5b88d5760320 518 if( ctx->psa_enabled == 1 )
kenjiArai 0:5b88d5760320 519 {
kenjiArai 0:5b88d5760320 520 /* While PSA Crypto has an API for multipart
kenjiArai 0:5b88d5760320 521 * operations, we currently don't make it
kenjiArai 0:5b88d5760320 522 * accessible through the cipher layer. */
kenjiArai 0:5b88d5760320 523 return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
kenjiArai 0:5b88d5760320 524 }
kenjiArai 0:5b88d5760320 525 #endif /* MBEDTLS_USE_PSA_CRYPTO */
kenjiArai 0:5b88d5760320 526
kenjiArai 0:5b88d5760320 527 *olen = 0;
kenjiArai 0:5b88d5760320 528 block_size = mbedtls_cipher_get_block_size( ctx );
kenjiArai 0:5b88d5760320 529
kenjiArai 0:5b88d5760320 530 if( ctx->cipher_info->mode == MBEDTLS_MODE_ECB )
kenjiArai 0:5b88d5760320 531 {
kenjiArai 0:5b88d5760320 532 if( ilen != block_size )
kenjiArai 0:5b88d5760320 533 return( MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED );
kenjiArai 0:5b88d5760320 534
kenjiArai 0:5b88d5760320 535 *olen = ilen;
kenjiArai 0:5b88d5760320 536
kenjiArai 0:5b88d5760320 537 if( 0 != ( ret = ctx->cipher_info->base->ecb_func( ctx->cipher_ctx,
kenjiArai 0:5b88d5760320 538 ctx->operation, input, output ) ) )
kenjiArai 0:5b88d5760320 539 {
kenjiArai 0:5b88d5760320 540 return( ret );
kenjiArai 0:5b88d5760320 541 }
kenjiArai 0:5b88d5760320 542
kenjiArai 0:5b88d5760320 543 return( 0 );
kenjiArai 0:5b88d5760320 544 }
kenjiArai 0:5b88d5760320 545
kenjiArai 0:5b88d5760320 546 #if defined(MBEDTLS_GCM_C)
kenjiArai 0:5b88d5760320 547 if( ctx->cipher_info->mode == MBEDTLS_MODE_GCM )
kenjiArai 0:5b88d5760320 548 {
kenjiArai 0:5b88d5760320 549 *olen = ilen;
kenjiArai 0:5b88d5760320 550 return( mbedtls_gcm_update( (mbedtls_gcm_context *) ctx->cipher_ctx, ilen, input,
kenjiArai 0:5b88d5760320 551 output ) );
kenjiArai 0:5b88d5760320 552 }
kenjiArai 0:5b88d5760320 553 #endif
kenjiArai 0:5b88d5760320 554
kenjiArai 0:5b88d5760320 555 #if defined(MBEDTLS_CHACHAPOLY_C)
kenjiArai 0:5b88d5760320 556 if ( ctx->cipher_info->type == MBEDTLS_CIPHER_CHACHA20_POLY1305 )
kenjiArai 0:5b88d5760320 557 {
kenjiArai 0:5b88d5760320 558 *olen = ilen;
kenjiArai 0:5b88d5760320 559 return( mbedtls_chachapoly_update( (mbedtls_chachapoly_context*) ctx->cipher_ctx,
kenjiArai 0:5b88d5760320 560 ilen, input, output ) );
kenjiArai 0:5b88d5760320 561 }
kenjiArai 0:5b88d5760320 562 #endif
kenjiArai 0:5b88d5760320 563
kenjiArai 0:5b88d5760320 564 if ( 0 == block_size )
kenjiArai 0:5b88d5760320 565 {
kenjiArai 0:5b88d5760320 566 return( MBEDTLS_ERR_CIPHER_INVALID_CONTEXT );
kenjiArai 0:5b88d5760320 567 }
kenjiArai 0:5b88d5760320 568
kenjiArai 0:5b88d5760320 569 if( input == output &&
kenjiArai 0:5b88d5760320 570 ( ctx->unprocessed_len != 0 || ilen % block_size ) )
kenjiArai 0:5b88d5760320 571 {
kenjiArai 0:5b88d5760320 572 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 573 }
kenjiArai 0:5b88d5760320 574
kenjiArai 0:5b88d5760320 575 #if defined(MBEDTLS_CIPHER_MODE_CBC)
kenjiArai 0:5b88d5760320 576 if( ctx->cipher_info->mode == MBEDTLS_MODE_CBC )
kenjiArai 0:5b88d5760320 577 {
kenjiArai 0:5b88d5760320 578 size_t copy_len = 0;
kenjiArai 0:5b88d5760320 579
kenjiArai 0:5b88d5760320 580 /*
kenjiArai 0:5b88d5760320 581 * If there is not enough data for a full block, cache it.
kenjiArai 0:5b88d5760320 582 */
kenjiArai 0:5b88d5760320 583 if( ( ctx->operation == MBEDTLS_DECRYPT && NULL != ctx->add_padding &&
kenjiArai 0:5b88d5760320 584 ilen <= block_size - ctx->unprocessed_len ) ||
kenjiArai 0:5b88d5760320 585 ( ctx->operation == MBEDTLS_DECRYPT && NULL == ctx->add_padding &&
kenjiArai 0:5b88d5760320 586 ilen < block_size - ctx->unprocessed_len ) ||
kenjiArai 0:5b88d5760320 587 ( ctx->operation == MBEDTLS_ENCRYPT &&
kenjiArai 0:5b88d5760320 588 ilen < block_size - ctx->unprocessed_len ) )
kenjiArai 0:5b88d5760320 589 {
kenjiArai 0:5b88d5760320 590 memcpy( &( ctx->unprocessed_data[ctx->unprocessed_len] ), input,
kenjiArai 0:5b88d5760320 591 ilen );
kenjiArai 0:5b88d5760320 592
kenjiArai 0:5b88d5760320 593 ctx->unprocessed_len += ilen;
kenjiArai 0:5b88d5760320 594 return( 0 );
kenjiArai 0:5b88d5760320 595 }
kenjiArai 0:5b88d5760320 596
kenjiArai 0:5b88d5760320 597 /*
kenjiArai 0:5b88d5760320 598 * Process cached data first
kenjiArai 0:5b88d5760320 599 */
kenjiArai 0:5b88d5760320 600 if( 0 != ctx->unprocessed_len )
kenjiArai 0:5b88d5760320 601 {
kenjiArai 0:5b88d5760320 602 copy_len = block_size - ctx->unprocessed_len;
kenjiArai 0:5b88d5760320 603
kenjiArai 0:5b88d5760320 604 memcpy( &( ctx->unprocessed_data[ctx->unprocessed_len] ), input,
kenjiArai 0:5b88d5760320 605 copy_len );
kenjiArai 0:5b88d5760320 606
kenjiArai 0:5b88d5760320 607 if( 0 != ( ret = ctx->cipher_info->base->cbc_func( ctx->cipher_ctx,
kenjiArai 0:5b88d5760320 608 ctx->operation, block_size, ctx->iv,
kenjiArai 0:5b88d5760320 609 ctx->unprocessed_data, output ) ) )
kenjiArai 0:5b88d5760320 610 {
kenjiArai 0:5b88d5760320 611 return( ret );
kenjiArai 0:5b88d5760320 612 }
kenjiArai 0:5b88d5760320 613
kenjiArai 0:5b88d5760320 614 *olen += block_size;
kenjiArai 0:5b88d5760320 615 output += block_size;
kenjiArai 0:5b88d5760320 616 ctx->unprocessed_len = 0;
kenjiArai 0:5b88d5760320 617
kenjiArai 0:5b88d5760320 618 input += copy_len;
kenjiArai 0:5b88d5760320 619 ilen -= copy_len;
kenjiArai 0:5b88d5760320 620 }
kenjiArai 0:5b88d5760320 621
kenjiArai 0:5b88d5760320 622 /*
kenjiArai 0:5b88d5760320 623 * Cache final, incomplete block
kenjiArai 0:5b88d5760320 624 */
kenjiArai 0:5b88d5760320 625 if( 0 != ilen )
kenjiArai 0:5b88d5760320 626 {
kenjiArai 0:5b88d5760320 627 if( 0 == block_size )
kenjiArai 0:5b88d5760320 628 {
kenjiArai 0:5b88d5760320 629 return( MBEDTLS_ERR_CIPHER_INVALID_CONTEXT );
kenjiArai 0:5b88d5760320 630 }
kenjiArai 0:5b88d5760320 631
kenjiArai 0:5b88d5760320 632 /* Encryption: only cache partial blocks
kenjiArai 0:5b88d5760320 633 * Decryption w/ padding: always keep at least one whole block
kenjiArai 0:5b88d5760320 634 * Decryption w/o padding: only cache partial blocks
kenjiArai 0:5b88d5760320 635 */
kenjiArai 0:5b88d5760320 636 copy_len = ilen % block_size;
kenjiArai 0:5b88d5760320 637 if( copy_len == 0 &&
kenjiArai 0:5b88d5760320 638 ctx->operation == MBEDTLS_DECRYPT &&
kenjiArai 0:5b88d5760320 639 NULL != ctx->add_padding)
kenjiArai 0:5b88d5760320 640 {
kenjiArai 0:5b88d5760320 641 copy_len = block_size;
kenjiArai 0:5b88d5760320 642 }
kenjiArai 0:5b88d5760320 643
kenjiArai 0:5b88d5760320 644 memcpy( ctx->unprocessed_data, &( input[ilen - copy_len] ),
kenjiArai 0:5b88d5760320 645 copy_len );
kenjiArai 0:5b88d5760320 646
kenjiArai 0:5b88d5760320 647 ctx->unprocessed_len += copy_len;
kenjiArai 0:5b88d5760320 648 ilen -= copy_len;
kenjiArai 0:5b88d5760320 649 }
kenjiArai 0:5b88d5760320 650
kenjiArai 0:5b88d5760320 651 /*
kenjiArai 0:5b88d5760320 652 * Process remaining full blocks
kenjiArai 0:5b88d5760320 653 */
kenjiArai 0:5b88d5760320 654 if( ilen )
kenjiArai 0:5b88d5760320 655 {
kenjiArai 0:5b88d5760320 656 if( 0 != ( ret = ctx->cipher_info->base->cbc_func( ctx->cipher_ctx,
kenjiArai 0:5b88d5760320 657 ctx->operation, ilen, ctx->iv, input, output ) ) )
kenjiArai 0:5b88d5760320 658 {
kenjiArai 0:5b88d5760320 659 return( ret );
kenjiArai 0:5b88d5760320 660 }
kenjiArai 0:5b88d5760320 661
kenjiArai 0:5b88d5760320 662 *olen += ilen;
kenjiArai 0:5b88d5760320 663 }
kenjiArai 0:5b88d5760320 664
kenjiArai 0:5b88d5760320 665 return( 0 );
kenjiArai 0:5b88d5760320 666 }
kenjiArai 0:5b88d5760320 667 #endif /* MBEDTLS_CIPHER_MODE_CBC */
kenjiArai 0:5b88d5760320 668
kenjiArai 0:5b88d5760320 669 #if defined(MBEDTLS_CIPHER_MODE_CFB)
kenjiArai 0:5b88d5760320 670 if( ctx->cipher_info->mode == MBEDTLS_MODE_CFB )
kenjiArai 0:5b88d5760320 671 {
kenjiArai 0:5b88d5760320 672 if( 0 != ( ret = ctx->cipher_info->base->cfb_func( ctx->cipher_ctx,
kenjiArai 0:5b88d5760320 673 ctx->operation, ilen, &ctx->unprocessed_len, ctx->iv,
kenjiArai 0:5b88d5760320 674 input, output ) ) )
kenjiArai 0:5b88d5760320 675 {
kenjiArai 0:5b88d5760320 676 return( ret );
kenjiArai 0:5b88d5760320 677 }
kenjiArai 0:5b88d5760320 678
kenjiArai 0:5b88d5760320 679 *olen = ilen;
kenjiArai 0:5b88d5760320 680
kenjiArai 0:5b88d5760320 681 return( 0 );
kenjiArai 0:5b88d5760320 682 }
kenjiArai 0:5b88d5760320 683 #endif /* MBEDTLS_CIPHER_MODE_CFB */
kenjiArai 0:5b88d5760320 684
kenjiArai 0:5b88d5760320 685 #if defined(MBEDTLS_CIPHER_MODE_OFB)
kenjiArai 0:5b88d5760320 686 if( ctx->cipher_info->mode == MBEDTLS_MODE_OFB )
kenjiArai 0:5b88d5760320 687 {
kenjiArai 0:5b88d5760320 688 if( 0 != ( ret = ctx->cipher_info->base->ofb_func( ctx->cipher_ctx,
kenjiArai 0:5b88d5760320 689 ilen, &ctx->unprocessed_len, ctx->iv, input, output ) ) )
kenjiArai 0:5b88d5760320 690 {
kenjiArai 0:5b88d5760320 691 return( ret );
kenjiArai 0:5b88d5760320 692 }
kenjiArai 0:5b88d5760320 693
kenjiArai 0:5b88d5760320 694 *olen = ilen;
kenjiArai 0:5b88d5760320 695
kenjiArai 0:5b88d5760320 696 return( 0 );
kenjiArai 0:5b88d5760320 697 }
kenjiArai 0:5b88d5760320 698 #endif /* MBEDTLS_CIPHER_MODE_OFB */
kenjiArai 0:5b88d5760320 699
kenjiArai 0:5b88d5760320 700 #if defined(MBEDTLS_CIPHER_MODE_CTR)
kenjiArai 0:5b88d5760320 701 if( ctx->cipher_info->mode == MBEDTLS_MODE_CTR )
kenjiArai 0:5b88d5760320 702 {
kenjiArai 0:5b88d5760320 703 if( 0 != ( ret = ctx->cipher_info->base->ctr_func( ctx->cipher_ctx,
kenjiArai 0:5b88d5760320 704 ilen, &ctx->unprocessed_len, ctx->iv,
kenjiArai 0:5b88d5760320 705 ctx->unprocessed_data, input, output ) ) )
kenjiArai 0:5b88d5760320 706 {
kenjiArai 0:5b88d5760320 707 return( ret );
kenjiArai 0:5b88d5760320 708 }
kenjiArai 0:5b88d5760320 709
kenjiArai 0:5b88d5760320 710 *olen = ilen;
kenjiArai 0:5b88d5760320 711
kenjiArai 0:5b88d5760320 712 return( 0 );
kenjiArai 0:5b88d5760320 713 }
kenjiArai 0:5b88d5760320 714 #endif /* MBEDTLS_CIPHER_MODE_CTR */
kenjiArai 0:5b88d5760320 715
kenjiArai 0:5b88d5760320 716 #if defined(MBEDTLS_CIPHER_MODE_XTS)
kenjiArai 0:5b88d5760320 717 if( ctx->cipher_info->mode == MBEDTLS_MODE_XTS )
kenjiArai 0:5b88d5760320 718 {
kenjiArai 0:5b88d5760320 719 if( ctx->unprocessed_len > 0 ) {
kenjiArai 0:5b88d5760320 720 /* We can only process an entire data unit at a time. */
kenjiArai 0:5b88d5760320 721 return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
kenjiArai 0:5b88d5760320 722 }
kenjiArai 0:5b88d5760320 723
kenjiArai 0:5b88d5760320 724 ret = ctx->cipher_info->base->xts_func( ctx->cipher_ctx,
kenjiArai 0:5b88d5760320 725 ctx->operation, ilen, ctx->iv, input, output );
kenjiArai 0:5b88d5760320 726 if( ret != 0 )
kenjiArai 0:5b88d5760320 727 {
kenjiArai 0:5b88d5760320 728 return( ret );
kenjiArai 0:5b88d5760320 729 }
kenjiArai 0:5b88d5760320 730
kenjiArai 0:5b88d5760320 731 *olen = ilen;
kenjiArai 0:5b88d5760320 732
kenjiArai 0:5b88d5760320 733 return( 0 );
kenjiArai 0:5b88d5760320 734 }
kenjiArai 0:5b88d5760320 735 #endif /* MBEDTLS_CIPHER_MODE_XTS */
kenjiArai 0:5b88d5760320 736
kenjiArai 0:5b88d5760320 737 #if defined(MBEDTLS_CIPHER_MODE_STREAM)
kenjiArai 0:5b88d5760320 738 if( ctx->cipher_info->mode == MBEDTLS_MODE_STREAM )
kenjiArai 0:5b88d5760320 739 {
kenjiArai 0:5b88d5760320 740 if( 0 != ( ret = ctx->cipher_info->base->stream_func( ctx->cipher_ctx,
kenjiArai 0:5b88d5760320 741 ilen, input, output ) ) )
kenjiArai 0:5b88d5760320 742 {
kenjiArai 0:5b88d5760320 743 return( ret );
kenjiArai 0:5b88d5760320 744 }
kenjiArai 0:5b88d5760320 745
kenjiArai 0:5b88d5760320 746 *olen = ilen;
kenjiArai 0:5b88d5760320 747
kenjiArai 0:5b88d5760320 748 return( 0 );
kenjiArai 0:5b88d5760320 749 }
kenjiArai 0:5b88d5760320 750 #endif /* MBEDTLS_CIPHER_MODE_STREAM */
kenjiArai 0:5b88d5760320 751
kenjiArai 0:5b88d5760320 752 return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
kenjiArai 0:5b88d5760320 753 }
kenjiArai 0:5b88d5760320 754
kenjiArai 0:5b88d5760320 755 #if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING)
kenjiArai 0:5b88d5760320 756 #if defined(MBEDTLS_CIPHER_PADDING_PKCS7)
kenjiArai 0:5b88d5760320 757 /*
kenjiArai 0:5b88d5760320 758 * PKCS7 (and PKCS5) padding: fill with ll bytes, with ll = padding_len
kenjiArai 0:5b88d5760320 759 */
kenjiArai 0:5b88d5760320 760 static void add_pkcs_padding( unsigned char *output, size_t output_len,
kenjiArai 0:5b88d5760320 761 size_t data_len )
kenjiArai 0:5b88d5760320 762 {
kenjiArai 0:5b88d5760320 763 size_t padding_len = output_len - data_len;
kenjiArai 0:5b88d5760320 764 unsigned char i;
kenjiArai 0:5b88d5760320 765
kenjiArai 0:5b88d5760320 766 for( i = 0; i < padding_len; i++ )
kenjiArai 0:5b88d5760320 767 output[data_len + i] = (unsigned char) padding_len;
kenjiArai 0:5b88d5760320 768 }
kenjiArai 0:5b88d5760320 769
kenjiArai 0:5b88d5760320 770 static int get_pkcs_padding( unsigned char *input, size_t input_len,
kenjiArai 0:5b88d5760320 771 size_t *data_len )
kenjiArai 0:5b88d5760320 772 {
kenjiArai 0:5b88d5760320 773 size_t i, pad_idx;
kenjiArai 0:5b88d5760320 774 unsigned char padding_len, bad = 0;
kenjiArai 0:5b88d5760320 775
kenjiArai 0:5b88d5760320 776 if( NULL == input || NULL == data_len )
kenjiArai 0:5b88d5760320 777 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 778
kenjiArai 0:5b88d5760320 779 padding_len = input[input_len - 1];
kenjiArai 0:5b88d5760320 780 *data_len = input_len - padding_len;
kenjiArai 0:5b88d5760320 781
kenjiArai 0:5b88d5760320 782 /* Avoid logical || since it results in a branch */
kenjiArai 0:5b88d5760320 783 bad |= padding_len > input_len;
kenjiArai 0:5b88d5760320 784 bad |= padding_len == 0;
kenjiArai 0:5b88d5760320 785
kenjiArai 0:5b88d5760320 786 /* The number of bytes checked must be independent of padding_len,
kenjiArai 0:5b88d5760320 787 * so pick input_len, which is usually 8 or 16 (one block) */
kenjiArai 0:5b88d5760320 788 pad_idx = input_len - padding_len;
kenjiArai 0:5b88d5760320 789 for( i = 0; i < input_len; i++ )
kenjiArai 0:5b88d5760320 790 bad |= ( input[i] ^ padding_len ) * ( i >= pad_idx );
kenjiArai 0:5b88d5760320 791
kenjiArai 0:5b88d5760320 792 return( MBEDTLS_ERR_CIPHER_INVALID_PADDING * ( bad != 0 ) );
kenjiArai 0:5b88d5760320 793 }
kenjiArai 0:5b88d5760320 794 #endif /* MBEDTLS_CIPHER_PADDING_PKCS7 */
kenjiArai 0:5b88d5760320 795
kenjiArai 0:5b88d5760320 796 #if defined(MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS)
kenjiArai 0:5b88d5760320 797 /*
kenjiArai 0:5b88d5760320 798 * One and zeros padding: fill with 80 00 ... 00
kenjiArai 0:5b88d5760320 799 */
kenjiArai 0:5b88d5760320 800 static void add_one_and_zeros_padding( unsigned char *output,
kenjiArai 0:5b88d5760320 801 size_t output_len, size_t data_len )
kenjiArai 0:5b88d5760320 802 {
kenjiArai 0:5b88d5760320 803 size_t padding_len = output_len - data_len;
kenjiArai 0:5b88d5760320 804 unsigned char i = 0;
kenjiArai 0:5b88d5760320 805
kenjiArai 0:5b88d5760320 806 output[data_len] = 0x80;
kenjiArai 0:5b88d5760320 807 for( i = 1; i < padding_len; i++ )
kenjiArai 0:5b88d5760320 808 output[data_len + i] = 0x00;
kenjiArai 0:5b88d5760320 809 }
kenjiArai 0:5b88d5760320 810
kenjiArai 0:5b88d5760320 811 static int get_one_and_zeros_padding( unsigned char *input, size_t input_len,
kenjiArai 0:5b88d5760320 812 size_t *data_len )
kenjiArai 0:5b88d5760320 813 {
kenjiArai 0:5b88d5760320 814 size_t i;
kenjiArai 0:5b88d5760320 815 unsigned char done = 0, prev_done, bad;
kenjiArai 0:5b88d5760320 816
kenjiArai 0:5b88d5760320 817 if( NULL == input || NULL == data_len )
kenjiArai 0:5b88d5760320 818 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 819
kenjiArai 0:5b88d5760320 820 bad = 0x80;
kenjiArai 0:5b88d5760320 821 *data_len = 0;
kenjiArai 0:5b88d5760320 822 for( i = input_len; i > 0; i-- )
kenjiArai 0:5b88d5760320 823 {
kenjiArai 0:5b88d5760320 824 prev_done = done;
kenjiArai 0:5b88d5760320 825 done |= ( input[i - 1] != 0 );
kenjiArai 0:5b88d5760320 826 *data_len |= ( i - 1 ) * ( done != prev_done );
kenjiArai 0:5b88d5760320 827 bad ^= input[i - 1] * ( done != prev_done );
kenjiArai 0:5b88d5760320 828 }
kenjiArai 0:5b88d5760320 829
kenjiArai 0:5b88d5760320 830 return( MBEDTLS_ERR_CIPHER_INVALID_PADDING * ( bad != 0 ) );
kenjiArai 0:5b88d5760320 831
kenjiArai 0:5b88d5760320 832 }
kenjiArai 0:5b88d5760320 833 #endif /* MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS */
kenjiArai 0:5b88d5760320 834
kenjiArai 0:5b88d5760320 835 #if defined(MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN)
kenjiArai 0:5b88d5760320 836 /*
kenjiArai 0:5b88d5760320 837 * Zeros and len padding: fill with 00 ... 00 ll, where ll is padding length
kenjiArai 0:5b88d5760320 838 */
kenjiArai 0:5b88d5760320 839 static void add_zeros_and_len_padding( unsigned char *output,
kenjiArai 0:5b88d5760320 840 size_t output_len, size_t data_len )
kenjiArai 0:5b88d5760320 841 {
kenjiArai 0:5b88d5760320 842 size_t padding_len = output_len - data_len;
kenjiArai 0:5b88d5760320 843 unsigned char i = 0;
kenjiArai 0:5b88d5760320 844
kenjiArai 0:5b88d5760320 845 for( i = 1; i < padding_len; i++ )
kenjiArai 0:5b88d5760320 846 output[data_len + i - 1] = 0x00;
kenjiArai 0:5b88d5760320 847 output[output_len - 1] = (unsigned char) padding_len;
kenjiArai 0:5b88d5760320 848 }
kenjiArai 0:5b88d5760320 849
kenjiArai 0:5b88d5760320 850 static int get_zeros_and_len_padding( unsigned char *input, size_t input_len,
kenjiArai 0:5b88d5760320 851 size_t *data_len )
kenjiArai 0:5b88d5760320 852 {
kenjiArai 0:5b88d5760320 853 size_t i, pad_idx;
kenjiArai 0:5b88d5760320 854 unsigned char padding_len, bad = 0;
kenjiArai 0:5b88d5760320 855
kenjiArai 0:5b88d5760320 856 if( NULL == input || NULL == data_len )
kenjiArai 0:5b88d5760320 857 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 858
kenjiArai 0:5b88d5760320 859 padding_len = input[input_len - 1];
kenjiArai 0:5b88d5760320 860 *data_len = input_len - padding_len;
kenjiArai 0:5b88d5760320 861
kenjiArai 0:5b88d5760320 862 /* Avoid logical || since it results in a branch */
kenjiArai 0:5b88d5760320 863 bad |= padding_len > input_len;
kenjiArai 0:5b88d5760320 864 bad |= padding_len == 0;
kenjiArai 0:5b88d5760320 865
kenjiArai 0:5b88d5760320 866 /* The number of bytes checked must be independent of padding_len */
kenjiArai 0:5b88d5760320 867 pad_idx = input_len - padding_len;
kenjiArai 0:5b88d5760320 868 for( i = 0; i < input_len - 1; i++ )
kenjiArai 0:5b88d5760320 869 bad |= input[i] * ( i >= pad_idx );
kenjiArai 0:5b88d5760320 870
kenjiArai 0:5b88d5760320 871 return( MBEDTLS_ERR_CIPHER_INVALID_PADDING * ( bad != 0 ) );
kenjiArai 0:5b88d5760320 872 }
kenjiArai 0:5b88d5760320 873 #endif /* MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN */
kenjiArai 0:5b88d5760320 874
kenjiArai 0:5b88d5760320 875 #if defined(MBEDTLS_CIPHER_PADDING_ZEROS)
kenjiArai 0:5b88d5760320 876 /*
kenjiArai 0:5b88d5760320 877 * Zero padding: fill with 00 ... 00
kenjiArai 0:5b88d5760320 878 */
kenjiArai 0:5b88d5760320 879 static void add_zeros_padding( unsigned char *output,
kenjiArai 0:5b88d5760320 880 size_t output_len, size_t data_len )
kenjiArai 0:5b88d5760320 881 {
kenjiArai 0:5b88d5760320 882 size_t i;
kenjiArai 0:5b88d5760320 883
kenjiArai 0:5b88d5760320 884 for( i = data_len; i < output_len; i++ )
kenjiArai 0:5b88d5760320 885 output[i] = 0x00;
kenjiArai 0:5b88d5760320 886 }
kenjiArai 0:5b88d5760320 887
kenjiArai 0:5b88d5760320 888 static int get_zeros_padding( unsigned char *input, size_t input_len,
kenjiArai 0:5b88d5760320 889 size_t *data_len )
kenjiArai 0:5b88d5760320 890 {
kenjiArai 0:5b88d5760320 891 size_t i;
kenjiArai 0:5b88d5760320 892 unsigned char done = 0, prev_done;
kenjiArai 0:5b88d5760320 893
kenjiArai 0:5b88d5760320 894 if( NULL == input || NULL == data_len )
kenjiArai 0:5b88d5760320 895 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 896
kenjiArai 0:5b88d5760320 897 *data_len = 0;
kenjiArai 0:5b88d5760320 898 for( i = input_len; i > 0; i-- )
kenjiArai 0:5b88d5760320 899 {
kenjiArai 0:5b88d5760320 900 prev_done = done;
kenjiArai 0:5b88d5760320 901 done |= ( input[i-1] != 0 );
kenjiArai 0:5b88d5760320 902 *data_len |= i * ( done != prev_done );
kenjiArai 0:5b88d5760320 903 }
kenjiArai 0:5b88d5760320 904
kenjiArai 0:5b88d5760320 905 return( 0 );
kenjiArai 0:5b88d5760320 906 }
kenjiArai 0:5b88d5760320 907 #endif /* MBEDTLS_CIPHER_PADDING_ZEROS */
kenjiArai 0:5b88d5760320 908
kenjiArai 0:5b88d5760320 909 /*
kenjiArai 0:5b88d5760320 910 * No padding: don't pad :)
kenjiArai 0:5b88d5760320 911 *
kenjiArai 0:5b88d5760320 912 * There is no add_padding function (check for NULL in mbedtls_cipher_finish)
kenjiArai 0:5b88d5760320 913 * but a trivial get_padding function
kenjiArai 0:5b88d5760320 914 */
kenjiArai 0:5b88d5760320 915 static int get_no_padding( unsigned char *input, size_t input_len,
kenjiArai 0:5b88d5760320 916 size_t *data_len )
kenjiArai 0:5b88d5760320 917 {
kenjiArai 0:5b88d5760320 918 if( NULL == input || NULL == data_len )
kenjiArai 0:5b88d5760320 919 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 920
kenjiArai 0:5b88d5760320 921 *data_len = input_len;
kenjiArai 0:5b88d5760320 922
kenjiArai 0:5b88d5760320 923 return( 0 );
kenjiArai 0:5b88d5760320 924 }
kenjiArai 0:5b88d5760320 925 #endif /* MBEDTLS_CIPHER_MODE_WITH_PADDING */
kenjiArai 0:5b88d5760320 926
kenjiArai 0:5b88d5760320 927 int mbedtls_cipher_finish( mbedtls_cipher_context_t *ctx,
kenjiArai 0:5b88d5760320 928 unsigned char *output, size_t *olen )
kenjiArai 0:5b88d5760320 929 {
kenjiArai 0:5b88d5760320 930 CIPHER_VALIDATE_RET( ctx != NULL );
kenjiArai 0:5b88d5760320 931 CIPHER_VALIDATE_RET( output != NULL );
kenjiArai 0:5b88d5760320 932 CIPHER_VALIDATE_RET( olen != NULL );
kenjiArai 0:5b88d5760320 933 if( ctx->cipher_info == NULL )
kenjiArai 0:5b88d5760320 934 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 935
kenjiArai 0:5b88d5760320 936 #if defined(MBEDTLS_USE_PSA_CRYPTO)
kenjiArai 0:5b88d5760320 937 if( ctx->psa_enabled == 1 )
kenjiArai 0:5b88d5760320 938 {
kenjiArai 0:5b88d5760320 939 /* While PSA Crypto has an API for multipart
kenjiArai 0:5b88d5760320 940 * operations, we currently don't make it
kenjiArai 0:5b88d5760320 941 * accessible through the cipher layer. */
kenjiArai 0:5b88d5760320 942 return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
kenjiArai 0:5b88d5760320 943 }
kenjiArai 0:5b88d5760320 944 #endif /* MBEDTLS_USE_PSA_CRYPTO */
kenjiArai 0:5b88d5760320 945
kenjiArai 0:5b88d5760320 946 *olen = 0;
kenjiArai 0:5b88d5760320 947
kenjiArai 0:5b88d5760320 948 if( MBEDTLS_MODE_CFB == ctx->cipher_info->mode ||
kenjiArai 0:5b88d5760320 949 MBEDTLS_MODE_OFB == ctx->cipher_info->mode ||
kenjiArai 0:5b88d5760320 950 MBEDTLS_MODE_CTR == ctx->cipher_info->mode ||
kenjiArai 0:5b88d5760320 951 MBEDTLS_MODE_GCM == ctx->cipher_info->mode ||
kenjiArai 0:5b88d5760320 952 MBEDTLS_MODE_XTS == ctx->cipher_info->mode ||
kenjiArai 0:5b88d5760320 953 MBEDTLS_MODE_STREAM == ctx->cipher_info->mode )
kenjiArai 0:5b88d5760320 954 {
kenjiArai 0:5b88d5760320 955 return( 0 );
kenjiArai 0:5b88d5760320 956 }
kenjiArai 0:5b88d5760320 957
kenjiArai 0:5b88d5760320 958 if ( ( MBEDTLS_CIPHER_CHACHA20 == ctx->cipher_info->type ) ||
kenjiArai 0:5b88d5760320 959 ( MBEDTLS_CIPHER_CHACHA20_POLY1305 == ctx->cipher_info->type ) )
kenjiArai 0:5b88d5760320 960 {
kenjiArai 0:5b88d5760320 961 return( 0 );
kenjiArai 0:5b88d5760320 962 }
kenjiArai 0:5b88d5760320 963
kenjiArai 0:5b88d5760320 964 if( MBEDTLS_MODE_ECB == ctx->cipher_info->mode )
kenjiArai 0:5b88d5760320 965 {
kenjiArai 0:5b88d5760320 966 if( ctx->unprocessed_len != 0 )
kenjiArai 0:5b88d5760320 967 return( MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED );
kenjiArai 0:5b88d5760320 968
kenjiArai 0:5b88d5760320 969 return( 0 );
kenjiArai 0:5b88d5760320 970 }
kenjiArai 0:5b88d5760320 971
kenjiArai 0:5b88d5760320 972 #if defined(MBEDTLS_CIPHER_MODE_CBC)
kenjiArai 0:5b88d5760320 973 if( MBEDTLS_MODE_CBC == ctx->cipher_info->mode )
kenjiArai 0:5b88d5760320 974 {
kenjiArai 0:5b88d5760320 975 int ret = 0;
kenjiArai 0:5b88d5760320 976
kenjiArai 0:5b88d5760320 977 if( MBEDTLS_ENCRYPT == ctx->operation )
kenjiArai 0:5b88d5760320 978 {
kenjiArai 0:5b88d5760320 979 /* check for 'no padding' mode */
kenjiArai 0:5b88d5760320 980 if( NULL == ctx->add_padding )
kenjiArai 0:5b88d5760320 981 {
kenjiArai 0:5b88d5760320 982 if( 0 != ctx->unprocessed_len )
kenjiArai 0:5b88d5760320 983 return( MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED );
kenjiArai 0:5b88d5760320 984
kenjiArai 0:5b88d5760320 985 return( 0 );
kenjiArai 0:5b88d5760320 986 }
kenjiArai 0:5b88d5760320 987
kenjiArai 0:5b88d5760320 988 ctx->add_padding( ctx->unprocessed_data, mbedtls_cipher_get_iv_size( ctx ),
kenjiArai 0:5b88d5760320 989 ctx->unprocessed_len );
kenjiArai 0:5b88d5760320 990 }
kenjiArai 0:5b88d5760320 991 else if( mbedtls_cipher_get_block_size( ctx ) != ctx->unprocessed_len )
kenjiArai 0:5b88d5760320 992 {
kenjiArai 0:5b88d5760320 993 /*
kenjiArai 0:5b88d5760320 994 * For decrypt operations, expect a full block,
kenjiArai 0:5b88d5760320 995 * or an empty block if no padding
kenjiArai 0:5b88d5760320 996 */
kenjiArai 0:5b88d5760320 997 if( NULL == ctx->add_padding && 0 == ctx->unprocessed_len )
kenjiArai 0:5b88d5760320 998 return( 0 );
kenjiArai 0:5b88d5760320 999
kenjiArai 0:5b88d5760320 1000 return( MBEDTLS_ERR_CIPHER_FULL_BLOCK_EXPECTED );
kenjiArai 0:5b88d5760320 1001 }
kenjiArai 0:5b88d5760320 1002
kenjiArai 0:5b88d5760320 1003 /* cipher block */
kenjiArai 0:5b88d5760320 1004 if( 0 != ( ret = ctx->cipher_info->base->cbc_func( ctx->cipher_ctx,
kenjiArai 0:5b88d5760320 1005 ctx->operation, mbedtls_cipher_get_block_size( ctx ), ctx->iv,
kenjiArai 0:5b88d5760320 1006 ctx->unprocessed_data, output ) ) )
kenjiArai 0:5b88d5760320 1007 {
kenjiArai 0:5b88d5760320 1008 return( ret );
kenjiArai 0:5b88d5760320 1009 }
kenjiArai 0:5b88d5760320 1010
kenjiArai 0:5b88d5760320 1011 /* Set output size for decryption */
kenjiArai 0:5b88d5760320 1012 if( MBEDTLS_DECRYPT == ctx->operation )
kenjiArai 0:5b88d5760320 1013 return( ctx->get_padding( output, mbedtls_cipher_get_block_size( ctx ),
kenjiArai 0:5b88d5760320 1014 olen ) );
kenjiArai 0:5b88d5760320 1015
kenjiArai 0:5b88d5760320 1016 /* Set output size for encryption */
kenjiArai 0:5b88d5760320 1017 *olen = mbedtls_cipher_get_block_size( ctx );
kenjiArai 0:5b88d5760320 1018 return( 0 );
kenjiArai 0:5b88d5760320 1019 }
kenjiArai 0:5b88d5760320 1020 #else
kenjiArai 0:5b88d5760320 1021 ((void) output);
kenjiArai 0:5b88d5760320 1022 #endif /* MBEDTLS_CIPHER_MODE_CBC */
kenjiArai 0:5b88d5760320 1023
kenjiArai 0:5b88d5760320 1024 return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
kenjiArai 0:5b88d5760320 1025 }
kenjiArai 0:5b88d5760320 1026
kenjiArai 0:5b88d5760320 1027 #if defined(MBEDTLS_CIPHER_MODE_WITH_PADDING)
kenjiArai 0:5b88d5760320 1028 int mbedtls_cipher_set_padding_mode( mbedtls_cipher_context_t *ctx,
kenjiArai 0:5b88d5760320 1029 mbedtls_cipher_padding_t mode )
kenjiArai 0:5b88d5760320 1030 {
kenjiArai 0:5b88d5760320 1031 CIPHER_VALIDATE_RET( ctx != NULL );
kenjiArai 0:5b88d5760320 1032
kenjiArai 0:5b88d5760320 1033 if( NULL == ctx->cipher_info || MBEDTLS_MODE_CBC != ctx->cipher_info->mode )
kenjiArai 0:5b88d5760320 1034 {
kenjiArai 0:5b88d5760320 1035 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 1036 }
kenjiArai 0:5b88d5760320 1037
kenjiArai 0:5b88d5760320 1038 #if defined(MBEDTLS_USE_PSA_CRYPTO)
kenjiArai 0:5b88d5760320 1039 if( ctx->psa_enabled == 1 )
kenjiArai 0:5b88d5760320 1040 {
kenjiArai 0:5b88d5760320 1041 /* While PSA Crypto knows about CBC padding
kenjiArai 0:5b88d5760320 1042 * schemes, we currently don't make them
kenjiArai 0:5b88d5760320 1043 * accessible through the cipher layer. */
kenjiArai 0:5b88d5760320 1044 if( mode != MBEDTLS_PADDING_NONE )
kenjiArai 0:5b88d5760320 1045 return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
kenjiArai 0:5b88d5760320 1046
kenjiArai 0:5b88d5760320 1047 return( 0 );
kenjiArai 0:5b88d5760320 1048 }
kenjiArai 0:5b88d5760320 1049 #endif /* MBEDTLS_USE_PSA_CRYPTO */
kenjiArai 0:5b88d5760320 1050
kenjiArai 0:5b88d5760320 1051 switch( mode )
kenjiArai 0:5b88d5760320 1052 {
kenjiArai 0:5b88d5760320 1053 #if defined(MBEDTLS_CIPHER_PADDING_PKCS7)
kenjiArai 0:5b88d5760320 1054 case MBEDTLS_PADDING_PKCS7:
kenjiArai 0:5b88d5760320 1055 ctx->add_padding = add_pkcs_padding;
kenjiArai 0:5b88d5760320 1056 ctx->get_padding = get_pkcs_padding;
kenjiArai 0:5b88d5760320 1057 break;
kenjiArai 0:5b88d5760320 1058 #endif
kenjiArai 0:5b88d5760320 1059 #if defined(MBEDTLS_CIPHER_PADDING_ONE_AND_ZEROS)
kenjiArai 0:5b88d5760320 1060 case MBEDTLS_PADDING_ONE_AND_ZEROS:
kenjiArai 0:5b88d5760320 1061 ctx->add_padding = add_one_and_zeros_padding;
kenjiArai 0:5b88d5760320 1062 ctx->get_padding = get_one_and_zeros_padding;
kenjiArai 0:5b88d5760320 1063 break;
kenjiArai 0:5b88d5760320 1064 #endif
kenjiArai 0:5b88d5760320 1065 #if defined(MBEDTLS_CIPHER_PADDING_ZEROS_AND_LEN)
kenjiArai 0:5b88d5760320 1066 case MBEDTLS_PADDING_ZEROS_AND_LEN:
kenjiArai 0:5b88d5760320 1067 ctx->add_padding = add_zeros_and_len_padding;
kenjiArai 0:5b88d5760320 1068 ctx->get_padding = get_zeros_and_len_padding;
kenjiArai 0:5b88d5760320 1069 break;
kenjiArai 0:5b88d5760320 1070 #endif
kenjiArai 0:5b88d5760320 1071 #if defined(MBEDTLS_CIPHER_PADDING_ZEROS)
kenjiArai 0:5b88d5760320 1072 case MBEDTLS_PADDING_ZEROS:
kenjiArai 0:5b88d5760320 1073 ctx->add_padding = add_zeros_padding;
kenjiArai 0:5b88d5760320 1074 ctx->get_padding = get_zeros_padding;
kenjiArai 0:5b88d5760320 1075 break;
kenjiArai 0:5b88d5760320 1076 #endif
kenjiArai 0:5b88d5760320 1077 case MBEDTLS_PADDING_NONE:
kenjiArai 0:5b88d5760320 1078 ctx->add_padding = NULL;
kenjiArai 0:5b88d5760320 1079 ctx->get_padding = get_no_padding;
kenjiArai 0:5b88d5760320 1080 break;
kenjiArai 0:5b88d5760320 1081
kenjiArai 0:5b88d5760320 1082 default:
kenjiArai 0:5b88d5760320 1083 return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
kenjiArai 0:5b88d5760320 1084 }
kenjiArai 0:5b88d5760320 1085
kenjiArai 0:5b88d5760320 1086 return( 0 );
kenjiArai 0:5b88d5760320 1087 }
kenjiArai 0:5b88d5760320 1088 #endif /* MBEDTLS_CIPHER_MODE_WITH_PADDING */
kenjiArai 0:5b88d5760320 1089
kenjiArai 0:5b88d5760320 1090 #if defined(MBEDTLS_GCM_C) || defined(MBEDTLS_CHACHAPOLY_C)
kenjiArai 0:5b88d5760320 1091 int mbedtls_cipher_write_tag( mbedtls_cipher_context_t *ctx,
kenjiArai 0:5b88d5760320 1092 unsigned char *tag, size_t tag_len )
kenjiArai 0:5b88d5760320 1093 {
kenjiArai 0:5b88d5760320 1094 CIPHER_VALIDATE_RET( ctx != NULL );
kenjiArai 0:5b88d5760320 1095 CIPHER_VALIDATE_RET( tag_len == 0 || tag != NULL );
kenjiArai 0:5b88d5760320 1096 if( ctx->cipher_info == NULL )
kenjiArai 0:5b88d5760320 1097 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 1098
kenjiArai 0:5b88d5760320 1099 if( MBEDTLS_ENCRYPT != ctx->operation )
kenjiArai 0:5b88d5760320 1100 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 1101
kenjiArai 0:5b88d5760320 1102 #if defined(MBEDTLS_USE_PSA_CRYPTO)
kenjiArai 0:5b88d5760320 1103 if( ctx->psa_enabled == 1 )
kenjiArai 0:5b88d5760320 1104 {
kenjiArai 0:5b88d5760320 1105 /* While PSA Crypto has an API for multipart
kenjiArai 0:5b88d5760320 1106 * operations, we currently don't make it
kenjiArai 0:5b88d5760320 1107 * accessible through the cipher layer. */
kenjiArai 0:5b88d5760320 1108 return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
kenjiArai 0:5b88d5760320 1109 }
kenjiArai 0:5b88d5760320 1110 #endif /* MBEDTLS_USE_PSA_CRYPTO */
kenjiArai 0:5b88d5760320 1111
kenjiArai 0:5b88d5760320 1112 #if defined(MBEDTLS_GCM_C)
kenjiArai 0:5b88d5760320 1113 if( MBEDTLS_MODE_GCM == ctx->cipher_info->mode )
kenjiArai 0:5b88d5760320 1114 return( mbedtls_gcm_finish( (mbedtls_gcm_context *) ctx->cipher_ctx,
kenjiArai 0:5b88d5760320 1115 tag, tag_len ) );
kenjiArai 0:5b88d5760320 1116 #endif
kenjiArai 0:5b88d5760320 1117
kenjiArai 0:5b88d5760320 1118 #if defined(MBEDTLS_CHACHAPOLY_C)
kenjiArai 0:5b88d5760320 1119 if ( MBEDTLS_CIPHER_CHACHA20_POLY1305 == ctx->cipher_info->type )
kenjiArai 0:5b88d5760320 1120 {
kenjiArai 0:5b88d5760320 1121 /* Don't allow truncated MAC for Poly1305 */
kenjiArai 0:5b88d5760320 1122 if ( tag_len != 16U )
kenjiArai 0:5b88d5760320 1123 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 1124
kenjiArai 0:5b88d5760320 1125 return( mbedtls_chachapoly_finish(
kenjiArai 0:5b88d5760320 1126 (mbedtls_chachapoly_context*) ctx->cipher_ctx, tag ) );
kenjiArai 0:5b88d5760320 1127 }
kenjiArai 0:5b88d5760320 1128 #endif
kenjiArai 0:5b88d5760320 1129
kenjiArai 0:5b88d5760320 1130 return( 0 );
kenjiArai 0:5b88d5760320 1131 }
kenjiArai 0:5b88d5760320 1132
kenjiArai 0:5b88d5760320 1133 int mbedtls_cipher_check_tag( mbedtls_cipher_context_t *ctx,
kenjiArai 0:5b88d5760320 1134 const unsigned char *tag, size_t tag_len )
kenjiArai 0:5b88d5760320 1135 {
kenjiArai 0:5b88d5760320 1136 unsigned char check_tag[16];
kenjiArai 0:5b88d5760320 1137 int ret;
kenjiArai 0:5b88d5760320 1138
kenjiArai 0:5b88d5760320 1139 CIPHER_VALIDATE_RET( ctx != NULL );
kenjiArai 0:5b88d5760320 1140 CIPHER_VALIDATE_RET( tag_len == 0 || tag != NULL );
kenjiArai 0:5b88d5760320 1141 if( ctx->cipher_info == NULL )
kenjiArai 0:5b88d5760320 1142 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 1143
kenjiArai 0:5b88d5760320 1144 if( MBEDTLS_DECRYPT != ctx->operation )
kenjiArai 0:5b88d5760320 1145 {
kenjiArai 0:5b88d5760320 1146 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 1147 }
kenjiArai 0:5b88d5760320 1148
kenjiArai 0:5b88d5760320 1149 #if defined(MBEDTLS_USE_PSA_CRYPTO)
kenjiArai 0:5b88d5760320 1150 if( ctx->psa_enabled == 1 )
kenjiArai 0:5b88d5760320 1151 {
kenjiArai 0:5b88d5760320 1152 /* While PSA Crypto has an API for multipart
kenjiArai 0:5b88d5760320 1153 * operations, we currently don't make it
kenjiArai 0:5b88d5760320 1154 * accessible through the cipher layer. */
kenjiArai 0:5b88d5760320 1155 return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
kenjiArai 0:5b88d5760320 1156 }
kenjiArai 0:5b88d5760320 1157 #endif /* MBEDTLS_USE_PSA_CRYPTO */
kenjiArai 0:5b88d5760320 1158
kenjiArai 0:5b88d5760320 1159 #if defined(MBEDTLS_GCM_C)
kenjiArai 0:5b88d5760320 1160 if( MBEDTLS_MODE_GCM == ctx->cipher_info->mode )
kenjiArai 0:5b88d5760320 1161 {
kenjiArai 0:5b88d5760320 1162 if( tag_len > sizeof( check_tag ) )
kenjiArai 0:5b88d5760320 1163 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 1164
kenjiArai 0:5b88d5760320 1165 if( 0 != ( ret = mbedtls_gcm_finish(
kenjiArai 0:5b88d5760320 1166 (mbedtls_gcm_context *) ctx->cipher_ctx,
kenjiArai 0:5b88d5760320 1167 check_tag, tag_len ) ) )
kenjiArai 0:5b88d5760320 1168 {
kenjiArai 0:5b88d5760320 1169 return( ret );
kenjiArai 0:5b88d5760320 1170 }
kenjiArai 0:5b88d5760320 1171
kenjiArai 0:5b88d5760320 1172 /* Check the tag in "constant-time" */
kenjiArai 0:5b88d5760320 1173 if( mbedtls_constant_time_memcmp( tag, check_tag, tag_len ) != 0 )
kenjiArai 0:5b88d5760320 1174 return( MBEDTLS_ERR_CIPHER_AUTH_FAILED );
kenjiArai 0:5b88d5760320 1175
kenjiArai 0:5b88d5760320 1176 return( 0 );
kenjiArai 0:5b88d5760320 1177 }
kenjiArai 0:5b88d5760320 1178 #endif /* MBEDTLS_GCM_C */
kenjiArai 0:5b88d5760320 1179
kenjiArai 0:5b88d5760320 1180 #if defined(MBEDTLS_CHACHAPOLY_C)
kenjiArai 0:5b88d5760320 1181 if ( MBEDTLS_CIPHER_CHACHA20_POLY1305 == ctx->cipher_info->type )
kenjiArai 0:5b88d5760320 1182 {
kenjiArai 0:5b88d5760320 1183 /* Don't allow truncated MAC for Poly1305 */
kenjiArai 0:5b88d5760320 1184 if ( tag_len != sizeof( check_tag ) )
kenjiArai 0:5b88d5760320 1185 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 1186
kenjiArai 0:5b88d5760320 1187 ret = mbedtls_chachapoly_finish(
kenjiArai 0:5b88d5760320 1188 (mbedtls_chachapoly_context*) ctx->cipher_ctx, check_tag );
kenjiArai 0:5b88d5760320 1189 if ( ret != 0 )
kenjiArai 0:5b88d5760320 1190 {
kenjiArai 0:5b88d5760320 1191 return( ret );
kenjiArai 0:5b88d5760320 1192 }
kenjiArai 0:5b88d5760320 1193
kenjiArai 0:5b88d5760320 1194 /* Check the tag in "constant-time" */
kenjiArai 0:5b88d5760320 1195 if( mbedtls_constant_time_memcmp( tag, check_tag, tag_len ) != 0 )
kenjiArai 0:5b88d5760320 1196 return( MBEDTLS_ERR_CIPHER_AUTH_FAILED );
kenjiArai 0:5b88d5760320 1197
kenjiArai 0:5b88d5760320 1198 return( 0 );
kenjiArai 0:5b88d5760320 1199 }
kenjiArai 0:5b88d5760320 1200 #endif /* MBEDTLS_CHACHAPOLY_C */
kenjiArai 0:5b88d5760320 1201
kenjiArai 0:5b88d5760320 1202 return( 0 );
kenjiArai 0:5b88d5760320 1203 }
kenjiArai 0:5b88d5760320 1204 #endif /* MBEDTLS_GCM_C || MBEDTLS_CHACHAPOLY_C */
kenjiArai 0:5b88d5760320 1205
kenjiArai 0:5b88d5760320 1206 /*
kenjiArai 0:5b88d5760320 1207 * Packet-oriented wrapper for non-AEAD modes
kenjiArai 0:5b88d5760320 1208 */
kenjiArai 0:5b88d5760320 1209 int mbedtls_cipher_crypt( mbedtls_cipher_context_t *ctx,
kenjiArai 0:5b88d5760320 1210 const unsigned char *iv, size_t iv_len,
kenjiArai 0:5b88d5760320 1211 const unsigned char *input, size_t ilen,
kenjiArai 0:5b88d5760320 1212 unsigned char *output, size_t *olen )
kenjiArai 0:5b88d5760320 1213 {
kenjiArai 0:5b88d5760320 1214 int ret;
kenjiArai 0:5b88d5760320 1215 size_t finish_olen;
kenjiArai 0:5b88d5760320 1216
kenjiArai 0:5b88d5760320 1217 CIPHER_VALIDATE_RET( ctx != NULL );
kenjiArai 0:5b88d5760320 1218 CIPHER_VALIDATE_RET( iv_len == 0 || iv != NULL );
kenjiArai 0:5b88d5760320 1219 CIPHER_VALIDATE_RET( ilen == 0 || input != NULL );
kenjiArai 0:5b88d5760320 1220 CIPHER_VALIDATE_RET( output != NULL );
kenjiArai 0:5b88d5760320 1221 CIPHER_VALIDATE_RET( olen != NULL );
kenjiArai 0:5b88d5760320 1222
kenjiArai 0:5b88d5760320 1223 #if defined(MBEDTLS_USE_PSA_CRYPTO)
kenjiArai 0:5b88d5760320 1224 if( ctx->psa_enabled == 1 )
kenjiArai 0:5b88d5760320 1225 {
kenjiArai 0:5b88d5760320 1226 /* As in the non-PSA case, we don't check that
kenjiArai 0:5b88d5760320 1227 * a key has been set. If not, the key slot will
kenjiArai 0:5b88d5760320 1228 * still be in its default state of 0, which is
kenjiArai 0:5b88d5760320 1229 * guaranteed to be invalid, hence the PSA-call
kenjiArai 0:5b88d5760320 1230 * below will gracefully fail. */
kenjiArai 0:5b88d5760320 1231 mbedtls_cipher_context_psa * const cipher_psa =
kenjiArai 0:5b88d5760320 1232 (mbedtls_cipher_context_psa *) ctx->cipher_ctx;
kenjiArai 0:5b88d5760320 1233
kenjiArai 0:5b88d5760320 1234 psa_status_t status;
kenjiArai 0:5b88d5760320 1235 psa_cipher_operation_t cipher_op = PSA_CIPHER_OPERATION_INIT;
kenjiArai 0:5b88d5760320 1236 size_t part_len;
kenjiArai 0:5b88d5760320 1237
kenjiArai 0:5b88d5760320 1238 if( ctx->operation == MBEDTLS_DECRYPT )
kenjiArai 0:5b88d5760320 1239 {
kenjiArai 0:5b88d5760320 1240 status = psa_cipher_decrypt_setup( &cipher_op,
kenjiArai 0:5b88d5760320 1241 cipher_psa->slot,
kenjiArai 0:5b88d5760320 1242 cipher_psa->alg );
kenjiArai 0:5b88d5760320 1243 }
kenjiArai 0:5b88d5760320 1244 else if( ctx->operation == MBEDTLS_ENCRYPT )
kenjiArai 0:5b88d5760320 1245 {
kenjiArai 0:5b88d5760320 1246 status = psa_cipher_encrypt_setup( &cipher_op,
kenjiArai 0:5b88d5760320 1247 cipher_psa->slot,
kenjiArai 0:5b88d5760320 1248 cipher_psa->alg );
kenjiArai 0:5b88d5760320 1249 }
kenjiArai 0:5b88d5760320 1250 else
kenjiArai 0:5b88d5760320 1251 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 1252
kenjiArai 0:5b88d5760320 1253 /* In the following, we can immediately return on an error,
kenjiArai 0:5b88d5760320 1254 * because the PSA Crypto API guarantees that cipher operations
kenjiArai 0:5b88d5760320 1255 * are terminated by unsuccessful calls to psa_cipher_update(),
kenjiArai 0:5b88d5760320 1256 * and by any call to psa_cipher_finish(). */
kenjiArai 0:5b88d5760320 1257 if( status != PSA_SUCCESS )
kenjiArai 0:5b88d5760320 1258 return( MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED );
kenjiArai 0:5b88d5760320 1259
kenjiArai 0:5b88d5760320 1260 status = psa_cipher_set_iv( &cipher_op, iv, iv_len );
kenjiArai 0:5b88d5760320 1261 if( status != PSA_SUCCESS )
kenjiArai 0:5b88d5760320 1262 return( MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED );
kenjiArai 0:5b88d5760320 1263
kenjiArai 0:5b88d5760320 1264 status = psa_cipher_update( &cipher_op,
kenjiArai 0:5b88d5760320 1265 input, ilen,
kenjiArai 0:5b88d5760320 1266 output, ilen, olen );
kenjiArai 0:5b88d5760320 1267 if( status != PSA_SUCCESS )
kenjiArai 0:5b88d5760320 1268 return( MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED );
kenjiArai 0:5b88d5760320 1269
kenjiArai 0:5b88d5760320 1270 status = psa_cipher_finish( &cipher_op,
kenjiArai 0:5b88d5760320 1271 output + *olen, ilen - *olen,
kenjiArai 0:5b88d5760320 1272 &part_len );
kenjiArai 0:5b88d5760320 1273 if( status != PSA_SUCCESS )
kenjiArai 0:5b88d5760320 1274 return( MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED );
kenjiArai 0:5b88d5760320 1275
kenjiArai 0:5b88d5760320 1276 *olen += part_len;
kenjiArai 0:5b88d5760320 1277 return( 0 );
kenjiArai 0:5b88d5760320 1278 }
kenjiArai 0:5b88d5760320 1279 #endif /* MBEDTLS_USE_PSA_CRYPTO */
kenjiArai 0:5b88d5760320 1280
kenjiArai 0:5b88d5760320 1281 if( ( ret = mbedtls_cipher_set_iv( ctx, iv, iv_len ) ) != 0 )
kenjiArai 0:5b88d5760320 1282 return( ret );
kenjiArai 0:5b88d5760320 1283
kenjiArai 0:5b88d5760320 1284 if( ( ret = mbedtls_cipher_reset( ctx ) ) != 0 )
kenjiArai 0:5b88d5760320 1285 return( ret );
kenjiArai 0:5b88d5760320 1286
kenjiArai 0:5b88d5760320 1287 if( ( ret = mbedtls_cipher_update( ctx, input, ilen,
kenjiArai 0:5b88d5760320 1288 output, olen ) ) != 0 )
kenjiArai 0:5b88d5760320 1289 return( ret );
kenjiArai 0:5b88d5760320 1290
kenjiArai 0:5b88d5760320 1291 if( ( ret = mbedtls_cipher_finish( ctx, output + *olen,
kenjiArai 0:5b88d5760320 1292 &finish_olen ) ) != 0 )
kenjiArai 0:5b88d5760320 1293 return( ret );
kenjiArai 0:5b88d5760320 1294
kenjiArai 0:5b88d5760320 1295 *olen += finish_olen;
kenjiArai 0:5b88d5760320 1296
kenjiArai 0:5b88d5760320 1297 return( 0 );
kenjiArai 0:5b88d5760320 1298 }
kenjiArai 0:5b88d5760320 1299
kenjiArai 0:5b88d5760320 1300 #if defined(MBEDTLS_CIPHER_MODE_AEAD)
kenjiArai 0:5b88d5760320 1301 /*
kenjiArai 0:5b88d5760320 1302 * Packet-oriented encryption for AEAD modes
kenjiArai 0:5b88d5760320 1303 */
kenjiArai 0:5b88d5760320 1304 int mbedtls_cipher_auth_encrypt( mbedtls_cipher_context_t *ctx,
kenjiArai 0:5b88d5760320 1305 const unsigned char *iv, size_t iv_len,
kenjiArai 0:5b88d5760320 1306 const unsigned char *ad, size_t ad_len,
kenjiArai 0:5b88d5760320 1307 const unsigned char *input, size_t ilen,
kenjiArai 0:5b88d5760320 1308 unsigned char *output, size_t *olen,
kenjiArai 0:5b88d5760320 1309 unsigned char *tag, size_t tag_len )
kenjiArai 0:5b88d5760320 1310 {
kenjiArai 0:5b88d5760320 1311 CIPHER_VALIDATE_RET( ctx != NULL );
kenjiArai 0:5b88d5760320 1312 CIPHER_VALIDATE_RET( iv != NULL );
kenjiArai 0:5b88d5760320 1313 CIPHER_VALIDATE_RET( ad_len == 0 || ad != NULL );
kenjiArai 0:5b88d5760320 1314 CIPHER_VALIDATE_RET( ilen == 0 || input != NULL );
kenjiArai 0:5b88d5760320 1315 CIPHER_VALIDATE_RET( output != NULL );
kenjiArai 0:5b88d5760320 1316 CIPHER_VALIDATE_RET( olen != NULL );
kenjiArai 0:5b88d5760320 1317 CIPHER_VALIDATE_RET( tag_len == 0 || tag != NULL );
kenjiArai 0:5b88d5760320 1318
kenjiArai 0:5b88d5760320 1319 #if defined(MBEDTLS_USE_PSA_CRYPTO)
kenjiArai 0:5b88d5760320 1320 if( ctx->psa_enabled == 1 )
kenjiArai 0:5b88d5760320 1321 {
kenjiArai 0:5b88d5760320 1322 /* As in the non-PSA case, we don't check that
kenjiArai 0:5b88d5760320 1323 * a key has been set. If not, the key slot will
kenjiArai 0:5b88d5760320 1324 * still be in its default state of 0, which is
kenjiArai 0:5b88d5760320 1325 * guaranteed to be invalid, hence the PSA-call
kenjiArai 0:5b88d5760320 1326 * below will gracefully fail. */
kenjiArai 0:5b88d5760320 1327 mbedtls_cipher_context_psa * const cipher_psa =
kenjiArai 0:5b88d5760320 1328 (mbedtls_cipher_context_psa *) ctx->cipher_ctx;
kenjiArai 0:5b88d5760320 1329
kenjiArai 0:5b88d5760320 1330 psa_status_t status;
kenjiArai 0:5b88d5760320 1331
kenjiArai 0:5b88d5760320 1332 /* PSA Crypto API always writes the authentication tag
kenjiArai 0:5b88d5760320 1333 * at the end of the encrypted message. */
kenjiArai 0:5b88d5760320 1334 if( tag != output + ilen )
kenjiArai 0:5b88d5760320 1335 return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
kenjiArai 0:5b88d5760320 1336
kenjiArai 0:5b88d5760320 1337 status = psa_aead_encrypt( cipher_psa->slot,
kenjiArai 0:5b88d5760320 1338 cipher_psa->alg,
kenjiArai 0:5b88d5760320 1339 iv, iv_len,
kenjiArai 0:5b88d5760320 1340 ad, ad_len,
kenjiArai 0:5b88d5760320 1341 input, ilen,
kenjiArai 0:5b88d5760320 1342 output, ilen + tag_len, olen );
kenjiArai 0:5b88d5760320 1343 if( status != PSA_SUCCESS )
kenjiArai 0:5b88d5760320 1344 return( MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED );
kenjiArai 0:5b88d5760320 1345
kenjiArai 0:5b88d5760320 1346 *olen -= tag_len;
kenjiArai 0:5b88d5760320 1347 return( 0 );
kenjiArai 0:5b88d5760320 1348 }
kenjiArai 0:5b88d5760320 1349 #endif /* MBEDTLS_USE_PSA_CRYPTO */
kenjiArai 0:5b88d5760320 1350
kenjiArai 0:5b88d5760320 1351 #if defined(MBEDTLS_GCM_C)
kenjiArai 0:5b88d5760320 1352 if( MBEDTLS_MODE_GCM == ctx->cipher_info->mode )
kenjiArai 0:5b88d5760320 1353 {
kenjiArai 0:5b88d5760320 1354 *olen = ilen;
kenjiArai 0:5b88d5760320 1355 return( mbedtls_gcm_crypt_and_tag( ctx->cipher_ctx, MBEDTLS_GCM_ENCRYPT,
kenjiArai 0:5b88d5760320 1356 ilen, iv, iv_len, ad, ad_len,
kenjiArai 0:5b88d5760320 1357 input, output, tag_len, tag ) );
kenjiArai 0:5b88d5760320 1358 }
kenjiArai 0:5b88d5760320 1359 #endif /* MBEDTLS_GCM_C */
kenjiArai 0:5b88d5760320 1360 #if defined(MBEDTLS_CCM_C)
kenjiArai 0:5b88d5760320 1361 if( MBEDTLS_MODE_CCM == ctx->cipher_info->mode )
kenjiArai 0:5b88d5760320 1362 {
kenjiArai 0:5b88d5760320 1363 *olen = ilen;
kenjiArai 0:5b88d5760320 1364 return( mbedtls_ccm_encrypt_and_tag( ctx->cipher_ctx, ilen,
kenjiArai 0:5b88d5760320 1365 iv, iv_len, ad, ad_len, input, output,
kenjiArai 0:5b88d5760320 1366 tag, tag_len ) );
kenjiArai 0:5b88d5760320 1367 }
kenjiArai 0:5b88d5760320 1368 #endif /* MBEDTLS_CCM_C */
kenjiArai 0:5b88d5760320 1369 #if defined(MBEDTLS_CHACHAPOLY_C)
kenjiArai 0:5b88d5760320 1370 if ( MBEDTLS_CIPHER_CHACHA20_POLY1305 == ctx->cipher_info->type )
kenjiArai 0:5b88d5760320 1371 {
kenjiArai 0:5b88d5760320 1372 /* ChachaPoly has fixed length nonce and MAC (tag) */
kenjiArai 0:5b88d5760320 1373 if ( ( iv_len != ctx->cipher_info->iv_size ) ||
kenjiArai 0:5b88d5760320 1374 ( tag_len != 16U ) )
kenjiArai 0:5b88d5760320 1375 {
kenjiArai 0:5b88d5760320 1376 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 1377 }
kenjiArai 0:5b88d5760320 1378
kenjiArai 0:5b88d5760320 1379 *olen = ilen;
kenjiArai 0:5b88d5760320 1380 return( mbedtls_chachapoly_encrypt_and_tag( ctx->cipher_ctx,
kenjiArai 0:5b88d5760320 1381 ilen, iv, ad, ad_len, input, output, tag ) );
kenjiArai 0:5b88d5760320 1382 }
kenjiArai 0:5b88d5760320 1383 #endif /* MBEDTLS_CHACHAPOLY_C */
kenjiArai 0:5b88d5760320 1384 #if defined(MBEDTLS_NIST_KW_C)
kenjiArai 0:5b88d5760320 1385 if( MBEDTLS_MODE_KW == ctx->cipher_info->mode ||
kenjiArai 0:5b88d5760320 1386 MBEDTLS_MODE_KWP == ctx->cipher_info->mode )
kenjiArai 0:5b88d5760320 1387 {
kenjiArai 0:5b88d5760320 1388 mbedtls_nist_kw_mode_t mode = ( MBEDTLS_MODE_KW == ctx->cipher_info->mode ) ?
kenjiArai 0:5b88d5760320 1389 MBEDTLS_KW_MODE_KW : MBEDTLS_KW_MODE_KWP;
kenjiArai 0:5b88d5760320 1390
kenjiArai 0:5b88d5760320 1391 /* There is no iv, tag or ad associated with KW and KWP, these length should be 0 */
kenjiArai 0:5b88d5760320 1392 if( iv_len != 0 || tag_len != 0 || ad_len != 0 )
kenjiArai 0:5b88d5760320 1393 {
kenjiArai 0:5b88d5760320 1394 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 1395 }
kenjiArai 0:5b88d5760320 1396
kenjiArai 0:5b88d5760320 1397 return( mbedtls_nist_kw_wrap( ctx->cipher_ctx, mode, input, ilen, output, olen, SIZE_MAX ) );
kenjiArai 0:5b88d5760320 1398 }
kenjiArai 0:5b88d5760320 1399 #endif /* MBEDTLS_NIST_KW_C */
kenjiArai 0:5b88d5760320 1400
kenjiArai 0:5b88d5760320 1401 return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
kenjiArai 0:5b88d5760320 1402 }
kenjiArai 0:5b88d5760320 1403
kenjiArai 0:5b88d5760320 1404 /*
kenjiArai 0:5b88d5760320 1405 * Packet-oriented decryption for AEAD modes
kenjiArai 0:5b88d5760320 1406 */
kenjiArai 0:5b88d5760320 1407 int mbedtls_cipher_auth_decrypt( mbedtls_cipher_context_t *ctx,
kenjiArai 0:5b88d5760320 1408 const unsigned char *iv, size_t iv_len,
kenjiArai 0:5b88d5760320 1409 const unsigned char *ad, size_t ad_len,
kenjiArai 0:5b88d5760320 1410 const unsigned char *input, size_t ilen,
kenjiArai 0:5b88d5760320 1411 unsigned char *output, size_t *olen,
kenjiArai 0:5b88d5760320 1412 const unsigned char *tag, size_t tag_len )
kenjiArai 0:5b88d5760320 1413 {
kenjiArai 0:5b88d5760320 1414 CIPHER_VALIDATE_RET( ctx != NULL );
kenjiArai 0:5b88d5760320 1415 CIPHER_VALIDATE_RET( iv != NULL );
kenjiArai 0:5b88d5760320 1416 CIPHER_VALIDATE_RET( ad_len == 0 || ad != NULL );
kenjiArai 0:5b88d5760320 1417 CIPHER_VALIDATE_RET( ilen == 0 || input != NULL );
kenjiArai 0:5b88d5760320 1418 CIPHER_VALIDATE_RET( output != NULL );
kenjiArai 0:5b88d5760320 1419 CIPHER_VALIDATE_RET( olen != NULL );
kenjiArai 0:5b88d5760320 1420 CIPHER_VALIDATE_RET( tag_len == 0 || tag != NULL );
kenjiArai 0:5b88d5760320 1421
kenjiArai 0:5b88d5760320 1422 #if defined(MBEDTLS_USE_PSA_CRYPTO)
kenjiArai 0:5b88d5760320 1423 if( ctx->psa_enabled == 1 )
kenjiArai 0:5b88d5760320 1424 {
kenjiArai 0:5b88d5760320 1425 /* As in the non-PSA case, we don't check that
kenjiArai 0:5b88d5760320 1426 * a key has been set. If not, the key slot will
kenjiArai 0:5b88d5760320 1427 * still be in its default state of 0, which is
kenjiArai 0:5b88d5760320 1428 * guaranteed to be invalid, hence the PSA-call
kenjiArai 0:5b88d5760320 1429 * below will gracefully fail. */
kenjiArai 0:5b88d5760320 1430 mbedtls_cipher_context_psa * const cipher_psa =
kenjiArai 0:5b88d5760320 1431 (mbedtls_cipher_context_psa *) ctx->cipher_ctx;
kenjiArai 0:5b88d5760320 1432
kenjiArai 0:5b88d5760320 1433 psa_status_t status;
kenjiArai 0:5b88d5760320 1434
kenjiArai 0:5b88d5760320 1435 /* PSA Crypto API always writes the authentication tag
kenjiArai 0:5b88d5760320 1436 * at the end of the encrypted message. */
kenjiArai 0:5b88d5760320 1437 if( tag != input + ilen )
kenjiArai 0:5b88d5760320 1438 return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
kenjiArai 0:5b88d5760320 1439
kenjiArai 0:5b88d5760320 1440 status = psa_aead_decrypt( cipher_psa->slot,
kenjiArai 0:5b88d5760320 1441 cipher_psa->alg,
kenjiArai 0:5b88d5760320 1442 iv, iv_len,
kenjiArai 0:5b88d5760320 1443 ad, ad_len,
kenjiArai 0:5b88d5760320 1444 input, ilen + tag_len,
kenjiArai 0:5b88d5760320 1445 output, ilen, olen );
kenjiArai 0:5b88d5760320 1446 if( status == PSA_ERROR_INVALID_SIGNATURE )
kenjiArai 0:5b88d5760320 1447 return( MBEDTLS_ERR_CIPHER_AUTH_FAILED );
kenjiArai 0:5b88d5760320 1448 else if( status != PSA_SUCCESS )
kenjiArai 0:5b88d5760320 1449 return( MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED );
kenjiArai 0:5b88d5760320 1450
kenjiArai 0:5b88d5760320 1451 return( 0 );
kenjiArai 0:5b88d5760320 1452 }
kenjiArai 0:5b88d5760320 1453 #endif /* MBEDTLS_USE_PSA_CRYPTO */
kenjiArai 0:5b88d5760320 1454
kenjiArai 0:5b88d5760320 1455 #if defined(MBEDTLS_GCM_C)
kenjiArai 0:5b88d5760320 1456 if( MBEDTLS_MODE_GCM == ctx->cipher_info->mode )
kenjiArai 0:5b88d5760320 1457 {
kenjiArai 0:5b88d5760320 1458 int ret;
kenjiArai 0:5b88d5760320 1459
kenjiArai 0:5b88d5760320 1460 *olen = ilen;
kenjiArai 0:5b88d5760320 1461 ret = mbedtls_gcm_auth_decrypt( ctx->cipher_ctx, ilen,
kenjiArai 0:5b88d5760320 1462 iv, iv_len, ad, ad_len,
kenjiArai 0:5b88d5760320 1463 tag, tag_len, input, output );
kenjiArai 0:5b88d5760320 1464
kenjiArai 0:5b88d5760320 1465 if( ret == MBEDTLS_ERR_GCM_AUTH_FAILED )
kenjiArai 0:5b88d5760320 1466 ret = MBEDTLS_ERR_CIPHER_AUTH_FAILED;
kenjiArai 0:5b88d5760320 1467
kenjiArai 0:5b88d5760320 1468 return( ret );
kenjiArai 0:5b88d5760320 1469 }
kenjiArai 0:5b88d5760320 1470 #endif /* MBEDTLS_GCM_C */
kenjiArai 0:5b88d5760320 1471 #if defined(MBEDTLS_CCM_C)
kenjiArai 0:5b88d5760320 1472 if( MBEDTLS_MODE_CCM == ctx->cipher_info->mode )
kenjiArai 0:5b88d5760320 1473 {
kenjiArai 0:5b88d5760320 1474 int ret;
kenjiArai 0:5b88d5760320 1475
kenjiArai 0:5b88d5760320 1476 *olen = ilen;
kenjiArai 0:5b88d5760320 1477 ret = mbedtls_ccm_auth_decrypt( ctx->cipher_ctx, ilen,
kenjiArai 0:5b88d5760320 1478 iv, iv_len, ad, ad_len,
kenjiArai 0:5b88d5760320 1479 input, output, tag, tag_len );
kenjiArai 0:5b88d5760320 1480
kenjiArai 0:5b88d5760320 1481 if( ret == MBEDTLS_ERR_CCM_AUTH_FAILED )
kenjiArai 0:5b88d5760320 1482 ret = MBEDTLS_ERR_CIPHER_AUTH_FAILED;
kenjiArai 0:5b88d5760320 1483
kenjiArai 0:5b88d5760320 1484 return( ret );
kenjiArai 0:5b88d5760320 1485 }
kenjiArai 0:5b88d5760320 1486 #endif /* MBEDTLS_CCM_C */
kenjiArai 0:5b88d5760320 1487 #if defined(MBEDTLS_CHACHAPOLY_C)
kenjiArai 0:5b88d5760320 1488 if ( MBEDTLS_CIPHER_CHACHA20_POLY1305 == ctx->cipher_info->type )
kenjiArai 0:5b88d5760320 1489 {
kenjiArai 0:5b88d5760320 1490 int ret;
kenjiArai 0:5b88d5760320 1491
kenjiArai 0:5b88d5760320 1492 /* ChachaPoly has fixed length nonce and MAC (tag) */
kenjiArai 0:5b88d5760320 1493 if ( ( iv_len != ctx->cipher_info->iv_size ) ||
kenjiArai 0:5b88d5760320 1494 ( tag_len != 16U ) )
kenjiArai 0:5b88d5760320 1495 {
kenjiArai 0:5b88d5760320 1496 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 1497 }
kenjiArai 0:5b88d5760320 1498
kenjiArai 0:5b88d5760320 1499 *olen = ilen;
kenjiArai 0:5b88d5760320 1500 ret = mbedtls_chachapoly_auth_decrypt( ctx->cipher_ctx, ilen,
kenjiArai 0:5b88d5760320 1501 iv, ad, ad_len, tag, input, output );
kenjiArai 0:5b88d5760320 1502
kenjiArai 0:5b88d5760320 1503 if( ret == MBEDTLS_ERR_CHACHAPOLY_AUTH_FAILED )
kenjiArai 0:5b88d5760320 1504 ret = MBEDTLS_ERR_CIPHER_AUTH_FAILED;
kenjiArai 0:5b88d5760320 1505
kenjiArai 0:5b88d5760320 1506 return( ret );
kenjiArai 0:5b88d5760320 1507 }
kenjiArai 0:5b88d5760320 1508 #endif /* MBEDTLS_CHACHAPOLY_C */
kenjiArai 0:5b88d5760320 1509 #if defined(MBEDTLS_NIST_KW_C)
kenjiArai 0:5b88d5760320 1510 if( MBEDTLS_MODE_KW == ctx->cipher_info->mode ||
kenjiArai 0:5b88d5760320 1511 MBEDTLS_MODE_KWP == ctx->cipher_info->mode )
kenjiArai 0:5b88d5760320 1512 {
kenjiArai 0:5b88d5760320 1513 mbedtls_nist_kw_mode_t mode = ( MBEDTLS_MODE_KW == ctx->cipher_info->mode ) ?
kenjiArai 0:5b88d5760320 1514 MBEDTLS_KW_MODE_KW : MBEDTLS_KW_MODE_KWP;
kenjiArai 0:5b88d5760320 1515
kenjiArai 0:5b88d5760320 1516 /* There is no iv, tag or ad associated with KW and KWP, these length should be 0 */
kenjiArai 0:5b88d5760320 1517 if( iv_len != 0 || tag_len != 0 || ad_len != 0 )
kenjiArai 0:5b88d5760320 1518 {
kenjiArai 0:5b88d5760320 1519 return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
kenjiArai 0:5b88d5760320 1520 }
kenjiArai 0:5b88d5760320 1521
kenjiArai 0:5b88d5760320 1522 return( mbedtls_nist_kw_unwrap( ctx->cipher_ctx, mode, input, ilen, output, olen, SIZE_MAX ) );
kenjiArai 0:5b88d5760320 1523 }
kenjiArai 0:5b88d5760320 1524 #endif /* MBEDTLS_NIST_KW_C */
kenjiArai 0:5b88d5760320 1525
kenjiArai 0:5b88d5760320 1526 return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
kenjiArai 0:5b88d5760320 1527 }
kenjiArai 0:5b88d5760320 1528 #endif /* MBEDTLS_CIPHER_MODE_AEAD */
kenjiArai 0:5b88d5760320 1529
kenjiArai 0:5b88d5760320 1530 #endif /* MBEDTLS_CIPHER_C */