cuberite/polarssl
1
0
Fork 0
mirror of https://github.com/cuberite/polarssl.git synced 2025-09-08 06:40:16 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1154 from tom-daubney-arm/backport_asymmetric_encrypt_buffer_protection

Browse Source 
[Backport] Asymmetric encrypt buffer protection
This commit is contained in:
David Horstmann 2024-02-29 14:17:10 +00:00 committed by GitHub
commit be49b6b239
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 49 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
library/psa_crypto.c
View File

@ -3353,17 +3353,20 @@ static void psa_rsa_oaep_set_padding_mode(psa_algorithm_t alg,
psa_status_t psa_asymmetric_encrypt(mbedtls_svc_key_id_t key,
psa_algorithm_t alg,
const uint8_t *input,
const uint8_t *input_external,
size_t input_length,
const uint8_t *salt,
const uint8_t *salt_external,
size_t salt_length,
uint8_t *output,
uint8_t *output_external,
size_t output_size,
size_t *output_length)
{
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
psa_key_slot_t *slot;
LOCAL_INPUT_DECLARE(input_external, input);
LOCAL_INPUT_DECLARE(salt_external, salt);
LOCAL_OUTPUT_DECLARE(output_external, output);
(void) input;
(void) input_length;
@ -3406,6 +3409,9 @@ psa_status_t psa_asymmetric_encrypt(mbedtls_svc_key_id_t key,
}
#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) ||
* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */
LOCAL_INPUT_ALLOC(input_external, input_length, input);
LOCAL_INPUT_ALLOC(salt_external, salt_length, salt);
LOCAL_OUTPUT_ALLOC(output_external, output_size, output);
if (alg == PSA_ALG_RSA_PKCS1V15_CRYPT) {
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT)
status = mbedtls_to_psa_error(
@ -3456,22 +3462,29 @@ rsa_exit:
exit:
unlock_status = psa_unlock_key_slot(slot);
LOCAL_INPUT_FREE(input_external, input);
LOCAL_INPUT_FREE(salt_external, salt);
LOCAL_OUTPUT_FREE(output_external, output);
return (status == PSA_SUCCESS) ? unlock_status : status;
}
psa_status_t psa_asymmetric_decrypt(mbedtls_svc_key_id_t key,
psa_algorithm_t alg,
const uint8_t *input,
const uint8_t *input_external,
size_t input_length,
const uint8_t *salt,
const uint8_t *salt_external,
size_t salt_length,
uint8_t *output,
uint8_t *output_external,
size_t output_size,
size_t *output_length)
{
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
psa_status_t unlock_status = PSA_ERROR_CORRUPTION_DETECTED;
psa_key_slot_t *slot;
LOCAL_INPUT_DECLARE(input_external, input);
LOCAL_INPUT_DECLARE(salt_external, salt);
LOCAL_OUTPUT_DECLARE(output_external, output);
(void) input;
(void) input_length;
@ -3513,7 +3526,9 @@ psa_status_t psa_asymmetric_decrypt(mbedtls_svc_key_id_t key,
}
#endif /* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) ||
* defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) */
LOCAL_INPUT_ALLOC(input_external, input_length, input);
LOCAL_INPUT_ALLOC(salt_external, salt_length, salt);
LOCAL_OUTPUT_ALLOC(output_external, output_size, output);
if (alg == PSA_ALG_RSA_PKCS1V15_CRYPT) {
#if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT)
status = mbedtls_to_psa_error(
@ -3563,6 +3578,10 @@ rsa_exit:
exit:
unlock_status = psa_unlock_key_slot(slot);
LOCAL_INPUT_FREE(input_external, input);
LOCAL_INPUT_FREE(salt_external, salt);
LOCAL_OUTPUT_FREE(output_external, output);
return (status == PSA_SUCCESS) ? unlock_status : status;
}

3
tests/scripts/generate_psa_wrappers.py
View File

@ -179,6 +179,9 @@ class PSAWrapperGenerator(c_wrapper_generator.Base):
'psa_mac_compute',
'psa_mac_verify'):
return True
if function_name in ('psa_asymmetric_encrypt',
'psa_asymmetric_decrypt'):
return True
return False
def _write_function_call(self, out: typing_util.Writable,

20
tests/src/psa_test_wrappers.c
View File

@ -124,7 +124,17 @@ psa_status_t mbedtls_test_wrap_psa_asymmetric_decrypt(
size_t arg7_output_size,
size_t *arg8_output_length)
{
#if defined(MBEDTLS_PSA_COPY_CALLER_BUFFERS)
MBEDTLS_TEST_MEMORY_POISON(arg2_input, arg3_input_length);
MBEDTLS_TEST_MEMORY_POISON(arg4_salt, arg5_salt_length);
MBEDTLS_TEST_MEMORY_POISON(arg6_output, arg7_output_size);
#endif /* defined(MBEDTLS_PSA_COPY_CALLER_BUFFERS) */
psa_status_t status = (psa_asymmetric_decrypt)(arg0_key, arg1_alg, arg2_input, arg3_input_length, arg4_salt, arg5_salt_length, arg6_output, arg7_output_size, arg8_output_length);
#if defined(MBEDTLS_PSA_COPY_CALLER_BUFFERS)
MBEDTLS_TEST_MEMORY_UNPOISON(arg2_input, arg3_input_length);
MBEDTLS_TEST_MEMORY_UNPOISON(arg4_salt, arg5_salt_length);
MBEDTLS_TEST_MEMORY_UNPOISON(arg6_output, arg7_output_size);
#endif /* defined(MBEDTLS_PSA_COPY_CALLER_BUFFERS) */
return status;
}
@ -140,7 +150,17 @@ psa_status_t mbedtls_test_wrap_psa_asymmetric_encrypt(
size_t arg7_output_size,
size_t *arg8_output_length)
{
#if defined(MBEDTLS_PSA_COPY_CALLER_BUFFERS)
MBEDTLS_TEST_MEMORY_POISON(arg2_input, arg3_input_length);
MBEDTLS_TEST_MEMORY_POISON(arg4_salt, arg5_salt_length);
MBEDTLS_TEST_MEMORY_POISON(arg6_output, arg7_output_size);
#endif /* defined(MBEDTLS_PSA_COPY_CALLER_BUFFERS) */
psa_status_t status = (psa_asymmetric_encrypt)(arg0_key, arg1_alg, arg2_input, arg3_input_length, arg4_salt, arg5_salt_length, arg6_output, arg7_output_size, arg8_output_length);
#if defined(MBEDTLS_PSA_COPY_CALLER_BUFFERS)
MBEDTLS_TEST_MEMORY_UNPOISON(arg2_input, arg3_input_length);
MBEDTLS_TEST_MEMORY_UNPOISON(arg4_salt, arg5_salt_length);
MBEDTLS_TEST_MEMORY_UNPOISON(arg6_output, arg7_output_size);
#endif /* defined(MBEDTLS_PSA_COPY_CALLER_BUFFERS) */
return status;
}