coffee/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2026-07-31 00:37:08 +08:00
Code Issues Packages Projects Releases Wiki Activity

clean up object names to be async hardware

Browse Source 
Signed-off-by: Cal Abel <crabel@mac.com>
This commit is contained in:
Cal Abel 2026-07-03 18:10:05 -04:00
parent 9f000bab4a
commit 5f38afbb1c
6 changed files with 257 additions and 257 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
library/ssl_client.c
View File

@ -21,13 +21,13 @@
#include "ssl_debug_helpers.h"
#if defined(MBEDTLS_ASYNC_HARDWARE_RANDOM)
typedef void (*samd_mbedtls_async_callback_t)(int success, void *context);
typedef void (*mbedtls_async_hardware_callback_t)(int success, void *context);
int samd_mbedtls_random_start(uint8_t *buffer, size_t length,
samd_mbedtls_async_callback_t callback,
int mbedtls_async_hardware_random_start(uint8_t *buffer, size_t length,
mbedtls_async_hardware_callback_t callback,
void *context);
static void samd_mbedtls_ssl_random_callback(int success, void *context)
static void mbedtls_async_hardware_ssl_random_callback(int success, void *context)
{
mbedtls_ssl_handshake_params *handshake =
(mbedtls_ssl_handshake_params *) context;
@ -35,11 +35,11 @@ static void samd_mbedtls_ssl_random_callback(int success, void *context)
return;
}
handshake->samd_random_success = success ? 1 : 0;
handshake->samd_random_done = 1;
handshake->async_hardware_random_success = success ? 1 : 0;
handshake->async_hardware_random_done = 1;
}
static int samd_mbedtls_ssl_random_fill(
static int mbedtls_async_hardware_ssl_random_fill(
mbedtls_ssl_context *ssl,
unsigned char *buffer,
size_t length)
@ -53,29 +53,29 @@ static int samd_mbedtls_ssl_random_fill(
handshake = ssl->handshake;
if (handshake->samd_random_pending != 0) {
if (handshake->samd_random_done == 0) {
if (handshake->async_hardware_random_pending != 0) {
if (handshake->async_hardware_random_done == 0) {
return MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
}
handshake->samd_random_pending = 0;
handshake->samd_random_done = 0;
if (handshake->samd_random_success == 0) {
handshake->samd_random_success = 0;
handshake->async_hardware_random_pending = 0;
handshake->async_hardware_random_done = 0;
if (handshake->async_hardware_random_success == 0) {
handshake->async_hardware_random_success = 0;
return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
}
handshake->samd_random_success = 0;
handshake->async_hardware_random_success = 0;
return 0;
}
handshake->samd_random_pending = 1;
handshake->samd_random_done = 0;
handshake->samd_random_success = 0;
handshake->async_hardware_random_pending = 1;
handshake->async_hardware_random_done = 0;
handshake->async_hardware_random_success = 0;
if (samd_mbedtls_random_start(
buffer, length, samd_mbedtls_ssl_random_callback,
if (mbedtls_async_hardware_random_start(
buffer, length, mbedtls_async_hardware_ssl_random_callback,
handshake) == 0) {
handshake->samd_random_pending = 0;
handshake->async_hardware_random_pending = 0;
return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
}
@ -765,7 +765,7 @@ static int ssl_generate_random(mbedtls_ssl_context *ssl)
size_t gmt_unix_time_len = 0;
#if defined(MBEDTLS_ASYNC_HARDWARE_RANDOM)
if (ssl->handshake->samd_client_random_ready != 0) {
if (ssl->handshake->async_hardware_client_random_ready != 0) {
return 0;
}
#endif
@ -795,11 +795,11 @@ static int ssl_generate_random(mbedtls_ssl_context *ssl)
}
#if defined(MBEDTLS_ASYNC_HARDWARE_RANDOM)
ret = samd_mbedtls_ssl_random_fill(
ret = mbedtls_async_hardware_ssl_random_fill(
ssl, randbytes + gmt_unix_time_len,
MBEDTLS_CLIENT_HELLO_RANDOM_LEN - gmt_unix_time_len);
if (ret == 0) {
ssl->handshake->samd_client_random_ready = 1;
ssl->handshake->async_hardware_client_random_ready = 1;
}
#else
ret = psa_generate_random(randbytes + gmt_unix_time_len,
@ -946,7 +946,7 @@ static int ssl_prepare_client_hello(mbedtls_ssl_context *ssl)
if (session_id_len > 0) {
#if defined(MBEDTLS_ASYNC_HARDWARE_RANDOM)
ret = samd_mbedtls_ssl_random_fill(
ret = mbedtls_async_hardware_ssl_random_fill(
ssl, session_negotiate->id, session_id_len);
#else
ret = psa_generate_random(session_negotiate->id,

46
library/ssl_misc.h
View File

@ -701,21 +701,21 @@ struct mbedtls_ssl_handshake_params {
#endif
#if defined(MBEDTLS_ASYNC_HARDWARE_RANDOM)
uint8_t samd_random_pending;
uint8_t samd_random_done;
uint8_t samd_random_success;
uint8_t samd_client_random_ready;
uint8_t samd_ecdh_public_pending;
uint8_t samd_ecdh_public_done;
uint8_t samd_ecdh_public_success;
uint8_t samd_ecdh_public_ready;
uint8_t samd_ecdh_private_ready;
uint8_t samd_ecdh_secret_pending;
uint8_t samd_ecdh_secret_done;
uint8_t samd_ecdh_secret_success;
uint8_t samd_ecdh_secret_ready;
unsigned char samd_ecdh_private_scalar[66];
unsigned char samd_ecdh_public_key[133];
uint8_t async_hardware_random_pending;
uint8_t async_hardware_random_done;
uint8_t async_hardware_random_success;
uint8_t async_hardware_client_random_ready;
uint8_t async_hardware_ecdh_public_pending;
uint8_t async_hardware_ecdh_public_done;
uint8_t async_hardware_ecdh_public_success;
uint8_t async_hardware_ecdh_public_ready;
uint8_t async_hardware_ecdh_private_ready;
uint8_t async_hardware_ecdh_secret_pending;
uint8_t async_hardware_ecdh_secret_done;
uint8_t async_hardware_ecdh_secret_success;
uint8_t async_hardware_ecdh_secret_ready;
unsigned char async_hardware_ecdh_private_scalar[66];
unsigned char async_hardware_ecdh_public_key[133];
#endif
#if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED)
@ -1137,14 +1137,14 @@ struct mbedtls_ssl_transform {
psa_algorithm_t psa_alg; /*!< psa algorithm */
#if defined(MBEDTLS_ASYNC_HARDWARE_AEAD)
unsigned char samd_aead_key_enc[32];
unsigned char samd_aead_key_dec[32];
size_t samd_aead_key_len;
unsigned char samd_aead_algorithm;
unsigned char samd_aead_keys_configured;
unsigned char samd_aead_pending;
unsigned char samd_aead_done;
unsigned char samd_aead_success;
unsigned char async_hardware_aead_key_enc[32];
unsigned char async_hardware_aead_key_dec[32];
size_t async_hardware_aead_key_len;
unsigned char async_hardware_aead_algorithm;
unsigned char async_hardware_aead_keys_configured;
unsigned char async_hardware_aead_pending;
unsigned char async_hardware_aead_done;
unsigned char async_hardware_aead_success;
#endif
#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)

142
library/ssl_msg.c
View File

@ -44,58 +44,58 @@ static int local_err_translation(psa_status_t status)
#define PSA_TO_MBEDTLS_ERR(status) local_err_translation(status)
#if defined(MBEDTLS_ASYNC_HARDWARE_AEAD)
typedef void (*samd_mbedtls_async_callback_t)(int success, void *context);
typedef void (*mbedtls_async_hardware_callback_t)(int success, void *context);
int samd_mbedtls_aes_gcm128_encrypt_start(
int mbedtls_async_hardware_aes_gcm128_encrypt_start(
const uint8_t key[16], const uint8_t nonce[12], const uint8_t *aad,
size_t aadLength, const uint8_t *plaintext, uint8_t *ciphertext,
size_t length, uint8_t tag[16], samd_mbedtls_async_callback_t callback,
size_t length, uint8_t tag[16], mbedtls_async_hardware_callback_t callback,
void *context);
int samd_mbedtls_aes_gcm128_decrypt_start(
int mbedtls_async_hardware_aes_gcm128_decrypt_start(
const uint8_t key[16], const uint8_t nonce[12], const uint8_t *aad,
size_t aadLength, const uint8_t *ciphertext, uint8_t *plaintext,
size_t length, const uint8_t tag[16],
samd_mbedtls_async_callback_t callback, void *context);
int samd_mbedtls_aead_encrypt_start(
mbedtls_async_hardware_callback_t callback, void *context);
int mbedtls_async_hardware_aead_encrypt_start(
int algorithm, const uint8_t *key, size_t keyLength,
const uint8_t *nonce, size_t nonceLength, const uint8_t *aad,
size_t aadLength, const uint8_t *plaintext, uint8_t *ciphertext,
size_t length, uint8_t *tag, size_t tagLength,
samd_mbedtls_async_callback_t callback, void *context);
int samd_mbedtls_aead_decrypt_start(
mbedtls_async_hardware_callback_t callback, void *context);
int mbedtls_async_hardware_aead_decrypt_start(
int algorithm, const uint8_t *key, size_t keyLength,
const uint8_t *nonce, size_t nonceLength, const uint8_t *aad,
size_t aadLength, const uint8_t *ciphertext, uint8_t *plaintext,
size_t length, const uint8_t *tag, size_t tagLength,
samd_mbedtls_async_callback_t callback, void *context);
mbedtls_async_hardware_callback_t callback, void *context);
static void samd_mbedtls_ssl_aead_callback(int success, void *context)
static void mbedtls_async_hardware_ssl_aead_callback(int success, void *context)
{
mbedtls_ssl_transform *transform = (mbedtls_ssl_transform *) context;
if (transform == NULL) {
return;
}
transform->samd_aead_success = success ? 1 : 0;
transform->samd_aead_done = 1;
transform->async_hardware_aead_success = success ? 1 : 0;
transform->async_hardware_aead_done = 1;
}
/**
* @brief Return whether the transform has explicit SAMD AEAD metadata.
* @brief Return whether the transform has explicit async hardware AEAD metadata.
*
* @todo Extend the provider dispatch behind this metadata for AES-256-GCM,
* AES-CCM, AES-CCM-8, and ChaCha20-Poly1305. Until then those algorithms are
* intentional fail-closed stubs instead of PSA/software fallbacks.
*/
static int samd_mbedtls_ssl_transform_has_aead(
static int mbedtls_async_hardware_ssl_transform_has_aead(
const mbedtls_ssl_transform *transform)
{
return transform != NULL &&
transform->samd_aead_keys_configured != 0 &&
transform->samd_aead_algorithm != 0 &&
transform->samd_aead_key_len != 0 &&
transform->samd_aead_key_len <=
sizeof(transform->samd_aead_key_enc) &&
transform->async_hardware_aead_keys_configured != 0 &&
transform->async_hardware_aead_algorithm != 0 &&
transform->async_hardware_aead_key_len != 0 &&
transform->async_hardware_aead_key_len <=
sizeof(transform->async_hardware_aead_key_enc) &&
transform->ivlen == 12;
}
@ -110,7 +110,7 @@ int mbedtls_ssl_configure_async_aead_transform(
unsigned char async_algorithm = 0;
if (transform == NULL || key_enc == NULL || key_dec == NULL ||
key_len == 0 || key_len > sizeof(transform->samd_aead_key_enc) ||
key_len == 0 || key_len > sizeof(transform->async_hardware_aead_key_enc) ||
transform->ivlen != 12 || transform->taglen != 16) {
return 0;
}
@ -146,11 +146,11 @@ int mbedtls_ssl_configure_async_aead_transform(
}
}
memcpy(transform->samd_aead_key_enc, key_enc, key_len);
memcpy(transform->samd_aead_key_dec, key_dec, key_len);
transform->samd_aead_key_len = key_len;
transform->samd_aead_algorithm = async_algorithm;
transform->samd_aead_keys_configured = 1;
memcpy(transform->async_hardware_aead_key_enc, key_enc, key_len);
memcpy(transform->async_hardware_aead_key_dec, key_dec, key_len);
transform->async_hardware_aead_key_len = key_len;
transform->async_hardware_aead_algorithm = async_algorithm;
transform->async_hardware_aead_keys_configured = 1;
return 1;
}
#endif
@ -1101,8 +1101,8 @@ hmac_failed_etm_disabled:
int dynamic_iv_is_explicit =
ssl_transform_aead_dynamic_iv_is_explicit(transform);
#if defined(MBEDTLS_ASYNC_HARDWARE_AEAD)
int use_samd_aead =
samd_mbedtls_ssl_transform_has_aead(transform);
int use_async_hardware_aead =
mbedtls_async_hardware_ssl_transform_has_aead(transform);
#endif
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
@ -1129,17 +1129,17 @@ hmac_failed_etm_disabled:
dynamic_iv_len = sizeof(rec->ctr);
#if defined(MBEDTLS_ASYNC_HARDWARE_AEAD)
if (use_samd_aead && transform->samd_aead_pending != 0) {
if (transform->samd_aead_done == 0) {
if (use_async_hardware_aead && transform->async_hardware_aead_pending != 0) {
if (transform->async_hardware_aead_done == 0) {
return MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
}
transform->samd_aead_pending = 0;
transform->samd_aead_done = 0;
if (transform->samd_aead_success == 0) {
transform->samd_aead_success = 0;
transform->async_hardware_aead_pending = 0;
transform->async_hardware_aead_done = 0;
if (transform->async_hardware_aead_success == 0) {
transform->async_hardware_aead_success = 0;
return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
}
transform->samd_aead_success = 0;
transform->async_hardware_aead_success = 0;
MBEDTLS_SSL_DEBUG_BUF(4, "after encrypt: tag",
data + rec->data_len,
@ -1161,7 +1161,7 @@ hmac_failed_etm_disabled:
}
auth_done++;
goto samd_aead_encrypt_done;
goto async_hardware_aead_encrypt_done;
}
#endif
@ -1194,20 +1194,20 @@ hmac_failed_etm_disabled:
* Encrypt and authenticate
*/
#if defined(MBEDTLS_ASYNC_HARDWARE_AEAD)
if (use_samd_aead) {
transform->samd_aead_pending = 1;
transform->samd_aead_done = 0;
transform->samd_aead_success = 0;
if (samd_mbedtls_aead_encrypt_start(
transform->samd_aead_algorithm,
transform->samd_aead_key_enc,
transform->samd_aead_key_len,
if (use_async_hardware_aead) {
transform->async_hardware_aead_pending = 1;
transform->async_hardware_aead_done = 0;
transform->async_hardware_aead_success = 0;
if (mbedtls_async_hardware_aead_encrypt_start(
transform->async_hardware_aead_algorithm,
transform->async_hardware_aead_key_enc,
transform->async_hardware_aead_key_len,
iv, transform->ivlen, add_data, add_data_len,
data, data, rec->data_len,
data + rec->data_len, transform->taglen,
samd_mbedtls_ssl_aead_callback,
mbedtls_async_hardware_ssl_aead_callback,
transform) == 0) {
transform->samd_aead_pending = 0;
transform->async_hardware_aead_pending = 0;
return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
}
return MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
@ -1251,7 +1251,7 @@ hmac_failed_etm_disabled:
auth_done++;
#if defined(MBEDTLS_ASYNC_HARDWARE_AEAD)
samd_aead_encrypt_done:
async_hardware_aead_encrypt_done:
(void) 0;
#endif
} else
@ -1523,25 +1523,25 @@ int mbedtls_ssl_decrypt_buf(mbedtls_ssl_context const *ssl,
unsigned char *dynamic_iv;
size_t dynamic_iv_len;
#if defined(MBEDTLS_ASYNC_HARDWARE_AEAD)
int use_samd_aead =
samd_mbedtls_ssl_transform_has_aead(transform);
int use_async_hardware_aead =
mbedtls_async_hardware_ssl_transform_has_aead(transform);
#endif
psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
#if defined(MBEDTLS_ASYNC_HARDWARE_AEAD)
if (use_samd_aead && transform->samd_aead_pending != 0) {
if (transform->samd_aead_done == 0) {
if (use_async_hardware_aead && transform->async_hardware_aead_pending != 0) {
if (transform->async_hardware_aead_done == 0) {
return MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
}
transform->samd_aead_pending = 0;
transform->samd_aead_done = 0;
if (transform->samd_aead_success == 0) {
transform->samd_aead_success = 0;
transform->async_hardware_aead_pending = 0;
transform->async_hardware_aead_done = 0;
if (transform->async_hardware_aead_success == 0) {
transform->async_hardware_aead_success = 0;
return MBEDTLS_ERR_SSL_INVALID_MAC;
}
transform->samd_aead_success = 0;
transform->async_hardware_aead_success = 0;
auth_done++;
goto samd_aead_decrypt_done;
goto async_hardware_aead_decrypt_done;
}
#endif
@ -1614,20 +1614,20 @@ int mbedtls_ssl_decrypt_buf(mbedtls_ssl_context const *ssl,
* Decrypt and authenticate
*/
#if defined(MBEDTLS_ASYNC_HARDWARE_AEAD)
if (use_samd_aead) {
transform->samd_aead_pending = 1;
transform->samd_aead_done = 0;
transform->samd_aead_success = 0;
if (samd_mbedtls_aead_decrypt_start(
transform->samd_aead_algorithm,
transform->samd_aead_key_dec,
transform->samd_aead_key_len,
if (use_async_hardware_aead) {
transform->async_hardware_aead_pending = 1;
transform->async_hardware_aead_done = 0;
transform->async_hardware_aead_success = 0;
if (mbedtls_async_hardware_aead_decrypt_start(
transform->async_hardware_aead_algorithm,
transform->async_hardware_aead_key_dec,
transform->async_hardware_aead_key_len,
iv, transform->ivlen, add_data, add_data_len,
data, data, rec->data_len,
data + rec->data_len, transform->taglen,
samd_mbedtls_ssl_aead_callback,
mbedtls_async_hardware_ssl_aead_callback,
transform) == 0) {
transform->samd_aead_pending = 0;
transform->async_hardware_aead_pending = 0;
return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
}
return MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
@ -1657,7 +1657,7 @@ int mbedtls_ssl_decrypt_buf(mbedtls_ssl_context const *ssl,
return MBEDTLS_ERR_SSL_INTERNAL_ERROR;
}
#if defined(MBEDTLS_ASYNC_HARDWARE_AEAD)
samd_aead_decrypt_done:
async_hardware_aead_decrypt_done:
(void) 0;
#endif
} else
@ -4934,7 +4934,7 @@ static int ssl_get_next_record(mbedtls_ssl_context *ssl)
#if defined(MBEDTLS_ASYNC_HARDWARE_AEAD)
if (ssl->transform_in != NULL &&
ssl->transform_in->samd_aead_pending != 0) {
ssl->transform_in->async_hardware_aead_pending != 0) {
const size_t header_len = mbedtls_ssl_in_hdr_len(ssl);
const size_t explicit_iv_len =
ssl_transform_aead_dynamic_iv_is_explicit(ssl->transform_in) ?
@ -4958,7 +4958,7 @@ static int ssl_get_next_record(mbedtls_ssl_context *ssl)
return ret;
}
goto samd_aead_record_content_ready;
goto async_hardware_aead_record_content_ready;
}
#endif
@ -5148,7 +5148,7 @@ static int ssl_get_next_record(mbedtls_ssl_context *ssl)
#if defined(MBEDTLS_ASYNC_HARDWARE_AEAD)
samd_aead_record_content_ready:
async_hardware_aead_record_content_ready:
#endif
/* Reset in pointers to default state for TLS/DTLS records,
@ -6149,7 +6149,7 @@ static int ssl_write_real(mbedtls_ssl_context *ssl,
#if defined(MBEDTLS_ASYNC_HARDWARE_AEAD)
if (ssl->transform_out != NULL &&
ssl->transform_out->samd_aead_pending != 0) {
ssl->transform_out->async_hardware_aead_pending != 0) {
if ((ret = mbedtls_ssl_write_record(ssl, SSL_FORCE_FLUSH)) != 0) {
MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_record", ret);
return ret;

34
library/ssl_tls.c
View File

@ -7469,15 +7469,15 @@ int mbedtls_ssl_write_finished(mbedtls_ssl_context *ssl)
int next_state = -1;
unsigned int hash_len;
#if defined(MBEDTLS_ASYNC_HARDWARE_AEAD)
int samd_resume_pending_finished = 0;
int async_hardware_resume_pending_finished = 0;
#endif
MBEDTLS_SSL_DEBUG_MSG(2, ("=> write finished"));
#if defined(MBEDTLS_ASYNC_HARDWARE_AEAD)
if (ssl->transform_negotiate != NULL &&
ssl->transform_negotiate->samd_aead_pending != 0) {
samd_resume_pending_finished = 1;
ssl->transform_negotiate->async_hardware_aead_pending != 0) {
async_hardware_resume_pending_finished = 1;
if (ssl->handshake->resume != 0) {
#if defined(MBEDTLS_SSL_CLI_C)
if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) {
@ -7492,7 +7492,7 @@ int mbedtls_ssl_write_finished(mbedtls_ssl_context *ssl)
} else {
next_state = ssl->state + 1;
}
goto samd_resume_pending_finished_write;
goto async_hardware_resume_pending_finished_write;
}
#endif
@ -7547,7 +7547,7 @@ int mbedtls_ssl_write_finished(mbedtls_ssl_context *ssl)
MBEDTLS_SSL_DEBUG_MSG(3, ("switching to new transform spec for outbound data"));
#if defined(MBEDTLS_ASYNC_HARDWARE_AEAD)
samd_resume_pending_finished_write:
async_hardware_resume_pending_finished_write:
#endif
#if defined(MBEDTLS_SSL_PROTO_DTLS)
@ -7589,7 +7589,7 @@ samd_resume_pending_finished_write:
#endif
#if defined(MBEDTLS_ASYNC_HARDWARE_AEAD)
if (samd_resume_pending_finished) {
if (async_hardware_resume_pending_finished) {
ret = mbedtls_ssl_write_record(ssl, 1);
} else
#endif
@ -7599,7 +7599,7 @@ samd_resume_pending_finished_write:
if (ret != 0) {
MBEDTLS_SSL_DEBUG_RET(1,
#if defined(MBEDTLS_ASYNC_HARDWARE_AEAD)
samd_resume_pending_finished
async_hardware_resume_pending_finished
? "mbedtls_ssl_write_record"
:
#endif
@ -7759,14 +7759,14 @@ static mbedtls_tls_prf_types tls_prf_get_type(mbedtls_ssl_tls_prf_cb *tls_prf)
#if defined(MBEDTLS_ASYNC_HARDWARE_AEAD)
/**
* @brief Map Mbed TLS/PSA record parameters to SAMD TLS AEAD capabilities.
* @brief Map Mbed TLS/PSA record parameters to async hardware TLS AEAD capabilities.
*
* @todo Wire AES-256-GCM, AES-CCM, AES-CCM-8, and ChaCha20-Poly1305 to
* hardware-backed provider operations. They are classified here so production
* hardware builds fail closed through the generic AEAD boundary instead of
* silently falling back to PSA/software.
*/
static int samd_mbedtls_tls_aead_from_transform(psa_key_type_t key_type,
static int mbedtls_async_hardware_tls_aead_from_transform(psa_key_type_t key_type,
size_t keylen,
psa_algorithm_t alg,
size_t ivlen,
@ -8103,17 +8103,17 @@ static int ssl_tls12_populate_transform(mbedtls_ssl_transform *transform,
transform->psa_alg = alg;
#if defined(MBEDTLS_ASYNC_HARDWARE_AEAD)
int samd_aead_algorithm = samd_mbedtls_tls_aead_from_transform(
int async_hardware_aead_algorithm = mbedtls_async_hardware_tls_aead_from_transform(
key_type, keylen, alg, transform->ivlen, transform->fixed_ivlen,
transform->taglen);
if (ssl_mode == MBEDTLS_SSL_MODE_AEAD &&
samd_aead_algorithm != 0 &&
keylen <= sizeof(transform->samd_aead_key_enc)) {
memcpy(transform->samd_aead_key_enc, key1, keylen);
memcpy(transform->samd_aead_key_dec, key2, keylen);
transform->samd_aead_key_len = keylen;
transform->samd_aead_algorithm = (unsigned char) samd_aead_algorithm;
transform->samd_aead_keys_configured = 1;
async_hardware_aead_algorithm != 0 &&
keylen <= sizeof(transform->async_hardware_aead_key_enc)) {
memcpy(transform->async_hardware_aead_key_enc, key1, keylen);
memcpy(transform->async_hardware_aead_key_dec, key2, keylen);
transform->async_hardware_aead_key_len = keylen;
transform->async_hardware_aead_algorithm = (unsigned char) async_hardware_aead_algorithm;
transform->async_hardware_aead_keys_configured = 1;
}
#endif

242
library/ssl_tls12_client.c
View File

@ -46,46 +46,46 @@ static int local_err_translation(psa_status_t status)
#endif
#if defined(MBEDTLS_ASYNC_HARDWARE_RANDOM)
typedef void (*samd_mbedtls_async_callback_t)(int success, void *context);
typedef void (*mbedtls_async_hardware_callback_t)(int success, void *context);
int samd_mbedtls_random_start(uint8_t *buffer, size_t length,
samd_mbedtls_async_callback_t callback,
int mbedtls_async_hardware_random_start(uint8_t *buffer, size_t length,
mbedtls_async_hardware_callback_t callback,
void *context);
int samd_mbedtls_ecdh_p256_public_key_start(
int mbedtls_async_hardware_ecdh_p256_public_key_start(
const uint8_t private_scalar[32],
uint8_t public_key[65],
samd_mbedtls_async_callback_t callback,
mbedtls_async_hardware_callback_t callback,
void *context);
int samd_mbedtls_ecdh_p384_public_key_start(
int mbedtls_async_hardware_ecdh_p384_public_key_start(
const uint8_t private_scalar[48],
uint8_t public_key[97],
samd_mbedtls_async_callback_t callback,
mbedtls_async_hardware_callback_t callback,
void *context);
int samd_mbedtls_ecdh_p521_public_key_start(
int mbedtls_async_hardware_ecdh_p521_public_key_start(
const uint8_t private_scalar[66],
uint8_t public_key[133],
samd_mbedtls_async_callback_t callback,
mbedtls_async_hardware_callback_t callback,
void *context);
int samd_mbedtls_ecdh_p256_start(
int mbedtls_async_hardware_ecdh_p256_start(
const uint8_t private_scalar[32],
const uint8_t peer_public_key[65],
uint8_t shared_secret[32],
samd_mbedtls_async_callback_t callback,
mbedtls_async_hardware_callback_t callback,
void *context);
int samd_mbedtls_ecdh_p384_start(
int mbedtls_async_hardware_ecdh_p384_start(
const uint8_t private_scalar[48],
const uint8_t peer_public_key[97],
uint8_t shared_secret[48],
samd_mbedtls_async_callback_t callback,
mbedtls_async_hardware_callback_t callback,
void *context);
int samd_mbedtls_ecdh_p521_start(
int mbedtls_async_hardware_ecdh_p521_start(
const uint8_t private_scalar[66],
const uint8_t peer_public_key[133],
uint8_t shared_secret[66],
samd_mbedtls_async_callback_t callback,
mbedtls_async_hardware_callback_t callback,
void *context);
static void samd_mbedtls_ssl_random_callback(int success, void *context)
static void mbedtls_async_hardware_ssl_random_callback(int success, void *context)
{
mbedtls_ssl_handshake_params *handshake =
(mbedtls_ssl_handshake_params *) context;
@ -93,11 +93,11 @@ static void samd_mbedtls_ssl_random_callback(int success, void *context)
return;
}
handshake->samd_random_success = success ? 1 : 0;
handshake->samd_random_done = 1;
handshake->async_hardware_random_success = success ? 1 : 0;
handshake->async_hardware_random_done = 1;
}
static int samd_mbedtls_ssl_random_fill(
static int mbedtls_async_hardware_ssl_random_fill(
mbedtls_ssl_context *ssl,
unsigned char *buffer,
size_t length)
@ -111,36 +111,36 @@ static int samd_mbedtls_ssl_random_fill(
handshake = ssl->handshake;
if (handshake->samd_random_pending != 0) {
if (handshake->samd_random_done == 0) {
if (handshake->async_hardware_random_pending != 0) {
if (handshake->async_hardware_random_done == 0) {
return MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
}
handshake->samd_random_pending = 0;
handshake->samd_random_done = 0;
if (handshake->samd_random_success == 0) {
handshake->samd_random_success = 0;
handshake->async_hardware_random_pending = 0;
handshake->async_hardware_random_done = 0;
if (handshake->async_hardware_random_success == 0) {
handshake->async_hardware_random_success = 0;
return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
}
handshake->samd_random_success = 0;
handshake->async_hardware_random_success = 0;
return 0;
}
handshake->samd_random_pending = 1;
handshake->samd_random_done = 0;
handshake->samd_random_success = 0;
handshake->async_hardware_random_pending = 1;
handshake->async_hardware_random_done = 0;
handshake->async_hardware_random_success = 0;
if (samd_mbedtls_random_start(
buffer, length, samd_mbedtls_ssl_random_callback,
if (mbedtls_async_hardware_random_start(
buffer, length, mbedtls_async_hardware_ssl_random_callback,
handshake) == 0) {
handshake->samd_random_pending = 0;
handshake->async_hardware_random_pending = 0;
return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
}
return MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
}
static void samd_mbedtls_ssl_ecdh_public_key_callback(int success,
static void mbedtls_async_hardware_ssl_ecdh_public_key_callback(int success,
void *context)
{
mbedtls_ssl_handshake_params *handshake =
@ -149,11 +149,11 @@ static void samd_mbedtls_ssl_ecdh_public_key_callback(int success,
return;
}
handshake->samd_ecdh_public_success = success ? 1 : 0;
handshake->samd_ecdh_public_done = 1;
handshake->async_hardware_ecdh_public_success = success ? 1 : 0;
handshake->async_hardware_ecdh_public_done = 1;
}
static int samd_mbedtls_ssl_ecdh_public_key_fill(mbedtls_ssl_context *ssl)
static int mbedtls_async_hardware_ssl_ecdh_public_key_fill(mbedtls_ssl_context *ssl)
{
mbedtls_ssl_handshake_params *handshake;
size_t coordinate_len;
@ -164,58 +164,58 @@ static int samd_mbedtls_ssl_ecdh_public_key_fill(mbedtls_ssl_context *ssl)
handshake = ssl->handshake;
if (handshake->samd_ecdh_public_ready != 0) {
if (handshake->async_hardware_ecdh_public_ready != 0) {
return 0;
}
if (handshake->samd_ecdh_public_pending != 0) {
if (handshake->samd_ecdh_public_done == 0) {
if (handshake->async_hardware_ecdh_public_pending != 0) {
if (handshake->async_hardware_ecdh_public_done == 0) {
return MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
}
handshake->samd_ecdh_public_pending = 0;
handshake->samd_ecdh_public_done = 0;
if (handshake->samd_ecdh_public_success == 0) {
handshake->samd_ecdh_public_success = 0;
handshake->async_hardware_ecdh_public_pending = 0;
handshake->async_hardware_ecdh_public_done = 0;
if (handshake->async_hardware_ecdh_public_success == 0) {
handshake->async_hardware_ecdh_public_success = 0;
return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
}
handshake->samd_ecdh_public_success = 0;
handshake->samd_ecdh_public_ready = 1;
handshake->async_hardware_ecdh_public_success = 0;
handshake->async_hardware_ecdh_public_ready = 1;
return 0;
}
handshake->samd_ecdh_public_pending = 1;
handshake->samd_ecdh_public_done = 0;
handshake->samd_ecdh_public_success = 0;
handshake->samd_ecdh_public_ready = 0;
handshake->async_hardware_ecdh_public_pending = 1;
handshake->async_hardware_ecdh_public_done = 0;
handshake->async_hardware_ecdh_public_success = 0;
handshake->async_hardware_ecdh_public_ready = 0;
coordinate_len = (handshake->xxdh_psa_bits + 7u) / 8u;
if ((coordinate_len == 32 ?
samd_mbedtls_ecdh_p256_public_key_start(
handshake->samd_ecdh_private_scalar,
handshake->samd_ecdh_public_key,
samd_mbedtls_ssl_ecdh_public_key_callback,
mbedtls_async_hardware_ecdh_p256_public_key_start(
handshake->async_hardware_ecdh_private_scalar,
handshake->async_hardware_ecdh_public_key,
mbedtls_async_hardware_ssl_ecdh_public_key_callback,
handshake) :
coordinate_len == 48 ?
samd_mbedtls_ecdh_p384_public_key_start(
handshake->samd_ecdh_private_scalar,
handshake->samd_ecdh_public_key,
samd_mbedtls_ssl_ecdh_public_key_callback,
mbedtls_async_hardware_ecdh_p384_public_key_start(
handshake->async_hardware_ecdh_private_scalar,
handshake->async_hardware_ecdh_public_key,
mbedtls_async_hardware_ssl_ecdh_public_key_callback,
handshake) :
coordinate_len == 66 ?
samd_mbedtls_ecdh_p521_public_key_start(
handshake->samd_ecdh_private_scalar,
handshake->samd_ecdh_public_key,
samd_mbedtls_ssl_ecdh_public_key_callback,
mbedtls_async_hardware_ecdh_p521_public_key_start(
handshake->async_hardware_ecdh_private_scalar,
handshake->async_hardware_ecdh_public_key,
mbedtls_async_hardware_ssl_ecdh_public_key_callback,
handshake) :
0) == 0) {
handshake->samd_ecdh_public_pending = 0;
handshake->async_hardware_ecdh_public_pending = 0;
return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
}
return MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
}
static void samd_mbedtls_ssl_ecdh_secret_callback(int success, void *context)
static void mbedtls_async_hardware_ssl_ecdh_secret_callback(int success, void *context)
{
mbedtls_ssl_handshake_params *handshake =
(mbedtls_ssl_handshake_params *) context;
@ -223,11 +223,11 @@ static void samd_mbedtls_ssl_ecdh_secret_callback(int success, void *context)
return;
}
handshake->samd_ecdh_secret_success = success ? 1 : 0;
handshake->samd_ecdh_secret_done = 1;
handshake->async_hardware_ecdh_secret_success = success ? 1 : 0;
handshake->async_hardware_ecdh_secret_done = 1;
}
static int samd_mbedtls_ssl_ecdh_secret_fill(mbedtls_ssl_context *ssl)
static int mbedtls_async_hardware_ssl_ecdh_secret_fill(mbedtls_ssl_context *ssl)
{
mbedtls_ssl_handshake_params *handshake;
size_t coordinate_len;
@ -238,71 +238,71 @@ static int samd_mbedtls_ssl_ecdh_secret_fill(mbedtls_ssl_context *ssl)
handshake = ssl->handshake;
if (handshake->samd_ecdh_secret_ready != 0) {
if (handshake->async_hardware_ecdh_secret_ready != 0) {
return 0;
}
if (handshake->samd_ecdh_secret_pending != 0) {
if (handshake->samd_ecdh_secret_done == 0) {
if (handshake->async_hardware_ecdh_secret_pending != 0) {
if (handshake->async_hardware_ecdh_secret_done == 0) {
return MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
}
handshake->samd_ecdh_secret_pending = 0;
handshake->samd_ecdh_secret_done = 0;
if (handshake->samd_ecdh_secret_success == 0) {
handshake->samd_ecdh_secret_success = 0;
handshake->async_hardware_ecdh_secret_pending = 0;
handshake->async_hardware_ecdh_secret_done = 0;
if (handshake->async_hardware_ecdh_secret_success == 0) {
handshake->async_hardware_ecdh_secret_success = 0;
return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
}
handshake->samd_ecdh_secret_success = 0;
handshake->samd_ecdh_secret_ready = 1;
handshake->async_hardware_ecdh_secret_success = 0;
handshake->async_hardware_ecdh_secret_ready = 1;
ssl->handshake->pmslen = (handshake->xxdh_psa_bits + 7u) / 8u;
return 0;
}
handshake->samd_ecdh_secret_pending = 1;
handshake->samd_ecdh_secret_done = 0;
handshake->samd_ecdh_secret_success = 0;
handshake->samd_ecdh_secret_ready = 0;
handshake->async_hardware_ecdh_secret_pending = 1;
handshake->async_hardware_ecdh_secret_done = 0;
handshake->async_hardware_ecdh_secret_success = 0;
handshake->async_hardware_ecdh_secret_ready = 0;
coordinate_len = (handshake->xxdh_psa_bits + 7u) / 8u;
if ((coordinate_len == 32 ?
samd_mbedtls_ecdh_p256_start(
handshake->samd_ecdh_private_scalar,
mbedtls_async_hardware_ecdh_p256_start(
handshake->async_hardware_ecdh_private_scalar,
handshake->xxdh_psa_peerkey,
ssl->handshake->premaster,
samd_mbedtls_ssl_ecdh_secret_callback,
mbedtls_async_hardware_ssl_ecdh_secret_callback,
handshake) :
coordinate_len == 48 ?
samd_mbedtls_ecdh_p384_start(
handshake->samd_ecdh_private_scalar,
mbedtls_async_hardware_ecdh_p384_start(
handshake->async_hardware_ecdh_private_scalar,
handshake->xxdh_psa_peerkey,
ssl->handshake->premaster,
samd_mbedtls_ssl_ecdh_secret_callback,
mbedtls_async_hardware_ssl_ecdh_secret_callback,
handshake) :
coordinate_len == 66 ?
samd_mbedtls_ecdh_p521_start(
handshake->samd_ecdh_private_scalar,
mbedtls_async_hardware_ecdh_p521_start(
handshake->async_hardware_ecdh_private_scalar,
handshake->xxdh_psa_peerkey,
ssl->handshake->premaster,
samd_mbedtls_ssl_ecdh_secret_callback,
mbedtls_async_hardware_ssl_ecdh_secret_callback,
handshake) :
0) == 0) {
handshake->samd_ecdh_secret_pending = 0;
handshake->async_hardware_ecdh_secret_pending = 0;
return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
}
return MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS;
}
static void samd_mbedtls_clear_ecdh_scalar(
static void mbedtls_async_hardware_clear_ecdh_scalar(
mbedtls_ssl_handshake_params *handshake)
{
if (handshake == NULL) {
return;
}
mbedtls_platform_zeroize(handshake->samd_ecdh_private_scalar,
sizeof(handshake->samd_ecdh_private_scalar));
mbedtls_platform_zeroize(handshake->async_hardware_ecdh_private_scalar,
sizeof(handshake->async_hardware_ecdh_private_scalar));
}
#endif
@ -2693,60 +2693,60 @@ static int ssl_write_client_key_exchange(mbedtls_ssl_context *ssl)
psa_set_key_bits(&key_attributes, handshake->xxdh_psa_bits);
#if defined(MBEDTLS_ASYNC_HARDWARE_RANDOM)
size_t samd_coordinate_len;
size_t samd_public_key_len;
size_t async_hardware_coordinate_len;
size_t async_hardware_public_key_len;
if (handshake->xxdh_psa_bits != 256u &&
handshake->xxdh_psa_bits != 384u &&
handshake->xxdh_psa_bits != 521u) {
return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
}
samd_coordinate_len = (handshake->xxdh_psa_bits + 7u) / 8u;
samd_public_key_len = samd_coordinate_len * 2u + 1u;
async_hardware_coordinate_len = (handshake->xxdh_psa_bits + 7u) / 8u;
async_hardware_public_key_len = async_hardware_coordinate_len * 2u + 1u;
if (handshake->samd_ecdh_private_ready == 0) {
ret = samd_mbedtls_ssl_random_fill(
ssl, handshake->samd_ecdh_private_scalar,
samd_coordinate_len);
if (handshake->async_hardware_ecdh_private_ready == 0) {
ret = mbedtls_async_hardware_ssl_random_fill(
ssl, handshake->async_hardware_ecdh_private_scalar,
async_hardware_coordinate_len);
if (ret != 0) {
return ret;
}
handshake->samd_ecdh_private_ready = 1;
handshake->async_hardware_ecdh_private_ready = 1;
}
ret = samd_mbedtls_ssl_ecdh_public_key_fill(ssl);
ret = mbedtls_async_hardware_ssl_ecdh_public_key_fill(ssl);
if (ret != 0) {
return ret;
}
unsigned char *samd_own_pubkey = ssl->out_msg + header_len + 1;
unsigned char *samd_end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
size_t samd_own_pubkey_max_len =
(size_t) (samd_end - samd_own_pubkey);
unsigned char *async_hardware_own_pubkey = ssl->out_msg + header_len + 1;
unsigned char *async_hardware_end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN;
size_t async_hardware_own_pubkey_max_len =
(size_t) (async_hardware_end - async_hardware_own_pubkey);
if (samd_own_pubkey_max_len <
samd_public_key_len) {
if (async_hardware_own_pubkey_max_len <
async_hardware_public_key_len) {
return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL;
}
memcpy(samd_own_pubkey, handshake->samd_ecdh_public_key,
samd_public_key_len);
memcpy(async_hardware_own_pubkey, handshake->async_hardware_ecdh_public_key,
async_hardware_public_key_len);
ssl->out_msg[header_len] =
(unsigned char) samd_public_key_len;
content_len = samd_public_key_len + 1;
(unsigned char) async_hardware_public_key_len;
content_len = async_hardware_public_key_len + 1;
ret = samd_mbedtls_ssl_ecdh_secret_fill(ssl);
ret = mbedtls_async_hardware_ssl_ecdh_secret_fill(ssl);
if (ret != 0) {
return ret;
}
samd_mbedtls_clear_ecdh_scalar(handshake);
handshake->samd_ecdh_private_ready = 0;
handshake->samd_ecdh_public_ready = 0;
handshake->samd_ecdh_secret_ready = 0;
mbedtls_platform_zeroize(handshake->samd_ecdh_public_key,
sizeof(handshake->samd_ecdh_public_key));
goto samd_ecdh_done;
mbedtls_async_hardware_clear_ecdh_scalar(handshake);
handshake->async_hardware_ecdh_private_ready = 0;
handshake->async_hardware_ecdh_public_ready = 0;
handshake->async_hardware_ecdh_secret_ready = 0;
mbedtls_platform_zeroize(handshake->async_hardware_ecdh_public_key,
sizeof(handshake->async_hardware_ecdh_public_key));
goto async_hardware_ecdh_done;
#else
/* Generate ECDH private key. */
status = psa_generate_key(&key_attributes,
@ -2854,7 +2854,7 @@ complete_interruptible_ecdh:
}
#endif
#if defined(MBEDTLS_ASYNC_HARDWARE_RANDOM)
samd_ecdh_done:
async_hardware_ecdh_done:
(void) 0;
#endif
} else

2
tf-psa-crypto

@ -1 +1 @@
Subproject commit 367fbeffb13aaf9203d06a0a663f94d13716b8c9
Subproject commit 3e1a1b9b30c49fdae5a77ba4dbbf7ce543d159e0