diff --git a/library/ssl_client.c b/library/ssl_client.c index 660e0c519b..689782d4f8 100644 --- a/library/ssl_client.c +++ b/library/ssl_client.c @@ -21,13 +21,13 @@ #include "ssl_debug_helpers.h" #if defined(MBEDTLS_ASYNC_HARDWARE_RANDOM) -typedef void (*samd_mbedtls_async_callback_t)(int success, void *context); +typedef void (*mbedtls_async_hardware_callback_t)(int success, void *context); -int samd_mbedtls_random_start(uint8_t *buffer, size_t length, - samd_mbedtls_async_callback_t callback, +int mbedtls_async_hardware_random_start(uint8_t *buffer, size_t length, + mbedtls_async_hardware_callback_t callback, void *context); -static void samd_mbedtls_ssl_random_callback(int success, void *context) +static void mbedtls_async_hardware_ssl_random_callback(int success, void *context) { mbedtls_ssl_handshake_params *handshake = (mbedtls_ssl_handshake_params *) context; @@ -35,11 +35,11 @@ static void samd_mbedtls_ssl_random_callback(int success, void *context) return; } - handshake->samd_random_success = success ? 1 : 0; - handshake->samd_random_done = 1; + handshake->async_hardware_random_success = success ? 1 : 0; + handshake->async_hardware_random_done = 1; } -static int samd_mbedtls_ssl_random_fill( +static int mbedtls_async_hardware_ssl_random_fill( mbedtls_ssl_context *ssl, unsigned char *buffer, size_t length) @@ -53,29 +53,29 @@ static int samd_mbedtls_ssl_random_fill( handshake = ssl->handshake; - if (handshake->samd_random_pending != 0) { - if (handshake->samd_random_done == 0) { + if (handshake->async_hardware_random_pending != 0) { + if (handshake->async_hardware_random_done == 0) { return MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS; } - handshake->samd_random_pending = 0; - handshake->samd_random_done = 0; - if (handshake->samd_random_success == 0) { - handshake->samd_random_success = 0; + handshake->async_hardware_random_pending = 0; + handshake->async_hardware_random_done = 0; + if (handshake->async_hardware_random_success == 0) { + handshake->async_hardware_random_success = 0; return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED; } - handshake->samd_random_success = 0; + handshake->async_hardware_random_success = 0; return 0; } - handshake->samd_random_pending = 1; - handshake->samd_random_done = 0; - handshake->samd_random_success = 0; + handshake->async_hardware_random_pending = 1; + handshake->async_hardware_random_done = 0; + handshake->async_hardware_random_success = 0; - if (samd_mbedtls_random_start( - buffer, length, samd_mbedtls_ssl_random_callback, + if (mbedtls_async_hardware_random_start( + buffer, length, mbedtls_async_hardware_ssl_random_callback, handshake) == 0) { - handshake->samd_random_pending = 0; + handshake->async_hardware_random_pending = 0; return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED; } @@ -765,7 +765,7 @@ static int ssl_generate_random(mbedtls_ssl_context *ssl) size_t gmt_unix_time_len = 0; #if defined(MBEDTLS_ASYNC_HARDWARE_RANDOM) - if (ssl->handshake->samd_client_random_ready != 0) { + if (ssl->handshake->async_hardware_client_random_ready != 0) { return 0; } #endif @@ -795,11 +795,11 @@ static int ssl_generate_random(mbedtls_ssl_context *ssl) } #if defined(MBEDTLS_ASYNC_HARDWARE_RANDOM) - ret = samd_mbedtls_ssl_random_fill( + ret = mbedtls_async_hardware_ssl_random_fill( ssl, randbytes + gmt_unix_time_len, MBEDTLS_CLIENT_HELLO_RANDOM_LEN - gmt_unix_time_len); if (ret == 0) { - ssl->handshake->samd_client_random_ready = 1; + ssl->handshake->async_hardware_client_random_ready = 1; } #else ret = psa_generate_random(randbytes + gmt_unix_time_len, @@ -946,7 +946,7 @@ static int ssl_prepare_client_hello(mbedtls_ssl_context *ssl) if (session_id_len > 0) { #if defined(MBEDTLS_ASYNC_HARDWARE_RANDOM) - ret = samd_mbedtls_ssl_random_fill( + ret = mbedtls_async_hardware_ssl_random_fill( ssl, session_negotiate->id, session_id_len); #else ret = psa_generate_random(session_negotiate->id, diff --git a/library/ssl_misc.h b/library/ssl_misc.h index d46446db06..fb222a5ab3 100644 --- a/library/ssl_misc.h +++ b/library/ssl_misc.h @@ -701,21 +701,21 @@ struct mbedtls_ssl_handshake_params { #endif #if defined(MBEDTLS_ASYNC_HARDWARE_RANDOM) - uint8_t samd_random_pending; - uint8_t samd_random_done; - uint8_t samd_random_success; - uint8_t samd_client_random_ready; - uint8_t samd_ecdh_public_pending; - uint8_t samd_ecdh_public_done; - uint8_t samd_ecdh_public_success; - uint8_t samd_ecdh_public_ready; - uint8_t samd_ecdh_private_ready; - uint8_t samd_ecdh_secret_pending; - uint8_t samd_ecdh_secret_done; - uint8_t samd_ecdh_secret_success; - uint8_t samd_ecdh_secret_ready; - unsigned char samd_ecdh_private_scalar[66]; - unsigned char samd_ecdh_public_key[133]; + uint8_t async_hardware_random_pending; + uint8_t async_hardware_random_done; + uint8_t async_hardware_random_success; + uint8_t async_hardware_client_random_ready; + uint8_t async_hardware_ecdh_public_pending; + uint8_t async_hardware_ecdh_public_done; + uint8_t async_hardware_ecdh_public_success; + uint8_t async_hardware_ecdh_public_ready; + uint8_t async_hardware_ecdh_private_ready; + uint8_t async_hardware_ecdh_secret_pending; + uint8_t async_hardware_ecdh_secret_done; + uint8_t async_hardware_ecdh_secret_success; + uint8_t async_hardware_ecdh_secret_ready; + unsigned char async_hardware_ecdh_private_scalar[66]; + unsigned char async_hardware_ecdh_public_key[133]; #endif #if defined(MBEDTLS_SSL_ECP_RESTARTABLE_ENABLED) @@ -1137,14 +1137,14 @@ struct mbedtls_ssl_transform { psa_algorithm_t psa_alg; /*!< psa algorithm */ #if defined(MBEDTLS_ASYNC_HARDWARE_AEAD) - unsigned char samd_aead_key_enc[32]; - unsigned char samd_aead_key_dec[32]; - size_t samd_aead_key_len; - unsigned char samd_aead_algorithm; - unsigned char samd_aead_keys_configured; - unsigned char samd_aead_pending; - unsigned char samd_aead_done; - unsigned char samd_aead_success; + unsigned char async_hardware_aead_key_enc[32]; + unsigned char async_hardware_aead_key_dec[32]; + size_t async_hardware_aead_key_len; + unsigned char async_hardware_aead_algorithm; + unsigned char async_hardware_aead_keys_configured; + unsigned char async_hardware_aead_pending; + unsigned char async_hardware_aead_done; + unsigned char async_hardware_aead_success; #endif #if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID) diff --git a/library/ssl_msg.c b/library/ssl_msg.c index f92974b10a..890fee43b2 100644 --- a/library/ssl_msg.c +++ b/library/ssl_msg.c @@ -44,58 +44,58 @@ static int local_err_translation(psa_status_t status) #define PSA_TO_MBEDTLS_ERR(status) local_err_translation(status) #if defined(MBEDTLS_ASYNC_HARDWARE_AEAD) -typedef void (*samd_mbedtls_async_callback_t)(int success, void *context); +typedef void (*mbedtls_async_hardware_callback_t)(int success, void *context); -int samd_mbedtls_aes_gcm128_encrypt_start( +int mbedtls_async_hardware_aes_gcm128_encrypt_start( const uint8_t key[16], const uint8_t nonce[12], const uint8_t *aad, size_t aadLength, const uint8_t *plaintext, uint8_t *ciphertext, - size_t length, uint8_t tag[16], samd_mbedtls_async_callback_t callback, + size_t length, uint8_t tag[16], mbedtls_async_hardware_callback_t callback, void *context); -int samd_mbedtls_aes_gcm128_decrypt_start( +int mbedtls_async_hardware_aes_gcm128_decrypt_start( const uint8_t key[16], const uint8_t nonce[12], const uint8_t *aad, size_t aadLength, const uint8_t *ciphertext, uint8_t *plaintext, size_t length, const uint8_t tag[16], - samd_mbedtls_async_callback_t callback, void *context); -int samd_mbedtls_aead_encrypt_start( + mbedtls_async_hardware_callback_t callback, void *context); +int mbedtls_async_hardware_aead_encrypt_start( int algorithm, const uint8_t *key, size_t keyLength, const uint8_t *nonce, size_t nonceLength, const uint8_t *aad, size_t aadLength, const uint8_t *plaintext, uint8_t *ciphertext, size_t length, uint8_t *tag, size_t tagLength, - samd_mbedtls_async_callback_t callback, void *context); -int samd_mbedtls_aead_decrypt_start( + mbedtls_async_hardware_callback_t callback, void *context); +int mbedtls_async_hardware_aead_decrypt_start( int algorithm, const uint8_t *key, size_t keyLength, const uint8_t *nonce, size_t nonceLength, const uint8_t *aad, size_t aadLength, const uint8_t *ciphertext, uint8_t *plaintext, size_t length, const uint8_t *tag, size_t tagLength, - samd_mbedtls_async_callback_t callback, void *context); + mbedtls_async_hardware_callback_t callback, void *context); -static void samd_mbedtls_ssl_aead_callback(int success, void *context) +static void mbedtls_async_hardware_ssl_aead_callback(int success, void *context) { mbedtls_ssl_transform *transform = (mbedtls_ssl_transform *) context; if (transform == NULL) { return; } - transform->samd_aead_success = success ? 1 : 0; - transform->samd_aead_done = 1; + transform->async_hardware_aead_success = success ? 1 : 0; + transform->async_hardware_aead_done = 1; } /** - * @brief Return whether the transform has explicit SAMD AEAD metadata. + * @brief Return whether the transform has explicit async hardware AEAD metadata. * * @todo Extend the provider dispatch behind this metadata for AES-256-GCM, * AES-CCM, AES-CCM-8, and ChaCha20-Poly1305. Until then those algorithms are * intentional fail-closed stubs instead of PSA/software fallbacks. */ -static int samd_mbedtls_ssl_transform_has_aead( +static int mbedtls_async_hardware_ssl_transform_has_aead( const mbedtls_ssl_transform *transform) { return transform != NULL && - transform->samd_aead_keys_configured != 0 && - transform->samd_aead_algorithm != 0 && - transform->samd_aead_key_len != 0 && - transform->samd_aead_key_len <= - sizeof(transform->samd_aead_key_enc) && + transform->async_hardware_aead_keys_configured != 0 && + transform->async_hardware_aead_algorithm != 0 && + transform->async_hardware_aead_key_len != 0 && + transform->async_hardware_aead_key_len <= + sizeof(transform->async_hardware_aead_key_enc) && transform->ivlen == 12; } @@ -110,7 +110,7 @@ int mbedtls_ssl_configure_async_aead_transform( unsigned char async_algorithm = 0; if (transform == NULL || key_enc == NULL || key_dec == NULL || - key_len == 0 || key_len > sizeof(transform->samd_aead_key_enc) || + key_len == 0 || key_len > sizeof(transform->async_hardware_aead_key_enc) || transform->ivlen != 12 || transform->taglen != 16) { return 0; } @@ -146,11 +146,11 @@ int mbedtls_ssl_configure_async_aead_transform( } } - memcpy(transform->samd_aead_key_enc, key_enc, key_len); - memcpy(transform->samd_aead_key_dec, key_dec, key_len); - transform->samd_aead_key_len = key_len; - transform->samd_aead_algorithm = async_algorithm; - transform->samd_aead_keys_configured = 1; + memcpy(transform->async_hardware_aead_key_enc, key_enc, key_len); + memcpy(transform->async_hardware_aead_key_dec, key_dec, key_len); + transform->async_hardware_aead_key_len = key_len; + transform->async_hardware_aead_algorithm = async_algorithm; + transform->async_hardware_aead_keys_configured = 1; return 1; } #endif @@ -1101,8 +1101,8 @@ hmac_failed_etm_disabled: int dynamic_iv_is_explicit = ssl_transform_aead_dynamic_iv_is_explicit(transform); #if defined(MBEDTLS_ASYNC_HARDWARE_AEAD) - int use_samd_aead = - samd_mbedtls_ssl_transform_has_aead(transform); + int use_async_hardware_aead = + mbedtls_async_hardware_ssl_transform_has_aead(transform); #endif psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; @@ -1129,17 +1129,17 @@ hmac_failed_etm_disabled: dynamic_iv_len = sizeof(rec->ctr); #if defined(MBEDTLS_ASYNC_HARDWARE_AEAD) - if (use_samd_aead && transform->samd_aead_pending != 0) { - if (transform->samd_aead_done == 0) { + if (use_async_hardware_aead && transform->async_hardware_aead_pending != 0) { + if (transform->async_hardware_aead_done == 0) { return MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS; } - transform->samd_aead_pending = 0; - transform->samd_aead_done = 0; - if (transform->samd_aead_success == 0) { - transform->samd_aead_success = 0; + transform->async_hardware_aead_pending = 0; + transform->async_hardware_aead_done = 0; + if (transform->async_hardware_aead_success == 0) { + transform->async_hardware_aead_success = 0; return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED; } - transform->samd_aead_success = 0; + transform->async_hardware_aead_success = 0; MBEDTLS_SSL_DEBUG_BUF(4, "after encrypt: tag", data + rec->data_len, @@ -1161,7 +1161,7 @@ hmac_failed_etm_disabled: } auth_done++; - goto samd_aead_encrypt_done; + goto async_hardware_aead_encrypt_done; } #endif @@ -1194,20 +1194,20 @@ hmac_failed_etm_disabled: * Encrypt and authenticate */ #if defined(MBEDTLS_ASYNC_HARDWARE_AEAD) - if (use_samd_aead) { - transform->samd_aead_pending = 1; - transform->samd_aead_done = 0; - transform->samd_aead_success = 0; - if (samd_mbedtls_aead_encrypt_start( - transform->samd_aead_algorithm, - transform->samd_aead_key_enc, - transform->samd_aead_key_len, + if (use_async_hardware_aead) { + transform->async_hardware_aead_pending = 1; + transform->async_hardware_aead_done = 0; + transform->async_hardware_aead_success = 0; + if (mbedtls_async_hardware_aead_encrypt_start( + transform->async_hardware_aead_algorithm, + transform->async_hardware_aead_key_enc, + transform->async_hardware_aead_key_len, iv, transform->ivlen, add_data, add_data_len, data, data, rec->data_len, data + rec->data_len, transform->taglen, - samd_mbedtls_ssl_aead_callback, + mbedtls_async_hardware_ssl_aead_callback, transform) == 0) { - transform->samd_aead_pending = 0; + transform->async_hardware_aead_pending = 0; return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED; } return MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS; @@ -1251,7 +1251,7 @@ hmac_failed_etm_disabled: auth_done++; #if defined(MBEDTLS_ASYNC_HARDWARE_AEAD) -samd_aead_encrypt_done: +async_hardware_aead_encrypt_done: (void) 0; #endif } else @@ -1523,25 +1523,25 @@ int mbedtls_ssl_decrypt_buf(mbedtls_ssl_context const *ssl, unsigned char *dynamic_iv; size_t dynamic_iv_len; #if defined(MBEDTLS_ASYNC_HARDWARE_AEAD) - int use_samd_aead = - samd_mbedtls_ssl_transform_has_aead(transform); + int use_async_hardware_aead = + mbedtls_async_hardware_ssl_transform_has_aead(transform); #endif psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; #if defined(MBEDTLS_ASYNC_HARDWARE_AEAD) - if (use_samd_aead && transform->samd_aead_pending != 0) { - if (transform->samd_aead_done == 0) { + if (use_async_hardware_aead && transform->async_hardware_aead_pending != 0) { + if (transform->async_hardware_aead_done == 0) { return MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS; } - transform->samd_aead_pending = 0; - transform->samd_aead_done = 0; - if (transform->samd_aead_success == 0) { - transform->samd_aead_success = 0; + transform->async_hardware_aead_pending = 0; + transform->async_hardware_aead_done = 0; + if (transform->async_hardware_aead_success == 0) { + transform->async_hardware_aead_success = 0; return MBEDTLS_ERR_SSL_INVALID_MAC; } - transform->samd_aead_success = 0; + transform->async_hardware_aead_success = 0; auth_done++; - goto samd_aead_decrypt_done; + goto async_hardware_aead_decrypt_done; } #endif @@ -1614,20 +1614,20 @@ int mbedtls_ssl_decrypt_buf(mbedtls_ssl_context const *ssl, * Decrypt and authenticate */ #if defined(MBEDTLS_ASYNC_HARDWARE_AEAD) - if (use_samd_aead) { - transform->samd_aead_pending = 1; - transform->samd_aead_done = 0; - transform->samd_aead_success = 0; - if (samd_mbedtls_aead_decrypt_start( - transform->samd_aead_algorithm, - transform->samd_aead_key_dec, - transform->samd_aead_key_len, + if (use_async_hardware_aead) { + transform->async_hardware_aead_pending = 1; + transform->async_hardware_aead_done = 0; + transform->async_hardware_aead_success = 0; + if (mbedtls_async_hardware_aead_decrypt_start( + transform->async_hardware_aead_algorithm, + transform->async_hardware_aead_key_dec, + transform->async_hardware_aead_key_len, iv, transform->ivlen, add_data, add_data_len, data, data, rec->data_len, data + rec->data_len, transform->taglen, - samd_mbedtls_ssl_aead_callback, + mbedtls_async_hardware_ssl_aead_callback, transform) == 0) { - transform->samd_aead_pending = 0; + transform->async_hardware_aead_pending = 0; return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED; } return MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS; @@ -1657,7 +1657,7 @@ int mbedtls_ssl_decrypt_buf(mbedtls_ssl_context const *ssl, return MBEDTLS_ERR_SSL_INTERNAL_ERROR; } #if defined(MBEDTLS_ASYNC_HARDWARE_AEAD) -samd_aead_decrypt_done: +async_hardware_aead_decrypt_done: (void) 0; #endif } else @@ -4934,7 +4934,7 @@ static int ssl_get_next_record(mbedtls_ssl_context *ssl) #if defined(MBEDTLS_ASYNC_HARDWARE_AEAD) if (ssl->transform_in != NULL && - ssl->transform_in->samd_aead_pending != 0) { + ssl->transform_in->async_hardware_aead_pending != 0) { const size_t header_len = mbedtls_ssl_in_hdr_len(ssl); const size_t explicit_iv_len = ssl_transform_aead_dynamic_iv_is_explicit(ssl->transform_in) ? @@ -4958,7 +4958,7 @@ static int ssl_get_next_record(mbedtls_ssl_context *ssl) return ret; } - goto samd_aead_record_content_ready; + goto async_hardware_aead_record_content_ready; } #endif @@ -5148,7 +5148,7 @@ static int ssl_get_next_record(mbedtls_ssl_context *ssl) #if defined(MBEDTLS_ASYNC_HARDWARE_AEAD) -samd_aead_record_content_ready: +async_hardware_aead_record_content_ready: #endif /* Reset in pointers to default state for TLS/DTLS records, @@ -6149,7 +6149,7 @@ static int ssl_write_real(mbedtls_ssl_context *ssl, #if defined(MBEDTLS_ASYNC_HARDWARE_AEAD) if (ssl->transform_out != NULL && - ssl->transform_out->samd_aead_pending != 0) { + ssl->transform_out->async_hardware_aead_pending != 0) { if ((ret = mbedtls_ssl_write_record(ssl, SSL_FORCE_FLUSH)) != 0) { MBEDTLS_SSL_DEBUG_RET(1, "mbedtls_ssl_write_record", ret); return ret; diff --git a/library/ssl_tls.c b/library/ssl_tls.c index fdb63e9395..e9a6fe71be 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -7469,15 +7469,15 @@ int mbedtls_ssl_write_finished(mbedtls_ssl_context *ssl) int next_state = -1; unsigned int hash_len; #if defined(MBEDTLS_ASYNC_HARDWARE_AEAD) - int samd_resume_pending_finished = 0; + int async_hardware_resume_pending_finished = 0; #endif MBEDTLS_SSL_DEBUG_MSG(2, ("=> write finished")); #if defined(MBEDTLS_ASYNC_HARDWARE_AEAD) if (ssl->transform_negotiate != NULL && - ssl->transform_negotiate->samd_aead_pending != 0) { - samd_resume_pending_finished = 1; + ssl->transform_negotiate->async_hardware_aead_pending != 0) { + async_hardware_resume_pending_finished = 1; if (ssl->handshake->resume != 0) { #if defined(MBEDTLS_SSL_CLI_C) if (ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT) { @@ -7492,7 +7492,7 @@ int mbedtls_ssl_write_finished(mbedtls_ssl_context *ssl) } else { next_state = ssl->state + 1; } - goto samd_resume_pending_finished_write; + goto async_hardware_resume_pending_finished_write; } #endif @@ -7547,7 +7547,7 @@ int mbedtls_ssl_write_finished(mbedtls_ssl_context *ssl) MBEDTLS_SSL_DEBUG_MSG(3, ("switching to new transform spec for outbound data")); #if defined(MBEDTLS_ASYNC_HARDWARE_AEAD) -samd_resume_pending_finished_write: +async_hardware_resume_pending_finished_write: #endif #if defined(MBEDTLS_SSL_PROTO_DTLS) @@ -7589,7 +7589,7 @@ samd_resume_pending_finished_write: #endif #if defined(MBEDTLS_ASYNC_HARDWARE_AEAD) - if (samd_resume_pending_finished) { + if (async_hardware_resume_pending_finished) { ret = mbedtls_ssl_write_record(ssl, 1); } else #endif @@ -7599,7 +7599,7 @@ samd_resume_pending_finished_write: if (ret != 0) { MBEDTLS_SSL_DEBUG_RET(1, #if defined(MBEDTLS_ASYNC_HARDWARE_AEAD) - samd_resume_pending_finished + async_hardware_resume_pending_finished ? "mbedtls_ssl_write_record" : #endif @@ -7759,14 +7759,14 @@ static mbedtls_tls_prf_types tls_prf_get_type(mbedtls_ssl_tls_prf_cb *tls_prf) #if defined(MBEDTLS_ASYNC_HARDWARE_AEAD) /** - * @brief Map Mbed TLS/PSA record parameters to SAMD TLS AEAD capabilities. + * @brief Map Mbed TLS/PSA record parameters to async hardware TLS AEAD capabilities. * * @todo Wire AES-256-GCM, AES-CCM, AES-CCM-8, and ChaCha20-Poly1305 to * hardware-backed provider operations. They are classified here so production * hardware builds fail closed through the generic AEAD boundary instead of * silently falling back to PSA/software. */ -static int samd_mbedtls_tls_aead_from_transform(psa_key_type_t key_type, +static int mbedtls_async_hardware_tls_aead_from_transform(psa_key_type_t key_type, size_t keylen, psa_algorithm_t alg, size_t ivlen, @@ -8103,17 +8103,17 @@ static int ssl_tls12_populate_transform(mbedtls_ssl_transform *transform, transform->psa_alg = alg; #if defined(MBEDTLS_ASYNC_HARDWARE_AEAD) - int samd_aead_algorithm = samd_mbedtls_tls_aead_from_transform( + int async_hardware_aead_algorithm = mbedtls_async_hardware_tls_aead_from_transform( key_type, keylen, alg, transform->ivlen, transform->fixed_ivlen, transform->taglen); if (ssl_mode == MBEDTLS_SSL_MODE_AEAD && - samd_aead_algorithm != 0 && - keylen <= sizeof(transform->samd_aead_key_enc)) { - memcpy(transform->samd_aead_key_enc, key1, keylen); - memcpy(transform->samd_aead_key_dec, key2, keylen); - transform->samd_aead_key_len = keylen; - transform->samd_aead_algorithm = (unsigned char) samd_aead_algorithm; - transform->samd_aead_keys_configured = 1; + async_hardware_aead_algorithm != 0 && + keylen <= sizeof(transform->async_hardware_aead_key_enc)) { + memcpy(transform->async_hardware_aead_key_enc, key1, keylen); + memcpy(transform->async_hardware_aead_key_dec, key2, keylen); + transform->async_hardware_aead_key_len = keylen; + transform->async_hardware_aead_algorithm = (unsigned char) async_hardware_aead_algorithm; + transform->async_hardware_aead_keys_configured = 1; } #endif diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c index 31d73e35da..901752655e 100644 --- a/library/ssl_tls12_client.c +++ b/library/ssl_tls12_client.c @@ -46,46 +46,46 @@ static int local_err_translation(psa_status_t status) #endif #if defined(MBEDTLS_ASYNC_HARDWARE_RANDOM) -typedef void (*samd_mbedtls_async_callback_t)(int success, void *context); +typedef void (*mbedtls_async_hardware_callback_t)(int success, void *context); -int samd_mbedtls_random_start(uint8_t *buffer, size_t length, - samd_mbedtls_async_callback_t callback, +int mbedtls_async_hardware_random_start(uint8_t *buffer, size_t length, + mbedtls_async_hardware_callback_t callback, void *context); -int samd_mbedtls_ecdh_p256_public_key_start( +int mbedtls_async_hardware_ecdh_p256_public_key_start( const uint8_t private_scalar[32], uint8_t public_key[65], - samd_mbedtls_async_callback_t callback, + mbedtls_async_hardware_callback_t callback, void *context); -int samd_mbedtls_ecdh_p384_public_key_start( +int mbedtls_async_hardware_ecdh_p384_public_key_start( const uint8_t private_scalar[48], uint8_t public_key[97], - samd_mbedtls_async_callback_t callback, + mbedtls_async_hardware_callback_t callback, void *context); -int samd_mbedtls_ecdh_p521_public_key_start( +int mbedtls_async_hardware_ecdh_p521_public_key_start( const uint8_t private_scalar[66], uint8_t public_key[133], - samd_mbedtls_async_callback_t callback, + mbedtls_async_hardware_callback_t callback, void *context); -int samd_mbedtls_ecdh_p256_start( +int mbedtls_async_hardware_ecdh_p256_start( const uint8_t private_scalar[32], const uint8_t peer_public_key[65], uint8_t shared_secret[32], - samd_mbedtls_async_callback_t callback, + mbedtls_async_hardware_callback_t callback, void *context); -int samd_mbedtls_ecdh_p384_start( +int mbedtls_async_hardware_ecdh_p384_start( const uint8_t private_scalar[48], const uint8_t peer_public_key[97], uint8_t shared_secret[48], - samd_mbedtls_async_callback_t callback, + mbedtls_async_hardware_callback_t callback, void *context); -int samd_mbedtls_ecdh_p521_start( +int mbedtls_async_hardware_ecdh_p521_start( const uint8_t private_scalar[66], const uint8_t peer_public_key[133], uint8_t shared_secret[66], - samd_mbedtls_async_callback_t callback, + mbedtls_async_hardware_callback_t callback, void *context); -static void samd_mbedtls_ssl_random_callback(int success, void *context) +static void mbedtls_async_hardware_ssl_random_callback(int success, void *context) { mbedtls_ssl_handshake_params *handshake = (mbedtls_ssl_handshake_params *) context; @@ -93,11 +93,11 @@ static void samd_mbedtls_ssl_random_callback(int success, void *context) return; } - handshake->samd_random_success = success ? 1 : 0; - handshake->samd_random_done = 1; + handshake->async_hardware_random_success = success ? 1 : 0; + handshake->async_hardware_random_done = 1; } -static int samd_mbedtls_ssl_random_fill( +static int mbedtls_async_hardware_ssl_random_fill( mbedtls_ssl_context *ssl, unsigned char *buffer, size_t length) @@ -111,36 +111,36 @@ static int samd_mbedtls_ssl_random_fill( handshake = ssl->handshake; - if (handshake->samd_random_pending != 0) { - if (handshake->samd_random_done == 0) { + if (handshake->async_hardware_random_pending != 0) { + if (handshake->async_hardware_random_done == 0) { return MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS; } - handshake->samd_random_pending = 0; - handshake->samd_random_done = 0; - if (handshake->samd_random_success == 0) { - handshake->samd_random_success = 0; + handshake->async_hardware_random_pending = 0; + handshake->async_hardware_random_done = 0; + if (handshake->async_hardware_random_success == 0) { + handshake->async_hardware_random_success = 0; return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED; } - handshake->samd_random_success = 0; + handshake->async_hardware_random_success = 0; return 0; } - handshake->samd_random_pending = 1; - handshake->samd_random_done = 0; - handshake->samd_random_success = 0; + handshake->async_hardware_random_pending = 1; + handshake->async_hardware_random_done = 0; + handshake->async_hardware_random_success = 0; - if (samd_mbedtls_random_start( - buffer, length, samd_mbedtls_ssl_random_callback, + if (mbedtls_async_hardware_random_start( + buffer, length, mbedtls_async_hardware_ssl_random_callback, handshake) == 0) { - handshake->samd_random_pending = 0; + handshake->async_hardware_random_pending = 0; return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED; } return MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS; } -static void samd_mbedtls_ssl_ecdh_public_key_callback(int success, +static void mbedtls_async_hardware_ssl_ecdh_public_key_callback(int success, void *context) { mbedtls_ssl_handshake_params *handshake = @@ -149,11 +149,11 @@ static void samd_mbedtls_ssl_ecdh_public_key_callback(int success, return; } - handshake->samd_ecdh_public_success = success ? 1 : 0; - handshake->samd_ecdh_public_done = 1; + handshake->async_hardware_ecdh_public_success = success ? 1 : 0; + handshake->async_hardware_ecdh_public_done = 1; } -static int samd_mbedtls_ssl_ecdh_public_key_fill(mbedtls_ssl_context *ssl) +static int mbedtls_async_hardware_ssl_ecdh_public_key_fill(mbedtls_ssl_context *ssl) { mbedtls_ssl_handshake_params *handshake; size_t coordinate_len; @@ -164,58 +164,58 @@ static int samd_mbedtls_ssl_ecdh_public_key_fill(mbedtls_ssl_context *ssl) handshake = ssl->handshake; - if (handshake->samd_ecdh_public_ready != 0) { + if (handshake->async_hardware_ecdh_public_ready != 0) { return 0; } - if (handshake->samd_ecdh_public_pending != 0) { - if (handshake->samd_ecdh_public_done == 0) { + if (handshake->async_hardware_ecdh_public_pending != 0) { + if (handshake->async_hardware_ecdh_public_done == 0) { return MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS; } - handshake->samd_ecdh_public_pending = 0; - handshake->samd_ecdh_public_done = 0; - if (handshake->samd_ecdh_public_success == 0) { - handshake->samd_ecdh_public_success = 0; + handshake->async_hardware_ecdh_public_pending = 0; + handshake->async_hardware_ecdh_public_done = 0; + if (handshake->async_hardware_ecdh_public_success == 0) { + handshake->async_hardware_ecdh_public_success = 0; return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED; } - handshake->samd_ecdh_public_success = 0; - handshake->samd_ecdh_public_ready = 1; + handshake->async_hardware_ecdh_public_success = 0; + handshake->async_hardware_ecdh_public_ready = 1; return 0; } - handshake->samd_ecdh_public_pending = 1; - handshake->samd_ecdh_public_done = 0; - handshake->samd_ecdh_public_success = 0; - handshake->samd_ecdh_public_ready = 0; + handshake->async_hardware_ecdh_public_pending = 1; + handshake->async_hardware_ecdh_public_done = 0; + handshake->async_hardware_ecdh_public_success = 0; + handshake->async_hardware_ecdh_public_ready = 0; coordinate_len = (handshake->xxdh_psa_bits + 7u) / 8u; if ((coordinate_len == 32 ? - samd_mbedtls_ecdh_p256_public_key_start( - handshake->samd_ecdh_private_scalar, - handshake->samd_ecdh_public_key, - samd_mbedtls_ssl_ecdh_public_key_callback, + mbedtls_async_hardware_ecdh_p256_public_key_start( + handshake->async_hardware_ecdh_private_scalar, + handshake->async_hardware_ecdh_public_key, + mbedtls_async_hardware_ssl_ecdh_public_key_callback, handshake) : coordinate_len == 48 ? - samd_mbedtls_ecdh_p384_public_key_start( - handshake->samd_ecdh_private_scalar, - handshake->samd_ecdh_public_key, - samd_mbedtls_ssl_ecdh_public_key_callback, + mbedtls_async_hardware_ecdh_p384_public_key_start( + handshake->async_hardware_ecdh_private_scalar, + handshake->async_hardware_ecdh_public_key, + mbedtls_async_hardware_ssl_ecdh_public_key_callback, handshake) : coordinate_len == 66 ? - samd_mbedtls_ecdh_p521_public_key_start( - handshake->samd_ecdh_private_scalar, - handshake->samd_ecdh_public_key, - samd_mbedtls_ssl_ecdh_public_key_callback, + mbedtls_async_hardware_ecdh_p521_public_key_start( + handshake->async_hardware_ecdh_private_scalar, + handshake->async_hardware_ecdh_public_key, + mbedtls_async_hardware_ssl_ecdh_public_key_callback, handshake) : 0) == 0) { - handshake->samd_ecdh_public_pending = 0; + handshake->async_hardware_ecdh_public_pending = 0; return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED; } return MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS; } -static void samd_mbedtls_ssl_ecdh_secret_callback(int success, void *context) +static void mbedtls_async_hardware_ssl_ecdh_secret_callback(int success, void *context) { mbedtls_ssl_handshake_params *handshake = (mbedtls_ssl_handshake_params *) context; @@ -223,11 +223,11 @@ static void samd_mbedtls_ssl_ecdh_secret_callback(int success, void *context) return; } - handshake->samd_ecdh_secret_success = success ? 1 : 0; - handshake->samd_ecdh_secret_done = 1; + handshake->async_hardware_ecdh_secret_success = success ? 1 : 0; + handshake->async_hardware_ecdh_secret_done = 1; } -static int samd_mbedtls_ssl_ecdh_secret_fill(mbedtls_ssl_context *ssl) +static int mbedtls_async_hardware_ssl_ecdh_secret_fill(mbedtls_ssl_context *ssl) { mbedtls_ssl_handshake_params *handshake; size_t coordinate_len; @@ -238,71 +238,71 @@ static int samd_mbedtls_ssl_ecdh_secret_fill(mbedtls_ssl_context *ssl) handshake = ssl->handshake; - if (handshake->samd_ecdh_secret_ready != 0) { + if (handshake->async_hardware_ecdh_secret_ready != 0) { return 0; } - if (handshake->samd_ecdh_secret_pending != 0) { - if (handshake->samd_ecdh_secret_done == 0) { + if (handshake->async_hardware_ecdh_secret_pending != 0) { + if (handshake->async_hardware_ecdh_secret_done == 0) { return MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS; } - handshake->samd_ecdh_secret_pending = 0; - handshake->samd_ecdh_secret_done = 0; - if (handshake->samd_ecdh_secret_success == 0) { - handshake->samd_ecdh_secret_success = 0; + handshake->async_hardware_ecdh_secret_pending = 0; + handshake->async_hardware_ecdh_secret_done = 0; + if (handshake->async_hardware_ecdh_secret_success == 0) { + handshake->async_hardware_ecdh_secret_success = 0; return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED; } - handshake->samd_ecdh_secret_success = 0; - handshake->samd_ecdh_secret_ready = 1; + handshake->async_hardware_ecdh_secret_success = 0; + handshake->async_hardware_ecdh_secret_ready = 1; ssl->handshake->pmslen = (handshake->xxdh_psa_bits + 7u) / 8u; return 0; } - handshake->samd_ecdh_secret_pending = 1; - handshake->samd_ecdh_secret_done = 0; - handshake->samd_ecdh_secret_success = 0; - handshake->samd_ecdh_secret_ready = 0; + handshake->async_hardware_ecdh_secret_pending = 1; + handshake->async_hardware_ecdh_secret_done = 0; + handshake->async_hardware_ecdh_secret_success = 0; + handshake->async_hardware_ecdh_secret_ready = 0; coordinate_len = (handshake->xxdh_psa_bits + 7u) / 8u; if ((coordinate_len == 32 ? - samd_mbedtls_ecdh_p256_start( - handshake->samd_ecdh_private_scalar, + mbedtls_async_hardware_ecdh_p256_start( + handshake->async_hardware_ecdh_private_scalar, handshake->xxdh_psa_peerkey, ssl->handshake->premaster, - samd_mbedtls_ssl_ecdh_secret_callback, + mbedtls_async_hardware_ssl_ecdh_secret_callback, handshake) : coordinate_len == 48 ? - samd_mbedtls_ecdh_p384_start( - handshake->samd_ecdh_private_scalar, + mbedtls_async_hardware_ecdh_p384_start( + handshake->async_hardware_ecdh_private_scalar, handshake->xxdh_psa_peerkey, ssl->handshake->premaster, - samd_mbedtls_ssl_ecdh_secret_callback, + mbedtls_async_hardware_ssl_ecdh_secret_callback, handshake) : coordinate_len == 66 ? - samd_mbedtls_ecdh_p521_start( - handshake->samd_ecdh_private_scalar, + mbedtls_async_hardware_ecdh_p521_start( + handshake->async_hardware_ecdh_private_scalar, handshake->xxdh_psa_peerkey, ssl->handshake->premaster, - samd_mbedtls_ssl_ecdh_secret_callback, + mbedtls_async_hardware_ssl_ecdh_secret_callback, handshake) : 0) == 0) { - handshake->samd_ecdh_secret_pending = 0; + handshake->async_hardware_ecdh_secret_pending = 0; return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED; } return MBEDTLS_ERR_SSL_CRYPTO_IN_PROGRESS; } -static void samd_mbedtls_clear_ecdh_scalar( +static void mbedtls_async_hardware_clear_ecdh_scalar( mbedtls_ssl_handshake_params *handshake) { if (handshake == NULL) { return; } - mbedtls_platform_zeroize(handshake->samd_ecdh_private_scalar, - sizeof(handshake->samd_ecdh_private_scalar)); + mbedtls_platform_zeroize(handshake->async_hardware_ecdh_private_scalar, + sizeof(handshake->async_hardware_ecdh_private_scalar)); } #endif @@ -2693,60 +2693,60 @@ static int ssl_write_client_key_exchange(mbedtls_ssl_context *ssl) psa_set_key_bits(&key_attributes, handshake->xxdh_psa_bits); #if defined(MBEDTLS_ASYNC_HARDWARE_RANDOM) - size_t samd_coordinate_len; - size_t samd_public_key_len; + size_t async_hardware_coordinate_len; + size_t async_hardware_public_key_len; if (handshake->xxdh_psa_bits != 256u && handshake->xxdh_psa_bits != 384u && handshake->xxdh_psa_bits != 521u) { return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED; } - samd_coordinate_len = (handshake->xxdh_psa_bits + 7u) / 8u; - samd_public_key_len = samd_coordinate_len * 2u + 1u; + async_hardware_coordinate_len = (handshake->xxdh_psa_bits + 7u) / 8u; + async_hardware_public_key_len = async_hardware_coordinate_len * 2u + 1u; - if (handshake->samd_ecdh_private_ready == 0) { - ret = samd_mbedtls_ssl_random_fill( - ssl, handshake->samd_ecdh_private_scalar, - samd_coordinate_len); + if (handshake->async_hardware_ecdh_private_ready == 0) { + ret = mbedtls_async_hardware_ssl_random_fill( + ssl, handshake->async_hardware_ecdh_private_scalar, + async_hardware_coordinate_len); if (ret != 0) { return ret; } - handshake->samd_ecdh_private_ready = 1; + handshake->async_hardware_ecdh_private_ready = 1; } - ret = samd_mbedtls_ssl_ecdh_public_key_fill(ssl); + ret = mbedtls_async_hardware_ssl_ecdh_public_key_fill(ssl); if (ret != 0) { return ret; } - unsigned char *samd_own_pubkey = ssl->out_msg + header_len + 1; - unsigned char *samd_end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN; - size_t samd_own_pubkey_max_len = - (size_t) (samd_end - samd_own_pubkey); + unsigned char *async_hardware_own_pubkey = ssl->out_msg + header_len + 1; + unsigned char *async_hardware_end = ssl->out_msg + MBEDTLS_SSL_OUT_CONTENT_LEN; + size_t async_hardware_own_pubkey_max_len = + (size_t) (async_hardware_end - async_hardware_own_pubkey); - if (samd_own_pubkey_max_len < - samd_public_key_len) { + if (async_hardware_own_pubkey_max_len < + async_hardware_public_key_len) { return MBEDTLS_ERR_SSL_BUFFER_TOO_SMALL; } - memcpy(samd_own_pubkey, handshake->samd_ecdh_public_key, - samd_public_key_len); + memcpy(async_hardware_own_pubkey, handshake->async_hardware_ecdh_public_key, + async_hardware_public_key_len); ssl->out_msg[header_len] = - (unsigned char) samd_public_key_len; - content_len = samd_public_key_len + 1; + (unsigned char) async_hardware_public_key_len; + content_len = async_hardware_public_key_len + 1; - ret = samd_mbedtls_ssl_ecdh_secret_fill(ssl); + ret = mbedtls_async_hardware_ssl_ecdh_secret_fill(ssl); if (ret != 0) { return ret; } - samd_mbedtls_clear_ecdh_scalar(handshake); - handshake->samd_ecdh_private_ready = 0; - handshake->samd_ecdh_public_ready = 0; - handshake->samd_ecdh_secret_ready = 0; - mbedtls_platform_zeroize(handshake->samd_ecdh_public_key, - sizeof(handshake->samd_ecdh_public_key)); - goto samd_ecdh_done; + mbedtls_async_hardware_clear_ecdh_scalar(handshake); + handshake->async_hardware_ecdh_private_ready = 0; + handshake->async_hardware_ecdh_public_ready = 0; + handshake->async_hardware_ecdh_secret_ready = 0; + mbedtls_platform_zeroize(handshake->async_hardware_ecdh_public_key, + sizeof(handshake->async_hardware_ecdh_public_key)); + goto async_hardware_ecdh_done; #else /* Generate ECDH private key. */ status = psa_generate_key(&key_attributes, @@ -2854,7 +2854,7 @@ complete_interruptible_ecdh: } #endif #if defined(MBEDTLS_ASYNC_HARDWARE_RANDOM) -samd_ecdh_done: +async_hardware_ecdh_done: (void) 0; #endif } else diff --git a/tf-psa-crypto b/tf-psa-crypto index 367fbeffb1..3e1a1b9b30 160000 --- a/tf-psa-crypto +++ b/tf-psa-crypto @@ -1 +1 @@ -Subproject commit 367fbeffb13aaf9203d06a0a663f94d13716b8c9 +Subproject commit 3e1a1b9b30c49fdae5a77ba4dbbf7ce543d159e0