From 77d2a9e627cba69db67ec6405fa7f466d49bf80a Mon Sep 17 00:00:00 2001 From: Aditya Patwardhan Date: Fri, 7 Mar 2025 10:50:08 +0530 Subject: [PATCH] feat(protocomm): Migrate to PSA api interface --- .../src/crypto/crypto_mbedtls-ec.c | 82 +++++---- .../src/crypto/crypto_mbedtls-rsa.c | 95 ++++------ .../src/crypto/crypto_mbedtls.c | 82 ++++----- .../wpa_supplicant/src/crypto/des-internal.c | 2 +- .../test_apps/main/test_crypto.c | 171 ++++++++++++------ 5 files changed, 248 insertions(+), 184 deletions(-) diff --git a/components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-ec.c b/components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-ec.c index 9e9d7a6b192..c731257ca25 100644 --- a/components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-ec.c +++ b/components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-ec.c @@ -1054,53 +1054,64 @@ int crypto_ecdsa_get_sign(unsigned char *hash, return 0; } -// TODO: Add a test case for this function and then migrate to PSA int crypto_ec_key_verify_signature_r_s(struct crypto_ec_key *csign, const unsigned char *hash, int hlen, const u8 *r, size_t r_len, const u8 *s, size_t s_len) { - printf("crypto_ec_key_verify_signature_r_s\n"); - mbedtls_ecp_keypair *ecp_kp = mbedtls_pk_ec(*(mbedtls_pk_context *)csign); - if (!ecp_kp) { + psa_status_t status = psa_crypto_init(); + if (status != PSA_SUCCESS) { return -1; } - struct crypto_bignum *rb = NULL, *sb = NULL; - rb = crypto_bignum_init_set(r, r_len); - sb = crypto_bignum_init_set(s, s_len); + psa_key_id_t *key_id = (psa_key_id_t *)csign; - mbedtls_ecp_group *ecp_kp_grp = &ecp_kp->MBEDTLS_PRIVATE(grp); - mbedtls_ecp_point *ecp_kp_q = &ecp_kp->MBEDTLS_PRIVATE(Q); - int ret = mbedtls_ecdsa_verify(ecp_kp_grp, hash, hlen, - ecp_kp_q, (mbedtls_mpi *)rb, (mbedtls_mpi *)sb); - if (ret != 0) { - wpa_printf(MSG_ERROR, "ecdsa verification failed"); - crypto_bignum_deinit(rb, 0); - crypto_bignum_deinit(sb, 0); - return ret; + u8 *sig = os_zalloc(r_len + s_len); + if (!sig) { + return -1; } - return ret; + os_memcpy(sig, r, r_len); + os_memcpy(sig + r_len, s, s_len); + + status = psa_verify_hash(*key_id, PSA_ALG_DETERMINISTIC_ECDSA(PSA_ALG_SHA_256), hash, hlen, sig, r_len + s_len); + if (status != PSA_SUCCESS) { + printf("psa_verify_hash failed with %d\n", status); + os_free(sig); + return -1; + } + + os_free(sig); + + return 0; } void crypto_ec_key_debug_print(struct crypto_ec_key *key, const char *title) { #ifdef DEBUG_PRINT - // mbedtls_pk_context *pkey = (mbedtls_pk_context *)key; - // mbedtls_ecp_keypair *ecp = mbedtls_pk_ec(*pkey); - // u8 x[32], y[32], d[32]; - // wpa_printf(MSG_INFO, "curve: %s", - // mbedtls_ecp_curve_info_from_grp_id(ecp->MBEDTLS_PRIVATE(grp).id)->name); - // int len = mbedtls_mpi_size((mbedtls_mpi *)crypto_ec_get_prime((struct crypto_ec *)crypto_ec_get_group_from_key(key))); + psa_key_id_t *pkey = (psa_key_id_t *)key; + + unsigned char pub[PSA_EXPORT_PUBLIC_KEY_MAX_SIZE]; + size_t pub_len = 0; + psa_export_public_key(*pkey, pub, sizeof(pub), &pub_len); + + wpa_hexdump(MSG_INFO, "public key:", pub, pub_len); + wpa_printf(MSG_INFO, "public key len: %d", pub_len); + + psa_key_attributes_t key_attributes = PSA_KEY_ATTRIBUTES_INIT; + psa_get_key_attributes(*pkey, &key_attributes); + + psa_ecc_family_t ecc_family = psa_get_key_type(&key_attributes); + size_t bits = psa_get_key_bits(&key_attributes); + int ret = mbedtls_ecc_group_from_psa(ecc_family, bits); + if (ret == 0) { + wpa_printf(MSG_ERROR, "Unsupported ECC group"); + } + + wpa_printf(MSG_INFO, "curve: %s", mbedtls_ecp_curve_info_from_grp_id(ret)->name); + wpa_printf(MSG_INFO, "bits: %d", bits); + wpa_printf(MSG_INFO, "psa_ecc_family: %d", ecc_family); - // wpa_printf(MSG_INFO, "prime len is %d", len); - // crypto_ec_point_to_bin((struct crypto_ec *)crypto_ec_get_group_from_key(key), crypto_ec_key_get_public_key(key), x, y); - // crypto_bignum_to_bin(crypto_ec_key_get_private_key(key), - // d, len, len); - // wpa_hexdump(MSG_INFO, "Q_x:", x, 32); - // wpa_hexdump(MSG_INFO, "Q_y:", y, 32); - // wpa_hexdump(MSG_INFO, "d: ", d, 32); #endif } @@ -1282,7 +1293,7 @@ int crypto_ec_write_pub_key(struct crypto_ec_key *key, unsigned char **key_buf) psa_key_id_t *pkey = (psa_key_id_t *)key; - mbedtls_pk_context *pk = os_malloc(sizeof(mbedtls_pk_context)); + mbedtls_pk_context *pk = os_zalloc(sizeof(mbedtls_pk_context)); mbedtls_pk_init(pk); int ret = mbedtls_pk_copy_public_from_psa(*pkey, pk); @@ -1290,9 +1301,14 @@ int crypto_ec_write_pub_key(struct crypto_ec_key *key, unsigned char **key_buf) wpa_printf(MSG_ERROR, "Failed to copy public key from psa key"); return 0; } - unsigned char output_buf[1600] = {0}; + unsigned char *output_buf = os_zalloc(1600); + if (!output_buf) { + wpa_printf(MSG_ERROR, "%s: memory allocation failed", __func__); + return 0; + } int len = crypto_pk_write_formatted_pubkey_der(pk, output_buf, 1600, 1); if (len <= 0) { + os_free(output_buf); return 0; } @@ -1302,9 +1318,11 @@ int crypto_ec_write_pub_key(struct crypto_ec_key *key, unsigned char **key_buf) *key_buf = os_malloc(len); if (!*key_buf) { wpa_printf(MSG_ERROR, "%s: memory allocation failed", __func__); + os_free(output_buf); return 0; } os_memcpy(*key_buf, output_buf + 1600 - len, len); + os_free(output_buf); return len; } diff --git a/components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-rsa.c b/components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-rsa.c index ceecb76422b..f82ca0bc338 100644 --- a/components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-rsa.c +++ b/components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls-rsa.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2015-2024 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2015-2025 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -185,15 +185,6 @@ int crypto_public_key_encrypt_pkcs1_v15(struct crypto_public_key *key, u8 *out, size_t *outlen) { int ret = 0; - mbedtls_pk_context *pkey = (mbedtls_pk_context *)key; - psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; - psa_key_id_t key_id = 0; - - if (!pkey) { - wpa_printf(MSG_ERROR, "failed to allocate memory"); - ret = -1; - goto cleanup; - } psa_status_t status = psa_crypto_init(); if (status != PSA_SUCCESS) { @@ -202,16 +193,22 @@ int crypto_public_key_encrypt_pkcs1_v15(struct crypto_public_key *key, goto cleanup; } - ret = mbedtls_pk_get_psa_attributes(pkey, PSA_KEY_USAGE_ENCRYPT, &attributes); - if (ret != 0) { - wpa_printf(MSG_ERROR, "failed to get key attributes"); + mbedtls_pk_context *pkey = (mbedtls_pk_context *)key; + + // Load the key into PSA + psa_key_id_t key_id = 0; + psa_key_attributes_t key_attributes = PSA_KEY_ATTRIBUTES_INIT; + + status = mbedtls_pk_get_psa_attributes(pkey, PSA_KEY_USAGE_ENCRYPT, &key_attributes); + if (status != PSA_SUCCESS) { + wpa_printf(MSG_ERROR, "Failed to get key attributes, returned %d", (int) status); ret = -1; goto cleanup; } - ret = mbedtls_pk_import_into_psa(pkey, &attributes, &key_id); + ret = mbedtls_pk_import_into_psa(pkey, &key_attributes, &key_id); if (ret != 0) { - wpa_printf(MSG_ERROR, "failed to import key into PSA"); + wpa_printf(MSG_ERROR, "Failed to import key, returned %d", ret); ret = -1; goto cleanup; } @@ -220,6 +217,7 @@ int crypto_public_key_encrypt_pkcs1_v15(struct crypto_public_key *key, status = psa_asymmetric_encrypt(key_id, PSA_ALG_RSA_PKCS1V15_CRYPT, in, inlen, NULL, 0, out, *outlen, &output_len); if (status != PSA_SUCCESS) { wpa_printf(MSG_ERROR, "Failed to encrypt data, returned %d", (int) status); + printf("Failed to encrypt data, returned %d\n", (int) status); ret = -1; goto cleanup; } @@ -227,10 +225,8 @@ int crypto_public_key_encrypt_pkcs1_v15(struct crypto_public_key *key, *outlen = output_len; cleanup: - + psa_reset_key_attributes(&key_attributes); if (key_id) { - printf("Destroying key\n"); - psa_reset_key_attributes(&attributes); psa_destroy_key(key_id); } return ret; @@ -241,51 +237,44 @@ int crypto_private_key_decrypt_pkcs1_v15(struct crypto_private_key *key, u8 *out, size_t *outlen) { int ret = 0; - mbedtls_pk_context *pkey = (mbedtls_pk_context *)key; - psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; - psa_key_id_t key_id = 0; - - if (!pkey) { - wpa_printf(MSG_ERROR, "failed to allocate memory"); - ret = -1; - goto cleanup; - } - psa_status_t status = psa_crypto_init(); if (status != PSA_SUCCESS) { wpa_printf(MSG_ERROR, "Failed to initialize PSA crypto, returned %d", (int) status); return -1; } - ret = mbedtls_pk_get_psa_attributes(pkey, PSA_KEY_USAGE_DECRYPT, &attributes); - if (ret != 0) { - wpa_printf(MSG_ERROR, "failed to get key attributes"); + mbedtls_pk_context *pkey = (mbedtls_pk_context *)key; + + // Load the key into PSA + psa_key_id_t key_id = 0; + psa_key_attributes_t key_attributes = PSA_KEY_ATTRIBUTES_INIT; + + status = mbedtls_pk_get_psa_attributes(pkey, PSA_KEY_USAGE_DECRYPT, &key_attributes); + if (status != PSA_SUCCESS) { + wpa_printf(MSG_ERROR, "Failed to get key attributes, returned %d", (int) status); ret = -1; goto cleanup; } - ret = mbedtls_pk_import_into_psa(pkey, &attributes, &key_id); + ret = mbedtls_pk_import_into_psa(pkey, &key_attributes, &key_id); if (ret != 0) { - wpa_printf(MSG_ERROR, "failed to import key into PSA"); + wpa_printf(MSG_ERROR, "Failed to import key, returned %d", ret); ret = -1; goto cleanup; } size_t output_len = 0; - size_t heap_free_before = esp_get_free_heap_size(); status = psa_asymmetric_decrypt(key_id, PSA_ALG_RSA_PKCS1V15_CRYPT, in, inlen, NULL, 0, out, *outlen, &output_len); if (status != PSA_SUCCESS) { printf("Failed to decrypt data, returned %d", (int) status); ret = -1; goto cleanup; } - size_t heap_free_after = esp_get_free_heap_size(); - printf("Heap free before: %d, Heap free after: %d, used: %d\n", heap_free_before, heap_free_after, heap_free_before - heap_free_after); *outlen = output_len; - + cleanup: + psa_reset_key_attributes(&key_attributes); if (key_id) { - psa_reset_key_attributes(&attributes); psa_destroy_key(key_id); } return ret; @@ -296,15 +285,6 @@ int crypto_private_key_sign_pkcs1(struct crypto_private_key *key, u8 *out, size_t *outlen) { int ret = 0; - mbedtls_pk_context *pkey = (mbedtls_pk_context *)key; - psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; - psa_key_id_t key_id = 0; - - if (!pkey) { - wpa_printf(MSG_ERROR, "failed to allocate memory"); - ret = -1; - goto cleanup; - } psa_status_t status = psa_crypto_init(); if (status != PSA_SUCCESS) { @@ -312,26 +292,31 @@ int crypto_private_key_sign_pkcs1(struct crypto_private_key *key, return -1; } - ret = mbedtls_pk_get_psa_attributes(pkey, PSA_KEY_USAGE_SIGN_HASH , &attributes); - if (ret != 0) { - wpa_printf(MSG_ERROR, "failed to get key attributes"); + mbedtls_pk_context *pkey = (mbedtls_pk_context *)key; + + // Load the key into PSA + psa_key_id_t key_id = 0; + psa_key_attributes_t key_attributes = PSA_KEY_ATTRIBUTES_INIT; + + status = mbedtls_pk_get_psa_attributes(pkey, PSA_KEY_USAGE_SIGN_HASH, &key_attributes); + if (status != PSA_SUCCESS) { + wpa_printf(MSG_ERROR, "Failed to get key attributes, returned %d", (int) status); ret = -1; goto cleanup; } - ret = mbedtls_pk_import_into_psa(pkey, &attributes, &key_id); + ret = mbedtls_pk_import_into_psa(pkey, &key_attributes, &key_id); if (ret != 0) { - wpa_printf(MSG_ERROR, "failed to import key into PSA"); + wpa_printf(MSG_ERROR, "Failed to import key, returned %d", ret); ret = -1; goto cleanup; } - printf("Hash ID: %d\n", (mbedtls_pk_rsa(*pkey))->MBEDTLS_PRIVATE(hash_id)); - size_t output_len = 0; status = psa_sign_hash(key_id, PSA_ALG_RSA_PKCS1V15_SIGN_RAW, in, inlen, out, *outlen, &output_len); if (status != PSA_SUCCESS) { wpa_printf(MSG_ERROR, "Failed to sign data, returned %d", (int) status); + printf("Failed to sign data, returned %d\n", (int) status); ret = -1; goto cleanup; } @@ -339,8 +324,8 @@ int crypto_private_key_sign_pkcs1(struct crypto_private_key *key, *outlen = output_len; cleanup: + psa_reset_key_attributes(&key_attributes); if (key_id) { - psa_reset_key_attributes(&attributes); psa_destroy_key(key_id); } return ret; diff --git a/components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls.c b/components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls.c index 4936fb44dbf..702b12ee3b4 100644 --- a/components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls.c +++ b/components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls.c @@ -46,14 +46,13 @@ struct crypto_hash { union { - psa_hash_operation_t *hash_operation; - psa_mac_operation_t *mac_operation; - } u; - int is_mac; - psa_key_id_t key_id; + psa_hash_operation_t *hash_operation; + psa_mac_operation_t *mac_operation; + } u; + int is_mac; + psa_key_id_t key_id; }; - static int digest_vector(psa_algorithm_t alg, size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac) { @@ -144,38 +143,38 @@ struct crypto_hash * crypto_hash_init(enum crypto_hash_alg alg, const u8 *key, psa_algorithm_t psa_alg; int is_hmac = 0; - switch(alg) { - case CRYPTO_HASH_ALG_MD5: - case CRYPTO_HASH_ALG_HMAC_MD5: - psa_alg = PSA_ALG_MD5; - break; - case CRYPTO_HASH_ALG_SHA1: - case CRYPTO_HASH_ALG_HMAC_SHA1: - psa_alg = PSA_ALG_SHA_1; - break; - case CRYPTO_HASH_ALG_SHA256: - case CRYPTO_HASH_ALG_HMAC_SHA256: - psa_alg = PSA_ALG_SHA_256; - break; - case CRYPTO_HASH_ALG_SHA384: - psa_alg = PSA_ALG_SHA_384; - break; - case CRYPTO_HASH_ALG_SHA512: - psa_alg = PSA_ALG_SHA_512; - break; - default: - os_free(ctx); - return NULL; + switch (alg) { + case CRYPTO_HASH_ALG_MD5: + case CRYPTO_HASH_ALG_HMAC_MD5: + psa_alg = PSA_ALG_MD5; + break; + case CRYPTO_HASH_ALG_SHA1: + case CRYPTO_HASH_ALG_HMAC_SHA1: + psa_alg = PSA_ALG_SHA_1; + break; + case CRYPTO_HASH_ALG_SHA256: + case CRYPTO_HASH_ALG_HMAC_SHA256: + psa_alg = PSA_ALG_SHA_256; + break; + case CRYPTO_HASH_ALG_SHA384: + psa_alg = PSA_ALG_SHA_384; + break; + case CRYPTO_HASH_ALG_SHA512: + psa_alg = PSA_ALG_SHA_512; + break; + default: + os_free(ctx); + return NULL; } - switch(alg) { - case CRYPTO_HASH_ALG_HMAC_MD5: - case CRYPTO_HASH_ALG_HMAC_SHA1: - case CRYPTO_HASH_ALG_HMAC_SHA256: - is_hmac = 1; - break; - default: - break; + switch (alg) { + case CRYPTO_HASH_ALG_HMAC_MD5: + case CRYPTO_HASH_ALG_HMAC_SHA1: + case CRYPTO_HASH_ALG_HMAC_SHA256: + is_hmac = 1; + break; + default: + break; } // If is_hmac is set, then it is HMAC mode @@ -251,7 +250,7 @@ void crypto_hash_update(struct crypto_hash *crypto_ctx, const u8 *data, size_t l } else { status = psa_hash_update(crypto_ctx->u.hash_operation, data, len); } - + if (status != PSA_SUCCESS) { wpa_printf(MSG_ERROR, "%s: psa_hash_update failed", __func__); } @@ -573,7 +572,7 @@ int aes_128_cbc_encrypt(const u8 *key, const u8 *iv, u8 *data, size_t data_len) psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; psa_key_id_t key_id; - status = psa_crypto_init(); + status = psa_crypto_init(); if (status != PSA_SUCCESS) { wpa_printf(MSG_ERROR, "%s: psa_crypto_init failed", __func__); return -1; @@ -797,7 +796,6 @@ struct crypto_cipher *crypto_cipher_init(enum crypto_cipher_alg alg, #endif /* CONFIG_MBEDTLS_CIPHER_MODE_WITH_PADDING */ return ctx; - cleanup: os_free(ctx); return NULL; @@ -1047,7 +1045,7 @@ int des_encrypt(const u8 *clear, const u8 *key, u8 *cypher) psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_ENCRYPT); psa_set_key_algorithm(&attributes, PSA_ALG_ECB_NO_PADDING); psa_set_key_type(&attributes, PSA_KEY_TYPE_DES); - psa_set_key_bits(&attributes, 64); + psa_set_key_bits(&attributes, 128); status = psa_import_key(&attributes, key, 8, &key_id); if (status != PSA_SUCCESS) { @@ -1135,7 +1133,7 @@ int aes_ccm_ae(const u8 *key, size_t key_len, const u8 *nonce, } size_t output_length = 0; - size_t tag_len = 0; + size_t tag_len = 0; status = psa_aead_update_ad(&operation, aad, aad_len); if (status != PSA_SUCCESS) { @@ -1159,7 +1157,7 @@ int aes_ccm_ae(const u8 *key, size_t key_len, const u8 *nonce, psa_destroy_key(key_id); - return 0; + return 0; } int aes_ccm_ad(const u8 *key, size_t key_len, const u8 *nonce, diff --git a/components/wpa_supplicant/src/crypto/des-internal.c b/components/wpa_supplicant/src/crypto/des-internal.c index beca000e504..8af1e8f1e63 100644 --- a/components/wpa_supplicant/src/crypto/des-internal.c +++ b/components/wpa_supplicant/src/crypto/des-internal.c @@ -412,7 +412,7 @@ int des_encrypt(const u8 *clear, const u8 *key, u8 *cypher) psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_ENCRYPT); psa_set_key_algorithm(&attributes, PSA_ALG_ECB_NO_PADDING); psa_set_key_type(&attributes, PSA_KEY_TYPE_DES); - psa_set_key_bits(&attributes, 64); + psa_set_key_bits(&attributes, 128); status = psa_import_key(&attributes, key, 8, &key_id); if (status != PSA_SUCCESS) { diff --git a/components/wpa_supplicant/test_apps/main/test_crypto.c b/components/wpa_supplicant/test_apps/main/test_crypto.c index 86b4b36642f..0f931307872 100644 --- a/components/wpa_supplicant/test_apps/main/test_crypto.c +++ b/components/wpa_supplicant/test_apps/main/test_crypto.c @@ -745,6 +745,9 @@ TEST_CASE("Test crypto lib ecdsa apis", "[wpa_crypto]") ret = crypto_ec_key_verify_signature(eckey, expected_data, 64, data, 64); TEST_ASSERT(ret == 0); + ret = crypto_ec_key_verify_signature_r_s(eckey, expected_data, 64, data, 32, data + 32, 32); + TEST_ASSERT(ret == 0); + // Negative test case expected_data[0] = 0x5A; ret = crypto_ec_key_verify_signature(eckey, expected_data, 64, data, 64); @@ -934,48 +937,119 @@ TEST_CASE("Test crypto lib rsa apis", "[wpa_crypto]") { set_leak_threshold(1); { - const char *rsa_key = - "-----BEGIN RSA PRIVATE KEY-----\n" - "MIIEowIBAAKCAQEAojDGyuzNRtqWDS3no8PPA0LFCme4V8qnpKaJnHjp/YxMEcny\n" - "W3eWPBTtL0WUvSRHBY7PgiVTKWKN/4zuRq77XnLxZQuRGYQeLcpLmsyZPArnlfym\n" - "jZRsXPsnPscmbKt5SAxCrFKXKIwZ76rR7he/2OsxQ7O6yfIm3JQQRt1h+PjCvPoq\n" - "JmvqhbMDH/0bTeNEdGPQPEx8+Xohhkb6bYivH8Jcm1FkZTVDfMtZsmismghr7ufB\n" - "gOLrc9NnFO7r9G8MtV+mtqWV8Urm7KkN4fs/e9i8XlHcd7qalSlEtDl0+md6xwV0\n" - "ZFvJQ2jlQEnZ94CEgAwYlpbsGlis+cfjdIf+wQIDAQABAoIBAFRnwey1E5c+BjzR\n" - "mOz25/Kwes6Rb7PweRIMwSy3GD6lFqljSUckkwCte0nQkjlkebmAuqjmN8Mf0Pof\n" - "I5mRUquyccG+JUL8KKB32KS0uUIwAplhpGOlzEcPRTs8dNi03CcMil4XlSa60nyR\n" - "jzKzFVoT+81Z6WlTJbpBK79VUrk4GCNPrvwU3r+H68zOQG0CSia5eoWSOEVuFlSw\n" - "01ixNbQRgCKZQQB72FQAtxBNIiPuWNg1nc+a7GMMKMmzzHr2xNUyv6byiQ0ADW6v\n" - "uOZbuNJ6gy6xltswGjR3mUcmGA9JoLwKTHLKD9qDzAE40RYU/G3I3o1PsbzdYnIr\n" - "hPnoLwkCgYEA0b3vBcpyIld1+BYPB1Q0b5uFbTXbegGvR8jU82ZGWs/uKUpO/wmq\n" - "A3P2Q7Bm+91Zsz0hiQ56k2N2tsb5H/tOcOwBSkzbViJ4w9IroFZydQpv5mZXSELh\n" - "b0wSnet4L99TxsJiA55S6JmawrgRCBGhOsTQA0bKNGFioN1CkcVrjhsCgYEAxfYV\n" - "KvdhmU9hRauYFHYVCiHYTC8ae8W1p8YwUc6N9PnUvUazYCpX257HlQgs0QzIcj0k\n" - "dz9/DqfE6xuPdVzyrFwwdn3MthN6QOWUNEnh0XeVnoUtFS8Tld3YFVO9sCGQg1JV\n" - "OWasqz8G/xxxycjiKp7ls5jcgJ/K5JaNwyJZhFMCgYBacgIxyBQhtP99JN4ENg6K\n" - "llEaQCBN444XcYZLE66BGKtGCPI5zowPAyGOHPK75773qQPeG21GQ5z8wp7JaNBx\n" - "p4QC61OmOCVFpEsF0GF5ETAh9b3rvlOCcBaTHOhuFGsHCenET7DG9v4iu8c0aI3T\n" - "Tu24i/1ESz6Byggb3js8QwKBgBfTlpilTcn2E+8eyB8uVznw+Oeyg62CDmszH325\n" - "LrzdlQ1zBQP+FLUKV1tIsJw4vaeCVHFF4zUQXFMv7gRiO5MjRXH9kjYYAg7tkvj4\n" - "K4Xartd1kAeMsv7GxMtMWPhqEcq8jiVqhj3WSDFMayWuWAppNZx4OZIBqZn5xPZH\n" - "nB6hAoGBAK70lFDgWH7tm6kmmSSSDk9jk4CHiXgWogVGog0+RAtKf4JaFU6Tz5UY\n" - "ejqo/sXVm7GCAKtpQ6iK79ZMmFOVG4fGx3WdrjAmCLspiO3FeJ2dR0hoc/OkbDv/\n" - "QOtjDKCvW8b3bLUD369Yh9GVCur5eJ6sjZga4D7jaSEgON3ENIkE\n" - "-----END RSA PRIVATE KEY-----\n"; + unsigned char rsa_der[] = { + 0x30, 0x82, 0x04, 0xbd, 0x02, 0x01, 0x00, 0x30, 0x0d, 0x06, 0x09, 0x2a, + 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x04, 0x82, + 0x04, 0xa7, 0x30, 0x82, 0x04, 0xa3, 0x02, 0x01, 0x00, 0x02, 0x82, 0x01, + 0x01, 0x00, 0xa2, 0x30, 0xc6, 0xca, 0xec, 0xcd, 0x46, 0xda, 0x96, 0x0d, + 0x2d, 0xe7, 0xa3, 0xc3, 0xcf, 0x03, 0x42, 0xc5, 0x0a, 0x67, 0xb8, 0x57, + 0xca, 0xa7, 0xa4, 0xa6, 0x89, 0x9c, 0x78, 0xe9, 0xfd, 0x8c, 0x4c, 0x11, + 0xc9, 0xf2, 0x5b, 0x77, 0x96, 0x3c, 0x14, 0xed, 0x2f, 0x45, 0x94, 0xbd, + 0x24, 0x47, 0x05, 0x8e, 0xcf, 0x82, 0x25, 0x53, 0x29, 0x62, 0x8d, 0xff, + 0x8c, 0xee, 0x46, 0xae, 0xfb, 0x5e, 0x72, 0xf1, 0x65, 0x0b, 0x91, 0x19, + 0x84, 0x1e, 0x2d, 0xca, 0x4b, 0x9a, 0xcc, 0x99, 0x3c, 0x0a, 0xe7, 0x95, + 0xfc, 0xa6, 0x8d, 0x94, 0x6c, 0x5c, 0xfb, 0x27, 0x3e, 0xc7, 0x26, 0x6c, + 0xab, 0x79, 0x48, 0x0c, 0x42, 0xac, 0x52, 0x97, 0x28, 0x8c, 0x19, 0xef, + 0xaa, 0xd1, 0xee, 0x17, 0xbf, 0xd8, 0xeb, 0x31, 0x43, 0xb3, 0xba, 0xc9, + 0xf2, 0x26, 0xdc, 0x94, 0x10, 0x46, 0xdd, 0x61, 0xf8, 0xf8, 0xc2, 0xbc, + 0xfa, 0x2a, 0x26, 0x6b, 0xea, 0x85, 0xb3, 0x03, 0x1f, 0xfd, 0x1b, 0x4d, + 0xe3, 0x44, 0x74, 0x63, 0xd0, 0x3c, 0x4c, 0x7c, 0xf9, 0x7a, 0x21, 0x86, + 0x46, 0xfa, 0x6d, 0x88, 0xaf, 0x1f, 0xc2, 0x5c, 0x9b, 0x51, 0x64, 0x65, + 0x35, 0x43, 0x7c, 0xcb, 0x59, 0xb2, 0x68, 0xac, 0x9a, 0x08, 0x6b, 0xee, + 0xe7, 0xc1, 0x80, 0xe2, 0xeb, 0x73, 0xd3, 0x67, 0x14, 0xee, 0xeb, 0xf4, + 0x6f, 0x0c, 0xb5, 0x5f, 0xa6, 0xb6, 0xa5, 0x95, 0xf1, 0x4a, 0xe6, 0xec, + 0xa9, 0x0d, 0xe1, 0xfb, 0x3f, 0x7b, 0xd8, 0xbc, 0x5e, 0x51, 0xdc, 0x77, + 0xba, 0x9a, 0x95, 0x29, 0x44, 0xb4, 0x39, 0x74, 0xfa, 0x67, 0x7a, 0xc7, + 0x05, 0x74, 0x64, 0x5b, 0xc9, 0x43, 0x68, 0xe5, 0x40, 0x49, 0xd9, 0xf7, + 0x80, 0x84, 0x80, 0x0c, 0x18, 0x96, 0x96, 0xec, 0x1a, 0x58, 0xac, 0xf9, + 0xc7, 0xe3, 0x74, 0x87, 0xfe, 0xc1, 0x02, 0x03, 0x01, 0x00, 0x01, 0x02, + 0x82, 0x01, 0x00, 0x54, 0x67, 0xc1, 0xec, 0xb5, 0x13, 0x97, 0x3e, 0x06, + 0x3c, 0xd1, 0x98, 0xec, 0xf6, 0xe7, 0xf2, 0xb0, 0x7a, 0xce, 0x91, 0x6f, + 0xb3, 0xf0, 0x79, 0x12, 0x0c, 0xc1, 0x2c, 0xb7, 0x18, 0x3e, 0xa5, 0x16, + 0xa9, 0x63, 0x49, 0x47, 0x24, 0x93, 0x00, 0xad, 0x7b, 0x49, 0xd0, 0x92, + 0x39, 0x64, 0x79, 0xb9, 0x80, 0xba, 0xa8, 0xe6, 0x37, 0xc3, 0x1f, 0xd0, + 0xfa, 0x1f, 0x23, 0x99, 0x91, 0x52, 0xab, 0xb2, 0x71, 0xc1, 0xbe, 0x25, + 0x42, 0xfc, 0x28, 0xa0, 0x77, 0xd8, 0xa4, 0xb4, 0xb9, 0x42, 0x30, 0x02, + 0x99, 0x61, 0xa4, 0x63, 0xa5, 0xcc, 0x47, 0x0f, 0x45, 0x3b, 0x3c, 0x74, + 0xd8, 0xb4, 0xdc, 0x27, 0x0c, 0x8a, 0x5e, 0x17, 0x95, 0x26, 0xba, 0xd2, + 0x7c, 0x91, 0x8f, 0x32, 0xb3, 0x15, 0x5a, 0x13, 0xfb, 0xcd, 0x59, 0xe9, + 0x69, 0x53, 0x25, 0xba, 0x41, 0x2b, 0xbf, 0x55, 0x52, 0xb9, 0x38, 0x18, + 0x23, 0x4f, 0xae, 0xfc, 0x14, 0xde, 0xbf, 0x87, 0xeb, 0xcc, 0xce, 0x40, + 0x6d, 0x02, 0x4a, 0x26, 0xb9, 0x7a, 0x85, 0x92, 0x38, 0x45, 0x6e, 0x16, + 0x54, 0xb0, 0xd3, 0x58, 0xb1, 0x35, 0xb4, 0x11, 0x80, 0x22, 0x99, 0x41, + 0x00, 0x7b, 0xd8, 0x54, 0x00, 0xb7, 0x10, 0x4d, 0x22, 0x23, 0xee, 0x58, + 0xd8, 0x35, 0x9d, 0xcf, 0x9a, 0xec, 0x63, 0x0c, 0x28, 0xc9, 0xb3, 0xcc, + 0x7a, 0xf6, 0xc4, 0xd5, 0x32, 0xbf, 0xa6, 0xf2, 0x89, 0x0d, 0x00, 0x0d, + 0x6e, 0xaf, 0xb8, 0xe6, 0x5b, 0xb8, 0xd2, 0x7a, 0x83, 0x2e, 0xb1, 0x96, + 0xdb, 0x30, 0x1a, 0x34, 0x77, 0x99, 0x47, 0x26, 0x18, 0x0f, 0x49, 0xa0, + 0xbc, 0x0a, 0x4c, 0x72, 0xca, 0x0f, 0xda, 0x83, 0xcc, 0x01, 0x38, 0xd1, + 0x16, 0x14, 0xfc, 0x6d, 0xc8, 0xde, 0x8d, 0x4f, 0xb1, 0xbc, 0xdd, 0x62, + 0x72, 0x2b, 0x84, 0xf9, 0xe8, 0x2f, 0x09, 0x02, 0x81, 0x81, 0x00, 0xd1, + 0xbd, 0xef, 0x05, 0xca, 0x72, 0x22, 0x57, 0x75, 0xf8, 0x16, 0x0f, 0x07, + 0x54, 0x34, 0x6f, 0x9b, 0x85, 0x6d, 0x35, 0xdb, 0x7a, 0x01, 0xaf, 0x47, + 0xc8, 0xd4, 0xf3, 0x66, 0x46, 0x5a, 0xcf, 0xee, 0x29, 0x4a, 0x4e, 0xff, + 0x09, 0xaa, 0x03, 0x73, 0xf6, 0x43, 0xb0, 0x66, 0xfb, 0xdd, 0x59, 0xb3, + 0x3d, 0x21, 0x89, 0x0e, 0x7a, 0x93, 0x63, 0x76, 0xb6, 0xc6, 0xf9, 0x1f, + 0xfb, 0x4e, 0x70, 0xec, 0x01, 0x4a, 0x4c, 0xdb, 0x56, 0x22, 0x78, 0xc3, + 0xd2, 0x2b, 0xa0, 0x56, 0x72, 0x75, 0x0a, 0x6f, 0xe6, 0x66, 0x57, 0x48, + 0x42, 0xe1, 0x6f, 0x4c, 0x12, 0x9d, 0xeb, 0x78, 0x2f, 0xdf, 0x53, 0xc6, + 0xc2, 0x62, 0x03, 0x9e, 0x52, 0xe8, 0x99, 0x9a, 0xc2, 0xb8, 0x11, 0x08, + 0x11, 0xa1, 0x3a, 0xc4, 0xd0, 0x03, 0x46, 0xca, 0x34, 0x61, 0x62, 0xa0, + 0xdd, 0x42, 0x91, 0xc5, 0x6b, 0x8e, 0x1b, 0x02, 0x81, 0x81, 0x00, 0xc5, + 0xf6, 0x15, 0x2a, 0xf7, 0x61, 0x99, 0x4f, 0x61, 0x45, 0xab, 0x98, 0x14, + 0x76, 0x15, 0x0a, 0x21, 0xd8, 0x4c, 0x2f, 0x1a, 0x7b, 0xc5, 0xb5, 0xa7, + 0xc6, 0x30, 0x51, 0xce, 0x8d, 0xf4, 0xf9, 0xd4, 0xbd, 0x46, 0xb3, 0x60, + 0x2a, 0x57, 0xdb, 0x9e, 0xc7, 0x95, 0x08, 0x2c, 0xd1, 0x0c, 0xc8, 0x72, + 0x3d, 0x24, 0x77, 0x3f, 0x7f, 0x0e, 0xa7, 0xc4, 0xeb, 0x1b, 0x8f, 0x75, + 0x5c, 0xf2, 0xac, 0x5c, 0x30, 0x76, 0x7d, 0xcc, 0xb6, 0x13, 0x7a, 0x40, + 0xe5, 0x94, 0x34, 0x49, 0xe1, 0xd1, 0x77, 0x95, 0x9e, 0x85, 0x2d, 0x15, + 0x2f, 0x13, 0x95, 0xdd, 0xd8, 0x15, 0x53, 0xbd, 0xb0, 0x21, 0x90, 0x83, + 0x52, 0x55, 0x39, 0x66, 0xac, 0xab, 0x3f, 0x06, 0xff, 0x1c, 0x71, 0xc9, + 0xc8, 0xe2, 0x2a, 0x9e, 0xe5, 0xb3, 0x98, 0xdc, 0x80, 0x9f, 0xca, 0xe4, + 0x96, 0x8d, 0xc3, 0x22, 0x59, 0x84, 0x53, 0x02, 0x81, 0x80, 0x5a, 0x72, + 0x02, 0x31, 0xc8, 0x14, 0x21, 0xb4, 0xff, 0x7d, 0x24, 0xde, 0x04, 0x36, + 0x0e, 0x8a, 0x96, 0x51, 0x1a, 0x40, 0x20, 0x4d, 0xe3, 0x8e, 0x17, 0x71, + 0x86, 0x4b, 0x13, 0xae, 0x81, 0x18, 0xab, 0x46, 0x08, 0xf2, 0x39, 0xce, + 0x8c, 0x0f, 0x03, 0x21, 0x8e, 0x1c, 0xf2, 0xbb, 0xe7, 0xbe, 0xf7, 0xa9, + 0x03, 0xde, 0x1b, 0x6d, 0x46, 0x43, 0x9c, 0xfc, 0xc2, 0x9e, 0xc9, 0x68, + 0xd0, 0x71, 0xa7, 0x84, 0x02, 0xeb, 0x53, 0xa6, 0x38, 0x25, 0x45, 0xa4, + 0x4b, 0x05, 0xd0, 0x61, 0x79, 0x11, 0x30, 0x21, 0xf5, 0xbd, 0xeb, 0xbe, + 0x53, 0x82, 0x70, 0x16, 0x93, 0x1c, 0xe8, 0x6e, 0x14, 0x6b, 0x07, 0x09, + 0xe9, 0xc4, 0x4f, 0xb0, 0xc6, 0xf6, 0xfe, 0x22, 0xbb, 0xc7, 0x34, 0x68, + 0x8d, 0xd3, 0x4e, 0xed, 0xb8, 0x8b, 0xfd, 0x44, 0x4b, 0x3e, 0x81, 0xca, + 0x08, 0x1b, 0xde, 0x3b, 0x3c, 0x43, 0x02, 0x81, 0x80, 0x17, 0xd3, 0x96, + 0x98, 0xa5, 0x4d, 0xc9, 0xf6, 0x13, 0xef, 0x1e, 0xc8, 0x1f, 0x2e, 0x57, + 0x39, 0xf0, 0xf8, 0xe7, 0xb2, 0x83, 0xad, 0x82, 0x0e, 0x6b, 0x33, 0x1f, + 0x7d, 0xb9, 0x2e, 0xbc, 0xdd, 0x95, 0x0d, 0x73, 0x05, 0x03, 0xfe, 0x14, + 0xb5, 0x0a, 0x57, 0x5b, 0x48, 0xb0, 0x9c, 0x38, 0xbd, 0xa7, 0x82, 0x54, + 0x71, 0x45, 0xe3, 0x35, 0x10, 0x5c, 0x53, 0x2f, 0xee, 0x04, 0x62, 0x3b, + 0x93, 0x23, 0x45, 0x71, 0xfd, 0x92, 0x36, 0x18, 0x02, 0x0e, 0xed, 0x92, + 0xf8, 0xf8, 0x2b, 0x85, 0xda, 0xae, 0xd7, 0x75, 0x90, 0x07, 0x8c, 0xb2, + 0xfe, 0xc6, 0xc4, 0xcb, 0x4c, 0x58, 0xf8, 0x6a, 0x11, 0xca, 0xbc, 0x8e, + 0x25, 0x6a, 0x86, 0x3d, 0xd6, 0x48, 0x31, 0x4c, 0x6b, 0x25, 0xae, 0x58, + 0x0a, 0x69, 0x35, 0x9c, 0x78, 0x39, 0x92, 0x01, 0xa9, 0x99, 0xf9, 0xc4, + 0xf6, 0x47, 0x9c, 0x1e, 0xa1, 0x02, 0x81, 0x81, 0x00, 0xae, 0xf4, 0x94, + 0x50, 0xe0, 0x58, 0x7e, 0xed, 0x9b, 0xa9, 0x26, 0x99, 0x24, 0x92, 0x0e, + 0x4f, 0x63, 0x93, 0x80, 0x87, 0x89, 0x78, 0x16, 0xa2, 0x05, 0x46, 0xa2, + 0x0d, 0x3e, 0x44, 0x0b, 0x4a, 0x7f, 0x82, 0x5a, 0x15, 0x4e, 0x93, 0xcf, + 0x95, 0x18, 0x7a, 0x3a, 0xa8, 0xfe, 0xc5, 0xd5, 0x9b, 0xb1, 0x82, 0x00, + 0xab, 0x69, 0x43, 0xa8, 0x8a, 0xef, 0xd6, 0x4c, 0x98, 0x53, 0x95, 0x1b, + 0x87, 0xc6, 0xc7, 0x75, 0x9d, 0xae, 0x30, 0x26, 0x08, 0xbb, 0x29, 0x88, + 0xed, 0xc5, 0x78, 0x9d, 0x9d, 0x47, 0x48, 0x68, 0x73, 0xf3, 0xa4, 0x6c, + 0x3b, 0xff, 0x40, 0xeb, 0x63, 0x0c, 0xa0, 0xaf, 0x5b, 0xc6, 0xf7, 0x6c, + 0xb5, 0x03, 0xdf, 0xaf, 0x58, 0x87, 0xd1, 0x95, 0x0a, 0xea, 0xf9, 0x78, + 0x9e, 0xac, 0x8d, 0x98, 0x1a, 0xe0, 0x3e, 0xe3, 0x69, 0x21, 0x20, 0x38, + 0xdd, 0xc4, 0x34, 0x89, 0x04 + }; + unsigned int rsa_der_len = 1217; - mbedtls_pk_context *ctx = calloc(1, sizeof(mbedtls_pk_context)); - mbedtls_pk_init(ctx); - - // Read the above key into mbedtls_pk_context - int ret = mbedtls_pk_parse_key(ctx, (const unsigned char *)rsa_key, strlen(rsa_key) + 1, NULL, 0, NULL, MBEDTLS_PSA_RANDOM_STATE); - TEST_ASSERT(ret == 0); + struct crypto_private_key *ctx = crypto_private_key_import(rsa_der, rsa_der_len, NULL); + TEST_ASSERT_NOT_NULL(ctx); uint8_t data[32] = {[0 ... 31] = 0xA5}; uint8_t encrypted[2048]; size_t encrypted_size = 2048; - psa_crypto_init(); - - ret = crypto_public_key_encrypt_pkcs1_v15((struct crypto_public_key *)ctx, data, 32, encrypted, &encrypted_size); + int ret = crypto_public_key_encrypt_pkcs1_v15((struct crypto_public_key *)ctx, data, 32, encrypted, &encrypted_size); TEST_ASSERT(ret == 0); uint8_t decrypted[32] = {[0 ... 31] = 0}; @@ -984,8 +1058,8 @@ TEST_CASE("Test crypto lib rsa apis", "[wpa_crypto]") ret = crypto_private_key_decrypt_pkcs1_v15((struct crypto_private_key *)ctx, encrypted, encrypted_size, decrypted, &decrypted_size); TEST_ASSERT(ret == 0); TEST_ASSERT(!memcmp(data, decrypted, 32)); - mbedtls_pk_free(ctx); - free(ctx); + + crypto_private_key_free(ctx); } { @@ -1019,26 +1093,16 @@ TEST_CASE("Test crypto lib rsa apis", "[wpa_crypto]") "QOtjDKCvW8b3bLUD369Yh9GVCur5eJ6sjZga4D7jaSEgON3ENIkE\n" "-----END RSA PRIVATE KEY-----\n"; - mbedtls_pk_context *ctx = calloc(1, sizeof(mbedtls_pk_context)); - mbedtls_pk_init(ctx); - - // Read the above key into mbedtls_pk_context - int ret = mbedtls_pk_parse_key(ctx, (const unsigned char *)rsa_key, strlen(rsa_key) + 1, NULL, 0, NULL, MBEDTLS_PSA_RANDOM_STATE); - TEST_ASSERT(ret == 0); + struct crypto_private_key *ctx = crypto_private_key_import((uint8_t *)rsa_key, strlen(rsa_key) + 1, NULL); + TEST_ASSERT_NOT_NULL(ctx); uint8_t data[32] = {[0 ... 31] = 0xA5}; uint8_t signature[2048]; size_t signature_size = 2048; - ret = crypto_private_key_sign_pkcs1((struct crypto_private_key *)ctx, data, 32, signature, &signature_size); + int ret = crypto_private_key_sign_pkcs1((struct crypto_private_key *)ctx, data, 32, signature, &signature_size); TEST_ASSERT(ret == 0); - // printf("Signature size: %d\n", signature_size); - // for (int i = 0; i < signature_size; i++) { - // printf("%02X", signature[i]); - // } - // printf("\n"); - // 700CE7B382057B3DA95734BFF2371A6435E9B226BFE2BB97922529A3331F1DEE57CA02341EE7448A5605813C8124BD64EBC21623EAC7CA8DECB61B615676BA0CBCE3A0B51369E4D69C8C7628AC55952D1553951722C05A0F79F9AC1C17061781532B8E2577529C480F96B93ED73D4079C865D71758ABB6EC4B51C4ED0ED8D47DF82C9B8701E072D5B9786CC835A52F508F2BCC2A762DD8C4BB9C02B44591954EDEF38655A2E551C6BAA0AFA803D583147856980D4EF3A1053A32EB997B3DEF46C86E7BB59F83F7D6FE38E825B60BF42652DF87AA4F19689BFBB6CEF07789A4B3AAD270A4FF9D942083BA08D0D97BD0D707B57424C652850627A505D23E1D0B2E uint8_t expected_signature[256] = { 0x70, 0x0C, 0xE7, 0xB3, 0x82, 0x05, 0x7B, 0x3D, 0xA9, 0x57, @@ -1077,8 +1141,7 @@ TEST_CASE("Test crypto lib rsa apis", "[wpa_crypto]") } } - mbedtls_pk_free(ctx); - free(ctx); + crypto_private_key_free(ctx); } }