Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

refactor(wpa_supplicant): add shared psa_import_aes_key helper

Browse Source 
Centralize PSA AES key import used by ECB, CBC, CTR, CCM, CMAC, and
NIST key-wrap paths in crypto_mbedtls.c.
This commit is contained in:
Kapil Gupta
2026-06-01 12:28:54 +05:30
committed by BOT
parent 005bedfbe0
commit e5fe5fb8ac
1 changed files with 46 additions and 88 deletions
Download Patch File Download Diff File Expand all files Collapse all files

134
components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls.c
View File

@@ -114,13 +114,6 @@ int md5_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
return digest_vector(PSA_ALG_MD5, num_elem, addr, len, mac);
}
#ifdef MBEDTLS_MD4_C
int md4_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac)
{
return digest_vector(MBEDTLS_MD_MD4, num_elem, addr, len, mac);
}
#endif
struct crypto_hash * crypto_hash_init(enum crypto_hash_alg alg, const u8 *key,
size_t key_len)
{
@@ -421,10 +414,29 @@ int hmac_sha1(const u8 *key, size_t key_len, const u8 *data, size_t data_len,
}
#endif
static psa_status_t psa_import_aes_key(const u8 *key, size_t key_len,
psa_algorithm_t alg,
psa_key_usage_t usage,
psa_key_id_t *key_id)
{
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
psa_status_t status;
psa_set_key_type(&attributes, PSA_KEY_TYPE_AES);
psa_set_key_bits(&attributes, key_len * 8);
psa_set_key_algorithm(&attributes, alg);
psa_set_key_usage_flags(&attributes, usage);
status = psa_import_key(&attributes, key, key_len, key_id);
psa_reset_key_attributes(&attributes);
return status;
}
static void *aes_crypt_init(int mode, const u8 *key, size_t len)
{
psa_status_t status;
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
psa_key_usage_t usage = 0;
psa_key_id_t *key_id = os_malloc(sizeof(psa_key_id_t));
if (key_id == NULL) {
@@ -432,17 +444,15 @@ static void *aes_crypt_init(int mode, const u8 *key, size_t len)
}
if (mode == MBEDTLS_ENCRYPT) {
psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_ENCRYPT);
usage = PSA_KEY_USAGE_ENCRYPT;
} else if (mode == MBEDTLS_DECRYPT) {
psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_DECRYPT);
usage = PSA_KEY_USAGE_DECRYPT;
} else {
os_free(key_id);
return NULL;
}
psa_set_key_algorithm(&attributes, PSA_ALG_ECB_NO_PADDING);
psa_set_key_type(&attributes, PSA_KEY_TYPE_AES);
psa_set_key_bits(&attributes, len * 8);
status = psa_import_key(&attributes, key, len, key_id);
psa_reset_key_attributes(&attributes);
status = psa_import_aes_key(key, len, PSA_ALG_ECB_NO_PADDING, usage, key_id);
if (status != PSA_SUCCESS) {
wpa_printf(MSG_ERROR, "%s: psa_import_key failed", __func__);
os_free(key_id);
@@ -537,16 +547,10 @@ void aes_decrypt_deinit(void *ctx)
int aes_128_cbc_encrypt(const u8 *key, const u8 *iv, u8 *data, size_t data_len)
{
psa_status_t status;
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
psa_key_id_t key_id;
psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_ENCRYPT);
psa_set_key_algorithm(&attributes, PSA_ALG_CBC_NO_PADDING);
psa_set_key_type(&attributes, PSA_KEY_TYPE_AES);
psa_set_key_bits(&attributes, 128);
status = psa_import_key(&attributes, key, 16, &key_id);
psa_reset_key_attributes(&attributes);
status = psa_import_aes_key(key, 16, PSA_ALG_CBC_NO_PADDING,
PSA_KEY_USAGE_ENCRYPT, &key_id);
if (status != PSA_SUCCESS) {
wpa_printf(MSG_ERROR, "%s: psa_import_key failed", __func__);
return -1;
@@ -596,16 +600,10 @@ int aes_128_cbc_encrypt(const u8 *key, const u8 *iv, u8 *data, size_t data_len)
int aes_128_cbc_decrypt(const u8 *key, const u8 *iv, u8 *data, size_t data_len)
{
psa_status_t status;
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
psa_key_id_t key_id;
psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_DECRYPT);
psa_set_key_algorithm(&attributes, PSA_ALG_CBC_NO_PADDING);
psa_set_key_type(&attributes, PSA_KEY_TYPE_AES);
psa_set_key_bits(&attributes, 128);
status = psa_import_key(&attributes, key, 16, &key_id);
psa_reset_key_attributes(&attributes);
status = psa_import_aes_key(key, 16, PSA_ALG_CBC_NO_PADDING,
PSA_KEY_USAGE_DECRYPT, &key_id);
if (status != PSA_SUCCESS) {
wpa_printf(MSG_ERROR, "%s: psa_import_key failed", __func__);
return -1;
@@ -894,25 +892,18 @@ int aes_ctr_encrypt(const u8 *key, size_t key_len, const u8 *nonce,
u8 *data, size_t data_len)
{
psa_status_t status;
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
psa_key_id_t key_id = 0;
psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT;
int ret = -1;
u8 *temp_buf = NULL;
psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_ENCRYPT);
psa_set_key_algorithm(&attributes, PSA_ALG_CTR);
psa_set_key_type(&attributes, PSA_KEY_TYPE_AES);
psa_set_key_bits(&attributes, key_len * 8);
status = psa_import_key(&attributes, key, key_len, &key_id);
status = psa_import_aes_key(key, key_len, PSA_ALG_CTR,
PSA_KEY_USAGE_ENCRYPT, &key_id);
if (status != PSA_SUCCESS) {
wpa_printf(MSG_ERROR, "%s: psa_import_key failed", __func__);
goto cleanup;
}
psa_reset_key_attributes(&attributes);
status = psa_cipher_encrypt_setup(&operation, key_id, PSA_ALG_CTR);
if (status != PSA_SUCCESS) {
wpa_printf(MSG_ERROR, "%s: psa_cipher_encrypt_setup failed", __func__);
@@ -984,30 +975,15 @@ int aes_128_ctr_encrypt(const u8 *key, const u8 *nonce,
}
#ifdef MBEDTLS_NIST_KW_C
static int nist_kw_import_kek(const u8 *kek, size_t kek_len, psa_key_usage_t usage,
mbedtls_svc_key_id_t *key_id)
{
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
psa_status_t status;
psa_set_key_type(&attributes, PSA_KEY_TYPE_AES);
psa_set_key_bits(&attributes, kek_len * 8);
psa_set_key_algorithm(&attributes, PSA_ALG_ECB_NO_PADDING);
psa_set_key_usage_flags(&attributes, usage);
status = psa_import_key(&attributes, kek, kek_len, key_id);
psa_reset_key_attributes(&attributes);
return status == PSA_SUCCESS ? 0 : -1;
}
int aes_wrap(const u8 *kek, size_t kek_len, int n, const u8 *plain, u8 *cipher)
{
mbedtls_svc_key_id_t key_id = 0;
psa_key_id_t key_id = 0;
psa_status_t status;
size_t olen = 0;
if (nist_kw_import_kek(kek, kek_len, PSA_KEY_USAGE_ENCRYPT, &key_id) != 0) {
status = psa_import_aes_key(kek, kek_len, PSA_ALG_ECB_NO_PADDING,
PSA_KEY_USAGE_ENCRYPT, &key_id);
if (status != PSA_SUCCESS) {
return -1;
}
@@ -1022,11 +998,13 @@ int aes_wrap(const u8 *kek, size_t kek_len, int n, const u8 *plain, u8 *cipher)
int aes_unwrap(const u8 *kek, size_t kek_len, int n, const u8 *cipher,
u8 *plain)
{
mbedtls_svc_key_id_t key_id = 0;
psa_key_id_t key_id = 0;
psa_status_t status;
size_t olen = 0;
if (nist_kw_import_kek(kek, kek_len, PSA_KEY_USAGE_DECRYPT, &key_id) != 0) {
status = psa_import_aes_key(kek, kek_len, PSA_ALG_ECB_NO_PADDING,
PSA_KEY_USAGE_DECRYPT, &key_id);
if (status != PSA_SUCCESS) {
return -1;
}
@@ -1190,22 +1168,15 @@ int aes_ccm_ae(const u8 *key, size_t key_len, const u8 *nonce,
const u8 *aad, size_t aad_len, u8 *crypt, u8 *auth)
{
psa_status_t status;
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
psa_key_id_t key_id;
psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_ENCRYPT);
psa_set_key_algorithm(&attributes, PSA_ALG_CCM);
psa_set_key_type(&attributes, PSA_KEY_TYPE_AES);
psa_set_key_bits(&attributes, key_len * 8);
status = psa_import_key(&attributes, key, key_len, &key_id);
status = psa_import_aes_key(key, key_len, PSA_ALG_CCM,
PSA_KEY_USAGE_ENCRYPT, &key_id);
if (status != PSA_SUCCESS) {
wpa_printf(MSG_ERROR, "%s: psa_import_key failed", __func__);
return -1;
}
psa_reset_key_attributes(&attributes);
psa_aead_operation_t operation = PSA_AEAD_OPERATION_INIT;
status = psa_aead_encrypt_setup(&operation, key_id, PSA_ALG_CCM);
@@ -1272,19 +1243,13 @@ int aes_ccm_ad(const u8 *key, size_t key_len, const u8 *nonce,
u8 *plain)
{
psa_status_t status;
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
psa_key_id_t key_id;
u8 *ciphertext_with_tag = NULL;
size_t plaintext_length = 0;
int ret = -1;
psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_DECRYPT);
psa_set_key_algorithm(&attributes, PSA_ALG_CCM);
psa_set_key_type(&attributes, PSA_KEY_TYPE_AES);
psa_set_key_bits(&attributes, key_len * 8);
status = psa_import_key(&attributes, key, key_len, &key_id);
psa_reset_key_attributes(&attributes);
status = psa_import_aes_key(key, key_len, PSA_ALG_CCM,
PSA_KEY_USAGE_DECRYPT, &key_id);
if (status != PSA_SUCCESS) {
wpa_printf(MSG_ERROR, "%s: psa_import_key failed", __func__);
return -1;
@@ -1335,24 +1300,17 @@ int omac1_aes_vector(const u8 *key, size_t key_len, size_t num_elem,
}
psa_status_t status;
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
psa_key_id_t key_id = 0;
psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT;
int ret = -1;
psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_HASH);
psa_set_key_algorithm(&attributes, PSA_ALG_CMAC);
psa_set_key_type(&attributes, PSA_KEY_TYPE_AES);
psa_set_key_bits(&attributes, key_len * 8);
status = psa_import_key(&attributes, key, key_len, &key_id);
status = psa_import_aes_key(key, key_len, PSA_ALG_CMAC,
PSA_KEY_USAGE_SIGN_HASH, &key_id);
if (status != PSA_SUCCESS) {
wpa_printf(MSG_ERROR, "%s: psa_import_key failed", __func__);
goto cleanup;
}
psa_reset_key_attributes(&attributes);
status = psa_mac_sign_setup(&operation, key_id, PSA_ALG_CMAC);
if (status != PSA_SUCCESS) {
wpa_printf(MSG_ERROR, "%s: psa_mac_sign_setup failed", __func__);