From e5fe5fb8ac2f10d1510eb6c146dd82954777b353 Mon Sep 17 00:00:00 2001 From: Kapil Gupta Date: Mon, 1 Jun 2026 12:28:54 +0530 Subject: [PATCH] refactor(wpa_supplicant): add shared psa_import_aes_key helper Centralize PSA AES key import used by ECB, CBC, CTR, CCM, CMAC, and NIST key-wrap paths in crypto_mbedtls.c. --- .../src/crypto/crypto_mbedtls.c | 134 ++++++------------ 1 file changed, 46 insertions(+), 88 deletions(-) diff --git a/components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls.c b/components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls.c index 0b5989a2e1a..e0c60da9869 100644 --- a/components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls.c +++ b/components/wpa_supplicant/esp_supplicant/src/crypto/crypto_mbedtls.c @@ -114,13 +114,6 @@ int md5_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac) return digest_vector(PSA_ALG_MD5, num_elem, addr, len, mac); } -#ifdef MBEDTLS_MD4_C -int md4_vector(size_t num_elem, const u8 *addr[], const size_t *len, u8 *mac) -{ - return digest_vector(MBEDTLS_MD_MD4, num_elem, addr, len, mac); -} -#endif - struct crypto_hash * crypto_hash_init(enum crypto_hash_alg alg, const u8 *key, size_t key_len) { @@ -421,10 +414,29 @@ int hmac_sha1(const u8 *key, size_t key_len, const u8 *data, size_t data_len, } #endif +static psa_status_t psa_import_aes_key(const u8 *key, size_t key_len, + psa_algorithm_t alg, + psa_key_usage_t usage, + psa_key_id_t *key_id) +{ + psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; + psa_status_t status; + + psa_set_key_type(&attributes, PSA_KEY_TYPE_AES); + psa_set_key_bits(&attributes, key_len * 8); + psa_set_key_algorithm(&attributes, alg); + psa_set_key_usage_flags(&attributes, usage); + + status = psa_import_key(&attributes, key, key_len, key_id); + psa_reset_key_attributes(&attributes); + + return status; +} + static void *aes_crypt_init(int mode, const u8 *key, size_t len) { psa_status_t status; - psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; + psa_key_usage_t usage = 0; psa_key_id_t *key_id = os_malloc(sizeof(psa_key_id_t)); if (key_id == NULL) { @@ -432,17 +444,15 @@ static void *aes_crypt_init(int mode, const u8 *key, size_t len) } if (mode == MBEDTLS_ENCRYPT) { - psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_ENCRYPT); + usage = PSA_KEY_USAGE_ENCRYPT; } else if (mode == MBEDTLS_DECRYPT) { - psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_DECRYPT); + usage = PSA_KEY_USAGE_DECRYPT; + } else { + os_free(key_id); + return NULL; } - psa_set_key_algorithm(&attributes, PSA_ALG_ECB_NO_PADDING); - psa_set_key_type(&attributes, PSA_KEY_TYPE_AES); - psa_set_key_bits(&attributes, len * 8); - - status = psa_import_key(&attributes, key, len, key_id); - psa_reset_key_attributes(&attributes); + status = psa_import_aes_key(key, len, PSA_ALG_ECB_NO_PADDING, usage, key_id); if (status != PSA_SUCCESS) { wpa_printf(MSG_ERROR, "%s: psa_import_key failed", __func__); os_free(key_id); @@ -537,16 +547,10 @@ void aes_decrypt_deinit(void *ctx) int aes_128_cbc_encrypt(const u8 *key, const u8 *iv, u8 *data, size_t data_len) { psa_status_t status; - psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; psa_key_id_t key_id; - psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_ENCRYPT); - psa_set_key_algorithm(&attributes, PSA_ALG_CBC_NO_PADDING); - psa_set_key_type(&attributes, PSA_KEY_TYPE_AES); - psa_set_key_bits(&attributes, 128); - - status = psa_import_key(&attributes, key, 16, &key_id); - psa_reset_key_attributes(&attributes); + status = psa_import_aes_key(key, 16, PSA_ALG_CBC_NO_PADDING, + PSA_KEY_USAGE_ENCRYPT, &key_id); if (status != PSA_SUCCESS) { wpa_printf(MSG_ERROR, "%s: psa_import_key failed", __func__); return -1; @@ -596,16 +600,10 @@ int aes_128_cbc_encrypt(const u8 *key, const u8 *iv, u8 *data, size_t data_len) int aes_128_cbc_decrypt(const u8 *key, const u8 *iv, u8 *data, size_t data_len) { psa_status_t status; - psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; psa_key_id_t key_id; - psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_DECRYPT); - psa_set_key_algorithm(&attributes, PSA_ALG_CBC_NO_PADDING); - psa_set_key_type(&attributes, PSA_KEY_TYPE_AES); - psa_set_key_bits(&attributes, 128); - - status = psa_import_key(&attributes, key, 16, &key_id); - psa_reset_key_attributes(&attributes); + status = psa_import_aes_key(key, 16, PSA_ALG_CBC_NO_PADDING, + PSA_KEY_USAGE_DECRYPT, &key_id); if (status != PSA_SUCCESS) { wpa_printf(MSG_ERROR, "%s: psa_import_key failed", __func__); return -1; @@ -894,25 +892,18 @@ int aes_ctr_encrypt(const u8 *key, size_t key_len, const u8 *nonce, u8 *data, size_t data_len) { psa_status_t status; - psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; psa_key_id_t key_id = 0; psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT; int ret = -1; u8 *temp_buf = NULL; - psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_ENCRYPT); - psa_set_key_algorithm(&attributes, PSA_ALG_CTR); - psa_set_key_type(&attributes, PSA_KEY_TYPE_AES); - psa_set_key_bits(&attributes, key_len * 8); - - status = psa_import_key(&attributes, key, key_len, &key_id); + status = psa_import_aes_key(key, key_len, PSA_ALG_CTR, + PSA_KEY_USAGE_ENCRYPT, &key_id); if (status != PSA_SUCCESS) { wpa_printf(MSG_ERROR, "%s: psa_import_key failed", __func__); goto cleanup; } - psa_reset_key_attributes(&attributes); - status = psa_cipher_encrypt_setup(&operation, key_id, PSA_ALG_CTR); if (status != PSA_SUCCESS) { wpa_printf(MSG_ERROR, "%s: psa_cipher_encrypt_setup failed", __func__); @@ -984,30 +975,15 @@ int aes_128_ctr_encrypt(const u8 *key, const u8 *nonce, } #ifdef MBEDTLS_NIST_KW_C -static int nist_kw_import_kek(const u8 *kek, size_t kek_len, psa_key_usage_t usage, - mbedtls_svc_key_id_t *key_id) -{ - psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; - psa_status_t status; - - psa_set_key_type(&attributes, PSA_KEY_TYPE_AES); - psa_set_key_bits(&attributes, kek_len * 8); - psa_set_key_algorithm(&attributes, PSA_ALG_ECB_NO_PADDING); - psa_set_key_usage_flags(&attributes, usage); - - status = psa_import_key(&attributes, kek, kek_len, key_id); - psa_reset_key_attributes(&attributes); - - return status == PSA_SUCCESS ? 0 : -1; -} - int aes_wrap(const u8 *kek, size_t kek_len, int n, const u8 *plain, u8 *cipher) { - mbedtls_svc_key_id_t key_id = 0; + psa_key_id_t key_id = 0; psa_status_t status; size_t olen = 0; - if (nist_kw_import_kek(kek, kek_len, PSA_KEY_USAGE_ENCRYPT, &key_id) != 0) { + status = psa_import_aes_key(kek, kek_len, PSA_ALG_ECB_NO_PADDING, + PSA_KEY_USAGE_ENCRYPT, &key_id); + if (status != PSA_SUCCESS) { return -1; } @@ -1022,11 +998,13 @@ int aes_wrap(const u8 *kek, size_t kek_len, int n, const u8 *plain, u8 *cipher) int aes_unwrap(const u8 *kek, size_t kek_len, int n, const u8 *cipher, u8 *plain) { - mbedtls_svc_key_id_t key_id = 0; + psa_key_id_t key_id = 0; psa_status_t status; size_t olen = 0; - if (nist_kw_import_kek(kek, kek_len, PSA_KEY_USAGE_DECRYPT, &key_id) != 0) { + status = psa_import_aes_key(kek, kek_len, PSA_ALG_ECB_NO_PADDING, + PSA_KEY_USAGE_DECRYPT, &key_id); + if (status != PSA_SUCCESS) { return -1; } @@ -1190,22 +1168,15 @@ int aes_ccm_ae(const u8 *key, size_t key_len, const u8 *nonce, const u8 *aad, size_t aad_len, u8 *crypt, u8 *auth) { psa_status_t status; - psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; psa_key_id_t key_id; - psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_ENCRYPT); - psa_set_key_algorithm(&attributes, PSA_ALG_CCM); - psa_set_key_type(&attributes, PSA_KEY_TYPE_AES); - psa_set_key_bits(&attributes, key_len * 8); - - status = psa_import_key(&attributes, key, key_len, &key_id); + status = psa_import_aes_key(key, key_len, PSA_ALG_CCM, + PSA_KEY_USAGE_ENCRYPT, &key_id); if (status != PSA_SUCCESS) { wpa_printf(MSG_ERROR, "%s: psa_import_key failed", __func__); return -1; } - psa_reset_key_attributes(&attributes); - psa_aead_operation_t operation = PSA_AEAD_OPERATION_INIT; status = psa_aead_encrypt_setup(&operation, key_id, PSA_ALG_CCM); @@ -1272,19 +1243,13 @@ int aes_ccm_ad(const u8 *key, size_t key_len, const u8 *nonce, u8 *plain) { psa_status_t status; - psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; psa_key_id_t key_id; u8 *ciphertext_with_tag = NULL; size_t plaintext_length = 0; int ret = -1; - psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_DECRYPT); - psa_set_key_algorithm(&attributes, PSA_ALG_CCM); - psa_set_key_type(&attributes, PSA_KEY_TYPE_AES); - psa_set_key_bits(&attributes, key_len * 8); - - status = psa_import_key(&attributes, key, key_len, &key_id); - psa_reset_key_attributes(&attributes); + status = psa_import_aes_key(key, key_len, PSA_ALG_CCM, + PSA_KEY_USAGE_DECRYPT, &key_id); if (status != PSA_SUCCESS) { wpa_printf(MSG_ERROR, "%s: psa_import_key failed", __func__); return -1; @@ -1335,24 +1300,17 @@ int omac1_aes_vector(const u8 *key, size_t key_len, size_t num_elem, } psa_status_t status; - psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; psa_key_id_t key_id = 0; psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT; int ret = -1; - psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_HASH); - psa_set_key_algorithm(&attributes, PSA_ALG_CMAC); - psa_set_key_type(&attributes, PSA_KEY_TYPE_AES); - psa_set_key_bits(&attributes, key_len * 8); - - status = psa_import_key(&attributes, key, key_len, &key_id); + status = psa_import_aes_key(key, key_len, PSA_ALG_CMAC, + PSA_KEY_USAGE_SIGN_HASH, &key_id); if (status != PSA_SUCCESS) { wpa_printf(MSG_ERROR, "%s: psa_import_key failed", __func__); goto cleanup; } - psa_reset_key_attributes(&attributes); - status = psa_mac_sign_setup(&operation, key_id, PSA_ALG_CMAC); if (status != PSA_SUCCESS) { wpa_printf(MSG_ERROR, "%s: psa_mac_sign_setup failed", __func__);