Skip to content

Commit 3b7df17

Browse files
mahavirjmahavirj
committed
feat(libsodium): add support for PSA crypto APIs
1 parent b49dcac commit 3b7df17

File tree

2 files changed

+184
-4
lines changed

2 files changed

+184
-4
lines changed

‎libsodium/port/crypto_hash_mbedtls/crypto_hash_sha256_mbedtls.c‎

Lines changed: 92 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* SPDX-FileCopyrightText: 2017-2021 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2017-2026 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
@@ -16,10 +16,21 @@
1616
#endif /* MBEDTLS_ALLOW_PRIVATE_ACCESS */
1717
#endif /* !(MBEDTLS_VERSION_NUMBER < 0x03000000) */
1818

19+
/* For MbedTLS 4.x support using PSA Crypto */
20+
#if (MBEDTLS_VERSION_NUMBER >= 0x04000000)
21+
#define MBEDTLS_PSA_CRYPTO
22+
#endif
23+
1924
#include "crypto_hash_sha256.h"
20-
#include "mbedtls/sha256.h"
2125
#include <string.h>
2226

27+
#ifdef MBEDTLS_PSA_CRYPTO
28+
#include "psa/crypto.h"
29+
#else
30+
#include "mbedtls/sha256.h"
31+
#endif
32+
33+
#ifndef MBEDTLS_PSA_CRYPTO
2334
#ifdef MBEDTLS_SHA256_ALT
2435
/* Wrapper only works if the libsodium context structure can be mapped
2536
directly to the mbedTLS context structure.
@@ -61,10 +72,42 @@ static void sha256_libsodium_to_mbedtls(mbedtls_sha256_context *mb_ctx, crypto_h
6172
memcpy(mb_ctx->buffer, ls_state->buf, sizeof(mb_ctx->buffer));
6273
mb_ctx->is224 = 0;
6374
}
75+
#endif /* !MBEDTLS_PSA_CRYPTO */
6476

6577
int
6678
crypto_hash_sha256_init(crypto_hash_sha256_state *state)
6779
{
80+
if (state == NULL) {
81+
return -1;
82+
}
83+
#ifdef MBEDTLS_PSA_CRYPTO
84+
psa_status_t status;
85+
86+
status = psa_crypto_init();
87+
if (status != PSA_SUCCESS) {
88+
return -1;
89+
}
90+
91+
psa_hash_operation_t *operation;
92+
93+
/* Store PSA hash operation in the state buffer
94+
* The libsodium state structure is large enough to hold psa_hash_operation_t.
95+
* Ensure this is safe with respect to both size and alignment.
96+
*/
97+
_Static_assert(sizeof(crypto_hash_sha256_state) >= sizeof(psa_hash_operation_t),
98+
"crypto_hash_sha256_state too small for psa_hash_operation_t");
99+
_Static_assert(_Alignof(crypto_hash_sha256_state) >= _Alignof(psa_hash_operation_t),
100+
"crypto_hash_sha256_state alignment insufficient for psa_hash_operation_t");
101+
memset(state, 0, sizeof(*state));
102+
operation = (psa_hash_operation_t *)state;
103+
*operation = psa_hash_operation_init();
104+
105+
status = psa_hash_setup(operation, PSA_ALG_SHA_256);
106+
if (status != PSA_SUCCESS) {
107+
return -1;
108+
}
109+
return 0;
110+
#else
68111
mbedtls_sha256_context ctx;
69112
mbedtls_sha256_init(&ctx);
70113
#ifdef MBEDTLS_2_X_COMPAT
@@ -77,12 +120,27 @@ crypto_hash_sha256_init(crypto_hash_sha256_state *state)
77120
}
78121
sha256_mbedtls_to_libsodium(state, &ctx);
79122
return 0;
123+
#endif /* !MBEDTLS_PSA_CRYPTO */
80124
}
81125

82126
int
83127
crypto_hash_sha256_update(crypto_hash_sha256_state *state,
84128
const unsigned char *in, unsigned long long inlen)
85129
{
130+
if (state == NULL || (in == NULL && inlen > 0)) {
131+
return -1;
132+
}
133+
#ifdef MBEDTLS_PSA_CRYPTO
134+
psa_hash_operation_t *operation = (psa_hash_operation_t *)state;
135+
psa_status_t status;
136+
137+
status = psa_hash_update(operation, in, inlen);
138+
if (status != PSA_SUCCESS) {
139+
psa_hash_abort(operation);
140+
return -1;
141+
}
142+
return 0;
143+
#else
86144
mbedtls_sha256_context ctx;
87145
sha256_libsodium_to_mbedtls(&ctx, state);
88146
#ifdef MBEDTLS_2_X_COMPAT
@@ -95,27 +153,59 @@ crypto_hash_sha256_update(crypto_hash_sha256_state *state,
95153
}
96154
sha256_mbedtls_to_libsodium(state, &ctx);
97155
return 0;
156+
#endif /* !MBEDTLS_PSA_CRYPTO */
98157
}
99158

100159
int
101160
crypto_hash_sha256_final(crypto_hash_sha256_state *state, unsigned char *out)
102161
{
162+
if (state == NULL || out == NULL) {
163+
return -1;
164+
}
165+
#ifdef MBEDTLS_PSA_CRYPTO
166+
psa_hash_operation_t *operation = (psa_hash_operation_t *)state;
167+
psa_status_t status;
168+
size_t hash_len;
169+
170+
status = psa_hash_finish(operation, out, crypto_hash_sha256_BYTES, &hash_len);
171+
if (status != PSA_SUCCESS || hash_len != crypto_hash_sha256_BYTES) {
172+
psa_hash_abort(operation);
173+
return -1;
174+
}
175+
return 0;
176+
#else
103177
mbedtls_sha256_context ctx;
104178
sha256_libsodium_to_mbedtls(&ctx, state);
105179
#ifdef MBEDTLS_2_X_COMPAT
106180
return mbedtls_sha256_finish_ret(&ctx, out);
107181
#else
108182
return mbedtls_sha256_finish(&ctx, out);
109183
#endif /* MBEDTLS_2_X_COMPAT */
184+
#endif /* !MBEDTLS_PSA_CRYPTO */
110185
}
111186

112187
int
113188
crypto_hash_sha256(unsigned char *out, const unsigned char *in,
114189
unsigned long long inlen)
115190
{
191+
if (out == NULL || (in == NULL && inlen > 0)) {
192+
return -1;
193+
}
194+
#ifdef MBEDTLS_PSA_CRYPTO
195+
psa_status_t status;
196+
size_t hash_len;
197+
198+
status = psa_hash_compute(PSA_ALG_SHA_256, in, inlen, out,
199+
crypto_hash_sha256_BYTES, &hash_len);
200+
if (status != PSA_SUCCESS || hash_len != crypto_hash_sha256_BYTES) {
201+
return -1;
202+
}
203+
return 0;
204+
#else
116205
#ifdef MBEDTLS_2_X_COMPAT
117206
return mbedtls_sha256_ret(in, inlen, out, 0);
118207
#else
119208
return mbedtls_sha256(in, inlen, out, 0);
120209
#endif /* MBEDTLS_2_X_COMPAT */
210+
#endif /* !MBEDTLS_PSA_CRYPTO */
121211
}

‎libsodium/port/crypto_hash_mbedtls/crypto_hash_sha512_mbedtls.c‎

Lines changed: 92 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* SPDX-FileCopyrightText: 2017-2021 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2017-2026 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
@@ -16,10 +16,21 @@
1616
#endif /* MBEDTLS_ALLOW_PRIVATE_ACCESS */
1717
#endif /* !(MBEDTLS_VERSION_NUMBER < 0x03000000) */
1818

19+
/* For MbedTLS 4.x support using PSA crypto */
20+
#if (MBEDTLS_VERSION_NUMBER >= 0x04000000)
21+
#define MBEDTLS_PSA_CRYPTO
22+
#endif
23+
1924
#include "crypto_hash_sha512.h"
20-
#include "mbedtls/sha512.h"
2125
#include <string.h>
2226

27+
#ifdef MBEDTLS_PSA_CRYPTO
28+
#include "psa/crypto.h"
29+
#else
30+
#include "mbedtls/sha512.h"
31+
#endif
32+
33+
#ifndef MBEDTLS_PSA_CRYPTO
2334
#ifdef MBEDTLS_SHA512_ALT
2435
/* Wrapper only works if the libsodium context structure can be mapped
2536
directly to the mbedTLS context structure.
@@ -65,10 +76,42 @@ static void sha512_libsodium_to_mbedtls(mbedtls_sha512_context *mb_ctx, crypto_h
6576
memcpy(mb_ctx->buffer, ls_state->buf, sizeof(mb_ctx->buffer));
6677
mb_ctx->is384 = 0;
6778
}
79+
#endif /* !MBEDTLS_PSA_CRYPTO */
6880

6981
int
7082
crypto_hash_sha512_init(crypto_hash_sha512_state *state)
7183
{
84+
if (state == NULL) {
85+
return -1;
86+
}
87+
#ifdef MBEDTLS_PSA_CRYPTO
88+
psa_status_t status;
89+
90+
status = psa_crypto_init();
91+
if (status != PSA_SUCCESS) {
92+
return -1;
93+
}
94+
95+
psa_hash_operation_t *operation;
96+
97+
/* Store PSA hash operation in the state buffer
98+
* The libsodium state structure is large enough to hold psa_hash_operation_t.
99+
* Ensure this is safe with respect to both size and alignment.
100+
*/
101+
_Static_assert(sizeof(crypto_hash_sha512_state) >= sizeof(psa_hash_operation_t),
102+
"crypto_hash_sha512_state too small for psa_hash_operation_t");
103+
_Static_assert(_Alignof(crypto_hash_sha512_state) >= _Alignof(psa_hash_operation_t),
104+
"crypto_hash_sha512_state alignment insufficient for psa_hash_operation_t");
105+
memset(state, 0, sizeof(*state));
106+
operation = (psa_hash_operation_t *)state;
107+
*operation = psa_hash_operation_init();
108+
109+
status = psa_hash_setup(operation, PSA_ALG_SHA_512);
110+
if (status != PSA_SUCCESS) {
111+
return -1;
112+
}
113+
return 0;
114+
#else
72115
mbedtls_sha512_context ctx;
73116
mbedtls_sha512_init(&ctx);
74117
#ifdef MBEDTLS_2_X_COMPAT
@@ -81,12 +124,27 @@ crypto_hash_sha512_init(crypto_hash_sha512_state *state)
81124
}
82125
sha512_mbedtls_to_libsodium(state, &ctx);
83126
return 0;
127+
#endif /* !MBEDTLS_PSA_CRYPTO */
84128
}
85129

86130
int
87131
crypto_hash_sha512_update(crypto_hash_sha512_state *state,
88132
const unsigned char *in, unsigned long long inlen)
89133
{
134+
if (state == NULL || (inlen > 0 && in == NULL)) {
135+
return -1;
136+
}
137+
#ifdef MBEDTLS_PSA_CRYPTO
138+
psa_hash_operation_t *operation = (psa_hash_operation_t *)state;
139+
psa_status_t status;
140+
141+
status = psa_hash_update(operation, in, inlen);
142+
if (status != PSA_SUCCESS) {
143+
psa_hash_abort(operation);
144+
return -1;
145+
}
146+
return 0;
147+
#else
90148
mbedtls_sha512_context ctx;
91149
sha512_libsodium_to_mbedtls(&ctx, state);
92150
#ifdef MBEDTLS_2_X_COMPAT
@@ -99,27 +157,59 @@ crypto_hash_sha512_update(crypto_hash_sha512_state *state,
99157
}
100158
sha512_mbedtls_to_libsodium(state, &ctx);
101159
return 0;
160+
#endif /* !MBEDTLS_PSA_CRYPTO */
102161
}
103162

104163
int
105164
crypto_hash_sha512_final(crypto_hash_sha512_state *state, unsigned char *out)
106165
{
166+
if (state == NULL || out == NULL) {
167+
return -1;
168+
}
169+
#ifdef MBEDTLS_PSA_CRYPTO
170+
psa_hash_operation_t *operation = (psa_hash_operation_t *)state;
171+
psa_status_t status;
172+
size_t hash_len;
173+
174+
status = psa_hash_finish(operation, out, crypto_hash_sha512_BYTES, &hash_len);
175+
if (status != PSA_SUCCESS || hash_len != crypto_hash_sha512_BYTES) {
176+
psa_hash_abort(operation);
177+
return -1;
178+
}
179+
return 0;
180+
#else
107181
mbedtls_sha512_context ctx;
108182
sha512_libsodium_to_mbedtls(&ctx, state);
109183
#ifdef MBEDTLS_2_X_COMPAT
110184
return mbedtls_sha512_finish_ret(&ctx, out);
111185
#else
112186
return mbedtls_sha512_finish(&ctx, out);
113187
#endif /* MBEDTLS_2_X_COMPAT */
188+
#endif /* !MBEDTLS_PSA_CRYPTO */
114189
}
115190

116191
int
117192
crypto_hash_sha512(unsigned char *out, const unsigned char *in,
118193
unsigned long long inlen)
119194
{
195+
if (out == NULL || (inlen > 0 && in == NULL)) {
196+
return -1;
197+
}
198+
#ifdef MBEDTLS_PSA_CRYPTO
199+
psa_status_t status;
200+
size_t hash_len;
201+
202+
status = psa_hash_compute(PSA_ALG_SHA_512, in, inlen, out,
203+
crypto_hash_sha512_BYTES, &hash_len);
204+
if (status != PSA_SUCCESS || hash_len != crypto_hash_sha512_BYTES) {
205+
return -1;
206+
}
207+
return 0;
208+
#else
120209
#ifdef MBEDTLS_2_X_COMPAT
121210
return mbedtls_sha512_ret(in, inlen, out, 0);
122211
#else
123212
return mbedtls_sha512(in, inlen, out, 0);
124213
#endif /* MBEDTLS_2_X_COMPAT */
214+
#endif /* !MBEDTLS_PSA_CRYPTO */
125215
}

0 commit comments

Comments
 (0)