Skip to content

Commit c31079d

Browse files
mahavirjmahavirj
committed
feat(libsodium): add support for PSA crypto APIs
1 parent c32c9a2 commit c31079d

File tree

2 files changed

+168
-4
lines changed

2 files changed

+168
-4
lines changed

‎libsodium/port/crypto_hash_mbedtls/crypto_hash_sha256_mbedtls.c‎

Lines changed: 84 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* SPDX-FileCopyrightText: 2017-2021 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2017-2026 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
@@ -16,10 +16,22 @@
1616
#endif /* MBEDTLS_ALLOW_PRIVATE_ACCESS */
1717
#endif /* !(MBEDTLS_VERSION_NUMBER < 0x03000000) */
1818

19+
/* For MbedTLS 4.x support using PSA Crypto */
20+
#if (MBEDTLS_VERSION_NUMBER >= 0x04000000)
21+
#define MBEDTLS_PSA_CRYPTO
22+
#endif
23+
1924
#include "crypto_hash_sha256.h"
20-
#include "mbedtls/sha256.h"
25+
#include <assert.h>
2126
#include <string.h>
2227

28+
#ifdef MBEDTLS_PSA_CRYPTO
29+
#include "psa/crypto.h"
30+
#else
31+
#include "mbedtls/sha256.h"
32+
#endif
33+
34+
#ifndef MBEDTLS_PSA_CRYPTO
2335
#ifdef MBEDTLS_SHA256_ALT
2436
/* Wrapper only works if the libsodium context structure can be mapped
2537
directly to the mbedTLS context structure.
@@ -61,10 +73,33 @@ static void sha256_libsodium_to_mbedtls(mbedtls_sha256_context *mb_ctx, crypto_h
6173
memcpy(mb_ctx->buffer, ls_state->buf, sizeof(mb_ctx->buffer));
6274
mb_ctx->is224 = 0;
6375
}
76+
#endif /* !MBEDTLS_PSA_CRYPTO */
6477

6578
int
6679
crypto_hash_sha256_init(crypto_hash_sha256_state *state)
6780
{
81+
#ifdef MBEDTLS_PSA_CRYPTO
82+
psa_status_t status;
83+
psa_hash_operation_t *operation;
84+
85+
/* Store PSA hash operation in the state buffer
86+
* The libsodium state structure is large enough to hold psa_hash_operation_t.
87+
* Ensure this is safe with respect to both size and alignment.
88+
*/
89+
_Static_assert(sizeof(crypto_hash_sha256_state) >= sizeof(psa_hash_operation_t),
90+
"crypto_hash_sha256_state too small for psa_hash_operation_t");
91+
_Static_assert(_Alignof(crypto_hash_sha256_state) >= _Alignof(psa_hash_operation_t),
92+
"crypto_hash_sha256_state alignment insufficient for psa_hash_operation_t");
93+
memset(state, 0, sizeof(*state));
94+
operation = (psa_hash_operation_t *)state;
95+
*operation = psa_hash_operation_init();
96+
97+
status = psa_hash_setup(operation, PSA_ALG_SHA_256);
98+
if (status != PSA_SUCCESS) {
99+
return -1;
100+
}
101+
return 0;
102+
#else
68103
mbedtls_sha256_context ctx;
69104
mbedtls_sha256_init(&ctx);
70105
#ifdef MBEDTLS_2_X_COMPAT
@@ -77,12 +112,24 @@ crypto_hash_sha256_init(crypto_hash_sha256_state *state)
77112
}
78113
sha256_mbedtls_to_libsodium(state, &ctx);
79114
return 0;
115+
#endif /* !MBEDTLS_PSA_CRYPTO */
80116
}
81117

82118
int
83119
crypto_hash_sha256_update(crypto_hash_sha256_state *state,
84120
const unsigned char *in, unsigned long long inlen)
85121
{
122+
#ifdef MBEDTLS_PSA_CRYPTO
123+
psa_hash_operation_t *operation = (psa_hash_operation_t *)state;
124+
psa_status_t status;
125+
126+
status = psa_hash_update(operation, in, inlen);
127+
if (status != PSA_SUCCESS) {
128+
psa_hash_abort(operation);
129+
return -1;
130+
}
131+
return 0;
132+
#else
86133
mbedtls_sha256_context ctx;
87134
sha256_libsodium_to_mbedtls(&ctx, state);
88135
#ifdef MBEDTLS_2_X_COMPAT
@@ -95,27 +142,62 @@ crypto_hash_sha256_update(crypto_hash_sha256_state *state,
95142
}
96143
sha256_mbedtls_to_libsodium(state, &ctx);
97144
return 0;
145+
#endif /* !MBEDTLS_PSA_CRYPTO */
98146
}
99147

100148
int
101149
crypto_hash_sha256_final(crypto_hash_sha256_state *state, unsigned char *out)
102150
{
151+
#ifdef MBEDTLS_PSA_CRYPTO
152+
psa_hash_operation_t *operation = (psa_hash_operation_t *)state;
153+
psa_status_t status;
154+
size_t hash_len;
155+
156+
status = psa_hash_finish(operation, out, crypto_hash_sha256_BYTES, &hash_len);
157+
if (status != PSA_SUCCESS) {
158+
psa_hash_abort(operation);
159+
return -1;
160+
}
161+
return 0;
162+
#else
103163
mbedtls_sha256_context ctx;
104164
sha256_libsodium_to_mbedtls(&ctx, state);
105165
#ifdef MBEDTLS_2_X_COMPAT
106166
return mbedtls_sha256_finish_ret(&ctx, out);
107167
#else
108168
return mbedtls_sha256_finish(&ctx, out);
109169
#endif /* MBEDTLS_2_X_COMPAT */
170+
#endif /* !MBEDTLS_PSA_CRYPTO */
110171
}
111172

112173
int
113174
crypto_hash_sha256(unsigned char *out, const unsigned char *in,
114175
unsigned long long inlen)
115176
{
177+
#ifdef MBEDTLS_PSA_CRYPTO
178+
psa_status_t status;
179+
size_t hash_len;
180+
181+
status = psa_hash_compute(PSA_ALG_SHA_256, in, inlen, out,
182+
crypto_hash_sha256_BYTES, &hash_len);
183+
if (status != PSA_SUCCESS) {
184+
return -1;
185+
}
186+
return 0;
187+
#else
116188
#ifdef MBEDTLS_2_X_COMPAT
117189
return mbedtls_sha256_ret(in, inlen, out, 0);
118190
#else
119191
return mbedtls_sha256(in, inlen, out, 0);
120192
#endif /* MBEDTLS_2_X_COMPAT */
193+
#endif /* !MBEDTLS_PSA_CRYPTO */
121194
}
195+
196+
#ifdef MBEDTLS_PSA_CRYPTO
197+
__attribute__((constructor)) static void crypto_psa_init_sha256(void)
198+
{
199+
/* Ensure PSA is initialized */
200+
psa_status_t status = psa_crypto_init();
201+
assert(status == PSA_SUCCESS);
202+
}
203+
#endif

‎libsodium/port/crypto_hash_mbedtls/crypto_hash_sha512_mbedtls.c‎

Lines changed: 84 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* SPDX-FileCopyrightText: 2017-2021 Espressif Systems (Shanghai) CO LTD
2+
* SPDX-FileCopyrightText: 2017-2026 Espressif Systems (Shanghai) CO LTD
33
*
44
* SPDX-License-Identifier: Apache-2.0
55
*/
@@ -16,10 +16,22 @@
1616
#endif /* MBEDTLS_ALLOW_PRIVATE_ACCESS */
1717
#endif /* !(MBEDTLS_VERSION_NUMBER < 0x03000000) */
1818

19+
/* For MbedTLS 4.x support using PSA crypto */
20+
#if (MBEDTLS_VERSION_NUMBER >= 0x04000000)
21+
#define MBEDTLS_PSA_CRYPTO
22+
#endif
23+
1924
#include "crypto_hash_sha512.h"
20-
#include "mbedtls/sha512.h"
25+
#include <assert.h>
2126
#include <string.h>
2227

28+
#ifdef MBEDTLS_PSA_CRYPTO
29+
#include "psa/crypto.h"
30+
#else
31+
#include "mbedtls/sha512.h"
32+
#endif
33+
34+
#ifndef MBEDTLS_PSA_CRYPTO
2335
#ifdef MBEDTLS_SHA512_ALT
2436
/* Wrapper only works if the libsodium context structure can be mapped
2537
directly to the mbedTLS context structure.
@@ -65,10 +77,33 @@ static void sha512_libsodium_to_mbedtls(mbedtls_sha512_context *mb_ctx, crypto_h
6577
memcpy(mb_ctx->buffer, ls_state->buf, sizeof(mb_ctx->buffer));
6678
mb_ctx->is384 = 0;
6779
}
80+
#endif /* !MBEDTLS_PSA_CRYPTO */
6881

6982
int
7083
crypto_hash_sha512_init(crypto_hash_sha512_state *state)
7184
{
85+
#ifdef MBEDTLS_PSA_CRYPTO
86+
psa_status_t status;
87+
psa_hash_operation_t *operation;
88+
89+
/* Store PSA hash operation in the state buffer
90+
* The libsodium state structure is large enough to hold psa_hash_operation_t.
91+
* Ensure this is safe with respect to both size and alignment.
92+
*/
93+
_Static_assert(sizeof(crypto_hash_sha512_state) >= sizeof(psa_hash_operation_t),
94+
"crypto_hash_sha512_state too small for psa_hash_operation_t");
95+
_Static_assert(_Alignof(crypto_hash_sha512_state) >= _Alignof(psa_hash_operation_t),
96+
"crypto_hash_sha512_state alignment insufficient for psa_hash_operation_t");
97+
memset(state, 0, sizeof(*state));
98+
operation = (psa_hash_operation_t *)state;
99+
*operation = psa_hash_operation_init();
100+
101+
status = psa_hash_setup(operation, PSA_ALG_SHA_512);
102+
if (status != PSA_SUCCESS) {
103+
return -1;
104+
}
105+
return 0;
106+
#else
72107
mbedtls_sha512_context ctx;
73108
mbedtls_sha512_init(&ctx);
74109
#ifdef MBEDTLS_2_X_COMPAT
@@ -81,12 +116,24 @@ crypto_hash_sha512_init(crypto_hash_sha512_state *state)
81116
}
82117
sha512_mbedtls_to_libsodium(state, &ctx);
83118
return 0;
119+
#endif /* !MBEDTLS_PSA_CRYPTO */
84120
}
85121

86122
int
87123
crypto_hash_sha512_update(crypto_hash_sha512_state *state,
88124
const unsigned char *in, unsigned long long inlen)
89125
{
126+
#ifdef MBEDTLS_PSA_CRYPTO
127+
psa_hash_operation_t *operation = (psa_hash_operation_t *)state;
128+
psa_status_t status;
129+
130+
status = psa_hash_update(operation, in, inlen);
131+
if (status != PSA_SUCCESS) {
132+
psa_hash_abort(operation);
133+
return -1;
134+
}
135+
return 0;
136+
#else
90137
mbedtls_sha512_context ctx;
91138
sha512_libsodium_to_mbedtls(&ctx, state);
92139
#ifdef MBEDTLS_2_X_COMPAT
@@ -99,27 +146,62 @@ crypto_hash_sha512_update(crypto_hash_sha512_state *state,
99146
}
100147
sha512_mbedtls_to_libsodium(state, &ctx);
101148
return 0;
149+
#endif /* !MBEDTLS_PSA_CRYPTO */
102150
}
103151

104152
int
105153
crypto_hash_sha512_final(crypto_hash_sha512_state *state, unsigned char *out)
106154
{
155+
#ifdef MBEDTLS_PSA_CRYPTO
156+
psa_hash_operation_t *operation = (psa_hash_operation_t *)state;
157+
psa_status_t status;
158+
size_t hash_len;
159+
160+
status = psa_hash_finish(operation, out, crypto_hash_sha512_BYTES, &hash_len);
161+
if (status != PSA_SUCCESS) {
162+
psa_hash_abort(operation);
163+
return -1;
164+
}
165+
return 0;
166+
#else
107167
mbedtls_sha512_context ctx;
108168
sha512_libsodium_to_mbedtls(&ctx, state);
109169
#ifdef MBEDTLS_2_X_COMPAT
110170
return mbedtls_sha512_finish_ret(&ctx, out);
111171
#else
112172
return mbedtls_sha512_finish(&ctx, out);
113173
#endif /* MBEDTLS_2_X_COMPAT */
174+
#endif /* !MBEDTLS_PSA_CRYPTO */
114175
}
115176

116177
int
117178
crypto_hash_sha512(unsigned char *out, const unsigned char *in,
118179
unsigned long long inlen)
119180
{
181+
#ifdef MBEDTLS_PSA_CRYPTO
182+
psa_status_t status;
183+
size_t hash_len;
184+
185+
status = psa_hash_compute(PSA_ALG_SHA_512, in, inlen, out,
186+
crypto_hash_sha512_BYTES, &hash_len);
187+
if (status != PSA_SUCCESS) {
188+
return -1;
189+
}
190+
return 0;
191+
#else
120192
#ifdef MBEDTLS_2_X_COMPAT
121193
return mbedtls_sha512_ret(in, inlen, out, 0);
122194
#else
123195
return mbedtls_sha512(in, inlen, out, 0);
124196
#endif /* MBEDTLS_2_X_COMPAT */
197+
#endif /* !MBEDTLS_PSA_CRYPTO */
125198
}
199+
200+
#ifdef MBEDTLS_PSA_CRYPTO
201+
__attribute__((constructor)) static void crypto_psa_init_sha512(void)
202+
{
203+
/* Ensure PSA is initialized */
204+
psa_status_t status = psa_crypto_init();
205+
assert(status == PSA_SUCCESS);
206+
}
207+
#endif

0 commit comments

Comments
 (0)