Skip to content

Commit e7c2630

Browse files
Vge0rgerlubos
Vge0rge
authored and
rlubos
committed
nrf_security: Use the PSA operation cipher context and key in Cracen SW
Make sure that you use the blkcipher context and the key already existed in the PSA cipher operation intead of allocating new ones in the stack. Also add a blkcipher operation in the CMAC context for the PSA CMAC software driver in Cracen for consistency. Signed-off-by: Georgios Vasilakis <[email protected]>
1 parent b971116 commit e7c2630

File tree

6 files changed

+64
-61
lines changed

6 files changed

+64
-61
lines changed

‎subsys/nrf_security/src/drivers/cracen/cracen_sw/include/cracen_sw_common.h‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
* This function is designed for CRACEN software workarounds that need
1818
* AES-ECB encryption functionality.
1919
*
20+
* @param blkciph The block cipher struct.
2021
* @param key The AES key reference.
2122
* @param input Pointer to the input block.
2223
* @param input_length Length of the input block.
@@ -26,15 +27,16 @@
2627
*
2728
* @retval psa_status_t PSA_SUCCESS on success, error code otherwise.
2829
*/
29-
psa_status_t cracen_aes_ecb_encrypt(const struct sxkeyref *key, const uint8_t *input,
30-
size_t input_length, uint8_t *output, size_t output_size,
31-
size_t *output_length);
30+
psa_status_t cracen_aes_ecb_encrypt(struct sxblkcipher *blkciph, const struct sxkeyref *key,
31+
const uint8_t *input, size_t input_length, uint8_t *output,
32+
size_t output_size, size_t *output_length);
3233

3334
/** @brief Decrypt a single AES block using ECB mode.
3435
*
3536
* This function is designed for CRACEN software workarounds that need
3637
* AES-ECB decryption functionality.
3738
*
39+
* @param blkciph The block cipher struct.
3840
* @param key The AES key reference.
3941
* @param input Pointer to the input block.
4042
* @param input_length Length of the input block.
@@ -44,22 +46,23 @@ psa_status_t cracen_aes_ecb_encrypt(const struct sxkeyref *key, const uint8_t *i
4446
*
4547
* @retval psa_status_t PSA_SUCCESS on success, error code otherwise.
4648
*/
47-
psa_status_t cracen_aes_ecb_decrypt(const struct sxkeyref *key, const uint8_t *input,
48-
size_t input_length, uint8_t *output, size_t output_size,
49-
size_t *output_length);
49+
psa_status_t cracen_aes_ecb_decrypt(struct sxblkcipher *blkciph, const struct sxkeyref *key,
50+
const uint8_t *input, size_t input_length, uint8_t *output,
51+
size_t output_size, size_t *output_length);
5052

5153
/** @brief Perform a single AES block encryption operation.
5254
*
5355
* This function is designed for use as an AES primitive in CRACEN software workarounds that require
5456
* it.
5557
*
58+
* @param blkciph The block cipher struct.
5659
* @param key The AES key reference.
5760
* @param input Pointer to the input block.
5861
* @param output Pointer to a 16-byte output buffer.
5962
*
6063
* @retval psa_status_t PSA_SUCCESS on success, error code otherwise.
6164
*/
62-
psa_status_t cracen_aes_primitive(const struct sxkeyref *key, const uint8_t *input,
63-
uint8_t *output);
65+
psa_status_t cracen_aes_primitive(struct sxblkcipher *blkciph, const struct sxkeyref *key,
66+
const uint8_t *input, uint8_t *output);
6467

6568
#endif /* CRACEN_SW_COMMON_H */

‎subsys/nrf_security/src/drivers/cracen/cracen_sw/src/cracen_sw_aes_ctr.c‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -130,8 +130,8 @@ psa_status_t cracen_sw_aes_ctr_update(cracen_cipher_operation_t *operation, cons
130130

131131
memcpy(current_ctr, operation->iv, SX_BLKCIPHER_AES_BLK_SZ);
132132

133-
status = cracen_aes_primitive(&operation->keyref, current_ctr,
134-
keystream_block);
133+
status = cracen_aes_primitive(&operation->cipher, &operation->keyref,
134+
current_ctr, keystream_block);
135135
if (status != PSA_SUCCESS) {
136136
return status;
137137
}

‎subsys/nrf_security/src/drivers/cracen/cracen_sw/src/cracen_sw_cipher.c‎

Lines changed: 28 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -264,25 +264,23 @@ psa_status_t cracen_cipher_encrypt(const psa_key_attributes_t *attributes,
264264
}
265265

266266
if (IS_ENABLED(PSA_NEED_CRACEN_ECB_NO_PADDING_AES) && alg == PSA_ALG_ECB_NO_PADDING) {
267-
struct sxkeyref key;
268-
269-
status = cracen_load_keyref(attributes, key_buffer, key_buffer_size, &key);
267+
status = cracen_load_keyref(attributes, key_buffer, key_buffer_size,
268+
&operation.keyref);
270269
if (status != PSA_SUCCESS) {
271270
return status;
272271
}
273-
return cracen_aes_ecb_encrypt(&key, input, input_length, output, output_size,
274-
output_length);
272+
return cracen_aes_ecb_encrypt(&operation.cipher, &operation.keyref, input,
273+
input_length, output, output_size, output_length);
275274
}
276275

277276
if (IS_ENABLED(PSA_NEED_CRACEN_CBC_PKCS7_AES) && alg == PSA_ALG_CBC_PKCS7) {
278-
struct sxkeyref key;
279-
280-
status = cracen_load_keyref(attributes, key_buffer, key_buffer_size, &key);
277+
status = cracen_load_keyref(attributes, key_buffer, key_buffer_size,
278+
&operation.keyref);
281279
if (status != PSA_SUCCESS) {
282280
return status;
283281
}
284-
return encrypt_cbc(&key, input, input_length, output, output_size, output_length,
285-
iv);
282+
return encrypt_cbc(&operation.keyref, input, input_length, output, output_size,
283+
output_length, iv);
286284
}
287285

288286
status = setup(CRACEN_ENCRYPT, &operation, attributes, key_buffer, key_buffer_size, alg);
@@ -328,25 +326,23 @@ psa_status_t cracen_cipher_decrypt(const psa_key_attributes_t *attributes,
328326
}
329327

330328
if (IS_ENABLED(PSA_NEED_CRACEN_ECB_NO_PADDING_AES) && alg == PSA_ALG_ECB_NO_PADDING) {
331-
struct sxkeyref key;
332-
333-
status = cracen_load_keyref(attributes, key_buffer, key_buffer_size, &key);
329+
status = cracen_load_keyref(attributes, key_buffer, key_buffer_size,
330+
&operation.keyref);
334331
if (status != PSA_SUCCESS) {
335332
return status;
336333
}
337-
return cracen_aes_ecb_decrypt(&key, input, input_length, output, output_size,
338-
output_length);
334+
return cracen_aes_ecb_decrypt(&operation.cipher, &operation.keyref, input,
335+
input_length, output, output_size, output_length);
339336
}
340337

341338
if (IS_ENABLED(PSA_NEED_CRACEN_CBC_PKCS7_AES) && alg == PSA_ALG_CBC_PKCS7) {
342-
struct sxkeyref key;
343-
344-
status = cracen_load_keyref(attributes, key_buffer, key_buffer_size, &key);
339+
status = cracen_load_keyref(attributes, key_buffer, key_buffer_size,
340+
&operation.keyref);
345341
if (status != PSA_SUCCESS) {
346342
return status;
347343
}
348-
return decrypt_cbc(&key, input + iv_size, input_length - iv_size, output,
349-
output_size, output_length, input);
344+
return decrypt_cbc(&operation.keyref, input + iv_size, input_length - iv_size,
345+
output, output_size, output_length, input);
350346
}
351347

352348
if (input_length < iv_size) {
@@ -573,13 +569,13 @@ psa_status_t cracen_cipher_update(cracen_cipher_operation_t *operation, const ui
573569
operation->blk_size);
574570
if (operation->dir == CRACEN_ENCRYPT) {
575571
psa_status = cracen_aes_ecb_encrypt(
576-
&operation->keyref,
572+
&operation->cipher, &operation->keyref,
577573
operation->unprocessed_input,
578574
operation->unprocessed_input_bytes, output,
579575
output_size, output_length);
580576
} else {
581577
psa_status = cracen_aes_ecb_decrypt(
582-
&operation->keyref,
578+
&operation->cipher, &operation->keyref,
583579
operation->unprocessed_input,
584580
operation->unprocessed_input_bytes, output,
585581
output_size, output_length);
@@ -594,12 +590,14 @@ psa_status_t cracen_cipher_update(cracen_cipher_operation_t *operation, const ui
594590
if (block_bytes) {
595591
if (operation->dir == CRACEN_ENCRYPT) {
596592
psa_status = cracen_aes_ecb_encrypt(
597-
&operation->keyref, input, block_bytes,
598-
output, output_size, output_length);
593+
&operation->cipher, &operation->keyref,
594+
input, block_bytes, output, output_size,
595+
output_length);
599596
} else {
600597
psa_status = cracen_aes_ecb_decrypt(
601-
&operation->keyref, input, block_bytes,
602-
output, output_size, output_length);
598+
&operation->cipher, &operation->keyref,
599+
input, block_bytes, output, output_size,
600+
output_length);
603601
}
604602
if (psa_status != PSA_SUCCESS) {
605603
return psa_status;
@@ -707,12 +705,14 @@ psa_status_t cracen_cipher_finish(cracen_cipher_operation_t *operation, uint8_t
707705
if (IS_ENABLED(PSA_NEED_CRACEN_ECB_NO_PADDING_AES)) {
708706
if (operation->alg == PSA_ALG_ECB_NO_PADDING) {
709707
if (operation->dir == CRACEN_ENCRYPT) {
710-
return cracen_aes_ecb_encrypt(&operation->keyref,
708+
return cracen_aes_ecb_encrypt(&operation->cipher,
709+
&operation->keyref,
711710
operation->unprocessed_input,
712711
operation->unprocessed_input_bytes,
713712
output, output_size, output_length);
714713
} else {
715-
return cracen_aes_ecb_decrypt(&operation->keyref,
714+
return cracen_aes_ecb_decrypt(&operation->cipher,
715+
&operation->keyref,
716716
operation->unprocessed_input,
717717
operation->unprocessed_input_bytes,
718718
output, output_size, output_length);

‎subsys/nrf_security/src/drivers/cracen/cracen_sw/src/cracen_sw_common.c‎

Lines changed: 14 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -37,12 +37,11 @@ psa_status_t cracen_aes_ecb_crypt(struct sxblkcipher *blkciph,
3737
return sx_status;
3838
}
3939

40-
psa_status_t cracen_aes_ecb_encrypt(const struct sxkeyref *key, const uint8_t *input,
41-
size_t input_length, uint8_t *output, size_t output_size,
42-
size_t *output_length)
40+
psa_status_t cracen_aes_ecb_encrypt(struct sxblkcipher *blkciph, const struct sxkeyref *key,
41+
const uint8_t *input, size_t input_length, uint8_t *output,
42+
size_t output_size, size_t *output_length)
4343
{
4444
int sx_status;
45-
struct sxblkcipher blkciph;
4645

4746
if (output_size < input_length) {
4847
return PSA_ERROR_BUFFER_TOO_SMALL;
@@ -52,21 +51,20 @@ psa_status_t cracen_aes_ecb_encrypt(const struct sxkeyref *key, const uint8_t *i
5251
return PSA_ERROR_INVALID_ARGUMENT;
5352
}
5453

55-
sx_status = sx_blkcipher_create_aesecb_enc(&blkciph, key);
54+
sx_status = sx_blkcipher_create_aesecb_enc(blkciph, key);
5655
if (sx_status != SX_OK) {
5756
return silex_statuscodes_to_psa(sx_status);
5857
}
5958

60-
return cracen_aes_ecb_crypt(&blkciph, input, input_length, output, output_size,
59+
return cracen_aes_ecb_crypt(blkciph, input, input_length, output, output_size,
6160
output_length);
6261
}
6362

64-
psa_status_t cracen_aes_ecb_decrypt(const struct sxkeyref *key, const uint8_t *input,
65-
size_t input_length, uint8_t *output, size_t output_size,
66-
size_t *output_length)
63+
psa_status_t cracen_aes_ecb_decrypt(struct sxblkcipher *blkciph, const struct sxkeyref *key,
64+
const uint8_t *input, size_t input_length, uint8_t *output,
65+
size_t output_size, size_t *output_length)
6766
{
6867
int sx_status;
69-
struct sxblkcipher blkciph;
7068

7169
if (output_size < input_length) {
7270
return PSA_ERROR_BUFFER_TOO_SMALL;
@@ -76,26 +74,26 @@ psa_status_t cracen_aes_ecb_decrypt(const struct sxkeyref *key, const uint8_t *i
7674
return PSA_ERROR_INVALID_ARGUMENT;
7775
}
7876

79-
sx_status = sx_blkcipher_create_aesecb_dec(&blkciph, key);
77+
sx_status = sx_blkcipher_create_aesecb_dec(blkciph, key);
8078
if (sx_status != SX_OK) {
8179
return silex_statuscodes_to_psa(sx_status);
8280
}
8381

84-
return cracen_aes_ecb_crypt(&blkciph, input, input_length, output, output_size,
82+
return cracen_aes_ecb_crypt(blkciph, input, input_length, output, output_size,
8583
output_length);
8684
}
8785

88-
psa_status_t cracen_aes_primitive(const struct sxkeyref *key, const uint8_t *input, uint8_t *output)
86+
psa_status_t cracen_aes_primitive(struct sxblkcipher *blkciph, const struct sxkeyref *key,
87+
const uint8_t *input, uint8_t *output)
8988
{
9089
int sx_status;
91-
struct sxblkcipher blkciph;
9290
size_t output_size;
9391

94-
sx_status = sx_blkcipher_create_aesecb_enc(&blkciph, key);
92+
sx_status = sx_blkcipher_create_aesecb_enc(blkciph, key);
9593
if (sx_status != SX_OK) {
9694
return silex_statuscodes_to_psa(sx_status);
9795
}
9896

99-
return cracen_aes_ecb_crypt(&blkciph, input, SX_BLKCIPHER_AES_BLK_SZ, output,
97+
return cracen_aes_ecb_crypt(blkciph, input, SX_BLKCIPHER_AES_BLK_SZ, output,
10098
SX_BLKCIPHER_AES_BLK_SZ, &output_size);
10199
}

‎subsys/nrf_security/src/drivers/cracen/cracen_sw/src/cracen_sw_mac_cmac.c‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,8 @@ psa_status_t cracen_cmac_derive_subkeys(cracen_mac_operation_t *operation, uint8
6767
{
6868
uint8_t empty_block[SX_BLKCIPHER_AES_BLK_SZ] = {0};
6969
uint8_t L[SX_BLKCIPHER_AES_BLK_SZ]; /* L is defined in RFC 4493 */
70-
psa_status_t status = cracen_aes_primitive(&operation->cmac.keyref, empty_block, L);
70+
psa_status_t status = cracen_aes_primitive(&operation->cmac.cipher, &operation->cmac.keyref,
71+
empty_block, L);
7172

7273
if (status != PSA_SUCCESS) {
7374
return status;
@@ -111,9 +112,9 @@ psa_status_t cracen_sw_cmac_update(cracen_mac_operation_t *operation, const uint
111112
cracen_xorbytes(operation->cmac.sw_ctx.mac_state,
112113
operation->cmac.sw_ctx.partial_block,
113114
SX_BLKCIPHER_AES_BLK_SZ);
114-
psa_status = cracen_aes_primitive(&operation->cmac.keyref,
115-
operation->cmac.sw_ctx.mac_state,
116-
operation->cmac.sw_ctx.mac_state);
115+
psa_status = cracen_aes_primitive(
116+
&operation->cmac.cipher, &operation->cmac.keyref,
117+
operation->cmac.sw_ctx.mac_state, operation->cmac.sw_ctx.mac_state);
117118
if (psa_status != PSA_SUCCESS) {
118119
return psa_status;
119120
}
@@ -152,9 +153,9 @@ psa_status_t cracen_sw_cmac_finish(cracen_mac_operation_t *operation)
152153
/* Final MAC: encrypt (mac_state XOR last_block) */
153154
cracen_xorbytes(operation->cmac.sw_ctx.mac_state, last_block, SX_BLKCIPHER_AES_BLK_SZ);
154155

155-
psa_status =
156-
cracen_aes_primitive(&operation->cmac.keyref, operation->cmac.sw_ctx.mac_state,
157-
operation->cmac.sw_ctx.mac_state);
156+
psa_status = cracen_aes_primitive(&operation->cmac.cipher, &operation->cmac.keyref,
157+
operation->cmac.sw_ctx.mac_state,
158+
operation->cmac.sw_ctx.mac_state);
158159
if (psa_status != PSA_SUCCESS) {
159160
return psa_status;
160161
}

‎subsys/nrf_security/src/drivers/cracen/cracenpsa/include/cracen_psa_primitives.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -220,6 +220,7 @@ struct cracen_mac_operation_s {
220220
uint8_t key_buffer[CRACEN_MAX_AES_KEY_SIZE];
221221
#if defined(CONFIG_CRACEN_NEED_MULTIPART_WORKAROUNDS)
222222
cracen_cmac_context_t sw_ctx;
223+
struct sxblkcipher cipher;
223224
#endif /* CONFIG_CRACEN_NEED_MULTIPART_WORKAROUNDS */
224225
} cmac;
225226
#endif /* PSA_NEED_CRACEN_CMAC */

0 commit comments

Comments
 (0)