crypt/wolfssl
1
0
Fork 0
mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-10-24 04:09:07 +03:00
Code Activity
Files
master
wolfssl/tests/swdev/swdev.c
Paul Adelsbach 94b375ec9d Tests: add Falcon to swdev for crypto cb testing
2026-10-21 17:13:12 -07:00

2486 lines
73 KiB
C
Raw Permalink Blame History

/* swdev.c
*
* Copyright (C) 2006-2026 wolfSSL Inc.
*
* This file is part of wolfSSL.
*
* wolfSSL is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 3 of the License, or
* (at your option) any later version.
*
* wolfSSL is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
*/
/* wc_swdev callback. */
#include "swdev.h"
#include <wolfssl/wolfcrypt/settings.h>
#include <wolfssl/wolfcrypt/types.h>
#include <wolfssl/wolfcrypt/error-crypt.h>
#include <wolfssl/wolfcrypt/wc_port.h>
#ifndef NO_RSA
#include <wolfssl/wolfcrypt/rsa.h>
#endif
#ifdef HAVE_ECC
#include <wolfssl/wolfcrypt/ecc.h>
#endif
#ifndef NO_SHA256
#include <wolfssl/wolfcrypt/sha256.h>
#endif
#ifndef NO_AES
#include <wolfssl/wolfcrypt/aes.h>
#endif
#ifdef HAVE_ED25519
#include <wolfssl/wolfcrypt/ed25519.h>
#endif
#ifdef HAVE_CURVE25519
#include <wolfssl/wolfcrypt/curve25519.h>
#endif
#ifdef HAVE_CURVE448
#include <wolfssl/wolfcrypt/curve448.h>
#endif
#ifdef HAVE_ED448
#include <wolfssl/wolfcrypt/ed448.h>
#endif
#ifdef WOLFSSL_HAVE_SLHDSA
#include <wolfssl/wolfcrypt/wc_slhdsa.h>
#endif
#ifdef HAVE_FALCON
#include <wolfssl/wolfcrypt/falcon.h>
#endif
#ifdef WOLFSSL_HAVE_MLKEM
#include <wolfssl/wolfcrypt/wc_mlkem.h>
#endif
#ifdef WOLFSSL_HAVE_FRODOKEM
#include <wolfssl/wolfcrypt/wc_frodokem.h>
#endif
static int swdev_initialized = 0;
static int swdev_ensure_init(void)
{
if (!swdev_initialized) {
int ret = wolfCrypt_Init();
if (ret != 0)
return ret;
swdev_initialized = 1;
}
return 0;
}
#if defined(WOLFSSL_HAVE_LMS) || defined(WOLFSSL_HAVE_XMSS)
static void swdev_stateful_cleanup(void);
#endif
WC_SWDEV_EXPORT void wc_SwDev_InternalCleanup(void)
{
#if defined(WOLFSSL_HAVE_LMS) || defined(WOLFSSL_HAVE_XMSS)
swdev_stateful_cleanup();
#endif
if (swdev_initialized) {
wolfCrypt_Cleanup();
swdev_initialized = 0;
}
}
#ifndef NO_RSA
static int swdev_rsa(wc_CryptoInfo* info)
{
switch (info->pk.rsa.type) {
case RSA_PUBLIC_ENCRYPT:
case RSA_PUBLIC_DECRYPT:
case RSA_PRIVATE_ENCRYPT:
case RSA_PRIVATE_DECRYPT:
return wc_RsaFunction(info->pk.rsa.in, info->pk.rsa.inLen,
info->pk.rsa.out, info->pk.rsa.outLen, info->pk.rsa.type,
info->pk.rsa.key, info->pk.rsa.rng);
default:
return CRYPTOCB_UNAVAILABLE;
}
}
#ifdef WOLFSSL_KEY_GEN
static int swdev_rsa_keygen(wc_CryptoInfo* info)
{
return wc_MakeRsaKey(info->pk.rsakg.key, info->pk.rsakg.size,
info->pk.rsakg.e, info->pk.rsakg.rng);
}
#endif
#endif /* !NO_RSA */
#ifdef HAVE_ECC
static int swdev_ecc_keygen(wc_CryptoInfo* info)
{
#ifdef HAVE_ECC_DHE
return wc_ecc_make_key_ex(info->pk.eckg.rng, info->pk.eckg.size,
info->pk.eckg.key, info->pk.eckg.curveId);
#else
(void)info;
return CRYPTOCB_UNAVAILABLE;
#endif
}
static int swdev_ecdh(wc_CryptoInfo* info)
{
#ifdef HAVE_ECC_DHE
return wc_ecc_shared_secret(info->pk.ecdh.private_key,
info->pk.ecdh.public_key, info->pk.ecdh.out,
info->pk.ecdh.outlen);
#else
(void)info;
return CRYPTOCB_UNAVAILABLE;
#endif
}
static int swdev_ecc_sign(wc_CryptoInfo* info)
{
#ifdef HAVE_ECC_SIGN
return wc_ecc_sign_hash(info->pk.eccsign.in, info->pk.eccsign.inlen,
info->pk.eccsign.out, info->pk.eccsign.outlen,
info->pk.eccsign.rng, info->pk.eccsign.key);
#else
(void)info;
return CRYPTOCB_UNAVAILABLE;
#endif
}
static int swdev_ecc_verify(wc_CryptoInfo* info)
{
#ifdef HAVE_ECC_VERIFY
return wc_ecc_verify_hash(info->pk.eccverify.sig,
info->pk.eccverify.siglen, info->pk.eccverify.hash,
info->pk.eccverify.hashlen, info->pk.eccverify.res,
info->pk.eccverify.key);
#else
(void)info;
return CRYPTOCB_UNAVAILABLE;
#endif
}
static int swdev_ecc_get_size(wc_CryptoInfo* info)
{
int sz = wc_ecc_size((ecc_key*)info->pk.ecc_get_size.key);
if (sz <= 0)
return sz; /* propagate negative error */
*info->pk.ecc_get_size.keySize = sz;
return 0;
}
static int swdev_ecc_get_sig_size(wc_CryptoInfo* info)
{
int sz = wc_ecc_sig_size(info->pk.ecc_get_sig_size.key);
if (sz <= 0)
return sz;
*info->pk.ecc_get_sig_size.sigSize = sz;
return 0;
}
static int swdev_ecc_make_pub(wc_CryptoInfo* info)
{
int ret;
ecc_key* key = info->pk.ecc_make_pub.key;
ecc_point* pub = wc_ecc_new_point_h(key->heap);
if (pub == NULL)
return MEMORY_E;
/* derive Q = d*G in software, then emit X9.63 uncompressed bytes. The
* point is serialized with the curve size from key->dp so custom-curve
* keys (idx == ECC_CUSTOM_IDX) work too; wc_ecc_export_point_der rejects
* negative curve indices. */
ret = wc_ecc_make_pub(key, pub);
if (ret == 0) {
byte* out = info->pk.ecc_make_pub.pubOut;
word32 curveSz = (word32)key->dp->size;
word32 ptSz = 1 + 2 * curveSz;
word32 xSz = curveSz;
word32 ySz = curveSz;
if (*info->pk.ecc_make_pub.pubOutSz < ptSz) {
ret = BUFFER_E;
}
else {
out[0] = ECC_POINT_UNCOMP;
ret = wc_export_int(pub->x, out + 1, &xSz, curveSz,
WC_TYPE_UNSIGNED_BIN);
if (ret == MP_OKAY)
ret = wc_export_int(pub->y, out + 1 + curveSz, &ySz, curveSz,
WC_TYPE_UNSIGNED_BIN);
if (ret == MP_OKAY)
*info->pk.ecc_make_pub.pubOutSz = ptSz;
}
}
wc_ecc_del_point_h(pub, key->heap);
return ret;
}
#ifdef HAVE_ECC_CHECK_KEY
static int swdev_ecc_check_pub(wc_CryptoInfo* info)
{
ecc_key* key = info->pk.ecc_check_pub.key;
int ret = 0;
int validatedFromWire = 0;
if (info->pk.ecc_check_pub.pubKeySz == 0) {
return ECC_INF_E;
}
#ifdef HAVE_ECC_KEY_IMPORT
if (key->idx >= 0) {
WC_DECLARE_VAR(pubOnly, ecc_key, 1, key->heap);
WC_ALLOC_VAR(pubOnly, ecc_key, 1, key->heap);
if (!WC_VAR_OK(pubOnly))
ret = MEMORY_E;
else
ret = wc_ecc_init_ex(pubOnly, key->heap, INVALID_DEVID);
if (ret == 0) {
ret = wc_ecc_import_x963_ex(info->pk.ecc_check_pub.pubKey,
info->pk.ecc_check_pub.pubKeySz, pubOnly, key->dp->id);
if (ret == 0 &&
wc_ecc_cmp_point(&pubOnly->pubkey, &key->pubkey) != MP_EQ) {
/* wire bytes disagree with key->pubkey */
ret = BAD_STATE_E;
}
if (ret == 0)
ret = wc_ecc_check_key(pubOnly);
wc_ecc_free(pubOnly);
}
WC_FREE_VAR(pubOnly, key->heap);
validatedFromWire = 1;
}
#endif
if (ret == 0 && (!validatedFromWire ||
(info->pk.ecc_check_pub.checkPriv &&
key->type == ECC_PRIVATEKEY))) {
ret = wc_ecc_check_key(key);
}
return ret;
}
#endif /* HAVE_ECC_CHECK_KEY */
#endif /* HAVE_ECC */
#ifdef HAVE_ED25519
#ifdef HAVE_ED25519_MAKE_KEY
static int swdev_ed25519_keygen(wc_CryptoInfo* info)
{
return wc_ed25519_make_key(info->pk.ed25519kg.rng,
info->pk.ed25519kg.size, info->pk.ed25519kg.key);
}
#endif
#ifdef HAVE_ED25519_SIGN
static int swdev_ed25519_sign(wc_CryptoInfo* info)
{
return wc_ed25519_sign_msg_ex(info->pk.ed25519sign.in,
info->pk.ed25519sign.inLen, info->pk.ed25519sign.out,
info->pk.ed25519sign.outLen, info->pk.ed25519sign.key,
info->pk.ed25519sign.type, info->pk.ed25519sign.context,
info->pk.ed25519sign.contextLen);
}
#endif
#ifdef HAVE_ED25519_VERIFY
static int swdev_ed25519_verify(wc_CryptoInfo* info)
{
return wc_ed25519_verify_msg_ex(info->pk.ed25519verify.sig,
info->pk.ed25519verify.sigLen, info->pk.ed25519verify.msg,
info->pk.ed25519verify.msgLen, info->pk.ed25519verify.res,
info->pk.ed25519verify.key, info->pk.ed25519verify.type,
info->pk.ed25519verify.context, info->pk.ed25519verify.contextLen);
}
#endif
#ifdef HAVE_ED25519_MAKE_KEY
static int swdev_ed25519_make_pub(wc_CryptoInfo* info)
{
if (info->pk.ed25519makepub.pubOutSz != ED25519_PUB_KEY_SIZE)
return BUFFER_E;
return wc_ed25519_make_public(info->pk.ed25519makepub.key,
info->pk.ed25519makepub.pubOut, info->pk.ed25519makepub.pubOutSz);
}
#endif
static int swdev_ed25519_check_key(wc_CryptoInfo* info)
{
ed25519_key* key = info->pk.ed25519checkkey.key;
int ret = 0;
int validatedFromWire = 0;
#ifdef HAVE_ED25519_KEY_IMPORT
{
WC_DECLARE_VAR(pubOnly, ed25519_key, 1, key->heap);
/* vault-style consumption: rebuild a public-only key from the wire
* bytes and validate it, proving the serialized form is sufficient.
* trusted=0 runs the full public-key validation during import. */
WC_ALLOC_VAR(pubOnly, ed25519_key, 1, key->heap);
if (!WC_VAR_OK(pubOnly))
return MEMORY_E;
ret = wc_ed25519_init_ex(pubOnly, key->heap, INVALID_DEVID);
if (ret == 0) {
ret = wc_ed25519_import_public_ex(info->pk.ed25519checkkey.pubKey,
info->pk.ed25519checkkey.pubKeySz, pubOnly, 0);
}
wc_ed25519_free(pubOnly);
WC_FREE_VAR(pubOnly, key->heap);
validatedFromWire = 1;
}
#endif
/* private part (and public-only validation when the import path is
* unavailable): validate via the key handle */
if (ret == 0 && (!validatedFromWire ||
info->pk.ed25519checkkey.checkPriv)) {
ret = wc_ed25519_check_key(key);
}
return ret;
}
#endif /* HAVE_ED25519 */
#ifdef HAVE_ED448
#ifdef HAVE_ED448_SIGN
static int swdev_ed448_sign(wc_CryptoInfo* info)
{
return wc_ed448_sign_msg_ex(info->pk.ed448sign.in,
info->pk.ed448sign.inLen, info->pk.ed448sign.out,
info->pk.ed448sign.outLen, info->pk.ed448sign.key,
info->pk.ed448sign.type, info->pk.ed448sign.context,
info->pk.ed448sign.contextLen);
}
#endif
#ifdef HAVE_ED448_VERIFY
static int swdev_ed448_verify(wc_CryptoInfo* info)
{
return wc_ed448_verify_msg_ex(info->pk.ed448verify.sig,
info->pk.ed448verify.sigLen, info->pk.ed448verify.msg,
info->pk.ed448verify.msgLen, info->pk.ed448verify.res,
info->pk.ed448verify.key, info->pk.ed448verify.type,
info->pk.ed448verify.context, info->pk.ed448verify.contextLen);
}
#endif
static int swdev_ed448_make_pub(wc_CryptoInfo* info)
{
if (info->pk.ed448makepub.pubOutSz != ED448_PUB_KEY_SIZE)
return BUFFER_E;
return wc_ed448_make_public(info->pk.ed448makepub.key,
info->pk.ed448makepub.pubOut, info->pk.ed448makepub.pubOutSz);
}
#ifdef HAVE_ED448_KEY_IMPORT
/* Validate the public key from its wire bytes alone. */
static int swdev_ed448_check_wire(wc_CryptoInfo* info)
{
int ret;
void* heap = info->pk.ed448checkkey.key->heap;
WC_DECLARE_VAR(pubOnly, ed448_key, 1, heap);
WC_ALLOC_VAR(pubOnly, ed448_key, 1, heap);
if (!WC_VAR_OK(pubOnly))
return MEMORY_E;
ret = wc_ed448_init_ex(pubOnly, heap, INVALID_DEVID);
if (ret == 0) {
ret = wc_ed448_import_public_ex(info->pk.ed448checkkey.pubKey,
info->pk.ed448checkkey.pubKeySz, pubOnly, 0);
}
wc_ed448_free(pubOnly);
WC_FREE_VAR(pubOnly, heap);
return ret;
}
#endif
static int swdev_ed448_check_key(wc_CryptoInfo* info)
{
int ret = 0;
int validatedFromWire = 0;
#ifdef HAVE_ED448_KEY_IMPORT
ret = swdev_ed448_check_wire(info);
validatedFromWire = 1;
#endif
if (ret == 0 && (!validatedFromWire ||
info->pk.ed448checkkey.checkPriv)) {
ret = wc_ed448_check_key(info->pk.ed448checkkey.key);
}
return ret;
}
#endif /* HAVE_ED448 */
#ifdef HAVE_CURVE25519
static int swdev_curve25519_keygen(wc_CryptoInfo* info)
{
return wc_curve25519_make_key(info->pk.curve25519kg.rng,
info->pk.curve25519kg.size, info->pk.curve25519kg.key);
}
#ifdef HAVE_CURVE25519_SHARED_SECRET
static int swdev_curve25519(wc_CryptoInfo* info)
{
return wc_curve25519_shared_secret_ex(info->pk.curve25519.private_key,
info->pk.curve25519.public_key, info->pk.curve25519.out,
info->pk.curve25519.outlen, info->pk.curve25519.endian);
}
#endif /* HAVE_CURVE25519_SHARED_SECRET */
static int swdev_curve25519_make_pub(wc_CryptoInfo* info)
{
return wc_curve25519_make_pub((int)info->pk.curve25519makepub.pubSz,
info->pk.curve25519makepub.pub,
(int)info->pk.curve25519makepub.privSz,
info->pk.curve25519makepub.priv);
}
static int swdev_curve25519_generic(wc_CryptoInfo* info)
{
return wc_curve25519_generic((int)info->pk.curve25519generic.pubSz,
info->pk.curve25519generic.pub,
(int)info->pk.curve25519generic.privSz,
info->pk.curve25519generic.priv,
(int)info->pk.curve25519generic.basepointSz,
info->pk.curve25519generic.basepoint);
}
#endif /* HAVE_CURVE25519 */
#ifdef HAVE_CURVE448
static int swdev_curve448_keygen(wc_CryptoInfo* info)
{
return wc_curve448_make_key(info->pk.curve448kg.rng,
info->pk.curve448kg.size, info->pk.curve448kg.key);
}
#ifdef HAVE_CURVE448_SHARED_SECRET
static int swdev_curve448(wc_CryptoInfo* info)
{
return wc_curve448_shared_secret_ex(info->pk.curve448.private_key,
info->pk.curve448.public_key, info->pk.curve448.out,
info->pk.curve448.outlen, info->pk.curve448.endian);
}
#endif /* HAVE_CURVE448_SHARED_SECRET */
static int swdev_curve448_make_pub(wc_CryptoInfo* info)
{
return wc_curve448_make_pub((int)info->pk.curve448makepub.pubSz,
info->pk.curve448makepub.pub,
(int)info->pk.curve448makepub.privSz,
info->pk.curve448makepub.priv);
}
static int swdev_curve448_generic(wc_CryptoInfo* info)
{
return wc_curve448_generic((int)info->pk.curve448generic.pubSz,
info->pk.curve448generic.pub,
(int)info->pk.curve448generic.privSz,
info->pk.curve448generic.priv,
(int)info->pk.curve448generic.basepointSz,
info->pk.curve448generic.basepoint);
}
#endif /* HAVE_CURVE448 */
#ifdef WOLFSSL_HAVE_SLHDSA
/* Take the key over for the duration of one operation.
*
* The key handed across the callback boundary still carries the device id, so
* the software calls below would dispatch straight back into swdev. Detach it
* and hand the old value back to the caller to restore.
*
* The parent library skips deriving the SHA-2 midstates from PK.seed when the
* software implementation is stripped, so re-import the public key here to
* bring them up to date. Importing the public key only sets the public flag,
* which is already set, so it is safe for private keys too.
*/
static int swdev_slhdsa_take(SlhDsaKey* key, int* devId)
{
int ret = 0;
*devId = INVALID_DEVID;
if ((key == NULL) || (key->params == NULL))
return BAD_FUNC_ARG;
*devId = key->devId;
key->devId = INVALID_DEVID;
if ((key->flags & WC_SLHDSA_FLAG_PUBLIC) != 0) {
byte pub[2 * WC_SLHDSA_MAX_SEED];
word32 pubSz = 2U * key->params->n;
/* Stage through a local buffer: import copies into the key and the
* source would otherwise be the destination. */
XMEMCPY(pub, key->sk + 2 * key->params->n, pubSz);
ret = wc_SlhDsaKey_ImportPublic(key, pub, pubSz);
}
return ret;
}
static void swdev_slhdsa_give_back(SlhDsaKey* key, int devId)
{
if (key != NULL)
key->devId = devId;
}
#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
static int swdev_slhdsa_keygen(wc_CryptoInfo* info)
{
SlhDsaKey* key = (SlhDsaKey*)info->pk.pqc_sig_kg.key;
const byte* seed = info->pk.pqc_sig_kg.seed;
int devId;
int ret;
ret = swdev_slhdsa_take(key, &devId);
if (ret == 0) {
if (seed != NULL) {
byte n = key->params->n;
if (info->pk.pqc_sig_kg.seedSz != 3U * (word32)n) {
ret = BUFFER_E;
}
else {
ret = wc_SlhDsaKey_MakeKeyWithRandom(key, seed, n, seed + n, n,
seed + 2 * n, n);
}
}
else {
ret = wc_SlhDsaKey_MakeKey(key, info->pk.pqc_sig_kg.rng);
}
}
swdev_slhdsa_give_back(key, devId);
return ret;
}
static int swdev_slhdsa_sign(wc_CryptoInfo* info)
{
SlhDsaKey* key = (SlhDsaKey*)info->pk.pqc_sign.key;
const byte* addRnd = info->pk.pqc_sign.addRnd;
enum wc_HashType hashType = (enum wc_HashType)info->pk.pqc_sign.preHashType;
int devId;
int ret;
ret = swdev_slhdsa_take(key, &devId);
if (ret == 0) {
if (hashType == WC_HASH_TYPE_NONE) {
/* Pure SLH-DSA. */
if (addRnd != NULL) {
ret = wc_SlhDsaKey_SignWithRandom(key,
info->pk.pqc_sign.context, info->pk.pqc_sign.contextLen,
info->pk.pqc_sign.in, info->pk.pqc_sign.inlen,
info->pk.pqc_sign.out, info->pk.pqc_sign.outlen, addRnd);
}
else {
ret = wc_SlhDsaKey_Sign(key, info->pk.pqc_sign.context,
info->pk.pqc_sign.contextLen, info->pk.pqc_sign.in,
info->pk.pqc_sign.inlen, info->pk.pqc_sign.out,
info->pk.pqc_sign.outlen, info->pk.pqc_sign.rng);
}
}
else {
/* HashSLH-DSA over a caller supplied digest. */
if (addRnd != NULL) {
ret = wc_SlhDsaKey_SignHashWithRandom(key,
info->pk.pqc_sign.context, info->pk.pqc_sign.contextLen,
info->pk.pqc_sign.in, info->pk.pqc_sign.inlen, hashType,
info->pk.pqc_sign.out, info->pk.pqc_sign.outlen, addRnd);
}
else {
ret = wc_SlhDsaKey_SignHash(key, info->pk.pqc_sign.context,
info->pk.pqc_sign.contextLen, info->pk.pqc_sign.in,
info->pk.pqc_sign.inlen, hashType, info->pk.pqc_sign.out,
info->pk.pqc_sign.outlen, info->pk.pqc_sign.rng);
}
}
}
swdev_slhdsa_give_back(key, devId);
return ret;
}
static int swdev_slhdsa_sign_msg(wc_CryptoInfo* info)
{
SlhDsaKey* key = (SlhDsaKey*)info->pk.pqc_sign.key;
int devId;
int ret;
ret = swdev_slhdsa_take(key, &devId);
if (ret == 0) {
ret = wc_SlhDsaKey_SignMsgWithRandom(key, info->pk.pqc_sign.in,
info->pk.pqc_sign.inlen, info->pk.pqc_sign.out,
info->pk.pqc_sign.outlen, info->pk.pqc_sign.addRnd);
}
swdev_slhdsa_give_back(key, devId);
return ret;
}
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
static int swdev_slhdsa_verify(wc_CryptoInfo* info)
{
SlhDsaKey* key = (SlhDsaKey*)info->pk.pqc_verify.key;
enum wc_HashType hashType =
(enum wc_HashType)info->pk.pqc_verify.preHashType;
int devId;
int ret;
ret = swdev_slhdsa_take(key, &devId);
if (ret == 0) {
if (hashType == WC_HASH_TYPE_NONE) {
ret = wc_SlhDsaKey_Verify(key, info->pk.pqc_verify.context,
info->pk.pqc_verify.contextLen, info->pk.pqc_verify.msg,
info->pk.pqc_verify.msglen, info->pk.pqc_verify.sig,
info->pk.pqc_verify.siglen);
}
else {
ret = wc_SlhDsaKey_VerifyHash(key, info->pk.pqc_verify.context,
info->pk.pqc_verify.contextLen, info->pk.pqc_verify.msg,
info->pk.pqc_verify.msglen, hashType, info->pk.pqc_verify.sig,
info->pk.pqc_verify.siglen);
}
}
swdev_slhdsa_give_back(key, devId);
/* A bad signature is reported through res, not the return code. */
if (ret == WC_NO_ERR_TRACE(SIG_VERIFY_E)) {
*info->pk.pqc_verify.res = 0;
ret = 0;
}
else if (ret == 0) {
*info->pk.pqc_verify.res = 1;
}
return ret;
}
static int swdev_slhdsa_verify_msg(wc_CryptoInfo* info)
{
SlhDsaKey* key = (SlhDsaKey*)info->pk.pqc_verify.key;
int devId;
int ret;
ret = swdev_slhdsa_take(key, &devId);
if (ret == 0) {
ret = wc_SlhDsaKey_VerifyMsg(key, info->pk.pqc_verify.msg,
info->pk.pqc_verify.msglen, info->pk.pqc_verify.sig,
info->pk.pqc_verify.siglen);
}
swdev_slhdsa_give_back(key, devId);
/* A bad signature is reported through res, not the return code. */
if (ret == WC_NO_ERR_TRACE(SIG_VERIFY_E)) {
*info->pk.pqc_verify.res = 0;
ret = 0;
}
else if (ret == 0) {
*info->pk.pqc_verify.res = 1;
}
return ret;
}
#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
static int swdev_slhdsa_check_priv_key(wc_CryptoInfo* info)
{
SlhDsaKey* key = (SlhDsaKey*)info->pk.pqc_sig_check.key;
int devId;
int ret;
/* The public key travels alongside the private key data, so check the
* caller's copy agrees before recomputing the root from the seeds. */
if ((info->pk.pqc_sig_check.pubKey != NULL) &&
(info->pk.pqc_sig_check.pubKeySz != 2U * key->params->n)) {
return BUFFER_E;
}
ret = swdev_slhdsa_take(key, &devId);
if (ret == 0) {
ret = wc_SlhDsaKey_CheckKey(key);
}
swdev_slhdsa_give_back(key, devId);
return ret;
}
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
static int swdev_slhdsa(wc_CryptoInfo* info, int pkType)
{
switch (pkType) {
#ifndef WOLFSSL_SLHDSA_VERIFY_ONLY
case WC_PK_TYPE_PQC_SIG_KEYGEN:
case WC_PK_TYPE_PQC_SIG_KEYGEN_SEED:
return swdev_slhdsa_keygen(info);
case WC_PK_TYPE_PQC_SIG_SIGN:
return swdev_slhdsa_sign(info);
case WC_PK_TYPE_PQC_SIG_SIGN_MSG:
return swdev_slhdsa_sign_msg(info);
case WC_PK_TYPE_PQC_SIG_CHECK_PRIV_KEY:
return swdev_slhdsa_check_priv_key(info);
#endif /* !WOLFSSL_SLHDSA_VERIFY_ONLY */
case WC_PK_TYPE_PQC_SIG_VERIFY:
return swdev_slhdsa_verify(info);
case WC_PK_TYPE_PQC_SIG_VERIFY_MSG:
return swdev_slhdsa_verify_msg(info);
default:
return CRYPTOCB_UNAVAILABLE;
}
}
#endif /* WOLFSSL_HAVE_SLHDSA */
#ifdef HAVE_FALCON
#ifndef WOLFSSL_FALCON_VERIFY_ONLY
static int swdev_falcon_keygen(wc_CryptoInfo* info)
{
return wc_falcon_make_key((falcon_key*)info->pk.pqc_sig_kg.key,
info->pk.pqc_sig_kg.rng);
}
static int swdev_falcon_sign(wc_CryptoInfo* info)
{
return wc_falcon_sign_msg(info->pk.pqc_sign.in, info->pk.pqc_sign.inlen,
info->pk.pqc_sign.out, info->pk.pqc_sign.outlen,
(falcon_key*)info->pk.pqc_sign.key, info->pk.pqc_sign.rng);
}
#endif
static int swdev_falcon_verify(wc_CryptoInfo* info)
{
return wc_falcon_verify_msg(info->pk.pqc_verify.sig,
info->pk.pqc_verify.siglen, info->pk.pqc_verify.msg,
info->pk.pqc_verify.msglen, info->pk.pqc_verify.res,
(falcon_key*)info->pk.pqc_verify.key);
}
static int swdev_falcon(wc_CryptoInfo* info, int pkType)
{
switch (pkType) {
#ifndef WOLFSSL_FALCON_VERIFY_ONLY
case WC_PK_TYPE_PQC_SIG_KEYGEN:
return swdev_falcon_keygen(info);
case WC_PK_TYPE_PQC_SIG_SIGN:
return swdev_falcon_sign(info);
#endif
case WC_PK_TYPE_PQC_SIG_VERIFY:
return swdev_falcon_verify(info);
case WC_PK_TYPE_PQC_SIG_CHECK_PRIV_KEY:
/* The public key sent alongside is the key's own copy. */
return wc_falcon_check_key((falcon_key*)info->pk.pqc_sig_check.key);
default:
return CRYPTOCB_UNAVAILABLE;
}
}
#endif /* HAVE_FALCON */
#if defined(WOLFSSL_HAVE_SLHDSA) || defined(HAVE_FALCON)
/* Decline the families swdev has no handler for, so the caller falls back. */
static int swdev_pqc_sig(wc_CryptoInfo* info, int type, int pkType)
{
switch (type) {
#ifdef WOLFSSL_HAVE_SLHDSA
case WC_PQC_SIG_TYPE_SLHDSA:
return swdev_slhdsa(info, pkType);
#endif
#ifdef HAVE_FALCON
case WC_PQC_SIG_TYPE_FALCON:
return swdev_falcon(info, pkType);
#endif
default:
return CRYPTOCB_UNAVAILABLE;
}
}
#endif /* WOLFSSL_HAVE_SLHDSA || HAVE_FALCON */
#ifdef WOLFSSL_HAVE_MLKEM
#ifndef WOLFSSL_MLKEM_NO_MAKE_KEY
static int swdev_mlkem_keygen(wc_CryptoInfo* info)
{
return wc_MlKemKey_MakeKey((MlKemKey*)info->pk.pqc_kem_kg.key,
info->pk.pqc_kem_kg.rng);
}
#endif
#ifndef WOLFSSL_MLKEM_NO_ENCAPSULATE
static int swdev_mlkem_encaps(wc_CryptoInfo* info)
{
MlKemKey* key = (MlKemKey*)info->pk.pqc_encaps.key;
word32 ctSz = 0;
int ret;
ret = wc_MlKemKey_CipherTextSize(key, &ctSz);
if ((ret == 0) && ((info->pk.pqc_encaps.ciphertextLen != ctSz) ||
(info->pk.pqc_encaps.sharedSecretLen != WC_ML_KEM_SS_SZ))) {
ret = BUFFER_E;
}
if (ret == 0) {
ret = wc_MlKemKey_Encapsulate(key, info->pk.pqc_encaps.ciphertext,
info->pk.pqc_encaps.sharedSecret, info->pk.pqc_encaps.rng);
}
return ret;
}
#endif
#ifndef WOLFSSL_MLKEM_NO_DECAPSULATE
static int swdev_mlkem_decaps(wc_CryptoInfo* info)
{
if (info->pk.pqc_decaps.sharedSecretLen != WC_ML_KEM_SS_SZ)
return BUFFER_E;
return wc_MlKemKey_Decapsulate((MlKemKey*)info->pk.pqc_decaps.key,
info->pk.pqc_decaps.sharedSecret, info->pk.pqc_decaps.ciphertext,
info->pk.pqc_decaps.ciphertextLen);
}
#endif
static int swdev_mlkem(wc_CryptoInfo* info, int pkType)
{
switch (pkType) {
#ifndef WOLFSSL_MLKEM_NO_MAKE_KEY
case WC_PK_TYPE_PQC_KEM_KEYGEN:
return swdev_mlkem_keygen(info);
#endif
#ifndef WOLFSSL_MLKEM_NO_ENCAPSULATE
case WC_PK_TYPE_PQC_KEM_ENCAPS:
return swdev_mlkem_encaps(info);
#endif
#ifndef WOLFSSL_MLKEM_NO_DECAPSULATE
case WC_PK_TYPE_PQC_KEM_DECAPS:
return swdev_mlkem_decaps(info);
#endif
default:
return CRYPTOCB_UNAVAILABLE;
}
}
#endif /* WOLFSSL_HAVE_MLKEM */
#ifdef WOLFSSL_HAVE_FRODOKEM
#ifndef WOLFSSL_FRODOKEM_NO_MAKE_KEY
static int swdev_frodokem_keygen(wc_CryptoInfo* info)
{
return wc_FrodoKemKey_MakeKey((FrodoKemKey*)info->pk.pqc_kem_kg.key,
info->pk.pqc_kem_kg.rng);
}
#endif
#ifndef WOLFSSL_FRODOKEM_NO_ENCAPSULATE
static int swdev_frodokem_encaps(wc_CryptoInfo* info)
{
FrodoKemKey* key = (FrodoKemKey*)info->pk.pqc_encaps.key;
word32 ctSz = 0;
word32 ssSz = 0;
int ret;
ret = wc_FrodoKemKey_CipherTextSize(key, &ctSz);
if (ret == 0)
ret = wc_FrodoKemKey_SharedSecretSize(key, &ssSz);
if ((ret == 0) && ((info->pk.pqc_encaps.ciphertextLen != ctSz) ||
(info->pk.pqc_encaps.sharedSecretLen != ssSz))) {
ret = BUFFER_E;
}
if (ret == 0) {
ret = wc_FrodoKemKey_Encapsulate(key, info->pk.pqc_encaps.ciphertext,
info->pk.pqc_encaps.sharedSecret, info->pk.pqc_encaps.rng);
}
return ret;
}
#endif
#ifndef WOLFSSL_FRODOKEM_NO_DECAPSULATE
static int swdev_frodokem_decaps(wc_CryptoInfo* info)
{
FrodoKemKey* key = (FrodoKemKey*)info->pk.pqc_decaps.key;
word32 ssSz = 0;
int ret;
ret = wc_FrodoKemKey_SharedSecretSize(key, &ssSz);
if ((ret == 0) && (info->pk.pqc_decaps.sharedSecretLen != ssSz))
ret = BUFFER_E;
if (ret == 0) {
ret = wc_FrodoKemKey_Decapsulate(key, info->pk.pqc_decaps.sharedSecret,
info->pk.pqc_decaps.ciphertext, info->pk.pqc_decaps.ciphertextLen);
}
return ret;
}
#endif
static int swdev_frodokem(wc_CryptoInfo* info, int pkType)
{
switch (pkType) {
#ifndef WOLFSSL_FRODOKEM_NO_MAKE_KEY
case WC_PK_TYPE_PQC_KEM_KEYGEN:
return swdev_frodokem_keygen(info);
#endif
#ifndef WOLFSSL_FRODOKEM_NO_ENCAPSULATE
case WC_PK_TYPE_PQC_KEM_ENCAPS:
return swdev_frodokem_encaps(info);
#endif
#ifndef WOLFSSL_FRODOKEM_NO_DECAPSULATE
case WC_PK_TYPE_PQC_KEM_DECAPS:
return swdev_frodokem_decaps(info);
#endif
default:
return CRYPTOCB_UNAVAILABLE;
}
}
#endif /* WOLFSSL_HAVE_FRODOKEM */
#if defined(WOLFSSL_HAVE_MLKEM) || defined(WOLFSSL_HAVE_FRODOKEM)
/* Dispatch a PQC KEM operation, declining the families swdev has no handler
* for so the caller can fall back. */
static int swdev_pqc_kem(wc_CryptoInfo* info, int type, int pkType)
{
switch (type) {
#ifdef WOLFSSL_HAVE_MLKEM
case WC_PQC_KEM_TYPE_MLKEM:
return swdev_mlkem(info, pkType);
#endif
#ifdef WOLFSSL_HAVE_FRODOKEM
case WC_PQC_KEM_TYPE_FRODOKEM:
return swdev_frodokem(info, pkType);
#endif
default:
return CRYPTOCB_UNAVAILABLE;
}
}
#endif /* WOLFSSL_HAVE_MLKEM || WOLFSSL_HAVE_FRODOKEM */
#if defined(WOLFSSL_HAVE_LMS) || defined(WOLFSSL_HAVE_XMSS)
#if (defined(WOLFSSL_HAVE_LMS) && !defined(WOLFSSL_LMS_VERIFY_ONLY)) || \
(defined(WOLFSSL_HAVE_XMSS) && !defined(WOLFSSL_XMSS_VERIFY_ONLY))
#define SWDEV_STATEFUL_SIGN
#endif
/* Signing key to model a device-resident key */
typedef struct swdev_stateful_key {
struct swdev_stateful_key* next;
int type;
byte* priv;
word32 privSz;
#ifdef WOLFSSL_HAVE_LMS
LmsKey lms;
#endif
#ifdef WOLFSSL_HAVE_XMSS
XmssKey xmss;
#endif
} swdev_stateful_key;
#if defined(WOLFSSL_HAVE_LMS) && !defined(WOLFSSL_LMS_VERIFY_ONLY)
static int swdev_lms_write(const byte* priv, word32 privSz, void* context)
{
swdev_stateful_key* dev = (swdev_stateful_key*)context;
if ((dev == NULL) || (priv == NULL))
return WC_LMS_RC_BAD_ARG;
if (privSz > dev->privSz)
return WC_LMS_RC_WRITE_FAIL;
XMEMCPY(dev->priv, priv, privSz);
return WC_LMS_RC_SAVED_TO_NV_MEMORY;
}
static int swdev_lms_read(byte* priv, word32 privSz, void* context)
{
swdev_stateful_key* dev = (swdev_stateful_key*)context;
if ((dev == NULL) || (priv == NULL))
return WC_LMS_RC_BAD_ARG;
if (privSz > dev->privSz)
return WC_LMS_RC_READ_FAIL;
XMEMCPY(priv, dev->priv, privSz);
return WC_LMS_RC_READ_TO_MEMORY;
}
#endif
#if defined(WOLFSSL_HAVE_XMSS) && !defined(WOLFSSL_XMSS_VERIFY_ONLY)
static enum wc_XmssRc swdev_xmss_write(const byte* priv, word32 privSz,
void* context)
{
swdev_stateful_key* dev = (swdev_stateful_key*)context;
if ((dev == NULL) || (priv == NULL) || (privSz > dev->privSz))
return WC_XMSS_RC_WRITE_FAIL;
XMEMCPY(dev->priv, priv, privSz);
return WC_XMSS_RC_SAVED_TO_NV_MEMORY;
}
static enum wc_XmssRc swdev_xmss_read(byte* priv, word32 privSz, void* context)
{
swdev_stateful_key* dev = (swdev_stateful_key*)context;
if ((dev == NULL) || (priv == NULL) || (privSz > dev->privSz))
return WC_XMSS_RC_READ_FAIL;
XMEMCPY(priv, dev->priv, privSz);
return WC_XMSS_RC_READ_TO_MEMORY;
}
#endif
/* Track freed keys and sweep at cleanup to avoid sanitizer issues. */
static swdev_stateful_key* swdev_stateful_list = NULL;
static void swdev_stateful_untrack(swdev_stateful_key* dev)
{
swdev_stateful_key** p = &swdev_stateful_list;
while (*p != NULL) {
if (*p == dev) {
*p = dev->next;
return;
}
p = &(*p)->next;
}
}
static void swdev_stateful_free(swdev_stateful_key* dev);
static void swdev_stateful_cleanup(void)
{
while (swdev_stateful_list != NULL) {
swdev_stateful_free(swdev_stateful_list);
}
}
static void swdev_stateful_free(swdev_stateful_key* dev)
{
if (dev == NULL)
return;
swdev_stateful_untrack(dev);
switch (dev->type) {
#ifdef WOLFSSL_HAVE_LMS
case WC_PQC_STATEFUL_SIG_TYPE_LMS:
wc_LmsKey_Free(&dev->lms);
break;
#endif
#ifdef WOLFSSL_HAVE_XMSS
case WC_PQC_STATEFUL_SIG_TYPE_XMSS:
wc_XmssKey_Free(&dev->xmss);
break;
#endif
default:
break;
}
if (dev->priv != NULL) {
wc_ForceZero(dev->priv, dev->privSz);
XFREE(dev->priv, NULL, DYNAMIC_TYPE_TMP_BUFFER);
}
wc_ForceZero(dev, sizeof(*dev));
XFREE(dev, NULL, DYNAMIC_TYPE_TMP_BUFFER);
}
#if defined(SWDEV_STATEFUL_SIGN) || defined(WOLF_CRYPTO_CB_FREE)
static swdev_stateful_key* swdev_stateful_get(int type, void* key)
{
switch (type) {
#ifdef WOLFSSL_HAVE_LMS
case WC_PQC_STATEFUL_SIG_TYPE_LMS:
return (swdev_stateful_key*)((LmsKey*)key)->devCtx;
#endif
#ifdef WOLFSSL_HAVE_XMSS
case WC_PQC_STATEFUL_SIG_TYPE_XMSS:
return (swdev_stateful_key*)((XmssKey*)key)->devCtx;
#endif
default:
return NULL;
}
}
#endif /* SWDEV_STATEFUL_SIGN || WOLF_CRYPTO_CB_FREE */
/* Clear the key's devId so the public API takes its software path instead of
* dispatching straight back here. */
static int swdev_stateful_take(int type, void* key, int* devId)
{
int ret = 0;
*devId = INVALID_DEVID;
if (key == NULL)
return BAD_FUNC_ARG;
switch (type) {
#ifdef WOLFSSL_HAVE_LMS
case WC_PQC_STATEFUL_SIG_TYPE_LMS:
*devId = ((LmsKey*)key)->devId;
((LmsKey*)key)->devId = INVALID_DEVID;
break;
#endif
#ifdef WOLFSSL_HAVE_XMSS
case WC_PQC_STATEFUL_SIG_TYPE_XMSS:
*devId = ((XmssKey*)key)->devId;
((XmssKey*)key)->devId = INVALID_DEVID;
break;
#endif
default:
ret = CRYPTOCB_UNAVAILABLE;
break;
}
return ret;
}
static void swdev_stateful_give_back(int type, void* key, int devId)
{
if (key == NULL)
return;
switch (type) {
#ifdef WOLFSSL_HAVE_LMS
case WC_PQC_STATEFUL_SIG_TYPE_LMS:
((LmsKey*)key)->devId = devId;
break;
#endif
#ifdef WOLFSSL_HAVE_XMSS
case WC_PQC_STATEFUL_SIG_TYPE_XMSS:
((XmssKey*)key)->devId = devId;
break;
#endif
default:
break;
}
}
#ifdef SWDEV_STATEFUL_SIGN
/* Generate a key that stays on the device. Only the public half is copied
* back, so the caller can perform export and verify. */
static int swdev_stateful_keygen(wc_CryptoInfo* info)
{
int type = info->pk.pqc_stateful_sig_kg.type;
void* key = info->pk.pqc_stateful_sig_kg.key;
swdev_stateful_key* dev;
word32 privSz = 0;
int ret;
if (key == NULL)
return BAD_FUNC_ARG;
dev = (swdev_stateful_key*)XMALLOC(sizeof(*dev), NULL,
DYNAMIC_TYPE_TMP_BUFFER);
if (dev == NULL)
return MEMORY_E;
XMEMSET(dev, 0, sizeof(*dev));
dev->type = type;
switch (type) {
#if defined(WOLFSSL_HAVE_LMS) && !defined(WOLFSSL_LMS_VERIFY_ONLY)
case WC_PQC_STATEFUL_SIG_TYPE_LMS: {
const LmsKey* src = (const LmsKey*)key;
int levels = 0, height = 0, winternitz = 0, hash = 0;
ret = wc_LmsKey_Init(&dev->lms, NULL, INVALID_DEVID);
if (ret == 0) {
ret = wc_LmsKey_GetParameters_ex(src, &levels, &height,
&winternitz, &hash);
}
if (ret == 0) {
ret = wc_LmsKey_SetParameters_ex(&dev->lms, levels, height,
winternitz, hash);
}
if (ret == 0) {
ret = wc_LmsKey_GetPrivLen(&dev->lms, &privSz);
}
#ifdef WOLFSSL_WC_LMS_SERIALIZE_STATE
/* The write callback receives the traversal state as well. */
if (ret == 0) {
privSz += LMS_PRIV_DATA_LEN(dev->lms.params->levels,
dev->lms.params->height, dev->lms.params->p,
dev->lms.params->rootLevels, dev->lms.params->cacheBits,
dev->lms.params->hash_len);
}
#endif
break;
}
#endif
#if defined(WOLFSSL_HAVE_XMSS) && !defined(WOLFSSL_XMSS_VERIFY_ONLY)
case WC_PQC_STATEFUL_SIG_TYPE_XMSS: {
const XmssKey* src = (const XmssKey*)key;
ret = wc_XmssKey_Init(&dev->xmss, NULL, INVALID_DEVID);
if (ret == 0) {
/* Mirror the caller's parameter set. */
dev->xmss.oid = src->oid;
dev->xmss.params = src->params;
dev->xmss.sk_len = src->sk_len;
dev->xmss.is_xmssmt = src->is_xmssmt;
dev->xmss.state = WC_XMSS_STATE_PARMSET;
ret = wc_XmssKey_GetPrivLen(&dev->xmss, &privSz);
}
break;
}
#endif
default:
ret = CRYPTOCB_UNAVAILABLE;
break;
}
/* Stands in for the device's nonvolatile storage. */
if (ret == 0) {
dev->privSz = privSz;
dev->priv = (byte*)XMALLOC(privSz, NULL, DYNAMIC_TYPE_TMP_BUFFER);
if (dev->priv == NULL) {
ret = MEMORY_E;
}
else {
XMEMSET(dev->priv, 0, privSz);
}
}
switch ((ret == 0) ? type : WC_PQC_STATEFUL_SIG_TYPE_NONE) {
#if defined(WOLFSSL_HAVE_LMS) && !defined(WOLFSSL_LMS_VERIFY_ONLY)
case WC_PQC_STATEFUL_SIG_TYPE_LMS:
{
const LmsKey* src = (const LmsKey*)key;
/* Persist where the caller asked, or in the device otherwise. */
if (src->write_private_key != NULL) {
ret = wc_LmsKey_SetWriteCb(&dev->lms, src->write_private_key);
if ((ret == 0) && (src->read_private_key != NULL)) {
ret = wc_LmsKey_SetReadCb(&dev->lms,
src->read_private_key);
}
if (ret == 0) {
ret = wc_LmsKey_SetContext(&dev->lms, src->context);
}
}
else {
ret = wc_LmsKey_SetWriteCb(&dev->lms, swdev_lms_write);
if (ret == 0) {
ret = wc_LmsKey_SetReadCb(&dev->lms, swdev_lms_read);
}
if (ret == 0) {
ret = wc_LmsKey_SetContext(&dev->lms, dev);
}
}
}
if (ret == 0) {
ret = wc_LmsKey_MakeKey(&dev->lms,
info->pk.pqc_stateful_sig_kg.rng);
}
if (ret == 0) {
LmsKey* dst = (LmsKey*)key;
XMEMCPY(dst->pub, dev->lms.pub, sizeof(dst->pub));
dst->devCtx = dev;
}
break;
#endif
#if defined(WOLFSSL_HAVE_XMSS) && !defined(WOLFSSL_XMSS_VERIFY_ONLY)
case WC_PQC_STATEFUL_SIG_TYPE_XMSS:
{
const XmssKey* src = (const XmssKey*)key;
/* Persist where the caller asked, or in the device otherwise. */
if (src->write_private_key != NULL) {
ret = wc_XmssKey_SetWriteCb(&dev->xmss,
src->write_private_key);
if ((ret == 0) && (src->read_private_key != NULL)) {
ret = wc_XmssKey_SetReadCb(&dev->xmss,
src->read_private_key);
}
if (ret == 0) {
ret = wc_XmssKey_SetContext(&dev->xmss, src->context);
}
}
else {
ret = wc_XmssKey_SetWriteCb(&dev->xmss, swdev_xmss_write);
if (ret == 0) {
ret = wc_XmssKey_SetReadCb(&dev->xmss, swdev_xmss_read);
}
if (ret == 0) {
ret = wc_XmssKey_SetContext(&dev->xmss, dev);
}
}
}
if (ret == 0) {
ret = wc_XmssKey_MakeKey(&dev->xmss,
info->pk.pqc_stateful_sig_kg.rng);
}
if (ret == 0) {
XmssKey* dst = (XmssKey*)key;
XMEMCPY(dst->pk, dev->xmss.pk, sizeof(dst->pk));
dst->devCtx = dev;
}
break;
#endif
default:
break;
}
if (ret != 0) {
swdev_stateful_free(dev);
}
else {
dev->next = swdev_stateful_list;
swdev_stateful_list = dev;
}
return ret;
}
static int swdev_stateful_sign(wc_CryptoInfo* info)
{
int type = info->pk.pqc_stateful_sig_sign.type;
swdev_stateful_key* dev;
int ret;
dev = swdev_stateful_get(type, info->pk.pqc_stateful_sig_sign.key);
if (dev == NULL)
return CRYPTOCB_UNAVAILABLE;
switch (type) {
#if defined(WOLFSSL_HAVE_LMS) && !defined(WOLFSSL_LMS_VERIFY_ONLY)
case WC_PQC_STATEFUL_SIG_TYPE_LMS:
ret = wc_LmsKey_Sign(&dev->lms, info->pk.pqc_stateful_sig_sign.out,
info->pk.pqc_stateful_sig_sign.outSz,
info->pk.pqc_stateful_sig_sign.msg,
(int)info->pk.pqc_stateful_sig_sign.msgSz);
break;
#endif
#if defined(WOLFSSL_HAVE_XMSS) && !defined(WOLFSSL_XMSS_VERIFY_ONLY)
case WC_PQC_STATEFUL_SIG_TYPE_XMSS:
ret = wc_XmssKey_Sign(&dev->xmss, info->pk.pqc_stateful_sig_sign.out,
info->pk.pqc_stateful_sig_sign.outSz,
info->pk.pqc_stateful_sig_sign.msg,
(int)info->pk.pqc_stateful_sig_sign.msgSz);
break;
#endif
default:
ret = CRYPTOCB_UNAVAILABLE;
break;
}
return ret;
}
static int swdev_stateful_sigsleft(wc_CryptoInfo* info)
{
int type = info->pk.pqc_stateful_sig_sigs_left.type;
swdev_stateful_key* dev;
int ret = 0;
if (info->pk.pqc_stateful_sig_sigs_left.sigsLeft == NULL)
return BAD_FUNC_ARG;
dev = swdev_stateful_get(type, info->pk.pqc_stateful_sig_sigs_left.key);
if (dev == NULL)
return CRYPTOCB_UNAVAILABLE;
switch (type) {
#if defined(WOLFSSL_HAVE_LMS) && !defined(WOLFSSL_LMS_VERIFY_ONLY)
case WC_PQC_STATEFUL_SIG_TYPE_LMS:
*info->pk.pqc_stateful_sig_sigs_left.sigsLeft =
(word32)wc_LmsKey_SigsLeft(&dev->lms);
break;
#endif
#if defined(WOLFSSL_HAVE_XMSS) && !defined(WOLFSSL_XMSS_VERIFY_ONLY)
case WC_PQC_STATEFUL_SIG_TYPE_XMSS:
*info->pk.pqc_stateful_sig_sigs_left.sigsLeft =
(word32)wc_XmssKey_SigsLeft(&dev->xmss);
break;
#endif
default:
ret = CRYPTOCB_UNAVAILABLE;
break;
}
return ret;
}
#endif /* SWDEV_STATEFUL_SIGN */
static int swdev_stateful_verify(wc_CryptoInfo* info)
{
int type = info->pk.pqc_stateful_sig_verify.type;
void* key = info->pk.pqc_stateful_sig_verify.key;
int* res = info->pk.pqc_stateful_sig_verify.res;
int devId;
int ret;
ret = swdev_stateful_take(type, key, &devId);
if (ret == 0) {
switch (type) {
#ifdef WOLFSSL_HAVE_LMS
case WC_PQC_STATEFUL_SIG_TYPE_LMS:
ret = wc_LmsKey_Verify((LmsKey*)key,
info->pk.pqc_stateful_sig_verify.sig,
info->pk.pqc_stateful_sig_verify.sigSz,
info->pk.pqc_stateful_sig_verify.msg,
(int)info->pk.pqc_stateful_sig_verify.msgSz);
break;
#endif
#ifdef WOLFSSL_HAVE_XMSS
case WC_PQC_STATEFUL_SIG_TYPE_XMSS:
ret = wc_XmssKey_Verify((XmssKey*)key,
info->pk.pqc_stateful_sig_verify.sig,
info->pk.pqc_stateful_sig_verify.sigSz,
info->pk.pqc_stateful_sig_verify.msg,
(int)info->pk.pqc_stateful_sig_verify.msgSz);
break;
#endif
default:
ret = CRYPTOCB_UNAVAILABLE;
break;
}
swdev_stateful_give_back(type, key, devId);
}
/* Only a bad signature is a verdict; every other failure propagates. */
if (ret == WC_NO_ERR_TRACE(SIG_VERIFY_E)) {
if (res != NULL) {
*res = 0;
}
ret = 0;
}
else if ((ret == 0) && (res != NULL)) {
*res = 1;
}
return ret;
}
#if defined(WOLF_CRYPTO_CB_FREE)
/* Release the device-resident key the caller is done with. */
static int swdev_stateful_free_cb(wc_CryptoInfo* info)
{
swdev_stateful_key* dev = swdev_stateful_get(info->free.subType,
info->free.obj);
if (dev != NULL) {
swdev_stateful_free(dev);
switch (info->free.subType) {
#ifdef WOLFSSL_HAVE_LMS
case WC_PQC_STATEFUL_SIG_TYPE_LMS:
((LmsKey*)info->free.obj)->devCtx = NULL;
break;
#endif
#ifdef WOLFSSL_HAVE_XMSS
case WC_PQC_STATEFUL_SIG_TYPE_XMSS:
((XmssKey*)info->free.obj)->devCtx = NULL;
break;
#endif
default:
break;
}
}
return 0;
}
#endif /* WOLF_CRYPTO_CB_FREE */
static int swdev_pqc_stateful_sig(wc_CryptoInfo* info, int pkType)
{
switch (pkType) {
#ifdef SWDEV_STATEFUL_SIGN
case WC_PK_TYPE_PQC_STATEFUL_SIG_KEYGEN:
return swdev_stateful_keygen(info);
case WC_PK_TYPE_PQC_STATEFUL_SIG_SIGN:
return swdev_stateful_sign(info);
case WC_PK_TYPE_PQC_STATEFUL_SIG_SIGS_LEFT:
return swdev_stateful_sigsleft(info);
#endif
case WC_PK_TYPE_PQC_STATEFUL_SIG_VERIFY:
return swdev_stateful_verify(info);
default:
return CRYPTOCB_UNAVAILABLE;
}
}
#endif /* WOLFSSL_HAVE_LMS || WOLFSSL_HAVE_XMSS */
#if defined(WOLFSSL_SHAKE128) || defined(WOLFSSL_SHAKE256)
/* Copy sponge state between the caller's wc_Shake and swdev's shadow */
static void swdev_shake_copy_state(wc_Shake* dst, const wc_Shake* src)
{
XMEMCPY(dst->s, src->s, sizeof(dst->s));
XMEMCPY(dst->t, src->t, sizeof(dst->t));
dst->i = src->i;
#ifdef WOLFSSL_HASH_FLAGS
dst->flags = src->flags;
#endif
}
static int swdev_shake_op(const wc_CryptoInfo* info)
{
#ifdef WOLF_CRYPTO_CB_SHAKE_XOF
return info->hash.shakeOp;
#else
(void)info;
return WC_SHAKE_OP_NONE;
#endif
}
typedef struct swdev_shake_funcs {
int type;
word32 rate;
int (*initFn)(wc_Shake*, void*, int);
int (*updateFn)(wc_Shake*, const byte*, word32);
int (*finalFn)(wc_Shake*, byte*, word32);
int (*absorbFn)(wc_Shake*, const byte*, word32);
int (*squeezeFn)(wc_Shake*, byte*, word32);
void (*freeFn)(wc_Shake*);
} swdev_shake_funcs;
static const swdev_shake_funcs swdev_shake_table[] = {
#ifdef WOLFSSL_SHAKE128
{ WC_HASH_TYPE_SHAKE128, WC_SHA3_128_COUNT * 8U, wc_InitShake128,
wc_Shake128_Update, wc_Shake128_Final, wc_Shake128_Absorb,
wc_Shake128_SqueezeBlocks, wc_Shake128_Free },
#endif
#ifdef WOLFSSL_SHAKE256
{ WC_HASH_TYPE_SHAKE256, WC_SHA3_256_COUNT * 8U, wc_InitShake256,
wc_Shake256_Update, wc_Shake256_Final, wc_Shake256_Absorb,
wc_Shake256_SqueezeBlocks, wc_Shake256_Free },
#endif
};
/* SHAKE handler. When shakeOp is WC_SHAKE_OP_NONE, update and final operations
* are determined by hash.digest. Otherwise hash.shakeOp selects the op. */
static int swdev_shake(wc_CryptoInfo* info)
{
wc_Shake* shake = info->hash.sha3;
wc_Shake shadow;
const swdev_shake_funcs* f = NULL;
size_t idx;
int ret;
if (shake == NULL)
return BAD_FUNC_ARG;
for (idx = 0; idx < sizeof(swdev_shake_table) /
sizeof(swdev_shake_table[0]); idx++) {
if (swdev_shake_table[idx].type == info->hash.type) {
f = &swdev_shake_table[idx];
break;
}
}
if (f == NULL)
return CRYPTOCB_UNAVAILABLE;
ret = f->initFn(&shadow, NULL, INVALID_DEVID);
if (ret != 0)
return ret;
swdev_shake_copy_state(&shadow, shake);
switch (swdev_shake_op(info)) {
case WC_SHAKE_OP_ABSORB:
ret = f->absorbFn(&shadow, info->hash.in, info->hash.inSz);
break;
case WC_SHAKE_OP_SQUEEZE:
/* outSz is the byte count; the API takes whole blocks. */
if ((info->hash.outSz % f->rate) != 0) {
ret = BAD_FUNC_ARG;
break;
}
ret = f->squeezeFn(&shadow, info->hash.digest,
info->hash.outSz / f->rate);
break;
default:
if (info->hash.in != NULL) {
ret = f->updateFn(&shadow, info->hash.in, info->hash.inSz);
}
if ((ret == 0) && (info->hash.digest != NULL)) {
ret = f->finalFn(&shadow, info->hash.digest, info->hash.outSz);
}
break;
}
if (ret == 0) {
swdev_shake_copy_state(shake, &shadow);
}
f->freeFn(&shadow);
return ret;
}
#endif /* WOLFSSL_SHAKE128 || WOLFSSL_SHAKE256 */
#ifndef NO_SHA256
/* Copy hash state between caller's wc_Sha256 and swdev's shadow, leaving
* admin fields (heap, devId, devCtx, W, async, HW ctx) per-side. */
static void swdev_sha256_copy_state(wc_Sha256* dst, const wc_Sha256* src)
{
XMEMCPY(dst->digest, src->digest, sizeof(dst->digest));
XMEMCPY(dst->buffer, src->buffer, sizeof(dst->buffer));
dst->buffLen = src->buffLen;
dst->loLen = src->loLen;
dst->hiLen = src->hiLen;
#if defined(WC_C_DYNAMIC_FALLBACK) && defined(HAVE_FIPS) && FIPS_VERSION3_LT(7,0,0)
dst->sha_method = src->sha_method;
#endif
#ifdef WOLFSSL_HASH_FLAGS
dst->flags = src->flags;
#endif
}
/* Run the op on a per-call shadow wc_Sha256 owned by swdev, copying state
* in and out around it. The caller's struct, allocated by libwolfssl with
* the software init stripped, can't be used directly. */
static int swdev_sha256(wc_CryptoInfo* info)
{
wc_Sha256* sha256 = info->hash.sha256;
wc_Sha256 shadow;
int ret;
if (sha256 == NULL)
return BAD_FUNC_ARG;
ret = wc_InitSha256(&shadow);
if (ret != 0)
return ret;
swdev_sha256_copy_state(&shadow, sha256);
if (info->hash.in != NULL) {
ret = wc_Sha256Update(&shadow, info->hash.in, info->hash.inSz);
if (ret != 0)
goto out;
}
if (info->hash.digest != NULL) {
ret = wc_Sha256Final(&shadow, info->hash.digest);
if (ret != 0)
goto out;
}
swdev_sha256_copy_state(sha256, &shadow);
out:
wc_Sha256Free(&shadow);
return ret;
}
#ifdef WOLFSSL_SHA224
/* SHA-224 is SHA-256 with a different IV/truncation; wc_Sha224 is a typedef
* of wc_Sha256, so the same shadow/copy-state dance applies. */
static int swdev_sha224(wc_CryptoInfo* info)
{
wc_Sha224* sha224 = info->hash.sha224;
wc_Sha224 shadow;
int ret;
if (sha224 == NULL)
return BAD_FUNC_ARG;
ret = wc_InitSha224(&shadow);
if (ret != 0)
return ret;
swdev_sha256_copy_state((wc_Sha256*)&shadow, (const wc_Sha256*)sha224);
if (info->hash.in != NULL) {
ret = wc_Sha224Update(&shadow, info->hash.in, info->hash.inSz);
if (ret != 0)
goto out;
}
if (info->hash.digest != NULL) {
ret = wc_Sha224Final(&shadow, info->hash.digest);
if (ret != 0)
goto out;
}
swdev_sha256_copy_state((wc_Sha256*)sha224, (const wc_Sha256*)&shadow);
out:
wc_Sha224Free(&shadow);
return ret;
}
#endif /* WOLFSSL_SHA224 */
#endif /* !NO_SHA256 */
#if defined(WOLFSSL_SHA512) || defined(WOLFSSL_SHA384)
/* Copy hash state between caller's wc_Sha512 and swdev's shadow, leaving
* admin fields (heap, devId, devCtx, W, async, HW ctx) per-side. The same
* helper works for SHA-384, SHA-512/224, SHA-512/256 since they all typedef
* to wc_Sha512. */
static void swdev_sha512_copy_state(wc_Sha512* dst, const wc_Sha512* src)
{
XMEMCPY(dst->digest, src->digest, sizeof(dst->digest));
XMEMCPY(dst->buffer, src->buffer, sizeof(dst->buffer));
dst->buffLen = src->buffLen;
dst->loLen = src->loLen;
dst->hiLen = src->hiLen;
#if defined(WC_C_DYNAMIC_FALLBACK) && defined(HAVE_FIPS) && FIPS_VERSION3_LT(7,0,0)
dst->sha_method = src->sha_method;
#endif
#ifdef WOLFSSL_HASH_FLAGS
dst->flags = src->flags;
#endif
#if defined(WOLFSSL_SHA512_HASHTYPE)
dst->hashType = src->hashType;
#endif
}
#endif /* WOLFSSL_SHA512 || WOLFSSL_SHA384 */
#ifdef WOLFSSL_SHA512
static int swdev_sha512(wc_CryptoInfo* info)
{
wc_Sha512* sha512 = info->hash.sha512;
wc_Sha512 shadow;
int ret;
if (sha512 == NULL)
return BAD_FUNC_ARG;
ret = wc_InitSha512(&shadow);
if (ret != 0)
return ret;
swdev_sha512_copy_state(&shadow, sha512);
if (info->hash.in != NULL) {
ret = wc_Sha512Update(&shadow, info->hash.in, info->hash.inSz);
if (ret != 0)
goto out;
}
if (info->hash.digest != NULL) {
ret = wc_Sha512Final(&shadow, info->hash.digest);
if (ret != 0)
goto out;
}
swdev_sha512_copy_state(sha512, &shadow);
out:
wc_Sha512Free(&shadow);
return ret;
}
#if !defined(WOLFSSL_NOSHA512_224) && \
!defined(WOLFSSL_SWDEV_SHA512_GENERAL_ONLY)
static int swdev_sha512_224(wc_CryptoInfo* info)
{
wc_Sha512 shadow;
wc_Sha512* sha = info->hash.sha512;
int ret;
if (sha == NULL)
return BAD_FUNC_ARG;
ret = wc_InitSha512_224(&shadow);
if (ret != 0)
return ret;
swdev_sha512_copy_state(&shadow, sha);
if (info->hash.in != NULL) {
ret = wc_Sha512_224Update(&shadow, info->hash.in, info->hash.inSz);
if (ret != 0)
goto out;
}
if (info->hash.digest != NULL) {
ret = wc_Sha512_224Final(&shadow, info->hash.digest);
if (ret != 0)
goto out;
}
swdev_sha512_copy_state(sha, &shadow);
out:
wc_Sha512_224Free(&shadow);
return ret;
}
#endif
#if !defined(WOLFSSL_NOSHA512_256) && \
!defined(WOLFSSL_SWDEV_SHA512_GENERAL_ONLY)
static int swdev_sha512_256(wc_CryptoInfo* info)
{
wc_Sha512 shadow;
wc_Sha512* sha = info->hash.sha512;
int ret;
if (sha == NULL)
return BAD_FUNC_ARG;
ret = wc_InitSha512_256(&shadow);
if (ret != 0)
return ret;
swdev_sha512_copy_state(&shadow, sha);
if (info->hash.in != NULL) {
ret = wc_Sha512_256Update(&shadow, info->hash.in, info->hash.inSz);
if (ret != 0)
goto out;
}
if (info->hash.digest != NULL) {
ret = wc_Sha512_256Final(&shadow, info->hash.digest);
if (ret != 0)
goto out;
}
swdev_sha512_copy_state(sha, &shadow);
out:
wc_Sha512_256Free(&shadow);
return ret;
}
#endif
#endif /* WOLFSSL_SHA512 */
#if defined(WOLFSSL_SHA384) && !defined(WOLFSSL_SWDEV_SHA512_GENERAL_ONLY)
/* SHA-384 is SHA-512 with a different IV/truncation; wc_Sha384 is a typedef
* of wc_Sha512, so the shadow/copy-state dance is identical to swdev_sha512.
* When WOLFSSL_SWDEV_SHA512_GENERAL_ONLY is set this is omitted so swdev declines
* SHA-384 and the cryptocb dispatcher's SHA-512 fallback path is exercised. */
static int swdev_sha384(wc_CryptoInfo* info)
{
wc_Sha384* sha384 = info->hash.sha384;
wc_Sha384 shadow;
int ret;
if (sha384 == NULL)
return BAD_FUNC_ARG;
ret = wc_InitSha384(&shadow);
if (ret != 0)
return ret;
swdev_sha512_copy_state(&shadow, sha384);
if (info->hash.in != NULL) {
ret = wc_Sha384Update(&shadow, info->hash.in, info->hash.inSz);
if (ret != 0)
goto out;
}
if (info->hash.digest != NULL) {
ret = wc_Sha384Final(&shadow, info->hash.digest);
if (ret != 0)
goto out;
}
swdev_sha512_copy_state(sha384, &shadow);
out:
wc_Sha384Free(&shadow);
return ret;
}
#endif /* WOLFSSL_SHA384 && !WOLFSSL_SWDEV_SHA512_GENERAL_ONLY */
#ifndef NO_AES
/* Rebuild a software AES shadow from the caller's raw devKey, since the
* caller's Aes has no software round-key schedule under CB_ONLY_AES. */
static int swdev_aes_shadow_init(Aes* shadow, const Aes* aes, int dir)
{
int ret;
if (shadow == NULL || aes == NULL)
return BAD_FUNC_ARG;
if (aes->keylen <= 0 || aes->keylen > (int)sizeof(aes->devKey))
return BAD_FUNC_ARG;
ret = wc_AesInit(shadow, aes->heap, INVALID_DEVID);
if (ret != 0)
return ret;
ret = wc_AesSetKey(shadow, (const byte*)aes->devKey,
(word32)aes->keylen, (const byte*)aes->reg, dir);
if (ret != 0) {
wc_AesFree(shadow);
return ret;
}
XMEMCPY(shadow->tmp, aes->tmp, sizeof(shadow->tmp));
#if defined(WOLFSSL_AES_COUNTER) || defined(WOLFSSL_AES_CFB) || \
defined(WOLFSSL_AES_OFB) || defined(WOLFSSL_AES_XTS) || \
defined(WOLFSSL_AES_CTS)
shadow->left = aes->left;
#endif
return 0;
}
static void swdev_aes_shadow_sync(Aes* dst, const Aes* src)
{
XMEMCPY(dst->reg, src->reg, sizeof(dst->reg));
XMEMCPY(dst->tmp, src->tmp, sizeof(dst->tmp));
#if defined(WOLFSSL_AES_COUNTER) || defined(WOLFSSL_AES_CFB) || \
defined(WOLFSSL_AES_OFB) || defined(WOLFSSL_AES_XTS) || \
defined(WOLFSSL_AES_CTS)
dst->left = src->left;
#endif
}
#ifdef HAVE_AES_CBC
static int swdev_aes_cbc(wc_CryptoInfo* info)
{
Aes* aes = info->cipher.aescbc.aes;
byte* out = info->cipher.aescbc.out;
const byte* in = info->cipher.aescbc.in;
word32 sz = info->cipher.aescbc.sz;
Aes shadow;
int ret;
ret = swdev_aes_shadow_init(&shadow, aes,
info->cipher.enc ? AES_ENCRYPTION : AES_DECRYPTION);
if (ret != 0)
return ret;
if (info->cipher.enc)
ret = wc_AesCbcEncrypt(&shadow, out, in, sz);
#ifdef HAVE_AES_DECRYPT
else
ret = wc_AesCbcDecrypt(&shadow, out, in, sz);
#else
else
ret = CRYPTOCB_UNAVAILABLE;
#endif
swdev_aes_shadow_sync(aes, &shadow);
wc_AesFree(&shadow);
return ret;
}
#endif /* HAVE_AES_CBC */
#ifdef WOLFSSL_AES_COUNTER
static int swdev_aes_ctr(wc_CryptoInfo* info)
{
Aes* aes = info->cipher.aesctr.aes;
Aes shadow;
int ret;
ret = swdev_aes_shadow_init(&shadow, aes, AES_ENCRYPTION);
if (ret != 0)
return ret;
ret = wc_AesCtrEncrypt(&shadow, info->cipher.aesctr.out,
info->cipher.aesctr.in, info->cipher.aesctr.sz);
swdev_aes_shadow_sync(aes, &shadow);
wc_AesFree(&shadow);
return ret;
}
#endif
#ifdef WOLFSSL_AES_CFB
static int swdev_aes_cfb(wc_CryptoInfo* info)
{
Aes* aes = info->cipher.aescfb.aes;
byte* out = info->cipher.aescfb.out;
const byte* in = info->cipher.aescfb.in;
word32 sz = info->cipher.aescfb.sz;
Aes shadow;
int ret;
/* CFB is a stream mode built on the forward cipher, so the shadow key
* schedule is always AES_ENCRYPTION (as for CTR), even when decrypting. */
ret = swdev_aes_shadow_init(&shadow, aes, AES_ENCRYPTION);
if (ret != 0)
return ret;
if (info->cipher.enc)
ret = wc_AesCfbEncrypt(&shadow, out, in, sz);
#ifdef HAVE_AES_DECRYPT
else
ret = wc_AesCfbDecrypt(&shadow, out, in, sz);
#else
else
ret = CRYPTOCB_UNAVAILABLE;
#endif
swdev_aes_shadow_sync(aes, &shadow);
wc_AesFree(&shadow);
return ret;
}
#endif /* WOLFSSL_AES_CFB */
#ifdef WOLFSSL_AES_OFB
static int swdev_aes_ofb(wc_CryptoInfo* info)
{
Aes* aes = info->cipher.aesofb.aes;
byte* out = info->cipher.aesofb.out;
const byte* in = info->cipher.aesofb.in;
word32 sz = info->cipher.aesofb.sz;
Aes shadow;
int ret;
/* OFB is a stream mode built on the forward cipher, so the shadow key
* schedule is always AES_ENCRYPTION (as for CTR), even when decrypting. */
ret = swdev_aes_shadow_init(&shadow, aes, AES_ENCRYPTION);
if (ret != 0)
return ret;
if (info->cipher.enc)
ret = wc_AesOfbEncrypt(&shadow, out, in, sz);
#ifdef HAVE_AES_DECRYPT
else
ret = wc_AesOfbDecrypt(&shadow, out, in, sz);
#else
else
ret = CRYPTOCB_UNAVAILABLE;
#endif
swdev_aes_shadow_sync(aes, &shadow);
wc_AesFree(&shadow);
return ret;
}
#endif /* WOLFSSL_AES_OFB */
#if defined(HAVE_AES_ECB) || defined(WOLFSSL_AES_DIRECT)
static int swdev_aes_ecb(wc_CryptoInfo* info)
{
Aes* aes = info->cipher.aesecb.aes;
byte* out = info->cipher.aesecb.out;
const byte* in = info->cipher.aesecb.in;
word32 sz = info->cipher.aesecb.sz;
Aes shadow;
int ret;
ret = swdev_aes_shadow_init(&shadow, aes,
info->cipher.enc ? AES_ENCRYPTION : AES_DECRYPTION);
if (ret != 0)
return ret;
#ifdef HAVE_AES_ECB
if (info->cipher.enc)
ret = wc_AesEcbEncrypt(&shadow, out, in, sz);
#ifdef HAVE_AES_DECRYPT
else
ret = wc_AesEcbDecrypt(&shadow, out, in, sz);
#else
else
ret = CRYPTOCB_UNAVAILABLE;
#endif
#elif defined(WOLFSSL_AES_DIRECT)
if (sz != WC_AES_BLOCK_SIZE) {
ret = CRYPTOCB_UNAVAILABLE;
}
else if (info->cipher.enc) {
ret = wc_AesEncryptDirect(&shadow, out, in);
}
#ifdef HAVE_AES_DECRYPT
else {
ret = wc_AesDecryptDirect(&shadow, out, in);
}
#else
else {
ret = CRYPTOCB_UNAVAILABLE;
}
#endif
#else
(void)out;
(void)in;
(void)sz;
ret = CRYPTOCB_UNAVAILABLE;
#endif
wc_AesFree(&shadow);
return ret;
}
#endif /* HAVE_AES_ECB || WOLFSSL_AES_DIRECT */
#if defined(HAVE_AES_KEYWRAP) && !defined(SWDEV_AES_ONLYECB)
/* AES Key Wrap (RFC 3394) and, when built, Key Wrap with Padding (RFC 5649).
* enc selects wrap (forward cipher) vs unwrap (inverse cipher); pad selects the
* RFC 5649 variant. The wrap/unwrap helpers return the produced byte count,
* which the cryptocb contract reports via outResSz with a 0 return. Gated like
* swdev_aes_gcm so SWDEV_AES_ONLYECB instead forces the parent's CB_ONLY_AES
* host-side key wrap (block ops dispatch back through cryptocb ECB). */
static int swdev_aes_keywrap(wc_CryptoInfo* info)
{
Aes* aes = info->cipher.aeskeywrap.aes;
const byte* in = info->cipher.aeskeywrap.in;
word32 inSz = info->cipher.aeskeywrap.inSz;
byte* out = info->cipher.aeskeywrap.out;
word32 outSz = info->cipher.aeskeywrap.outSz;
const byte* iv = info->cipher.aeskeywrap.iv;
Aes shadow;
int ret;
int dir;
if (info->cipher.enc)
dir = AES_ENCRYPTION;
else
dir = AES_DECRYPTION;
ret = swdev_aes_shadow_init(&shadow, aes, dir);
if (ret != 0)
return ret;
if (info->cipher.enc) {
#ifdef WOLFSSL_AES_KEYWRAP_PADDING
if (info->cipher.aeskeywrap.pad)
ret = wc_AesKeyWrap_Pad_ex(&shadow, in, inSz, out, outSz, iv);
else
#endif
ret = wc_AesKeyWrap_ex(&shadow, in, inSz, out, outSz, iv);
}
else {
#ifdef WOLFSSL_AES_KEYWRAP_PADDING
if (info->cipher.aeskeywrap.pad)
ret = wc_AesKeyUnWrap_Pad_ex(&shadow, in, inSz, out, outSz, iv);
else
#endif
ret = wc_AesKeyUnWrap_ex(&shadow, in, inSz, out, outSz, iv);
}
wc_AesFree(&shadow);
if (ret < 0)
return ret;
/* success: report produced length; cryptocb returns outResSz on ret==0 */
info->cipher.aeskeywrap.outResSz = (word32)ret;
return 0;
}
#endif /* HAVE_AES_KEYWRAP && !SWDEV_AES_ONLYECB */
/* SWDEV_AES_ONLYECB: when defined, swdev's AES backend returns
* CRYPTOCB_UNAVAILABLE for AES-GCM so the parent's CB_ONLY_AES host-side
* GCM software path runs (GHASH on the host; AES-CTR blocks dispatch back
* through cryptocb ECB). Without this macro, swdev handles GCM end-to-end
* and the host-side software path is never exercised. */
#if defined(HAVE_AESGCM) && !defined(SWDEV_AES_ONLYECB)
static int swdev_aes_gcm(wc_CryptoInfo* info)
{
Aes* aes = info->cipher.enc ? info->cipher.aesgcm_enc.aes :
info->cipher.aesgcm_dec.aes;
Aes shadow;
int ret;
if (aes == NULL || aes->keylen <= 0 || aes->keylen > (int)sizeof(aes->devKey))
return BAD_FUNC_ARG;
ret = wc_AesInit(&shadow, aes->heap, INVALID_DEVID);
if (ret != 0)
return ret;
ret = wc_AesGcmSetKey(&shadow, (const byte*)aes->devKey, (word32)aes->keylen);
if (ret != 0) {
wc_AesFree(&shadow);
return ret;
}
if (info->cipher.enc) {
ret = wc_AesGcmEncrypt(&shadow,
info->cipher.aesgcm_enc.out, info->cipher.aesgcm_enc.in,
info->cipher.aesgcm_enc.sz,
info->cipher.aesgcm_enc.iv, info->cipher.aesgcm_enc.ivSz,
info->cipher.aesgcm_enc.authTag,
info->cipher.aesgcm_enc.authTagSz,
info->cipher.aesgcm_enc.authIn,
info->cipher.aesgcm_enc.authInSz);
}
else {
ret = wc_AesGcmDecrypt(&shadow, info->cipher.aesgcm_dec.out,
info->cipher.aesgcm_dec.in, info->cipher.aesgcm_dec.sz,
info->cipher.aesgcm_dec.iv, info->cipher.aesgcm_dec.ivSz,
info->cipher.aesgcm_dec.authTag,
info->cipher.aesgcm_dec.authTagSz,
info->cipher.aesgcm_dec.authIn,
info->cipher.aesgcm_dec.authInSz);
}
wc_AesFree(&shadow);
return ret;
}
#endif /* HAVE_AESGCM && !SWDEV_AES_ONLYECB */
#ifdef HAVE_AESCCM
static int swdev_aes_ccm(wc_CryptoInfo* info)
{
Aes* aes = info->cipher.enc ? info->cipher.aesccm_enc.aes :
info->cipher.aesccm_dec.aes;
Aes shadow;
int ret;
if (aes == NULL || aes->keylen <= 0 || aes->keylen > (int)sizeof(aes->devKey))
return BAD_FUNC_ARG;
ret = wc_AesInit(&shadow, aes->heap, INVALID_DEVID);
if (ret != 0)
return ret;
ret = wc_AesCcmSetKey(&shadow, (const byte*)aes->devKey, (word32)aes->keylen);
if (ret != 0) {
wc_AesFree(&shadow);
return ret;
}
if (info->cipher.enc) {
ret = wc_AesCcmEncrypt(&shadow,
info->cipher.aesccm_enc.out, info->cipher.aesccm_enc.in,
info->cipher.aesccm_enc.sz,
info->cipher.aesccm_enc.nonce,
info->cipher.aesccm_enc.nonceSz,
info->cipher.aesccm_enc.authTag,
info->cipher.aesccm_enc.authTagSz,
info->cipher.aesccm_enc.authIn,
info->cipher.aesccm_enc.authInSz);
}
#ifdef HAVE_AES_DECRYPT
else {
ret = wc_AesCcmDecrypt(&shadow, info->cipher.aesccm_dec.out,
info->cipher.aesccm_dec.in, info->cipher.aesccm_dec.sz,
info->cipher.aesccm_dec.nonce,
info->cipher.aesccm_dec.nonceSz,
info->cipher.aesccm_dec.authTag,
info->cipher.aesccm_dec.authTagSz,
info->cipher.aesccm_dec.authIn,
info->cipher.aesccm_dec.authInSz);
}
#else
else {
ret = CRYPTOCB_UNAVAILABLE;
}
#endif
wc_AesFree(&shadow);
return ret;
}
#endif /* HAVE_AESCCM */
#endif /* !NO_AES */
WC_SWDEV_EXPORT int wc_SwDev_Callback(int devId, wc_CryptoInfo* info,
void* ctx)
{
int ret;
(void)devId;
(void)ctx;
if (info == NULL)
return BAD_FUNC_ARG;
ret = swdev_ensure_init();
if (ret != 0)
return ret;
switch (info->algo_type) {
#if !defined(NO_RSA) || defined(HAVE_ECC) || defined(HAVE_ED25519) || \
defined(HAVE_CURVE25519) || defined(HAVE_CURVE448) || \
defined(HAVE_ED448) || defined(WOLFSSL_HAVE_SLHDSA) || \
defined(HAVE_FALCON) || \
defined(WOLFSSL_HAVE_MLKEM) || defined(WOLFSSL_HAVE_FRODOKEM) || \
defined(WOLFSSL_HAVE_LMS) || defined(WOLFSSL_HAVE_XMSS)
#if defined(WOLF_CRYPTO_CB_FREE) && \
(defined(WOLFSSL_HAVE_LMS) || defined(WOLFSSL_HAVE_XMSS))
case WC_ALGO_TYPE_FREE:
if ((info->free.algo == WC_ALGO_TYPE_PK) &&
(info->free.type == WC_PK_TYPE_PQC_STATEFUL_SIG_KEYGEN)) {
return swdev_stateful_free_cb(info);
}
return CRYPTOCB_UNAVAILABLE;
#endif
case WC_ALGO_TYPE_PK:
switch (info->pk.type) {
#ifndef NO_RSA
case WC_PK_TYPE_RSA:
return swdev_rsa(info);
#ifdef WOLFSSL_KEY_GEN
case WC_PK_TYPE_RSA_KEYGEN:
return swdev_rsa_keygen(info);
#endif
#endif /* !NO_RSA */
#ifdef HAVE_ECC
case WC_PK_TYPE_EC_KEYGEN:
return swdev_ecc_keygen(info);
case WC_PK_TYPE_ECDH:
return swdev_ecdh(info);
case WC_PK_TYPE_ECDSA_SIGN:
return swdev_ecc_sign(info);
case WC_PK_TYPE_ECDSA_VERIFY:
return swdev_ecc_verify(info);
case WC_PK_TYPE_EC_GET_SIZE:
return swdev_ecc_get_size(info);
case WC_PK_TYPE_EC_GET_SIG_SIZE:
return swdev_ecc_get_sig_size(info);
case WC_PK_TYPE_EC_MAKE_PUB:
return swdev_ecc_make_pub(info);
#ifdef HAVE_ECC_CHECK_KEY
case WC_PK_TYPE_EC_CHECK_PUB_KEY:
return swdev_ecc_check_pub(info);
#endif
#endif /* HAVE_ECC */
#ifdef HAVE_ED25519
#ifdef HAVE_ED25519_MAKE_KEY
case WC_PK_TYPE_ED25519_KEYGEN:
return swdev_ed25519_keygen(info);
#endif
#ifdef HAVE_ED25519_SIGN
case WC_PK_TYPE_ED25519_SIGN:
return swdev_ed25519_sign(info);
#endif
#ifdef HAVE_ED25519_VERIFY
case WC_PK_TYPE_ED25519_VERIFY:
return swdev_ed25519_verify(info);
#endif
#ifdef HAVE_ED25519_MAKE_KEY
case WC_PK_TYPE_ED25519_MAKE_PUB:
return swdev_ed25519_make_pub(info);
#endif
case WC_PK_TYPE_ED25519_CHECK_KEY:
return swdev_ed25519_check_key(info);
#endif /* HAVE_ED25519 */
#ifdef HAVE_CURVE25519
case WC_PK_TYPE_CURVE25519_KEYGEN:
return swdev_curve25519_keygen(info);
#ifdef HAVE_CURVE25519_SHARED_SECRET
case WC_PK_TYPE_CURVE25519:
return swdev_curve25519(info);
#endif
case WC_PK_TYPE_CURVE25519_MAKE_PUB:
return swdev_curve25519_make_pub(info);
case WC_PK_TYPE_CURVE25519_GENERIC:
return swdev_curve25519_generic(info);
#endif /* HAVE_CURVE25519 */
#ifdef HAVE_CURVE448
case WC_PK_TYPE_CURVE448_KEYGEN:
return swdev_curve448_keygen(info);
#ifdef HAVE_CURVE448_SHARED_SECRET
case WC_PK_TYPE_CURVE448:
return swdev_curve448(info);
#endif
case WC_PK_TYPE_CURVE448_MAKE_PUB:
return swdev_curve448_make_pub(info);
case WC_PK_TYPE_CURVE448_GENERIC:
return swdev_curve448_generic(info);
#endif /* HAVE_CURVE448 */
#ifdef HAVE_ED448
#ifdef HAVE_ED448_SIGN
case WC_PK_TYPE_ED448:
return swdev_ed448_sign(info);
#endif
#ifdef HAVE_ED448_VERIFY
case WC_PK_TYPE_ED448_VERIFY:
return swdev_ed448_verify(info);
#endif
case WC_PK_TYPE_ED448_MAKE_PUB:
return swdev_ed448_make_pub(info);
case WC_PK_TYPE_ED448_CHECK_KEY:
return swdev_ed448_check_key(info);
#endif /* HAVE_ED448 */
#if defined(WOLFSSL_HAVE_SLHDSA) || defined(HAVE_FALCON)
case WC_PK_TYPE_PQC_SIG_KEYGEN:
case WC_PK_TYPE_PQC_SIG_KEYGEN_SEED:
return swdev_pqc_sig(info, info->pk.pqc_sig_kg.type,
info->pk.type);
case WC_PK_TYPE_PQC_SIG_SIGN:
case WC_PK_TYPE_PQC_SIG_SIGN_MSG:
return swdev_pqc_sig(info, info->pk.pqc_sign.type, info->pk.type);
case WC_PK_TYPE_PQC_SIG_CHECK_PRIV_KEY:
return swdev_pqc_sig(info, info->pk.pqc_sig_check.type,
info->pk.type);
case WC_PK_TYPE_PQC_SIG_VERIFY:
case WC_PK_TYPE_PQC_SIG_VERIFY_MSG:
return swdev_pqc_sig(info, info->pk.pqc_verify.type, info->pk.type);
#endif /* WOLFSSL_HAVE_SLHDSA || HAVE_FALCON */
#if defined(WOLFSSL_HAVE_MLKEM) || defined(WOLFSSL_HAVE_FRODOKEM)
case WC_PK_TYPE_PQC_KEM_KEYGEN:
return swdev_pqc_kem(info, info->pk.pqc_kem_kg.type,
info->pk.type);
case WC_PK_TYPE_PQC_KEM_ENCAPS:
return swdev_pqc_kem(info, info->pk.pqc_encaps.type,
info->pk.type);
case WC_PK_TYPE_PQC_KEM_DECAPS:
return swdev_pqc_kem(info, info->pk.pqc_decaps.type,
info->pk.type);
#endif /* WOLFSSL_HAVE_MLKEM || WOLFSSL_HAVE_FRODOKEM */
#if defined(WOLFSSL_HAVE_LMS) || defined(WOLFSSL_HAVE_XMSS)
case WC_PK_TYPE_PQC_STATEFUL_SIG_KEYGEN:
case WC_PK_TYPE_PQC_STATEFUL_SIG_SIGN:
case WC_PK_TYPE_PQC_STATEFUL_SIG_VERIFY:
case WC_PK_TYPE_PQC_STATEFUL_SIG_SIGS_LEFT:
return swdev_pqc_stateful_sig(info, info->pk.type);
#endif
default:
return CRYPTOCB_UNAVAILABLE;
}
#endif
#if !defined(NO_SHA256) || defined(WOLFSSL_SHA512) || \
defined(WOLFSSL_SHA384) || defined(WOLFSSL_SHAKE128) || \
defined(WOLFSSL_SHAKE256)
case WC_ALGO_TYPE_HASH:
switch (info->hash.type) {
#ifndef NO_SHA256
case WC_HASH_TYPE_SHA256:
return swdev_sha256(info);
#endif
#ifdef WOLFSSL_SHA224
case WC_HASH_TYPE_SHA224:
return swdev_sha224(info);
#endif
#ifdef WOLFSSL_SHA512
case WC_HASH_TYPE_SHA512:
return swdev_sha512(info);
#if !defined(WOLFSSL_NOSHA512_224) && \
!defined(WOLFSSL_SWDEV_SHA512_GENERAL_ONLY)
case WC_HASH_TYPE_SHA512_224:
return swdev_sha512_224(info);
#endif
#if !defined(WOLFSSL_NOSHA512_256) && \
!defined(WOLFSSL_SWDEV_SHA512_GENERAL_ONLY)
case WC_HASH_TYPE_SHA512_256:
return swdev_sha512_256(info);
#endif
#endif
#if defined(WOLFSSL_SHA384) && \
!defined(WOLFSSL_SWDEV_SHA512_GENERAL_ONLY)
case WC_HASH_TYPE_SHA384:
return swdev_sha384(info);
#endif
#if defined(WOLFSSL_SHAKE128) || defined(WOLFSSL_SHAKE256)
#ifdef WOLFSSL_SHAKE128
case WC_HASH_TYPE_SHAKE128:
#endif
#ifdef WOLFSSL_SHAKE256
case WC_HASH_TYPE_SHAKE256:
#endif
return swdev_shake(info);
#endif
default:
return CRYPTOCB_UNAVAILABLE;
}
#endif
#ifndef NO_AES
case WC_ALGO_TYPE_CIPHER:
switch (info->cipher.type) {
#ifdef HAVE_AES_CBC
case WC_CIPHER_AES_CBC:
return swdev_aes_cbc(info);
#endif
#ifdef WOLFSSL_AES_COUNTER
case WC_CIPHER_AES_CTR:
return swdev_aes_ctr(info);
#endif
#ifdef WOLFSSL_AES_CFB
case WC_CIPHER_AES_CFB:
return swdev_aes_cfb(info);
#endif
#ifdef WOLFSSL_AES_OFB
case WC_CIPHER_AES_OFB:
return swdev_aes_ofb(info);
#endif
#if defined(HAVE_AES_ECB) || defined(WOLFSSL_AES_DIRECT)
case WC_CIPHER_AES_ECB:
return swdev_aes_ecb(info);
#endif
#if defined(HAVE_AESGCM) && !defined(SWDEV_AES_ONLYECB)
case WC_CIPHER_AES_GCM:
return swdev_aes_gcm(info);
#endif
#ifdef HAVE_AESCCM
case WC_CIPHER_AES_CCM:
return swdev_aes_ccm(info);
#endif
#if defined(HAVE_AES_KEYWRAP) && !defined(SWDEV_AES_ONLYECB)
case WC_CIPHER_AES_KEYWRAP:
return swdev_aes_keywrap(info);
#endif
default:
return CRYPTOCB_UNAVAILABLE;
}
#endif /* !NO_AES */
default:
return CRYPTOCB_UNAVAILABLE;
}
}
View Git Blame Copy Permalink