1 /**
2 * \file psa/crypto_compat.h
3 *
4 * \brief PSA cryptography module: Backward compatibility aliases
5 *
6 * This header declares alternative names for macro and functions.
7 * New application code should not use these names.
8 * These names may be removed in a future version of Mbed Crypto.
9 *
10 * \note This file may not be included directly. Applications must
11 * include psa/crypto.h.
12 */
13 /*
14 * Copyright The Mbed TLS Contributors
15 * SPDX-License-Identifier: Apache-2.0
16 *
17 * Licensed under the Apache License, Version 2.0 (the "License"); you may
18 * not use this file except in compliance with the License.
19 * You may obtain a copy of the License at
20 *
21 * http://www.apache.org/licenses/LICENSE-2.0
22 *
23 * Unless required by applicable law or agreed to in writing, software
24 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
25 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
26 * See the License for the specific language governing permissions and
27 * limitations under the License.
28 */
29
30 #ifndef PSA_CRYPTO_COMPAT_H
31 #define PSA_CRYPTO_COMPAT_H
32
33 #ifdef __cplusplus
34 extern "C" {
35 #endif
36
37 /*
38 * To support both openless APIs and psa_open_key() temporarily, define
39 * psa_key_handle_t to be equal to mbedtls_svc_key_id_t. Do not mark the
40 * type and its utility macros and functions deprecated yet. This will be done
41 * in a subsequent phase.
42 */
43 typedef mbedtls_svc_key_id_t psa_key_handle_t;
44
45 #define PSA_KEY_HANDLE_INIT MBEDTLS_SVC_KEY_ID_INIT
46
47 /** Check wether an handle is null.
48 *
49 * \param handle Handle
50 *
51 * \return Non-zero if the handle is null, zero otherwise.
52 */
psa_key_handle_is_null(psa_key_handle_t handle)53 static inline int psa_key_handle_is_null( psa_key_handle_t handle )
54 {
55 return( mbedtls_svc_key_id_is_null( handle ) );
56 }
57
58 #if !defined(MBEDTLS_DEPRECATED_REMOVED)
59
60 /*
61 * Mechanism for declaring deprecated values
62 */
63 #if defined(MBEDTLS_DEPRECATED_WARNING) && !defined(MBEDTLS_PSA_DEPRECATED)
64 #define MBEDTLS_PSA_DEPRECATED __attribute__((deprecated))
65 #else
66 #define MBEDTLS_PSA_DEPRECATED
67 #endif
68
69 typedef MBEDTLS_PSA_DEPRECATED size_t mbedtls_deprecated_size_t;
70 typedef MBEDTLS_PSA_DEPRECATED psa_status_t mbedtls_deprecated_psa_status_t;
71 typedef MBEDTLS_PSA_DEPRECATED psa_key_usage_t mbedtls_deprecated_psa_key_usage_t;
72 typedef MBEDTLS_PSA_DEPRECATED psa_ecc_family_t mbedtls_deprecated_psa_ecc_family_t;
73 typedef MBEDTLS_PSA_DEPRECATED psa_dh_family_t mbedtls_deprecated_psa_dh_family_t;
74 typedef MBEDTLS_PSA_DEPRECATED psa_ecc_family_t psa_ecc_curve_t;
75 typedef MBEDTLS_PSA_DEPRECATED psa_dh_family_t psa_dh_group_t;
76 typedef MBEDTLS_PSA_DEPRECATED psa_algorithm_t mbedtls_deprecated_psa_algorithm_t;
77
78 #define PSA_KEY_TYPE_GET_CURVE PSA_KEY_TYPE_ECC_GET_FAMILY
79 #define PSA_KEY_TYPE_GET_GROUP PSA_KEY_TYPE_DH_GET_FAMILY
80
81 #define MBEDTLS_DEPRECATED_CONSTANT( type, value ) \
82 ( (mbedtls_deprecated_##type) ( value ) )
83
84 /*
85 * Deprecated PSA Crypto error code definitions (PSA Crypto API <= 1.0 beta2)
86 */
87 #define PSA_ERROR_UNKNOWN_ERROR \
88 MBEDTLS_DEPRECATED_CONSTANT( psa_status_t, PSA_ERROR_GENERIC_ERROR )
89 #define PSA_ERROR_OCCUPIED_SLOT \
90 MBEDTLS_DEPRECATED_CONSTANT( psa_status_t, PSA_ERROR_ALREADY_EXISTS )
91 #define PSA_ERROR_EMPTY_SLOT \
92 MBEDTLS_DEPRECATED_CONSTANT( psa_status_t, PSA_ERROR_DOES_NOT_EXIST )
93 #define PSA_ERROR_INSUFFICIENT_CAPACITY \
94 MBEDTLS_DEPRECATED_CONSTANT( psa_status_t, PSA_ERROR_INSUFFICIENT_DATA )
95 #define PSA_ERROR_TAMPERING_DETECTED \
96 MBEDTLS_DEPRECATED_CONSTANT( psa_status_t, PSA_ERROR_CORRUPTION_DETECTED )
97
98 /*
99 * Deprecated PSA Crypto numerical encodings (PSA Crypto API <= 1.0 beta3)
100 */
101 #define PSA_KEY_USAGE_SIGN \
102 MBEDTLS_DEPRECATED_CONSTANT( psa_key_usage_t, PSA_KEY_USAGE_SIGN_HASH )
103 #define PSA_KEY_USAGE_VERIFY \
104 MBEDTLS_DEPRECATED_CONSTANT( psa_key_usage_t, PSA_KEY_USAGE_VERIFY_HASH )
105
106 /*
107 * Deprecated PSA Crypto size calculation macros (PSA Crypto API <= 1.0 beta3)
108 */
109 #define PSA_ASYMMETRIC_SIGNATURE_MAX_SIZE \
110 MBEDTLS_DEPRECATED_CONSTANT( size_t, PSA_SIGNATURE_MAX_SIZE )
111 #define PSA_ASYMMETRIC_SIGN_OUTPUT_SIZE( key_type, key_bits, alg ) \
112 MBEDTLS_DEPRECATED_CONSTANT( size_t, PSA_SIGN_OUTPUT_SIZE( key_type, key_bits, alg ) )
113
114 /*
115 * Deprecated PSA Crypto function names (PSA Crypto API <= 1.0 beta3)
116 */
psa_asymmetric_sign(psa_key_handle_t key,psa_algorithm_t alg,const uint8_t * hash,size_t hash_length,uint8_t * signature,size_t signature_size,size_t * signature_length)117 MBEDTLS_PSA_DEPRECATED static inline psa_status_t psa_asymmetric_sign( psa_key_handle_t key,
118 psa_algorithm_t alg,
119 const uint8_t *hash,
120 size_t hash_length,
121 uint8_t *signature,
122 size_t signature_size,
123 size_t *signature_length )
124 {
125 return psa_sign_hash( key, alg, hash, hash_length, signature, signature_size, signature_length );
126 }
127
psa_asymmetric_verify(psa_key_handle_t key,psa_algorithm_t alg,const uint8_t * hash,size_t hash_length,const uint8_t * signature,size_t signature_length)128 MBEDTLS_PSA_DEPRECATED static inline psa_status_t psa_asymmetric_verify( psa_key_handle_t key,
129 psa_algorithm_t alg,
130 const uint8_t *hash,
131 size_t hash_length,
132 const uint8_t *signature,
133 size_t signature_length )
134 {
135 return psa_verify_hash( key, alg, hash, hash_length, signature, signature_length );
136 }
137
138 /*
139 * Size-specific elliptic curve families.
140 */
141 #define PSA_ECC_CURVE_SECP160K1 \
142 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECP_K1 )
143 #define PSA_ECC_CURVE_SECP192K1 \
144 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECP_K1 )
145 #define PSA_ECC_CURVE_SECP224K1 \
146 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECP_K1 )
147 #define PSA_ECC_CURVE_SECP256K1 \
148 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECP_K1 )
149 #define PSA_ECC_CURVE_SECP160R1 \
150 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECP_R1 )
151 #define PSA_ECC_CURVE_SECP192R1 \
152 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECP_R1 )
153 #define PSA_ECC_CURVE_SECP224R1 \
154 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECP_R1 )
155 #define PSA_ECC_CURVE_SECP256R1 \
156 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECP_R1 )
157 #define PSA_ECC_CURVE_SECP384R1 \
158 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECP_R1 )
159 #define PSA_ECC_CURVE_SECP521R1 \
160 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECP_R1 )
161 #define PSA_ECC_CURVE_SECP160R2 \
162 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECP_R2 )
163 #define PSA_ECC_CURVE_SECT163K1 \
164 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_K1 )
165 #define PSA_ECC_CURVE_SECT233K1 \
166 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_K1 )
167 #define PSA_ECC_CURVE_SECT239K1 \
168 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_K1 )
169 #define PSA_ECC_CURVE_SECT283K1 \
170 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_K1 )
171 #define PSA_ECC_CURVE_SECT409K1 \
172 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_K1 )
173 #define PSA_ECC_CURVE_SECT571K1 \
174 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_K1 )
175 #define PSA_ECC_CURVE_SECT163R1 \
176 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_R1 )
177 #define PSA_ECC_CURVE_SECT193R1 \
178 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_R1 )
179 #define PSA_ECC_CURVE_SECT233R1 \
180 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_R1 )
181 #define PSA_ECC_CURVE_SECT283R1 \
182 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_R1 )
183 #define PSA_ECC_CURVE_SECT409R1 \
184 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_R1 )
185 #define PSA_ECC_CURVE_SECT571R1 \
186 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_R1 )
187 #define PSA_ECC_CURVE_SECT163R2 \
188 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_R2 )
189 #define PSA_ECC_CURVE_SECT193R2 \
190 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_R2 )
191 #define PSA_ECC_CURVE_BRAINPOOL_P256R1 \
192 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_BRAINPOOL_P_R1 )
193 #define PSA_ECC_CURVE_BRAINPOOL_P384R1 \
194 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_BRAINPOOL_P_R1 )
195 #define PSA_ECC_CURVE_BRAINPOOL_P512R1 \
196 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_BRAINPOOL_P_R1 )
197 #define PSA_ECC_CURVE_CURVE25519 \
198 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_MONTGOMERY )
199 #define PSA_ECC_CURVE_CURVE448 \
200 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_MONTGOMERY )
201
202 /*
203 * Curves that changed name due to PSA specification.
204 */
205 #define PSA_ECC_CURVE_SECP_K1 \
206 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECP_K1 )
207 #define PSA_ECC_CURVE_SECP_R1 \
208 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECP_R1 )
209 #define PSA_ECC_CURVE_SECP_R2 \
210 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECP_R2 )
211 #define PSA_ECC_CURVE_SECT_K1 \
212 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_K1 )
213 #define PSA_ECC_CURVE_SECT_R1 \
214 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_R1 )
215 #define PSA_ECC_CURVE_SECT_R2 \
216 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_SECT_R2 )
217 #define PSA_ECC_CURVE_BRAINPOOL_P_R1 \
218 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_BRAINPOOL_P_R1 )
219 #define PSA_ECC_CURVE_MONTGOMERY \
220 MBEDTLS_DEPRECATED_CONSTANT( psa_ecc_family_t, PSA_ECC_FAMILY_MONTGOMERY )
221
222 /*
223 * Finite-field Diffie-Hellman families.
224 */
225 #define PSA_DH_GROUP_FFDHE2048 \
226 MBEDTLS_DEPRECATED_CONSTANT( psa_dh_family_t, PSA_DH_FAMILY_RFC7919 )
227 #define PSA_DH_GROUP_FFDHE3072 \
228 MBEDTLS_DEPRECATED_CONSTANT( psa_dh_family_t, PSA_DH_FAMILY_RFC7919 )
229 #define PSA_DH_GROUP_FFDHE4096 \
230 MBEDTLS_DEPRECATED_CONSTANT( psa_dh_family_t, PSA_DH_FAMILY_RFC7919 )
231 #define PSA_DH_GROUP_FFDHE6144 \
232 MBEDTLS_DEPRECATED_CONSTANT( psa_dh_family_t, PSA_DH_FAMILY_RFC7919 )
233 #define PSA_DH_GROUP_FFDHE8192 \
234 MBEDTLS_DEPRECATED_CONSTANT( psa_dh_family_t, PSA_DH_FAMILY_RFC7919 )
235
236 /*
237 * Diffie-Hellman families that changed name due to PSA specification.
238 */
239 #define PSA_DH_GROUP_RFC7919 \
240 MBEDTLS_DEPRECATED_CONSTANT( psa_dh_family_t, PSA_DH_FAMILY_RFC7919 )
241 #define PSA_DH_GROUP_CUSTOM \
242 MBEDTLS_DEPRECATED_CONSTANT( psa_dh_family_t, PSA_DH_FAMILY_CUSTOM )
243
244 /*
245 * Deprecated PSA Crypto stream cipher algorithms (PSA Crypto API <= 1.0 beta3)
246 */
247 #define PSA_ALG_ARC4 \
248 MBEDTLS_DEPRECATED_CONSTANT( psa_algorithm_t, PSA_ALG_STREAM_CIPHER )
249 #define PSA_ALG_CHACHA20 \
250 MBEDTLS_DEPRECATED_CONSTANT( psa_algorithm_t, PSA_ALG_STREAM_CIPHER )
251
252 #endif /* MBEDTLS_DEPRECATED_REMOVED */
253
254 /** Open a handle to an existing persistent key.
255 *
256 * Open a handle to a persistent key. A key is persistent if it was created
257 * with a lifetime other than #PSA_KEY_LIFETIME_VOLATILE. A persistent key
258 * always has a nonzero key identifier, set with psa_set_key_id() when
259 * creating the key. Implementations may provide additional pre-provisioned
260 * keys that can be opened with psa_open_key(). Such keys have an application
261 * key identifier in the vendor range, as documented in the description of
262 * #psa_key_id_t.
263 *
264 * The application must eventually close the handle with psa_close_key() or
265 * psa_destroy_key() to release associated resources. If the application dies
266 * without calling one of these functions, the implementation should perform
267 * the equivalent of a call to psa_close_key().
268 *
269 * Some implementations permit an application to open the same key multiple
270 * times. If this is successful, each call to psa_open_key() will return a
271 * different key handle.
272 *
273 * \note This API is not part of the PSA Cryptography API Release 1.0.0
274 * specification. It was defined in the 1.0 Beta 3 version of the
275 * specification but was removed in the 1.0.0 released version. This API is
276 * kept for the time being to not break applications relying on it. It is not
277 * deprecated yet but will be in the near future.
278 *
279 * \note Applications that rely on opening a key multiple times will not be
280 * portable to implementations that only permit a single key handle to be
281 * opened. See also :ref:\`key-handles\`.
282 *
283 *
284 * \param key The persistent identifier of the key.
285 * \param[out] handle On success, a handle to the key.
286 *
287 * \retval #PSA_SUCCESS
288 * Success. The application can now use the value of `*handle`
289 * to access the key.
290 * \retval #PSA_ERROR_INSUFFICIENT_MEMORY
291 * The implementation does not have sufficient resources to open the
292 * key. This can be due to reaching an implementation limit on the
293 * number of open keys, the number of open key handles, or available
294 * memory.
295 * \retval #PSA_ERROR_DOES_NOT_EXIST
296 * There is no persistent key with key identifier \p id.
297 * \retval #PSA_ERROR_INVALID_ARGUMENT
298 * \p id is not a valid persistent key identifier.
299 * \retval #PSA_ERROR_NOT_PERMITTED
300 * The specified key exists, but the application does not have the
301 * permission to access it. Note that this specification does not
302 * define any way to create such a key, but it may be possible
303 * through implementation-specific means.
304 * \retval #PSA_ERROR_COMMUNICATION_FAILURE
305 * \retval #PSA_ERROR_CORRUPTION_DETECTED
306 * \retval #PSA_ERROR_STORAGE_FAILURE
307 * \retval #PSA_ERROR_BAD_STATE
308 * The library has not been previously initialized by psa_crypto_init().
309 * It is implementation-dependent whether a failure to initialize
310 * results in this error code.
311 */
312 psa_status_t psa_open_key( mbedtls_svc_key_id_t key,
313 psa_key_handle_t *handle );
314
315 /** Close a key handle.
316 *
317 * If the handle designates a volatile key, this will destroy the key material
318 * and free all associated resources, just like psa_destroy_key().
319 *
320 * If this is the last open handle to a persistent key, then closing the handle
321 * will free all resources associated with the key in volatile memory. The key
322 * data in persistent storage is not affected and can be opened again later
323 * with a call to psa_open_key().
324 *
325 * Closing the key handle makes the handle invalid, and the key handle
326 * must not be used again by the application.
327 *
328 * \note This API is not part of the PSA Cryptography API Release 1.0.0
329 * specification. It was defined in the 1.0 Beta 3 version of the
330 * specification but was removed in the 1.0.0 released version. This API is
331 * kept for the time being to not break applications relying on it. It is not
332 * deprecated yet but will be in the near future.
333 *
334 * \note If the key handle was used to set up an active
335 * :ref:\`multipart operation <multipart-operations>\`, then closing the
336 * key handle can cause the multipart operation to fail. Applications should
337 * maintain the key handle until after the multipart operation has finished.
338 *
339 * \param handle The key handle to close.
340 * If this is \c 0, do nothing and return \c PSA_SUCCESS.
341 *
342 * \retval #PSA_SUCCESS
343 * \p handle was a valid handle or \c 0. It is now closed.
344 * \retval #PSA_ERROR_INVALID_HANDLE
345 * \p handle is not a valid handle nor \c 0.
346 * \retval #PSA_ERROR_COMMUNICATION_FAILURE
347 * \retval #PSA_ERROR_CORRUPTION_DETECTED
348 * \retval #PSA_ERROR_BAD_STATE
349 * The library has not been previously initialized by psa_crypto_init().
350 * It is implementation-dependent whether a failure to initialize
351 * results in this error code.
352 */
353 psa_status_t psa_close_key(psa_key_handle_t handle);
354
355 #ifdef __cplusplus
356 }
357 #endif
358
359 #endif /* PSA_CRYPTO_COMPAT_H */
360
