library/psa_crypto_mac.c - platform/external/mbedtls - Git at Google

 /*
  *  PSA MAC layer on top of Mbed TLS software crypto
  */
 /*
  *  Copyright The Mbed TLS Contributors
  *  SPDX-License-Identifier: Apache-2.0
  *
  *  Licensed under the Apache License, Version 2.0 (the "License"); you may
  *  not use this file except in compliance with the License.
  *  You may obtain a copy of the License at
  *
  *  http://www.apache.org/licenses/LICENSE-2.0
  *
  *  Unless required by applicable law or agreed to in writing, software
  *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  *  See the License for the specific language governing permissions and
  *  limitations under the License.
  */

 #include "common.h"

 #if defined(MBEDTLS_PSA_CRYPTO_C)

 #include <psa/crypto.h>
 #include "psa_crypto_core.h"
 #include "psa_crypto_cipher.h"
 #include "psa_crypto_mac.h"
 #include <mbedtls/md.h>

 #include <mbedtls/error.h>
 #include <string.h>

 #if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
 static psa_status_t psa_hmac_abort_internal(
     mbedtls_psa_hmac_operation_t *hmac)
 {
     mbedtls_platform_zeroize(hmac->opad, sizeof(hmac->opad));
     return psa_hash_abort(&hmac->hash_ctx);
 }

 static psa_status_t psa_hmac_setup_internal(
     mbedtls_psa_hmac_operation_t *hmac,
     const uint8_t *key,
     size_t key_length,
     psa_algorithm_t hash_alg)
 {
     uint8_t ipad[PSA_HMAC_MAX_HASH_BLOCK_SIZE];
     size_t i;
     size_t hash_size = PSA_HASH_LENGTH(hash_alg);
     size_t block_size = PSA_HASH_BLOCK_LENGTH(hash_alg);
     psa_status_t status;

     hmac->alg = hash_alg;

     /* Sanity checks on block_size, to guarantee that there won't be a buffer
      * overflow below. This should never trigger if the hash algorithm
      * is implemented correctly. */
     /* The size checks against the ipad and opad buffers cannot be written
      * `block_size > sizeof( ipad ) || block_size > sizeof( hmac->opad )`
      * because that triggers -Wlogical-op on GCC 7.3. */
     if (block_size > sizeof(ipad)) {
         return PSA_ERROR_NOT_SUPPORTED;
     }
     if (block_size > sizeof(hmac->opad)) {
         return PSA_ERROR_NOT_SUPPORTED;
     }
     if (block_size < hash_size) {
         return PSA_ERROR_NOT_SUPPORTED;
     }

     if (key_length > block_size) {
         status = psa_hash_compute(hash_alg, key, key_length,
                                   ipad, sizeof(ipad), &key_length);
         if (status != PSA_SUCCESS) {
             goto cleanup;
         }
     }
     /* A 0-length key is not commonly used in HMAC when used as a MAC,
      * but it is permitted. It is common when HMAC is used in HKDF, for
      * example. Don't call `memcpy` in the 0-length because `key` could be
      * an invalid pointer which would make the behavior undefined. */
     else if (key_length != 0) {
         memcpy(ipad, key, key_length);
     }

     /* ipad contains the key followed by garbage. Xor and fill with 0x36
      * to create the ipad value. */
     for (i = 0; i < key_length; i++) {
         ipad[i] ^= 0x36;
     }
     memset(ipad + key_length, 0x36, block_size - key_length);

     /* Copy the key material from ipad to opad, flipping the requisite bits,
      * and filling the rest of opad with the requisite constant. */
     for (i = 0; i < key_length; i++) {
         hmac->opad[i] = ipad[i] ^ 0x36 ^ 0x5C;
     }
     memset(hmac->opad + key_length, 0x5C, block_size - key_length);

     status = psa_hash_setup(&hmac->hash_ctx, hash_alg);
     if (status != PSA_SUCCESS) {
         goto cleanup;
     }

     status = psa_hash_update(&hmac->hash_ctx, ipad, block_size);

 cleanup:
     mbedtls_platform_zeroize(ipad, sizeof(ipad));

     return status;
 }

 static psa_status_t psa_hmac_update_internal(
     mbedtls_psa_hmac_operation_t *hmac,
     const uint8_t *data,
     size_t data_length)
 {
     return psa_hash_update(&hmac->hash_ctx, data, data_length);
 }

 static psa_status_t psa_hmac_finish_internal(
     mbedtls_psa_hmac_operation_t *hmac,
     uint8_t *mac,
     size_t mac_size)
 {
     uint8_t tmp[PSA_HASH_MAX_SIZE];
     psa_algorithm_t hash_alg = hmac->alg;
     size_t hash_size = 0;
     size_t block_size = PSA_HASH_BLOCK_LENGTH(hash_alg);
     psa_status_t status;

     status = psa_hash_finish(&hmac->hash_ctx, tmp, sizeof(tmp), &hash_size);
     if (status != PSA_SUCCESS) {
         return status;
     }
     /* From here on, tmp needs to be wiped. */

     status = psa_hash_setup(&hmac->hash_ctx, hash_alg);
     if (status != PSA_SUCCESS) {
         goto exit;
     }

     status = psa_hash_update(&hmac->hash_ctx, hmac->opad, block_size);
     if (status != PSA_SUCCESS) {
         goto exit;
     }

     status = psa_hash_update(&hmac->hash_ctx, tmp, hash_size);
     if (status != PSA_SUCCESS) {
         goto exit;
     }

     status = psa_hash_finish(&hmac->hash_ctx, tmp, sizeof(tmp), &hash_size);
     if (status != PSA_SUCCESS) {
         goto exit;
     }

     memcpy(mac, tmp, mac_size);

 exit:
     mbedtls_platform_zeroize(tmp, hash_size);
     return status;
 }
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */

 #if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC)
 static psa_status_t cmac_setup(mbedtls_psa_mac_operation_t *operation,
                                const psa_key_attributes_t *attributes,
                                const uint8_t *key_buffer)
 {
     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;

 #if defined(PSA_WANT_KEY_TYPE_DES)
     /* Mbed TLS CMAC does not accept 3DES with only two keys, nor does it accept
      * to do CMAC with pure DES, so return NOT_SUPPORTED here. */
     if (psa_get_key_type(attributes) == PSA_KEY_TYPE_DES &&
         (psa_get_key_bits(attributes) == 64 ||
          psa_get_key_bits(attributes) == 128)) {
         return PSA_ERROR_NOT_SUPPORTED;
     }
 #endif

     const mbedtls_cipher_info_t *cipher_info =
         mbedtls_cipher_info_from_psa(
             PSA_ALG_CMAC,
             psa_get_key_type(attributes),
             psa_get_key_bits(attributes),
             NULL);

     if (cipher_info == NULL) {
         return PSA_ERROR_NOT_SUPPORTED;
     }

     ret = mbedtls_cipher_setup(&operation->ctx.cmac, cipher_info);
     if (ret != 0) {
         goto exit;
     }

     ret = mbedtls_cipher_cmac_starts(&operation->ctx.cmac,
                                      key_buffer,
                                      psa_get_key_bits(attributes));
 exit:
     return mbedtls_to_psa_error(ret);
 }
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */

 #if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC) || \
     defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC)

 /* Initialize this driver's MAC operation structure. Once this function has been
  * called, mbedtls_psa_mac_abort can run and will do the right thing. */
 static psa_status_t mac_init(
     mbedtls_psa_mac_operation_t *operation,
     psa_algorithm_t alg)
 {
     psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;

     operation->alg = alg;

 #if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC)
     if (PSA_ALG_FULL_LENGTH_MAC(operation->alg) == PSA_ALG_CMAC) {
         mbedtls_cipher_init(&operation->ctx.cmac);
         status = PSA_SUCCESS;
     } else
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */
 #if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
     if (PSA_ALG_IS_HMAC(operation->alg)) {
         /* We'll set up the hash operation later in psa_hmac_setup_internal. */
         operation->ctx.hmac.alg = 0;
         status = PSA_SUCCESS;
     } else
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
     {
         (void) operation;
         status = PSA_ERROR_NOT_SUPPORTED;
     }

     if (status != PSA_SUCCESS) {
         memset(operation, 0, sizeof(*operation));
     }
     return status;
 }

 psa_status_t mbedtls_psa_mac_abort(mbedtls_psa_mac_operation_t *operation)
 {
     if (operation->alg == 0) {
         /* The object has (apparently) been initialized but it is not
          * in use. It's ok to call abort on such an object, and there's
          * nothing to do. */
         return PSA_SUCCESS;
     } else
 #if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC)
     if (PSA_ALG_FULL_LENGTH_MAC(operation->alg) == PSA_ALG_CMAC) {
         mbedtls_cipher_free(&operation->ctx.cmac);
     } else
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */
 #if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
     if (PSA_ALG_IS_HMAC(operation->alg)) {
         psa_hmac_abort_internal(&operation->ctx.hmac);
     } else
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
     {
         /* Sanity check (shouldn't happen: operation->alg should
          * always have been initialized to a valid value). */
         goto bad_state;
     }

     operation->alg = 0;

     return PSA_SUCCESS;

 bad_state:
     /* If abort is called on an uninitialized object, we can't trust
      * anything. Wipe the object in case it contains confidential data.
      * This may result in a memory leak if a pointer gets overwritten,
      * but it's too late to do anything about this. */
     memset(operation, 0, sizeof(*operation));
     return PSA_ERROR_BAD_STATE;
 }

 static psa_status_t psa_mac_setup(mbedtls_psa_mac_operation_t *operation,
                                   const psa_key_attributes_t *attributes,
                                   const uint8_t *key_buffer,
                                   size_t key_buffer_size,
                                   psa_algorithm_t alg)
 {
     psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;

     /* A context must be freshly initialized before it can be set up. */
     if (operation->alg != 0) {
         return PSA_ERROR_BAD_STATE;
     }

     status = mac_init(operation, alg);
     if (status != PSA_SUCCESS) {
         return status;
     }

 #if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC)
     if (PSA_ALG_FULL_LENGTH_MAC(alg) == PSA_ALG_CMAC) {
         /* Key buffer size for CMAC is dictated by the key bits set on the
          * attributes, and previously validated by the core on key import. */
         (void) key_buffer_size;
         status = cmac_setup(operation, attributes, key_buffer);
     } else
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */
 #if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
     if (PSA_ALG_IS_HMAC(alg)) {
         status = psa_hmac_setup_internal(&operation->ctx.hmac,
                                          key_buffer,
                                          key_buffer_size,
                                          PSA_ALG_HMAC_GET_HASH(alg));
     } else
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
     {
         (void) attributes;
         (void) key_buffer;
         (void) key_buffer_size;
         status = PSA_ERROR_NOT_SUPPORTED;
     }

     if (status != PSA_SUCCESS) {
         mbedtls_psa_mac_abort(operation);
     }

     return status;
 }

 psa_status_t mbedtls_psa_mac_sign_setup(
     mbedtls_psa_mac_operation_t *operation,
     const psa_key_attributes_t *attributes,
     const uint8_t *key_buffer,
     size_t key_buffer_size,
     psa_algorithm_t alg)
 {
     return psa_mac_setup(operation, attributes,
                          key_buffer, key_buffer_size, alg);
 }

 psa_status_t mbedtls_psa_mac_verify_setup(
     mbedtls_psa_mac_operation_t *operation,
     const psa_key_attributes_t *attributes,
     const uint8_t *key_buffer,
     size_t key_buffer_size,
     psa_algorithm_t alg)
 {
     return psa_mac_setup(operation, attributes,
                          key_buffer, key_buffer_size, alg);
 }

 psa_status_t mbedtls_psa_mac_update(
     mbedtls_psa_mac_operation_t *operation,
     const uint8_t *input,
     size_t input_length)
 {
     if (operation->alg == 0) {
         return PSA_ERROR_BAD_STATE;
     }

 #if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC)
     if (PSA_ALG_FULL_LENGTH_MAC(operation->alg) == PSA_ALG_CMAC) {
         return mbedtls_to_psa_error(
             mbedtls_cipher_cmac_update(&operation->ctx.cmac,
                                        input, input_length));
     } else
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */
 #if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
     if (PSA_ALG_IS_HMAC(operation->alg)) {
         return psa_hmac_update_internal(&operation->ctx.hmac,
                                         input, input_length);
     } else
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
     {
         /* This shouldn't happen if `operation` was initialized by
          * a setup function. */
         (void) input;
         (void) input_length;
         return PSA_ERROR_BAD_STATE;
     }
 }

 static psa_status_t psa_mac_finish_internal(
     mbedtls_psa_mac_operation_t *operation,
     uint8_t *mac, size_t mac_size)
 {
 #if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC)
     if (PSA_ALG_FULL_LENGTH_MAC(operation->alg) == PSA_ALG_CMAC) {
         uint8_t tmp[PSA_BLOCK_CIPHER_BLOCK_MAX_SIZE];
         int ret = mbedtls_cipher_cmac_finish(&operation->ctx.cmac, tmp);
         if (ret == 0) {
             memcpy(mac, tmp, mac_size);
         }
         mbedtls_platform_zeroize(tmp, sizeof(tmp));
         return mbedtls_to_psa_error(ret);
     } else
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */
 #if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
     if (PSA_ALG_IS_HMAC(operation->alg)) {
         return psa_hmac_finish_internal(&operation->ctx.hmac,
                                         mac, mac_size);
     } else
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
     {
         /* This shouldn't happen if `operation` was initialized by
          * a setup function. */
         (void) operation;
         (void) mac;
         (void) mac_size;
         return PSA_ERROR_BAD_STATE;
     }
 }

 psa_status_t mbedtls_psa_mac_sign_finish(
     mbedtls_psa_mac_operation_t *operation,
     uint8_t *mac,
     size_t mac_size,
     size_t *mac_length)
 {
     psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;

     if (operation->alg == 0) {
         return PSA_ERROR_BAD_STATE;
     }

     status = psa_mac_finish_internal(operation, mac, mac_size);
     if (status == PSA_SUCCESS) {
         *mac_length = mac_size;
     }

     return status;
 }

 psa_status_t mbedtls_psa_mac_verify_finish(
     mbedtls_psa_mac_operation_t *operation,
     const uint8_t *mac,
     size_t mac_length)
 {
     uint8_t actual_mac[PSA_MAC_MAX_SIZE];
     psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;

     if (operation->alg == 0) {
         return PSA_ERROR_BAD_STATE;
     }

     /* Consistency check: requested MAC length fits our local buffer */
     if (mac_length > sizeof(actual_mac)) {
         return PSA_ERROR_INVALID_ARGUMENT;
     }

     status = psa_mac_finish_internal(operation, actual_mac, mac_length);
     if (status != PSA_SUCCESS) {
         goto cleanup;
     }

     if (mbedtls_psa_safer_memcmp(mac, actual_mac, mac_length) != 0) {
         status = PSA_ERROR_INVALID_SIGNATURE;
     }

 cleanup:
     mbedtls_platform_zeroize(actual_mac, sizeof(actual_mac));

     return status;
 }

 psa_status_t mbedtls_psa_mac_compute(
     const psa_key_attributes_t *attributes,
     const uint8_t *key_buffer,
     size_t key_buffer_size,
     psa_algorithm_t alg,
     const uint8_t *input,
     size_t input_length,
     uint8_t *mac,
     size_t mac_size,
     size_t *mac_length)
 {
     psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
     mbedtls_psa_mac_operation_t operation = MBEDTLS_PSA_MAC_OPERATION_INIT;

     status = psa_mac_setup(&operation,
                            attributes, key_buffer, key_buffer_size,
                            alg);
     if (status != PSA_SUCCESS) {
         goto exit;
     }

     if (input_length > 0) {
         status = mbedtls_psa_mac_update(&operation, input, input_length);
         if (status != PSA_SUCCESS) {
             goto exit;
         }
     }

     status = psa_mac_finish_internal(&operation, mac, mac_size);
     if (status == PSA_SUCCESS) {
         *mac_length = mac_size;
     }

 exit:
     mbedtls_psa_mac_abort(&operation);

     return status;
 }

 #endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC || MBEDTLS_PSA_BUILTIN_ALG_CMAC */

 #endif /* MBEDTLS_PSA_CRYPTO_C */
	/*
	* PSA MAC layer on top of Mbed TLS software crypto
	*/
	/*
	* Copyright The Mbed TLS Contributors
	* SPDX-License-Identifier: Apache-2.0
	*
	* Licensed under the Apache License, Version 2.0 (the "License"); you may
	* not use this file except in compliance with the License.
	* You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
	* WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*/

	#include "common.h"

	#if defined(MBEDTLS_PSA_CRYPTO_C)

	#include <psa/crypto.h>
	#include "psa_crypto_core.h"
	#include "psa_crypto_cipher.h"
	#include "psa_crypto_mac.h"
	#include <mbedtls/md.h>

	#include <mbedtls/error.h>
	#include <string.h>

	#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
	static psa_status_t psa_hmac_abort_internal(
	mbedtls_psa_hmac_operation_t *hmac)
	{
	mbedtls_platform_zeroize(hmac->opad, sizeof(hmac->opad));
	return psa_hash_abort(&hmac->hash_ctx);
	}

	static psa_status_t psa_hmac_setup_internal(
	mbedtls_psa_hmac_operation_t *hmac,
	const uint8_t *key,
	size_t key_length,
	psa_algorithm_t hash_alg)
	{
	uint8_t ipad[PSA_HMAC_MAX_HASH_BLOCK_SIZE];
	size_t i;
	size_t hash_size = PSA_HASH_LENGTH(hash_alg);
	size_t block_size = PSA_HASH_BLOCK_LENGTH(hash_alg);
	psa_status_t status;

	hmac->alg = hash_alg;

	/* Sanity checks on block_size, to guarantee that there won't be a buffer
	* overflow below. This should never trigger if the hash algorithm
	* is implemented correctly. */
	/* The size checks against the ipad and opad buffers cannot be written
	* `block_size > sizeof( ipad ) \|\| block_size > sizeof( hmac->opad )`
	* because that triggers -Wlogical-op on GCC 7.3. */
	if (block_size > sizeof(ipad)) {
	return PSA_ERROR_NOT_SUPPORTED;
	}
	if (block_size > sizeof(hmac->opad)) {
	return PSA_ERROR_NOT_SUPPORTED;
	}
	if (block_size < hash_size) {
	return PSA_ERROR_NOT_SUPPORTED;
	}

	if (key_length > block_size) {
	status = psa_hash_compute(hash_alg, key, key_length,
	ipad, sizeof(ipad), &key_length);
	if (status != PSA_SUCCESS) {
	goto cleanup;
	}
	}
	/* A 0-length key is not commonly used in HMAC when used as a MAC,
	* but it is permitted. It is common when HMAC is used in HKDF, for
	* example. Don't call `memcpy` in the 0-length because `key` could be
	* an invalid pointer which would make the behavior undefined. */
	else if (key_length != 0) {
	memcpy(ipad, key, key_length);
	}

	/* ipad contains the key followed by garbage. Xor and fill with 0x36
	* to create the ipad value. */
	for (i = 0; i < key_length; i++) {
	ipad[i] ^= 0x36;
	}
	memset(ipad + key_length, 0x36, block_size - key_length);

	/* Copy the key material from ipad to opad, flipping the requisite bits,
	* and filling the rest of opad with the requisite constant. */
	for (i = 0; i < key_length; i++) {
	hmac->opad[i] = ipad[i] ^ 0x36 ^ 0x5C;
	}
	memset(hmac->opad + key_length, 0x5C, block_size - key_length);

	status = psa_hash_setup(&hmac->hash_ctx, hash_alg);
	if (status != PSA_SUCCESS) {
	goto cleanup;
	}

	status = psa_hash_update(&hmac->hash_ctx, ipad, block_size);

	cleanup:
	mbedtls_platform_zeroize(ipad, sizeof(ipad));

	return status;
	}

	static psa_status_t psa_hmac_update_internal(
	mbedtls_psa_hmac_operation_t *hmac,
	const uint8_t *data,
	size_t data_length)
	{
	return psa_hash_update(&hmac->hash_ctx, data, data_length);
	}

	static psa_status_t psa_hmac_finish_internal(
	mbedtls_psa_hmac_operation_t *hmac,
	uint8_t *mac,
	size_t mac_size)
	{
	uint8_t tmp[PSA_HASH_MAX_SIZE];
	psa_algorithm_t hash_alg = hmac->alg;
	size_t hash_size = 0;
	size_t block_size = PSA_HASH_BLOCK_LENGTH(hash_alg);
	psa_status_t status;

	status = psa_hash_finish(&hmac->hash_ctx, tmp, sizeof(tmp), &hash_size);
	if (status != PSA_SUCCESS) {
	return status;
	}
	/* From here on, tmp needs to be wiped. */

	status = psa_hash_setup(&hmac->hash_ctx, hash_alg);
	if (status != PSA_SUCCESS) {
	goto exit;
	}

	status = psa_hash_update(&hmac->hash_ctx, hmac->opad, block_size);
	if (status != PSA_SUCCESS) {
	goto exit;
	}

	status = psa_hash_update(&hmac->hash_ctx, tmp, hash_size);
	if (status != PSA_SUCCESS) {
	goto exit;
	}

	status = psa_hash_finish(&hmac->hash_ctx, tmp, sizeof(tmp), &hash_size);
	if (status != PSA_SUCCESS) {
	goto exit;
	}

	memcpy(mac, tmp, mac_size);

	exit:
	mbedtls_platform_zeroize(tmp, hash_size);
	return status;
	}
	#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */

	#if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC)
	static psa_status_t cmac_setup(mbedtls_psa_mac_operation_t *operation,
	const psa_key_attributes_t *attributes,
	const uint8_t *key_buffer)
	{
	int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;

	#if defined(PSA_WANT_KEY_TYPE_DES)
	/* Mbed TLS CMAC does not accept 3DES with only two keys, nor does it accept
	* to do CMAC with pure DES, so return NOT_SUPPORTED here. */
	if (psa_get_key_type(attributes) == PSA_KEY_TYPE_DES &&
	(psa_get_key_bits(attributes) == 64 \|\|
	psa_get_key_bits(attributes) == 128)) {
	return PSA_ERROR_NOT_SUPPORTED;
	}
	#endif

	const mbedtls_cipher_info_t *cipher_info =
	mbedtls_cipher_info_from_psa(
	PSA_ALG_CMAC,
	psa_get_key_type(attributes),
	psa_get_key_bits(attributes),
	NULL);

	if (cipher_info == NULL) {
	return PSA_ERROR_NOT_SUPPORTED;
	}

	ret = mbedtls_cipher_setup(&operation->ctx.cmac, cipher_info);
	if (ret != 0) {
	goto exit;
	}

	ret = mbedtls_cipher_cmac_starts(&operation->ctx.cmac,
	key_buffer,
	psa_get_key_bits(attributes));
	exit:
	return mbedtls_to_psa_error(ret);
	}
	#endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */

	#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC) \|\| \
	defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC)

	/* Initialize this driver's MAC operation structure. Once this function has been
	* called, mbedtls_psa_mac_abort can run and will do the right thing. */
	static psa_status_t mac_init(
	mbedtls_psa_mac_operation_t *operation,
	psa_algorithm_t alg)
	{
	psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;

	operation->alg = alg;

	#if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC)
	if (PSA_ALG_FULL_LENGTH_MAC(operation->alg) == PSA_ALG_CMAC) {
	mbedtls_cipher_init(&operation->ctx.cmac);
	status = PSA_SUCCESS;
	} else
	#endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */
	#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
	if (PSA_ALG_IS_HMAC(operation->alg)) {
	/* We'll set up the hash operation later in psa_hmac_setup_internal. */
	operation->ctx.hmac.alg = 0;
	status = PSA_SUCCESS;
	} else
	#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
	{
	(void) operation;
	status = PSA_ERROR_NOT_SUPPORTED;
	}

	if (status != PSA_SUCCESS) {
	memset(operation, 0, sizeof(*operation));
	}
	return status;
	}

	psa_status_t mbedtls_psa_mac_abort(mbedtls_psa_mac_operation_t *operation)
	{
	if (operation->alg == 0) {
	/* The object has (apparently) been initialized but it is not
	* in use. It's ok to call abort on such an object, and there's
	* nothing to do. */
	return PSA_SUCCESS;
	} else
	#if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC)
	if (PSA_ALG_FULL_LENGTH_MAC(operation->alg) == PSA_ALG_CMAC) {
	mbedtls_cipher_free(&operation->ctx.cmac);
	} else
	#endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */
	#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
	if (PSA_ALG_IS_HMAC(operation->alg)) {
	psa_hmac_abort_internal(&operation->ctx.hmac);
	} else
	#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
	{
	/* Sanity check (shouldn't happen: operation->alg should
	* always have been initialized to a valid value). */
	goto bad_state;
	}

	operation->alg = 0;

	return PSA_SUCCESS;

	bad_state:
	/* If abort is called on an uninitialized object, we can't trust
	* anything. Wipe the object in case it contains confidential data.
	* This may result in a memory leak if a pointer gets overwritten,
	* but it's too late to do anything about this. */
	memset(operation, 0, sizeof(*operation));
	return PSA_ERROR_BAD_STATE;
	}

	static psa_status_t psa_mac_setup(mbedtls_psa_mac_operation_t *operation,
	const psa_key_attributes_t *attributes,
	const uint8_t *key_buffer,
	size_t key_buffer_size,
	psa_algorithm_t alg)
	{
	psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;

	/* A context must be freshly initialized before it can be set up. */
	if (operation->alg != 0) {
	return PSA_ERROR_BAD_STATE;
	}

	status = mac_init(operation, alg);
	if (status != PSA_SUCCESS) {
	return status;
	}

	#if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC)
	if (PSA_ALG_FULL_LENGTH_MAC(alg) == PSA_ALG_CMAC) {
	/* Key buffer size for CMAC is dictated by the key bits set on the
	* attributes, and previously validated by the core on key import. */
	(void) key_buffer_size;
	status = cmac_setup(operation, attributes, key_buffer);
	} else
	#endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */
	#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
	if (PSA_ALG_IS_HMAC(alg)) {
	status = psa_hmac_setup_internal(&operation->ctx.hmac,
	key_buffer,
	key_buffer_size,
	PSA_ALG_HMAC_GET_HASH(alg));
	} else
	#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
	{
	(void) attributes;
	(void) key_buffer;
	(void) key_buffer_size;
	status = PSA_ERROR_NOT_SUPPORTED;
	}

	if (status != PSA_SUCCESS) {
	mbedtls_psa_mac_abort(operation);
	}

	return status;
	}

	psa_status_t mbedtls_psa_mac_sign_setup(
	mbedtls_psa_mac_operation_t *operation,
	const psa_key_attributes_t *attributes,
	const uint8_t *key_buffer,
	size_t key_buffer_size,
	psa_algorithm_t alg)
	{
	return psa_mac_setup(operation, attributes,
	key_buffer, key_buffer_size, alg);
	}

	psa_status_t mbedtls_psa_mac_verify_setup(
	mbedtls_psa_mac_operation_t *operation,
	const psa_key_attributes_t *attributes,
	const uint8_t *key_buffer,
	size_t key_buffer_size,
	psa_algorithm_t alg)
	{
	return psa_mac_setup(operation, attributes,
	key_buffer, key_buffer_size, alg);
	}

	psa_status_t mbedtls_psa_mac_update(
	mbedtls_psa_mac_operation_t *operation,
	const uint8_t *input,
	size_t input_length)
	{
	if (operation->alg == 0) {
	return PSA_ERROR_BAD_STATE;
	}

	#if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC)
	if (PSA_ALG_FULL_LENGTH_MAC(operation->alg) == PSA_ALG_CMAC) {
	return mbedtls_to_psa_error(
	mbedtls_cipher_cmac_update(&operation->ctx.cmac,
	input, input_length));
	} else
	#endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */
	#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
	if (PSA_ALG_IS_HMAC(operation->alg)) {
	return psa_hmac_update_internal(&operation->ctx.hmac,
	input, input_length);
	} else
	#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
	{
	/* This shouldn't happen if `operation` was initialized by
	* a setup function. */
	(void) input;
	(void) input_length;
	return PSA_ERROR_BAD_STATE;
	}
	}

	static psa_status_t psa_mac_finish_internal(
	mbedtls_psa_mac_operation_t *operation,
	uint8_t *mac, size_t mac_size)
	{
	#if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC)
	if (PSA_ALG_FULL_LENGTH_MAC(operation->alg) == PSA_ALG_CMAC) {
	uint8_t tmp[PSA_BLOCK_CIPHER_BLOCK_MAX_SIZE];
	int ret = mbedtls_cipher_cmac_finish(&operation->ctx.cmac, tmp);
	if (ret == 0) {
	memcpy(mac, tmp, mac_size);
	}
	mbedtls_platform_zeroize(tmp, sizeof(tmp));
	return mbedtls_to_psa_error(ret);
	} else
	#endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */
	#if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC)
	if (PSA_ALG_IS_HMAC(operation->alg)) {
	return psa_hmac_finish_internal(&operation->ctx.hmac,
	mac, mac_size);
	} else
	#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */
	{
	/* This shouldn't happen if `operation` was initialized by
	* a setup function. */
	(void) operation;
	(void) mac;
	(void) mac_size;
	return PSA_ERROR_BAD_STATE;
	}
	}

	psa_status_t mbedtls_psa_mac_sign_finish(
	mbedtls_psa_mac_operation_t *operation,
	uint8_t *mac,
	size_t mac_size,
	size_t *mac_length)
	{
	psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;

	if (operation->alg == 0) {
	return PSA_ERROR_BAD_STATE;
	}

	status = psa_mac_finish_internal(operation, mac, mac_size);
	if (status == PSA_SUCCESS) {
	*mac_length = mac_size;
	}

	return status;
	}

	psa_status_t mbedtls_psa_mac_verify_finish(
	mbedtls_psa_mac_operation_t *operation,
	const uint8_t *mac,
	size_t mac_length)
	{
	uint8_t actual_mac[PSA_MAC_MAX_SIZE];
	psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;

	if (operation->alg == 0) {
	return PSA_ERROR_BAD_STATE;
	}

	/* Consistency check: requested MAC length fits our local buffer */
	if (mac_length > sizeof(actual_mac)) {
	return PSA_ERROR_INVALID_ARGUMENT;
	}

	status = psa_mac_finish_internal(operation, actual_mac, mac_length);
	if (status != PSA_SUCCESS) {
	goto cleanup;
	}

	if (mbedtls_psa_safer_memcmp(mac, actual_mac, mac_length) != 0) {
	status = PSA_ERROR_INVALID_SIGNATURE;
	}

	cleanup:
	mbedtls_platform_zeroize(actual_mac, sizeof(actual_mac));

	return status;
	}

	psa_status_t mbedtls_psa_mac_compute(
	const psa_key_attributes_t *attributes,
	const uint8_t *key_buffer,
	size_t key_buffer_size,
	psa_algorithm_t alg,
	const uint8_t *input,
	size_t input_length,
	uint8_t *mac,
	size_t mac_size,
	size_t *mac_length)
	{
	psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
	mbedtls_psa_mac_operation_t operation = MBEDTLS_PSA_MAC_OPERATION_INIT;

	status = psa_mac_setup(&operation,
	attributes, key_buffer, key_buffer_size,
	alg);
	if (status != PSA_SUCCESS) {
	goto exit;
	}

	if (input_length > 0) {
	status = mbedtls_psa_mac_update(&operation, input, input_length);
	if (status != PSA_SUCCESS) {
	goto exit;
	}
	}

	status = psa_mac_finish_internal(&operation, mac, mac_size);
	if (status == PSA_SUCCESS) {
	*mac_length = mac_size;
	}

	exit:
	mbedtls_psa_mac_abort(&operation);

	return status;
	}

	#endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC \|\| MBEDTLS_PSA_BUILTIN_ALG_CMAC */

	#endif /* MBEDTLS_PSA_CRYPTO_C */