/src/mbedtls/library/psa_crypto_mac.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * PSA MAC layer on top of Mbed TLS software crypto |
3 | | */ |
4 | | /* |
5 | | * Copyright The Mbed TLS Contributors |
6 | | * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later |
7 | | */ |
8 | | |
9 | | #include "common.h" |
10 | | |
11 | | #if defined(MBEDTLS_PSA_CRYPTO_C) |
12 | | |
13 | | #include <psa/crypto.h> |
14 | | #include "psa_crypto_core.h" |
15 | | #include "psa_crypto_cipher.h" |
16 | | #include "psa_crypto_mac.h" |
17 | | #include <mbedtls/md.h> |
18 | | |
19 | | #include <mbedtls/error.h> |
20 | | #include "mbedtls/constant_time.h" |
21 | | #include <string.h> |
22 | | |
23 | | #if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC) |
24 | | static psa_status_t psa_hmac_abort_internal( |
25 | | mbedtls_psa_hmac_operation_t *hmac) |
26 | 0 | { |
27 | 0 | mbedtls_platform_zeroize(hmac->opad, sizeof(hmac->opad)); |
28 | 0 | return psa_hash_abort(&hmac->hash_ctx); |
29 | 0 | } |
30 | | |
31 | | static psa_status_t psa_hmac_setup_internal( |
32 | | mbedtls_psa_hmac_operation_t *hmac, |
33 | | const uint8_t *key, |
34 | | size_t key_length, |
35 | | psa_algorithm_t hash_alg) |
36 | 0 | { |
37 | 0 | uint8_t ipad[PSA_HMAC_MAX_HASH_BLOCK_SIZE]; |
38 | 0 | size_t i; |
39 | 0 | size_t hash_size = PSA_HASH_LENGTH(hash_alg); |
40 | 0 | size_t block_size = PSA_HASH_BLOCK_LENGTH(hash_alg); |
41 | 0 | psa_status_t status; |
42 | |
|
43 | 0 | hmac->alg = hash_alg; |
44 | | |
45 | | /* Sanity checks on block_size, to guarantee that there won't be a buffer |
46 | | * overflow below. This should never trigger if the hash algorithm |
47 | | * is implemented correctly. */ |
48 | | /* The size checks against the ipad and opad buffers cannot be written |
49 | | * `block_size > sizeof( ipad ) || block_size > sizeof( hmac->opad )` |
50 | | * because that triggers -Wlogical-op on GCC 7.3. */ |
51 | 0 | if (block_size > sizeof(ipad)) { |
52 | 0 | return PSA_ERROR_NOT_SUPPORTED; |
53 | 0 | } |
54 | 0 | if (block_size > sizeof(hmac->opad)) { |
55 | 0 | return PSA_ERROR_NOT_SUPPORTED; |
56 | 0 | } |
57 | 0 | if (block_size < hash_size) { |
58 | 0 | return PSA_ERROR_NOT_SUPPORTED; |
59 | 0 | } |
60 | | |
61 | 0 | if (key_length > block_size) { |
62 | 0 | status = psa_hash_compute(hash_alg, key, key_length, |
63 | 0 | ipad, sizeof(ipad), &key_length); |
64 | 0 | if (status != PSA_SUCCESS) { |
65 | 0 | goto cleanup; |
66 | 0 | } |
67 | 0 | } |
68 | | /* A 0-length key is not commonly used in HMAC when used as a MAC, |
69 | | * but it is permitted. It is common when HMAC is used in HKDF, for |
70 | | * example. Don't call `memcpy` in the 0-length because `key` could be |
71 | | * an invalid pointer which would make the behavior undefined. */ |
72 | 0 | else if (key_length != 0) { |
73 | 0 | memcpy(ipad, key, key_length); |
74 | 0 | } |
75 | | |
76 | | /* ipad contains the key followed by garbage. Xor and fill with 0x36 |
77 | | * to create the ipad value. */ |
78 | 0 | for (i = 0; i < key_length; i++) { |
79 | 0 | ipad[i] ^= 0x36; |
80 | 0 | } |
81 | 0 | memset(ipad + key_length, 0x36, block_size - key_length); |
82 | | |
83 | | /* Copy the key material from ipad to opad, flipping the requisite bits, |
84 | | * and filling the rest of opad with the requisite constant. */ |
85 | 0 | for (i = 0; i < key_length; i++) { |
86 | 0 | hmac->opad[i] = ipad[i] ^ 0x36 ^ 0x5C; |
87 | 0 | } |
88 | 0 | memset(hmac->opad + key_length, 0x5C, block_size - key_length); |
89 | |
|
90 | 0 | status = psa_hash_setup(&hmac->hash_ctx, hash_alg); |
91 | 0 | if (status != PSA_SUCCESS) { |
92 | 0 | goto cleanup; |
93 | 0 | } |
94 | | |
95 | 0 | status = psa_hash_update(&hmac->hash_ctx, ipad, block_size); |
96 | |
|
97 | 0 | cleanup: |
98 | 0 | mbedtls_platform_zeroize(ipad, sizeof(ipad)); |
99 | |
|
100 | 0 | return status; |
101 | 0 | } |
102 | | |
103 | | static psa_status_t psa_hmac_update_internal( |
104 | | mbedtls_psa_hmac_operation_t *hmac, |
105 | | const uint8_t *data, |
106 | | size_t data_length) |
107 | 0 | { |
108 | 0 | return psa_hash_update(&hmac->hash_ctx, data, data_length); |
109 | 0 | } |
110 | | |
111 | | static psa_status_t psa_hmac_finish_internal( |
112 | | mbedtls_psa_hmac_operation_t *hmac, |
113 | | uint8_t *mac, |
114 | | size_t mac_size) |
115 | 0 | { |
116 | 0 | uint8_t tmp[PSA_HASH_MAX_SIZE]; |
117 | 0 | psa_algorithm_t hash_alg = hmac->alg; |
118 | 0 | size_t hash_size = 0; |
119 | 0 | size_t block_size = PSA_HASH_BLOCK_LENGTH(hash_alg); |
120 | 0 | psa_status_t status; |
121 | |
|
122 | 0 | status = psa_hash_finish(&hmac->hash_ctx, tmp, sizeof(tmp), &hash_size); |
123 | 0 | if (status != PSA_SUCCESS) { |
124 | 0 | return status; |
125 | 0 | } |
126 | | /* From here on, tmp needs to be wiped. */ |
127 | | |
128 | 0 | status = psa_hash_setup(&hmac->hash_ctx, hash_alg); |
129 | 0 | if (status != PSA_SUCCESS) { |
130 | 0 | goto exit; |
131 | 0 | } |
132 | | |
133 | 0 | status = psa_hash_update(&hmac->hash_ctx, hmac->opad, block_size); |
134 | 0 | if (status != PSA_SUCCESS) { |
135 | 0 | goto exit; |
136 | 0 | } |
137 | | |
138 | 0 | status = psa_hash_update(&hmac->hash_ctx, tmp, hash_size); |
139 | 0 | if (status != PSA_SUCCESS) { |
140 | 0 | goto exit; |
141 | 0 | } |
142 | | |
143 | 0 | status = psa_hash_finish(&hmac->hash_ctx, tmp, sizeof(tmp), &hash_size); |
144 | 0 | if (status != PSA_SUCCESS) { |
145 | 0 | goto exit; |
146 | 0 | } |
147 | | |
148 | 0 | memcpy(mac, tmp, mac_size); |
149 | |
|
150 | 0 | exit: |
151 | 0 | mbedtls_platform_zeroize(tmp, hash_size); |
152 | 0 | return status; |
153 | 0 | } |
154 | | #endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */ |
155 | | |
156 | | #if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC) |
157 | | static psa_status_t cmac_setup(mbedtls_psa_mac_operation_t *operation, |
158 | | const psa_key_attributes_t *attributes, |
159 | | const uint8_t *key_buffer) |
160 | 0 | { |
161 | 0 | int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; |
162 | |
|
163 | 0 | #if defined(PSA_WANT_KEY_TYPE_DES) |
164 | | /* Mbed TLS CMAC does not accept 3DES with only two keys, nor does it accept |
165 | | * to do CMAC with pure DES, so return NOT_SUPPORTED here. */ |
166 | 0 | if (psa_get_key_type(attributes) == PSA_KEY_TYPE_DES && |
167 | 0 | (psa_get_key_bits(attributes) == 64 || |
168 | 0 | psa_get_key_bits(attributes) == 128)) { |
169 | 0 | return PSA_ERROR_NOT_SUPPORTED; |
170 | 0 | } |
171 | 0 | #endif |
172 | | |
173 | 0 | const mbedtls_cipher_info_t *cipher_info = |
174 | 0 | mbedtls_cipher_info_from_psa( |
175 | 0 | PSA_ALG_CMAC, |
176 | 0 | psa_get_key_type(attributes), |
177 | 0 | psa_get_key_bits(attributes), |
178 | 0 | NULL); |
179 | |
|
180 | 0 | if (cipher_info == NULL) { |
181 | 0 | return PSA_ERROR_NOT_SUPPORTED; |
182 | 0 | } |
183 | | |
184 | 0 | ret = mbedtls_cipher_setup(&operation->ctx.cmac, cipher_info); |
185 | 0 | if (ret != 0) { |
186 | 0 | goto exit; |
187 | 0 | } |
188 | | |
189 | 0 | ret = mbedtls_cipher_cmac_starts(&operation->ctx.cmac, |
190 | 0 | key_buffer, |
191 | 0 | psa_get_key_bits(attributes)); |
192 | 0 | exit: |
193 | 0 | return mbedtls_to_psa_error(ret); |
194 | 0 | } |
195 | | #endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */ |
196 | | |
197 | | #if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC) || \ |
198 | | defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC) |
199 | | |
200 | | /* Initialize this driver's MAC operation structure. Once this function has been |
201 | | * called, mbedtls_psa_mac_abort can run and will do the right thing. */ |
202 | | static psa_status_t mac_init( |
203 | | mbedtls_psa_mac_operation_t *operation, |
204 | | psa_algorithm_t alg) |
205 | 0 | { |
206 | 0 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
207 | |
|
208 | 0 | operation->alg = alg; |
209 | |
|
210 | 0 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC) |
211 | 0 | if (PSA_ALG_FULL_LENGTH_MAC(operation->alg) == PSA_ALG_CMAC) { |
212 | 0 | mbedtls_cipher_init(&operation->ctx.cmac); |
213 | 0 | status = PSA_SUCCESS; |
214 | 0 | } else |
215 | 0 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */ |
216 | 0 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC) |
217 | 0 | if (PSA_ALG_IS_HMAC(operation->alg)) { |
218 | | /* We'll set up the hash operation later in psa_hmac_setup_internal. */ |
219 | 0 | operation->ctx.hmac.alg = 0; |
220 | 0 | status = PSA_SUCCESS; |
221 | 0 | } else |
222 | 0 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */ |
223 | 0 | { |
224 | 0 | (void) operation; |
225 | 0 | status = PSA_ERROR_NOT_SUPPORTED; |
226 | 0 | } |
227 | |
|
228 | 0 | if (status != PSA_SUCCESS) { |
229 | 0 | memset(operation, 0, sizeof(*operation)); |
230 | 0 | } |
231 | 0 | return status; |
232 | 0 | } |
233 | | |
234 | | psa_status_t mbedtls_psa_mac_abort(mbedtls_psa_mac_operation_t *operation) |
235 | 0 | { |
236 | 0 | if (operation->alg == 0) { |
237 | | /* The object has (apparently) been initialized but it is not |
238 | | * in use. It's ok to call abort on such an object, and there's |
239 | | * nothing to do. */ |
240 | 0 | return PSA_SUCCESS; |
241 | 0 | } else |
242 | 0 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC) |
243 | 0 | if (PSA_ALG_FULL_LENGTH_MAC(operation->alg) == PSA_ALG_CMAC) { |
244 | 0 | mbedtls_cipher_free(&operation->ctx.cmac); |
245 | 0 | } else |
246 | 0 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */ |
247 | 0 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC) |
248 | 0 | if (PSA_ALG_IS_HMAC(operation->alg)) { |
249 | 0 | psa_hmac_abort_internal(&operation->ctx.hmac); |
250 | 0 | } else |
251 | 0 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */ |
252 | 0 | { |
253 | | /* Sanity check (shouldn't happen: operation->alg should |
254 | | * always have been initialized to a valid value). */ |
255 | 0 | goto bad_state; |
256 | 0 | } |
257 | | |
258 | 0 | operation->alg = 0; |
259 | |
|
260 | 0 | return PSA_SUCCESS; |
261 | | |
262 | 0 | bad_state: |
263 | | /* If abort is called on an uninitialized object, we can't trust |
264 | | * anything. Wipe the object in case it contains confidential data. |
265 | | * This may result in a memory leak if a pointer gets overwritten, |
266 | | * but it's too late to do anything about this. */ |
267 | 0 | memset(operation, 0, sizeof(*operation)); |
268 | 0 | return PSA_ERROR_BAD_STATE; |
269 | 0 | } |
270 | | |
271 | | static psa_status_t psa_mac_setup(mbedtls_psa_mac_operation_t *operation, |
272 | | const psa_key_attributes_t *attributes, |
273 | | const uint8_t *key_buffer, |
274 | | size_t key_buffer_size, |
275 | | psa_algorithm_t alg) |
276 | 0 | { |
277 | 0 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
278 | | |
279 | | /* A context must be freshly initialized before it can be set up. */ |
280 | 0 | if (operation->alg != 0) { |
281 | 0 | return PSA_ERROR_BAD_STATE; |
282 | 0 | } |
283 | | |
284 | 0 | status = mac_init(operation, alg); |
285 | 0 | if (status != PSA_SUCCESS) { |
286 | 0 | return status; |
287 | 0 | } |
288 | | |
289 | 0 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC) |
290 | 0 | if (PSA_ALG_FULL_LENGTH_MAC(alg) == PSA_ALG_CMAC) { |
291 | | /* Key buffer size for CMAC is dictated by the key bits set on the |
292 | | * attributes, and previously validated by the core on key import. */ |
293 | 0 | (void) key_buffer_size; |
294 | 0 | status = cmac_setup(operation, attributes, key_buffer); |
295 | 0 | } else |
296 | 0 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */ |
297 | 0 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC) |
298 | 0 | if (PSA_ALG_IS_HMAC(alg)) { |
299 | 0 | status = psa_hmac_setup_internal(&operation->ctx.hmac, |
300 | 0 | key_buffer, |
301 | 0 | key_buffer_size, |
302 | 0 | PSA_ALG_HMAC_GET_HASH(alg)); |
303 | 0 | } else |
304 | 0 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */ |
305 | 0 | { |
306 | 0 | (void) attributes; |
307 | 0 | (void) key_buffer; |
308 | 0 | (void) key_buffer_size; |
309 | 0 | status = PSA_ERROR_NOT_SUPPORTED; |
310 | 0 | } |
311 | |
|
312 | 0 | if (status != PSA_SUCCESS) { |
313 | 0 | mbedtls_psa_mac_abort(operation); |
314 | 0 | } |
315 | |
|
316 | 0 | return status; |
317 | 0 | } |
318 | | |
319 | | psa_status_t mbedtls_psa_mac_sign_setup( |
320 | | mbedtls_psa_mac_operation_t *operation, |
321 | | const psa_key_attributes_t *attributes, |
322 | | const uint8_t *key_buffer, |
323 | | size_t key_buffer_size, |
324 | | psa_algorithm_t alg) |
325 | 0 | { |
326 | 0 | return psa_mac_setup(operation, attributes, |
327 | 0 | key_buffer, key_buffer_size, alg); |
328 | 0 | } |
329 | | |
330 | | psa_status_t mbedtls_psa_mac_verify_setup( |
331 | | mbedtls_psa_mac_operation_t *operation, |
332 | | const psa_key_attributes_t *attributes, |
333 | | const uint8_t *key_buffer, |
334 | | size_t key_buffer_size, |
335 | | psa_algorithm_t alg) |
336 | 0 | { |
337 | 0 | return psa_mac_setup(operation, attributes, |
338 | 0 | key_buffer, key_buffer_size, alg); |
339 | 0 | } |
340 | | |
341 | | psa_status_t mbedtls_psa_mac_update( |
342 | | mbedtls_psa_mac_operation_t *operation, |
343 | | const uint8_t *input, |
344 | | size_t input_length) |
345 | 0 | { |
346 | 0 | if (operation->alg == 0) { |
347 | 0 | return PSA_ERROR_BAD_STATE; |
348 | 0 | } |
349 | | |
350 | 0 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC) |
351 | 0 | if (PSA_ALG_FULL_LENGTH_MAC(operation->alg) == PSA_ALG_CMAC) { |
352 | 0 | return mbedtls_to_psa_error( |
353 | 0 | mbedtls_cipher_cmac_update(&operation->ctx.cmac, |
354 | 0 | input, input_length)); |
355 | 0 | } else |
356 | 0 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */ |
357 | 0 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC) |
358 | 0 | if (PSA_ALG_IS_HMAC(operation->alg)) { |
359 | 0 | return psa_hmac_update_internal(&operation->ctx.hmac, |
360 | 0 | input, input_length); |
361 | 0 | } else |
362 | 0 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */ |
363 | 0 | { |
364 | | /* This shouldn't happen if `operation` was initialized by |
365 | | * a setup function. */ |
366 | 0 | (void) input; |
367 | 0 | (void) input_length; |
368 | 0 | return PSA_ERROR_BAD_STATE; |
369 | 0 | } |
370 | 0 | } |
371 | | |
372 | | static psa_status_t psa_mac_finish_internal( |
373 | | mbedtls_psa_mac_operation_t *operation, |
374 | | uint8_t *mac, size_t mac_size) |
375 | 0 | { |
376 | 0 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_CMAC) |
377 | 0 | if (PSA_ALG_FULL_LENGTH_MAC(operation->alg) == PSA_ALG_CMAC) { |
378 | 0 | uint8_t tmp[PSA_BLOCK_CIPHER_BLOCK_MAX_SIZE]; |
379 | 0 | int ret = mbedtls_cipher_cmac_finish(&operation->ctx.cmac, tmp); |
380 | 0 | if (ret == 0) { |
381 | 0 | memcpy(mac, tmp, mac_size); |
382 | 0 | } |
383 | 0 | mbedtls_platform_zeroize(tmp, sizeof(tmp)); |
384 | 0 | return mbedtls_to_psa_error(ret); |
385 | 0 | } else |
386 | 0 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_CMAC */ |
387 | 0 | #if defined(MBEDTLS_PSA_BUILTIN_ALG_HMAC) |
388 | 0 | if (PSA_ALG_IS_HMAC(operation->alg)) { |
389 | 0 | return psa_hmac_finish_internal(&operation->ctx.hmac, |
390 | 0 | mac, mac_size); |
391 | 0 | } else |
392 | 0 | #endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC */ |
393 | 0 | { |
394 | | /* This shouldn't happen if `operation` was initialized by |
395 | | * a setup function. */ |
396 | 0 | (void) operation; |
397 | 0 | (void) mac; |
398 | 0 | (void) mac_size; |
399 | 0 | return PSA_ERROR_BAD_STATE; |
400 | 0 | } |
401 | 0 | } |
402 | | |
403 | | psa_status_t mbedtls_psa_mac_sign_finish( |
404 | | mbedtls_psa_mac_operation_t *operation, |
405 | | uint8_t *mac, |
406 | | size_t mac_size, |
407 | | size_t *mac_length) |
408 | 0 | { |
409 | 0 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
410 | |
|
411 | 0 | if (operation->alg == 0) { |
412 | 0 | return PSA_ERROR_BAD_STATE; |
413 | 0 | } |
414 | | |
415 | 0 | status = psa_mac_finish_internal(operation, mac, mac_size); |
416 | 0 | if (status == PSA_SUCCESS) { |
417 | 0 | *mac_length = mac_size; |
418 | 0 | } |
419 | |
|
420 | 0 | return status; |
421 | 0 | } |
422 | | |
423 | | psa_status_t mbedtls_psa_mac_verify_finish( |
424 | | mbedtls_psa_mac_operation_t *operation, |
425 | | const uint8_t *mac, |
426 | | size_t mac_length) |
427 | 0 | { |
428 | 0 | uint8_t actual_mac[PSA_MAC_MAX_SIZE]; |
429 | 0 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
430 | |
|
431 | 0 | if (operation->alg == 0) { |
432 | 0 | return PSA_ERROR_BAD_STATE; |
433 | 0 | } |
434 | | |
435 | | /* Consistency check: requested MAC length fits our local buffer */ |
436 | 0 | if (mac_length > sizeof(actual_mac)) { |
437 | 0 | return PSA_ERROR_INVALID_ARGUMENT; |
438 | 0 | } |
439 | | |
440 | 0 | status = psa_mac_finish_internal(operation, actual_mac, mac_length); |
441 | 0 | if (status != PSA_SUCCESS) { |
442 | 0 | goto cleanup; |
443 | 0 | } |
444 | | |
445 | 0 | if (mbedtls_ct_memcmp(mac, actual_mac, mac_length) != 0) { |
446 | 0 | status = PSA_ERROR_INVALID_SIGNATURE; |
447 | 0 | } |
448 | |
|
449 | 0 | cleanup: |
450 | 0 | mbedtls_platform_zeroize(actual_mac, sizeof(actual_mac)); |
451 | |
|
452 | 0 | return status; |
453 | 0 | } |
454 | | |
455 | | psa_status_t mbedtls_psa_mac_compute( |
456 | | const psa_key_attributes_t *attributes, |
457 | | const uint8_t *key_buffer, |
458 | | size_t key_buffer_size, |
459 | | psa_algorithm_t alg, |
460 | | const uint8_t *input, |
461 | | size_t input_length, |
462 | | uint8_t *mac, |
463 | | size_t mac_size, |
464 | | size_t *mac_length) |
465 | 0 | { |
466 | 0 | psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED; |
467 | 0 | mbedtls_psa_mac_operation_t operation = MBEDTLS_PSA_MAC_OPERATION_INIT; |
468 | |
|
469 | 0 | status = psa_mac_setup(&operation, |
470 | 0 | attributes, key_buffer, key_buffer_size, |
471 | 0 | alg); |
472 | 0 | if (status != PSA_SUCCESS) { |
473 | 0 | goto exit; |
474 | 0 | } |
475 | | |
476 | 0 | if (input_length > 0) { |
477 | 0 | status = mbedtls_psa_mac_update(&operation, input, input_length); |
478 | 0 | if (status != PSA_SUCCESS) { |
479 | 0 | goto exit; |
480 | 0 | } |
481 | 0 | } |
482 | | |
483 | 0 | status = psa_mac_finish_internal(&operation, mac, mac_size); |
484 | 0 | if (status == PSA_SUCCESS) { |
485 | 0 | *mac_length = mac_size; |
486 | 0 | } |
487 | |
|
488 | 0 | exit: |
489 | 0 | mbedtls_psa_mac_abort(&operation); |
490 | |
|
491 | 0 | return status; |
492 | 0 | } |
493 | | |
494 | | #endif /* MBEDTLS_PSA_BUILTIN_ALG_HMAC || MBEDTLS_PSA_BUILTIN_ALG_CMAC */ |
495 | | |
496 | | #endif /* MBEDTLS_PSA_CRYPTO_C */ |