Add Testing Validation and Fixes for wolfPSA

src/psa_aead.c

@@ -105,6 +105,8 @@ static psa_status_t wolfpsa_aead_check_key(psa_key_id_t key,
     psa_status_t status;
     psa_key_usage_t key_usage;
     psa_algorithm_t key_alg;
+    psa_algorithm_t key_base;
+    psa_algorithm_t req_base;
     size_t key_tag_len;
     size_t req_tag_len;
 
@@ -153,41 +155,40 @@ static psa_status_t wolfpsa_aead_check_key(psa_key_id_t key,
         return PSA_ERROR_NOT_PERMITTED;
     }
 
-    {
-        psa_algorithm_t key_base = PSA_ALG_AEAD_WITH_DEFAULT_LENGTH_TAG(key_alg);
-        psa_algorithm_t req_base = PSA_ALG_AEAD_WITH_DEFAULT_LENGTH_TAG(alg);
-        key_tag_len = wolfpsa_aead_tag_length(key_alg);
-        req_tag_len = wolfpsa_aead_tag_length(alg);
+    /* Algorithm match checks */
+    key_base = PSA_ALG_AEAD_WITH_DEFAULT_LENGTH_TAG(key_alg);
+    req_base = PSA_ALG_AEAD_WITH_DEFAULT_LENGTH_TAG(alg);
+    key_tag_len = wolfpsa_aead_tag_length(key_alg);
+    req_tag_len = wolfpsa_aead_tag_length(alg);
 
-        if (key_tag_len == 0 || req_tag_len == 0) {
-            wolfpsa_forcezero_free_key_data(*key_data, *key_data_length);
-            *key_data = NULL;
-            *key_data_length = 0;
-            return PSA_ERROR_INVALID_ARGUMENT;
-        }
+    if (key_tag_len == 0 || req_tag_len == 0) {
+        wolfpsa_forcezero_free_key_data(*key_data, *key_data_length);
+        *key_data = NULL;
+        *key_data_length = 0;
+        return PSA_ERROR_INVALID_ARGUMENT;
+    }
 
-        if (key_base != req_base) {
-            wolfpsa_forcezero_free_key_data(*key_data, *key_data_length);
-            *key_data = NULL;
-            *key_data_length = 0;
-            return PSA_ERROR_NOT_PERMITTED;
-        }
+    if (key_base != req_base) {
+        wolfpsa_forcezero_free_key_data(*key_data, *key_data_length);
+        *key_data = NULL;
+        *key_data_length = 0;
+        return PSA_ERROR_NOT_PERMITTED;
+    }
 
-        if ((key_alg & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) {
-            if (req_tag_len < key_tag_len) {
-                wolfpsa_forcezero_free_key_data(*key_data, *key_data_length);
-                *key_data = NULL;
-                *key_data_length = 0;
-                return PSA_ERROR_NOT_PERMITTED;
-            }
-        }
-        else if (req_tag_len != key_tag_len) {
+    if ((key_alg & PSA_ALG_AEAD_AT_LEAST_THIS_LENGTH_FLAG) != 0) {
+        if (req_tag_len < key_tag_len) {
             wolfpsa_forcezero_free_key_data(*key_data, *key_data_length);
             *key_data = NULL;
             *key_data_length = 0;
             return PSA_ERROR_NOT_PERMITTED;
         }
     }
+    else if (req_tag_len != key_tag_len) {
+        wolfpsa_forcezero_free_key_data(*key_data, *key_data_length);
+        *key_data = NULL;
+        *key_data_length = 0;
+        return PSA_ERROR_NOT_PERMITTED;
+    }
 
     return PSA_SUCCESS;
 }

src/psa_asymmetric_api.c

@@ -174,6 +174,7 @@ static psa_status_t wolfpsa_asymmetric_check_key(psa_key_id_t key,
         return PSA_ERROR_NOT_PERMITTED;
     }
 
+    /* Algorithm match checks */
     if (PSA_ALG_IS_KEY_AGREEMENT(alg) && PSA_ALG_IS_KEY_AGREEMENT(key_alg)) {
         if (PSA_ALG_KEY_AGREEMENT_GET_BASE(key_alg) !=
             PSA_ALG_KEY_AGREEMENT_GET_BASE(alg)) {

src/psa_key_derivation.c

@@ -643,6 +643,7 @@ psa_status_t psa_key_derivation_input_key(psa_key_derivation_operation_t *operat
         return PSA_ERROR_NOT_PERMITTED;
     }
 
+    /* Algorithm match checks */
     if (ctx->is_key_agreement) {
         if (!PSA_ALG_IS_KEY_AGREEMENT(key_alg) ||
             PSA_ALG_KEY_AGREEMENT_GET_KDF(key_alg) != ctx->alg) {
@@ -756,6 +757,18 @@ static psa_status_t wolfpsa_kdf_hkdf(wolfpsa_kdf_ctx_t *ctx,
         if (output_length > (size_t)hash_len) {
             return PSA_ERROR_INVALID_ARGUMENT;
         }
+        if (output_length < (size_t)hash_len) {
+            uint8_t tmp[WC_MAX_DIGEST_SIZE];
+            ret = wc_HKDF_Extract(hash_type,
+                                  ctx->salt, (word32)ctx->salt_length,
+                                  ctx->secret, (word32)ctx->secret_length,
+                                  tmp);
+            if (ret == 0) {
+                XMEMCPY(output, tmp, output_length);
+            }
+            wc_ForceZero(tmp, sizeof(tmp));
+            return ret == 0 ? PSA_SUCCESS : wc_error_to_psa_status(ret);
+        }
         ret = wc_HKDF_Extract(hash_type,
                               ctx->salt, (word32)ctx->salt_length,
                               ctx->secret, (word32)ctx->secret_length,

src/psa_mac.c

@@ -162,15 +162,17 @@ static psa_status_t wolfpsa_mac_check_key(psa_key_id_t key,
     }
 
     key_alg = psa_get_key_algorithm(attributes);
-    key_alg_full = PSA_ALG_FULL_LENGTH_MAC(key_alg);
-    req_alg_full = PSA_ALG_FULL_LENGTH_MAC(alg);
     if (key_alg == PSA_ALG_NONE) {
         wolfpsa_forcezero_free_key_data(*key_data, *key_data_length);
         *key_data = NULL;
         *key_data_length = 0;
         return PSA_ERROR_NOT_PERMITTED;
     }
 
+    /* Algorithm match checks */
+    key_alg_full = PSA_ALG_FULL_LENGTH_MAC(key_alg);
+    req_alg_full = PSA_ALG_FULL_LENGTH_MAC(alg);
+
     if (key_alg_full != req_alg_full) {
         wolfpsa_forcezero_free_key_data(*key_data, *key_data_length);
         *key_data = NULL;
@@ -258,6 +260,7 @@ static psa_status_t wolfpsa_mac_setup(psa_mac_operation_t *operation,
                                        PSA_ALG_FULL_LENGTH_MAC(alg));
     if (wolfpsa_check_word32_length(key_data_length) != PSA_SUCCESS) {
         wolfpsa_forcezero_free_key_data(key_data, key_data_length);
+        wc_ForceZero(ctx, sizeof(*ctx));
         XFREE(ctx, NULL, DYNAMIC_TYPE_TMP_BUFFER);
         return PSA_ERROR_INVALID_ARGUMENT;
     }