Add driver and dispatch for MLDSA

CMakeLists.txt

@@ -408,6 +408,8 @@ endif()
 # drivers, that are appended in `drivers/CMakeLists.txt`.
 #
 set(TF_PSA_CRYPTO_PRIVATE_INCLUDE_DIRS
+        # psa_crypto_driver_wrappers.h is generated, so it may be in the build tree.
+        ${CMAKE_CURRENT_BINARY_DIR}/core
         ${CMAKE_CURRENT_SOURCE_DIR}/core
         ${CMAKE_CURRENT_SOURCE_DIR}/dispatch
         ${CMAKE_CURRENT_SOURCE_DIR}/extras

drivers/pqcp/src/psa_crypto_mldsa.c

@@ -8,8 +8,189 @@
 
 #if defined(MBEDTLS_PSA_CRYPTO_C) && defined(TF_PSA_CRYPTO_PQCP_MLDSA_ENABLED)
 
+#include <psa/crypto.h>
+#include "psa_crypto_mldsa.h"
 #include "wrap_mldsa_native.h"
+#include <mbedtls/platform_util.h>
 
-int tf_psa_crypto_pqcp_driver_exists = 1;
+/* The size of an ML-DSA seed in bytes.
+ * The PSA API uses the seed as the private key.
+ * (Some other ML-DSA interfaces use the "expanded secret", which is
+ * derived from the seed, as the private key.)
+ */
+#define SEED_SIZE 32
+
+/* For now, hard-coded values for MLDSA-87 */
+#define TF_PSA_CRYPTO_MLDSA_EXPANDED_SECRET_MAX_SIZE MLDSA87_SECRETKEYBYTES
+#define TF_PSA_CRYPTO_MLDSA_PUBLIC_KEY_MAX_SIZE MLDSA87_PUBLICKEYBYTES
+#define TF_PSA_CRYPTO_MLDSA_SIGNATURE_MAX_SIZE MLDSA87_BYTES
+
+static psa_status_t pqcp_to_psa_error(int ret)
+{
+    /* At the time of writing, mldsa-native has very few documented error
+     * conditions: only invalid signature on verification, and self-test
+     * failure. But this will change when we update mldsa-native
+     * with support for heap allocation of intermediate values.
+     */
+    if (ret == 0) {
+        return PSA_SUCCESS;
+    } else {
+        /* Not really hardware, but this is the fallback error code for
+         * something unexpectedly going wrong in a driver. */
+        return PSA_ERROR_HARDWARE_FAILURE;
+    }
+}
+
+static psa_status_t seed_to_public_key(
+    size_t bits,
+    const uint8_t *key_buffer, size_t key_buffer_size,
+    uint8_t *data, size_t data_size, size_t *data_length)
+{
+    if (key_buffer_size != SEED_SIZE) {
+        return PSA_ERROR_INVALID_ARGUMENT;
+    }
+
+    if (bits != 87) {
+        /* Other parameter sets are not supported yet. */
+        return PSA_ERROR_NOT_SUPPORTED;
+    }
+
+    size_t public_key_length = MLDSA87_PUBLICKEYBYTES;
+    if (data_size < public_key_length) {
+        return PSA_ERROR_BUFFER_TOO_SMALL;
+    }
+
+    /* Beyond this point, we must go through the cleanup code. */
+    uint8_t secret[TF_PSA_CRYPTO_MLDSA_EXPANDED_SECRET_MAX_SIZE];
+
+    int ret = tf_psa_crypto_pqcp_mldsa87_keypair_internal(data,
+                                                          secret,
+                                                          key_buffer);
+    if (ret != 0) {
+        goto cleanup;
+    }
+    ret = 0;
+    *data_length = public_key_length;
+
+cleanup:
+    mbedtls_platform_zeroize(secret, sizeof(secret));
+    return pqcp_to_psa_error(ret);
+}
+
+psa_status_t tf_psa_crypto_mldsa_export_public_key(
+    const psa_key_attributes_t *attributes,
+    const uint8_t *key_buffer, size_t key_buffer_size,
+    uint8_t *data, size_t data_size, size_t *data_length)
+{
+    *data_length = 0;           /* Safe default */
+
+    if (psa_get_key_type(attributes) != PSA_KEY_TYPE_ML_DSA_KEY_PAIR) {
+        return PSA_ERROR_NOT_SUPPORTED;
+    }
+
+    return seed_to_public_key(psa_get_key_bits(attributes),
+                              key_buffer, key_buffer_size,
+                              data, data_size, data_length);
+}
+
+psa_status_t tf_psa_crypto_mldsa_sign_message(
+    const psa_key_attributes_t *attributes,
+    const uint8_t *key_buffer, size_t key_buffer_size,
+    psa_algorithm_t alg,
+    const uint8_t *message, size_t message_length,
+    uint8_t *signature, size_t signature_size, size_t *signature_length)
+{
+    *signature_length = 0;      /* Safe default */
+
+    if (alg != PSA_ALG_DETERMINISTIC_ML_DSA) {
+        return PSA_ERROR_NOT_SUPPORTED;
+    }
+
+    if (psa_get_key_type(attributes) != PSA_KEY_TYPE_ML_DSA_KEY_PAIR) {
+        return PSA_ERROR_INVALID_ARGUMENT;
+    }
+    if (psa_get_key_bits(attributes) != 87) {
+        /* Other parameter sets are not supported yet. */
+        return PSA_ERROR_NOT_SUPPORTED;
+    }
+    size_t actual_signature_length = MLDSA87_BYTES;
+
+    if (key_buffer_size != SEED_SIZE) {
+        return PSA_ERROR_INVALID_ARGUMENT;
+    }
+
+    if (signature_size < actual_signature_length) {
+        return PSA_ERROR_BUFFER_TOO_SMALL;
+    }
+
+    /* Beyond this point, we must go through the cleanup code. */
+    uint8_t secret[TF_PSA_CRYPTO_MLDSA_EXPANDED_SECRET_MAX_SIZE];
+    uint8_t public[TF_PSA_CRYPTO_MLDSA_PUBLIC_KEY_MAX_SIZE];
+
+    int ret = tf_psa_crypto_pqcp_mldsa87_keypair_internal(public,
+                                                          secret,
+                                                          key_buffer);
+    if (ret != 0) {
+        goto cleanup;
+    }
+
+    const uint8_t prefix[2] = { 0, 0 }; // pure ML-DSA with empty context
+    const size_t prefix_length = sizeof(prefix);
+    const uint8_t rnd[MLDSA_RNDBYTES] = { 0 };
+
+    ret = tf_psa_crypto_pqcp_mldsa87_signature_internal(signature,
+                                                        signature_length,
+                                                        message, message_length,
+                                                        prefix, prefix_length,
+                                                        rnd,
+                                                        secret,
+                                                        0);
+    ret = 0;
+
+cleanup:
+    mbedtls_platform_zeroize(secret, sizeof(secret));
+    return pqcp_to_psa_error(ret);
+}
+
+psa_status_t tf_psa_crypto_mldsa_verify_message(
+    const psa_key_attributes_t *attributes,
+    const uint8_t *key_buffer, size_t key_buffer_size,
+    psa_algorithm_t alg,
+    const uint8_t *message, size_t message_length,
+    const uint8_t *signature, size_t signature_length)
+{
+    if (!PSA_ALG_IS_ML_DSA(alg)) {
+        return PSA_ERROR_NOT_SUPPORTED;
+    }
+
+    if (psa_get_key_type(attributes) != PSA_KEY_TYPE_ML_DSA_PUBLIC_KEY) {
+        return PSA_ERROR_INVALID_ARGUMENT;
+    }
+    if (psa_get_key_bits(attributes) != 87) {
+        /* Other parameter sets are not supported yet. */
+        return PSA_ERROR_NOT_SUPPORTED;
+    }
+    if (key_buffer_size != MLDSA87_PUBLICKEYBYTES) {
+        return PSA_ERROR_INVALID_ARGUMENT;
+    }
+
+    if (signature_length != MLDSA87_BYTES) {
+        return PSA_ERROR_INVALID_SIGNATURE;
+    }
+
+    int ret = tf_psa_crypto_pqcp_mldsa87_verify(signature, signature_length,
+                                                message, message_length,
+                                                NULL, 0,
+                                                key_buffer);
+    if (ret == 0) {
+        return PSA_SUCCESS;
+    } else {
+        /* At the time of writing, invalid signature is the only possible
+         * error condition. But this will change when we update mldsa-native
+         * with support for heap allocation of intermediate values.
+         */
+        return PSA_ERROR_INVALID_SIGNATURE;
+    }
+}
 
 #endif /* MBEDTLS_PSA_CRYPTO_C && TF_PSA_CRYPTO_PQCP_MLDSA_ENABLED */

drivers/pqcp/src/psa_crypto_mldsa.h

@@ -9,6 +9,136 @@
 
 #include <psa/crypto.h>
 
-extern int tf_psa_crypto_pqcp_driver_exists;
+/* Define macros for key types and algorithms here in a private header,
+ * rather than in a public header, because ML-DSA is not yet supported
+ * through the API. In particular, the size macros in <psa/crypto_sizes.h>
+ * do not yet take ML-DSA into account.
+ */
+
+/** The type of an ML-DSA key pair.
+ *
+ * It is represented as just the 32-byte seed.
+ *
+ * The `bits` attribute of the key indicates the parameter set:
+ * 44, 56 or 87.
+ */
+#define PSA_KEY_TYPE_ML_DSA_KEY_PAIR ((psa_key_type_t) 0x7002)
+
+/** The type of an ML-DSA public key.
+ *
+ * The `bits` attribute of the key indicates the parameter set:
+ * 44, 56 or 87.
+ */
+#define PSA_KEY_TYPE_ML_DSA_PUBLIC_KEY ((psa_key_type_t) 0x6002)
+
+/** Whether the key type is an ML-DSA key (key pair or public key). */
+#define PSA_KEY_TYPE_IS_ML_DSA(type)                                    \
+    ((type) == PSA_KEY_TYPE_ML_DSA_PUBLIC_KEY ||                        \
+     (type) == PSA_KEY_TYPE_ML_DSA_KEY_PAIR)
+
+/** Hedged pure ML-DSA (without pre-hashing). */
+#define PSA_ALG_ML_DSA ((psa_algorithm_t) 0x06004400)
+
+/** Deterministic pure ML-DSA (without pre-hashing). */
+#define PSA_ALG_DETERMINISTIC_ML_DSA ((psa_algorithm_t) 0x06004500)
+
+/** Whether the given algorithm is a pure ML-DSA algorithm
+ * (without pre-hashing).
+ */
+#define PSA_ALG_IS_ML_DSA(alg)                \
+    ((alg) == PSA_ALG_DETERMINISTIC_ML_DSA || \
+     (alg) == PSA_ALG_ML_DSA)
+
+/** Export the public key of an ML-DSA key pair.
+ *
+ * \param[in] attributes        The key attributes.
+ * \param[in] key_buffer        The key material. This must be a key pair
+ *                              in the standard representation, i.e.
+ *                              just the 32-byte seed.
+ * \param key_buffer_size       The size of \p key_buffer, in bytes.
+ * \param[out] data             On success, the exported key.
+ * \param data_size             The size of \p data, in bytes.
+ * \param[out] data_length      On success, the length of the data written
+ *                              to \p data.
+ *
+ * \retval 0
+ *         Success.
+ * \retval #PSA_ERROR_NOT_SUPPORTED
+ *         The key type or size registered in \p attributes is not supported.
+ * \retval #PSA_ERROR_INVALID_ARGUMENT
+ *         The key material is invalid.
+ * \retval #PSA_ERROR_BUFFER_TOO_SMALL
+ *         \p data_size is too small.
+ */
+psa_status_t tf_psa_crypto_mldsa_export_public_key(
+    const psa_key_attributes_t *attributes,
+    const uint8_t *key_buffer, size_t key_buffer_size,
+    uint8_t *data, size_t data_size, size_t *data_length);
+
+/** Sign a message using pure-ML-DSA (without pre-hashing).
+ *
+ * \param[in] attributes        The key attributes.
+ * \param[in] key_buffer        The key material. This must be a key pair
+ *                              in the standard representation, i.e.
+ *                              just the 32-byte seed.
+ * \param key_buffer_size       The size of \p key_buffer, in bytes.
+ * \param alg                   The algorithm:
+ *                              #PSA_ALG_ML_DSA (not implemented yet) or
+ *                              #PSA_ALG_DETERMINISTIC_ML_DSA.
+ * \param[in] message           The message to sign.
+ * \param message_length        The length of \p message, in bytes.
+ * \param[out] signature        On success, the exported key.
+ * \param signature_size        The size of \p signature, in bytes.
+ * \param[out] signature_length On success, the length of the data written
+ *                              to \p signature.
+ *
+ * \retval 0
+ *         Success.
+ * \retval #PSA_ERROR_NOT_SUPPORTED
+ *         The key type or size registered in \p attributes is not supported,
+ *         or the algorithm is not supported.
+ * \retval #PSA_ERROR_INVALID_ARGUMENT
+ *         The key material is invalid, or the key type is invalid for the
+ *         given algorithm.
+ * \retval #PSA_ERROR_BUFFER_TOO_SMALL
+ *         \p signature_size is too small.
+ */
+psa_status_t tf_psa_crypto_mldsa_sign_message(
+    const psa_key_attributes_t *attributes,
+    const uint8_t *key_buffer, size_t key_buffer_size,
+    psa_algorithm_t alg,
+    const uint8_t *message, size_t message_length,
+    uint8_t *signature, size_t signature_size, size_t *signature_length);
+
+/** Verify a message using pure-ML-DSA (without pre-hashing).
+ *
+ * \param[in] attributes        The key attributes.
+ * \param[in] key_buffer        The key material. This must be a public key
+ *                              in the standard representation.
+ * \param key_buffer_size       The size of \p key_buffer, in bytes.
+ * \param alg                   The algorithm:
+ *                              #PSA_ALG_ML_DSA (not implemented yet) or
+ *                              #PSA_ALG_DETERMINISTIC_ML_DSA.
+ * \param[in] message           The message to verify.
+ * \param message_length        The length of \p message, in bytes.
+ * \param[out] signature        The signature to verify.
+ * \param signature_length      The length of \p signature, in bytes.
+ *
+ * \retval 0
+ *         Success.
+ * \retval #PSA_ERROR_NOT_SUPPORTED
+ *         The key type or size registered in \p attributes is not supported,
+ *         or the algorithm is not supported.
+ * \retval #PSA_ERROR_INVALID_ARGUMENT
+ *         The key material is invalid.
+ * \retval #PSA_ERROR_INVALID_SIGNATURE
+ *         The signature is not valid for this message.
+ */
+psa_status_t tf_psa_crypto_mldsa_verify_message(
+    const psa_key_attributes_t *attributes,
+    const uint8_t *key_buffer, size_t key_buffer_size,
+    psa_algorithm_t alg,
+    const uint8_t *message, size_t message_length,
+    const uint8_t *signature, size_t signature_length);
 
 #endif /* "psa_crypto_mldsa.h" */

scripts/data_files/driver_templates/psa_crypto_driver_wrappers.h.jinja

@@ -129,6 +129,18 @@ static inline psa_status_t psa_driver_wrapper_sign_message(
                 return( status );
 #endif /* PSA_CRYPTO_DRIVER_TEST */
 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
+
+#if defined(TF_PSA_CRYPTO_PQCP_MLDSA_ENABLED)
+            if (PSA_ALG_IS_ML_DSA(alg)) {
+                status = tf_psa_crypto_mldsa_sign_message(
+                            attributes,
+                            key_buffer, key_buffer_size,
+                            alg,
+                            input, input_length,
+                            signature, signature_size, signature_length);
+                return status;
+            }
+#endif
             break;
 
         /* Add cases for opaque driver here */
@@ -202,6 +214,18 @@ static inline psa_status_t psa_driver_wrapper_verify_message(
                 return( status );
 #endif /* PSA_CRYPTO_DRIVER_TEST */
 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
+
+#if defined(TF_PSA_CRYPTO_PQCP_MLDSA_ENABLED)
+            if (PSA_ALG_IS_ML_DSA(alg)) {
+                status = tf_psa_crypto_mldsa_verify_message(
+                            attributes,
+                            key_buffer, key_buffer_size,
+                            alg,
+                            input, input_length,
+                            signature, signature_length);
+                return status;
+            }
+#endif
             break;
 
         /* Add cases for opaque driver here */

scripts/data_files/driver_templates/psa_crypto_driver_wrappers_no_static.c.jinja

@@ -144,6 +144,16 @@ data_length
 {% endwith -%}
 #endif /* PSA_CRYPTO_ACCELERATOR_DRIVER_PRESENT */
             /* Fell through, meaning no accelerator supports this operation */
+
+#if defined(TF_PSA_CRYPTO_PQCP_MLDSA_ENABLED)
+            if (psa_get_key_type(attributes) == PSA_KEY_TYPE_ML_DSA_KEY_PAIR) {
+                status = tf_psa_crypto_mldsa_export_public_key(
+                            attributes,
+                            key_buffer, key_buffer_size,
+                            data, data_size, data_length);
+                return status;
+            }
+#endif
             return( psa_export_public_key_internal( attributes,
                                                     key_buffer,
                                                     key_buffer_size,