`psa_cipher_set_iv` doesn't allow to set the counter value for chacha20 #162

New issue

Open

opened 2025-01-18 14:46:28 -06:00 by dbuenzli · 2 comments

dbuenzli commented

2025-01-18 14:46:28 -06:00

(Migrated from github.com)

According to the spec it should be possible to set the counter value for ChaCha20 by providing a 16 bytes IV.

This is currently not possible in the current implementation. A first check in mbedtls_psa_cipher_set_iv seems to assume IV lengths are fixed for a given operation which is not the case for ChaCha20. Then barring that, mbedtls_cipher_set_iv doesn't seem anyways to have the logic for setting up the counter to something else than 0.

P.S. Not that I need this I was just writing some test code for the cipher API and trying to match the result of this vector.

According to the [spec](https://arm-software.github.io/psa-api/crypto/1.2/api/ops/ciphers.html#c.PSA_ALG_STREAM_CIPHER) it should be possible to set the counter value for `ChaCha20` by providing a 16 bytes IV. This is currently not possible in the current implementation. A [first check](https://github.com/Mbed-TLS/TF-PSA-Crypto/blob/3671d643746853b4a49fe25dda7842d6c22c026b/drivers/builtin/src/psa_crypto_cipher.c#L383-L384) in `mbedtls_psa_cipher_set_iv` seems to assume IV lengths are fixed for a given operation which is not the case for ChaCha20. Then barring that, `mbedtls_cipher_set_iv` [doesn't seem](https://github.com/Mbed-TLS/TF-PSA-Crypto/blob/3671d643746853b4a49fe25dda7842d6c22c026b/drivers/builtin/src/cipher.c#L455-L457) anyways to have the logic for setting up the counter to something else than 0. P.S. Not that I need this I was just writing some test code for the cipher API and trying to match the result of [this vector](https://www.rfc-editor.org/rfc/rfc8439#section-2.4.2).

gilles-peskine-arm commented

2025-02-07 03:18:35 -06:00

(Migrated from github.com)

Indeed that's a known limitation (we haven't yet migrated issues from the mbedtls repository). Do you need it in production, or just as part of testing effort?

Indeed that's [a known limitation](https://github.com/Mbed-TLS/mbedtls/issues/5616) (we haven't yet migrated issues from the mbedtls repository). Do you need it in production, or just as part of testing effort?

dbuenzli commented

2025-02-07 03:29:42 -06:00

(Migrated from github.com)

I was just testing bindings I'm making to PSA crypto.

No milestone

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

gh-Mbed-TLS/TF-PSA-Crypto#162

No description provided.

Rows
Columns

psa_cipher_set_iv doesn't allow to set the counter value for chacha20 #162

`psa_cipher_set_iv` doesn't allow to set the counter value for chacha20 #162