[crypto] add platform AES-CCM* single-part hook

When OPENTHREAD_CONFIG_CRYPTO_PLATFORM_CCM_SINGLE_PART_ENABLE is set,
AesCcm::Engine::ProcessOneShot() calls two new weak platform APIs:

  otPlatCryptoAesCcmEncryptAndTag()
  otPlatCryptoAesCcmDecryptAndVerify()

Both operate in-place on a contiguous [payload|tag] buffer, mapping
to single-part PSA AEAD or a packet-oriented hardware engine.

Default weak implementations:
- PSA path: psa_aead_encrypt_setup/update/finish and verify.
  CCM may buffer the entire payload until Finish/Verify, so the
  same pointer is passed for input and output to avoid a copy.
- mbedTLS path: mbedtls_ccm_encrypt_and_tag / mbedtls_ccm_auth_decrypt,
  both support in-place (input == output).

Author: suveshpratapa

include/openthread/instance.h

@@ -52,7 +52,7 @@ extern "C" {
  *
  * @note This number versions both OpenThread platform and user APIs.
  */
-#define OPENTHREAD_API_VERSION (604)
+#define OPENTHREAD_API_VERSION (605)
 
 /**
  * @addtogroup api-instance

include/openthread/platform/crypto.h

@@ -749,6 +749,68 @@ otError otPlatCryptoPbkdf2GenerateKey(const uint8_t *aPassword,
                                       uint16_t       aKeyLen,
                                       uint8_t       *aKey);
 
+/**
+ * Performs in-place AES-CCM* authenticated encryption in a single call.
+ *
+ * On success, plaintext at @p aData is replaced with ciphertext in-place and the
+ * authentication tag is written to @p aData + @p aPayloadLength.
+ *
+ * Requires `OPENTHREAD_CONFIG_CRYPTO_PLATFORM_CCM_SINGLE_PART_ENABLE`.
+ * A default weak PSA implementation is provided.
+ *
+ * @param[in]      aKey            The key.
+ * @param[in]      aNonce          The nonce (IEEE 802.15.4 CCM* format, typically 13 bytes).
+ * @param[in]      aNonceLength    Length of @p aNonce in bytes.
+ * @param[in]      aHeader         Additional authenticated data (not encrypted).
+ * @param[in]      aHeaderLength   Length of @p aHeader in bytes.
+ * @param[in,out]  aData           Plaintext on entry, ciphertext on return. Tag written at @p aData + @p
+ * aPayloadLength.
+ * @param[in]      aPayloadLength  Payload length in bytes (not including tag).
+ * @param[in]      aTagLength      Tag length in bytes.
+ *
+ * @retval OT_ERROR_NONE    Success.
+ * @retval OT_ERROR_FAILED  Operation failed.
+ */
+otError otPlatCryptoAesCcmEncryptAndTag(const otCryptoKey *aKey,
+                                        const uint8_t     *aNonce,
+                                        uint8_t            aNonceLength,
+                                        const void        *aHeader,
+                                        uint32_t           aHeaderLength,
+                                        uint8_t           *aData,
+                                        uint32_t           aPayloadLength,
+                                        uint8_t            aTagLength);
+
+/**
+ * Performs in-place AES-CCM* authenticated decryption and tag verification in a single call.
+ *
+ * On success, ciphertext at @p aData is replaced with plaintext in-place.
+ * The tag to verify must be at @p aData + @p aPayloadLength.
+ *
+ * Requires `OPENTHREAD_CONFIG_CRYPTO_PLATFORM_CCM_SINGLE_PART_ENABLE`.
+ * A default weak PSA implementation is provided.
+ *
+ * @param[in]      aKey            The key.
+ * @param[in]      aNonce          The nonce (IEEE 802.15.4 CCM* format, typically 13 bytes).
+ * @param[in]      aNonceLength    Length of @p aNonce in bytes.
+ * @param[in]      aHeader         Additional authenticated data.
+ * @param[in]      aHeaderLength   Length of @p aHeader in bytes.
+ * @param[in,out]  aData           Ciphertext on entry, plaintext on return. Tag read from @p aData + @p aPayloadLength.
+ * @param[in]      aPayloadLength  Payload length in bytes (not including tag).
+ * @param[in]      aTagLength      Tag length in bytes.
+ *
+ * @retval OT_ERROR_NONE      Success.
+ * @retval OT_ERROR_SECURITY  Tag mismatch.
+ * @retval OT_ERROR_FAILED    Operation failed.
+ */
+otError otPlatCryptoAesCcmDecryptAndVerify(const otCryptoKey *aKey,
+                                           const uint8_t     *aNonce,
+                                           uint8_t            aNonceLength,
+                                           const void        *aHeader,
+                                           uint32_t           aHeaderLength,
+                                           uint8_t           *aData,
+                                           uint32_t           aPayloadLength,
+                                           uint8_t            aTagLength);
+
 /**
  * @}
  */

src/core/config/crypto.h

@@ -68,6 +68,20 @@
 #define OPENTHREAD_CONFIG_CRYPTO_PLATFORM_ALLOCS_CONTEXT 0
 #endif
 
+/**
+ * @def OPENTHREAD_CONFIG_CRYPTO_PLATFORM_CCM_SINGLE_PART_ENABLE
+ *
+ * Define to 1 to enable platform single-part AES-CCM* acceleration.
+ *
+ * When enabled, `AesCcm::Engine::ProcessOneShot()` calls
+ * `otPlatCryptoAesCcmEncryptAndTag()` / `otPlatCryptoAesCcmDecryptAndVerify()`
+ * instead of the built-in software CCM engine.
+ *
+ */
+#ifndef OPENTHREAD_CONFIG_CRYPTO_PLATFORM_CCM_SINGLE_PART_ENABLE
+#define OPENTHREAD_CONFIG_CRYPTO_PLATFORM_CCM_SINGLE_PART_ENABLE 0
+#endif
+
 #if OPENTHREAD_CONFIG_CRYPTO_LIB == OPENTHREAD_CONFIG_CRYPTO_LIB_PLATFORM
 
 /**

src/core/crypto/aes_ccm.cpp

@@ -212,15 +212,27 @@ Error AesCcm::Engine::ProcessOneShot(Operation      aOperation,
                                      const uint8_t *aHeader,
                                      uint8_t       *aData)
 {
-    // This method performs one-shot (single-part) AES-CCM processing.
-    // Currently, it is implemented by calling the multi-part
-    // streaming APIs sequentially. In the future, this can be
-    // optimized to directly call platform-specific one-shot hardware
-    // acceleration APIs if supported by the platform.
-
     Error   error = kErrorNone;
     uint8_t tag[kMaxTagLength];
 
+#if OPENTHREAD_CONFIG_CRYPTO_PLATFORM_CCM_SINGLE_PART_ENABLE
+    switch (aOperation)
+    {
+    case kEncrypt:
+        error =
+            otPlatCryptoAesCcmEncryptAndTag(&aConfig.mKey, aConfig.mNonce, aConfig.mNonceLength, aHeader,
+                                            aConfig.mHeaderLength, aData, aConfig.mPlainTextLength, aConfig.mTagLength);
+        break;
+    case kDecrypt:
+        error = otPlatCryptoAesCcmDecryptAndVerify(&aConfig.mKey, aConfig.mNonce, aConfig.mNonceLength, aHeader,
+                                                   aConfig.mHeaderLength, aData, aConfig.mPlainTextLength,
+                                                   aConfig.mTagLength);
+        break;
+    }
+
+    return error;
+#endif
+
     Start(aConfig);
     AddHeader(aHeader, aConfig.mHeaderLength);
     AddPayload(aData, aData, aConfig.mPlainTextLength, aOperation);

src/core/crypto/crypto_platform_mbedtls.cpp

@@ -37,6 +37,7 @@
 #include <string.h>
 
 #include <mbedtls/aes.h>
+#include <mbedtls/ccm.h>
 #include <mbedtls/cmac.h>
 #include <mbedtls/ctr_drbg.h>
 #include <mbedtls/ecdsa.h>
@@ -152,6 +153,79 @@ OT_TOOL_WEAK otError otPlatCryptoAesFree(otCryptoContext *aContext)
     return error;
 }
 
+#if OPENTHREAD_CONFIG_CRYPTO_PLATFORM_CCM_SINGLE_PART_ENABLE
+
+OT_TOOL_WEAK otError otPlatCryptoAesCcmEncryptAndTag(const otCryptoKey *aKey,
+                                                     const uint8_t     *aNonce,
+                                                     uint8_t            aNonceLength,
+                                                     const void        *aHeader,
+                                                     uint32_t           aHeaderLength,
+                                                     uint8_t           *aData,
+                                                     uint32_t           aPayloadLength,
+                                                     uint8_t            aTagLength)
+{
+    Error               error = kErrorNone;
+    mbedtls_ccm_context ctx;
+    int                 ret;
+
+    VerifyOrExit(aKey != nullptr && aKey->mKey != nullptr && aNonce != nullptr && aData != nullptr,
+                 error = kErrorInvalidArgs);
+
+    mbedtls_ccm_init(&ctx);
+
+    ret = mbedtls_ccm_setkey(&ctx, MBEDTLS_CIPHER_ID_AES, aKey->mKey, aKey->mKeyLength * 8);
+    VerifyOrExit(ret == 0, error = kErrorFailed);
+
+    ret = mbedtls_ccm_encrypt_and_tag(&ctx, aPayloadLength, aNonce, aNonceLength, static_cast<const uint8_t *>(aHeader),
+                                      aHeaderLength, aData, aData, aData + aPayloadLength, aTagLength);
+    VerifyOrExit(ret == 0, error = kErrorFailed);
+
+exit:
+    mbedtls_ccm_free(&ctx);
+    return error;
+}
+
+OT_TOOL_WEAK otError otPlatCryptoAesCcmDecryptAndVerify(const otCryptoKey *aKey,
+                                                        const uint8_t     *aNonce,
+                                                        uint8_t            aNonceLength,
+                                                        const void        *aHeader,
+                                                        uint32_t           aHeaderLength,
+                                                        uint8_t           *aData,
+                                                        uint32_t           aPayloadLength,
+                                                        uint8_t            aTagLength)
+{
+    Error               error = kErrorNone;
+    mbedtls_ccm_context ctx;
+    int                 ret;
+
+    VerifyOrExit(aKey != nullptr && aKey->mKey != nullptr && aNonce != nullptr && aData != nullptr,
+                 error = kErrorInvalidArgs);
+
+    mbedtls_ccm_init(&ctx);
+
+    ret = mbedtls_ccm_setkey(&ctx, MBEDTLS_CIPHER_ID_AES, aKey->mKey, aKey->mKeyLength * 8);
+    VerifyOrExit(ret == 0, error = kErrorFailed);
+
+    // MBEDTLS_ERR_CCM_AUTH_FAILED is the expected return on tag mismatch; map to kErrorSecurity.
+    ret = mbedtls_ccm_auth_decrypt(&ctx, aPayloadLength, aNonce, aNonceLength, static_cast<const uint8_t *>(aHeader),
+                                   aHeaderLength, aData, aData, aData + aPayloadLength, aTagLength);
+
+    if (ret == MBEDTLS_ERR_CCM_AUTH_FAILED)
+    {
+        error = kErrorSecurity;
+    }
+    else
+    {
+        VerifyOrExit(ret == 0, error = kErrorFailed);
+    }
+
+exit:
+    mbedtls_ccm_free(&ctx);
+    return error;
+}
+
+#endif // OPENTHREAD_CONFIG_CRYPTO_PLATFORM_CCM_SINGLE_PART_ENABLE
+
 #if OPENTHREAD_FTD || OPENTHREAD_MTD
 
 // HMAC implementations

src/core/crypto/crypto_platform_psa.cpp

@@ -389,6 +389,113 @@ OT_TOOL_WEAK otError otPlatCryptoAesFree(otCryptoContext *aContext)
     return kErrorNone;
 }
 
+#if OPENTHREAD_CONFIG_CRYPTO_PLATFORM_CCM_SINGLE_PART_ENABLE
+
+OT_TOOL_WEAK otError otPlatCryptoAesCcmEncryptAndTag(const otCryptoKey *aKey,
+                                                     const uint8_t     *aNonce,
+                                                     uint8_t            aNonceLength,
+                                                     const void        *aHeader,
+                                                     uint32_t           aHeaderLength,
+                                                     uint8_t           *aData,
+                                                     uint32_t           aPayloadLength,
+                                                     uint8_t            aTagLength)
+{
+    Error                error = kErrorNone;
+    psa_status_t         status;
+    psa_aead_operation_t operation = PSA_AEAD_OPERATION_INIT;
+    psa_algorithm_t      algorithm = PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, aTagLength);
+    uint8_t              trailing[AesCcm::kMaxTagLength];
+    size_t               trailingLen = 0;
+    size_t               tagLen      = 0;
+    size_t               outputLen   = 0;
+
+    VerifyOrExit(aKey != nullptr && aNonce != nullptr && aData != nullptr, error = kErrorInvalidArgs);
+
+    status = psa_aead_encrypt_setup(&operation, aKey->mKeyRef, algorithm);
+    SuccessOrExit(error = PsaToOtError(status));
+
+    status = psa_aead_set_lengths(&operation, aHeaderLength, aPayloadLength);
+    SuccessOrExit(error = PsaToOtError(status));
+
+    status = psa_aead_set_nonce(&operation, aNonce, aNonceLength);
+    SuccessOrExit(error = PsaToOtError(status));
+
+    if (aHeaderLength > 0)
+    {
+        status = psa_aead_update_ad(&operation, static_cast<const uint8_t *>(aHeader), aHeaderLength);
+        SuccessOrExit(error = PsaToOtError(status));
+    }
+
+    // CCM may buffer the entire payload until Finish; pass in-place to avoid a copy.
+    status = psa_aead_update(&operation, aData, aPayloadLength, aData, aPayloadLength, &outputLen);
+    SuccessOrExit(error = PsaToOtError(status));
+
+    status = psa_aead_finish(&operation, trailing, sizeof(trailing), &trailingLen, aData + aPayloadLength, aTagLength,
+                             &tagLen);
+    SuccessOrExit(error = PsaToOtError(status));
+    VerifyOrExit(tagLen == aTagLength, error = kErrorFailed);
+
+exit:
+    if (error != kErrorNone)
+    {
+        psa_aead_abort(&operation);
+    }
+
+    return error;
+}
+
+OT_TOOL_WEAK otError otPlatCryptoAesCcmDecryptAndVerify(const otCryptoKey *aKey,
+                                                        const uint8_t     *aNonce,
+                                                        uint8_t            aNonceLength,
+                                                        const void        *aHeader,
+                                                        uint32_t           aHeaderLength,
+                                                        uint8_t           *aData,
+                                                        uint32_t           aPayloadLength,
+                                                        uint8_t            aTagLength)
+{
+    Error                error = kErrorNone;
+    psa_status_t         status;
+    psa_aead_operation_t operation = PSA_AEAD_OPERATION_INIT;
+    psa_algorithm_t      algorithm = PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_CCM, aTagLength);
+    uint8_t              trailing[AesCcm::kMaxTagLength];
+    size_t               trailingLen = 0;
+    size_t               outputLen   = 0;
+
+    VerifyOrExit(aKey != nullptr && aNonce != nullptr && aData != nullptr, error = kErrorInvalidArgs);
+
+    status = psa_aead_decrypt_setup(&operation, aKey->mKeyRef, algorithm);
+    SuccessOrExit(error = PsaToOtError(status));
+
+    status = psa_aead_set_lengths(&operation, aHeaderLength, aPayloadLength);
+    SuccessOrExit(error = PsaToOtError(status));
+
+    status = psa_aead_set_nonce(&operation, aNonce, aNonceLength);
+    SuccessOrExit(error = PsaToOtError(status));
+
+    if (aHeaderLength > 0)
+    {
+        status = psa_aead_update_ad(&operation, static_cast<const uint8_t *>(aHeader), aHeaderLength);
+        SuccessOrExit(error = PsaToOtError(status));
+    }
+
+    // CCM may buffer the entire payload until Verify; pass in-place to avoid a copy.
+    status = psa_aead_update(&operation, aData, aPayloadLength, aData, aPayloadLength, &outputLen);
+    SuccessOrExit(error = PsaToOtError(status));
+
+    status = psa_aead_verify(&operation, trailing, sizeof(trailing), &trailingLen, aData + aPayloadLength, aTagLength);
+    error  = (status == PSA_ERROR_INVALID_SIGNATURE) ? kErrorSecurity : PsaToOtError(status);
+
+exit:
+    if (error != kErrorNone)
+    {
+        psa_aead_abort(&operation);
+    }
+
+    return error;
+}
+
+#endif // OPENTHREAD_CONFIG_CRYPTO_PLATFORM_CCM_SINGLE_PART_ENABLE
+
 #if OPENTHREAD_FTD || OPENTHREAD_MTD
 
 OT_TOOL_WEAK otError otPlatCryptoHmacSha256Init(otCryptoContext *aContext)