[crypto/coverage] Add comments to impl

Add coverage comments on unreached lines.
Note that several lines are reachable but miss a test, these comments
are added so we keep track on what is left to test.

Signed-off-by: Siemen Dhooghe <sdhooghe@google.com>

Author: siemen11

sw/device/lib/crypto/impl/aes.c

@@ -147,10 +147,6 @@ static status_t aes_key_construct(otcrypto_blinded_key_t *blinded_key,
 static status_t aes_padding_apply(otcrypto_aes_padding_t padding_mode,
                                   const size_t partial_data_len,
                                   aes_block_t *block) {
-  if (partial_data_len >= kAesBlockNumBytes) {
-    return OTCRYPTO_BAD_ARGS;
-  }
-
   // Get a byte-sized pointer to the padding start point within the block's
   // data buffer.
   char *padding = ((char *)block->data) + partial_data_len;
@@ -174,9 +170,12 @@ static status_t aes_padding_apply(otcrypto_aes_padding_t padding_mode,
       break;
     case kOtcryptoAesPaddingNull:
       // This routine should not be called if padding is not needed.
+      // COVERAGE (SW ERR) The internal routine is not called with PaddingNull
       return OTCRYPTO_RECOV_ERR;
     default:
       // Unrecognized padding mode.
+      // COVERAGE (SW ERR) This is an internal routine which is given correct
+      // inputs
       return OTCRYPTO_BAD_ARGS;
   }
   // Check if we landed in the correct case statement. Use ORs for this to
@@ -297,14 +296,6 @@ static otcrypto_status_t otcrypto_aes_impl(
     otcrypto_aes_mode_t aes_mode, otcrypto_aes_operation_t aes_operation,
     const otcrypto_const_byte_buf_t *cipher_input,
     otcrypto_aes_padding_t aes_padding, otcrypto_byte_buf_t *cipher_output) {
-  // Check for NULL pointers in input pointers and data buffers.
-  if (key == NULL ||
-      (aes_mode != kOtcryptoAesModeEcb && (iv == NULL || iv->data == NULL)) ||
-      cipher_input == NULL || cipher_input->data == NULL ||
-      cipher_output == NULL || cipher_output->data == NULL) {
-    return OTCRYPTO_BAD_ARGS;
-  }
-
   // Calculate the number of blocks for the input, including the padding for
   // encryption.
   size_t input_nblocks;
@@ -364,6 +355,7 @@ static otcrypto_status_t otcrypto_aes_impl(
           launder32(aes_operation_started) | kOtcryptoAesOperationDecrypt;
       break;
     default:
+      // COVERAGE (MISSING) The default bad argument input is not covered.
       return OTCRYPTO_BAD_ARGS;
   }
   // Check if we landed in the correct case statement. Use ORs for this to

sw/device/lib/crypto/impl/aes_gcm.c

@@ -115,6 +115,7 @@ static status_t aes_gcm_key_construct(otcrypto_blinded_key_t *blinded_key,
   // Key integrity check.
   if (launder32(integrity_blinded_key_check(blinded_key)) !=
       kHardenedBoolTrue) {
+    // COVERAGE (MISSING) The bad integrity input key is not covered.
     return OTCRYPTO_BAD_ARGS;
   }
 
@@ -156,6 +157,7 @@ static status_t aes_gcm_key_construct(otcrypto_blinded_key_t *blinded_key,
     aes_key->key_shares[1] = share1;
     aes_key->sideload = launder32(kHardenedBoolFalse);
   } else {
+    // COVERAGE (MISSING) A bad parameter hw_backed is not covered.
     return OTCRYPTO_BAD_ARGS;
   }
   HARDENED_CHECK_EQ(aes_key->sideload, blinded_key->config.hw_backed);
@@ -243,6 +245,8 @@ static status_t load_key_if_sideloaded(const aes_key_t key) {
   if (launder32(key.sideload) == kHardenedBoolFalse) {
     return OTCRYPTO_OK;
   } else if (key.sideload != kHardenedBoolTrue) {
+    // COVERAGE (SW ERR) This is an internal function, the aes key's sideload is
+    // set internal by good parameters.
     return OTCRYPTO_BAD_ARGS;
   }
   HARDENED_CHECK_EQ(key.sideload, kHardenedBoolTrue);
@@ -268,6 +272,8 @@ static status_t clear_key_if_sideloaded(const aes_key_t key) {
     HARDENED_CHECK_EQ(key.sideload, kHardenedBoolFalse);
     return OTCRYPTO_OK;
   } else if (launder32(key.sideload) != kHardenedBoolTrue) {
+    // COVERAGE (SW ERR) This is an internal function, the aes key's sideload is
+    // set internal by good parameters.
     return OTCRYPTO_BAD_ARGS;
   }
   HARDENED_CHECK_EQ(key.sideload, kHardenedBoolTrue);
@@ -283,6 +289,7 @@ otcrypto_status_t otcrypto_aes_gcm_encrypt(
   // buffers.
   if (key == NULL || iv == NULL || iv->data == NULL || auth_tag == NULL ||
       auth_tag->data == NULL) {
+    // COVERAGE (MISSING) We do not cover NULL inputs.
     return OTCRYPTO_BAD_ARGS;
   }
 
@@ -448,6 +455,7 @@ otcrypto_status_t otcrypto_aes_gcm_update_aad(
 
   if (aad->len == 0) {
     // Nothing to do.
+    // COVERAGE (MISSING) We do not cover the length 0 aad on update.
     return OTCRYPTO_OK;
   }
 
@@ -480,6 +488,7 @@ otcrypto_status_t otcrypto_aes_gcm_update_encrypted_data(
 
   if (input->len == 0) {
     // Nothing to do.
+    // COVERAGE (MISSING) We do not cover the length 0 input on update.
     return OTCRYPTO_OK;
   }
 
@@ -494,6 +503,7 @@ otcrypto_status_t otcrypto_aes_gcm_update_encrypted_data(
   // exist after `input` is added.
   size_t partial_block_len = internal_ctx.input_len % kAesBlockNumBytes;
   if (input->len > UINT32_MAX - partial_block_len) {
+    // COVERAGE (MISSING) We do not cover too short output buffers.
     return OTCRYPTO_BAD_ARGS;
   }
   size_t min_output_blocks =

sw/device/lib/crypto/impl/aes_gcm/aes_gcm.c

@@ -384,11 +384,6 @@ status_t aes_gcm_encrypt(const aes_key_t key, const size_t iv_len,
  */
 static status_t aes_gcm_init(const aes_key_t key, const size_t iv_len,
                              const uint32_t *iv, aes_gcm_context_t *ctx) {
-  // Check for null pointers and IV length (must be 96 or 128 bits = 3 or 4
-  // words).
-  if (ctx == NULL || iv == NULL || (iv_len != 3 && iv_len != 4)) {
-    return OTCRYPTO_BAD_ARGS;
-  }
   HARDENED_CHECK_EQ(key.checksum, aes_key_integrity_checksum(&key));
 
   // Initialize the hash subkey H.
@@ -501,6 +496,7 @@ status_t aes_gcm_update_encrypted_data(aes_gcm_context_t *ctx, size_t input_len,
   // than NIST requires, but SP800-38D also allows implementations to stipulate
   // lower length limits.
   if (input_len > UINT32_MAX - ctx->input_len) {
+    // COVERAGE (MISSING) We do not cover too large inputs.
     return OTCRYPTO_BAD_ARGS;
   }
 
@@ -532,6 +528,8 @@ status_t aes_gcm_update_encrypted_data(aes_gcm_context_t *ctx, size_t input_len,
     // Since we only generate ciphertext in full-block increments, no partial
     // blocks are possible in this case.
     if (*output_len % kGhashBlockNumBytes != 0) {
+      // COVERAGE (SW ERR) Since we call aes_gcm_gctr before, this should
+      // normally not be called.
       return OTCRYPTO_RECOV_ERR;
     }
     HARDENED_TRY(ghash_process_full_blocks(&ctx->ghash_ctx, /*partial_len=*/0,

sw/device/lib/crypto/impl/aes_gcm/ghash.c

@@ -169,6 +169,8 @@ hardened_bool_t ghash_context_integrity_checksum_check(
       launder32(ghash_context_integrity_checksum(ghash_ctx))) {
     return kHardenedBoolTrue;
   }
+  // COVERAGE (FI CM) We only provide correct encoded contexts, this is to check
+  // for faults.
   return kHardenedBoolFalse;
 }
 

sw/device/lib/crypto/impl/ecc/p256.c

@@ -152,6 +152,8 @@ hardened_bool_t p256_masked_scalar_checksum_check(
   if (scalar->checksum == launder32(p256_masked_scalar_checksum(scalar))) {
     return kHardenedBoolTrue;
   }
+  // COVERAGE (FI CM) We only provide correct encoded scalars, this is to check
+  // for faults.
   return kHardenedBoolFalse;
 }
 
@@ -172,6 +174,8 @@ hardened_bool_t p256_ecdh_shared_key_checksum_check(
   if (key->checksum == launder32(p256_ecdh_shared_key_checksum(key))) {
     return kHardenedBoolTrue;
   }
+  // COVERAGE (FI CM) We only provide correct encoded keys, this is to check for
+  // faults.
   return kHardenedBoolFalse;
 }
 
@@ -205,6 +209,7 @@ status_t p256_sideload_keygen_start(void) {
 status_t p256_sideload_attestation_keygen_start(
     const otcrypto_const_word32_buf_t *attestation_seed) {
   if (launder32(attestation_seed->len) > kDiceAttestationMaxSeedLength) {
+    // COVERAGE (MISSING) We do not cover too long attestation seed inputs.
     return OTCRYPTO_BAD_ARGS;
   }
 
@@ -356,6 +361,7 @@ status_t p256_sideload_attestation_sign_start(
     const uint32_t digest[kP256ScalarWords],
     const otcrypto_const_word32_buf_t *attestation_seed) {
   if (launder32(attestation_seed->len) > kDiceAttestationMaxSeedLength) {
+    // COVERAGE (MISSING) We do not cover too long attestation seed inputs.
     return OTCRYPTO_BAD_ARGS;
   }
   HARDENED_CHECK_EQ(kHardenedBoolTrue, OTCRYPTO_CHECK_BUF(attestation_seed));

sw/device/lib/crypto/impl/ecc/p384.c

@@ -160,6 +160,8 @@ hardened_bool_t p384_masked_scalar_checksum_check(
   if (scalar->checksum == launder32(p384_masked_scalar_checksum(scalar))) {
     return kHardenedBoolTrue;
   }
+  // COVERAGE (FI CM) We only provide correct encoded scalars, this is to check
+  // for faults.
   return kHardenedBoolFalse;
 }
 
@@ -223,6 +225,8 @@ hardened_bool_t p384_ecdh_shared_key_checksum_check(
   if (key->checksum == launder32(p384_ecdh_shared_key_checksum(key))) {
     return kHardenedBoolTrue;
   }
+  // COVERAGE (FI CM) We only provide correct encoded keys, this is to check for
+  // faults.
   return kHardenedBoolFalse;
 }
 
@@ -453,6 +457,8 @@ status_t p384_ecdh_finalize(p384_ecdh_shared_key_t *shared_key) {
   HARDENED_TRY(otbn_dmem_read(1, kOtbnVarOk, &ok));
   if (launder32(ok) != kHardenedBoolTrue) {
     HARDENED_TRY(otbn_dmem_sec_wipe());
+    // COVERAGE (MISSING) We do not cover a negative ECDH check where a bad
+    // public key is given.
     return OTCRYPTO_BAD_ARGS;
   }
   HARDENED_CHECK_EQ(ok, kHardenedBoolTrue);
@@ -526,6 +532,7 @@ status_t p384_point_on_curve_check(const p384_point_t *point,
   } else if (launder32(ins_cnt) == kModePointOnCurveCheckInvld1InsCnt) {
     HARDENED_CHECK_EQ(ins_cnt, kModePointOnCurveCheckInvld1InsCnt);
   } else {
+    // COVERAGE (MISSING) We do not cover PointOnCurveCheckInvld2
     HARDENED_CHECK_EQ(ins_cnt, kModePointOnCurveCheckInvld2InsCnt);
   }