mirror/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-03-22 13:20:50 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

pk: fix library code for using the new opaque key solution

Browse Source 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
This commit is contained in:
Valerio Setti 2023-04-28 15:26:11 +02:00
parent e00954d0ed
commit 048cd44f77
5 changed files with 14 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
library/pk.c
View File

@ -312,12 +312,11 @@ int mbedtls_pk_can_do_ext(const mbedtls_pk_context *ctx, psa_algorithm_t alg,
return (key_usage & usage) == usage; return (key_usage & usage) == usage;
} }
const mbedtls_svc_key_id_t *key = (const mbedtls_svc_key_id_t *) ctx->pk_ctx;
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
psa_algorithm_t key_alg, key_alg2; psa_algorithm_t key_alg, key_alg2;
psa_status_t status; psa_status_t status;
status = psa_get_key_attributes(*key, &attributes); status = psa_get_key_attributes(ctx->opaque_id, &attributes);
if (status != PSA_SUCCESS) { if (status != PSA_SUCCESS) {
return 0; return 0;
} }
@ -698,10 +697,9 @@ int mbedtls_pk_sign_ext(mbedtls_pk_type_t pk_type,
} }
if (mbedtls_pk_get_type(ctx) == MBEDTLS_PK_OPAQUE) { if (mbedtls_pk_get_type(ctx) == MBEDTLS_PK_OPAQUE) {
const mbedtls_svc_key_id_t *key = (const mbedtls_svc_key_id_t *) ctx->pk_ctx;
psa_status_t status; psa_status_t status;
status = psa_sign_hash(*key, PSA_ALG_RSA_PSS(psa_md_alg), status = psa_sign_hash(ctx->opaque_id, PSA_ALG_RSA_PSS(psa_md_alg),
hash, hash_len, hash, hash_len,
sig, sig_size, sig_len); sig, sig_size, sig_len);
return PSA_PK_RSA_TO_MBEDTLS_ERR(status); return PSA_PK_RSA_TO_MBEDTLS_ERR(status);

11
library/pk_wrap.c
View File

@ -1505,11 +1505,10 @@ const mbedtls_pk_info_t mbedtls_rsa_alt_info = {
#if defined(MBEDTLS_USE_PSA_CRYPTO) #if defined(MBEDTLS_USE_PSA_CRYPTO)
static size_t pk_opaque_get_bitlen(mbedtls_pk_context *pk) static size_t pk_opaque_get_bitlen(mbedtls_pk_context *pk)
{ {
const mbedtls_svc_key_id_t *key = pk->pk_ctx;
size_t bits; size_t bits;
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
if (PSA_SUCCESS != psa_get_key_attributes(*key, &attributes)) { if (PSA_SUCCESS != psa_get_key_attributes(pk->opaque_id, &attributes)) {
return 0; return 0;
} }
@ -1547,7 +1546,6 @@ static int pk_opaque_sign_wrap(mbedtls_pk_context *pk, mbedtls_md_type_t md_alg,
((void) p_rng); ((void) p_rng);
return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE; return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE;
#else /* !MBEDTLS_PK_CAN_ECDSA_SIGN && !MBEDTLS_RSA_C */ #else /* !MBEDTLS_PK_CAN_ECDSA_SIGN && !MBEDTLS_RSA_C */
const mbedtls_svc_key_id_t *key = pk->pk_ctx;
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
psa_algorithm_t alg; psa_algorithm_t alg;
psa_key_type_t type; psa_key_type_t type;
@ -1557,7 +1555,7 @@ static int pk_opaque_sign_wrap(mbedtls_pk_context *pk, mbedtls_md_type_t md_alg,
(void) f_rng; (void) f_rng;
(void) p_rng; (void) p_rng;
status = psa_get_key_attributes(*key, &attributes); status = psa_get_key_attributes(pk->opaque_id, &attributes);
if (status != PSA_SUCCESS) { if (status != PSA_SUCCESS) {
return PSA_PK_TO_MBEDTLS_ERR(status); return PSA_PK_TO_MBEDTLS_ERR(status);
} }
@ -1578,7 +1576,7 @@ static int pk_opaque_sign_wrap(mbedtls_pk_context *pk, mbedtls_md_type_t md_alg,
return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE; return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE;
/* make the signature */ /* make the signature */
status = psa_sign_hash(*key, alg, hash, hash_len, status = psa_sign_hash(pk->opaque_id, alg, hash, hash_len,
sig, sig_size, sig_len); sig, sig_size, sig_len);
if (status != PSA_SUCCESS) { if (status != PSA_SUCCESS) {
#if defined(MBEDTLS_PK_CAN_ECDSA_SIGN) #if defined(MBEDTLS_PK_CAN_ECDSA_SIGN)
@ -1634,14 +1632,13 @@ static int pk_opaque_rsa_decrypt(mbedtls_pk_context *pk,
unsigned char *output, size_t *olen, size_t osize, unsigned char *output, size_t *olen, size_t osize,
int (*f_rng)(void *, unsigned char *, size_t), void *p_rng) int (*f_rng)(void *, unsigned char *, size_t), void *p_rng)
{ {
const mbedtls_svc_key_id_t *key = pk->pk_ctx;
psa_status_t status; psa_status_t status;
/* PSA has its own RNG */ /* PSA has its own RNG */
(void) f_rng; (void) f_rng;
(void) p_rng; (void) p_rng;
status = psa_asymmetric_decrypt(*key, PSA_ALG_RSA_PKCS1V15_CRYPT, status = psa_asymmetric_decrypt(pk->opaque_id, PSA_ALG_RSA_PKCS1V15_CRYPT,
input, ilen, input, ilen,
NULL, 0, NULL, 0,
output, osize, olen); output, osize, olen);

11
library/pkwrite.c
View File

@ -188,14 +188,13 @@ int mbedtls_pk_write_pubkey(unsigned char **p, unsigned char *start,
#if defined(MBEDTLS_USE_PSA_CRYPTO) #if defined(MBEDTLS_USE_PSA_CRYPTO)
if (mbedtls_pk_get_type(key) == MBEDTLS_PK_OPAQUE) { if (mbedtls_pk_get_type(key) == MBEDTLS_PK_OPAQUE) {
size_t buffer_size; size_t buffer_size;
mbedtls_svc_key_id_t *key_id = (mbedtls_svc_key_id_t *) key->pk_ctx;
if (*p < start) { if (*p < start) {
return MBEDTLS_ERR_PK_BAD_INPUT_DATA; return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
} }
buffer_size = (size_t) (*p - start); buffer_size = (size_t) (*p - start);
if (psa_export_public_key(*key_id, start, buffer_size, &len) if (psa_export_public_key(key->opaque_id, start, buffer_size, &len)
!= PSA_SUCCESS) { != PSA_SUCCESS) {
return MBEDTLS_ERR_PK_BAD_INPUT_DATA; return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
} else { } else {
@ -254,9 +253,11 @@ int mbedtls_pk_write_pubkey_der(const mbedtls_pk_context *key, unsigned char *bu
if (pk_type == MBEDTLS_PK_OPAQUE) { if (pk_type == MBEDTLS_PK_OPAQUE) {
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
psa_key_type_t key_type; psa_key_type_t key_type;
mbedtls_svc_key_id_t key_id; psa_ecc_family_t curve;
key_id = *((mbedtls_svc_key_id_t *) key->pk_ctx); size_t bits;
if (PSA_SUCCESS != psa_get_key_attributes(key_id, &attributes)) {
if (PSA_SUCCESS != psa_get_key_attributes(key->opaque_id,
&attributes)) {
return MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED; return MBEDTLS_ERR_PLATFORM_HW_ACCEL_FAILED;
} }
key_type = psa_get_key_type(&attributes); key_type = psa_get_key_type(&attributes);

3
library/ssl_tls12_server.c
View File

@ -2614,8 +2614,7 @@ static int ssl_get_ecdh_params_from_cert(mbedtls_ssl_context *ssl)
return MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH; return MBEDTLS_ERR_SSL_PK_TYPE_MISMATCH;
} }
ssl->handshake->ecdh_psa_privkey = ssl->handshake->ecdh_psa_privkey = pk->opaque_id;
*((mbedtls_svc_key_id_t *) pk->pk_ctx);
/* Key should not be destroyed in the TLS library */ /* Key should not be destroyed in the TLS library */
ssl->handshake->ecdh_psa_privkey_is_external = 1; ssl->handshake->ecdh_psa_privkey_is_external = 1;

3
tests/src/test_helpers/ssl_helpers.c
View File

@ -595,8 +595,7 @@ static void test_ssl_endpoint_certificate_free(mbedtls_test_ssl_endpoint *ep)
if (cert->pkey != NULL) { if (cert->pkey != NULL) {
#if defined(MBEDTLS_USE_PSA_CRYPTO) #if defined(MBEDTLS_USE_PSA_CRYPTO)
if (mbedtls_pk_get_type(cert->pkey) == MBEDTLS_PK_OPAQUE) { if (mbedtls_pk_get_type(cert->pkey) == MBEDTLS_PK_OPAQUE) {
mbedtls_svc_key_id_t *key_slot = cert->pkey->pk_ctx; psa_destroy_key(cert->pkey->opaque_id);
psa_destroy_key(*key_slot);
} }
#endif #endif
mbedtls_pk_free(cert->pkey); mbedtls_pk_free(cert->pkey);