mirror/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-03-23 16:20:49 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

ssl_tls12_server: do not export/import opaque keys

Browse Source 
Signed-off-by: Valerio Setti <valerio.setti@nordicsemi.no>
This commit is contained in:
Valerio Setti 2023-12-06 17:05:24 +01:00
parent bced8bc8d7
commit 202bb71dcd
1 changed files with 33 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

56
library/ssl_tls12_server.c
View File

@ -2635,31 +2635,41 @@ static int ssl_get_ecdh_params_from_cert(mbedtls_ssl_context *ssl)
ssl->handshake->xxdh_psa_type = psa_get_key_type(&key_attributes); ssl->handshake->xxdh_psa_type = psa_get_key_type(&key_attributes);
ssl->handshake->xxdh_psa_bits = psa_get_key_bits(&key_attributes); ssl->handshake->xxdh_psa_bits = psa_get_key_bits(&key_attributes);
/* Now export and then re-import the same key with proper flags if (pk_type == MBEDTLS_PK_OPAQUE) {
* and algorithm. We also set key's type and bits that we just got /* Opaque key is created by the user (externally from Mbed TLS)
* above. */ * so we assume it already has the right algorithm and flags
key_attributes = psa_key_attributes_init(); * set. Just copy its ID as reference. */
psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_DERIVE); ssl->handshake->xxdh_psa_privkey = pk->priv_id;
psa_set_key_algorithm(&key_attributes, PSA_ALG_ECDH); ssl->handshake->xxdh_psa_privkey_is_external = 1;
psa_set_key_type(&key_attributes, } else {
PSA_KEY_TYPE_ECC_KEY_PAIR(ssl->handshake->xxdh_psa_type)); /* PK_ECKEY[_DH] and PK_ECDSA instead as parsed from the PK
psa_set_key_bits(&key_attributes, ssl->handshake->xxdh_psa_bits); * module and only have ECDSA capabilities. Since we need
* them for ECDH later, we export and then re-import them with
* proper flags and algorithm. Of course We also set key's type
* and bits that we just got above. */
key_attributes = psa_key_attributes_init();
psa_set_key_usage_flags(&key_attributes, PSA_KEY_USAGE_DERIVE);
psa_set_key_algorithm(&key_attributes, PSA_ALG_ECDH);
psa_set_key_type(&key_attributes,
PSA_KEY_TYPE_ECC_KEY_PAIR(ssl->handshake->xxdh_psa_type));
psa_set_key_bits(&key_attributes, ssl->handshake->xxdh_psa_bits);
status = psa_export_key(pk->priv_id, buf, sizeof(buf), &key_len); status = psa_export_key(pk->priv_id, buf, sizeof(buf), &key_len);
if (status != PSA_SUCCESS) { if (status != PSA_SUCCESS) {
ret = PSA_TO_MBEDTLS_ERR(status); ret = PSA_TO_MBEDTLS_ERR(status);
goto exit; goto exit;
} }
status = psa_import_key(&key_attributes, buf, key_len, status = psa_import_key(&key_attributes, buf, key_len,
&ssl->handshake->xxdh_psa_privkey); &ssl->handshake->xxdh_psa_privkey);
if (status != PSA_SUCCESS) { if (status != PSA_SUCCESS) {
ret = PSA_TO_MBEDTLS_ERR(status); ret = PSA_TO_MBEDTLS_ERR(status);
goto exit; goto exit;
} }
/* Set this key as owned by the TLS library: it will be its duty /* Set this key as owned by the TLS library: it will be its duty
* to clear it exit. */ * to clear it exit. */
ssl->handshake->xxdh_psa_privkey_is_external = 0; ssl->handshake->xxdh_psa_privkey_is_external = 0;
}
ret = 0; ret = 0;
break; break;