Skip to content

Commit 0b6b871

Browse files
PataterPatater
authored
Merge pull request #22 from ARMmbed/iotssl-2697-psa-key-allocation-crypto
Adapting to the new PSA key slot allocation mechanism
2 parents cfb7ae9 + 54c139f commit 0b6b871

File tree

14 files changed

+92
-72
lines changed

14 files changed

+92
-72
lines changed

‎include/mbedtls/cipher_internal.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -137,7 +137,7 @@ typedef enum
137137
typedef struct
138138
{
139139
psa_algorithm_t alg;
140-
psa_key_slot_t slot;
140+
psa_key_handle_t slot;
141141
mbedtls_cipher_psa_key_ownership slot_state;
142142
} mbedtls_cipher_context_psa;
143143
#endif /* MBEDTLS_USE_PSA_CRYPTO */

‎include/mbedtls/pk.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -273,7 +273,7 @@ int mbedtls_pk_setup( mbedtls_pk_context *ctx, const mbedtls_pk_info_t *info );
273273
* ECC key pair.
274274
* \return #MBEDTLS_ERR_PK_ALLOC_FAILED on allocation failure.
275275
*/
276-
int mbedtls_pk_setup_opaque( mbedtls_pk_context *ctx, const psa_key_slot_t key );
276+
int mbedtls_pk_setup_opaque( mbedtls_pk_context *ctx, const psa_key_handle_t key );
277277
#endif /* MBEDTLS_USE_PSA_CRYPTO */
278278

279279
#if defined(MBEDTLS_PK_RSA_ALT_SUPPORT)
@@ -761,7 +761,7 @@ int mbedtls_pk_load_file( const char *path, unsigned char **buf, size_t *n );
761761
* \return An Mbed TLS error code otherwise.
762762
*/
763763
int mbedtls_pk_wrap_as_opaque( mbedtls_pk_context *pk,
764-
psa_key_slot_t *slot,
764+
psa_key_handle_t *slot,
765765
psa_algorithm_t hash_alg );
766766
#endif /* MBEDTLS_USE_PSA_CRYPTO */
767767

‎include/mbedtls/psa_util.h

Lines changed: 30 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -42,21 +42,6 @@
4242
#include "md.h"
4343
#include "pk.h"
4444

45-
/* Slot allocation */
46-
47-
static inline psa_status_t mbedtls_psa_get_free_key_slot( psa_key_slot_t *key )
48-
{
49-
for( psa_key_slot_t slot = 1; slot <= 32; slot++ )
50-
{
51-
if( psa_get_key_information( slot, NULL, NULL ) == PSA_ERROR_EMPTY_SLOT )
52-
{
53-
*key = slot;
54-
return( PSA_SUCCESS );
55-
}
56-
}
57-
return( PSA_ERROR_INSUFFICIENT_MEMORY );
58-
}
59-
6045
/* Translations for symmetric crypto. */
6146

6247
static inline psa_key_type_t mbedtls_psa_translate_cipher_type(
@@ -231,6 +216,23 @@ static inline psa_ecc_curve_t mbedtls_psa_translate_ecc_group( mbedtls_ecp_group
231216
}
232217
}
233218

219+
#define MBEDTLS_PSA_ECC_KEY_BITS_OF_CURVE( curve ) \
220+
( curve == PSA_ECC_CURVE_SECP192R1 ? 192 : \
221+
curve == PSA_ECC_CURVE_SECP224R1 ? 224 : \
222+
curve == PSA_ECC_CURVE_SECP256R1 ? 256 : \
223+
curve == PSA_ECC_CURVE_SECP384R1 ? 384 : \
224+
curve == PSA_ECC_CURVE_SECP521R1 ? 521 : \
225+
curve == PSA_ECC_CURVE_SECP192K1 ? 192 : \
226+
curve == PSA_ECC_CURVE_SECP224K1 ? 224 : \
227+
curve == PSA_ECC_CURVE_SECP256K1 ? 256 : \
228+
curve == PSA_ECC_CURVE_BRAINPOOL_P256R1 ? 256 : \
229+
curve == PSA_ECC_CURVE_BRAINPOOL_P384R1 ? 384 : \
230+
curve == PSA_ECC_CURVE_BRAINPOOL_P512R1 ? 512 : \
231+
0 )
232+
233+
#define MBEDTLS_PSA_ECC_KEY_BYTES_OF_CURVE( curve ) \
234+
( ( MBEDTLS_PSA_ECC_KEY_BITS_OF_CURVE( curve ) + 7 ) / 8 )
235+
234236
/* Translations for PK layer */
235237

236238
static inline int mbedtls_psa_err_translate_pk( psa_status_t status )
@@ -259,6 +261,19 @@ static inline int mbedtls_psa_err_translate_pk( psa_status_t status )
259261
}
260262
}
261263

264+
/* Translations for ECC */
265+
266+
/* This function transforms an ECC group identifier from
267+
* https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8
268+
* into a PSA ECC group identifier. */
269+
static inline psa_ecc_curve_t mbedtls_psa_parse_tls_ecc_group(
270+
uint16_t tls_ecc_grp_reg_id )
271+
{
272+
/* The PSA identifiers are currently aligned with those from
273+
* the TLS Supported Groups registry, so no conversion is necessary. */
274+
return( (psa_ecc_curve_t) tls_ecc_grp_reg_id );
275+
}
276+
262277
#endif /* MBEDTLS_USE_PSA_CRYPTO */
263278

264279
#endif /* MBEDTLS_PSA_UTIL_H */

‎include/mbedtls/ssl.h

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -929,11 +929,11 @@ struct mbedtls_ssl_config
929929
#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
930930

931931
#if defined(MBEDTLS_USE_PSA_CRYPTO)
932-
psa_key_slot_t psk_opaque; /*!< PSA key slot holding opaque PSK.
933-
* This field should only be set via
934-
* mbedtls_ssl_conf_psk_opaque().
935-
* If either no PSK or a raw PSK have
936-
* been configured, this has value \c 0. */
932+
psa_key_handle_t psk_opaque; /*!< PSA key slot holding opaque PSK.
933+
* This field should only be set via
934+
* mbedtls_ssl_conf_psk_opaque().
935+
* If either no PSK or a raw PSK have
936+
* been configured, this has value \c 0. */
937937
#endif /* MBEDTLS_USE_PSA_CRYPTO */
938938

939939
unsigned char *psk; /*!< The raw pre-shared key. This field should
@@ -2129,7 +2129,7 @@ int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,
21292129
* \param psk The identifier of the key slot holding the PSK.
21302130
* Until \p conf is destroyed or this function is successfully
21312131
* called again, the key slot \p psk must be populated with a
2132-
* key of type #PSA_ALG_CATEGORY_KEY_DERIVATION whose policy
2132+
* key of type PSA_ALG_CATEGORY_KEY_DERIVATION whose policy
21332133
* allows its use for the key derivation algorithm applied
21342134
* in the handshake.
21352135
* \param psk_identity The pointer to the pre-shared key identity.
@@ -2144,7 +2144,7 @@ int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,
21442144
* \return An \c MBEDTLS_ERR_SSL_XXX error code on failure.
21452145
*/
21462146
int mbedtls_ssl_conf_psk_opaque( mbedtls_ssl_config *conf,
2147-
psa_key_slot_t psk,
2147+
psa_key_handle_t psk,
21482148
const unsigned char *psk_identity,
21492149
size_t psk_identity_len );
21502150
#endif /* MBEDTLS_USE_PSA_CRYPTO */
@@ -2176,15 +2176,15 @@ int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl,
21762176
* \param psk The identifier of the key slot holding the PSK.
21772177
* For the duration of the current handshake, the key slot
21782178
* must be populated with a key of type
2179-
* #PSA_ALG_CATEGORY_KEY_DERIVATION whose policy allows its
2179+
* PSA_ALG_CATEGORY_KEY_DERIVATION whose policy allows its
21802180
* use for the key derivation algorithm
21812181
* applied in the handshake.
21822182
*
21832183
* \return \c 0 if successful.
21842184
* \return An \c MBEDTLS_ERR_SSL_XXX error code on failure.
21852185
*/
21862186
int mbedtls_ssl_set_hs_psk_opaque( mbedtls_ssl_context *ssl,
2187-
psa_key_slot_t psk );
2187+
psa_key_handle_t psk );
21882188
#endif /* MBEDTLS_USE_PSA_CRYPTO */
21892189

21902190
/**

‎include/mbedtls/ssl_internal.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -284,7 +284,7 @@ struct mbedtls_ssl_handshake_params
284284
#endif
285285
#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
286286
#if defined(MBEDTLS_USE_PSA_CRYPTO)
287-
psa_key_slot_t psk_opaque; /*!< Opaque PSK from the callback */
287+
psa_key_handle_t psk_opaque; /*!< Opaque PSK from the callback */
288288
#endif /* MBEDTLS_USE_PSA_CRYPTO */
289289
unsigned char *psk; /*!< PSK from the callback */
290290
size_t psk_len; /*!< Length of PSK from callback */

‎library/cipher.c

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -302,12 +302,18 @@ int mbedtls_cipher_setkey( mbedtls_cipher_context_t *ctx,
302302
if( cipher_psa->slot_state != MBEDTLS_CIPHER_PSA_KEY_UNSET )
303303
return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
304304

305-
/* Find a fresh key slot to use. */
306-
status = mbedtls_psa_get_free_key_slot( &cipher_psa->slot );
305+
key_type = mbedtls_psa_translate_cipher_type(
306+
ctx->cipher_info->type );
307+
if( key_type == 0 )
308+
return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
309+
310+
/* Allocate a key slot to use. */
311+
status = psa_allocate_key( key_type, key_bitlen, &cipher_psa->slot );
307312
if( status != PSA_SUCCESS )
308313
return( MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED );
309-
/* Indicate that we own the key slot and need to
310-
* destroy it in mbedtls_cipher_free(). */
314+
315+
/* Indicate that we own the key slot and need to
316+
* destroy it in mbedtls_cipher_free(). */
311317
cipher_psa->slot_state = MBEDTLS_CIPHER_PSA_KEY_OWNED;
312318

313319
/* From that point on, the responsibility for destroying the
@@ -330,10 +336,6 @@ int mbedtls_cipher_setkey( mbedtls_cipher_context_t *ctx,
330336
return( MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED );
331337

332338
/* Populate new key slot. */
333-
key_type = mbedtls_psa_translate_cipher_type(
334-
ctx->cipher_info->type );
335-
if( key_type == 0 )
336-
return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
337339
status = psa_import_key( cipher_psa->slot,
338340
key_type, key, key_bytelen );
339341
if( status != PSA_SUCCESS )

‎library/pk.c

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -147,10 +147,10 @@ int mbedtls_pk_setup( mbedtls_pk_context *ctx, const mbedtls_pk_info_t *info )
147147
/*
148148
* Initialise a PSA-wrapping context
149149
*/
150-
int mbedtls_pk_setup_opaque( mbedtls_pk_context *ctx, const psa_key_slot_t key )
150+
int mbedtls_pk_setup_opaque( mbedtls_pk_context *ctx, const psa_key_handle_t key )
151151
{
152152
const mbedtls_pk_info_t * const info = &mbedtls_pk_opaque_info;
153-
psa_key_slot_t *pk_ctx;
153+
psa_key_handle_t *pk_ctx;
154154
psa_key_type_t type;
155155

156156
if( ctx == NULL || ctx->pk_info != NULL )
@@ -168,7 +168,7 @@ int mbedtls_pk_setup_opaque( mbedtls_pk_context *ctx, const psa_key_slot_t key )
168168

169169
ctx->pk_info = info;
170170

171-
pk_ctx = (psa_key_slot_t *) ctx->pk_ctx;
171+
pk_ctx = (psa_key_handle_t *) ctx->pk_ctx;
172172
*pk_ctx = key;
173173

174174
return( 0 );
@@ -547,13 +547,13 @@ mbedtls_pk_type_t mbedtls_pk_get_type( const mbedtls_pk_context *ctx )
547547
* Currently only works for EC private keys.
548548
*/
549549
int mbedtls_pk_wrap_as_opaque( mbedtls_pk_context *pk,
550-
psa_key_slot_t *slot,
550+
psa_key_handle_t *slot,
551551
psa_algorithm_t hash_alg )
552552
{
553553
#if !defined(MBEDTLS_ECP_C)
554554
return( MBEDTLS_ERR_PK_TYPE_MISMATCH );
555555
#else
556-
psa_key_slot_t key;
556+
psa_key_handle_t key;
557557
const mbedtls_ecp_keypair *ec;
558558
unsigned char d[MBEDTLS_ECP_MAX_BYTES];
559559
size_t d_len;
@@ -572,9 +572,11 @@ int mbedtls_pk_wrap_as_opaque( mbedtls_pk_context *pk,
572572
return( ret );
573573

574574
curve_id = mbedtls_ecp_curve_info_from_grp_id( ec->grp.id )->tls_id;
575+
key_type = PSA_KEY_TYPE_ECC_KEYPAIR(
576+
mbedtls_psa_parse_tls_ecc_group ( curve_id ) );
575577

576-
/* find a free key slot */
577-
if( PSA_SUCCESS != mbedtls_psa_get_free_key_slot( &key ) )
578+
/* allocate a key slot */
579+
if( PSA_SUCCESS != psa_allocate_key( key_type, d_len * 8, &key ) )
578580
return( MBEDTLS_ERR_PK_HW_ACCEL_FAILED );
579581

580582
/* set policy */
@@ -585,7 +587,6 @@ int mbedtls_pk_wrap_as_opaque( mbedtls_pk_context *pk,
585587
return( MBEDTLS_ERR_PK_HW_ACCEL_FAILED );
586588

587589
/* import private key in slot */
588-
key_type = PSA_KEY_TYPE_ECC_KEYPAIR(curve_id);
589590
if( PSA_SUCCESS != psa_import_key( key, key_type, d, d_len ) )
590591
return( MBEDTLS_ERR_PK_HW_ACCEL_FAILED );
591592

‎library/pk_wrap.c

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -546,7 +546,7 @@ static int ecdsa_verify_wrap( void *ctx, mbedtls_md_type_t md_alg,
546546
const unsigned char *sig, size_t sig_len )
547547
{
548548
int ret;
549-
psa_key_slot_t key_slot;
549+
psa_key_handle_t key_slot;
550550
psa_key_policy_t policy;
551551
psa_key_type_t psa_type;
552552
mbedtls_pk_context key;
@@ -571,15 +571,17 @@ static int ecdsa_verify_wrap( void *ctx, mbedtls_md_type_t md_alg,
571571
if( key_len <= 0 )
572572
return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
573573

574-
if( ( ret = mbedtls_psa_get_free_key_slot( &key_slot ) ) != PSA_SUCCESS )
575-
return( mbedtls_psa_err_translate_pk( ret ) );
576-
577574
psa_md = mbedtls_psa_translate_md( md_alg );
578575
if( psa_md == 0 )
579576
return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
580577
psa_sig_md = PSA_ALG_ECDSA( psa_md );
581578
psa_type = PSA_KEY_TYPE_ECC_PUBLIC_KEY( curve );
582579

580+
if( ( ret = psa_allocate_key( psa_type,
581+
MBEDTLS_PSA_ECC_KEY_BITS_OF_CURVE(curve),
582+
&key_slot ) ) != PSA_SUCCESS )
583+
return( mbedtls_psa_err_translate_pk( ret ) );
584+
583585
psa_key_policy_init( &policy );
584586
psa_key_policy_set_usage( &policy, PSA_KEY_USAGE_VERIFY, psa_sig_md );
585587
if( ( ret = psa_set_key_policy( key_slot, &policy ) ) != PSA_SUCCESS )
@@ -879,7 +881,7 @@ const mbedtls_pk_info_t mbedtls_rsa_alt_info = {
879881

880882
static void *pk_opaque_alloc_wrap( void )
881883
{
882-
void *ctx = mbedtls_calloc( 1, sizeof( psa_key_slot_t ) );
884+
void *ctx = mbedtls_calloc( 1, sizeof( psa_key_handle_t ) );
883885

884886
/* no _init() function to call, an calloc() already zeroized */
885887

@@ -888,13 +890,13 @@ static void *pk_opaque_alloc_wrap( void )
888890

889891
static void pk_opaque_free_wrap( void *ctx )
890892
{
891-
mbedtls_platform_zeroize( ctx, sizeof( psa_key_slot_t ) );
893+
mbedtls_platform_zeroize( ctx, sizeof( psa_key_handle_t ) );
892894
mbedtls_free( ctx );
893895
}
894896

895897
static size_t pk_opaque_get_bitlen( const void *ctx )
896898
{
897-
const psa_key_slot_t *key = (const psa_key_slot_t *) ctx;
899+
const psa_key_handle_t *key = (const psa_key_handle_t *) ctx;
898900
size_t bits;
899901

900902
if( PSA_SUCCESS != psa_get_key_information( *key, NULL, &bits ) )
@@ -999,7 +1001,7 @@ static int pk_opaque_sign_wrap( void *ctx, mbedtls_md_type_t md_alg,
9991001
unsigned char *sig, size_t *sig_len,
10001002
int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
10011003
{
1002-
const psa_key_slot_t *key = (const psa_key_slot_t *) ctx;
1004+
const psa_key_handle_t *key = (const psa_key_handle_t *) ctx;
10031005
psa_algorithm_t alg = PSA_ALG_ECDSA( mbedtls_psa_translate_md( md_alg ) );
10041006
size_t bits, buf_len;
10051007
psa_status_t status;

‎library/pkwrite.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -168,7 +168,7 @@ int mbedtls_pk_write_pubkey( unsigned char **p, unsigned char *start,
168168
if( mbedtls_pk_get_type( key ) == MBEDTLS_PK_OPAQUE )
169169
{
170170
size_t buffer_size;
171-
psa_key_slot_t* key_slot = (psa_key_slot_t*) key->pk_ctx;
171+
psa_key_handle_t* key_slot = (psa_key_handle_t*) key->pk_ctx;
172172

173173
if ( *p < start )
174174
return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );

‎library/ssl_tls.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -798,7 +798,7 @@ int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
798798
psa_status_t status;
799799
psa_algorithm_t alg;
800800
psa_crypto_generator_t generator = PSA_CRYPTO_GENERATOR_INIT;
801-
psa_key_slot_t psk;
801+
psa_key_handle_t psk;
802802

803803
MBEDTLS_SSL_DEBUG_MSG( 2, ( "perform PSA-based PSK-to-MS expansion" ) );
804804

@@ -7617,7 +7617,7 @@ int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl,
76177617

76187618
#if defined(MBEDTLS_USE_PSA_CRYPTO)
76197619
int mbedtls_ssl_conf_psk_opaque( mbedtls_ssl_config *conf,
7620-
psa_key_slot_t psk_slot,
7620+
psa_key_handle_t psk_slot,
76217621
const unsigned char *psk_identity,
76227622
size_t psk_identity_len )
76237623
{
@@ -7640,7 +7640,7 @@ int mbedtls_ssl_conf_psk_opaque( mbedtls_ssl_config *conf,
76407640
}
76417641

76427642
int mbedtls_ssl_set_hs_psk_opaque( mbedtls_ssl_context *ssl,
7643-
psa_key_slot_t psk_slot )
7643+
psa_key_handle_t psk_slot )
76447644
{
76457645
if( psk_slot == 0 || ssl->handshake == NULL )
76467646
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );

‎programs/ssl/ssl_client2.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -571,7 +571,7 @@ int main( int argc, char *argv[] )
571571
const char *pers = "ssl_client2";
572572

573573
#if defined(MBEDTLS_USE_PSA_CRYPTO)
574-
psa_key_slot_t slot = 0;
574+
psa_key_handle_t slot = 0;
575575
psa_algorithm_t alg = 0;
576576
psa_key_policy_t policy;
577577
psa_status_t status;
@@ -594,7 +594,7 @@ int main( int argc, char *argv[] )
594594
mbedtls_x509_crt clicert;
595595
mbedtls_pk_context pkey;
596596
#if defined(MBEDTLS_USE_PSA_CRYPTO)
597-
psa_key_slot_t key_slot = 0; /* invalid key slot */
597+
psa_key_handle_t key_slot = 0; /* invalid key slot */
598598
#endif
599599
#endif
600600
char *p, *q;
@@ -1594,7 +1594,7 @@ int main( int argc, char *argv[] )
15941594
if( opt.psk_opaque != 0 )
15951595
{
15961596
/* The algorithm has already been determined earlier. */
1597-
status = mbedtls_psa_get_free_key_slot( &slot );
1597+
status = psa_allocate_key( PSA_KEY_TYPE_DERIVE, psk_len * 8, &slot );
15981598
if( status != PSA_SUCCESS )
15991599
{
16001600
ret = MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;

0 commit comments

Comments
 (0)