Skip to content

Commit 8df72f2

Browse files
gilles-peskine-armgilles-peskine-arm
committed
SE generate/sign/verify tests: also test export_public
Add a flow where the key is imported or fake-generated in the secure element, then call psa_export_public_key and do the software verification with the public key.
1 parent af906f8 commit 8df72f2

File tree

2 files changed

+98
-37
lines changed

2 files changed

+98
-37
lines changed

‎tests/suites/test_suite_psa_crypto_se_driver_hal.data

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -140,16 +140,24 @@ register_key_smoke_test:MIN_DRIVER_LIFETIME:0:PSA_ERROR_NOT_PERMITTED
140140

141141
Import-sign-verify: sign in driver, ECDSA
142142
depends_on:MBEDTLS_ECDSA_C:MBEDTLS_ECP_C:MBEDTLS_ECP_DP_SECP256R1_ENABLED
143-
sign_verify:1:PSA_KEY_TYPE_ECC_KEY_PAIR( PSA_ECC_CURVE_SECP256R1 ):PSA_ALG_ECDSA_ANY:0:"49c9a8c18c4b885638c431cf1df1c994131609b580d4fd43a0cab17db2f13eee":"54686973206973206e6f74206120686173682e"
143+
sign_verify:SIGN_IN_DRIVER_AND_PARALLEL_CREATION:PSA_KEY_TYPE_ECC_KEY_PAIR( PSA_ECC_CURVE_SECP256R1 ):PSA_ALG_ECDSA_ANY:0:"49c9a8c18c4b885638c431cf1df1c994131609b580d4fd43a0cab17db2f13eee":"54686973206973206e6f74206120686173682e"
144+
145+
Import-sign-verify: sign in driver then export_public, ECDSA
146+
depends_on:MBEDTLS_ECDSA_C:MBEDTLS_ECP_C:MBEDTLS_ECP_DP_SECP256R1_ENABLED
147+
sign_verify:SIGN_IN_DRIVER_THEN_EXPORT_PUBLIC:PSA_KEY_TYPE_ECC_KEY_PAIR( PSA_ECC_CURVE_SECP256R1 ):PSA_ALG_ECDSA_ANY:0:"49c9a8c18c4b885638c431cf1df1c994131609b580d4fd43a0cab17db2f13eee":"54686973206973206e6f74206120686173682e"
144148

145149
Import-sign-verify: sign in software, ECDSA
146150
depends_on:MBEDTLS_ECDSA_C:MBEDTLS_ECP_C:MBEDTLS_ECP_DP_SECP256R1_ENABLED
147-
sign_verify:0:PSA_KEY_TYPE_ECC_KEY_PAIR( PSA_ECC_CURVE_SECP256R1 ):PSA_ALG_ECDSA_ANY:0:"49c9a8c18c4b885638c431cf1df1c994131609b580d4fd43a0cab17db2f13eee":"54686973206973206e6f74206120686173682e"
151+
sign_verify:SIGN_IN_SOFTWARE_AND_PARALLEL_CREATION:PSA_KEY_TYPE_ECC_KEY_PAIR( PSA_ECC_CURVE_SECP256R1 ):PSA_ALG_ECDSA_ANY:0:"49c9a8c18c4b885638c431cf1df1c994131609b580d4fd43a0cab17db2f13eee":"54686973206973206e6f74206120686173682e"
148152

149153
Generate-sign-verify: sign in driver, ECDSA
150154
depends_on:MBEDTLS_ECDSA_C:MBEDTLS_ECP_C:MBEDTLS_ECP_DP_SECP256R1_ENABLED
151-
sign_verify:1:PSA_KEY_TYPE_ECC_KEY_PAIR( PSA_ECC_CURVE_SECP256R1 ):PSA_ALG_ECDSA_ANY:256:"49c9a8c18c4b885638c431cf1df1c994131609b580d4fd43a0cab17db2f13eee":"54686973206973206e6f74206120686173682e"
155+
sign_verify:SIGN_IN_DRIVER_AND_PARALLEL_CREATION:PSA_KEY_TYPE_ECC_KEY_PAIR( PSA_ECC_CURVE_SECP256R1 ):PSA_ALG_ECDSA_ANY:256:"49c9a8c18c4b885638c431cf1df1c994131609b580d4fd43a0cab17db2f13eee":"54686973206973206e6f74206120686173682e"
156+
157+
Generate-sign-verify: sign in driver then export_public, ECDSA
158+
depends_on:MBEDTLS_ECDSA_C:MBEDTLS_ECP_C:MBEDTLS_ECP_DP_SECP256R1_ENABLED
159+
sign_verify:SIGN_IN_DRIVER_THEN_EXPORT_PUBLIC:PSA_KEY_TYPE_ECC_KEY_PAIR( PSA_ECC_CURVE_SECP256R1 ):PSA_ALG_ECDSA_ANY:256:"49c9a8c18c4b885638c431cf1df1c994131609b580d4fd43a0cab17db2f13eee":"54686973206973206e6f74206120686173682e"
152160

153161
Generate-sign-verify: sign in software, ECDSA
154162
depends_on:MBEDTLS_ECDSA_C:MBEDTLS_ECP_C:MBEDTLS_ECP_DP_SECP256R1_ENABLED
155-
sign_verify:0:PSA_KEY_TYPE_ECC_KEY_PAIR( PSA_ECC_CURVE_SECP256R1 ):PSA_ALG_ECDSA_ANY:256:"49c9a8c18c4b885638c431cf1df1c994131609b580d4fd43a0cab17db2f13eee":"54686973206973206e6f74206120686173682e"
163+
sign_verify:SIGN_IN_SOFTWARE_AND_PARALLEL_CREATION:PSA_KEY_TYPE_ECC_KEY_PAIR( PSA_ECC_CURVE_SECP256R1 ):PSA_ALG_ECDSA_ANY:256:"49c9a8c18c4b885638c431cf1df1c994131609b580d4fd43a0cab17db2f13eee":"54686973206973206e6f74206120686173682e"

‎tests/suites/test_suite_psa_crypto_se_driver_hal.function

Lines changed: 86 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -444,6 +444,13 @@ exit:
444444
/* Other test helper functions */
445445
/****************************************************************/
446446

447+
typedef enum
448+
{
449+
SIGN_IN_SOFTWARE_AND_PARALLEL_CREATION,
450+
SIGN_IN_DRIVER_AND_PARALLEL_CREATION,
451+
SIGN_IN_DRIVER_THEN_EXPORT_PUBLIC,
452+
} sign_verify_method_t;
453+
447454
/* Check that the attributes of a key reported by psa_get_key_attributes()
448455
* are consistent with the attributes used when creating the key. */
449456
static int check_key_attributes(
@@ -1017,7 +1024,7 @@ exit:
10171024
/* END_CASE */
10181025

10191026
/* BEGIN_CASE */
1020-
void sign_verify( int sign_in_driver,
1027+
void sign_verify( int flow,
10211028
int type_arg, int alg_arg,
10221029
int bits_arg, data_t *key_material,
10231030
data_t *input )
@@ -1036,75 +1043,121 @@ void sign_verify( int sign_in_driver,
10361043
psa_key_id_t id = 1;
10371044
psa_key_handle_t drv_handle = 0; /* key managed by the driver */
10381045
psa_key_handle_t sw_handle = 0; /* transparent key */
1039-
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
1046+
psa_key_attributes_t sw_attributes = PSA_KEY_ATTRIBUTES_INIT;
1047+
psa_key_attributes_t drv_attributes;
10401048
uint8_t signature[PSA_ASYMMETRIC_SIGNATURE_MAX_SIZE];
10411049
size_t signature_length;
10421050

10431051
memset( &driver, 0, sizeof( driver ) );
10441052
memset( &key_management, 0, sizeof( key_management ) );
1053+
memset( &asymmetric, 0, sizeof( asymmetric ) );
10451054
driver.hal_version = PSA_DRV_SE_HAL_VERSION;
10461055
driver.key_management = &key_management;
10471056
driver.asymmetric = &asymmetric;
1048-
driver.persistent_data_size = sizeof( psa_key_slot_number_t );
10491057
driver.persistent_data_size = sizeof( ram_slot_usage_t );
10501058
key_management.p_allocate = ram_allocate;
10511059
key_management.p_destroy = ram_destroy;
10521060
if( generating )
10531061
key_management.p_generate = ram_fake_generate;
10541062
else
10551063
key_management.p_import = ram_import;
1056-
if( sign_in_driver )
1057-
asymmetric.p_sign = ram_sign;
1064+
switch( flow )
1065+
{
1066+
case SIGN_IN_SOFTWARE_AND_PARALLEL_CREATION:
1067+
break;
1068+
case SIGN_IN_DRIVER_AND_PARALLEL_CREATION:
1069+
asymmetric.p_sign = ram_sign;
1070+
break;
1071+
case SIGN_IN_DRIVER_THEN_EXPORT_PUBLIC:
1072+
asymmetric.p_sign = ram_sign;
1073+
key_management.p_export_public = ram_export_public;
1074+
break;
1075+
default:
1076+
TEST_ASSERT( ! "unsupported flow (should be SIGN_IN_xxx)" );
1077+
break;
1078+
}
10581079
asymmetric.p_verify = ram_verify;
10591080

10601081
PSA_ASSERT( psa_register_se_driver( lifetime, &driver ) );
10611082
PSA_ASSERT( psa_crypto_init( ) );
10621083

1063-
/* Create two keys with the same key material: a transparent key,
1064-
* and one that goes through the driver. */
1065-
psa_set_key_usage_flags( &attributes,
1084+
/* Prepare to create two keys with the same key material: a transparent
1085+
* key, and one that goes through the driver. */
1086+
psa_set_key_usage_flags( &sw_attributes,
10661087
PSA_KEY_USAGE_SIGN | PSA_KEY_USAGE_VERIFY );
1067-
psa_set_key_algorithm( &attributes, alg );
1068-
psa_set_key_type( &attributes, type );
1069-
PSA_ASSERT( psa_import_key( &attributes,
1070-
key_material->x, key_material->len,
1071-
&sw_handle ) );
1072-
psa_set_key_id( &attributes, id );
1073-
psa_set_key_lifetime( &attributes, lifetime );
1088+
psa_set_key_algorithm( &sw_attributes, alg );
1089+
psa_set_key_type( &sw_attributes, type );
1090+
drv_attributes = sw_attributes;
1091+
psa_set_key_id( &drv_attributes, id );
1092+
psa_set_key_lifetime( &drv_attributes, lifetime );
1093+
1094+
/* Create the key in the driver. */
10741095
if( generating )
10751096
{
1076-
psa_set_key_bits( &attributes, bits );
1077-
PSA_ASSERT( psa_generate_key( &attributes, &drv_handle ) );
1097+
psa_set_key_bits( &drv_attributes, bits );
1098+
PSA_ASSERT( psa_generate_key( &drv_attributes, &drv_handle ) );
10781099
/* Since we called a generate method that does not actually
10791100
* generate material, store the desired result of generation in
10801101
* the mock secure element storage. */
1081-
PSA_ASSERT( psa_get_key_attributes( drv_handle, &attributes ) );
1102+
PSA_ASSERT( psa_get_key_attributes( drv_handle, &drv_attributes ) );
10821103
TEST_ASSERT( key_material->len == PSA_BITS_TO_BYTES( bits ) );
10831104
memcpy( ram_slots[ram_min_slot].content, key_material->x,
10841105
key_material->len );
10851106
}
10861107
else
10871108
{
1088-
PSA_ASSERT( psa_import_key( &attributes,
1109+
PSA_ASSERT( psa_import_key( &drv_attributes,
10891110
key_material->x, key_material->len,
10901111
&drv_handle ) );
10911112
}
10921113

1114+
/* Either import the same key in software, or export the driver's
1115+
* public key and import that. */
1116+
switch( flow )
1117+
{
1118+
case SIGN_IN_SOFTWARE_AND_PARALLEL_CREATION:
1119+
case SIGN_IN_DRIVER_AND_PARALLEL_CREATION:
1120+
PSA_ASSERT( psa_import_key( &sw_attributes,
1121+
key_material->x, key_material->len,
1122+
&sw_handle ) );
1123+
break;
1124+
case SIGN_IN_DRIVER_THEN_EXPORT_PUBLIC:
1125+
{
1126+
uint8_t public_key[PSA_KEY_EXPORT_ECC_PUBLIC_KEY_MAX_SIZE( PSA_VENDOR_ECC_MAX_CURVE_BITS )];
1127+
size_t public_key_length;
1128+
PSA_ASSERT( psa_export_public_key( drv_handle,
1129+
public_key, sizeof( public_key ),
1130+
&public_key_length ) );
1131+
psa_set_key_type( &sw_attributes,
1132+
PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR( type ) );
1133+
PSA_ASSERT( psa_import_key( &sw_attributes,
1134+
public_key, public_key_length,
1135+
&sw_handle ) );
1136+
break;
1137+
}
1138+
}
1139+
10931140
/* Sign with the chosen key. */
1094-
if( sign_in_driver )
1095-
PSA_ASSERT_VIA_DRIVER(
1096-
psa_asymmetric_sign( drv_handle,
1097-
alg,
1098-
input->x, input->len,
1099-
signature, sizeof( signature ),
1100-
&signature_length ),
1101-
PSA_SUCCESS );
1102-
else
1103-
PSA_ASSERT( psa_asymmetric_sign( sw_handle,
1104-
alg,
1105-
input->x, input->len,
1106-
signature, sizeof( signature ),
1107-
&signature_length ) );
1141+
switch( flow )
1142+
{
1143+
case SIGN_IN_DRIVER_AND_PARALLEL_CREATION:
1144+
case SIGN_IN_DRIVER_THEN_EXPORT_PUBLIC:
1145+
PSA_ASSERT_VIA_DRIVER(
1146+
psa_asymmetric_sign( drv_handle,
1147+
alg,
1148+
input->x, input->len,
1149+
signature, sizeof( signature ),
1150+
&signature_length ),
1151+
PSA_SUCCESS );
1152+
break;
1153+
case SIGN_IN_SOFTWARE_AND_PARALLEL_CREATION:
1154+
PSA_ASSERT( psa_asymmetric_sign( sw_handle,
1155+
alg,
1156+
input->x, input->len,
1157+
signature, sizeof( signature ),
1158+
&signature_length ) );
1159+
break;
1160+
}
11081161

11091162
/* Verify with both keys. */
11101163
PSA_ASSERT( psa_asymmetric_verify( sw_handle, alg,

0 commit comments

Comments
 (0)