Skip to content

Commit c750932

Browse files
AndrzejKurekAndrzejKurek
committed
Adapt to the new key allocation mechanism
1 parent 9e0feff commit c750932

File tree

14 files changed

+65
-79
lines changed

14 files changed

+65
-79
lines changed

‎include/mbedtls/cipher_internal.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -137,7 +137,7 @@ typedef enum
137137
typedef struct
138138
{
139139
psa_algorithm_t alg;
140-
psa_key_slot_t slot;
140+
psa_key_handle_t slot;
141141
mbedtls_cipher_psa_key_ownership slot_state;
142142
} mbedtls_cipher_context_psa;
143143
#endif /* MBEDTLS_USE_PSA_CRYPTO */

‎include/mbedtls/pk.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -273,7 +273,7 @@ int mbedtls_pk_setup( mbedtls_pk_context *ctx, const mbedtls_pk_info_t *info );
273273
* ECC key pair.
274274
* \return #MBEDTLS_ERR_PK_ALLOC_FAILED on allocation failure.
275275
*/
276-
int mbedtls_pk_setup_opaque( mbedtls_pk_context *ctx, const psa_key_slot_t key );
276+
int mbedtls_pk_setup_opaque( mbedtls_pk_context *ctx, const psa_key_handle_t key );
277277
#endif /* MBEDTLS_USE_PSA_CRYPTO */
278278

279279
#if defined(MBEDTLS_PK_RSA_ALT_SUPPORT)
@@ -761,7 +761,7 @@ int mbedtls_pk_load_file( const char *path, unsigned char **buf, size_t *n );
761761
* \return An Mbed TLS error code otherwise.
762762
*/
763763
int mbedtls_pk_wrap_as_opaque( mbedtls_pk_context *pk,
764-
psa_key_slot_t *slot,
764+
psa_key_handle_t *slot,
765765
psa_algorithm_t hash_alg );
766766
#endif /* MBEDTLS_USE_PSA_CRYPTO */
767767

‎include/mbedtls/psa_util.h

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -42,21 +42,6 @@
4242
#include "md.h"
4343
#include "pk.h"
4444

45-
/* Slot allocation */
46-
47-
static inline psa_status_t mbedtls_psa_get_free_key_slot( psa_key_slot_t *key )
48-
{
49-
for( psa_key_slot_t slot = 1; slot <= 32; slot++ )
50-
{
51-
if( psa_get_key_information( slot, NULL, NULL ) == PSA_ERROR_EMPTY_SLOT )
52-
{
53-
*key = slot;
54-
return( PSA_SUCCESS );
55-
}
56-
}
57-
return( PSA_ERROR_INSUFFICIENT_MEMORY );
58-
}
59-
6045
/* Translations for symmetric crypto. */
6146

6247
static inline psa_key_type_t mbedtls_psa_translate_cipher_type(

‎include/mbedtls/ssl.h

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -929,11 +929,11 @@ struct mbedtls_ssl_config
929929
#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
930930

931931
#if defined(MBEDTLS_USE_PSA_CRYPTO)
932-
psa_key_slot_t psk_opaque; /*!< PSA key slot holding opaque PSK.
933-
* This field should only be set via
934-
* mbedtls_ssl_conf_psk_opaque().
935-
* If either no PSK or a raw PSK have
936-
* been configured, this has value \c 0. */
932+
psa_key_handle_t psk_opaque; /*!< PSA key slot holding opaque PSK.
933+
* This field should only be set via
934+
* mbedtls_ssl_conf_psk_opaque().
935+
* If either no PSK or a raw PSK have
936+
* been configured, this has value \c 0. */
937937
#endif /* MBEDTLS_USE_PSA_CRYPTO */
938938

939939
unsigned char *psk; /*!< The raw pre-shared key. This field should
@@ -2144,7 +2144,7 @@ int mbedtls_ssl_conf_psk( mbedtls_ssl_config *conf,
21442144
* \return An \c MBEDTLS_ERR_SSL_XXX error code on failure.
21452145
*/
21462146
int mbedtls_ssl_conf_psk_opaque( mbedtls_ssl_config *conf,
2147-
psa_key_slot_t psk,
2147+
psa_key_handle_t psk,
21482148
const unsigned char *psk_identity,
21492149
size_t psk_identity_len );
21502150
#endif /* MBEDTLS_USE_PSA_CRYPTO */
@@ -2184,7 +2184,7 @@ int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl,
21842184
* \return An \c MBEDTLS_ERR_SSL_XXX error code on failure.
21852185
*/
21862186
int mbedtls_ssl_set_hs_psk_opaque( mbedtls_ssl_context *ssl,
2187-
psa_key_slot_t psk );
2187+
psa_key_handle_t psk );
21882188
#endif /* MBEDTLS_USE_PSA_CRYPTO */
21892189

21902190
/**

‎include/mbedtls/ssl_internal.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -284,7 +284,7 @@ struct mbedtls_ssl_handshake_params
284284
#endif
285285
#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
286286
#if defined(MBEDTLS_USE_PSA_CRYPTO)
287-
psa_key_slot_t psk_opaque; /*!< Opaque PSK from the callback */
287+
psa_key_handle_t psk_opaque; /*!< Opaque PSK from the callback */
288288
#endif /* MBEDTLS_USE_PSA_CRYPTO */
289289
unsigned char *psk; /*!< PSK from the callback */
290290
size_t psk_len; /*!< Length of PSK from callback */

‎library/cipher.c

Lines changed: 18 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -302,38 +302,39 @@ int mbedtls_cipher_setkey( mbedtls_cipher_context_t *ctx,
302302
if( cipher_psa->slot_state != MBEDTLS_CIPHER_PSA_KEY_UNSET )
303303
return( MBEDTLS_ERR_CIPHER_BAD_INPUT_DATA );
304304

305-
/* Find a fresh key slot to use. */
306-
status = mbedtls_psa_get_free_key_slot( &cipher_psa->slot );
305+
key_type = mbedtls_psa_translate_cipher_type(
306+
ctx->cipher_info->type );
307+
if( key_type == 0 )
308+
return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
309+
310+
/* Allocate a key slot to use. */
311+
status = psa_allocate_key( key_type, key_bitlen, &cipher_psa->slot );
307312
if( status != PSA_SUCCESS )
308313
return( MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED );
309-
/* Indicate that we own the key slot and need to
310-
* destroy it in mbedtls_cipher_free(). */
311-
cipher_psa->slot_state = MBEDTLS_CIPHER_PSA_KEY_OWNED;
312-
313-
/* From that point on, the responsibility for destroying the
314-
* key slot is on mbedtls_cipher_free(). This includes the case
315-
* where the policy setup or key import below fail, as
316-
* mbedtls_cipher_free() needs to be called in any case. */
317314

318315
/* Setup policy for the new key slot. */
319316
psa_key_policy_init( &key_policy );
320317

321318
/* Mbed TLS' cipher layer doesn't enforce the mode of operation
322-
* (encrypt vs. decrypt): it is possible to setup a key for encryption
323-
* and use it for AEAD decryption. Until tests relying on this
324-
* are changed, allow any usage in PSA. */
319+
* (encrypt vs. decrypt): it is possible to setup a key for encryption
320+
* and use it for AEAD decryption. Until tests relying on this
321+
* are changed, allow any usage in PSA. */
325322
/* key_usage = mbedtls_psa_translate_cipher_operation( operation ); */
326323
key_usage = PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT;
327324
psa_key_policy_set_usage( &key_policy, key_usage, cipher_psa->alg );
328325
status = psa_set_key_policy( cipher_psa->slot, &key_policy );
329326
if( status != PSA_SUCCESS )
330327
return( MBEDTLS_ERR_CIPHER_HW_ACCEL_FAILED );
328+
/* Indicate that we own the key slot and need to
329+
* destroy it in mbedtls_cipher_free(). */
330+
cipher_psa->slot_state = MBEDTLS_CIPHER_PSA_KEY_OWNED;
331+
332+
/* From that point on, the responsibility for destroying the
333+
* key slot is on mbedtls_cipher_free(). This includes the case
334+
* where the policy setup or key import below fail, as
335+
* mbedtls_cipher_free() needs to be called in any case. */
331336

332337
/* Populate new key slot. */
333-
key_type = mbedtls_psa_translate_cipher_type(
334-
ctx->cipher_info->type );
335-
if( key_type == 0 )
336-
return( MBEDTLS_ERR_CIPHER_FEATURE_UNAVAILABLE );
337338
status = psa_import_key( cipher_psa->slot,
338339
key_type, key, key_bytelen );
339340
if( status != PSA_SUCCESS )

‎library/pk.c

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -147,10 +147,10 @@ int mbedtls_pk_setup( mbedtls_pk_context *ctx, const mbedtls_pk_info_t *info )
147147
/*
148148
* Initialise a PSA-wrapping context
149149
*/
150-
int mbedtls_pk_setup_opaque( mbedtls_pk_context *ctx, const psa_key_slot_t key )
150+
int mbedtls_pk_setup_opaque( mbedtls_pk_context *ctx, const psa_key_handle_t key )
151151
{
152152
const mbedtls_pk_info_t * const info = &mbedtls_pk_opaque_info;
153-
psa_key_slot_t *pk_ctx;
153+
psa_key_handle_t *pk_ctx;
154154
psa_key_type_t type;
155155

156156
if( ctx == NULL || ctx->pk_info != NULL )
@@ -168,7 +168,7 @@ int mbedtls_pk_setup_opaque( mbedtls_pk_context *ctx, const psa_key_slot_t key )
168168

169169
ctx->pk_info = info;
170170

171-
pk_ctx = (psa_key_slot_t *) ctx->pk_ctx;
171+
pk_ctx = (psa_key_handle_t *) ctx->pk_ctx;
172172
*pk_ctx = key;
173173

174174
return( 0 );
@@ -547,13 +547,13 @@ mbedtls_pk_type_t mbedtls_pk_get_type( const mbedtls_pk_context *ctx )
547547
* Currently only works for EC private keys.
548548
*/
549549
int mbedtls_pk_wrap_as_opaque( mbedtls_pk_context *pk,
550-
psa_key_slot_t *slot,
550+
psa_key_handle_t *slot,
551551
psa_algorithm_t hash_alg )
552552
{
553553
#if !defined(MBEDTLS_ECP_C)
554554
return( MBEDTLS_ERR_PK_TYPE_MISMATCH );
555555
#else
556-
psa_key_slot_t key;
556+
psa_key_handle_t key;
557557
const mbedtls_ecp_keypair *ec;
558558
unsigned char d[MBEDTLS_ECP_MAX_BYTES];
559559
size_t d_len;
@@ -572,9 +572,10 @@ int mbedtls_pk_wrap_as_opaque( mbedtls_pk_context *pk,
572572
return( ret );
573573

574574
curve_id = mbedtls_ecp_curve_info_from_grp_id( ec->grp.id )->tls_id;
575+
key_type = PSA_KEY_TYPE_ECC_KEYPAIR(curve_id);
575576

576-
/* find a free key slot */
577-
if( PSA_SUCCESS != mbedtls_psa_get_free_key_slot( &key ) )
577+
/* allocate a key slot */
578+
if( PSA_SUCCESS != psa_allocate_key( key_type, d_len * 8, &key ) )
578579
return( MBEDTLS_ERR_PK_HW_ACCEL_FAILED );
579580

580581
/* set policy */
@@ -585,7 +586,6 @@ int mbedtls_pk_wrap_as_opaque( mbedtls_pk_context *pk,
585586
return( MBEDTLS_ERR_PK_HW_ACCEL_FAILED );
586587

587588
/* import private key in slot */
588-
key_type = PSA_KEY_TYPE_ECC_KEYPAIR(curve_id);
589589
if( PSA_SUCCESS != psa_import_key( key, key_type, d, d_len ) )
590590
return( MBEDTLS_ERR_PK_HW_ACCEL_FAILED );
591591

‎library/pk_wrap.c

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -546,7 +546,7 @@ static int ecdsa_verify_wrap( void *ctx, mbedtls_md_type_t md_alg,
546546
const unsigned char *sig, size_t sig_len )
547547
{
548548
int ret;
549-
psa_key_slot_t key_slot;
549+
psa_key_handle_t key_slot;
550550
psa_key_policy_t policy;
551551
psa_key_type_t psa_type;
552552
mbedtls_pk_context key;
@@ -571,15 +571,15 @@ static int ecdsa_verify_wrap( void *ctx, mbedtls_md_type_t md_alg,
571571
if( key_len <= 0 )
572572
return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
573573

574-
if( ( ret = mbedtls_psa_get_free_key_slot( &key_slot ) ) != PSA_SUCCESS )
575-
return( mbedtls_psa_err_translate_pk( ret ) );
576-
577574
psa_md = mbedtls_psa_translate_md( md_alg );
578575
if( psa_md == 0 )
579576
return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
580577
psa_sig_md = PSA_ALG_ECDSA( psa_md );
581578
psa_type = PSA_KEY_TYPE_ECC_PUBLIC_KEY( curve );
582579

580+
if( ( ret = psa_allocate_key( psa_type, key_len * 8, &key_slot ) ) != PSA_SUCCESS )
581+
return( mbedtls_psa_err_translate_pk( ret ) );
582+
583583
psa_key_policy_init( &policy );
584584
psa_key_policy_set_usage( &policy, PSA_KEY_USAGE_VERIFY, psa_sig_md );
585585
if( ( ret = psa_set_key_policy( key_slot, &policy ) ) != PSA_SUCCESS )
@@ -879,7 +879,7 @@ const mbedtls_pk_info_t mbedtls_rsa_alt_info = {
879879

880880
static void *pk_opaque_alloc_wrap( void )
881881
{
882-
void *ctx = mbedtls_calloc( 1, sizeof( psa_key_slot_t ) );
882+
void *ctx = mbedtls_calloc( 1, sizeof( psa_key_handle_t ) );
883883

884884
/* no _init() function to call, an calloc() already zeroized */
885885

@@ -888,13 +888,13 @@ static void *pk_opaque_alloc_wrap( void )
888888

889889
static void pk_opaque_free_wrap( void *ctx )
890890
{
891-
mbedtls_platform_zeroize( ctx, sizeof( psa_key_slot_t ) );
891+
mbedtls_platform_zeroize( ctx, sizeof( psa_key_handle_t ) );
892892
mbedtls_free( ctx );
893893
}
894894

895895
static size_t pk_opaque_get_bitlen( const void *ctx )
896896
{
897-
const psa_key_slot_t *key = (const psa_key_slot_t *) ctx;
897+
const psa_key_handle_t *key = (const psa_key_handle_t *) ctx;
898898
size_t bits;
899899

900900
if( PSA_SUCCESS != psa_get_key_information( *key, NULL, &bits ) )
@@ -999,7 +999,7 @@ static int pk_opaque_sign_wrap( void *ctx, mbedtls_md_type_t md_alg,
999999
unsigned char *sig, size_t *sig_len,
10001000
int (*f_rng)(void *, unsigned char *, size_t), void *p_rng )
10011001
{
1002-
const psa_key_slot_t *key = (const psa_key_slot_t *) ctx;
1002+
const psa_key_handle_t *key = (const psa_key_handle_t *) ctx;
10031003
psa_algorithm_t alg = PSA_ALG_ECDSA( mbedtls_psa_translate_md( md_alg ) );
10041004
size_t bits, buf_len;
10051005
psa_status_t status;

‎library/pkwrite.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -168,7 +168,7 @@ int mbedtls_pk_write_pubkey( unsigned char **p, unsigned char *start,
168168
if( mbedtls_pk_get_type( key ) == MBEDTLS_PK_OPAQUE )
169169
{
170170
size_t buffer_size;
171-
psa_key_slot_t* key_slot = (psa_key_slot_t*) key->pk_ctx;
171+
psa_key_handle_t* key_slot = (psa_key_handle_t*) key->pk_ctx;
172172

173173
if ( *p < start )
174174
return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );

‎library/ssl_tls.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -798,7 +798,7 @@ int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
798798
psa_status_t status;
799799
psa_algorithm_t alg;
800800
psa_crypto_generator_t generator = PSA_CRYPTO_GENERATOR_INIT;
801-
psa_key_slot_t psk;
801+
psa_key_handle_t psk;
802802

803803
MBEDTLS_SSL_DEBUG_MSG( 2, ( "perform PSA-based PSK-to-MS expansion" ) );
804804

@@ -7617,7 +7617,7 @@ int mbedtls_ssl_set_hs_psk( mbedtls_ssl_context *ssl,
76177617

76187618
#if defined(MBEDTLS_USE_PSA_CRYPTO)
76197619
int mbedtls_ssl_conf_psk_opaque( mbedtls_ssl_config *conf,
7620-
psa_key_slot_t psk_slot,
7620+
psa_key_handle_t psk_slot,
76217621
const unsigned char *psk_identity,
76227622
size_t psk_identity_len )
76237623
{
@@ -7640,7 +7640,7 @@ int mbedtls_ssl_conf_psk_opaque( mbedtls_ssl_config *conf,
76407640
}
76417641

76427642
int mbedtls_ssl_set_hs_psk_opaque( mbedtls_ssl_context *ssl,
7643-
psa_key_slot_t psk_slot )
7643+
psa_key_handle_t psk_slot )
76447644
{
76457645
if( psk_slot == 0 || ssl->handshake == NULL )
76467646
return( MBEDTLS_ERR_SSL_BAD_INPUT_DATA );

‎programs/ssl/ssl_client2.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -571,7 +571,7 @@ int main( int argc, char *argv[] )
571571
const char *pers = "ssl_client2";
572572

573573
#if defined(MBEDTLS_USE_PSA_CRYPTO)
574-
psa_key_slot_t slot = 0;
574+
psa_key_handle_t slot = 0;
575575
psa_algorithm_t alg = 0;
576576
psa_key_policy_t policy;
577577
psa_status_t status;
@@ -594,7 +594,7 @@ int main( int argc, char *argv[] )
594594
mbedtls_x509_crt clicert;
595595
mbedtls_pk_context pkey;
596596
#if defined(MBEDTLS_USE_PSA_CRYPTO)
597-
psa_key_slot_t key_slot = 0; /* invalid key slot */
597+
psa_key_handle_t key_slot = 0; /* invalid key slot */
598598
#endif
599599
#endif
600600
char *p, *q;
@@ -1594,7 +1594,7 @@ int main( int argc, char *argv[] )
15941594
if( opt.psk_opaque != 0 )
15951595
{
15961596
/* The algorithm has already been determined earlier. */
1597-
status = mbedtls_psa_get_free_key_slot( &slot );
1597+
status = psa_allocate_key( PSA_KEY_TYPE_DERIVE, psk_len * 8, &slot );
15981598
if( status != PSA_SUCCESS )
15991599
{
16001600
ret = MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;

‎programs/ssl/ssl_server2.c

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -806,7 +806,7 @@ struct _psk_entry
806806
size_t key_len;
807807
unsigned char key[MBEDTLS_PSK_MAX_LEN];
808808
#if defined(MBEDTLS_USE_PSA_CRYPTO)
809-
psa_key_slot_t slot;
809+
psa_key_handle_t slot;
810810
#endif /* MBEDTLS_USE_PSA_CRYPTO */
811811
psk_entry *next;
812812
};
@@ -822,7 +822,7 @@ int psk_free( psk_entry *head )
822822
{
823823
#if defined(MBEDTLS_USE_PSA_CRYPTO)
824824
psa_status_t status;
825-
psa_key_slot_t const slot = head->slot;
825+
psa_key_handle_t const slot = head->slot;
826826

827827
if( slot != 0 )
828828
{
@@ -1231,7 +1231,7 @@ int idle( mbedtls_net_context *fd,
12311231
}
12321232

12331233
#if defined(MBEDTLS_USE_PSA_CRYPTO)
1234-
static psa_status_t psa_setup_psk_key_slot( psa_key_slot_t slot,
1234+
static psa_status_t psa_setup_psk_key_slot( psa_key_handle_t slot,
12351235
psa_algorithm_t alg,
12361236
unsigned char *psk,
12371237
size_t psk_len )
@@ -1268,7 +1268,7 @@ int main( int argc, char *argv[] )
12681268
#if defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED)
12691269
#if defined(MBEDTLS_USE_PSA_CRYPTO)
12701270
psa_algorithm_t alg = 0;
1271-
psa_key_slot_t psk_slot = 0;
1271+
psa_key_handle_t psk_slot = 0;
12721272
#endif /* MBEDTLS_USE_PSA_CRYPTO */
12731273
unsigned char psk[MBEDTLS_PSK_MAX_LEN];
12741274
size_t psk_len = 0;
@@ -2667,7 +2667,7 @@ int main( int argc, char *argv[] )
26672667
#if defined(MBEDTLS_USE_PSA_CRYPTO)
26682668
if( opt.psk_opaque != 0 )
26692669
{
2670-
status = mbedtls_psa_get_free_key_slot( &psk_slot );
2670+
status = psa_allocate_key( PSA_KEY_TYPE_DERIVE, psk_len * 8, &psk_slot );
26712671
if( status != PSA_SUCCESS )
26722672
{
26732673
fprintf( stderr, "ALLOC FAIL\n" );
@@ -2711,7 +2711,7 @@ int main( int argc, char *argv[] )
27112711
psk_entry *cur_psk;
27122712
for( cur_psk = psk_info; cur_psk != NULL; cur_psk = cur_psk->next )
27132713
{
2714-
status = mbedtls_psa_get_free_key_slot( &cur_psk->slot );
2714+
status = psa_allocate_key( PSA_KEY_TYPE_DERIVE, cur_psk->key_len * 8, &cur_psk->slot );
27152715
if( status != PSA_SUCCESS )
27162716
{
27172717
ret = MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;

0 commit comments

Comments
 (0)