yuzu-emu/mbedtls
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
mbedtls/tests/suites/test_suite_psa_crypto_persistent_key.function

346 lines
11 KiB
C
Raw Normal View History

psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
/* BEGIN_HEADER */
Add a note to some invasive tests Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2019-09-09 18:22:50 +02:00
/* The tests in this module verify the contents of key store files. They
* access internal key storage functions directly. Some of the tests depend
Fix typos prior to release Signed-off-by: Tom Cosgrove <tom.cosgrove@arm.com>
2022-12-04 18:19:59 +01:00
* on the storage format. On the other hand, these tests treat the storage
Add a note to some invasive tests Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2019-09-09 18:22:50 +02:00
* subsystem as a black box, and in particular have no reliance on the
* internals of the ITS implementation.
Add warnings to test code and data about storage format stability Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2022-06-20 19:10:35 +02:00
*
* Note that if you need to make a change that affects how files are
* stored, this may indicate that the key store is changing in a
* backward-incompatible way! Think carefully about backward compatibility
* before changing how test data is constructed or validated.
Add a note to some invasive tests Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2019-09-09 18:22:50 +02:00
*/
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
#include <stdint.h>
Create PSA-specific helper function file Create a specific file for helper functions that are related to the PSA API. The reason for a separate file is so that it can include <psa/crypto.h>, without forcing this header inclusion into every test suite. In this commit, psa_helpers.function doesn't need psa/crypto.h yet, but this will be the case in a subsequent commit. Move PSA_ASSERT to psa_helpers.function, since that's the sort of things it's for. Include "psa_helpers.function" from the PSA crypto tests. In the ITS test, don't include "psa_helpers". The ITS tests are meant to stand alone from the rest of the library.
2019-05-23 20:25:48 +02:00
psa: Forbid creation/registration of keys in vendor range The identifier of keys created/registred should be in the application range. This is by spec for key creation. This may change for registered key. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-10-29 15:26:43 +01:00
#include "psa_crypto_slot_management.h"
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
#include "psa_crypto_storage.h"
Create PSA-specific helper function file Create a specific file for helper functions that are related to the PSA API. The reason for a separate file is so that it can include <psa/crypto.h>, without forcing this header inclusion into every test suite. In this commit, psa_helpers.function doesn't need psa/crypto.h yet, but this will be the case in a subsequent commit. Move PSA_ASSERT to psa_helpers.function, since that's the sort of things it's for. Include "psa_helpers.function" from the PSA crypto tests. In the ITS test, don't include "psa_helpers". The ITS tests are meant to stand alone from the rest of the library.
2019-05-23 20:25:48 +02:00
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
#include "mbedtls/md.h"
#define PSA_KEY_STORAGE_MAGIC_HEADER "PSA\0KEY"
#define PSA_KEY_STORAGE_MAGIC_HEADER_LENGTH ( sizeof( PSA_KEY_STORAGE_MAGIC_HEADER ) )
Add a note to some invasive tests Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2019-09-09 18:22:50 +02:00
/* Enforce the storage format for keys. The storage format is not a public
* documented interface, but it must be preserved between versions so that
* upgrades work smoothly, so it's a stable interface nonetheless.
*/
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
typedef struct {
uint8_t magic[PSA_KEY_STORAGE_MAGIC_HEADER_LENGTH];
uint8_t version[4];
Add the lifetime to the key storage format Stored keys must contain lifetime information. The lifetime used to be implied by the location of the key, back when applications supplied the lifetime value when opening the key. Now that all keys' metadata are stored in a central location, this location needs to store the lifetime explicitly.
2019-07-23 14:46:52 +02:00
uint8_t lifetime[sizeof( psa_key_lifetime_t )];
Change key types to a 16-bit encoding All key types now have an encoding on 32 bits where the bottom 16 bits are zero. Change to using 16 bits only. Keep 32 bits for key types in storage, but move the significant half-word from the top to the bottom. Likewise, change EC curve and DH group families from 32 bits out of which the top 8 and bottom 16 bits are zero, to 8 bits only. Reorder psa_core_key_attributes_t to avoid padding.
2019-12-04 17:18:41 +01:00
uint8_t type[4];
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
uint8_t policy[sizeof( psa_key_policy_t )];
uint8_t data_len[4];
uint8_t key_data[];
} psa_persistent_key_storage_format;
psa: Extend psa_generate_key to support persistent lifetimes
2018-11-07 17:05:30 +01:00
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
/* END_HEADER */
/* BEGIN_DEPENDENCIES
* depends_on:MBEDTLS_PSA_CRYPTO_C:MBEDTLS_PSA_CRYPTO_STORAGE_C
* END_DEPENDENCIES
*/
/* BEGIN_CASE */
void format_storage_data_check( data_t *key_data,
data_t *expected_file_data,
Changes PSA key storage format to include key bits * Stores bits in psa_persistent_key_storage_format. * psa_load_persistent_key_into_slot still imports plaintext keys which ensures that the bits value gets set. * Updates key specification to match new implementation. * Expands persistent store and load tests with to check for bits attribute. * Removes bits storage from psa_se_key_data_storage_t. Signed-off-by: Torstein Nesse <torstein.nesse@silabs.com>
2020-10-07 10:50:15 +02:00
int key_lifetime, int key_type, int key_bits,
Enrollment algorithm in policy: update persistent key tests The storage format has changed, so update the test data accordingly.
2019-05-14 11:16:10 +02:00
int key_usage, int key_alg, int key_alg2 )
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
{
Fix memory failure handling in test_format_storage_data_check Fail the test instead of crashing if a memory allocation fails. Free memory even if the test fails.
2019-12-02 20:50:16 +01:00
uint8_t *file_data = NULL;
size_t file_data_length =
key_data->len + sizeof( psa_persistent_key_storage_format );
Use a key attribute structure in the internal storage interface Pass information via a key attribute structure rather than as separate parameters to psa_crypto_storage functions. This makes it easier to maintain the code when the metadata of a key evolves. This has negligible impact on code size (+4B with "gcc -Os" on x86_64).
2019-07-23 11:58:03 +02:00
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
Add the lifetime to the key storage format Stored keys must contain lifetime information. The lifetime used to be implied by the location of the key, back when applications supplied the lifetime value when opening the key. Now that all keys' metadata are stored in a central location, this location needs to store the lifetime explicitly.
2019-07-23 14:46:52 +02:00
psa_set_key_lifetime( &attributes, key_lifetime );
Use a key attribute structure in the internal storage interface Pass information via a key attribute structure rather than as separate parameters to psa_crypto_storage functions. This makes it easier to maintain the code when the metadata of a key evolves. This has negligible impact on code size (+4B with "gcc -Os" on x86_64).
2019-07-23 11:58:03 +02:00
psa_set_key_type( &attributes, key_type );
Changes PSA key storage format to include key bits * Stores bits in psa_persistent_key_storage_format. * psa_load_persistent_key_into_slot still imports plaintext keys which ensures that the bits value gets set. * Updates key specification to match new implementation. * Expands persistent store and load tests with to check for bits attribute. * Removes bits storage from psa_se_key_data_storage_t. Signed-off-by: Torstein Nesse <torstein.nesse@silabs.com>
2020-10-07 10:50:15 +02:00
psa_set_key_bits( &attributes, key_bits );
Use a key attribute structure in the internal storage interface Pass information via a key attribute structure rather than as separate parameters to psa_crypto_storage functions. This makes it easier to maintain the code when the metadata of a key evolves. This has negligible impact on code size (+4B with "gcc -Os" on x86_64).
2019-07-23 11:58:03 +02:00
psa_set_key_usage_flags( &attributes, key_usage );
psa_set_key_algorithm( &attributes, key_alg );
psa_set_key_enrollment_algorithm( &attributes, key_alg2 );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
Fix memory failure handling in test_format_storage_data_check Fail the test instead of crashing if a memory allocation fails. Free memory even if the test fails.
2019-12-02 20:50:16 +01:00
ASSERT_ALLOC( file_data, file_data_length );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
psa_format_key_data_for_storage( key_data->x, key_data->len,
Switch storage functions over to psa_core_key_attributes_t
2019-07-30 20:22:33 +02:00
&attributes.core,
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
file_data );
ASSERT_COMPARE( expected_file_data->x, expected_file_data->len,
file_data, file_data_length );
Fix memory failure handling in test_format_storage_data_check Fail the test instead of crashing if a memory allocation fails. Free memory even if the test fails.
2019-12-02 20:50:16 +01:00
exit:
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
mbedtls_free( file_data );
}
/* END_CASE */
/* BEGIN_CASE */
void parse_storage_data_check( data_t *file_data,
data_t *expected_key_data,
Add the lifetime to the key storage format Stored keys must contain lifetime information. The lifetime used to be implied by the location of the key, back when applications supplied the lifetime value when opening the key. Now that all keys' metadata are stored in a central location, this location needs to store the lifetime explicitly.
2019-07-23 14:46:52 +02:00
int expected_key_lifetime,
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
int expected_key_type,
Changes PSA key storage format to include key bits * Stores bits in psa_persistent_key_storage_format. * psa_load_persistent_key_into_slot still imports plaintext keys which ensures that the bits value gets set. * Updates key specification to match new implementation. * Expands persistent store and load tests with to check for bits attribute. * Removes bits storage from psa_se_key_data_storage_t. Signed-off-by: Torstein Nesse <torstein.nesse@silabs.com>
2020-10-07 10:50:15 +02:00
int expected_key_bits,
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
int expected_key_usage,
int expected_key_alg,
Enrollment algorithm in policy: update persistent key tests The storage format has changed, so update the test data accordingly.
2019-05-14 11:16:10 +02:00
int expected_key_alg2,
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
int expected_status )
{
uint8_t *key_data = NULL;
size_t key_data_length = 0;
Use a key attribute structure in the internal storage interface Pass information via a key attribute structure rather than as separate parameters to psa_crypto_storage functions. This makes it easier to maintain the code when the metadata of a key evolves. This has negligible impact on code size (+4B with "gcc -Os" on x86_64).
2019-07-23 11:58:03 +02:00
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
psa_status_t status;
status = psa_parse_key_data_from_storage( file_data->x, file_data->len,
&key_data, &key_data_length,
Switch storage functions over to psa_core_key_attributes_t
2019-07-30 20:22:33 +02:00
&attributes.core );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
Use TEST_EQUAL(a,b) in preference to TEST_ASSERT(a==b) This commit is the result of the following command, followed by reindenting (but not wrapping lines): perl -00 -i -pe 's/^( *)TEST_ASSERT\(([^;=]*)(?: |\n *)==([^;=]*)\);$/${1}TEST_EQUAL($2,$3);/gm' tests/suites/test_suite_psa_*.function
2018-12-18 00:24:04 +01:00
TEST_EQUAL( status, expected_status );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
if( status != PSA_SUCCESS )
goto exit;
Add the lifetime to the key storage format Stored keys must contain lifetime information. The lifetime used to be implied by the location of the key, back when applications supplied the lifetime value when opening the key. Now that all keys' metadata are stored in a central location, this location needs to store the lifetime explicitly.
2019-07-23 14:46:52 +02:00
TEST_EQUAL( psa_get_key_lifetime( &attributes ),
(psa_key_type_t) expected_key_lifetime );
Use a key attribute structure in the internal storage interface Pass information via a key attribute structure rather than as separate parameters to psa_crypto_storage functions. This makes it easier to maintain the code when the metadata of a key evolves. This has negligible impact on code size (+4B with "gcc -Os" on x86_64).
2019-07-23 11:58:03 +02:00
TEST_EQUAL( psa_get_key_type( &attributes ),
(psa_key_type_t) expected_key_type );
Changes PSA key storage format to include key bits * Stores bits in psa_persistent_key_storage_format. * psa_load_persistent_key_into_slot still imports plaintext keys which ensures that the bits value gets set. * Updates key specification to match new implementation. * Expands persistent store and load tests with to check for bits attribute. * Removes bits storage from psa_se_key_data_storage_t. Signed-off-by: Torstein Nesse <torstein.nesse@silabs.com>
2020-10-07 10:50:15 +02:00
TEST_EQUAL( psa_get_key_bits( &attributes ),
(psa_key_bits_t) expected_key_bits );
Use a key attribute structure in the internal storage interface Pass information via a key attribute structure rather than as separate parameters to psa_crypto_storage functions. This makes it easier to maintain the code when the metadata of a key evolves. This has negligible impact on code size (+4B with "gcc -Os" on x86_64).
2019-07-23 11:58:03 +02:00
TEST_EQUAL( psa_get_key_usage_flags( &attributes ),
(uint32_t) expected_key_usage );
TEST_EQUAL( psa_get_key_algorithm( &attributes ),
(uint32_t) expected_key_alg );
TEST_EQUAL( psa_get_key_enrollment_algorithm( &attributes ),
(uint32_t) expected_key_alg2 );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
ASSERT_COMPARE( expected_key_data->x, expected_key_data->len,
key_data, key_data_length );
exit:
mbedtls_free( key_data );
}
/* END_CASE */
/* BEGIN_CASE */
Limit keys to 65528 bits 65528 bits is more than any reasonable key until we start supporting post-quantum cryptography. This limit is chosen to allow bit-sizes to be stored in 16 bits, with 65535 left to indicate an invalid value. It's a whole number of bytes, which facilitates some calculations, in particular allowing a key of exactly PSA_CRYPTO_MAX_STORAGE_SIZE to be created but not one bit more. As a resource usage limit, this is arguably too large, but that's out of scope of the current commit. Test that key import, generation and derivation reject overly large sizes.
2019-07-30 17:26:54 +02:00
void save_large_persistent_key( int data_length_arg, int expected_status )
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
{
psa: Rename psa_key_file_id_t to mbedtls_svc_key_id_t With PSA crypto v1.0.0, a volatile key identifier may contain a owner identifier but no file is associated to it. Thus rename the type psa_key_file_id_t to mbedtls_svc_key_id_t to avoid a direct link with a file when a key identifier involves an owner identifier. The new type name is prefixed by mbedtls to highlight that the type is specific to Mbed TLS implementation and not defined in the PSA Cryptography API specification. The svc in the type name stands for service as this is the key identifier type from the point of view of the service providing the Cryptography services. The service can be completely provided by the present library or partially in case of a multi-client service. As a consequence rename as well: . MBEDTLS_PSA_CRYPTO_KEY_FILE_ID_ENCODES_OWNER to MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER . PSA_KEY_ID_INIT to MBEDTLS_SVC_KEY_ID_INIT . PSA_KEY_FILE_GET_KEY_ID to MBEDTLS_SVC_KEY_ID_GET_KEY_ID . psa_key_file_id_make to mbedtls_svc_key_id_make Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-28 19:01:50 +02:00
mbedtls_svc_key_id_t key_id = mbedtls_svc_key_id_make( 1, 42 );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
uint8_t *data = NULL;
Limit keys to 65528 bits 65528 bits is more than any reasonable key until we start supporting post-quantum cryptography. This limit is chosen to allow bit-sizes to be stored in 16 bits, with 65535 left to indicate an invalid value. It's a whole number of bytes, which facilitates some calculations, in particular allowing a key of exactly PSA_CRYPTO_MAX_STORAGE_SIZE to be created but not one bit more. As a resource usage limit, this is arguably too large, but that's out of scope of the current commit. Test that key import, generation and derivation reject overly large sizes.
2019-07-30 17:26:54 +02:00
size_t data_length = data_length_arg;
Update persistent_key_load_key_from_storage to use attributes Update persistent_key_load_key_from_storage to the new attribute-based key creation interface. I tweaked the code a little to make it simpler and more robust without changing the core logic.
2019-04-19 14:06:53 +02:00
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
ASSERT_ALLOC( data, data_length );
Use PSA_ASSERT(a) in preference to TEST_ASSERT(a==PSA_SUCCESS) This commit is the result of the following command, followed by reindenting (but not wrapping lines): perl -00 -i -pe 's/^( *)TEST_ASSERT\(([^;=]*)(?: |\n *)==\s*PSA_SUCCESS\s*\);$/${1}PSA_ASSERT($2 );/gm' tests/suites/test_suite_psa_*.function
2018-12-18 00:18:46 +01:00
PSA_ASSERT( psa_crypto_init() );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
Replace psa_make_key_persistent by id/lifetime setters in tests Remove all internal uses of psa_make_key_persistent.
2019-05-15 16:12:22 +02:00
psa_set_key_id( &attributes, key_id );
Update persistent_key_load_key_from_storage to use attributes Update persistent_key_load_key_from_storage to the new attribute-based key creation interface. I tweaked the code a little to make it simpler and more robust without changing the core logic.
2019-04-19 14:06:53 +02:00
psa_set_key_type( &attributes, PSA_KEY_TYPE_RAW_DATA );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
tests: Adapt PSA tests to openless APIs psa_key_handle_equal() is removed as not used anymore. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 14:58:35 +02:00
TEST_EQUAL( psa_import_key( &attributes, data, data_length, &key_id ),
Rewrap some lines after the macro changes Change the way some lines are wrapped to cut at a more logical place. This commit mainly rewrites multi-line calls to TEST_EQUAL, and also a few calls to PSA_ASSERT.
2018-12-18 00:33:25 +01:00
expected_status );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
Close or destroy keys explicitly in tests
2019-05-28 14:08:50 +02:00
if( expected_status == PSA_SUCCESS )
tests: Adapt PSA tests to openless APIs psa_key_handle_equal() is removed as not used anymore. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 14:58:35 +02:00
PSA_ASSERT( psa_destroy_key( key_id ) );
Close or destroy keys explicitly in tests
2019-05-28 14:08:50 +02:00
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
exit:
mbedtls_free( data );
Replace all calls to mbedtls_psa_crypto_free by PSA_DONE Replace all calls to mbedtls_psa_crypto_free in tests by PSA_DONE. This is correct for most tests, because most tests close open keys. A few tests now fail; these tests need to be reviewed and switched back to mbedtls_psa_crypto_free if they genuinely expected to end with some slots still in use.
2019-05-28 15:10:21 +02:00
PSA_DONE();
Convert the PSA crypto persistent storage tests to the new handle API Switch from the direct use of slot numbers to handles allocated by psa_allocate_key. The general principle for each function is: * Change `psa_key_slot_t slot` to `psa_key_handle_t handle` or `psa_key_id_t key_id` depending on whether it's used as a handle to an open slot or as a persistent name for a key. * Call psa_create_key() before using a slot, instead of calling psa_set_key_lifetime to make a slot persistent. Remove the unit test persistent_key_is_configurable which is no longer relevant.
2018-12-03 17:05:18 +01:00
psa_destroy_persistent_key( key_id );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
}
/* END_CASE */
/* BEGIN_CASE */
tests: psa: Add owner identifier as test parameter To test the proper handling of owner identifier as of key identifiers, add owner identifier(s) to tests having key identifier(s) as test parameters. Just don't do it for tests related to tests invalid values of key identifiers as there is no owner identifier invalid values. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-07-28 15:06:14 +02:00
void persistent_key_destroy( int owner_id_arg, int key_id_arg, int restart,
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
int first_type_arg, data_t *first_data,
int second_type_arg, data_t *second_data )
{
tests: psa: Add owner identifier as test parameter To test the proper handling of owner identifier as of key identifiers, add owner identifier(s) to tests having key identifier(s) as test parameters. Just don't do it for tests related to tests invalid values of key identifiers as there is no owner identifier invalid values. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-07-28 15:06:14 +02:00
mbedtls_svc_key_id_t key_id =
mbedtls_svc_key_id_make( owner_id_arg, key_id_arg );
tests: Adapt PSA tests to openless APIs psa_key_handle_equal() is removed as not used anymore. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 14:58:35 +02:00
mbedtls_svc_key_id_t returned_key_id = MBEDTLS_SVC_KEY_ID_INIT;
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
psa_key_type_t first_type = (psa_key_type_t) first_type_arg;
psa_key_type_t second_type = (psa_key_type_t) second_type_arg;
Update persistent_key_load_key_from_storage to use attributes Update persistent_key_load_key_from_storage to the new attribute-based key creation interface. I tweaked the code a little to make it simpler and more robust without changing the core logic.
2019-04-19 14:06:53 +02:00
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
Use PSA_ASSERT(a) in preference to TEST_ASSERT(a==PSA_SUCCESS) This commit is the result of the following command, followed by reindenting (but not wrapping lines): perl -00 -i -pe 's/^( *)TEST_ASSERT\(([^;=]*)(?: |\n *)==\s*PSA_SUCCESS\s*\);$/${1}PSA_ASSERT($2 );/gm' tests/suites/test_suite_psa_*.function
2018-12-18 00:18:46 +01:00
PSA_ASSERT( psa_crypto_init() );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
Replace psa_make_key_persistent by id/lifetime setters in tests Remove all internal uses of psa_make_key_persistent.
2019-05-15 16:12:22 +02:00
psa_set_key_id( &attributes, key_id );
Update persistent_key_load_key_from_storage to use attributes Update persistent_key_load_key_from_storage to the new attribute-based key creation interface. I tweaked the code a little to make it simpler and more robust without changing the core logic.
2019-04-19 14:06:53 +02:00
psa_set_key_type( &attributes, first_type );
Convert the PSA crypto persistent storage tests to the new handle API Switch from the direct use of slot numbers to handles allocated by psa_allocate_key. The general principle for each function is: * Change `psa_key_slot_t slot` to `psa_key_handle_t handle` or `psa_key_id_t key_id` depending on whether it's used as a handle to an open slot or as a persistent name for a key. * Call psa_create_key() before using a slot, instead of calling psa_set_key_lifetime to make a slot persistent. Remove the unit test persistent_key_is_configurable which is no longer relevant.
2018-12-03 17:05:18 +01:00
Split long lines after psa_import_key refactoring
2019-05-15 20:22:09 +02:00
PSA_ASSERT( psa_import_key( &attributes, first_data->x, first_data->len,
tests: Adapt PSA tests to openless APIs psa_key_handle_equal() is removed as not used anymore. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 14:58:35 +02:00
&returned_key_id ) );
Update persistent_key_load_key_from_storage to use attributes Update persistent_key_load_key_from_storage to the new attribute-based key creation interface. I tweaked the code a little to make it simpler and more robust without changing the core logic.
2019-04-19 14:06:53 +02:00
if( restart )
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
{
tests: Adapt PSA tests to openless APIs psa_key_handle_equal() is removed as not used anymore. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 14:58:35 +02:00
psa_close_key( key_id );
Replace all calls to mbedtls_psa_crypto_free by PSA_DONE Replace all calls to mbedtls_psa_crypto_free in tests by PSA_DONE. This is correct for most tests, because most tests close open keys. A few tests now fail; these tests need to be reviewed and switched back to mbedtls_psa_crypto_free if they genuinely expected to end with some slots still in use.
2019-05-28 15:10:21 +02:00
PSA_DONE();
Update persistent_key_load_key_from_storage to use attributes Update persistent_key_load_key_from_storage to the new attribute-based key creation interface. I tweaked the code a little to make it simpler and more robust without changing the core logic.
2019-04-19 14:06:53 +02:00
PSA_ASSERT( psa_crypto_init() );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
}
Update persistent_key_load_key_from_storage to use attributes Update persistent_key_load_key_from_storage to the new attribute-based key creation interface. I tweaked the code a little to make it simpler and more robust without changing the core logic.
2019-04-19 14:06:53 +02:00
TEST_EQUAL( psa_is_key_present_in_storage( key_id ), 1 );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
/* Destroy the key */
tests: Adapt PSA tests to openless APIs psa_key_handle_equal() is removed as not used anymore. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 14:58:35 +02:00
PSA_ASSERT( psa_destroy_key( key_id ) );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
/* Check key slot storage is removed */
Use TEST_EQUAL(a,b) in preference to TEST_ASSERT(a==b) This commit is the result of the following command, followed by reindenting (but not wrapping lines): perl -00 -i -pe 's/^( *)TEST_ASSERT\(([^;=]*)(?: |\n *)==([^;=]*)\);$/${1}TEST_EQUAL($2,$3);/gm' tests/suites/test_suite_psa_*.function
2018-12-18 00:24:04 +01:00
TEST_EQUAL( psa_is_key_present_in_storage( key_id ), 0 );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
/* Shutdown and restart */
Replace all calls to mbedtls_psa_crypto_free by PSA_DONE Replace all calls to mbedtls_psa_crypto_free in tests by PSA_DONE. This is correct for most tests, because most tests close open keys. A few tests now fail; these tests need to be reviewed and switched back to mbedtls_psa_crypto_free if they genuinely expected to end with some slots still in use.
2019-05-28 15:10:21 +02:00
PSA_DONE();
Use PSA_ASSERT(a) in preference to TEST_ASSERT(a==PSA_SUCCESS) This commit is the result of the following command, followed by reindenting (but not wrapping lines): perl -00 -i -pe 's/^( *)TEST_ASSERT\(([^;=]*)(?: |\n *)==\s*PSA_SUCCESS\s*\);$/${1}PSA_ASSERT($2 );/gm' tests/suites/test_suite_psa_*.function
2018-12-18 00:18:46 +01:00
PSA_ASSERT( psa_crypto_init() );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
Convert the PSA crypto persistent storage tests to the new handle API Switch from the direct use of slot numbers to handles allocated by psa_allocate_key. The general principle for each function is: * Change `psa_key_slot_t slot` to `psa_key_handle_t handle` or `psa_key_id_t key_id` depending on whether it's used as a handle to an open slot or as a persistent name for a key. * Call psa_create_key() before using a slot, instead of calling psa_set_key_lifetime to make a slot persistent. Remove the unit test persistent_key_is_configurable which is no longer relevant.
2018-12-03 17:05:18 +01:00
/* Create another key in the same slot */
Replace psa_make_key_persistent by id/lifetime setters in tests Remove all internal uses of psa_make_key_persistent.
2019-05-15 16:12:22 +02:00
psa_set_key_id( &attributes, key_id );
Update persistent_key_load_key_from_storage to use attributes Update persistent_key_load_key_from_storage to the new attribute-based key creation interface. I tweaked the code a little to make it simpler and more robust without changing the core logic.
2019-04-19 14:06:53 +02:00
psa_set_key_type( &attributes, second_type );
Split long lines after psa_import_key refactoring
2019-05-15 20:22:09 +02:00
PSA_ASSERT( psa_import_key( &attributes, second_data->x, second_data->len,
tests: Adapt PSA tests to openless APIs psa_key_handle_equal() is removed as not used anymore. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 14:58:35 +02:00
&returned_key_id ) );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
tests: Adapt PSA tests to openless APIs psa_key_handle_equal() is removed as not used anymore. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 14:58:35 +02:00
PSA_ASSERT( psa_destroy_key( key_id ) );
Close or destroy keys explicitly in tests
2019-05-28 14:08:50 +02:00
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
exit:
Replace all calls to mbedtls_psa_crypto_free by PSA_DONE Replace all calls to mbedtls_psa_crypto_free in tests by PSA_DONE. This is correct for most tests, because most tests close open keys. A few tests now fail; these tests need to be reviewed and switched back to mbedtls_psa_crypto_free if they genuinely expected to end with some slots still in use.
2019-05-28 15:10:21 +02:00
PSA_DONE();
Convert the PSA crypto persistent storage tests to the new handle API Switch from the direct use of slot numbers to handles allocated by psa_allocate_key. The general principle for each function is: * Change `psa_key_slot_t slot` to `psa_key_handle_t handle` or `psa_key_id_t key_id` depending on whether it's used as a handle to an open slot or as a persistent name for a key. * Call psa_create_key() before using a slot, instead of calling psa_set_key_lifetime to make a slot persistent. Remove the unit test persistent_key_is_configurable which is no longer relevant.
2018-12-03 17:05:18 +01:00
psa_destroy_persistent_key( key_id );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
}
/* END_CASE */
/* BEGIN_CASE */
tests: psa: Add owner identifier as test parameter To test the proper handling of owner identifier as of key identifiers, add owner identifier(s) to tests having key identifier(s) as test parameters. Just don't do it for tests related to tests invalid values of key identifiers as there is no owner identifier invalid values. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-07-28 15:06:14 +02:00
void persistent_key_import( int owner_id_arg, int key_id_arg, int type_arg,
data_t *data, int restart, int expected_status )
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
{
tests: psa: Add owner identifier as test parameter To test the proper handling of owner identifier as of key identifiers, add owner identifier(s) to tests having key identifier(s) as test parameters. Just don't do it for tests related to tests invalid values of key identifiers as there is no owner identifier invalid values. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-07-28 15:06:14 +02:00
mbedtls_svc_key_id_t key_id =
mbedtls_svc_key_id_make( owner_id_arg, key_id_arg );
tests: Adapt PSA tests to openless APIs psa_key_handle_equal() is removed as not used anymore. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 14:58:35 +02:00
mbedtls_svc_key_id_t returned_key_id;
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
psa_key_type_t type = (psa_key_type_t) type_arg;
Update persistent_key_load_key_from_storage to use attributes Update persistent_key_load_key_from_storage to the new attribute-based key creation interface. I tweaked the code a little to make it simpler and more robust without changing the core logic.
2019-04-19 14:06:53 +02:00
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
Use PSA_ASSERT(a) in preference to TEST_ASSERT(a==PSA_SUCCESS) This commit is the result of the following command, followed by reindenting (but not wrapping lines): perl -00 -i -pe 's/^( *)TEST_ASSERT\(([^;=]*)(?: |\n *)==\s*PSA_SUCCESS\s*\);$/${1}PSA_ASSERT($2 );/gm' tests/suites/test_suite_psa_*.function
2018-12-18 00:18:46 +01:00
PSA_ASSERT( psa_crypto_init() );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
Replace psa_make_key_persistent by id/lifetime setters in tests Remove all internal uses of psa_make_key_persistent.
2019-05-15 16:12:22 +02:00
psa_set_key_id( &attributes, key_id );
Update persistent_key_load_key_from_storage to use attributes Update persistent_key_load_key_from_storage to the new attribute-based key creation interface. I tweaked the code a little to make it simpler and more robust without changing the core logic.
2019-04-19 14:06:53 +02:00
psa_set_key_type( &attributes, type );
tests: Adapt PSA tests to openless APIs psa_key_handle_equal() is removed as not used anymore. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 14:58:35 +02:00
TEST_EQUAL( psa_import_key( &attributes, data->x, data->len, &returned_key_id ),
Rewrap some lines after the macro changes Change the way some lines are wrapped to cut at a more logical place. This commit mainly rewrites multi-line calls to TEST_EQUAL, and also a few calls to PSA_ASSERT.
2018-12-18 00:33:25 +01:00
expected_status );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
if( expected_status != PSA_SUCCESS )
{
tests: Adapt PSA tests to openless APIs psa_key_handle_equal() is removed as not used anymore. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 14:58:35 +02:00
TEST_ASSERT( mbedtls_svc_key_id_is_null( returned_key_id ) );
Use TEST_EQUAL(a,b) in preference to TEST_ASSERT(a==b) This commit is the result of the following command, followed by reindenting (but not wrapping lines): perl -00 -i -pe 's/^( *)TEST_ASSERT\(([^;=]*)(?: |\n *)==([^;=]*)\);$/${1}TEST_EQUAL($2,$3);/gm' tests/suites/test_suite_psa_*.function
2018-12-18 00:24:04 +01:00
TEST_EQUAL( psa_is_key_present_in_storage( key_id ), 0 );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
goto exit;
}
tests: Adapt PSA tests to openless APIs psa_key_handle_equal() is removed as not used anymore. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 14:58:35 +02:00
TEST_ASSERT( mbedtls_svc_key_id_equal( returned_key_id, key_id ) );
Persistent key gray-box tests: add test cases with restart Also test the behavior if the crypto subsystem is restarted after creating the persistent key.
2019-04-19 15:40:00 +02:00
if( restart )
{
tests: Adapt PSA tests to openless APIs psa_key_handle_equal() is removed as not used anymore. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 14:58:35 +02:00
PSA_ASSERT( psa_purge_key( key_id ) );
Replace all calls to mbedtls_psa_crypto_free by PSA_DONE Replace all calls to mbedtls_psa_crypto_free in tests by PSA_DONE. This is correct for most tests, because most tests close open keys. A few tests now fail; these tests need to be reviewed and switched back to mbedtls_psa_crypto_free if they genuinely expected to end with some slots still in use.
2019-05-28 15:10:21 +02:00
PSA_DONE();
Persistent key gray-box tests: add test cases with restart Also test the behavior if the crypto subsystem is restarted after creating the persistent key.
2019-04-19 15:40:00 +02:00
PSA_ASSERT( psa_crypto_init() );
}
Update persistent_key_load_key_from_storage to use attributes Update persistent_key_load_key_from_storage to the new attribute-based key creation interface. I tweaked the code a little to make it simpler and more robust without changing the core logic.
2019-04-19 14:06:53 +02:00
psa_reset_key_attributes( &attributes );
tests: Adapt PSA tests to openless APIs psa_key_handle_equal() is removed as not used anymore. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 14:58:35 +02:00
PSA_ASSERT( psa_get_key_attributes( key_id, &attributes ) );
TEST_ASSERT( mbedtls_svc_key_id_equal( psa_get_key_id( &attributes ),
key_id ) );
Update persistent_key_load_key_from_storage to use attributes Update persistent_key_load_key_from_storage to the new attribute-based key creation interface. I tweaked the code a little to make it simpler and more robust without changing the core logic.
2019-04-19 14:06:53 +02:00
TEST_EQUAL( psa_get_key_lifetime( &attributes ),
PSA_KEY_LIFETIME_PERSISTENT );
TEST_EQUAL( psa_get_key_type( &attributes ), type );
TEST_EQUAL( psa_get_key_usage_flags( &attributes ), 0 );
TEST_EQUAL( psa_get_key_algorithm( &attributes ), 0 );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
tests: Adapt PSA tests to openless APIs psa_key_handle_equal() is removed as not used anymore. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 14:58:35 +02:00
PSA_ASSERT( psa_destroy_key( key_id ) );
Close or destroy keys explicitly in tests
2019-05-28 14:08:50 +02:00
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
exit:
tests: psa: Reset key attributes where needed After a call to psa_get_key_attributes() to retrieve the attributes of a key into a psa_key_attributes_t structure, a call to psa_reset_key_attributes() is mandated to free the resources that may be referenced by the psa_key_attributes_t structure. Not calling psa_reset_key_attributes() may result in a memory leak. When a test function calls psa_get_key_parameters() the associated key attributes are systematically reset in the clean-up part of the function with a comment to emphasize the need for the reset and make it more visible. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-19 17:55:23 +01:00
/*
* Key attributes may have been returned by psa_get_key_attributes()
* thus reset them as required.
*/
Call psa_reset_key_attributes after psa_get_key_attributes After calling psa_get_key_attributes(), call psa_reset_key_attributes() if the key may have domain parameters, because that's the way to free the domain parameter substructure in the attribute structure. Keep not calling reset() in some places where the key can only be a symmetric key which doesn't have domain parameters.
2019-04-26 16:03:33 +02:00
psa_reset_key_attributes( &attributes );
tests: psa: Reset key attributes where needed After a call to psa_get_key_attributes() to retrieve the attributes of a key into a psa_key_attributes_t structure, a call to psa_reset_key_attributes() is mandated to free the resources that may be referenced by the psa_key_attributes_t structure. Not calling psa_reset_key_attributes() may result in a memory leak. When a test function calls psa_get_key_parameters() the associated key attributes are systematically reset in the clean-up part of the function with a comment to emphasize the need for the reset and make it more visible. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-19 17:55:23 +01:00
Convert the PSA crypto persistent storage tests to the new handle API Switch from the direct use of slot numbers to handles allocated by psa_allocate_key. The general principle for each function is: * Change `psa_key_slot_t slot` to `psa_key_handle_t handle` or `psa_key_id_t key_id` depending on whether it's used as a handle to an open slot or as a persistent name for a key. * Call psa_create_key() before using a slot, instead of calling psa_set_key_lifetime to make a slot persistent. Remove the unit test persistent_key_is_configurable which is no longer relevant.
2018-12-03 17:05:18 +01:00
psa_destroy_persistent_key( key_id );
Replace all calls to mbedtls_psa_crypto_free by PSA_DONE Replace all calls to mbedtls_psa_crypto_free in tests by PSA_DONE. This is correct for most tests, because most tests close open keys. A few tests now fail; these tests need to be reviewed and switched back to mbedtls_psa_crypto_free if they genuinely expected to end with some slots still in use.
2019-05-28 15:10:21 +02:00
PSA_DONE();
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
}
/* END_CASE */
/* BEGIN_CASE */
void import_export_persistent_key( data_t *data, int type_arg,
Persistent key gray-box tests: add test cases with restart Also test the behavior if the crypto subsystem is restarted after creating the persistent key.
2019-04-19 15:40:00 +02:00
int expected_bits,
int restart, int key_not_exist )
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
{
psa: Rename psa_key_file_id_t to mbedtls_svc_key_id_t With PSA crypto v1.0.0, a volatile key identifier may contain a owner identifier but no file is associated to it. Thus rename the type psa_key_file_id_t to mbedtls_svc_key_id_t to avoid a direct link with a file when a key identifier involves an owner identifier. The new type name is prefixed by mbedtls to highlight that the type is specific to Mbed TLS implementation and not defined in the PSA Cryptography API specification. The svc in the type name stands for service as this is the key identifier type from the point of view of the service providing the Cryptography services. The service can be completely provided by the present library or partially in case of a multi-client service. As a consequence rename as well: . MBEDTLS_PSA_CRYPTO_KEY_FILE_ID_ENCODES_OWNER to MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER . PSA_KEY_ID_INIT to MBEDTLS_SVC_KEY_ID_INIT . PSA_KEY_FILE_GET_KEY_ID to MBEDTLS_SVC_KEY_ID_GET_KEY_ID . psa_key_file_id_make to mbedtls_svc_key_id_make Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-28 19:01:50 +02:00
mbedtls_svc_key_id_t key_id = mbedtls_svc_key_id_make( 1, 42 );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
psa_key_type_t type = (psa_key_type_t) type_arg;
tests: Adapt PSA tests to openless APIs psa_key_handle_equal() is removed as not used anymore. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 14:58:35 +02:00
mbedtls_svc_key_id_t returned_key_id = MBEDTLS_SVC_KEY_ID_INIT;
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
unsigned char *exported = NULL;
size_t export_size = data->len;
size_t exported_length;
Update persistent_key_load_key_from_storage to use attributes Update persistent_key_load_key_from_storage to the new attribute-based key creation interface. I tweaked the code a little to make it simpler and more robust without changing the core logic.
2019-04-19 14:06:53 +02:00
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
ASSERT_ALLOC( exported, export_size );
Use PSA_ASSERT(a) in preference to TEST_ASSERT(a==PSA_SUCCESS) This commit is the result of the following command, followed by reindenting (but not wrapping lines): perl -00 -i -pe 's/^( *)TEST_ASSERT\(([^;=]*)(?: |\n *)==\s*PSA_SUCCESS\s*\);$/${1}PSA_ASSERT($2 );/gm' tests/suites/test_suite_psa_*.function
2018-12-18 00:18:46 +01:00
PSA_ASSERT( psa_crypto_init( ) );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
Replace psa_make_key_persistent by id/lifetime setters in tests Remove all internal uses of psa_make_key_persistent.
2019-05-15 16:12:22 +02:00
psa_set_key_id( &attributes, key_id );
Update persistent_key_load_key_from_storage to use attributes Update persistent_key_load_key_from_storage to the new attribute-based key creation interface. I tweaked the code a little to make it simpler and more robust without changing the core logic.
2019-04-19 14:06:53 +02:00
psa_set_key_type( &attributes, type );
psa_set_key_usage_flags( &attributes, PSA_KEY_USAGE_EXPORT );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
/* Import the key */
tests: Adapt PSA tests to openless APIs psa_key_handle_equal() is removed as not used anymore. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 14:58:35 +02:00
PSA_ASSERT( psa_import_key( &attributes, data->x, data->len,
&returned_key_id ) );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
Persistent key gray-box tests: add test cases with restart Also test the behavior if the crypto subsystem is restarted after creating the persistent key.
2019-04-19 15:40:00 +02:00
if( restart )
{
tests: Adapt PSA tests to openless APIs psa_key_handle_equal() is removed as not used anymore. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 14:58:35 +02:00
PSA_ASSERT( psa_purge_key( key_id ) );
Replace all calls to mbedtls_psa_crypto_free by PSA_DONE Replace all calls to mbedtls_psa_crypto_free in tests by PSA_DONE. This is correct for most tests, because most tests close open keys. A few tests now fail; these tests need to be reviewed and switched back to mbedtls_psa_crypto_free if they genuinely expected to end with some slots still in use.
2019-05-28 15:10:21 +02:00
PSA_DONE();
Persistent key gray-box tests: add test cases with restart Also test the behavior if the crypto subsystem is restarted after creating the persistent key.
2019-04-19 15:40:00 +02:00
PSA_ASSERT( psa_crypto_init() );
}
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
/* Test the key information */
Update persistent_key_load_key_from_storage to use attributes Update persistent_key_load_key_from_storage to the new attribute-based key creation interface. I tweaked the code a little to make it simpler and more robust without changing the core logic.
2019-04-19 14:06:53 +02:00
psa_reset_key_attributes( &attributes );
tests: Adapt PSA tests to openless APIs psa_key_handle_equal() is removed as not used anymore. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 14:58:35 +02:00
PSA_ASSERT( psa_get_key_attributes( key_id, &attributes ) );
Fix PSA code and unit tests Fix PSA code and unit tests for the unit tests to pass with key identifiers encoding owner identifiers. The changes in PSA code just make the enablement of key identifiers encoding owner identifiers platform independent. Previous to this commit, such key identifiers were used only in the case of PSA SPM platforms. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-07-23 17:13:42 +02:00
TEST_ASSERT( mbedtls_svc_key_id_equal(
psa_get_key_id( &attributes ), key_id ) );
Update persistent_key_load_key_from_storage to use attributes Update persistent_key_load_key_from_storage to the new attribute-based key creation interface. I tweaked the code a little to make it simpler and more robust without changing the core logic.
2019-04-19 14:06:53 +02:00
TEST_EQUAL( psa_get_key_lifetime( &attributes ),
PSA_KEY_LIFETIME_PERSISTENT );
TEST_EQUAL( psa_get_key_type( &attributes ), type );
TEST_EQUAL( psa_get_key_bits( &attributes ), (size_t) expected_bits );
TEST_EQUAL( psa_get_key_usage_flags( &attributes ), PSA_KEY_USAGE_EXPORT );
TEST_EQUAL( psa_get_key_algorithm( &attributes ), 0 );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
Use TEST_EQUAL(a,b) in preference to TEST_ASSERT(a==b) This commit is the result of the following command, followed by reindenting (but not wrapping lines): perl -00 -i -pe 's/^( *)TEST_ASSERT\(([^;=]*)(?: |\n *)==([^;=]*)\);$/${1}TEST_EQUAL($2,$3);/gm' tests/suites/test_suite_psa_*.function
2018-12-18 00:24:04 +01:00
TEST_EQUAL( psa_is_key_present_in_storage( key_id ), 1 );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
if( key_not_exist )
{
Convert the PSA crypto persistent storage tests to the new handle API Switch from the direct use of slot numbers to handles allocated by psa_allocate_key. The general principle for each function is: * Change `psa_key_slot_t slot` to `psa_key_handle_t handle` or `psa_key_id_t key_id` depending on whether it's used as a handle to an open slot or as a persistent name for a key. * Call psa_create_key() before using a slot, instead of calling psa_set_key_lifetime to make a slot persistent. Remove the unit test persistent_key_is_configurable which is no longer relevant.
2018-12-03 17:05:18 +01:00
psa_destroy_persistent_key( key_id );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
}
/* Export the key */
tests: Adapt PSA tests to openless APIs psa_key_handle_equal() is removed as not used anymore. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 14:58:35 +02:00
PSA_ASSERT( psa_export_key( key_id, exported, export_size,
Use PSA_ASSERT(a) in preference to TEST_ASSERT(a==PSA_SUCCESS) This commit is the result of the following command, followed by reindenting (but not wrapping lines): perl -00 -i -pe 's/^( *)TEST_ASSERT\(([^;=]*)(?: |\n *)==\s*PSA_SUCCESS\s*\);$/${1}PSA_ASSERT($2 );/gm' tests/suites/test_suite_psa_*.function
2018-12-18 00:18:46 +01:00
&exported_length ) );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
ASSERT_COMPARE( data->x, data->len, exported, exported_length );
/* Destroy the key */
tests: Adapt PSA tests to openless APIs psa_key_handle_equal() is removed as not used anymore. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-08-04 14:58:35 +02:00
PSA_ASSERT( psa_destroy_key( key_id ) );
Use TEST_EQUAL(a,b) in preference to TEST_ASSERT(a==b) This commit is the result of the following command, followed by reindenting (but not wrapping lines): perl -00 -i -pe 's/^( *)TEST_ASSERT\(([^;=]*)(?: |\n *)==([^;=]*)\);$/${1}TEST_EQUAL($2,$3);/gm' tests/suites/test_suite_psa_*.function
2018-12-18 00:24:04 +01:00
TEST_EQUAL( psa_is_key_present_in_storage( key_id ), 0 );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
exit:
tests: psa: Reset key attributes where needed After a call to psa_get_key_attributes() to retrieve the attributes of a key into a psa_key_attributes_t structure, a call to psa_reset_key_attributes() is mandated to free the resources that may be referenced by the psa_key_attributes_t structure. Not calling psa_reset_key_attributes() may result in a memory leak. When a test function calls psa_get_key_parameters() the associated key attributes are systematically reset in the clean-up part of the function with a comment to emphasize the need for the reset and make it more visible. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-19 17:55:23 +01:00
/*
* Key attributes may have been returned by psa_get_key_attributes()
* thus reset them as required.
*/
Call psa_reset_key_attributes after psa_get_key_attributes After calling psa_get_key_attributes(), call psa_reset_key_attributes() if the key may have domain parameters, because that's the way to free the domain parameter substructure in the attribute structure. Keep not calling reset() in some places where the key can only be a symmetric key which doesn't have domain parameters.
2019-04-26 16:03:33 +02:00
psa_reset_key_attributes( &attributes );
tests: psa: Reset key attributes where needed After a call to psa_get_key_attributes() to retrieve the attributes of a key into a psa_key_attributes_t structure, a call to psa_reset_key_attributes() is mandated to free the resources that may be referenced by the psa_key_attributes_t structure. Not calling psa_reset_key_attributes() may result in a memory leak. When a test function calls psa_get_key_parameters() the associated key attributes are systematically reset in the clean-up part of the function with a comment to emphasize the need for the reset and make it more visible. Signed-off-by: Ronald Cron <ronald.cron@arm.com>
2020-11-19 17:55:23 +01:00
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
mbedtls_free( exported );
Replace all calls to mbedtls_psa_crypto_free by PSA_DONE Replace all calls to mbedtls_psa_crypto_free in tests by PSA_DONE. This is correct for most tests, because most tests close open keys. A few tests now fail; these tests need to be reviewed and switched back to mbedtls_psa_crypto_free if they genuinely expected to end with some slots still in use.
2019-05-28 15:10:21 +02:00
PSA_DONE( );
Convert the PSA crypto persistent storage tests to the new handle API Switch from the direct use of slot numbers to handles allocated by psa_allocate_key. The general principle for each function is: * Change `psa_key_slot_t slot` to `psa_key_handle_t handle` or `psa_key_id_t key_id` depending on whether it's used as a handle to an open slot or as a persistent name for a key. * Call psa_create_key() before using a slot, instead of calling psa_set_key_lifetime to make a slot persistent. Remove the unit test persistent_key_is_configurable which is no longer relevant.
2018-12-03 17:05:18 +01:00
psa_destroy_persistent_key( key_id );
psa: Implement persistent keys Allow use of persistent keys, including configuring them, importing and exporting them, and destroying them. When getting a slot using psa_get_key_slot, there are 3 scenarios that can occur if the keys lifetime is persistent: 1. Key type is PSA_KEY_TYPE_NONE, no persistent storage entry: - The key slot is treated as a standard empty key slot 2. Key type is PSA_KEY_TYPE_NONE, persistent storage entry exists: - Attempt to load the key from persistent storage 3. Key type is not PSA_KEY_TYPE_NONE: - As checking persistent storage on every use of the key could be expensive, the persistent key is assumed to be saved in persistent storage, the in-memory key is continued to be used.
2018-06-18 18:27:26 +02:00
}
/* END_CASE */
Add negative tests for psa_destroy_key Test a non-existent key identifier in a valid range. Test identifiers outside the valid range. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
2021-04-21 20:09:23 +02:00
/* BEGIN_CASE */
void destroy_nonexistent( int id_arg, int expected_status_arg )
{
mbedtls_svc_key_id_t id = mbedtls_svc_key_id_make( 1, id_arg );
psa_status_t expected_status = expected_status_arg;
PSA_INIT( );
TEST_EQUAL( expected_status, psa_destroy_key( id ) );
exit:
PSA_DONE( );
}
/* END_CASE */
Reference in a new issue Copy permalink