diff --git a/tests/suites/test_suite_psa_crypto_slot_management.function b/tests/suites/test_suite_psa_crypto_slot_management.function index b4f2d234e..2137aba22 100644 --- a/tests/suites/test_suite_psa_crypto_slot_management.function +++ b/tests/suites/test_suite_psa_crypto_slot_management.function @@ -90,8 +90,10 @@ static int invalidate_psa(invalidate_method_t invalidate_method) break; } - PSA_ASSERT(psa_crypto_init()); + /* When AES_C is not defined CTR_DRBG relies on PSA to get AES-ECB so it + * holds an open key once psa_crypto_init() is called. */ ASSERT_PSA_PRISTINE(); + PSA_ASSERT(psa_crypto_init()); return 1; exit: @@ -746,19 +748,12 @@ void invalid_handle(int handle_construction, * MBEDTLS_SVC_KEY_ID_GET_KEY_ID( valid_handle ) is a volatile * key identifier as the imported key is a volatile key. Volatile * key identifiers are in the range from PSA_KEY_ID_VOLATILE_MIN - * to PSA_KEY_ID_VOLATILE_MAX included. Thus pick a key identifier - * in the range from PSA_KEY_ID_VOLATILE_MIN to - * PSA_KEY_ID_VOLATILE_MAX different from - * MBEDTLS_SVC_KEY_ID_GET_KEY_ID( valid_handle ) to build an - * unopened and thus invalid identifier. + * to PSA_KEY_ID_VOLATILE_MAX included. It is very unlikely that + * all IDs are used up to the last one, so pick + * PSA_KEY_ID_VOLATILE_MAX to build an unopened and thus invalid + * identifier. */ - - if (MBEDTLS_SVC_KEY_ID_GET_KEY_ID(valid_handle) == - PSA_KEY_ID_VOLATILE_MIN) { - key_id = PSA_KEY_ID_VOLATILE_MIN + 1; - } else { - key_id = MBEDTLS_SVC_KEY_ID_GET_KEY_ID(valid_handle) - 1; - } + key_id = PSA_KEY_ID_VOLATILE_MAX; invalid_handle = mbedtls_svc_key_id_make(0, key_id); @@ -938,11 +933,16 @@ void non_reusable_key_slots_integrity_in_case_of_key_slot_starvation() mbedtls_svc_key_id_t persistent_key2 = MBEDTLS_SVC_KEY_ID_INIT; mbedtls_svc_key_id_t returned_key_id = MBEDTLS_SVC_KEY_ID_INIT; mbedtls_svc_key_id_t *keys = NULL; + mbedtls_psa_stats_t psa_key_slots_stats; + size_t available_key_slots = 0; TEST_ASSERT(MBEDTLS_PSA_KEY_SLOT_COUNT >= 1); - TEST_CALLOC(keys, MBEDTLS_PSA_KEY_SLOT_COUNT); PSA_ASSERT(psa_crypto_init()); + mbedtls_psa_get_stats(&psa_key_slots_stats); + available_key_slots = psa_key_slots_stats.empty_slots; + + TEST_CALLOC(keys, available_key_slots); psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_COPY); @@ -961,10 +961,10 @@ void non_reusable_key_slots_integrity_in_case_of_key_slot_starvation() TEST_ASSERT(mbedtls_svc_key_id_equal(returned_key_id, persistent_key)); /* - * Create MBEDTLS_PSA_KEY_SLOT_COUNT volatile keys + * Create the maximum available number of volatile keys */ psa_set_key_lifetime(&attributes, PSA_KEY_LIFETIME_VOLATILE); - for (i = 0; i < MBEDTLS_PSA_KEY_SLOT_COUNT; i++) { + for (i = 0; i < available_key_slots; i++) { PSA_ASSERT(psa_import_key(&attributes, (uint8_t *) &i, sizeof(i), &keys[i])); @@ -983,12 +983,12 @@ void non_reusable_key_slots_integrity_in_case_of_key_slot_starvation() * Check we can export the volatile key created last and that it has the * expected value. Then, destroy it. */ - PSA_ASSERT(psa_export_key(keys[MBEDTLS_PSA_KEY_SLOT_COUNT - 1], + PSA_ASSERT(psa_export_key(keys[available_key_slots - 1], exported, sizeof(exported), &exported_length)); - i = MBEDTLS_PSA_KEY_SLOT_COUNT - 1; + i = available_key_slots - 1; TEST_MEMORY_COMPARE(exported, exported_length, (uint8_t *) &i, sizeof(i)); - PSA_ASSERT(psa_destroy_key(keys[MBEDTLS_PSA_KEY_SLOT_COUNT - 1])); + PSA_ASSERT(psa_destroy_key(keys[available_key_slots - 1])); /* * Check that we can now access the persistent key again. @@ -1011,7 +1011,7 @@ void non_reusable_key_slots_integrity_in_case_of_key_slot_starvation() * Check we can export the remaining volatile keys and that they have the * expected values. */ - for (i = 0; i < (MBEDTLS_PSA_KEY_SLOT_COUNT - 1); i++) { + for (i = 0; i < (available_key_slots - 1); i++) { PSA_ASSERT(psa_export_key(keys[i], exported, sizeof(exported), &exported_length));