Merge pull request #3492 from stevew817/rework/key_slot_contains_key_buffer
Rework PSA Crypto core to store keys in export representation
This commit is contained in:
commit
67a85d1d3b
5 changed files with 781 additions and 399 deletions
3
ChangeLog.d/psa_curve25519_public_key_import.txt
Normal file
3
ChangeLog.d/psa_curve25519_public_key_import.txt
Normal file
|
@ -0,0 +1,3 @@
|
||||||
|
Bugfix
|
||||||
|
* PSA key import will now correctly import a Curve25519/Curve448 public key
|
||||||
|
instead of erroring out. Contributed by Steven Cooreman in #3492.
|
1126
library/psa_crypto.c
1126
library/psa_crypto.c
File diff suppressed because it is too large
Load diff
|
@ -32,9 +32,6 @@
|
||||||
#include "psa/crypto.h"
|
#include "psa/crypto.h"
|
||||||
#include "psa/crypto_se_driver.h"
|
#include "psa/crypto_se_driver.h"
|
||||||
|
|
||||||
#include "mbedtls/ecp.h"
|
|
||||||
#include "mbedtls/rsa.h"
|
|
||||||
|
|
||||||
/** The data structure representing a key slot, containing key material
|
/** The data structure representing a key slot, containing key material
|
||||||
* and metadata for one key.
|
* and metadata for one key.
|
||||||
*/
|
*/
|
||||||
|
@ -43,20 +40,13 @@ typedef struct
|
||||||
psa_core_key_attributes_t attr;
|
psa_core_key_attributes_t attr;
|
||||||
union
|
union
|
||||||
{
|
{
|
||||||
/* Raw-data key (key_type_is_raw_bytes() in psa_crypto.c) */
|
/* Dynamically allocated key data buffer.
|
||||||
struct raw_data
|
* Format as specified in psa_export_key(). */
|
||||||
|
struct key_data
|
||||||
{
|
{
|
||||||
uint8_t *data;
|
uint8_t *data;
|
||||||
size_t bytes;
|
size_t bytes;
|
||||||
} raw;
|
} key;
|
||||||
#if defined(MBEDTLS_RSA_C)
|
|
||||||
/* RSA public key or key pair */
|
|
||||||
mbedtls_rsa_context *rsa;
|
|
||||||
#endif /* MBEDTLS_RSA_C */
|
|
||||||
#if defined(MBEDTLS_ECP_C)
|
|
||||||
/* EC public key or key pair */
|
|
||||||
mbedtls_ecp_keypair *ecp;
|
|
||||||
#endif /* MBEDTLS_ECP_C */
|
|
||||||
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
|
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
|
||||||
/* Any key type in a secure element */
|
/* Any key type in a secure element */
|
||||||
struct se
|
struct se
|
||||||
|
|
|
@ -252,6 +252,10 @@ PSA import/export EC brainpoolP256r1 public key: good
|
||||||
depends_on:MBEDTLS_PK_PARSE_C:MBEDTLS_PK_WRITE_C:MBEDTLS_ECP_C:MBEDTLS_ECP_DP_BP256R1_ENABLED
|
depends_on:MBEDTLS_PK_PARSE_C:MBEDTLS_PK_WRITE_C:MBEDTLS_ECP_C:MBEDTLS_ECP_DP_BP256R1_ENABLED
|
||||||
import_export:"04768c8cae4abca6306db0ed81b0c4a6215c378066ec6d616c146e13f1c7df809b96ab6911c27d8a02339f0926840e55236d3d1efbe2669d090e4c4c660fada91d":PSA_KEY_TYPE_ECC_PUBLIC_KEY(PSA_ECC_FAMILY_BRAINPOOL_P_R1):PSA_KEY_USAGE_EXPORT:PSA_ALG_ECDSA_ANY:256:0:PSA_SUCCESS:1
|
import_export:"04768c8cae4abca6306db0ed81b0c4a6215c378066ec6d616c146e13f1c7df809b96ab6911c27d8a02339f0926840e55236d3d1efbe2669d090e4c4c660fada91d":PSA_KEY_TYPE_ECC_PUBLIC_KEY(PSA_ECC_FAMILY_BRAINPOOL_P_R1):PSA_KEY_USAGE_EXPORT:PSA_ALG_ECDSA_ANY:256:0:PSA_SUCCESS:1
|
||||||
|
|
||||||
|
PSA import/export curve25519 public key: good
|
||||||
|
depends_on:MBEDTLS_PK_PARSE_C:MBEDTLS_PK_WRITE_C:MBEDTLS_ECP_C:MBEDTLS_ECP_DP_CURVE25519_ENABLED
|
||||||
|
import_export:"8520f0098930a754748b7ddcb43ef75a0dbf3a0d26381af4eba4a98eaa9b4e6a":PSA_KEY_TYPE_ECC_PUBLIC_KEY(PSA_ECC_FAMILY_MONTGOMERY):PSA_KEY_USAGE_EXPORT:PSA_ALG_ECDH:255:0:PSA_SUCCESS:1
|
||||||
|
|
||||||
PSA import/export AES key: policy forbids export
|
PSA import/export AES key: policy forbids export
|
||||||
depends_on:MBEDTLS_AES_C:MBEDTLS_CIPHER_MODE_CTR
|
depends_on:MBEDTLS_AES_C:MBEDTLS_CIPHER_MODE_CTR
|
||||||
import_export:"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa":PSA_KEY_TYPE_AES:PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT:PSA_ALG_CTR:128:0:PSA_ERROR_NOT_PERMITTED:1
|
import_export:"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa":PSA_KEY_TYPE_AES:PSA_KEY_USAGE_ENCRYPT | PSA_KEY_USAGE_DECRYPT:PSA_ALG_CTR:128:0:PSA_ERROR_NOT_PERMITTED:1
|
||||||
|
@ -2409,6 +2413,10 @@ PSA key agreement setup: ECDH + HKDF-SHA-256: good
|
||||||
depends_on:MBEDTLS_PK_PARSE_C:MBEDTLS_ECP_C:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_ECDH_C:MBEDTLS_SHA256_C
|
depends_on:MBEDTLS_PK_PARSE_C:MBEDTLS_ECP_C:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_ECDH_C:MBEDTLS_SHA256_C
|
||||||
key_agreement_setup:PSA_ALG_KEY_AGREEMENT(PSA_ALG_ECDH, PSA_ALG_HKDF(PSA_ALG_SHA_256)):PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1):"c88f01f510d9ac3f70a292daa2316de544e9aab8afe84049c62a9c57862d1433":"04d12dfb5289c8d4f81208b70270398c342296970a0bccb74c736fc7554494bf6356fbf3ca366cc23e8157854c13c58d6aac23f046ada30f8353e74f33039872ab":PSA_SUCCESS
|
key_agreement_setup:PSA_ALG_KEY_AGREEMENT(PSA_ALG_ECDH, PSA_ALG_HKDF(PSA_ALG_SHA_256)):PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1):"c88f01f510d9ac3f70a292daa2316de544e9aab8afe84049c62a9c57862d1433":"04d12dfb5289c8d4f81208b70270398c342296970a0bccb74c736fc7554494bf6356fbf3ca366cc23e8157854c13c58d6aac23f046ada30f8353e74f33039872ab":PSA_SUCCESS
|
||||||
|
|
||||||
|
PSA key agreement setup: ECDH + HKDF-SHA-256: public key not on curve
|
||||||
|
depends_on:MBEDTLS_PK_PARSE_C:MBEDTLS_ECP_C:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_ECDH_C:MBEDTLS_SHA256_C
|
||||||
|
key_agreement_setup:PSA_ALG_KEY_AGREEMENT(PSA_ALG_ECDH, PSA_ALG_HKDF(PSA_ALG_SHA_256)):PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1):"c88f01f510d9ac3f70a292daa2316de544e9aab8afe84049c62a9c57862d1433":"04d12dfb5289c8d4f81208b70270398c342296970a0bccb74c736fc7554494bf6356fbf3ca366cc23e8157854c13c58d6aac23f046ada30f8353e74f33039872ff":PSA_ERROR_INVALID_ARGUMENT
|
||||||
|
|
||||||
PSA key agreement setup: ECDH + HKDF-SHA-256: public key on different curve
|
PSA key agreement setup: ECDH + HKDF-SHA-256: public key on different curve
|
||||||
depends_on:MBEDTLS_PK_PARSE_C:MBEDTLS_ECP_C:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_ECDH_C:MBEDTLS_SHA256_C
|
depends_on:MBEDTLS_PK_PARSE_C:MBEDTLS_ECP_C:MBEDTLS_ECP_DP_SECP256R1_ENABLED:MBEDTLS_ECP_DP_SECP384R1_ENABLED:MBEDTLS_ECDH_C:MBEDTLS_SHA256_C
|
||||||
key_agreement_setup:PSA_ALG_KEY_AGREEMENT(PSA_ALG_ECDH, PSA_ALG_HKDF(PSA_ALG_SHA_256)):PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1):"c88f01f510d9ac3f70a292daa2316de544e9aab8afe84049c62a9c57862d1433":"04e558dbef53eecde3d3fccfc1aea08a89a987475d12fd950d83cfa41732bc509d0d1ac43a0336def96fda41d0774a3571dcfbec7aacf3196472169e838430367f66eebe3c6e70c416dd5f0c68759dd1fff83fa40142209dff5eaad96db9e6386c":PSA_ERROR_INVALID_ARGUMENT
|
key_agreement_setup:PSA_ALG_KEY_AGREEMENT(PSA_ALG_ECDH, PSA_ALG_HKDF(PSA_ALG_SHA_256)):PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1):"c88f01f510d9ac3f70a292daa2316de544e9aab8afe84049c62a9c57862d1433":"04e558dbef53eecde3d3fccfc1aea08a89a987475d12fd950d83cfa41732bc509d0d1ac43a0336def96fda41d0774a3571dcfbec7aacf3196472169e838430367f66eebe3c6e70c416dd5f0c68759dd1fff83fa40142209dff5eaad96db9e6386c":PSA_ERROR_INVALID_ARGUMENT
|
||||||
|
|
|
@ -961,14 +961,23 @@ static int exported_key_sanity_check( psa_key_type_t type, size_t bits,
|
||||||
#if defined(MBEDTLS_ECP_C)
|
#if defined(MBEDTLS_ECP_C)
|
||||||
if( PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY( type ) )
|
if( PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY( type ) )
|
||||||
{
|
{
|
||||||
/* The representation of an ECC public key is:
|
if( PSA_KEY_TYPE_ECC_GET_FAMILY( type ) == PSA_ECC_FAMILY_MONTGOMERY )
|
||||||
* - The byte 0x04;
|
{
|
||||||
* - `x_P` as a `ceiling(m/8)`-byte string, big-endian;
|
/* The representation of an ECC Montgomery public key is
|
||||||
* - `y_P` as a `ceiling(m/8)`-byte string, big-endian;
|
* the raw compressed point */
|
||||||
* - where m is the bit size associated with the curve.
|
TEST_EQUAL( p + PSA_BITS_TO_BYTES( bits ), end );
|
||||||
*/
|
}
|
||||||
TEST_EQUAL( p + 1 + 2 * PSA_BITS_TO_BYTES( bits ), end );
|
else
|
||||||
TEST_EQUAL( p[0], 4 );
|
{
|
||||||
|
/* The representation of an ECC Weierstrass public key is:
|
||||||
|
* - The byte 0x04;
|
||||||
|
* - `x_P` as a `ceiling(m/8)`-byte string, big-endian;
|
||||||
|
* - `y_P` as a `ceiling(m/8)`-byte string, big-endian;
|
||||||
|
* - where m is the bit size associated with the curve.
|
||||||
|
*/
|
||||||
|
TEST_EQUAL( p + 1 + 2 * PSA_BITS_TO_BYTES( bits ), end );
|
||||||
|
TEST_EQUAL( p[0], 4 );
|
||||||
|
}
|
||||||
}
|
}
|
||||||
else
|
else
|
||||||
#endif /* MBEDTLS_ECP_C */
|
#endif /* MBEDTLS_ECP_C */
|
||||||
|
|
Loading…
Reference in a new issue