mbedtls_pk_import_into_psa: implement and test
Implement mbedtls_pk_import_into_psa for all PK types except RSA_ALT. This covers importing a key pair, importing a public key and importing the public part of a key pair. Test mbedtls_pk_import_into_psa() with the output of mbedtls_pk_get_psa_attributes(). Also unit-test mbedtls_pk_import_into_psa() on its own to get extra coverage, mostly for negative cases. Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
This commit is contained in:
Gilles Peskine
parent
fdb809ef86
commit
fc3d866ad2
5 changed files with 607 additions and 13 deletions
280
library/pk.c
280
library/pk.c
|
|
@ -18,10 +18,8 @@
|
|||
|
||||
#if defined(MBEDTLS_RSA_C)
|
||||
#include "mbedtls/rsa.h"
|
||||
#if defined(MBEDTLS_PKCS1_V21) && !defined(MBEDTLS_USE_PSA_CRYPTO)
|
||||
#include "rsa_internal.h"
|
||||
#endif
|
||||
#endif
|
||||
#if defined(MBEDTLS_PK_HAVE_ECC_KEYS)
|
||||
#include "mbedtls/ecp.h"
|
||||
#endif
|
||||
|
|
@ -579,6 +577,284 @@ int mbedtls_pk_get_psa_attributes(const mbedtls_pk_context *pk,
|
|||
|
||||
return 0;
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_PK_USE_PSA_EC_DATA) || defined(MBEDTLS_USE_PSA_CRYPTO)
|
||||
static psa_status_t export_import_into_psa(mbedtls_svc_key_id_t old_key_id,
|
||||
const psa_key_attributes_t *attributes,
|
||||
mbedtls_svc_key_id_t *new_key_id)
|
||||
{
|
||||
unsigned char key_buffer[PSA_EXPORT_KEY_PAIR_MAX_SIZE];
|
||||
size_t key_length = 0;
|
||||
psa_status_t status = psa_export_key(old_key_id,
|
||||
key_buffer, sizeof(key_buffer),
|
||||
&key_length);
|
||||
if (status != PSA_SUCCESS) {
|
||||
return status;
|
||||
}
|
||||
status = psa_import_key(attributes, key_buffer, key_length, new_key_id);
|
||||
mbedtls_platform_zeroize(key_buffer, key_length);
|
||||
return status;
|
||||
}
|
||||
|
||||
static int copy_into_psa(mbedtls_svc_key_id_t old_key_id,
|
||||
const psa_key_attributes_t *attributes,
|
||||
mbedtls_svc_key_id_t *new_key_id)
|
||||
{
|
||||
/* Normally, we prefer copying: it's more efficient and works even
|
||||
* for non-exportable keys. */
|
||||
psa_status_t status = psa_copy_key(old_key_id, attributes, new_key_id);
|
||||
if (status == PSA_ERROR_NOT_PERMITTED /*missing COPY usage*/ ||
|
||||
status == PSA_ERROR_INVALID_ARGUMENT /*incompatible policy*/) {
|
||||
/* There are edge cases where copying won't work, but export+import
|
||||
* might:
|
||||
* - If the old key does not allow PSA_KEY_USAGE_COPY.
|
||||
* - If the old key's usage does not allow what attributes wants.
|
||||
* Because the key was intended for use in the pk module, and may
|
||||
* have had a policy chosen solely for what pk needs rather than
|
||||
* based on a detailed understanding of PSA policies, we are a bit
|
||||
* more liberal than psa_copy_key() here.
|
||||
*/
|
||||
/* Here we need to check that the types match, otherwise we risk
|
||||
* importing nonsensical data. */
|
||||
psa_key_attributes_t old_attributes = PSA_KEY_ATTRIBUTES_INIT;
|
||||
status = psa_get_key_attributes(old_key_id, &old_attributes);
|
||||
if (status != PSA_SUCCESS) {
|
||||
return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
|
||||
}
|
||||
psa_key_type_t old_type = psa_get_key_type(&old_attributes);
|
||||
psa_reset_key_attributes(&old_attributes);
|
||||
if (old_type != psa_get_key_type(attributes)) {
|
||||
return MBEDTLS_ERR_PK_TYPE_MISMATCH;
|
||||
}
|
||||
status = export_import_into_psa(old_key_id, attributes, new_key_id);
|
||||
}
|
||||
return PSA_PK_TO_MBEDTLS_ERR(status);
|
||||
}
|
||||
#endif /* MBEDTLS_PK_USE_PSA_EC_DATA || MBEDTLS_USE_PSA_CRYPTO */
|
||||
|
||||
static int import_pair_into_psa(const mbedtls_pk_context *pk,
|
||||
const psa_key_attributes_t *attributes,
|
||||
mbedtls_svc_key_id_t *key_id)
|
||||
{
|
||||
switch (mbedtls_pk_get_type(pk)) {
|
||||
#if defined(MBEDTLS_RSA_C)
|
||||
case MBEDTLS_PK_RSA:
|
||||
{
|
||||
if (psa_get_key_type(attributes) != PSA_KEY_TYPE_RSA_KEY_PAIR) {
|
||||
return MBEDTLS_ERR_PK_TYPE_MISMATCH;
|
||||
}
|
||||
unsigned char key_buffer[
|
||||
PSA_KEY_EXPORT_RSA_KEY_PAIR_MAX_SIZE(PSA_VENDOR_RSA_MAX_KEY_BITS)];
|
||||
unsigned char *const key_end = key_buffer + sizeof(key_buffer);
|
||||
unsigned char *key_data = key_end;
|
||||
int ret = mbedtls_rsa_write_key(mbedtls_pk_rsa(*pk),
|
||||
key_buffer, &key_data);
|
||||
if (ret < 0) {
|
||||
return ret;
|
||||
}
|
||||
size_t key_length = key_end - key_data;
|
||||
ret = PSA_PK_TO_MBEDTLS_ERR(psa_import_key(attributes,
|
||||
key_data, key_length,
|
||||
key_id));
|
||||
mbedtls_platform_zeroize(key_data, key_length);
|
||||
return ret;
|
||||
}
|
||||
#endif /* MBEDTLS_RSA_C */
|
||||
|
||||
#if defined(MBEDTLS_PK_HAVE_ECC_KEYS)
|
||||
case MBEDTLS_PK_ECKEY:
|
||||
case MBEDTLS_PK_ECKEY_DH:
|
||||
case MBEDTLS_PK_ECDSA:
|
||||
{
|
||||
/* We need to check the curve family, otherwise the import could
|
||||
* succeed with nonsensical data.
|
||||
* We don't check the bit-size: it's optional in attributes,
|
||||
* and if it's specified, psa_import_key() will know from the key
|
||||
* data length and will check that the bit-size matches. */
|
||||
psa_key_type_t to_type = psa_get_key_type(attributes);
|
||||
#if defined(MBEDTLS_PK_USE_PSA_EC_DATA)
|
||||
psa_ecc_family_t from_family = pk->ec_family;
|
||||
#else /* MBEDTLS_PK_USE_PSA_EC_DATA */
|
||||
/* We're only reading the key, but mbedtls_ecp_write_key()
|
||||
* is missing a const annotation on its key parameter, so
|
||||
* we need the non-const accessor here. */
|
||||
mbedtls_ecp_keypair *ec = mbedtls_pk_ec_rw(*pk);
|
||||
size_t from_bits = 0;
|
||||
psa_ecc_family_t from_family = mbedtls_ecc_group_to_psa(ec->grp.id,
|
||||
&from_bits);
|
||||
#endif /* MBEDTLS_PK_USE_PSA_EC_DATA */
|
||||
if (to_type != PSA_KEY_TYPE_ECC_KEY_PAIR(from_family)) {
|
||||
return MBEDTLS_ERR_PK_TYPE_MISMATCH;
|
||||
}
|
||||
|
||||
#if defined(MBEDTLS_PK_USE_PSA_EC_DATA)
|
||||
if (mbedtls_svc_key_id_is_null(pk->priv_id)) {
|
||||
/* We have a public key and want a key pair. */
|
||||
return MBEDTLS_ERR_PK_TYPE_MISMATCH;
|
||||
}
|
||||
return copy_into_psa(pk->priv_id, attributes, key_id);
|
||||
#else /* MBEDTLS_PK_USE_PSA_EC_DATA */
|
||||
if (ec->d.n == 0) {
|
||||
/* Private key not set. Assume the input is a public key only.
|
||||
* (The other possibility is that it's an incomplete object
|
||||
* where the group is set but neither the public key nor
|
||||
* the private key. This is not possible through ecp.h
|
||||
* functions, so we don't bother reporting a more suitable
|
||||
* error in that case.) */
|
||||
return MBEDTLS_ERR_PK_TYPE_MISMATCH;
|
||||
}
|
||||
unsigned char key_buffer[PSA_BITS_TO_BYTES(PSA_VENDOR_ECC_MAX_CURVE_BITS)];
|
||||
int ret = mbedtls_ecp_write_key(ec,
|
||||
key_buffer, sizeof(key_buffer));
|
||||
if (ret < 0) {
|
||||
return ret;
|
||||
}
|
||||
size_t key_length = PSA_BITS_TO_BYTES(ec->grp.nbits);
|
||||
unsigned char *key_data = key_buffer + sizeof(key_buffer) - key_length;
|
||||
ret = PSA_PK_TO_MBEDTLS_ERR(psa_import_key(attributes,
|
||||
key_data, key_length,
|
||||
key_id));
|
||||
mbedtls_platform_zeroize(key_data, key_length);
|
||||
return ret;
|
||||
#endif /* MBEDTLS_PK_USE_PSA_EC_DATA */
|
||||
}
|
||||
#endif /* MBEDTLS_PK_HAVE_ECC_KEYS */
|
||||
|
||||
#if defined(MBEDTLS_USE_PSA_CRYPTO)
|
||||
case MBEDTLS_PK_OPAQUE:
|
||||
return copy_into_psa(pk->priv_id, attributes, key_id);
|
||||
#endif /* MBEDTLS_USE_PSA_CRYPTO */
|
||||
|
||||
default:
|
||||
return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
|
||||
}
|
||||
}
|
||||
|
||||
static int import_public_into_psa(const mbedtls_pk_context *pk,
|
||||
const psa_key_attributes_t *attributes,
|
||||
mbedtls_svc_key_id_t *key_id)
|
||||
{
|
||||
psa_key_type_t psa_type = psa_get_key_type(attributes);
|
||||
|
||||
#if defined(MBEDTLS_RSA_C) || \
|
||||
(defined(MBEDTLS_PK_HAVE_ECC_KEYS) && !defined(MBEDTLS_PK_USE_PSA_EC_DATA)) || \
|
||||
defined(MBEDTLS_USE_PSA_CRYPTO)
|
||||
unsigned char key_buffer[PSA_EXPORT_PUBLIC_KEY_MAX_SIZE];
|
||||
#endif
|
||||
unsigned char *key_data = NULL;
|
||||
size_t key_length = 0;
|
||||
|
||||
switch (mbedtls_pk_get_type(pk)) {
|
||||
#if defined(MBEDTLS_RSA_C)
|
||||
case MBEDTLS_PK_RSA:
|
||||
{
|
||||
if (psa_type != PSA_KEY_TYPE_RSA_PUBLIC_KEY) {
|
||||
return MBEDTLS_ERR_PK_TYPE_MISMATCH;
|
||||
}
|
||||
unsigned char *const key_end = key_buffer + sizeof(key_buffer);
|
||||
key_data = key_end;
|
||||
int ret = mbedtls_rsa_write_pubkey(mbedtls_pk_rsa(*pk),
|
||||
key_buffer, &key_data);
|
||||
if (ret < 0) {
|
||||
return ret;
|
||||
}
|
||||
key_length = (size_t) ret;
|
||||
break;
|
||||
}
|
||||
#endif /*MBEDTLS_RSA_C */
|
||||
|
||||
#if defined(MBEDTLS_PK_HAVE_ECC_KEYS)
|
||||
case MBEDTLS_PK_ECKEY:
|
||||
case MBEDTLS_PK_ECKEY_DH:
|
||||
case MBEDTLS_PK_ECDSA:
|
||||
{
|
||||
/* We need to check the curve family, otherwise the import could
|
||||
* succeed with nonsensical data.
|
||||
* We don't check the bit-size: it's optional in attributes,
|
||||
* and if it's specified, psa_import_key() will know from the key
|
||||
* data length and will check that the bit-size matches. */
|
||||
#if defined(MBEDTLS_PK_USE_PSA_EC_DATA)
|
||||
if (psa_type != PSA_KEY_TYPE_ECC_PUBLIC_KEY(pk->ec_family)) {
|
||||
return MBEDTLS_ERR_PK_TYPE_MISMATCH;
|
||||
}
|
||||
key_data = (unsigned char *) pk->pub_raw;
|
||||
key_length = pk->pub_raw_len;
|
||||
#else /* MBEDTLS_PK_USE_PSA_EC_DATA */
|
||||
const mbedtls_ecp_keypair *ec = mbedtls_pk_ec_ro(*pk);
|
||||
size_t from_bits = 0;
|
||||
psa_ecc_family_t from_family = mbedtls_ecc_group_to_psa(ec->grp.id,
|
||||
&from_bits);
|
||||
psa_key_type_t to_type = psa_get_key_type(attributes);
|
||||
if (to_type != PSA_KEY_TYPE_ECC_PUBLIC_KEY(from_family)) {
|
||||
return MBEDTLS_ERR_PK_TYPE_MISMATCH;
|
||||
}
|
||||
int ret = mbedtls_ecp_write_public_key(
|
||||
ec, MBEDTLS_ECP_PF_UNCOMPRESSED,
|
||||
&key_length, key_buffer, sizeof(key_buffer));
|
||||
if (ret < 0) {
|
||||
return ret;
|
||||
}
|
||||
key_data = key_buffer;
|
||||
#endif /* MBEDTLS_PK_USE_PSA_EC_DATA */
|
||||
break;
|
||||
}
|
||||
#endif /* MBEDTLS_PK_HAVE_ECC_KEYS */
|
||||
|
||||
#if defined(MBEDTLS_USE_PSA_CRYPTO)
|
||||
case MBEDTLS_PK_OPAQUE:
|
||||
{
|
||||
psa_key_attributes_t old_attributes = PSA_KEY_ATTRIBUTES_INIT;
|
||||
psa_status_t status =
|
||||
psa_get_key_attributes(pk->priv_id, &old_attributes);
|
||||
if (status != PSA_SUCCESS) {
|
||||
return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
|
||||
}
|
||||
psa_key_type_t old_type = psa_get_key_type(&old_attributes);
|
||||
psa_reset_key_attributes(&old_attributes);
|
||||
if (psa_type != PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(old_type)) {
|
||||
return MBEDTLS_ERR_PK_TYPE_MISMATCH;
|
||||
}
|
||||
status = psa_export_public_key(pk->priv_id,
|
||||
key_buffer, sizeof(key_buffer),
|
||||
&key_length);
|
||||
if (status != PSA_SUCCESS) {
|
||||
return PSA_PK_TO_MBEDTLS_ERR(status);
|
||||
}
|
||||
key_data = key_buffer;
|
||||
break;
|
||||
}
|
||||
#endif /* MBEDTLS_USE_PSA_CRYPTO */
|
||||
|
||||
default:
|
||||
return MBEDTLS_ERR_PK_BAD_INPUT_DATA;
|
||||
}
|
||||
|
||||
return PSA_PK_TO_MBEDTLS_ERR(psa_import_key(attributes,
|
||||
key_data, key_length,
|
||||
key_id));
|
||||
}
|
||||
|
||||
int mbedtls_pk_import_into_psa(const mbedtls_pk_context *pk,
|
||||
const psa_key_attributes_t *attributes,
|
||||
mbedtls_svc_key_id_t *key_id)
|
||||
{
|
||||
/* Set the output immediately so that it won't contain garbage even
|
||||
* if we error out before calling psa_import_key(). */
|
||||
*key_id = MBEDTLS_SVC_KEY_ID_INIT;
|
||||
|
||||
#if defined(MBEDTLS_PK_RSA_ALT_SUPPORT)
|
||||
if (mbedtls_pk_get_type(pk) == MBEDTLS_PK_RSA_ALT) {
|
||||
return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE;
|
||||
}
|
||||
#endif /* MBEDTLS_PK_RSA_ALT_SUPPORT */
|
||||
|
||||
int want_public = PSA_KEY_TYPE_IS_PUBLIC_KEY(psa_get_key_type(attributes));
|
||||
if (want_public) {
|
||||
return import_public_into_psa(pk, attributes, key_id);
|
||||
} else {
|
||||
return import_pair_into_psa(pk, attributes, key_id);
|
||||
}
|
||||
}
|
||||
#endif /* MBEDTLS_PSA_CRYPTO_C */
|
||||
|
||||
/*
|
||||
|
|
|
|||
|
|
@ -17,7 +17,7 @@
|
|||
#include "mbedtls/ecp.h"
|
||||
#endif
|
||||
|
||||
#if defined(MBEDTLS_USE_PSA_CRYPTO)
|
||||
#if defined(MBEDTLS_PSA_CRYPTO_CLIENT)
|
||||
#include "psa/crypto.h"
|
||||
|
||||
#include "psa_util_internal.h"
|
||||
|
|
@ -28,7 +28,7 @@
|
|||
#define PSA_PK_ECDSA_TO_MBEDTLS_ERR(status) PSA_TO_MBEDTLS_ERR_LIST(status, \
|
||||
psa_to_pk_ecdsa_errors, \
|
||||
psa_pk_status_to_mbedtls)
|
||||
#endif /* MBEDTLS_USE_PSA_CRYPTO */
|
||||
#endif /* MBEDTLS_PSA_CRYPTO_CLIENT */
|
||||
|
||||
/* Headers/footers for PEM files */
|
||||
#define PEM_BEGIN_PUBLIC_KEY "-----BEGIN PUBLIC KEY-----"
|
||||
|
|
|
|||
|
|
@ -164,6 +164,8 @@ int psa_pk_status_to_mbedtls(psa_status_t status)
|
|||
return MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE;
|
||||
case PSA_ERROR_INVALID_ARGUMENT:
|
||||
return MBEDTLS_ERR_PK_INVALID_ALG;
|
||||
case PSA_ERROR_NOT_PERMITTED:
|
||||
return MBEDTLS_ERR_PK_TYPE_MISMATCH;
|
||||
case PSA_ERROR_INSUFFICIENT_MEMORY:
|
||||
return MBEDTLS_ERR_PK_ALLOC_FAILED;
|
||||
case PSA_ERROR_BAD_STATE:
|
||||
|
|
|
|||
|
|
@ -1004,8 +1004,23 @@ PSA attributes for pk: opaque RSA pair, SIGN|DECRYPT & SIGN_MESSAGE
|
|||
depends_on:MBEDTLS_RSA_C:MBEDTLS_GENPRIME
|
||||
pk_get_psa_attributes_opaque:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_RSA_GEN_KEY_MIN_BITS:PSA_KEY_USAGE_SIGN_MESSAGE | PSA_KEY_USAGE_DECRYPT:PSA_ALG_RSA_PKCS1V15_SIGN_RAW:PSA_KEY_USAGE_SIGN_MESSAGE:0:1:PSA_KEY_USAGE_SIGN_MESSAGE | PSA_KEY_USAGE_DECRYPT
|
||||
|
||||
# For a PK_OPAQUE key with a key pair type output,
|
||||
# mbedtls_pk_import_into_psa() requires the key to be copyable or exportable.
|
||||
# Try all combinations of COPY/not, EXPORT/not.
|
||||
PSA attributes for pk: opaque RSA pair, SIGN|... & SIGN_MESSAGE
|
||||
depends_on:MBEDTLS_RSA_C:MBEDTLS_GENPRIME
|
||||
pk_get_psa_attributes_opaque:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_RSA_GEN_KEY_MIN_BITS:PSA_KEY_USAGE_SIGN_MESSAGE | PSA_KEY_USAGE_VERIFY_MESSAGE | PSA_KEY_USAGE_DECRYPT | PSA_KEY_USAGE_ENCRYPT:PSA_ALG_RSA_PKCS1V15_SIGN_RAW:PSA_KEY_USAGE_SIGN_MESSAGE:0:1:PSA_KEY_USAGE_SIGN_MESSAGE | PSA_KEY_USAGE_VERIFY_MESSAGE | PSA_KEY_USAGE_DECRYPT | PSA_KEY_USAGE_ENCRYPT
|
||||
|
||||
PSA attributes for pk: opaque RSA pair, SIGN|EXPORT|... & SIGN_MESSAGE
|
||||
depends_on:MBEDTLS_RSA_C:MBEDTLS_GENPRIME
|
||||
pk_get_psa_attributes_opaque:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_RSA_GEN_KEY_MIN_BITS:PSA_KEY_USAGE_SIGN_MESSAGE | PSA_KEY_USAGE_VERIFY_MESSAGE | PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_DECRYPT | PSA_KEY_USAGE_ENCRYPT:PSA_ALG_RSA_PKCS1V15_SIGN_RAW:PSA_KEY_USAGE_SIGN_MESSAGE:0:1:PSA_KEY_USAGE_SIGN_MESSAGE | PSA_KEY_USAGE_VERIFY_MESSAGE | PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_DECRYPT | PSA_KEY_USAGE_ENCRYPT
|
||||
|
||||
PSA attributes for pk: opaque RSA pair, SIGN|COPY|... & SIGN_MESSAGE
|
||||
depends_on:MBEDTLS_RSA_C:MBEDTLS_GENPRIME
|
||||
pk_get_psa_attributes_opaque:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_RSA_GEN_KEY_MIN_BITS:PSA_KEY_USAGE_SIGN_MESSAGE | PSA_KEY_USAGE_VERIFY_MESSAGE | PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_DECRYPT | PSA_KEY_USAGE_ENCRYPT:PSA_ALG_RSA_PKCS1V15_SIGN_RAW:PSA_KEY_USAGE_SIGN_MESSAGE:0:1:PSA_KEY_USAGE_SIGN_MESSAGE | PSA_KEY_USAGE_VERIFY_MESSAGE | PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_DECRYPT | PSA_KEY_USAGE_ENCRYPT
|
||||
|
||||
PSA attributes for pk: opaque RSA pair, SIGN|COPY|EXPORT... & SIGN_MESSAGE
|
||||
depends_on:MBEDTLS_RSA_C:MBEDTLS_GENPRIME
|
||||
pk_get_psa_attributes_opaque:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_RSA_GEN_KEY_MIN_BITS:PSA_KEY_USAGE_SIGN_MESSAGE | PSA_KEY_USAGE_VERIFY_MESSAGE | PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_DECRYPT | PSA_KEY_USAGE_ENCRYPT:PSA_ALG_RSA_PKCS1V15_SIGN_RAW:PSA_KEY_USAGE_SIGN_MESSAGE:0:1:PSA_KEY_USAGE_SIGN_MESSAGE | PSA_KEY_USAGE_VERIFY_MESSAGE | PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_DECRYPT | PSA_KEY_USAGE_ENCRYPT
|
||||
|
||||
PSA attributes for pk: opaque RSA pair, SIGN_MESSAGE & SIGN_HASH (bad policy)
|
||||
|
|
@ -1109,3 +1124,173 @@ pk_get_psa_attributes_opaque:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1):2
|
|||
PSA attributes for pk: opaque ECC pair->public, ENCRYPT & ENCRYPT (bad)
|
||||
depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE:PSA_WANT_ECC_SECP_R1_256
|
||||
pk_get_psa_attributes_opaque:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1):256:PSA_KEY_USAGE_ENCRYPT:PSA_ALG_ECDSA_ANY:PSA_KEY_USAGE_ENCRYPT:MBEDTLS_ERR_PK_TYPE_MISMATCH:0:0
|
||||
|
||||
PSA import into PSA: RSA pair to ECC (bad)
|
||||
depends_on:MBEDTLS_RSA_C:MBEDTLS_GENPRIME
|
||||
pk_import_into_psa_fail:MBEDTLS_PK_RSA:1:PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1):MBEDTLS_ERR_PK_TYPE_MISMATCH
|
||||
|
||||
PSA import into PSA: RSA public to RSA pair (bad)
|
||||
depends_on:MBEDTLS_RSA_C:MBEDTLS_GENPRIME
|
||||
pk_import_into_psa_fail:MBEDTLS_PK_RSA:0:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_ERR_RSA_BAD_INPUT_DATA
|
||||
|
||||
PSA import into PSA: ECKEY pair to RSA (bad)
|
||||
depends_on:MBEDTLS_PK_HAVE_ECC_KEYS:MBEDTLS_TEST_PSA_ECC_AT_LEAST_ONE_CURVE
|
||||
pk_import_into_psa_fail:MBEDTLS_PK_ECKEY:1:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_ERR_PK_TYPE_MISMATCH
|
||||
|
||||
PSA import into PSA: ECKEY_DH pair to RSA (bad)
|
||||
depends_on:MBEDTLS_PK_HAVE_ECC_KEYS:MBEDTLS_TEST_PSA_ECC_AT_LEAST_ONE_CURVE
|
||||
pk_import_into_psa_fail:MBEDTLS_PK_ECKEY_DH:1:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_ERR_PK_TYPE_MISMATCH
|
||||
|
||||
PSA import into PSA: ECDSA pair to RSA (bad)
|
||||
depends_on:MBEDTLS_PK_HAVE_ECC_KEYS:MBEDTLS_TEST_PSA_ECC_AT_LEAST_ONE_CURVE:MBEDTLS_PK_CAN_ECDSA_SOME
|
||||
pk_import_into_psa_fail:MBEDTLS_PK_ECDSA:1:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_ERR_PK_TYPE_MISMATCH
|
||||
|
||||
PSA import into PSA: ECKEY public to pair (bad)
|
||||
depends_on:MBEDTLS_PK_HAVE_ECC_KEYS:MBEDTLS_TEST_PSA_ECC_AT_LEAST_ONE_CURVE
|
||||
pk_import_into_psa_fail:MBEDTLS_PK_ECKEY:0:PSA_KEY_TYPE_ECC_KEY_PAIR(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY):MBEDTLS_ERR_PK_TYPE_MISMATCH
|
||||
|
||||
PSA import into PSA: ECKEY_DH public to pair (bad)
|
||||
depends_on:MBEDTLS_PK_HAVE_ECC_KEYS:MBEDTLS_TEST_PSA_ECC_AT_LEAST_ONE_CURVE
|
||||
pk_import_into_psa_fail:MBEDTLS_PK_ECKEY_DH:0:PSA_KEY_TYPE_ECC_KEY_PAIR(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY):MBEDTLS_ERR_PK_TYPE_MISMATCH
|
||||
|
||||
PSA import into PSA: ECDSA public to pair (bad)
|
||||
depends_on:MBEDTLS_PK_HAVE_ECC_KEYS:MBEDTLS_TEST_PSA_ECC_AT_LEAST_ONE_CURVE:MBEDTLS_PK_CAN_ECDSA_SOME
|
||||
pk_import_into_psa_fail:MBEDTLS_PK_ECDSA:0:PSA_KEY_TYPE_ECC_KEY_PAIR(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY):MBEDTLS_ERR_PK_TYPE_MISMATCH
|
||||
|
||||
PSA import into PSA: opaque RSA, COPY (ok)
|
||||
depends_on:PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE:PSA_WANT_ALG_RSA_PKCS1V15_SIGN
|
||||
pk_import_into_psa_opaque:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_RSA_GEN_KEY_MIN_BITS:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_RSA_PKCS1V15_SIGN_RAW:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_RSA_GEN_KEY_MIN_BITS:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_RSA_PKCS1V15_SIGN_RAW:0
|
||||
|
||||
PSA import into PSA: opaque RSA, EXPORT (ok)
|
||||
depends_on:PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE:PSA_WANT_ALG_RSA_PKCS1V15_SIGN
|
||||
pk_import_into_psa_opaque:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_RSA_GEN_KEY_MIN_BITS:PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_RSA_PKCS1V15_SIGN_RAW:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_RSA_GEN_KEY_MIN_BITS:PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_RSA_PKCS1V15_SIGN_RAW:0
|
||||
|
||||
PSA import into PSA: opaque RSA, no COPY/EXPORT (bad)
|
||||
depends_on:PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE:PSA_WANT_ALG_RSA_PKCS1V15_SIGN
|
||||
pk_import_into_psa_opaque:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_RSA_GEN_KEY_MIN_BITS:PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_RSA_PKCS1V15_SIGN_RAW:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_RSA_GEN_KEY_MIN_BITS:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_RSA_PKCS1V15_SIGN_RAW:MBEDTLS_ERR_PK_TYPE_MISMATCH
|
||||
|
||||
# Detail that isn't precisely documented: since this copies the key,
|
||||
# the new key has the intersection of the usage flags.
|
||||
PSA import into PSA: opaque RSA, COPY|EXPORT, different usage (restricted)
|
||||
depends_on:PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE:PSA_WANT_ALG_RSA_PKCS1V15_SIGN
|
||||
pk_import_into_psa_opaque:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_RSA_GEN_KEY_MIN_BITS:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_RSA_PKCS1V15_SIGN_RAW:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_RSA_GEN_KEY_MIN_BITS:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_RSA_PKCS1V15_SIGN_RAW:0
|
||||
|
||||
# Detail that isn't precisely documented: since this copies the key,
|
||||
# the new key has the intersection of the usage flags.
|
||||
PSA import into PSA: opaque RSA, COPY, different usage (restricted)
|
||||
depends_on:PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE:PSA_WANT_ALG_RSA_PKCS1V15_SIGN
|
||||
pk_import_into_psa_opaque:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_RSA_GEN_KEY_MIN_BITS:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_RSA_PKCS1V15_SIGN_RAW:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_RSA_GEN_KEY_MIN_BITS:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_RSA_PKCS1V15_SIGN_RAW:0
|
||||
|
||||
# Detail that isn't precisely documented: since this exports the key,
|
||||
# the new key has all the requested usage flags.
|
||||
PSA import into PSA: opaque RSA, EXPORT, different usage (ok)
|
||||
depends_on:PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE:PSA_WANT_ALG_RSA_PKCS1V15_SIGN
|
||||
pk_import_into_psa_opaque:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_RSA_GEN_KEY_MIN_BITS:PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_RSA_PKCS1V15_SIGN_RAW:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_RSA_GEN_KEY_MIN_BITS:PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_RSA_PKCS1V15_SIGN_RAW:0
|
||||
|
||||
PSA import into PSA: opaque RSA, COPY|EXPORT, different algorithm (ok)
|
||||
depends_on:PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE:PSA_WANT_ALG_RSA_PKCS1V15_SIGN
|
||||
pk_import_into_psa_opaque:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_RSA_GEN_KEY_MIN_BITS:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_RSA_PKCS1V15_SIGN_RAW:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_RSA_GEN_KEY_MIN_BITS:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_SHA_256):0
|
||||
|
||||
PSA import into PSA: opaque RSA, COPY, different algorithm (bad)
|
||||
depends_on:PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE:PSA_WANT_ALG_RSA_PKCS1V15_SIGN
|
||||
pk_import_into_psa_opaque:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_RSA_GEN_KEY_MIN_BITS:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_RSA_PKCS1V15_SIGN_RAW:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_RSA_GEN_KEY_MIN_BITS:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_SHA_256):MBEDTLS_ERR_PK_TYPE_MISMATCH
|
||||
|
||||
PSA import into PSA: opaque RSA, EXPORT, different algorithm (ok)
|
||||
depends_on:PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE:PSA_WANT_ALG_RSA_PKCS1V15_SIGN
|
||||
pk_import_into_psa_opaque:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_RSA_GEN_KEY_MIN_BITS:PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_RSA_PKCS1V15_SIGN_RAW:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_RSA_GEN_KEY_MIN_BITS:PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_SHA_256):0
|
||||
|
||||
PSA import into PSA: opaque RSA, implicit bits (ok)
|
||||
depends_on:PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE:PSA_WANT_ALG_RSA_PKCS1V15_SIGN
|
||||
pk_import_into_psa_opaque:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_RSA_GEN_KEY_MIN_BITS:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_RSA_PKCS1V15_SIGN_RAW:PSA_KEY_TYPE_RSA_KEY_PAIR:0:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_RSA_PKCS1V15_SIGN_RAW:0
|
||||
|
||||
PSA import into PSA: opaque RSA, different bits (bad)
|
||||
depends_on:PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE:PSA_WANT_ALG_RSA_PKCS1V15_SIGN
|
||||
pk_import_into_psa_opaque:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_RSA_GEN_KEY_MIN_BITS:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_RSA_PKCS1V15_SIGN_RAW:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_RSA_GEN_KEY_MIN_BITS + 8:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_RSA_PKCS1V15_SIGN_RAW:MBEDTLS_ERR_PK_TYPE_MISMATCH
|
||||
|
||||
PSA import into PSA: opaque RSA, different type (bad)
|
||||
depends_on:PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE:PSA_WANT_ALG_RSA_PKCS1V15_SIGN
|
||||
pk_import_into_psa_opaque:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_RSA_GEN_KEY_MIN_BITS:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:0:PSA_KEY_TYPE_HMAC:MBEDTLS_RSA_GEN_KEY_MIN_BITS:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:0:MBEDTLS_ERR_PK_TYPE_MISMATCH
|
||||
|
||||
PSA import into PSA: opaque RSA to public (ok)
|
||||
depends_on:PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE:PSA_WANT_ALG_RSA_PKCS1V15_SIGN
|
||||
pk_import_into_psa_opaque:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_RSA_GEN_KEY_MIN_BITS:PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_RSA_PKCS1V15_SIGN_RAW:PSA_KEY_TYPE_RSA_PUBLIC_KEY:MBEDTLS_RSA_GEN_KEY_MIN_BITS:PSA_KEY_USAGE_VERIFY_HASH | PSA_KEY_USAGE_VERIFY_MESSAGE:PSA_ALG_RSA_PKCS1V15_SIGN_RAW:0
|
||||
|
||||
PSA import into PSA: opaque RSA to public, implicit bits (ok)
|
||||
depends_on:PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE:PSA_WANT_ALG_RSA_PKCS1V15_SIGN
|
||||
pk_import_into_psa_opaque:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_RSA_GEN_KEY_MIN_BITS:PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_RSA_PKCS1V15_SIGN_RAW:PSA_KEY_TYPE_RSA_PUBLIC_KEY:0:PSA_KEY_USAGE_VERIFY_HASH | PSA_KEY_USAGE_VERIFY_MESSAGE:PSA_ALG_RSA_PKCS1V15_SIGN_RAW:0
|
||||
|
||||
# MBEDTLS_ERR_PK_INVALID_ALG is the error that results from our translation
|
||||
# of PSA errors. In this case MBEDTLS_ERR_PK_TYPE_MISMATCH would probably
|
||||
# be more appropriate.
|
||||
PSA import into PSA: opaque RSA to public, different bits (bad)
|
||||
depends_on:PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE:PSA_WANT_ALG_RSA_PKCS1V15_SIGN
|
||||
pk_import_into_psa_opaque:PSA_KEY_TYPE_RSA_KEY_PAIR:MBEDTLS_RSA_GEN_KEY_MIN_BITS:PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_RSA_PKCS1V15_SIGN_RAW:PSA_KEY_TYPE_RSA_PUBLIC_KEY:MBEDTLS_RSA_GEN_KEY_MIN_BITS + 8:PSA_KEY_USAGE_VERIFY_HASH | PSA_KEY_USAGE_VERIFY_MESSAGE:PSA_ALG_RSA_PKCS1V15_SIGN_RAW:MBEDTLS_ERR_PK_INVALID_ALG
|
||||
|
||||
PSA import into PSA: opaque ECC, COPY (ok)
|
||||
depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE:MBEDTLS_TEST_PSA_ECC_AT_LEAST_ONE_CURVE:PSA_WANT_ALG_ECDSA
|
||||
pk_import_into_psa_opaque:PSA_KEY_TYPE_ECC_KEY_PAIR(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY):MBEDTLS_PSA_ECC_ONE_CURVE_BITS:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_ECDSA(PSA_ALG_ANY_HASH):PSA_KEY_TYPE_ECC_KEY_PAIR(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY):MBEDTLS_PSA_ECC_ONE_CURVE_BITS:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_ECDSA(PSA_ALG_ANY_HASH):0
|
||||
|
||||
PSA import into PSA: opaque ECC, EXPORT (ok)
|
||||
depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE:MBEDTLS_TEST_PSA_ECC_AT_LEAST_ONE_CURVE:PSA_WANT_ALG_ECDSA
|
||||
pk_import_into_psa_opaque:PSA_KEY_TYPE_ECC_KEY_PAIR(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY):MBEDTLS_PSA_ECC_ONE_CURVE_BITS:PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_ECDSA(PSA_ALG_ANY_HASH):PSA_KEY_TYPE_ECC_KEY_PAIR(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY):MBEDTLS_PSA_ECC_ONE_CURVE_BITS:PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_ECDSA(PSA_ALG_ANY_HASH):0
|
||||
|
||||
PSA import into PSA: opaque ECC, no COPY/EXPORT (bad)
|
||||
depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE:MBEDTLS_TEST_PSA_ECC_AT_LEAST_ONE_CURVE:PSA_WANT_ALG_ECDSA
|
||||
pk_import_into_psa_opaque:PSA_KEY_TYPE_ECC_KEY_PAIR(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY):MBEDTLS_PSA_ECC_ONE_CURVE_BITS:PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_ECDSA(PSA_ALG_ANY_HASH):PSA_KEY_TYPE_ECC_KEY_PAIR(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY):MBEDTLS_PSA_ECC_ONE_CURVE_BITS:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_ECDSA(PSA_ALG_ANY_HASH):MBEDTLS_ERR_PK_TYPE_MISMATCH
|
||||
|
||||
# Detail that isn't precisely documented: since this copies the key,
|
||||
# the new key has the intersection of the usage flags.
|
||||
PSA import into PSA: opaque ECC, COPY|EXPORT, different usage (restricted)
|
||||
depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE:MBEDTLS_TEST_PSA_ECC_AT_LEAST_ONE_CURVE:PSA_WANT_ALG_ECDSA
|
||||
pk_import_into_psa_opaque:PSA_KEY_TYPE_ECC_KEY_PAIR(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY):MBEDTLS_PSA_ECC_ONE_CURVE_BITS:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_ECDSA(PSA_ALG_ANY_HASH):PSA_KEY_TYPE_ECC_KEY_PAIR(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY):MBEDTLS_PSA_ECC_ONE_CURVE_BITS:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_ECDSA(PSA_ALG_ANY_HASH):0
|
||||
|
||||
# Detail that isn't precisely documented: since this copies the key,
|
||||
# the new key has the intersection of the usage flags.
|
||||
PSA import into PSA: opaque ECC, COPY, different usage (restricted)
|
||||
depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE:MBEDTLS_TEST_PSA_ECC_AT_LEAST_ONE_CURVE:PSA_WANT_ALG_ECDSA
|
||||
pk_import_into_psa_opaque:PSA_KEY_TYPE_ECC_KEY_PAIR(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY):MBEDTLS_PSA_ECC_ONE_CURVE_BITS:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_ECDSA(PSA_ALG_ANY_HASH):PSA_KEY_TYPE_ECC_KEY_PAIR(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY):MBEDTLS_PSA_ECC_ONE_CURVE_BITS:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_ECDSA(PSA_ALG_ANY_HASH):0
|
||||
|
||||
# Detail that isn't precisely documented: since this exports the key,
|
||||
# the new key has all the requested usage flags.
|
||||
PSA import into PSA: opaque ECC, EXPORT, different usage (ok)
|
||||
depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE:MBEDTLS_TEST_PSA_ECC_AT_LEAST_ONE_CURVE:PSA_WANT_ALG_ECDSA
|
||||
pk_import_into_psa_opaque:PSA_KEY_TYPE_ECC_KEY_PAIR(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY):MBEDTLS_PSA_ECC_ONE_CURVE_BITS:PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_ECDSA(PSA_ALG_ANY_HASH):PSA_KEY_TYPE_ECC_KEY_PAIR(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY):MBEDTLS_PSA_ECC_ONE_CURVE_BITS:PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_ECDSA(PSA_ALG_ANY_HASH):0
|
||||
|
||||
PSA import into PSA: opaque ECC, COPY|EXPORT, different algorithm (ok)
|
||||
depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE:MBEDTLS_TEST_PSA_ECC_AT_LEAST_ONE_CURVE:PSA_WANT_ALG_ECDSA
|
||||
pk_import_into_psa_opaque:PSA_KEY_TYPE_ECC_KEY_PAIR(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY):MBEDTLS_PSA_ECC_ONE_CURVE_BITS:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_ECDSA(PSA_ALG_ANY_HASH):PSA_KEY_TYPE_ECC_KEY_PAIR(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY):MBEDTLS_PSA_ECC_ONE_CURVE_BITS:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_DETERMINISTIC_ECDSA(PSA_ALG_SHA_256):0
|
||||
|
||||
PSA import into PSA: opaque ECC, COPY, different algorithm (bad)
|
||||
depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE:MBEDTLS_TEST_PSA_ECC_AT_LEAST_ONE_CURVE:PSA_WANT_ALG_ECDSA
|
||||
pk_import_into_psa_opaque:PSA_KEY_TYPE_ECC_KEY_PAIR(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY):MBEDTLS_PSA_ECC_ONE_CURVE_BITS:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_ECDSA(PSA_ALG_ANY_HASH):PSA_KEY_TYPE_ECC_KEY_PAIR(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY):MBEDTLS_PSA_ECC_ONE_CURVE_BITS:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_DETERMINISTIC_ECDSA(PSA_ALG_SHA_256):MBEDTLS_ERR_PK_TYPE_MISMATCH
|
||||
|
||||
PSA import into PSA: opaque ECC, EXPORT, different algorithm (ok)
|
||||
depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE:MBEDTLS_TEST_PSA_ECC_AT_LEAST_ONE_CURVE:PSA_WANT_ALG_ECDSA
|
||||
pk_import_into_psa_opaque:PSA_KEY_TYPE_ECC_KEY_PAIR(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY):MBEDTLS_PSA_ECC_ONE_CURVE_BITS:PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_ECDSA(PSA_ALG_ANY_HASH):PSA_KEY_TYPE_ECC_KEY_PAIR(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY):MBEDTLS_PSA_ECC_ONE_CURVE_BITS:PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_DETERMINISTIC_ECDSA(PSA_ALG_SHA_256):0
|
||||
|
||||
PSA import into PSA: opaque ECC, implicit bits (ok)
|
||||
depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE:MBEDTLS_TEST_PSA_ECC_AT_LEAST_ONE_CURVE:PSA_WANT_ALG_ECDSA
|
||||
pk_import_into_psa_opaque:PSA_KEY_TYPE_ECC_KEY_PAIR(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY):MBEDTLS_PSA_ECC_ONE_CURVE_BITS:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_ECDSA(PSA_ALG_ANY_HASH):PSA_KEY_TYPE_ECC_KEY_PAIR(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY):0:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_ECDSA(PSA_ALG_ANY_HASH):0
|
||||
|
||||
PSA import into PSA: opaque ECC, different bits (bad)
|
||||
depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE:MBEDTLS_TEST_PSA_ECC_AT_LEAST_ONE_CURVE:PSA_WANT_ALG_ECDSA
|
||||
pk_import_into_psa_opaque:PSA_KEY_TYPE_ECC_KEY_PAIR(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY):MBEDTLS_PSA_ECC_ONE_CURVE_BITS:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_ECDSA(PSA_ALG_ANY_HASH):PSA_KEY_TYPE_ECC_KEY_PAIR(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY):MBEDTLS_PSA_ECC_ONE_CURVE_BITS + 8:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_ECDSA(PSA_ALG_ANY_HASH):MBEDTLS_ERR_PK_TYPE_MISMATCH
|
||||
|
||||
PSA import into PSA: opaque ECC, different type (bad)
|
||||
depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE:MBEDTLS_TEST_PSA_ECC_AT_LEAST_ONE_CURVE:PSA_WANT_ALG_ECDSA
|
||||
pk_import_into_psa_opaque:PSA_KEY_TYPE_ECC_KEY_PAIR(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY):MBEDTLS_PSA_ECC_ONE_CURVE_BITS:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:0:PSA_KEY_TYPE_HMAC:MBEDTLS_PSA_ECC_ONE_CURVE_BITS:PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:0:MBEDTLS_ERR_PK_TYPE_MISMATCH
|
||||
|
||||
PSA import into PSA: opaque ECC to public (ok)
|
||||
depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE:MBEDTLS_TEST_PSA_ECC_AT_LEAST_ONE_CURVE:PSA_WANT_ALG_ECDSA
|
||||
pk_import_into_psa_opaque:PSA_KEY_TYPE_ECC_KEY_PAIR(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY):MBEDTLS_PSA_ECC_ONE_CURVE_BITS:PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_ECDSA(PSA_ALG_ANY_HASH):PSA_KEY_TYPE_ECC_PUBLIC_KEY(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY):MBEDTLS_PSA_ECC_ONE_CURVE_BITS:PSA_KEY_USAGE_VERIFY_HASH | PSA_KEY_USAGE_VERIFY_MESSAGE:PSA_ALG_ECDSA(PSA_ALG_ANY_HASH):0
|
||||
|
||||
PSA import into PSA: opaque ECC to public, implicit bits (ok)
|
||||
depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE:MBEDTLS_TEST_PSA_ECC_AT_LEAST_ONE_CURVE:PSA_WANT_ALG_ECDSA
|
||||
pk_import_into_psa_opaque:PSA_KEY_TYPE_ECC_KEY_PAIR(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY):MBEDTLS_PSA_ECC_ONE_CURVE_BITS:PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_ECDSA(PSA_ALG_ANY_HASH):PSA_KEY_TYPE_ECC_PUBLIC_KEY(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY):0:PSA_KEY_USAGE_VERIFY_HASH | PSA_KEY_USAGE_VERIFY_MESSAGE:PSA_ALG_ECDSA(PSA_ALG_ANY_HASH):0
|
||||
|
||||
# MBEDTLS_ERR_PK_INVALID_ALG is the error that results from our translation
|
||||
# of PSA errors. In this case MBEDTLS_ERR_PK_TYPE_MISMATCH would probably
|
||||
# be more appropriate.
|
||||
PSA import into PSA: opaque ECC to public, different bits (bad)
|
||||
depends_on:PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE:MBEDTLS_TEST_PSA_ECC_AT_LEAST_ONE_CURVE:PSA_WANT_ALG_ECDSA
|
||||
pk_import_into_psa_opaque:PSA_KEY_TYPE_ECC_KEY_PAIR(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY):MBEDTLS_PSA_ECC_ONE_CURVE_BITS:PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE:PSA_ALG_ECDSA(PSA_ALG_ANY_HASH):PSA_KEY_TYPE_ECC_PUBLIC_KEY(MBEDTLS_TEST_PSA_ECC_ONE_FAMILY):MBEDTLS_PSA_ECC_ONE_CURVE_BITS + 8:PSA_KEY_USAGE_VERIFY_HASH | PSA_KEY_USAGE_VERIFY_MESSAGE:PSA_ALG_ECDSA(PSA_ALG_ANY_HASH):MBEDTLS_ERR_PK_INVALID_ALG
|
||||
|
|
|
|||
|
|
@ -131,14 +131,31 @@ static int pk_genkey_ec(mbedtls_pk_context *pk, mbedtls_ecp_group_id grp_id)
|
|||
|
||||
psa_set_key_type(&key_attr, PSA_KEY_TYPE_ECC_KEY_PAIR(curve));
|
||||
psa_set_key_bits(&key_attr, curve_bits);
|
||||
psa_set_key_usage_flags(&key_attr, PSA_KEY_USAGE_EXPORT |
|
||||
PSA_KEY_USAGE_SIGN_HASH |
|
||||
PSA_KEY_USAGE_SIGN_MESSAGE);
|
||||
psa_key_usage_t usage = PSA_KEY_USAGE_EXPORT | PSA_KEY_USAGE_COPY;
|
||||
psa_algorithm_t sign_alg = 0;
|
||||
psa_algorithm_t derive_alg = 0;
|
||||
if (mbedtls_pk_get_type(pk) != MBEDTLS_PK_ECDSA) {
|
||||
usage |= PSA_KEY_USAGE_DERIVE;
|
||||
derive_alg = PSA_ALG_ECDH;
|
||||
}
|
||||
if (mbedtls_pk_get_type(pk) != MBEDTLS_PK_ECKEY_DH &&
|
||||
curve != PSA_ECC_FAMILY_MONTGOMERY) {
|
||||
usage |= PSA_KEY_USAGE_SIGN_HASH | PSA_KEY_USAGE_SIGN_MESSAGE;
|
||||
#if defined(MBEDTLS_ECDSA_DETERMINISTIC)
|
||||
psa_set_key_algorithm(&key_attr, PSA_ALG_DETERMINISTIC_ECDSA(PSA_ALG_ANY_HASH));
|
||||
sign_alg = PSA_ALG_DETERMINISTIC_ECDSA(PSA_ALG_ANY_HASH);
|
||||
#else
|
||||
psa_set_key_algorithm(&key_attr, PSA_ALG_ECDSA(PSA_ALG_ANY_HASH));
|
||||
sign_alg = PSA_ALG_ECDSA(PSA_ALG_ANY_HASH);
|
||||
#endif
|
||||
}
|
||||
if (derive_alg != 0) {
|
||||
psa_set_key_algorithm(&key_attr, derive_alg);
|
||||
if (sign_alg != 0) {
|
||||
psa_set_key_enrollment_algorithm(&key_attr, sign_alg);
|
||||
}
|
||||
} else {
|
||||
psa_set_key_algorithm(&key_attr, sign_alg);
|
||||
}
|
||||
psa_set_key_usage_flags(&key_attr, usage);
|
||||
|
||||
status = psa_generate_key(&key_attr, &pk->priv_id);
|
||||
if (status != PSA_SUCCESS) {
|
||||
|
|
@ -1458,6 +1475,9 @@ void pk_rsa_alt()
|
|||
PSA_KEY_USAGE_ENCRYPT,
|
||||
&attributes),
|
||||
MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE);
|
||||
mbedtls_svc_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT;
|
||||
TEST_EQUAL(mbedtls_pk_import_into_psa(&alt, &attributes, &key_id),
|
||||
MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE);
|
||||
#endif /* MBEDTLS_PSA_CRYPTO_C */
|
||||
|
||||
/* Test signature */
|
||||
|
|
@ -1776,6 +1796,7 @@ void pk_get_psa_attributes(int pk_type, int from_pair,
|
|||
mbedtls_pk_init(&pk);
|
||||
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
|
||||
psa_key_usage_t usage = usage_arg;
|
||||
mbedtls_svc_key_id_t new_key_id = MBEDTLS_SVC_KEY_ID_INIT;
|
||||
|
||||
PSA_INIT();
|
||||
|
||||
|
|
@ -1816,9 +1837,12 @@ void pk_get_psa_attributes(int pk_type, int from_pair,
|
|||
TEST_EQUAL(psa_get_key_algorithm(&attributes), expected_alg);
|
||||
TEST_EQUAL(psa_get_key_enrollment_algorithm(&attributes), PSA_ALG_NONE);
|
||||
|
||||
TEST_EQUAL(mbedtls_pk_import_into_psa(&pk, &attributes, &new_key_id), 0);
|
||||
|
||||
exit:
|
||||
mbedtls_pk_free(&pk);
|
||||
psa_reset_key_attributes(&attributes);
|
||||
psa_destroy_key(new_key_id);
|
||||
PSA_DONE();
|
||||
}
|
||||
/* END_CASE */
|
||||
|
|
@ -1832,6 +1856,7 @@ void pk_rsa_v21_get_psa_attributes(int md_type, int from_pair,
|
|||
mbedtls_pk_init(&pk);
|
||||
psa_key_usage_t usage = usage_arg;
|
||||
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
|
||||
mbedtls_svc_key_id_t new_key_id = MBEDTLS_SVC_KEY_ID_INIT;
|
||||
|
||||
PSA_INIT();
|
||||
|
||||
|
|
@ -1857,9 +1882,12 @@ void pk_rsa_v21_get_psa_attributes(int md_type, int from_pair,
|
|||
TEST_EQUAL(psa_get_key_algorithm(&attributes), expected_alg);
|
||||
TEST_EQUAL(psa_get_key_enrollment_algorithm(&attributes), PSA_ALG_NONE);
|
||||
|
||||
TEST_EQUAL(mbedtls_pk_import_into_psa(&pk, &attributes, &new_key_id), 0);
|
||||
|
||||
exit:
|
||||
mbedtls_pk_free(&pk);
|
||||
psa_reset_key_attributes(&attributes);
|
||||
psa_destroy_key(new_key_id);
|
||||
PSA_DONE();
|
||||
}
|
||||
/* END_CASE */
|
||||
|
|
@ -1900,13 +1928,14 @@ void pk_get_psa_attributes_opaque(int from_type_arg, int from_bits_arg,
|
|||
mbedtls_pk_context pk;
|
||||
mbedtls_pk_init(&pk);
|
||||
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
|
||||
mbedtls_svc_key_id_t key_id = MBEDTLS_SVC_KEY_ID_INIT;
|
||||
mbedtls_svc_key_id_t old_key_id = MBEDTLS_SVC_KEY_ID_INIT;
|
||||
psa_key_type_t from_type = from_type_arg;
|
||||
size_t bits = from_bits_arg;
|
||||
psa_key_usage_t from_usage = from_usage_arg;
|
||||
psa_algorithm_t alg = from_alg_arg;
|
||||
psa_key_usage_t usage = usage_arg;
|
||||
psa_key_usage_t expected_usage = expected_usage_arg;
|
||||
mbedtls_svc_key_id_t new_key_id = MBEDTLS_SVC_KEY_ID_INIT;
|
||||
|
||||
PSA_INIT();
|
||||
|
||||
|
|
@ -1916,8 +1945,8 @@ void pk_get_psa_attributes_opaque(int from_type_arg, int from_bits_arg,
|
|||
psa_set_key_algorithm(&attributes, alg);
|
||||
psa_set_key_enrollment_algorithm(&attributes, 42);
|
||||
//TODO: test with persistent key
|
||||
PSA_ASSERT(psa_generate_key(&attributes, &key_id));
|
||||
TEST_EQUAL(mbedtls_pk_setup_opaque(&pk, key_id), 0);
|
||||
PSA_ASSERT(psa_generate_key(&attributes, &old_key_id));
|
||||
TEST_EQUAL(mbedtls_pk_setup_opaque(&pk, old_key_id), 0);
|
||||
|
||||
psa_key_type_t expected_psa_type =
|
||||
to_pair ? from_type : PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(from_type);
|
||||
|
|
@ -1934,12 +1963,114 @@ void pk_get_psa_attributes_opaque(int from_type_arg, int from_bits_arg,
|
|||
TEST_EQUAL(psa_get_key_usage_flags(&attributes), expected_usage);
|
||||
TEST_EQUAL(psa_get_key_algorithm(&attributes), alg);
|
||||
TEST_EQUAL(psa_get_key_enrollment_algorithm(&attributes), PSA_ALG_NONE);
|
||||
|
||||
int expected_import_ret = 0;
|
||||
if (to_pair &&
|
||||
!(from_usage & (PSA_KEY_USAGE_COPY | PSA_KEY_USAGE_EXPORT))) {
|
||||
expected_import_ret = MBEDTLS_ERR_PK_TYPE_MISMATCH;
|
||||
}
|
||||
TEST_EQUAL(mbedtls_pk_import_into_psa(&pk, &attributes, &new_key_id),
|
||||
expected_import_ret);
|
||||
}
|
||||
|
||||
exit:
|
||||
mbedtls_pk_free(&pk);
|
||||
psa_destroy_key(key_id);
|
||||
psa_destroy_key(old_key_id);
|
||||
psa_destroy_key(new_key_id);
|
||||
psa_reset_key_attributes(&attributes);
|
||||
PSA_DONE();
|
||||
}
|
||||
/* END_CASE */
|
||||
|
||||
/* BEGIN_CASE depends_on:MBEDTLS_PSA_CRYPTO_C */
|
||||
void pk_import_into_psa_fail(int pk_type, int from_pair,
|
||||
int type_arg,
|
||||
int expected_ret)
|
||||
{
|
||||
mbedtls_pk_context pk;
|
||||
mbedtls_pk_init(&pk);
|
||||
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
|
||||
psa_key_type_t type = type_arg;
|
||||
mbedtls_svc_key_id_t key_id = mbedtls_svc_key_id_make(0, 42);
|
||||
|
||||
PSA_INIT();
|
||||
|
||||
psa_key_type_t expected_psa_type;
|
||||
TEST_EQUAL(pk_setup_for_type(pk_type, from_pair,
|
||||
&pk, &expected_psa_type), 0);
|
||||
|
||||
psa_set_key_type(&attributes, type);
|
||||
|
||||
TEST_EQUAL(mbedtls_pk_import_into_psa(&pk, &attributes, &key_id),
|
||||
expected_ret);
|
||||
TEST_ASSERT(mbedtls_svc_key_id_equal(key_id, MBEDTLS_SVC_KEY_ID_INIT));
|
||||
|
||||
exit:
|
||||
psa_destroy_key(key_id);
|
||||
mbedtls_pk_free(&pk);
|
||||
psa_reset_key_attributes(&attributes);
|
||||
PSA_DONE();
|
||||
}
|
||||
/* END_CASE */
|
||||
|
||||
/* BEGIN_CASE depends_on:MBEDTLS_USE_PSA_CRYPTO */
|
||||
void pk_import_into_psa_opaque(int from_type, int from_bits,
|
||||
int from_usage, int from_alg,
|
||||
int to_type, int to_bits,
|
||||
int to_usage, int to_alg,
|
||||
int expected_ret)
|
||||
{
|
||||
mbedtls_pk_context pk;
|
||||
mbedtls_pk_init(&pk);
|
||||
psa_key_attributes_t from_attributes = PSA_KEY_ATTRIBUTES_INIT;
|
||||
mbedtls_svc_key_id_t from_key_id = MBEDTLS_SVC_KEY_ID_INIT;
|
||||
psa_key_attributes_t to_attributes = PSA_KEY_ATTRIBUTES_INIT;
|
||||
mbedtls_svc_key_id_t to_key_id = MBEDTLS_SVC_KEY_ID_INIT;
|
||||
psa_key_attributes_t actual_attributes = PSA_KEY_ATTRIBUTES_INIT;
|
||||
|
||||
PSA_INIT();
|
||||
|
||||
psa_set_key_type(&from_attributes, from_type);
|
||||
psa_set_key_bits(&from_attributes, from_bits);
|
||||
psa_set_key_usage_flags(&from_attributes, from_usage);
|
||||
psa_set_key_algorithm(&from_attributes, from_alg);
|
||||
PSA_ASSERT(psa_generate_key(&from_attributes, &from_key_id));
|
||||
TEST_EQUAL(mbedtls_pk_setup_opaque(&pk, from_key_id), 0);
|
||||
|
||||
psa_set_key_type(&to_attributes, to_type);
|
||||
psa_set_key_bits(&to_attributes, to_bits);
|
||||
psa_set_key_usage_flags(&to_attributes, to_usage);
|
||||
psa_set_key_algorithm(&to_attributes, to_alg);
|
||||
|
||||
TEST_EQUAL(mbedtls_pk_import_into_psa(&pk, &to_attributes, &to_key_id),
|
||||
expected_ret);
|
||||
|
||||
if (expected_ret == 0) {
|
||||
PSA_ASSERT(psa_get_key_attributes(to_key_id, &actual_attributes));
|
||||
TEST_EQUAL(to_type, psa_get_key_type(&actual_attributes));
|
||||
if (to_bits != 0) {
|
||||
TEST_EQUAL(to_bits, psa_get_key_bits(&actual_attributes));
|
||||
}
|
||||
TEST_EQUAL(to_alg, psa_get_key_algorithm(&actual_attributes));
|
||||
psa_key_usage_t expected_usage = to_usage;
|
||||
if (expected_usage & PSA_KEY_USAGE_SIGN_HASH) {
|
||||
expected_usage |= PSA_KEY_USAGE_SIGN_MESSAGE;
|
||||
}
|
||||
if (expected_usage & PSA_KEY_USAGE_VERIFY_HASH) {
|
||||
expected_usage |= PSA_KEY_USAGE_VERIFY_MESSAGE;
|
||||
}
|
||||
TEST_EQUAL(expected_usage, psa_get_key_usage_flags(&actual_attributes));
|
||||
} else {
|
||||
TEST_ASSERT(mbedtls_svc_key_id_equal(to_key_id, MBEDTLS_SVC_KEY_ID_INIT));
|
||||
}
|
||||
|
||||
exit:
|
||||
mbedtls_pk_free(&pk);
|
||||
psa_destroy_key(from_key_id);
|
||||
psa_destroy_key(to_key_id);
|
||||
psa_reset_key_attributes(&from_attributes);
|
||||
psa_reset_key_attributes(&to_attributes);
|
||||
psa_reset_key_attributes(&actual_attributes);
|
||||
PSA_DONE();
|
||||
}
|
||||
/* END_CASE */
|
||||
|
|
|
|||
Loading…
Reference in a new issue