Skip to content

Commit 48c3c1e

Browse files
Vge0rgerlubos
Vge0rge
authored and
rlubos
committed
nrf_security: Refactor get_opaque_size function
This refactors the function cracen_get_opaque_size so that it returns psa_status_t and not a size_t value. With ths previous implementation it was not possible to distinguish between a key with invalid arguments or a key which is revoked. Revocation support will be added soon and this separation is needed. Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no>
1 parent 35facd1 commit 48c3c1e

File tree

7 files changed

+60
-32
lines changed

7 files changed

+60
-32
lines changed

‎subsys/nrf_security/src/drivers/cracen/cracenpsa/include/cracen_psa.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -247,7 +247,7 @@ psa_status_t cracen_copy_key(psa_key_attributes_t *attributes, const uint8_t *so
247247

248248
psa_status_t cracen_destroy_key(const psa_key_attributes_t *attributes);
249249

250-
size_t cracen_get_opaque_size(const psa_key_attributes_t *attributes);
250+
psa_status_t cracen_get_opaque_size(const psa_key_attributes_t *attributes, size_t *key_size);
251251

252252
psa_status_t cracen_jpake_setup(cracen_jpake_operation_t *operation,
253253
const psa_key_attributes_t *attributes, const uint8_t *password,

‎subsys/nrf_security/src/drivers/cracen/cracenpsa/src/common.c

+15-9
Original file line numberDiff line numberDiff line change
@@ -806,26 +806,28 @@ psa_status_t cracen_load_keyref(const psa_key_attributes_t *attributes, const ui
806806
return PSA_SUCCESS;
807807
}
808808

809-
size_t cracen_get_opaque_size(const psa_key_attributes_t *attributes)
809+
psa_status_t cracen_get_opaque_size(const psa_key_attributes_t *attributes, size_t *key_size)
810810
{
811811
if (PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)) ==
812812
PSA_KEY_LOCATION_CRACEN) {
813813
switch (MBEDTLS_SVC_KEY_ID_GET_KEY_ID(psa_get_key_id(attributes))) {
814814
case CRACEN_BUILTIN_IDENTITY_KEY_ID:
815815
if (psa_get_key_type(attributes) ==
816816
PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1)) {
817-
return sizeof(ikg_opaque_key);
817+
*key_size = sizeof(ikg_opaque_key);
818+
return PSA_SUCCESS;
818819
}
819820
break;
820821
case CRACEN_BUILTIN_MEXT_ID:
821822
case CRACEN_BUILTIN_MKEK_ID:
822823
if (psa_get_key_type(attributes) == PSA_KEY_TYPE_AES) {
823-
return sizeof(ikg_opaque_key);
824+
*key_size = sizeof(ikg_opaque_key);
825+
return PSA_SUCCESS;
824826
}
825827
break;
826828
#ifdef CONFIG_PSA_NEED_CRACEN_PLATFORM_KEYS
827829
default:
828-
return cracen_platform_keys_get_size(attributes);
830+
return cracen_platform_keys_get_size(attributes, key_size);
829831
#endif
830832
}
831833
}
@@ -835,15 +837,19 @@ size_t cracen_get_opaque_size(const psa_key_attributes_t *attributes)
835837
if (PSA_KEY_TYPE_IS_ECC(psa_get_key_type(attributes))) {
836838
if (psa_get_key_type(attributes) ==
837839
PSA_KEY_TYPE_ECC_PUBLIC_KEY(PSA_ECC_FAMILY_SECP_R1)) {
838-
return PSA_EXPORT_PUBLIC_KEY_OUTPUT_SIZE(
840+
*key_size = PSA_EXPORT_PUBLIC_KEY_OUTPUT_SIZE(
839841
psa_get_key_type(attributes), psa_get_key_bits(attributes));
842+
} else {
843+
*key_size = PSA_BITS_TO_BYTES(psa_get_key_bits(attributes));
840844
}
841-
return PSA_BITS_TO_BYTES(psa_get_key_bits(attributes));
842845
} else if (psa_get_key_type(attributes) == PSA_KEY_TYPE_HMAC) {
843-
return PSA_BITS_TO_BYTES(psa_get_key_bits(attributes));
846+
*key_size = PSA_BITS_TO_BYTES(psa_get_key_bits(attributes));
844847
} else {
845-
return sizeof(kmu_opaque_key_buffer);
848+
*key_size = sizeof(kmu_opaque_key_buffer);
846849
}
850+
851+
return PSA_SUCCESS;
847852
}
848-
return 0;
853+
854+
return PSA_ERROR_INVALID_ARGUMENT;
849855
}

‎subsys/nrf_security/src/drivers/cracen/cracenpsa/src/key_management.c

+25-7
Original file line numberDiff line numberDiff line change
@@ -880,12 +880,18 @@ psa_status_t cracen_import_key(const psa_key_attributes_t *attributes, const uin
880880
MBEDTLS_SVC_KEY_ID_GET_KEY_ID(psa_get_key_id(attributes)));
881881
psa_key_attributes_t stored_attributes;
882882

883-
if (key_buffer_size < cracen_get_opaque_size(attributes)) {
884-
return PSA_ERROR_BUFFER_TOO_SMALL;
883+
size_t opaque_key_size;
884+
psa_status_t status = cracen_get_opaque_size(attributes, &opaque_key_size);
885+
886+
if (status != PSA_SUCCESS) {
887+
return status;
885888
}
886889

887-
psa_status_t status = cracen_kmu_provision(attributes, slot_id, data, data_length);
890+
if (key_buffer_size < opaque_key_size) {
891+
return PSA_ERROR_BUFFER_TOO_SMALL;
892+
}
888893

894+
status = cracen_kmu_provision(attributes, slot_id, data, data_length);
889895
if (status != PSA_SUCCESS) {
890896
return status;
891897
}
@@ -1182,6 +1188,9 @@ psa_status_t cracen_get_builtin_key(psa_drv_slot_number_t slot_number,
11821188
psa_key_attributes_t *attributes, uint8_t *key_buffer,
11831189
size_t key_buffer_size, size_t *key_buffer_length)
11841190
{
1191+
size_t opaque_key_size;
1192+
psa_status_t status = PSA_ERROR_INVALID_ARGUMENT;
1193+
11851194
/* According to the PSA Crypto Driver specification, the PSA core will set the `id`
11861195
* and the `lifetime` field of the attribute struct. We will fill all the other
11871196
* attributes, and update the `lifetime` field to be more specific.
@@ -1199,12 +1208,17 @@ psa_status_t cracen_get_builtin_key(psa_drv_slot_number_t slot_number,
11991208
PSA_KEY_USAGE_VERIFY_HASH |
12001209
PSA_KEY_USAGE_VERIFY_MESSAGE);
12011210

1211+
status = cracen_get_opaque_size(attributes, &opaque_key_size);
1212+
if (status != PSA_SUCCESS) {
1213+
return status;
1214+
}
1215+
12021216
/* According to the PSA Crypto Driver interface proposed document the driver
12031217
* should fill the attributes even if the buffer of the key is too small. So
12041218
* we check the buffer here and not earlier in the function.
12051219
*/
1206-
if (key_buffer_size >= cracen_get_opaque_size(attributes)) {
1207-
*key_buffer_length = cracen_get_opaque_size(attributes);
1220+
if (key_buffer_size >= opaque_key_size) {
1221+
*key_buffer_length = opaque_key_size;
12081222
*((ikg_opaque_key *)key_buffer) =
12091223
(ikg_opaque_key){.slot_number = slot_number,
12101224
.owner_id = MBEDTLS_SVC_KEY_ID_GET_OWNER_ID(
@@ -1226,11 +1240,15 @@ psa_status_t cracen_get_builtin_key(psa_drv_slot_number_t slot_number,
12261240
psa_set_key_usage_flags(attributes,
12271241
PSA_KEY_USAGE_DERIVE | PSA_KEY_USAGE_VERIFY_DERIVATION);
12281242

1243+
status = cracen_get_opaque_size(attributes, &opaque_key_size);
1244+
if (status != PSA_SUCCESS) {
1245+
return status;
1246+
}
12291247
/* See comment about the placement of this check in the previous switch
12301248
* case.
12311249
*/
1232-
if (key_buffer_size >= cracen_get_opaque_size(attributes)) {
1233-
*key_buffer_length = cracen_get_opaque_size(attributes);
1250+
if (key_buffer_size >= opaque_key_size) {
1251+
*key_buffer_length = opaque_key_size;
12341252
*((ikg_opaque_key *)key_buffer) =
12351253
(ikg_opaque_key){.slot_number = slot_number,
12361254
.owner_id = MBEDTLS_SVC_KEY_ID_GET_OWNER_ID(

‎subsys/nrf_security/src/drivers/cracen/cracenpsa/src/kmu.c

+9-2
Original file line numberDiff line numberDiff line change
@@ -901,6 +901,7 @@ psa_status_t cracen_kmu_get_builtin_key(psa_drv_slot_number_t slot_number,
901901
{
902902
kmu_metadata metadata;
903903
psa_status_t status = read_primary_slot_metadata(slot_number, &metadata);
904+
size_t opaque_key_size;
904905

905906
if (status != PSA_SUCCESS) {
906907
return status;
@@ -921,8 +922,14 @@ psa_status_t cracen_kmu_get_builtin_key(psa_drv_slot_number_t slot_number,
921922
return status;
922923
}
923924

924-
if (key_buffer_size >= cracen_get_opaque_size(attributes)) {
925-
*key_buffer_length = cracen_get_opaque_size(attributes);
925+
926+
status = cracen_get_opaque_size(attributes, &opaque_key_size);
927+
if (status != PSA_SUCCESS) {
928+
return status;
929+
}
930+
931+
if (key_buffer_size >= opaque_key_size) {
932+
*key_buffer_length = opaque_key_size;
926933
kmu_opaque_key_buffer *key = (kmu_opaque_key_buffer *)key_buffer;
927934

928935
key->key_usage_scheme = metadata.key_usage_scheme;

‎subsys/nrf_security/src/drivers/cracen/cracenpsa/src/platform_keys/platform_keys.c

+6-8
Original file line numberDiff line numberDiff line change
@@ -520,26 +520,24 @@ psa_status_t cracen_platform_get_builtin_key(psa_drv_slot_number_t slot_number,
520520
return PSA_ERROR_CORRUPTION_DETECTED;
521521
}
522522

523-
size_t cracen_platform_keys_get_size(psa_key_attributes_t const *attributes)
523+
psa_status_t cracen_platform_keys_get_size(psa_key_attributes_t const *attributes, size_t *key_size)
524524
{
525525
platform_key key;
526526
key_type type = find_key(MBEDTLS_SVC_KEY_ID_GET_KEY_ID(psa_get_key_id(attributes)), &key);
527527
psa_key_type_t key_type = psa_get_key_type(attributes);
528528

529-
if (type == INVALID) {
530-
return 0;
531-
}
532-
533529
if (type == IKG) {
534-
return sizeof(ikg_opaque_key);
530+
*key_size = sizeof(ikg_opaque_key);
531+
return PSA_SUCCESS;
535532
}
536533

537534
if (key_type == PSA_KEY_TYPE_ECC_PUBLIC_KEY(PSA_ECC_FAMILY_TWISTED_EDWARDS) ||
538535
key_type == PSA_KEY_TYPE_AES) {
539-
return PSA_BITS_TO_BYTES(psa_get_key_bits(attributes));
536+
*key_size = PSA_BITS_TO_BYTES(psa_get_key_bits(attributes));
537+
return PSA_SUCCESS;
540538
}
541539

542-
return 0;
540+
return PSA_ERROR_INVALID_ARGUMENT;
543541
}
544542

545543
psa_status_t cracen_platform_get_key_slot(mbedtls_svc_key_id_t key_id, psa_key_lifetime_t *lifetime,

‎subsys/nrf_security/src/drivers/cracen/cracenpsa/src/platform_keys/platform_keys.h

+2-1
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,8 @@ psa_status_t cracen_platform_get_builtin_key(psa_drv_slot_number_t slot_number,
1313
psa_key_attributes_t *attributes, uint8_t *key_buffer,
1414
size_t key_buffer_size, size_t *key_buffer_length);
1515

16-
size_t cracen_platform_keys_get_size(psa_key_attributes_t const *attributes);
16+
psa_status_t cracen_platform_keys_get_size(psa_key_attributes_t const *attributes,
17+
size_t *key_size);
1718

1819
psa_status_t cracen_platform_get_key_slot(mbedtls_svc_key_id_t key_id, psa_key_lifetime_t *lifetime,
1920
psa_drv_slot_number_t *slot_number);

‎subsys/nrf_security/src/psa_crypto_driver_wrappers.c

+2-4
Original file line numberDiff line numberDiff line change
@@ -463,8 +463,7 @@ psa_driver_wrapper_get_key_buffer_size_from_key_data(const psa_key_attributes_t
463463
#if defined(PSA_NEED_CRACEN_KMU_DRIVER)
464464
case PSA_KEY_LOCATION_CRACEN_KMU:
465465
#endif
466-
*key_buffer_size = cracen_get_opaque_size(attributes);
467-
return *key_buffer_size != 0 ? PSA_SUCCESS : PSA_ERROR_INVALID_ARGUMENT;
466+
return cracen_get_opaque_size(attributes, key_buffer_size);
468467
#endif
469468
default:
470469
(void)key_type;
@@ -503,8 +502,7 @@ psa_status_t psa_driver_wrapper_get_key_buffer_size(const psa_key_attributes_t *
503502
#if defined(PSA_NEED_CRACEN_KMU_DRIVER)
504503
case PSA_KEY_LOCATION_CRACEN_KMU:
505504
#endif
506-
*key_buffer_size = cracen_get_opaque_size(attributes);
507-
return *key_buffer_size != 0 ? PSA_SUCCESS : PSA_ERROR_NOT_SUPPORTED;
505+
return cracen_get_opaque_size(attributes, key_buffer_size);
508506
#endif
509507
#if defined(PSA_CRYPTO_DRIVER_TFM_BUILTIN_KEY_LOADER)
510508
case TFM_BUILTIN_KEY_LOADER_KEY_LOCATION:

0 commit comments

Comments
 (0)