Implementation-specific definitions

`psa_key_handle_t` (type)

typedef _unsigned_integral_type_ psa_key_handle_t;

Key handle.

This type represents open handles to keys. It must be an unsigned integral type. The choice of type is implementation-dependent.

0 is not a valid key handle. How other handle values are assigned is implementation-dependent.

Library initialization

`psa_crypto_init` (function)

psa_status_t psa_crypto_init(void);

Returns: psa_status_t

PSA_SUCCESS
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED
PSA_ERROR_INSUFFICIENT_ENTROPY

Description:

Library initialization.

Applications must call this function before calling any other function in this module.

Applications may call this function more than once. Once a call succeeds, subsequent calls are guaranteed to succeed.

If the application calls other functions before calling psa_crypto_init(), the behavior is undefined. Implementations are encouraged to either perform the operation as if the library had been initialized or to return PSA_ERROR_BAD_STATE or some other applicable error. In particular, implementations should not return a success status if the lack of initialization may have security implications, for example due to improper seeding of the random number generator.

Key attributes

`psa_key_attributes_t` (type)

typedef struct psa_key_attributes_s psa_key_attributes_t;

The type of a structure containing key attributes.

This is an opaque structure that can represent the metadata of a key object. Metadata that can be stored in attributes includes:

The location of the key in storage, indicated by its key identifier and its lifetime.
The key’s policy, comprising usage flags and a specification of the permitted algorithm(s).
Information about the key itself: the key type and its size.
Implementations may define additional attributes.

The actual key material is not considered an attribute of a key. Key attributes do not contain information that is generally considered highly confidential.

An attribute structure can be a simple data structure where each function psa_set_key_xxx sets a field and the corresponding function psa_get_key_xxx retrieves the value of the corresponding field. However, implementations may report values that are equivalent to the original one, but have a different encoding. For example, an implementation may use a more compact representation for types where many bit-patterns are invalid or not supported, and store all values that it does not support as a special marker value. In such an implementation, after setting an invalid value, the corresponding get function returns an invalid value which may not be the one that was originally stored.

An attribute structure may contain references to auxiliary resources, for example pointers to allocated memory or indirect references to pre-calculated values. In order to free such resources, the application must call psa_reset_key_attributes(). As an exception, calling psa_reset_key_attributes() on an attribute structure is optional if the structure has only been modified by the following functions since it was initialized or last reset with psa_reset_key_attributes():

psa_set_key_id()
psa_set_key_lifetime()
psa_set_key_type()
psa_set_key_bits()
psa_set_key_usage_flags()
psa_set_key_algorithm()

Before calling any function on a key attribute structure, the application must initialize it by any of the following means:

Set the structure to all-bits-zero, for example:

psa_key_attributes_t attributes;
memset(&attributes, 0, sizeof(attributes));

Initialize the structure to logical zero values, for example:
```
psa_key_attributes_t attributes = {0};
```
Initialize the structure to the initializer PSA_KEY_ATTRIBUTES_INIT, for example:
```
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
```
Assign the result of the function psa_key_attributes_init() to the structure, for example:
```
psa_key_attributes_t attributes;
attributes = psa_key_attributes_init();
```

A freshly initialized attribute structure contains the following values:

lifetime: PSA_KEY_LIFETIME_VOLATILE.
key identifier: unspecified.
type: 0.
key size: 0.
usage flags: 0.
algorithm: 0.

A typical sequence to create a key is as follows:

Create and initialize an attribute structure.
If the key is persistent, call psa_set_key_id(). Also call psa_set_key_lifetime() to place the key in a non-default location.
Set the key policy with psa_set_key_usage_flags() and psa_set_key_algorithm().
Set the key type with psa_set_key_type(). Skip this step if copying an existing key with psa_copy_key().
When generating a random key with psa_generate_key() or deriving a key with psa_key_derivation_output_key(), set the desired key size with psa_set_key_bits().
Call a key creation function: psa_import_key(), psa_generate_key(), psa_key_derivation_output_key() or psa_copy_key(). This function reads the attribute structure, creates a key with these attributes, and outputs a handle to the newly created key.
The attribute structure is now no longer necessary. You may call psa_reset_key_attributes(), although this is optional with the workflow presented here because the attributes currently defined in this specification do not require any additional resources beyond the structure itself.

A typical sequence to query a key’s attributes is as follows:

Call psa_get_key_attributes().
Call psa_get_key_xxx functions to retrieve the attribute(s) that you are interested in.
Call psa_reset_key_attributes() to free any resources that may be used by the attribute structure.

Once a key has been created, it is impossible to change its attributes.

`PSA_KEY_ATTRIBUTES_INIT` (macro)

#define PSA_KEY_ATTRIBUTES_INIT  {0}

This macro returns a suitable initializer for a key attribute structure of type psa_key_attributes_t.

`psa_key_attributes_init` (function)

psa_key_attributes_t psa_key_attributes_init(void);

Returns: psa_key_attributes_t

Description:

Return an initial value for a key attributes structure.

`psa_set_key_id` (function)

void psa_set_key_id(psa_key_attributes_t * attributes,
                    psa_key_id_t id);

Parameters:

attributes: The attribute structure to write to.
id: The persistent identifier for the key.

Returns: void

Description:

Declare a key as persistent and set its key identifier.

If the attribute structure currently declares the key as volatile (which is the default content of an attribute structure), this function sets the lifetime attribute to PSA_KEY_LIFETIME_PERSISTENT.

This function does not access storage, it merely stores the given value in the structure. The persistent key will be written to storage when the attribute structure is passed to a key creation function such as psa_import_key(), psa_generate_key(), psa_key_derivation_output_key() or psa_copy_key().

This function may be declared as static (i.e. without external linkage). This function may be provided as a function-like macro, but in this case it must evaluate each of its arguments exactly once.

`psa_set_key_lifetime` (function)

void psa_set_key_lifetime(psa_key_attributes_t * attributes,
                          psa_key_lifetime_t lifetime);

Parameters:

attributes: The attribute structure to write to.
lifetime: The lifetime for the key. If this is PSA_KEY_LIFETIME_VOLATILE, the key will be volatile, and the key identifier attribute is reset to 0.

Returns: void

Description:

Set the location of a persistent key.

To make a key persistent, you must give it a persistent key identifier with psa_set_key_id(). By default, a key that has a persistent identifier is stored in the default storage area identifier by PSA_KEY_LIFETIME_PERSISTENT. Call this function to choose a storage area, or to explicitly declare the key as volatile.

This function does not access storage, it merely stores the given value in the structure. The persistent key will be written to storage when the attribute structure is passed to a key creation function such as psa_import_key(), psa_generate_key(), psa_key_derivation_output_key() or psa_copy_key().

This function may be declared as static (i.e. without external linkage). This function may be provided as a function-like macro, but in this case it must evaluate each of its arguments exactly once.

`psa_get_key_id` (function)

psa_key_id_t psa_get_key_id(const psa_key_attributes_t * attributes);

Parameters:

attributes: The key attribute structure to query.

Returns: psa_key_id_t

The persistent identifier stored in the attribute structure. This value is unspecified if the attribute structure declares the key as volatile.

Description:

Retrieve the key identifier from key attributes.

This function may be declared as static (i.e. without external linkage). This function may be provided as a function-like macro, but in this case it must evaluate its argument exactly once.

`psa_get_key_lifetime` (function)

psa_key_lifetime_t psa_get_key_lifetime(const psa_key_attributes_t * attributes);

Parameters:

attributes: The key attribute structure to query.

Returns: psa_key_lifetime_t

The lifetime value stored in the attribute structure.

Description:

Retrieve the lifetime from key attributes.

This function may be declared as static (i.e. without external linkage). This function may be provided as a function-like macro, but in this case it must evaluate its argument exactly once.

`psa_set_key_usage_flags` (function)

void psa_set_key_usage_flags(psa_key_attributes_t * attributes,
                             psa_key_usage_t usage_flags);

Parameters:

attributes: The attribute structure to write to.
usage_flags: The usage flags to write.

Returns: void

Description:

Declare usage flags for a key.

Usage flags are part of a key’s usage policy. They encode what kind of operations are permitted on the key. For more details, refer to the documentation of the type psa_key_usage_t.

This function overwrites any usage flags previously set in attributes.

This function may be declared as static (i.e. without external linkage). This function may be provided as a function-like macro, but in this case it must evaluate each of its arguments exactly once.

`psa_get_key_usage_flags` (function)

psa_key_usage_t psa_get_key_usage_flags(const psa_key_attributes_t * attributes);

Parameters:

attributes: The key attribute structure to query.

Returns: psa_key_usage_t

The usage flags stored in the attribute structure.

Description:

Retrieve the usage flags from key attributes.

This function may be declared as static (i.e. without external linkage). This function may be provided as a function-like macro, but in this case it must evaluate its argument exactly once.

`psa_set_key_algorithm` (function)

void psa_set_key_algorithm(psa_key_attributes_t * attributes,
                           psa_algorithm_t alg);

Parameters:

attributes: The attribute structure to write to.
alg: The permitted algorithm policy to write.

Returns: void

Description:

Declare the permitted algorithm policy for a key.

The permitted algorithm policy of a key encodes which algorithm or algorithms are permitted to be used with this key.

This function overwrites any algorithm policy previously set in attributes.

This function may be declared as static (i.e. without external linkage). This function may be provided as a function-like macro, but in this case it must evaluate each of its arguments exactly once.

`psa_get_key_algorithm` (function)

psa_algorithm_t psa_get_key_algorithm(const psa_key_attributes_t * attributes);

Parameters:

attributes: The key attribute structure to query.

Returns: psa_algorithm_t

The algorithm stored in the attribute structure.

Description:

Retrieve the algorithm policy from key attributes.

This function may be declared as static (i.e. without external linkage). This function may be provided as a function-like macro, but in this case it must evaluate its argument exactly once.

`psa_set_key_type` (function)

void psa_set_key_type(psa_key_attributes_t * attributes,
                      psa_key_type_t type);

Parameters:

attributes: The attribute structure to write to.
type: The key type to write.

Returns: void

Description:

Declare the type of a key.

This function overwrites any key type previously set in attributes.

This function may be declared as static (i.e. without external linkage). This function may be provided as a function-like macro, but in this case it must evaluate each of its arguments exactly once.

`psa_set_key_bits` (function)

void psa_set_key_bits(psa_key_attributes_t * attributes,
                      size_t bits);

Parameters:

attributes: The attribute structure to write to.
bits: The key size in bits.

Returns: void

Description:

Declare the size of a key.

This function overwrites any key size previously set in attributes.

This function may be declared as static (i.e. without external linkage). This function may be provided as a function-like macro, but in this case it must evaluate each of its arguments exactly once.

`psa_get_key_type` (function)

psa_key_type_t psa_get_key_type(const psa_key_attributes_t * attributes);

Parameters:

attributes: The key attribute structure to query.

Returns: psa_key_type_t

The key type stored in the attribute structure.

Description:

Retrieve the key type from key attributes.

This function may be declared as static (i.e. without external linkage). This function may be provided as a function-like macro, but in this case it must evaluate its argument exactly once.

`psa_get_key_bits` (function)

size_t psa_get_key_bits(const psa_key_attributes_t * attributes);

Parameters:

attributes: The key attribute structure to query.

Returns: size_t

The key size stored in the attribute structure, in bits.

Description:

Retrieve the key size from key attributes.

This function may be declared as static (i.e. without external linkage). This function may be provided as a function-like macro, but in this case it must evaluate its argument exactly once.

`psa_get_key_attributes` (function)

psa_status_t psa_get_key_attributes(psa_key_handle_t handle,
                                    psa_key_attributes_t * attributes);

Parameters:

handle: Handle to the key to query.
attributes: On success, the attributes of the key. On failure, equivalent to a freshly-initialized structure.

Returns: psa_status_t

PSA_SUCCESS
PSA_ERROR_INVALID_HANDLE
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE

Description:

Retrieve the attributes of a key.

This function first resets the attribute structure as with psa_reset_key_attributes(). It then copies the attributes of the given key into the given attribute structure.

Note

This function may allocate memory or other resources. Once you have called this function on an attribute structure, you must call psa_reset_key_attributes() to free these resources.

`psa_reset_key_attributes` (function)

void psa_reset_key_attributes(psa_key_attributes_t * attributes);

Parameters:

attributes: The attribute structure to reset.

Returns: void

Description:

Reset a key attribute structure to a freshly initialized state.

You must initialize the attribute structure as described in the documentation of the type psa_key_attributes_t before calling this function. Once the structure has been initialized, you may call this function at any time.

This function frees any auxiliary resources that the structure may contain.

Key management

`psa_open_key` (function)

psa_status_t psa_open_key(psa_key_id_t id,
                          psa_key_handle_t * handle);

Parameters:

id: The persistent identifier of the key.
handle: On success, a handle to the key.

Returns: psa_status_t

PSA_SUCCESS: Success. The application can now use the value of *handle to access the key.
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_DOES_NOT_EXIST
PSA_ERROR_INVALID_ARGUMENT: id is invalid.
PSA_ERROR_NOT_PERMITTED: The specified key exists, but the application does not have the permission to access it. Note that this specification does not define any way to create such a key, but it may be possible through implementation-specific means.
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_STORAGE_FAILURE

Description:

Open a handle to an existing persistent key.

Open a handle to a persistent key. A key is persistent if it was created with a lifetime other than PSA_KEY_LIFETIME_VOLATILE. A persistent key always has a nonzero key identifier, set with psa_set_key_id() when creating the key. Implementations may provide additional pre-provisioned keys with identifiers in the range PSA_KEY_ID_VENDOR_MIN–PSA_KEY_ID_VENDOR_MAX.

The application must eventually close the handle with psa_close_key() to release associated resources. If the application dies without calling psa_close_key(), the implementation should perform the equivalent of a call to psa_close_key().

Implementations may provide additional keys that can be opened with psa_open_key(). Such keys have a key identifier in the vendor range, as documented in the description of psa_key_id_t.

`psa_close_key` (function)

psa_status_t psa_close_key(psa_key_handle_t handle);

Parameters:

handle: The key handle to close.

Returns: psa_status_t

PSA_SUCCESS
PSA_ERROR_INVALID_HANDLE
PSA_ERROR_COMMUNICATION_FAILURE

Description:

Close a key handle.

If the handle designates a volatile key, destroy the key material and free all associated resources, just like psa_destroy_key().

If the handle designates a persistent key, free all resources associated with the key in volatile memory. The key in persistent storage is not affected and can be opened again later with psa_open_key().

If the key is currently in use in a multipart operation, the multipart operation is aborted.

Key import and export

`psa_import_key` (function)

psa_status_t psa_import_key(const psa_key_attributes_t * attributes,
                            const uint8_t * data,
                            size_t data_length,
                            psa_key_handle_t * handle);

Parameters:

attributes: The attributes for the new key. The key size is always determined from the data buffer. If the key size in attributes is nonzero, it must be equal to the size from data.
data: Buffer containing the key data. The content of this buffer is interpreted according to the type declared in attributes. All implementations must support at least the format described in the documentation of psa_export_key() or psa_export_public_key() for the chosen type. Implementations may allow other formats, but should be conservative: implementations should err on the side of rejecting content if it may be erroneous (e.g. wrong type or truncated data).
data_length: Size of the data buffer in bytes.
handle: On success, a handle to the newly created key. 0 on failure.

Returns: psa_status_t

PSA_SUCCESS: Success. If the key is persistent, the key material and the key’s metadata have been saved to persistent storage.
PSA_ERROR_ALREADY_EXISTS: This is an attempt to create a persistent key, and there is already a persistent key with the given identifier.
PSA_ERROR_NOT_SUPPORTED: The key type or key size is not supported, either by the implementation in general or in this particular persistent location.
PSA_ERROR_INVALID_ARGUMENT: The key attributes, as a whole, are invalid.
PSA_ERROR_INVALID_ARGUMENT: The key data is not correctly formatted.
PSA_ERROR_INVALID_ARGUMENT: The size in attributes is nonzero and does not match the size of the key data.
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_INSUFFICIENT_STORAGE
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_STORAGE_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED
PSA_ERROR_BAD_STATE: The library has not been previously initialized by psa_crypto_init(). It is implementation-dependent whether a failure to initialize results in this error code.

Description:

Import a key in binary format.

This function supports any output from psa_export_key(). Refer to the documentation of psa_export_public_key() for the format of public keys and to the documentation of psa_export_key() for the format for other key types.

This specification supports a single format for each key type. Implementations may support other formats as long as the standard format is supported. Implementations that support other formats should ensure that the formats are clearly unambiguous so as to minimize the risk that an invalid input is accidentally interpreted according to a different format.

`psa_destroy_key` (function)

psa_status_t psa_destroy_key(psa_key_handle_t handle);

Parameters:

handle: Handle to the key to erase.

Returns: psa_status_t

PSA_SUCCESS: The key material has been erased.
PSA_ERROR_NOT_PERMITTED: The key cannot be erased because it is read-only, either due to a policy or due to physical restrictions.
PSA_ERROR_INVALID_HANDLE
PSA_ERROR_COMMUNICATION_FAILURE: There was an failure in communication with the cryptoprocessor. The key material may still be present in the cryptoprocessor.
PSA_ERROR_STORAGE_FAILURE: The storage is corrupted. Implementations shall make a best effort to erase key material even in this stage, however applications should be aware that it may be impossible to guarantee that the key material is not recoverable in such cases.
PSA_ERROR_CORRUPTION_DETECTED: An unexpected condition which is not a storage corruption or a communication failure occurred. The cryptoprocessor may have been compromised.
PSA_ERROR_BAD_STATE: The library has not been previously initialized by psa_crypto_init(). It is implementation-dependent whether a failure to initialize results in this error code.

Description:

Destroy a key.

This function destroys a key from both volatile memory and, if applicable, non-volatile storage. Implementations shall make a best effort to ensure that that the key material cannot be recovered.

This function also erases any metadata such as policies and frees all resources associated with the key.

`psa_export_key` (function)

psa_status_t psa_export_key(psa_key_handle_t handle,
                            uint8_t * data,
                            size_t data_size,
                            size_t * data_length);

Parameters:

handle: Handle to the key to export.
data: Buffer where the key data is to be written.
data_size: Size of the data buffer in bytes.
data_length: On success, the number of bytes that make up the key data.

Returns: psa_status_t

PSA_SUCCESS
PSA_ERROR_INVALID_HANDLE
PSA_ERROR_DOES_NOT_EXIST
PSA_ERROR_NOT_PERMITTED: The key does not have the PSA_KEY_USAGE_EXPORT flag.
PSA_ERROR_NOT_SUPPORTED
PSA_ERROR_BUFFER_TOO_SMALL: The size of the data buffer is too small. You can determine a sufficient buffer size by calling PSA_KEY_EXPORT_MAX_SIZE(type, bits) where type is the key type and bits is the key size in bits.
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED
PSA_ERROR_BAD_STATE: The library has not been previously initialized by psa_crypto_init(). It is implementation-dependent whether a failure to initialize results in this error code.

Description:

Export a key in binary format.

The output of this function can be passed to psa_import_key() to create an equivalent object.

If the implementation of psa_import_key() supports other formats beyond the format specified here, the output from psa_export_key() must use the representation specified here, not the original representation.

For standard key types, the output format is as follows:

For symmetric keys (including MAC keys), the format is the raw bytes of the key.
For DES, the key data consists of 8 bytes. The parity bits must be correct.
For Triple-DES, the format is the concatenation of the two or three DES keys.

For RSA key pairs (PSA_KEY_TYPE_RSA_KEY_PAIR), the format is the non-encrypted DER encoding of the representation defined by PKCS#1 (RFC 8017) as RSAPrivateKey, version 0.

RSAPrivateKey ::= SEQUENCE {
    version             INTEGER,  -- must be 0
    modulus             INTEGER,  -- n
    publicExponent      INTEGER,  -- e
    privateExponent     INTEGER,  -- d
    prime1              INTEGER,  -- p
    prime2              INTEGER,  -- q
    exponent1           INTEGER,  -- d mod (p-1)
    exponent2           INTEGER,  -- d mod (q-1)
    coefficient         INTEGER,  -- (inverse of q) mod p
}

For elliptic curve key pairs (key types for which PSA_KEY_TYPE_IS_ECC_KEY_PAIR is true), the format is a representation of the private value as a ceiling(m/8)-byte string where m is the bit size associated with the curve, i.e. the bit size of the order of the curve’s coordinate field. This byte string is in little-endian order for Montgomery curves (curve types PSA_ECC_CURVE_CURVEXXX), and in big-endian order for Weierstrass curves (curve types PSA_ECC_CURVE_SECTXXX, PSA_ECC_CURVE_SECPXXX and PSA_ECC_CURVE_BRAINPOOL_PXXX). This is the content of the privateKey field of the ECPrivateKey format defined by RFC 5915.
For Diffie-Hellman key exchange key pairs (key types for which PSA_KEY_TYPE_IS_DH_KEY_PAIR is true), the format is the representation of the private key x as a big-endian byte string. The length of the byte string is the private key size in bytes (leading zeroes are not stripped).
For public keys (key types for which PSA_KEY_TYPE_IS_PUBLIC_KEY is true), the format is the same as for psa_export_public_key().

The policy on the key must have the usage flag PSA_KEY_USAGE_EXPORT set.

`psa_export_public_key` (function)

psa_status_t psa_export_public_key(psa_key_handle_t handle,
                                   uint8_t * data,
                                   size_t data_size,
                                   size_t * data_length);

Parameters:

handle: Handle to the key to export.
data: Buffer where the key data is to be written.
data_size: Size of the data buffer in bytes.
data_length: On success, the number of bytes that make up the key data.

Returns: psa_status_t

PSA_SUCCESS
PSA_ERROR_INVALID_HANDLE
PSA_ERROR_DOES_NOT_EXIST
PSA_ERROR_INVALID_ARGUMENT: The key is neither a public key nor a key pair.
PSA_ERROR_NOT_SUPPORTED
PSA_ERROR_BUFFER_TOO_SMALL: The size of the data buffer is too small. You can determine a sufficient buffer size by calling PSA_KEY_EXPORT_MAX_SIZE(PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(type), bits) where type is the key type and bits is the key size in bits.
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED
PSA_ERROR_BAD_STATE: The library has not been previously initialized by psa_crypto_init(). It is implementation-dependent whether a failure to initialize results in this error code.

Description:

Export a public key or the public part of a key pair in binary format.

The output of this function can be passed to psa_import_key() to create an object that is equivalent to the public key.

This specification supports a single format for each key type. Implementations may support other formats as long as the standard format is supported. Implementations that support other formats should ensure that the formats are clearly unambiguous so as to minimize the risk that an invalid input is accidentally interpreted according to a different format.

For standard key types, the output format is as follows:

For RSA public keys (PSA_KEY_TYPE_RSA_PUBLIC_KEY), the DER encoding of the representation defined by RFC 3279 §2.3.1 as RSAPublicKey.

RSAPublicKey ::= SEQUENCE {
   modulus            INTEGER,    -- n
   publicExponent     INTEGER  }  -- e

For elliptic curve public keys (key types for which PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY is true), the format is the uncompressed representation defined by SEC1 §2.3.3 as the content of an ECPoint. Let m be the bit size associated with the curve, i.e. the bit size of q for a curve over F_q. The representation consists of:
- The byte 0x04;
- x_P as a ceiling(m/8)-byte string, big-endian;
- y_P as a ceiling(m/8)-byte string, big-endian.
For Diffie-Hellman key exchange public keys (key types for which PSA_KEY_TYPE_IS_DH_PUBLIC_KEY is true), the format is the representation of the public key y = g^x mod p as a big-endian byte string. The length of the byte string is the length of the base prime p in bytes.

Exporting a public key object or the public part of a key pair is always permitted, regardless of the key’s usage flags.

`psa_copy_key` (function)

psa_status_t psa_copy_key(psa_key_handle_t source_handle,
                          const psa_key_attributes_t * attributes,
                          psa_key_handle_t * target_handle);

Parameters:

source_handle

The key to copy. It must be a valid key handle.

attributes

The attributes for the new key. They are used as follows:

The key type and size may be 0. If either is nonzero, it must match the corresponding attribute of the source key.
The key location (the lifetime and, for persistent keys, the key identifier) is used directly.
The policy constraints (usage flags and algorithm policy) are combined from the source key and attributes so that both sets of restrictions apply, as described in the documentation of this function.

target_handle

On success, a handle to the newly created key. 0 on failure.

Returns: psa_status_t

PSA_SUCCESS
PSA_ERROR_INVALID_HANDLE: source_handle is invalid.
PSA_ERROR_ALREADY_EXISTS: This is an attempt to create a persistent key, and there is already a persistent key with the given identifier.
PSA_ERROR_INVALID_ARGUMENT: The lifetime or identifier in attributes are invalid.
PSA_ERROR_INVALID_ARGUMENT: The policy constraints on the source and specified in attributes are incompatible.
PSA_ERROR_INVALID_ARGUMENT: attributes specifies a key type or key size which does not match the attributes of the source key.
PSA_ERROR_NOT_PERMITTED: The source key does not have the PSA_KEY_USAGE_COPY usage flag.
PSA_ERROR_NOT_PERMITTED: The source key is not exportable and its lifetime does not allow copying it to the target’s lifetime.
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_INSUFFICIENT_STORAGE
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Make a copy of a key.

Copy key material from one location to another.

This function is primarily useful to copy a key from one location to another, since it populates a key using the material from another key which may have a different lifetime.

This function may be used to share a key with a different party, subject to implementation-defined restrictions on key sharing.

The policy on the source key must have the usage flag PSA_KEY_USAGE_COPY set. This flag is sufficient to permit the copy if the key has the lifetime PSA_KEY_LIFETIME_VOLATILE or PSA_KEY_LIFETIME_PERSISTENT. Some secure elements do not provide a way to copy a key without making it extractable from the secure element. If a key is located in such a secure element, then the key must have both usage flags PSA_KEY_USAGE_COPY and PSA_KEY_USAGE_EXPORT in order to make a copy of the key outside the secure element.

The resulting key may only be used in a way that conforms to both the policy of the original key and the policy specified in the attributes parameter:

The usage flags on the resulting key are the bitwise-and of the usage flags on the source policy and the usage flags in attributes.
If both allow the same algorithm or wildcard-based algorithm policy, the resulting key has the same algorithm policy.
If either of the policies allows an algorithm and the other policy allows a wildcard-based algorithm policy that includes this algorithm, the resulting key allows the same algorithm.
If the policies do not allow any algorithm in common, this function fails with the status PSA_ERROR_INVALID_ARGUMENT.

The effect of this function on implementation-defined attributes is implementation-defined.

Message digests

`psa_hash_operation_t` (type)

typedef struct psa_hash_operation_s psa_hash_operation_t;

The type of the state data structure for multipart hash operations.

Before calling any function on a hash operation object, the application must initialize it by any of the following means:

Set the structure to all-bits-zero, for example:

psa_hash_operation_t operation;
memset(&operation, 0, sizeof(operation));

Initialize the structure to logical zero values, for example:
```
psa_hash_operation_t operation = {0};
```
Initialize the structure to the initializer PSA_HASH_OPERATION_INIT, for example:
```
psa_hash_operation_t operation = PSA_HASH_OPERATION_INIT;
```
Assign the result of the function psa_hash_operation_init() to the structure, for example:
```
psa_hash_operation_t operation;
operation = psa_hash_operation_init();
```

This is an implementation-defined struct. Applications should not make any assumptions about the content of this structure except as directed by the documentation of a specific implementation.

`PSA_HASH_OPERATION_INIT` (macro)

#define PSA_HASH_OPERATION_INIT  {0}

This macro returns a suitable initializer for a hash operation object of type psa_hash_operation_t.

`psa_hash_compute` (function)

psa_status_t psa_hash_compute(psa_algorithm_t alg,
                              const uint8_t * input,
                              size_t input_length,
                              uint8_t * hash,
                              size_t hash_size,
                              size_t * hash_length);

Parameters:

alg: The hash algorithm to compute (PSA_ALG_XXX value such that PSA_ALG_IS_HASH(alg) is true).
input: Buffer containing the message to hash.
input_length: Size of the input buffer in bytes.
hash: Buffer where the hash is to be written.
hash_size: Size of the hash buffer in bytes.
hash_length: On success, the number of bytes that make up the hash value. This is always PSA_HASH_SIZE(alg).

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_NOT_SUPPORTED: alg is not supported or is not a hash algorithm.
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Calculate the hash (digest) of a message.

Note

To verify the hash of a message against an expected value, use psa_hash_compare() instead.

`psa_hash_compare` (function)

psa_status_t psa_hash_compare(psa_algorithm_t alg,
                              const uint8_t * input,
                              size_t input_length,
                              const uint8_t * hash,
                              const size_t hash_length);

Parameters:

alg: The hash algorithm to compute (PSA_ALG_XXX value such that PSA_ALG_IS_HASH(alg) is true).
input: Buffer containing the message to hash.
input_length: Size of the input buffer in bytes.
hash: Buffer containing the expected hash value.
hash_length: Size of the hash buffer in bytes.

Returns: psa_status_t

PSA_SUCCESS: The expected hash is identical to the actual hash of the input.
PSA_ERROR_INVALID_SIGNATURE: The hash of the message was calculated successfully, but it differs from the expected hash.
PSA_ERROR_NOT_SUPPORTED: alg is not supported or is not a hash algorithm.
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Calculate the hash (digest) of a message and compare it with a reference value.

`psa_hash_operation_init` (function)

psa_hash_operation_t psa_hash_operation_init(void);

Returns: psa_hash_operation_t

Description:

Return an initial value for a hash operation object.

`psa_hash_setup` (function)

psa_status_t psa_hash_setup(psa_hash_operation_t * operation,
                            psa_algorithm_t alg);

Parameters:

operation: The operation object to set up. It must have been initialized as per the documentation for psa_hash_operation_t and not yet in use.
alg: The hash algorithm to compute (PSA_ALG_XXX value such that PSA_ALG_IS_HASH(alg) is true).

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_NOT_SUPPORTED: alg is not supported or is not a hash algorithm.
PSA_ERROR_BAD_STATE: The operation state is not valid (already set up and not subsequently completed).
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Set up a multipart hash operation.

The sequence of operations to calculate a hash (message digest) is as follows:

Allocate an operation object which will be passed to all the functions listed here.
Initialize the operation object with one of the methods described in the documentation for psa_hash_operation_t, e.g. PSA_HASH_OPERATION_INIT.
Call psa_hash_setup() to specify the algorithm.
Call psa_hash_update() zero, one or more times, passing a fragment of the message each time. The hash that is calculated is the hash of the concatenation of these messages in order.
To calculate the hash, call psa_hash_finish(). To compare the hash with an expected value, call psa_hash_verify().

The application may call psa_hash_abort() at any time after the operation has been initialized.

After a successful call to psa_hash_setup(), the application must eventually terminate the operation. The following events terminate an operation:

A failed call to psa_hash_update().
A call to psa_hash_finish(), psa_hash_verify() or psa_hash_abort().

`psa_hash_update` (function)

psa_status_t psa_hash_update(psa_hash_operation_t * operation,
                             const uint8_t * input,
                             size_t input_length);

Parameters:

operation: Active hash operation.
input: Buffer containing the message fragment to hash.
input_length: Size of the input buffer in bytes.

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_BAD_STATE: The operation state is not valid (not set up, or already completed).
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Add a message fragment to a multipart hash operation.

The application must call psa_hash_setup() before calling this function.

If this function returns an error status, the operation becomes inactive.

`psa_hash_finish` (function)

psa_status_t psa_hash_finish(psa_hash_operation_t * operation,
                             uint8_t * hash,
                             size_t hash_size,
                             size_t * hash_length);

Parameters:

operation: Active hash operation.
hash: Buffer where the hash is to be written.
hash_size: Size of the hash buffer in bytes.
hash_length: On success, the number of bytes that make up the hash value. This is always PSA_HASH_SIZE(alg) where alg is the hash algorithm that is calculated.

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_BAD_STATE: The operation state is not valid (not set up, or already completed).
PSA_ERROR_BUFFER_TOO_SMALL: The size of the hash buffer is too small. You can determine a sufficient buffer size by calling PSA_HASH_SIZE(alg) where alg is the hash algorithm that is calculated.
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Finish the calculation of the hash of a message.

The application must call psa_hash_setup() before calling this function. This function calculates the hash of the message formed by concatenating the inputs passed to preceding calls to psa_hash_update().

When this function returns, the operation becomes inactive.

Warning

Applications should not call this function if they expect a specific value for the hash. Call psa_hash_verify() instead. Beware that comparing integrity or authenticity data such as hash values with a function such as memcmp is risky because the time taken by the comparison may leak information about the hashed data which could allow an attacker to guess a valid hash and thereby bypass security controls.

`psa_hash_verify` (function)

psa_status_t psa_hash_verify(psa_hash_operation_t * operation,
                             const uint8_t * hash,
                             size_t hash_length);

Parameters:

operation: Active hash operation.
hash: Buffer containing the expected hash value.
hash_length: Size of the hash buffer in bytes.

Returns: psa_status_t

PSA_SUCCESS: The expected hash is identical to the actual hash of the message.
PSA_ERROR_INVALID_SIGNATURE: The hash of the message was calculated successfully, but it differs from the expected hash.
PSA_ERROR_BAD_STATE: The operation state is not valid (not set up, or already completed).
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Finish the calculation of the hash of a message and compare it with an expected value.

The application must call psa_hash_setup() before calling this function. This function calculates the hash of the message formed by concatenating the inputs passed to preceding calls to psa_hash_update(). It then compares the calculated hash with the expected hash passed as a parameter to this function.

When this function returns, the operation becomes inactive.

Note

Implementations shall make the best effort to ensure that the comparison between the actual hash and the expected hash is performed in constant time.

`psa_hash_abort` (function)

psa_status_t psa_hash_abort(psa_hash_operation_t * operation);

Parameters:

operation: Initialized hash operation.

Returns: psa_status_t

PSA_SUCCESS
PSA_ERROR_BAD_STATE: operation is not an active hash operation.
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Abort a hash operation.

Aborting an operation frees all associated resources except for the operation structure itself. Once aborted, the operation object can be reused for another operation by calling psa_hash_setup() again.

You may call this function any time after the operation object has been initialized by any of the following methods:

A call to psa_hash_setup(), whether it succeeds or not.
Initializing the struct to all-bits-zero.
Initializing the struct to logical zeros, e.g. psa_hash_operation_t operation = {0}.

In particular, calling psa_hash_abort() after the operation has been terminated by a call to psa_hash_abort(), psa_hash_finish() or psa_hash_verify() is safe and has no effect.

`psa_hash_clone` (function)

psa_status_t psa_hash_clone(const psa_hash_operation_t * source_operation,
                            psa_hash_operation_t * target_operation);

Parameters:

source_operation: The active hash operation to clone.
target_operation: The operation object to set up. It must be initialized but not active.

Returns: psa_status_t

PSA_SUCCESS
PSA_ERROR_BAD_STATE: source_operation is not an active hash operation.
PSA_ERROR_BAD_STATE: target_operation is active.
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Clone a hash operation.

This function copies the state of an ongoing hash operation to a new operation object. In other words, this function is equivalent to calling psa_hash_setup() on target_operation with the same algorithm that source_operation was set up for, then psa_hash_update() on target_operation with the same input that that was passed to source_operation. After this function returns, the two objects are independent, i.e. subsequent calls involving one of the objects do not affect the other object.

Message authentication codes

`psa_mac_operation_t` (type)

typedef struct psa_mac_operation_s psa_mac_operation_t;

The type of the state data structure for multipart MAC operations.

Before calling any function on a MAC operation object, the application must initialize it by any of the following means:

Set the structure to all-bits-zero, for example:

psa_mac_operation_t operation;
memset(&operation, 0, sizeof(operation));

Initialize the structure to logical zero values, for example:
```
psa_mac_operation_t operation = {0};
```
Initialize the structure to the initializer PSA_MAC_OPERATION_INIT, for example:
```
psa_mac_operation_t operation = PSA_MAC_OPERATION_INIT;
```
Assign the result of the function psa_mac_operation_init() to the structure, for example:
```
psa_mac_operation_t operation;
operation = psa_mac_operation_init();
```

This is an implementation-defined struct. Applications should not make any assumptions about the content of this structure except as directed by the documentation of a specific implementation.

`PSA_MAC_OPERATION_INIT` (macro)

#define PSA_MAC_OPERATION_INIT  {0}

This macro returns a suitable initializer for a MAC operation object of type psa_mac_operation_t.

`psa_mac_compute` (function)

psa_status_t psa_mac_compute(psa_key_handle_t handle,
                             psa_algorithm_t alg,
                             const uint8_t * input,
                             size_t input_length,
                             uint8_t * mac,
                             size_t mac_size,
                             size_t * mac_length);

Parameters:

handle: Handle to the key to use for the operation.
alg: The MAC algorithm to compute (PSA_ALG_XXX value such that PSA_ALG_IS_MAC(alg) is true).
input: Buffer containing the input message.
input_length: Size of the input buffer in bytes.
mac: Buffer where the MAC value is to be written.
mac_size: Size of the mac buffer in bytes.
mac_length: On success, the number of bytes that make up the MAC value.

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_INVALID_HANDLE
PSA_ERROR_NOT_PERMITTED
PSA_ERROR_INVALID_ARGUMENT: handle is not compatible with alg.
PSA_ERROR_NOT_SUPPORTED: alg is not supported or is not a MAC algorithm.
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED
PSA_ERROR_BAD_STATE: The library has not been previously initialized by psa_crypto_init(). It is implementation-dependent whether a failure to initialize results in this error code.

Description:

Calculate the MAC (message authentication code) of a message.

Note

To verify the MAC of a message against an expected value, use psa_mac_verify() instead. Beware that comparing integrity or authenticity data such as MAC values with a function such as memcmp is risky because the time taken by the comparison may leak information about the MAC value which could allow an attacker to guess a valid MAC and thereby bypass security controls.

`psa_mac_verify` (function)

psa_status_t psa_mac_verify(psa_key_handle_t handle,
                            psa_algorithm_t alg,
                            const uint8_t * input,
                            size_t input_length,
                            const uint8_t * mac,
                            const size_t mac_length);

Parameters:

handle: Handle to the key to use for the operation.
alg: The MAC algorithm to compute (PSA_ALG_XXX value such that PSA_ALG_IS_MAC(alg) is true).
input: Buffer containing the input message.
input_length: Size of the input buffer in bytes.
mac: Buffer containing the expected MAC value.
mac_length: Size of the mac buffer in bytes.

Returns: psa_status_t

PSA_SUCCESS: The expected MAC is identical to the actual MAC of the input.
PSA_ERROR_INVALID_SIGNATURE: The MAC of the message was calculated successfully, but it differs from the expected value.
PSA_ERROR_INVALID_HANDLE
PSA_ERROR_NOT_PERMITTED
PSA_ERROR_INVALID_ARGUMENT: handle is not compatible with alg.
PSA_ERROR_NOT_SUPPORTED: alg is not supported or is not a MAC algorithm.
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Calculate the MAC of a message and compare it with a reference value.

`psa_mac_operation_init` (function)

psa_mac_operation_t psa_mac_operation_init(void);

Returns: psa_mac_operation_t

Description:

Return an initial value for a MAC operation object.

`psa_mac_sign_setup` (function)

psa_status_t psa_mac_sign_setup(psa_mac_operation_t * operation,
                                psa_key_handle_t handle,
                                psa_algorithm_t alg);

Parameters:

operation: The operation object to set up. It must have been initialized as per the documentation for psa_mac_operation_t and not yet in use.
handle: Handle to the key to use for the operation. It must remain valid until the operation terminates.
alg: The MAC algorithm to compute (PSA_ALG_XXX value such that PSA_ALG_IS_MAC(alg) is true).

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_INVALID_HANDLE
PSA_ERROR_DOES_NOT_EXIST
PSA_ERROR_NOT_PERMITTED
PSA_ERROR_INVALID_ARGUMENT: handle is not compatible with alg.
PSA_ERROR_NOT_SUPPORTED: alg is not supported or is not a MAC algorithm.
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED
PSA_ERROR_BAD_STATE: The operation state is not valid (already set up and not subsequently completed).
PSA_ERROR_BAD_STATE: The library has not been previously initialized by psa_crypto_init(). It is implementation-dependent whether a failure to initialize results in this error code.

Description:

Set up a multipart MAC calculation operation.

This function sets up the calculation of the MAC (message authentication code) of a byte string. To verify the MAC of a message against an expected value, use psa_mac_verify_setup() instead.

The sequence of operations to calculate a MAC is as follows:

Allocate an operation object which will be passed to all the functions listed here.
Initialize the operation object with one of the methods described in the documentation for psa_mac_operation_t, e.g. PSA_MAC_OPERATION_INIT.
Call psa_mac_sign_setup() to specify the algorithm and key.
Call psa_mac_update() zero, one or more times, passing a fragment of the message each time. The MAC that is calculated is the MAC of the concatenation of these messages in order.
At the end of the message, call psa_mac_sign_finish() to finish calculating the MAC value and retrieve it.

The application may call psa_mac_abort() at any time after the operation has been initialized.

After a successful call to psa_mac_sign_setup(), the application must eventually terminate the operation through one of the following methods:

A failed call to psa_mac_update().
A call to psa_mac_sign_finish() or psa_mac_abort().

`psa_mac_verify_setup` (function)

psa_status_t psa_mac_verify_setup(psa_mac_operation_t * operation,
                                  psa_key_handle_t handle,
                                  psa_algorithm_t alg);

Parameters:

operation: The operation object to set up. It must have been initialized as per the documentation for psa_mac_operation_t and not yet in use.
handle: Handle to the key to use for the operation. It must remain valid until the operation terminates.
alg: The MAC algorithm to compute (PSA_ALG_XXX value such that PSA_ALG_IS_MAC(alg) is true).

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_INVALID_HANDLE
PSA_ERROR_DOES_NOT_EXIST
PSA_ERROR_NOT_PERMITTED
PSA_ERROR_INVALID_ARGUMENT: key is not compatible with alg.
PSA_ERROR_NOT_SUPPORTED: alg is not supported or is not a MAC algorithm.
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED
PSA_ERROR_BAD_STATE: The operation state is not valid (already set up and not subsequently completed).
PSA_ERROR_BAD_STATE: The library has not been previously initialized by psa_crypto_init(). It is implementation-dependent whether a failure to initialize results in this error code.

Description:

Set up a multipart MAC verification operation.

This function sets up the verification of the MAC (message authentication code) of a byte string against an expected value.

The sequence of operations to verify a MAC is as follows:

Allocate an operation object which will be passed to all the functions listed here.
Initialize the operation object with one of the methods described in the documentation for psa_mac_operation_t, e.g. PSA_MAC_OPERATION_INIT.
Call psa_mac_verify_setup() to specify the algorithm and key.
Call psa_mac_update() zero, one or more times, passing a fragment of the message each time. The MAC that is calculated is the MAC of the concatenation of these messages in order.
At the end of the message, call psa_mac_verify_finish() to finish calculating the actual MAC of the message and verify it against the expected value.

The application may call psa_mac_abort() at any time after the operation has been initialized.

After a successful call to psa_mac_verify_setup(), the application must eventually terminate the operation through one of the following methods:

A failed call to psa_mac_update().
A call to psa_mac_verify_finish() or psa_mac_abort().

`psa_mac_update` (function)

psa_status_t psa_mac_update(psa_mac_operation_t * operation,
                            const uint8_t * input,
                            size_t input_length);

Parameters:

operation: Active MAC operation.
input: Buffer containing the message fragment to add to the MAC calculation.
input_length: Size of the input buffer in bytes.

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_BAD_STATE: The operation state is not valid (not set up, or already completed).
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Add a message fragment to a multipart MAC operation.

The application must call psa_mac_sign_setup() or psa_mac_verify_setup() before calling this function.

If this function returns an error status, the operation becomes inactive.

`psa_mac_sign_finish` (function)

psa_status_t psa_mac_sign_finish(psa_mac_operation_t * operation,
                                 uint8_t * mac,
                                 size_t mac_size,
                                 size_t * mac_length);

Parameters:

operation: Active MAC operation.
mac: Buffer where the MAC value is to be written.
mac_size: Size of the mac buffer in bytes.
mac_length: On success, the number of bytes that make up the MAC value. This is always PSA_MAC_FINAL_SIZE(key_type, key_bits, alg) where key_type and key_bits are the type and bit-size respectively of the key and alg is the MAC algorithm that is calculated.

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_BAD_STATE: The operation state is not valid (not set up, or already completed).
PSA_ERROR_BUFFER_TOO_SMALL: The size of the mac buffer is too small. You can determine a sufficient buffer size by calling PSA_MAC_FINAL_SIZE().
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Finish the calculation of the MAC of a message.

The application must call psa_mac_sign_setup() before calling this function. This function calculates the MAC of the message formed by concatenating the inputs passed to preceding calls to psa_mac_update().

When this function returns, the operation becomes inactive.

Warning

Applications should not call this function if they expect a specific value for the MAC. Call psa_mac_verify_finish() instead. Beware that comparing integrity or authenticity data such as MAC values with a function such as memcmp is risky because the time taken by the comparison may leak information about the MAC value which could allow an attacker to guess a valid MAC and thereby bypass security controls.

`psa_mac_verify_finish` (function)

psa_status_t psa_mac_verify_finish(psa_mac_operation_t * operation,
                                   const uint8_t * mac,
                                   size_t mac_length);

Parameters:

operation: Active MAC operation.
mac: Buffer containing the expected MAC value.
mac_length: Size of the mac buffer in bytes.

Returns: psa_status_t

PSA_SUCCESS: The expected MAC is identical to the actual MAC of the message.
PSA_ERROR_INVALID_SIGNATURE: The MAC of the message was calculated successfully, but it differs from the expected MAC.
PSA_ERROR_BAD_STATE: The operation state is not valid (not set up, or already completed).
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Finish the calculation of the MAC of a message and compare it with an expected value.

The application must call psa_mac_verify_setup() before calling this function. This function calculates the MAC of the message formed by concatenating the inputs passed to preceding calls to psa_mac_update(). It then compares the calculated MAC with the expected MAC passed as a parameter to this function.

When this function returns, the operation becomes inactive.

Note

Implementations shall make the best effort to ensure that the comparison between the actual MAC and the expected MAC is performed in constant time.

`psa_mac_abort` (function)

psa_status_t psa_mac_abort(psa_mac_operation_t * operation);

Parameters:

operation: Initialized MAC operation.

Returns: psa_status_t

PSA_SUCCESS
PSA_ERROR_BAD_STATE: operation is not an active MAC operation.
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Abort a MAC operation.

Aborting an operation frees all associated resources except for the operation structure itself. Once aborted, the operation object can be reused for another operation by calling psa_mac_sign_setup() or psa_mac_verify_setup() again.

You may call this function any time after the operation object has been initialized by any of the following methods:

A call to psa_mac_sign_setup() or psa_mac_verify_setup(), whether it succeeds or not.
Initializing the struct to all-bits-zero.
Initializing the struct to logical zeros, e.g. psa_mac_operation_t operation = {0}.

In particular, calling psa_mac_abort() after the operation has been terminated by a call to psa_mac_abort(), psa_mac_sign_finish() or psa_mac_verify_finish() is safe and has no effect.

Symmetric ciphers

`psa_cipher_operation_t` (type)

typedef struct psa_cipher_operation_s psa_cipher_operation_t;

The type of the state data structure for multipart cipher operations.

Before calling any function on a cipher operation object, the application must initialize it by any of the following means:

Set the structure to all-bits-zero, for example:

psa_cipher_operation_t operation;
memset(&operation, 0, sizeof(operation));

Initialize the structure to logical zero values, for example:
```
psa_cipher_operation_t operation = {0};
```
Initialize the structure to the initializer PSA_CIPHER_OPERATION_INIT, for example:
```
psa_cipher_operation_t operation = PSA_CIPHER_OPERATION_INIT;
```
Assign the result of the function psa_cipher_operation_init() to the structure, for example:
```
psa_cipher_operation_t operation;
operation = psa_cipher_operation_init();
```

This is an implementation-defined struct. Applications should not make any assumptions about the content of this structure except as directed by the documentation of a specific implementation.

`PSA_CIPHER_OPERATION_INIT` (macro)

#define PSA_CIPHER_OPERATION_INIT  {0}

This macro returns a suitable initializer for a cipher operation object of type psa_cipher_operation_t.

`psa_cipher_encrypt` (function)

psa_status_t psa_cipher_encrypt(psa_key_handle_t handle,
                                psa_algorithm_t alg,
                                const uint8_t * input,
                                size_t input_length,
                                uint8_t * output,
                                size_t output_size,
                                size_t * output_length);

Parameters:

handle: Handle to the key to use for the operation. It must remain valid until the operation terminates.
alg: The cipher algorithm to compute (PSA_ALG_XXX value such that PSA_ALG_IS_CIPHER(alg) is true).
input: Buffer containing the message to encrypt.
input_length: Size of the input buffer in bytes.
output: Buffer where the output is to be written. The output contains the IV followed by the ciphertext proper.
output_size: Size of the output buffer in bytes.
output_length: On success, the number of bytes that make up the output.

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_INVALID_HANDLE
PSA_ERROR_NOT_PERMITTED
PSA_ERROR_INVALID_ARGUMENT: handle is not compatible with alg.
PSA_ERROR_NOT_SUPPORTED: alg is not supported or is not a cipher algorithm.
PSA_ERROR_BUFFER_TOO_SMALL
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Encrypt a message using a symmetric cipher.

This function encrypts a message with a random IV (initialization vector).

`psa_cipher_decrypt` (function)

psa_status_t psa_cipher_decrypt(psa_key_handle_t handle,
                                psa_algorithm_t alg,
                                const uint8_t * input,
                                size_t input_length,
                                uint8_t * output,
                                size_t output_size,
                                size_t * output_length);

Parameters:

handle: Handle to the key to use for the operation. It must remain valid until the operation terminates.
alg: The cipher algorithm to compute (PSA_ALG_XXX value such that PSA_ALG_IS_CIPHER(alg) is true).
input: Buffer containing the message to decrypt. This consists of the IV followed by the ciphertext proper.
input_length: Size of the input buffer in bytes.
output: Buffer where the plaintext is to be written.
output_size: Size of the output buffer in bytes.
output_length: On success, the number of bytes that make up the output.

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_INVALID_HANDLE
PSA_ERROR_NOT_PERMITTED
PSA_ERROR_INVALID_ARGUMENT: handle is not compatible with alg.
PSA_ERROR_NOT_SUPPORTED: alg is not supported or is not a cipher algorithm.
PSA_ERROR_BUFFER_TOO_SMALL
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Decrypt a message using a symmetric cipher.

This function decrypts a message encrypted with a symmetric cipher.

`psa_cipher_operation_init` (function)

psa_cipher_operation_t psa_cipher_operation_init(void);

Returns: psa_cipher_operation_t

Description:

Return an initial value for a cipher operation object.

`psa_cipher_encrypt_setup` (function)

psa_status_t psa_cipher_encrypt_setup(psa_cipher_operation_t * operation,
                                      psa_key_handle_t handle,
                                      psa_algorithm_t alg);

Parameters:

operation: The operation object to set up. It must have been initialized as per the documentation for psa_cipher_operation_t and not yet in use.
handle: Handle to the key to use for the operation. It must remain valid until the operation terminates.
alg: The cipher algorithm to compute (PSA_ALG_XXX value such that PSA_ALG_IS_CIPHER(alg) is true).

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_INVALID_HANDLE
PSA_ERROR_DOES_NOT_EXIST
PSA_ERROR_NOT_PERMITTED
PSA_ERROR_INVALID_ARGUMENT: handle is not compatible with alg.
PSA_ERROR_NOT_SUPPORTED: alg is not supported or is not a cipher algorithm.
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED
PSA_ERROR_BAD_STATE: The operation state is not valid (already set up and not subsequently completed).
PSA_ERROR_BAD_STATE: The library has not been previously initialized by psa_crypto_init(). It is implementation-dependent whether a failure to initialize results in this error code.

Description:

Set the key for a multipart symmetric encryption operation.

The sequence of operations to encrypt a message with a symmetric cipher is as follows:

Allocate an operation object which will be passed to all the functions listed here.
Initialize the operation object with one of the methods described in the documentation for psa_cipher_operation_t, e.g. PSA_CIPHER_OPERATION_INIT.
Call psa_cipher_encrypt_setup() to specify the algorithm and key.
Call either psa_cipher_generate_iv() or psa_cipher_set_iv() to generate or set the IV (initialization vector). You should use psa_cipher_generate_iv() unless the protocol you are implementing requires a specific IV value.
Call psa_cipher_update() zero, one or more times, passing a fragment of the message each time.
Call psa_cipher_finish().

The application may call psa_cipher_abort() at any time after the operation has been initialized.

After a successful call to psa_cipher_encrypt_setup(), the application must eventually terminate the operation. The following events terminate an operation:

A failed call to any of the psa_cipher_xxx functions.
A call to psa_cipher_finish() or psa_cipher_abort().

`psa_cipher_decrypt_setup` (function)

psa_status_t psa_cipher_decrypt_setup(psa_cipher_operation_t * operation,
                                      psa_key_handle_t handle,
                                      psa_algorithm_t alg);

Parameters:

operation: The operation object to set up. It must have been initialized as per the documentation for psa_cipher_operation_t and not yet in use.
handle: Handle to the key to use for the operation. It must remain valid until the operation terminates.
alg: The cipher algorithm to compute (PSA_ALG_XXX value such that PSA_ALG_IS_CIPHER(alg) is true).

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_INVALID_HANDLE
PSA_ERROR_DOES_NOT_EXIST
PSA_ERROR_NOT_PERMITTED
PSA_ERROR_INVALID_ARGUMENT: handle is not compatible with alg.
PSA_ERROR_NOT_SUPPORTED: alg is not supported or is not a cipher algorithm.
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED
PSA_ERROR_BAD_STATE: The operation state is not valid (already set up and not subsequently completed).
PSA_ERROR_BAD_STATE: The library has not been previously initialized by psa_crypto_init(). It is implementation-dependent whether a failure to initialize results in this error code.

Description:

Set the key for a multipart symmetric decryption operation.

The sequence of operations to decrypt a message with a symmetric cipher is as follows:

Allocate an operation object which will be passed to all the functions listed here.
Initialize the operation object with one of the methods described in the documentation for psa_cipher_operation_t, e.g. PSA_CIPHER_OPERATION_INIT.
Call psa_cipher_decrypt_setup() to specify the algorithm and key.
Call psa_cipher_set_iv() with the IV (initialization vector) for the decryption. If the IV is prepended to the ciphertext, you can call psa_cipher_update() on a buffer containing the IV followed by the beginning of the message.
Call psa_cipher_update() zero, one or more times, passing a fragment of the message each time.
Call psa_cipher_finish().

The application may call psa_cipher_abort() at any time after the operation has been initialized.

After a successful call to psa_cipher_decrypt_setup(), the application must eventually terminate the operation. The following events terminate an operation:

A failed call to any of the psa_cipher_xxx functions.
A call to psa_cipher_finish() or psa_cipher_abort().

`psa_cipher_generate_iv` (function)

psa_status_t psa_cipher_generate_iv(psa_cipher_operation_t * operation,
                                    unsigned char * iv,
                                    size_t iv_size,
                                    size_t * iv_length);

Parameters:

operation: Active cipher operation.
iv: Buffer where the generated IV is to be written.
iv_size: Size of the iv buffer in bytes.
iv_length: On success, the number of bytes of the generated IV.

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_BAD_STATE: The operation state is not valid (not set up, or IV already set).
PSA_ERROR_BUFFER_TOO_SMALL: The size of the iv buffer is too small.
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Generate an IV for a symmetric encryption operation.

This function generates a random IV (initialization vector), nonce or initial counter value for the encryption operation as appropriate for the chosen algorithm, key type and key size.

The application must call psa_cipher_encrypt_setup() before calling this function.

If this function returns an error status, the operation becomes inactive.

`psa_cipher_set_iv` (function)

psa_status_t psa_cipher_set_iv(psa_cipher_operation_t * operation,
                               const unsigned char * iv,
                               size_t iv_length);

Parameters:

operation: Active cipher operation.
iv: Buffer containing the IV to use.
iv_length: Size of the IV in bytes.

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_BAD_STATE: The operation state is not valid (not set up, or IV already set).
PSA_ERROR_INVALID_ARGUMENT: The size of iv is not acceptable for the chosen algorithm, or the chosen algorithm does not use an IV.
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Set the IV for a symmetric encryption or decryption operation.

This function sets the IV (initialization vector), nonce or initial counter value for the encryption or decryption operation.

The application must call psa_cipher_encrypt_setup() before calling this function.

If this function returns an error status, the operation becomes inactive.

Note

When encrypting, applications should use psa_cipher_generate_iv() instead of this function, unless implementing a protocol that requires a non-random IV.

`psa_cipher_update` (function)

psa_status_t psa_cipher_update(psa_cipher_operation_t * operation,
                               const uint8_t * input,
                               size_t input_length,
                               unsigned char * output,
                               size_t output_size,
                               size_t * output_length);

Parameters:

operation: Active cipher operation.
input: Buffer containing the message fragment to encrypt or decrypt.
input_length: Size of the input buffer in bytes.
output: Buffer where the output is to be written.
output_size: Size of the output buffer in bytes.
output_length: On success, the number of bytes that make up the returned output.

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_BAD_STATE: The operation state is not valid (not set up, IV required but not set, or already completed).
PSA_ERROR_BUFFER_TOO_SMALL: The size of the output buffer is too small.
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Encrypt or decrypt a message fragment in an active cipher operation.

Before calling this function, you must:

Call either psa_cipher_encrypt_setup() or psa_cipher_decrypt_setup(). The choice of setup function determines whether this function encrypts or decrypts its input.
If the algorithm requires an IV, call psa_cipher_generate_iv() (recommended when encrypting) or psa_cipher_set_iv().

If this function returns an error status, the operation becomes inactive.

`psa_cipher_finish` (function)

psa_status_t psa_cipher_finish(psa_cipher_operation_t * operation,
                               uint8_t * output,
                               size_t output_size,
                               size_t * output_length);

Parameters:

operation: Active cipher operation.
output: Buffer where the output is to be written.
output_size: Size of the output buffer in bytes.
output_length: On success, the number of bytes that make up the returned output.

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_BAD_STATE: The operation state is not valid (not set up, IV required but not set, or already completed).
PSA_ERROR_BUFFER_TOO_SMALL: The size of the output buffer is too small.
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Finish encrypting or decrypting a message in a cipher operation.

The application must call psa_cipher_encrypt_setup() or psa_cipher_decrypt_setup() before calling this function. The choice of setup function determines whether this function encrypts or decrypts its input.

This function finishes the encryption or decryption of the message formed by concatenating the inputs passed to preceding calls to psa_cipher_update().

When this function returns, the operation becomes inactive.

`psa_cipher_abort` (function)

psa_status_t psa_cipher_abort(psa_cipher_operation_t * operation);

Parameters:

operation: Initialized cipher operation.

Returns: psa_status_t

PSA_SUCCESS
PSA_ERROR_BAD_STATE: operation is not an active cipher operation.
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Abort a cipher operation.

Aborting an operation frees all associated resources except for the operation structure itself. Once aborted, the operation object can be reused for another operation by calling psa_cipher_encrypt_setup() or psa_cipher_decrypt_setup() again.

You may call this function any time after the operation object has been initialized by any of the following methods:

A call to psa_cipher_encrypt_setup() or psa_cipher_decrypt_setup(), whether it succeeds or not.
Initializing the struct to all-bits-zero.
Initializing the struct to logical zeros, e.g. psa_cipher_operation_t operation = {0}.

In particular, calling psa_cipher_abort() after the operation has been terminated by a call to psa_cipher_abort() or psa_cipher_finish() is safe and has no effect.

Authenticated encryption with associated data (AEAD)

`psa_aead_operation_t` (type)

typedef struct psa_aead_operation_s psa_aead_operation_t;

The type of the state data structure for multipart AEAD operations.

Before calling any function on an AEAD operation object, the application must initialize it by any of the following means:

Set the structure to all-bits-zero, for example:

psa_aead_operation_t operation;
memset(&operation, 0, sizeof(operation));

Initialize the structure to logical zero values, for example:
```
psa_aead_operation_t operation = {0};
```
Initialize the structure to the initializer PSA_AEAD_OPERATION_INIT, for example:
```
psa_aead_operation_t operation = PSA_AEAD_OPERATION_INIT;
```
Assign the result of the function psa_aead_operation_init() to the structure, for example:
```
psa_aead_operation_t operation;
operation = psa_aead_operation_init();
```

This is an implementation-defined struct. Applications should not make any assumptions about the content of this structure except as directed by the documentation of a specific implementation.

`PSA_AEAD_OPERATION_INIT` (macro)

#define PSA_AEAD_OPERATION_INIT  {0}

This macro returns a suitable initializer for an AEAD operation object of type psa_aead_operation_t.

`psa_aead_encrypt` (function)

psa_status_t psa_aead_encrypt(psa_key_handle_t handle,
                              psa_algorithm_t alg,
                              const uint8_t * nonce,
                              size_t nonce_length,
                              const uint8_t * additional_data,
                              size_t additional_data_length,
                              const uint8_t * plaintext,
                              size_t plaintext_length,
                              uint8_t * ciphertext,
                              size_t ciphertext_size,
                              size_t * ciphertext_length);

Parameters:

handle: Handle to the key to use for the operation.
alg: The AEAD algorithm to compute (PSA_ALG_XXX value such that PSA_ALG_IS_AEAD(alg) is true).
nonce: Nonce or IV to use.
nonce_length: Size of the nonce buffer in bytes.
additional_data: Additional data that will be authenticated but not encrypted.
additional_data_length: Size of additional_data in bytes.
plaintext: Data that will be authenticated and encrypted.
plaintext_length: Size of plaintext in bytes.
ciphertext: Output buffer for the authenticated and encrypted data. The additional data is not part of this output. For algorithms where the encrypted data and the authentication tag are defined as separate outputs, the authentication tag is appended to the encrypted data.
ciphertext_size: Size of the ciphertext buffer in bytes. This must be at least PSA_AEAD_ENCRYPT_OUTPUT_SIZE(alg, plaintext_length).
ciphertext_length: On success, the size of the output in the ciphertext buffer.

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_INVALID_HANDLE
PSA_ERROR_DOES_NOT_EXIST
PSA_ERROR_NOT_PERMITTED
PSA_ERROR_INVALID_ARGUMENT: handle is not compatible with alg.
PSA_ERROR_NOT_SUPPORTED: alg is not supported or is not an AEAD algorithm.
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED
PSA_ERROR_BAD_STATE: The library has not been previously initialized by psa_crypto_init(). It is implementation-dependent whether a failure to initialize results in this error code.

Description:

Process an authenticated encryption operation.

`psa_aead_decrypt` (function)

psa_status_t psa_aead_decrypt(psa_key_handle_t handle,
                              psa_algorithm_t alg,
                              const uint8_t * nonce,
                              size_t nonce_length,
                              const uint8_t * additional_data,
                              size_t additional_data_length,
                              const uint8_t * ciphertext,
                              size_t ciphertext_length,
                              uint8_t * plaintext,
                              size_t plaintext_size,
                              size_t * plaintext_length);

Parameters:

handle: Handle to the key to use for the operation.
alg: The AEAD algorithm to compute (PSA_ALG_XXX value such that PSA_ALG_IS_AEAD(alg) is true).
nonce: Nonce or IV to use.
nonce_length: Size of the nonce buffer in bytes.
additional_data: Additional data that has been authenticated but not encrypted.
additional_data_length: Size of additional_data in bytes.
ciphertext: Data that has been authenticated and encrypted. For algorithms where the encrypted data and the authentication tag are defined as separate inputs, the buffer must contain the encrypted data followed by the authentication tag.
ciphertext_length: Size of ciphertext in bytes.
plaintext: Output buffer for the decrypted data.
plaintext_size: Size of the plaintext buffer in bytes. This must be at least PSA_AEAD_DECRYPT_OUTPUT_SIZE(alg, ciphertext_length).
plaintext_length: On success, the size of the output in the plaintext buffer.

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_INVALID_HANDLE
PSA_ERROR_DOES_NOT_EXIST
PSA_ERROR_INVALID_SIGNATURE: The ciphertext is not authentic.
PSA_ERROR_NOT_PERMITTED
PSA_ERROR_INVALID_ARGUMENT: handle is not compatible with alg.
PSA_ERROR_NOT_SUPPORTED: alg is not supported or is not an AEAD algorithm.
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED
PSA_ERROR_BAD_STATE: The library has not been previously initialized by psa_crypto_init(). It is implementation-dependent whether a failure to initialize results in this error code.

Description:

Process an authenticated decryption operation.

`psa_aead_operation_init` (function)

psa_aead_operation_t psa_aead_operation_init(void);

Returns: psa_aead_operation_t

Description:

Return an initial value for an AEAD operation object.

`psa_aead_encrypt_setup` (function)

psa_status_t psa_aead_encrypt_setup(psa_aead_operation_t * operation,
                                    psa_key_handle_t handle,
                                    psa_algorithm_t alg);

Parameters:

operation: The operation object to set up. It must have been initialized as per the documentation for psa_aead_operation_t and not yet in use.
handle: Handle to the key to use for the operation. It must remain valid until the operation terminates.
alg: The AEAD algorithm to compute (PSA_ALG_XXX value such that PSA_ALG_IS_AEAD(alg) is true).

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_INVALID_HANDLE
PSA_ERROR_NOT_PERMITTED
PSA_ERROR_INVALID_ARGUMENT: handle is not compatible with alg.
PSA_ERROR_NOT_SUPPORTED: alg is not supported or is not an AEAD algorithm.
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED
PSA_ERROR_BAD_STATE: The library has not been previously initialized by psa_crypto_init(). It is implementation-dependent whether a failure to initialize results in this error code.

Description:

Set the key for a multipart authenticated encryption operation.

The sequence of operations to encrypt a message with authentication is as follows:

Allocate an operation object which will be passed to all the functions listed here.
Initialize the operation object with one of the methods described in the documentation for psa_aead_operation_t, e.g. PSA_AEAD_OPERATION_INIT.
Call psa_aead_encrypt_setup() to specify the algorithm and key.
If needed, call psa_aead_set_lengths() to specify the length of the inputs to the subsequent calls to psa_aead_update_ad() and psa_aead_update(). See the documentation of psa_aead_set_lengths() for details.
Call either psa_aead_generate_nonce() or psa_aead_set_nonce() to generate or set the nonce. You should use psa_aead_generate_nonce() unless the protocol you are implementing requires a specific nonce value.
Call psa_aead_update_ad() zero, one or more times, passing a fragment of the non-encrypted additional authenticated data each time.
Call psa_aead_update() zero, one or more times, passing a fragment of the message to encrypt each time.
Call psa_aead_finish().

The application may call psa_aead_abort() at any time after the operation has been initialized.

After a successful call to psa_aead_encrypt_setup(), the application must eventually terminate the operation. The following events terminate an operation:

A failed call to any of the psa_aead_xxx functions.
A call to psa_aead_finish(), psa_aead_verify() or psa_aead_abort().

`psa_aead_decrypt_setup` (function)

psa_status_t psa_aead_decrypt_setup(psa_aead_operation_t * operation,
                                    psa_key_handle_t handle,
                                    psa_algorithm_t alg);

Parameters:

operation: The operation object to set up. It must have been initialized as per the documentation for psa_aead_operation_t and not yet in use.
handle: Handle to the key to use for the operation. It must remain valid until the operation terminates.
alg: The AEAD algorithm to compute (PSA_ALG_XXX value such that PSA_ALG_IS_AEAD(alg) is true).

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_INVALID_HANDLE
PSA_ERROR_NOT_PERMITTED
PSA_ERROR_INVALID_ARGUMENT: handle is not compatible with alg.
PSA_ERROR_NOT_SUPPORTED: alg is not supported or is not an AEAD algorithm.
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED
PSA_ERROR_BAD_STATE: The library has not been previously initialized by psa_crypto_init(). It is implementation-dependent whether a failure to initialize results in this error code.

Description:

Set the key for a multipart authenticated decryption operation.

The sequence of operations to decrypt a message with authentication is as follows:

Allocate an operation object which will be passed to all the functions listed here.
Initialize the operation object with one of the methods described in the documentation for psa_aead_operation_t, e.g. PSA_AEAD_OPERATION_INIT.
Call psa_aead_decrypt_setup() to specify the algorithm and key.
If needed, call psa_aead_set_lengths() to specify the length of the inputs to the subsequent calls to psa_aead_update_ad() and psa_aead_update(). See the documentation of psa_aead_set_lengths() for details.
Call psa_aead_set_nonce() with the nonce for the decryption.
Call psa_aead_update_ad() zero, one or more times, passing a fragment of the non-encrypted additional authenticated data each time.
Call psa_aead_update() zero, one or more times, passing a fragment of the ciphertext to decrypt each time.
Call psa_aead_verify().

The application may call psa_aead_abort() at any time after the operation has been initialized.

After a successful call to psa_aead_decrypt_setup(), the application must eventually terminate the operation. The following events terminate an operation:

A failed call to any of the psa_aead_xxx functions.
A call to psa_aead_finish(), psa_aead_verify() or psa_aead_abort().

`psa_aead_generate_nonce` (function)

psa_status_t psa_aead_generate_nonce(psa_aead_operation_t * operation,
                                     unsigned char * nonce,
                                     size_t nonce_size,
                                     size_t * nonce_length);

Parameters:

operation: Active AEAD operation.
nonce: Buffer where the generated nonce is to be written.
nonce_size: Size of the nonce buffer in bytes.
nonce_length: On success, the number of bytes of the generated nonce.

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_BAD_STATE: The operation state is not valid (not set up, or nonce already set).
PSA_ERROR_BUFFER_TOO_SMALL: The size of the nonce buffer is too small.
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Generate a random nonce for an authenticated encryption operation.

This function generates a random nonce for the authenticated encryption operation with an appropriate size for the chosen algorithm, key type and key size.

The application must call psa_aead_encrypt_setup() before calling this function.

If this function returns an error status, the operation becomes inactive.

`psa_aead_set_nonce` (function)

psa_status_t psa_aead_set_nonce(psa_aead_operation_t * operation,
                                const unsigned char * nonce,
                                size_t nonce_length);

Parameters:

operation: Active AEAD operation.
nonce: Buffer containing the nonce to use.
nonce_length: Size of the nonce in bytes.

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_BAD_STATE: The operation state is not valid (not set up, or nonce already set).
PSA_ERROR_INVALID_ARGUMENT: The size of nonce is not acceptable for the chosen algorithm.
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Set the nonce for an authenticated encryption or decryption operation.

This function sets the nonce for the authenticated encryption or decryption operation.

The application must call psa_aead_encrypt_setup() before calling this function.

If this function returns an error status, the operation becomes inactive.

Note

When encrypting, applications should use psa_aead_generate_nonce() instead of this function, unless implementing a protocol that requires a non-random IV.

`psa_aead_set_lengths` (function)

psa_status_t psa_aead_set_lengths(psa_aead_operation_t * operation,
                                  size_t ad_length,
                                  size_t plaintext_length);

Parameters:

operation: Active AEAD operation.
ad_length: Size of the non-encrypted additional authenticated data in bytes.
plaintext_length: Size of the plaintext to encrypt in bytes.

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_BAD_STATE: The operation state is not valid (not set up, already completed, or psa_aead_update_ad() or psa_aead_update() already called).
PSA_ERROR_INVALID_ARGUMENT: At least one of the lengths is not acceptable for the chosen algorithm.
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Declare the lengths of the message and additional data for AEAD.

The application must call this function before calling psa_aead_update_ad() or psa_aead_update() if the algorithm for the operation requires it. If the algorithm does not require it, calling this function is optional, but if this function is called then the implementation must enforce the lengths.

You may call this function before or after setting the nonce with psa_aead_set_nonce() or psa_aead_generate_nonce().

For PSA_ALG_CCM, calling this function is required.
For the other AEAD algorithms defined in this specification, calling this function is not required.
For vendor-defined algorithm, refer to the vendor documentation.

`psa_aead_update_ad` (function)

psa_status_t psa_aead_update_ad(psa_aead_operation_t * operation,
                                const uint8_t * input,
                                size_t input_length);

Parameters:

operation: Active AEAD operation.
input: Buffer containing the fragment of additional data.
input_length: Size of the input buffer in bytes.

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_BAD_STATE: The operation state is not valid (not set up, nonce not set, psa_aead_update() already called, or operation already completed).
PSA_ERROR_INVALID_ARGUMENT: The total input length overflows the additional data length that was previously specified with psa_aead_set_lengths().
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Pass additional data to an active AEAD operation.

Additional data is authenticated, but not encrypted.

You may call this function multiple times to pass successive fragments of the additional data. You may not call this function after passing data to encrypt or decrypt with psa_aead_update().

Before calling this function, you must:

Call either psa_aead_encrypt_setup() or psa_aead_decrypt_setup().
Set the nonce with psa_aead_generate_nonce() or psa_aead_set_nonce().

If this function returns an error status, the operation becomes inactive.

Warning

When decrypting, until psa_aead_verify() has returned PSA_SUCCESS, there is no guarantee that the input is valid. Therefore, until you have called psa_aead_verify() and it has returned PSA_SUCCESS, treat the input as untrusted and prepare to undo any action that depends on the input if psa_aead_verify() returns an error status.

`psa_aead_update` (function)

psa_status_t psa_aead_update(psa_aead_operation_t * operation,
                             const uint8_t * input,
                             size_t input_length,
                             unsigned char * output,
                             size_t output_size,
                             size_t * output_length);

Parameters:

operation: Active AEAD operation.
input: Buffer containing the message fragment to encrypt or decrypt.
input_length: Size of the input buffer in bytes.
output: Buffer where the output is to be written.
output_size: Size of the output buffer in bytes. This must be at least PSA_AEAD_UPDATE_OUTPUT_SIZE(alg, input_length) where alg is the algorithm that is being calculated.
output_length: On success, the number of bytes that make up the returned output.

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_BAD_STATE: The operation state is not valid (not set up, nonce not set or already completed).
PSA_ERROR_BUFFER_TOO_SMALL: The size of the output buffer is too small. You can determine a sufficient buffer size by calling PSA_AEAD_UPDATE_OUTPUT_SIZE(alg, input_length) where alg is the algorithm that is being calculated.
PSA_ERROR_INVALID_ARGUMENT: The total length of input to psa_aead_update_ad() so far is less than the additional data length that was previously specified with psa_aead_set_lengths().
PSA_ERROR_INVALID_ARGUMENT: The total input length overflows the plaintext length that was previously specified with psa_aead_set_lengths().
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Encrypt or decrypt a message fragment in an active AEAD operation.

Before calling this function, you must:

Call either psa_aead_encrypt_setup() or psa_aead_decrypt_setup(). The choice of setup function determines whether this function encrypts or decrypts its input.
Set the nonce with psa_aead_generate_nonce() or psa_aead_set_nonce().
Call psa_aead_update_ad() to pass all the additional data.

If this function returns an error status, the operation becomes inactive.

Warning

When decrypting, until psa_aead_verify() has returned PSA_SUCCESS, there is no guarantee that the input is valid. Therefore, until you have called psa_aead_verify() and it has returned PSA_SUCCESS:

Do not use the output in any way other than storing it in a confidential location. If you take any action that depends on the tentative decrypted data, this action will need to be undone if the input turns out not to be valid. Furthermore, if an adversary can observe that this action took place (for example through timing), they may be able to use this fact as an oracle to decrypt any message encrypted with the same key.
In particular, do not copy the output anywhere but to a memory or storage space that you have exclusive access to.

This function does not require the input to be aligned to any particular block boundary. If the implementation can only process a whole block at a time, it must consume all the input provided, but it may delay the end of the corresponding output until a subsequent call to psa_aead_update(), psa_aead_finish() or psa_aead_verify() provides sufficient input. The amount of data that can be delayed in this way is bounded by PSA_AEAD_UPDATE_OUTPUT_SIZE.

`psa_aead_finish` (function)

psa_status_t psa_aead_finish(psa_aead_operation_t * operation,
                             uint8_t * ciphertext,
                             size_t ciphertext_size,
                             size_t * ciphertext_length,
                             uint8_t * tag,
                             size_t tag_size,
                             size_t * tag_length);

Parameters:

operation: Active AEAD operation.
ciphertext: Buffer where the last part of the ciphertext is to be written.
ciphertext_size: Size of the ciphertext buffer in bytes. This must be at least PSA_AEAD_FINISH_OUTPUT_SIZE(alg) where alg is the algorithm that is being calculated.
ciphertext_length: On success, the number of bytes of returned ciphertext.
tag: Buffer where the authentication tag is to be written.
tag_size: Size of the tag buffer in bytes. This must be at least PSA_AEAD_TAG_LENGTH(alg) where alg is the algorithm that is being calculated.
tag_length: On success, the number of bytes that make up the returned tag.

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_BAD_STATE: The operation state is not valid (not set up, nonce not set, decryption, or already completed).
PSA_ERROR_BUFFER_TOO_SMALL: The size of the ciphertext or tag buffer is too small. You can determine a sufficient buffer size for ciphertext by calling PSA_AEAD_FINISH_OUTPUT_SIZE(alg) where alg is the algorithm that is being calculated. You can determine a sufficient buffer size for tag by calling PSA_AEAD_TAG_LENGTH(alg).
PSA_ERROR_INVALID_ARGUMENT: The total length of input to psa_aead_update_ad() so far is less than the additional data length that was previously specified with psa_aead_set_lengths().
PSA_ERROR_INVALID_ARGUMENT: The total length of input to psa_aead_update() so far is less than the plaintext length that was previously specified with psa_aead_set_lengths().
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Finish encrypting a message in an AEAD operation.

The operation must have been set up with psa_aead_encrypt_setup().

This function finishes the authentication of the additional data formed by concatenating the inputs passed to preceding calls to psa_aead_update_ad() with the plaintext formed by concatenating the inputs passed to preceding calls to psa_aead_update().

This function has two output buffers:

ciphertext contains trailing ciphertext that was buffered from preceding calls to psa_aead_update().
tag contains the authentication tag. Its length is always PSA_AEAD_TAG_LENGTH(alg) where alg is the AEAD algorithm that the operation performs.

When this function returns, the operation becomes inactive.

`psa_aead_verify` (function)

psa_status_t psa_aead_verify(psa_aead_operation_t * operation,
                             uint8_t * plaintext,
                             size_t plaintext_size,
                             size_t * plaintext_length,
                             const uint8_t * tag,
                             size_t tag_length);

Parameters:

operation: Active AEAD operation.
plaintext: Buffer where the last part of the plaintext is to be written. This is the remaining data from previous calls to psa_aead_update() that could not be processed until the end of the input.
plaintext_size: Size of the plaintext buffer in bytes. This must be at least PSA_AEAD_VERIFY_OUTPUT_SIZE(alg) where alg is the algorithm that is being calculated.
plaintext_length: On success, the number of bytes of returned plaintext.
tag: Buffer containing the authentication tag.
tag_length: Size of the tag buffer in bytes.

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_BAD_STATE: The operation state is not valid (not set up, nonce not set, encryption, or already completed).
PSA_ERROR_BUFFER_TOO_SMALL: The size of the plaintext buffer is too small. You can determine a sufficient buffer size for plaintext by calling PSA_AEAD_VERIFY_OUTPUT_SIZE(alg) where alg is the algorithm that is being calculated.
PSA_ERROR_INVALID_ARGUMENT: The total length of input to psa_aead_update_ad() so far is less than the additional data length that was previously specified with psa_aead_set_lengths().
PSA_ERROR_INVALID_ARGUMENT: The total length of input to psa_aead_update() so far is less than the plaintext length that was previously specified with psa_aead_set_lengths().
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Finish authenticating and decrypting a message in an AEAD operation.

The operation must have been set up with psa_aead_decrypt_setup().

This function finishes the authentication of the additional data formed by concatenating the inputs passed to preceding calls to psa_aead_update_ad() with the ciphertext formed by concatenating the inputs passed to preceding calls to psa_aead_update().

When this function returns, the operation becomes inactive.

`psa_aead_abort` (function)

psa_status_t psa_aead_abort(psa_aead_operation_t * operation);

Parameters:

operation: Initialized AEAD operation.

Returns: psa_status_t

PSA_SUCCESS
PSA_ERROR_BAD_STATE: operation is not an active AEAD operation.
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Abort an AEAD operation.

Aborting an operation frees all associated resources except for the operation structure itself. Once aborted, the operation object can be reused for another operation by calling psa_aead_encrypt_setup() or psa_aead_decrypt_setup() again.

You may call this function any time after the operation object has been initialized by any of the following methods:

A call to psa_aead_encrypt_setup() or psa_aead_decrypt_setup(), whether it succeeds or not.
Initializing the struct to all-bits-zero.
Initializing the struct to logical zeros, e.g. psa_aead_operation_t operation = {0}.

In particular, calling psa_aead_abort() after the operation has been terminated by a call to psa_aead_abort() or psa_aead_finish() is safe and has no effect.

Asymmetric cryptography

`psa_asymmetric_sign` (function)

psa_status_t psa_asymmetric_sign(psa_key_handle_t handle,
                                 psa_algorithm_t alg,
                                 const uint8_t * hash,
                                 size_t hash_length,
                                 uint8_t * signature,
                                 size_t signature_size,
                                 size_t * signature_length);

Parameters:

handle: Handle to the key to use for the operation. It must be an asymmetric key pair.
alg: A signature algorithm that is compatible with the type of handle.
hash: The hash or message to sign.
hash_length: Size of the hash buffer in bytes.
signature: Buffer where the signature is to be written.
signature_size: Size of the signature buffer in bytes.
signature_length: On success, the number of bytes that make up the returned signature value.

Returns: psa_status_t

PSA_SUCCESS
PSA_ERROR_BUFFER_TOO_SMALL: The size of the signature buffer is too small. You can determine a sufficient buffer size by calling PSA_ASYMMETRIC_SIGN_OUTPUT_SIZE(key_type, key_bits, alg) where key_type and key_bits are the type and bit-size respectively of handle.
PSA_ERROR_NOT_SUPPORTED
PSA_ERROR_INVALID_ARGUMENT
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED
PSA_ERROR_INSUFFICIENT_ENTROPY
PSA_ERROR_BAD_STATE: The library has not been previously initialized by psa_crypto_init(). It is implementation-dependent whether a failure to initialize results in this error code.

Description:

Sign a hash or short message with a private key.

Note that to perform a hash-and-sign signature algorithm, you must first calculate the hash by calling psa_hash_setup(), psa_hash_update() and psa_hash_finish(). Then pass the resulting hash as the hash parameter to this function. You can use PSA_ALG_SIGN_GET_HASH(alg) to determine the hash algorithm to use.

`psa_asymmetric_verify` (function)

psa_status_t psa_asymmetric_verify(psa_key_handle_t handle,
                                   psa_algorithm_t alg,
                                   const uint8_t * hash,
                                   size_t hash_length,
                                   const uint8_t * signature,
                                   size_t signature_length);

Parameters:

handle: Handle to the key to use for the operation. It must be a public key or an asymmetric key pair.
alg: A signature algorithm that is compatible with the type of handle.
hash: The hash or message whose signature is to be verified.
hash_length: Size of the hash buffer in bytes.
signature: Buffer containing the signature to verify.
signature_length: Size of the signature buffer in bytes.

Returns: psa_status_t

PSA_SUCCESS: The signature is valid.
PSA_ERROR_INVALID_SIGNATURE: The calculation was perfomed successfully, but the passed signature is not a valid signature.
PSA_ERROR_NOT_SUPPORTED
PSA_ERROR_INVALID_ARGUMENT
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED
PSA_ERROR_BAD_STATE: The library has not been previously initialized by psa_crypto_init(). It is implementation-dependent whether a failure to initialize results in this error code.

Description:

Verify the signature a hash or short message using a public key.

Note that to perform a hash-and-sign signature algorithm, you must first calculate the hash by calling psa_hash_setup(), psa_hash_update() and psa_hash_finish(). Then pass the resulting hash as the hash parameter to this function. You can use PSA_ALG_SIGN_GET_HASH(alg) to determine the hash algorithm to use.

`psa_asymmetric_encrypt` (function)

psa_status_t psa_asymmetric_encrypt(psa_key_handle_t handle,
                                    psa_algorithm_t alg,
                                    const uint8_t * input,
                                    size_t input_length,
                                    const uint8_t * salt,
                                    size_t salt_length,
                                    uint8_t * output,
                                    size_t output_size,
                                    size_t * output_length);

Parameters:

handle: Handle to the key to use for the operation. It must be a public key or an asymmetric key pair.
alg: An asymmetric encryption algorithm that is compatible with the type of handle.
input: The message to encrypt.
input_length: Size of the input buffer in bytes.
salt: A salt or label, if supported by the encryption algorithm. If the algorithm does not support a salt, pass NULL. If the algorithm supports an optional salt and you do not want to pass a salt, pass NULL.
salt_length: Size of the salt buffer in bytes. If salt is NULL, pass 0.
output: Buffer where the encrypted message is to be written.
output_size: Size of the output buffer in bytes.
output_length: On success, the number of bytes that make up the returned output.

Returns: psa_status_t

PSA_SUCCESS
PSA_ERROR_BUFFER_TOO_SMALL: The size of the output buffer is too small. You can determine a sufficient buffer size by calling PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE(key_type, key_bits, alg) where key_type and key_bits are the type and bit-size respectively of handle.
PSA_ERROR_NOT_SUPPORTED
PSA_ERROR_INVALID_ARGUMENT
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED
PSA_ERROR_INSUFFICIENT_ENTROPY
PSA_ERROR_BAD_STATE: The library has not been previously initialized by psa_crypto_init(). It is implementation-dependent whether a failure to initialize results in this error code.

Description:

Encrypt a short message with a public key.

For PSA_ALG_RSA_PKCS1V15_CRYPT, no salt is supported.

`psa_asymmetric_decrypt` (function)

psa_status_t psa_asymmetric_decrypt(psa_key_handle_t handle,
                                    psa_algorithm_t alg,
                                    const uint8_t * input,
                                    size_t input_length,
                                    const uint8_t * salt,
                                    size_t salt_length,
                                    uint8_t * output,
                                    size_t output_size,
                                    size_t * output_length);

Parameters:

handle: Handle to the key to use for the operation. It must be an asymmetric key pair.
alg: An asymmetric encryption algorithm that is compatible with the type of handle.
input: The message to decrypt.
input_length: Size of the input buffer in bytes.
salt: A salt or label, if supported by the encryption algorithm. If the algorithm does not support a salt, pass NULL. If the algorithm supports an optional salt and you do not want to pass a salt, pass NULL.
salt_length: Size of the salt buffer in bytes. If salt is NULL, pass 0.
output: Buffer where the decrypted message is to be written.
output_size: Size of the output buffer in bytes.
output_length: On success, the number of bytes that make up the returned output.

Returns: psa_status_t

PSA_SUCCESS
PSA_ERROR_BUFFER_TOO_SMALL: The size of the output buffer is too small. You can determine a sufficient buffer size by calling PSA_ASYMMETRIC_DECRYPT_OUTPUT_SIZE(key_type, key_bits, alg) where key_type and key_bits are the type and bit-size respectively of handle.
PSA_ERROR_NOT_SUPPORTED
PSA_ERROR_INVALID_ARGUMENT
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED
PSA_ERROR_INSUFFICIENT_ENTROPY
PSA_ERROR_INVALID_PADDING
PSA_ERROR_BAD_STATE: The library has not been previously initialized by psa_crypto_init(). It is implementation-dependent whether a failure to initialize results in this error code.

Description:

Decrypt a short message with a private key.

For PSA_ALG_RSA_PKCS1V15_CRYPT, no salt is supported.

Key derivation and pseudorandom generation

`psa_key_derivation_operation_t` (type)

typedef struct psa_key_derivation_s psa_key_derivation_operation_t;

The type of the state data structure for key derivation operations.

Before calling any function on a key derivation operation object, the application must initialize it by any of the following means:

Set the structure to all-bits-zero, for example:

psa_key_derivation_operation_t operation;
memset(&operation, 0, sizeof(operation));

Initialize the structure to logical zero values, for example:
```
psa_key_derivation_operation_t operation = {0};
```
Initialize the structure to the initializer PSA_KEY_DERIVATION_OPERATION_INIT, for example:
```
psa_key_derivation_operation_t operation = PSA_KEY_DERIVATION_OPERATION_INIT;
```
Assign the result of the function psa_key_derivation_operation_init() to the structure, for example:
```
psa_key_derivation_operation_t operation;
operation = psa_key_derivation_operation_init();
```

This is an implementation-defined struct. Applications should not make any assumptions about the content of this structure except as directed by the documentation of a specific implementation.

`PSA_KEY_DERIVATION_OPERATION_INIT` (macro)

#define PSA_KEY_DERIVATION_OPERATION_INIT  {0}

This macro returns a suitable initializer for a key derivation operation object of type psa_key_derivation_operation_t.

`PSA_KEY_DERIVATION_UNLIMITED_CAPACITY` (macro)

#define PSA_KEY_DERIVATION_UNLIMITED_CAPACITY  ((size_t)(-1))

Use the maximum possible capacity for a key derivation operation.

Use this value as the capacity argument when setting up a key derivation to indicate that the operation should have the maximum possible capacity. The value of the maximum possible capacity depends on the key derivation algorithm.

`psa_key_derivation_operation_init` (function)

psa_key_derivation_operation_t psa_key_derivation_operation_init(void);

Returns: psa_key_derivation_operation_t

Description:

Return an initial value for a key derivation operation object.

`psa_key_derivation_setup` (function)

psa_status_t psa_key_derivation_setup(psa_key_derivation_operation_t * operation,
                                      psa_algorithm_t alg);

Parameters:

operation: The key derivation operation object to set up. It must have been initialized but not set up yet.
alg: The key derivation algorithm to compute (PSA_ALG_XXX value such that PSA_ALG_IS_KEY_DERIVATION(alg) is true).

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_INVALID_ARGUMENT: alg is not a key derivation algorithm.
PSA_ERROR_NOT_SUPPORTED: alg is not supported or is not a key derivation algorithm.
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED
PSA_ERROR_BAD_STATE

Description:

Set up a key derivation operation.

A key derivation algorithm takes some inputs and uses them to generate a byte stream in a deterministic way. This byte stream can be used to produce keys and other cryptographic material.

To derive a key:

Start with an initialized object of type psa_key_derivation_operation_t.
Call psa_key_derivation_setup() to select the algorithm.
Provide the inputs for the key derivation by calling psa_key_derivation_input_bytes() or psa_key_derivation_input_key() as appropriate. Which inputs are needed, in what order, and whether they may be keys and if so of what type depends on the algorithm.
Optionally set the operation’s maximum capacity with psa_key_derivation_set_capacity(). You may do this before, in the middle of or after providing inputs. For some algorithms, this step is mandatory because the output depends on the maximum capacity.
To derive a key, call psa_key_derivation_output_key(). To derive a byte string for a different purpose, call
psa_key_derivation_output_bytes(). Successive calls to these functions use successive output bytes calculated by the key derivation algorithm.
Clean up the key derivation operation object with psa_key_derivation_abort().

`psa_key_derivation_get_capacity` (function)

psa_status_t psa_key_derivation_get_capacity(const psa_key_derivation_operation_t * operation,
                                             size_t * capacity);

Parameters:

operation: The operation to query.
capacity: On success, the capacity of the operation.

Returns: psa_status_t

PSA_SUCCESS
PSA_ERROR_BAD_STATE
PSA_ERROR_COMMUNICATION_FAILURE

Description:

Retrieve the current capacity of a key derivation operation.

The capacity of a key derivation is the maximum number of bytes that it can return. When you get N bytes of output from a key derivation operation, this reduces its capacity by N.

`psa_key_derivation_set_capacity` (function)

psa_status_t psa_key_derivation_set_capacity(psa_key_derivation_operation_t * operation,
                                             size_t capacity);

Parameters:

operation: The key derivation operation object to modify.
capacity: The new capacity of the operation. It must be less or equal to the operation’s current capacity.

Returns: psa_status_t

PSA_SUCCESS
PSA_ERROR_INVALID_ARGUMENT: capacity is larger than the operation’s current capacity. In this case, the operation object remains valid and its capacity remains unchanged.
PSA_ERROR_BAD_STATE
PSA_ERROR_COMMUNICATION_FAILURE

Description:

Set the maximum capacity of a key derivation operation.

The capacity of a key derivation operation is the maximum number of bytes that the key derivation operation can return from this point onwards.

`psa_key_derivation_input_bytes` (function)

psa_status_t psa_key_derivation_input_bytes(psa_key_derivation_operation_t * operation,
                                            psa_key_derivation_step_t step,
                                            const uint8_t * data,
                                            size_t data_length);

Parameters:

operation: The key derivation operation object to use. It must have been set up with psa_key_derivation_setup() and must not have produced any output yet.
step: Which step the input data is for.
data: Input data to use.
data_length: Size of the data buffer in bytes.

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_INVALID_ARGUMENT: step is not compatible with the operation’s algorithm.
PSA_ERROR_INVALID_ARGUMENT: step does not allow direct inputs.
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED
PSA_ERROR_BAD_STATE: The value of step is not valid given the state of operation.
PSA_ERROR_BAD_STATE: The library has not been previously initialized by psa_crypto_init(). It is implementation-dependent whether a failure to initialize results in this error code.

Description:

Provide an input for key derivation or key agreement.

Which inputs are required and in what order depends on the algorithm. Refer to the documentation of each key derivation or key agreement algorithm for information.

This function passes direct inputs. Some inputs must be passed as keys using psa_key_derivation_input_key() instead of this function. Refer to the documentation of individual step types for information.

`psa_key_derivation_input_key` (function)

psa_status_t psa_key_derivation_input_key(psa_key_derivation_operation_t * operation,
                                          psa_key_derivation_step_t step,
                                          psa_key_handle_t handle);

Parameters:

operation: The key derivation operation object to use. It must have been set up with psa_key_derivation_setup() and must not have produced any output yet.
step: Which step the input data is for.
handle: Handle to the key. It must have an appropriate type for step and must allow the usage PSA_KEY_USAGE_DERIVE.

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_INVALID_HANDLE
PSA_ERROR_DOES_NOT_EXIST
PSA_ERROR_NOT_PERMITTED
PSA_ERROR_INVALID_ARGUMENT: step is not compatible with the operation’s algorithm.
PSA_ERROR_INVALID_ARGUMENT: step does not allow key inputs.
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED
PSA_ERROR_BAD_STATE: The value of step is not valid given the state of operation.
PSA_ERROR_BAD_STATE: The library has not been previously initialized by psa_crypto_init(). It is implementation-dependent whether a failure to initialize results in this error code.

Description:

Provide an input for key derivation in the form of a key.

Which inputs are required and in what order depends on the algorithm. Refer to the documentation of each key derivation or key agreement algorithm for information.

This function passes key inputs. Some inputs must be passed as keys of the appropriate type using this function, while others must be passed as direct inputs using psa_key_derivation_input_bytes(). Refer to the documentation of individual step types for information.

`psa_key_derivation_key_agreement` (function)

psa_status_t psa_key_derivation_key_agreement(psa_key_derivation_operation_t * operation,
                                              psa_key_derivation_step_t step,
                                              psa_key_handle_t private_key,
                                              const uint8_t * peer_key,
                                              size_t peer_key_length);

Parameters:

operation: The key derivation operation object to use. It must have been set up with psa_key_derivation_setup() with a key agreement and derivation algorithm alg (PSA_ALG_XXX value such that PSA_ALG_IS_KEY_AGREEMENT(alg) is true and PSA_ALG_IS_RAW_KEY_AGREEMENT(alg) is false). The operation must be ready for an input of the type given by step.
step: Which step the input data is for.
private_key: Handle to the private key to use.
peer_key: Public key of the peer. The peer key must be in the same format that psa_import_key() accepts for the public key type corresponding to the type of private_key. That is, this function performs the equivalent of psa_import_key(…, peer_key, peer_key_length) where with key attributes indicating the public key type corresponding to the type of private_key. For example, for EC keys, this means that peer_key is interpreted as a point on the curve that the private key is on. The standard formats for public keys are documented in the documentation of psa_export_public_key().
peer_key_length: Size of peer_key in bytes.

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_INVALID_HANDLE
PSA_ERROR_DOES_NOT_EXIST
PSA_ERROR_NOT_PERMITTED
PSA_ERROR_INVALID_ARGUMENT: private_key is not compatible with alg, or peer_key is not valid for alg or not compatible with private_key.
PSA_ERROR_NOT_SUPPORTED: alg is not supported or is not a key derivation algorithm.
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Perform a key agreement and use the shared secret as input to a key derivation.

A key agreement algorithm takes two inputs: a private key private_key a public key peer_key. The result of this function is passed as input to a key derivation. The output of this key derivation can be extracted by reading from the resulting operation to produce keys and other cryptographic material.

`psa_key_derivation_output_bytes` (function)

psa_status_t psa_key_derivation_output_bytes(psa_key_derivation_operation_t * operation,
                                             uint8_t * output,
                                             size_t output_length);

Parameters:

operation: The key derivation operation object to read from.
output: Buffer where the output will be written.
output_length: Number of bytes to output.

Returns: psa_status_t

PSA_SUCCESS
PSA_ERROR_INSUFFICIENT_DATA: The operation’s capacity was less than output_length bytes. Note that in this case, no output is written to the output buffer. The operation’s capacity is set to 0, thus subsequent calls to this function will not succeed, even with a smaller output buffer.
PSA_ERROR_BAD_STATE
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Read some data from a key derivation operation.

This function calculates output bytes from a key derivation algorithm and return those bytes. If you view the key derivation’s output as a stream of bytes, this function destructively reads the requested number of bytes from the stream. The operation’s capacity decreases by the number of bytes read.

`psa_key_derivation_output_key` (function)

psa_status_t psa_key_derivation_output_key(const psa_key_attributes_t * attributes,
                                           psa_key_derivation_operation_t * operation,
                                           psa_key_handle_t * handle);

Parameters:

attributes: The attributes for the new key.
operation: The key derivation operation object to read from.
handle: On success, a handle to the newly created key. 0 on failure.

Returns: psa_status_t

PSA_SUCCESS: Success. If the key is persistent, the key material and the key’s metadata have been saved to persistent storage.
PSA_ERROR_ALREADY_EXISTS: This is an attempt to create a persistent key, and there is already a persistent key with the given identifier.
PSA_ERROR_INSUFFICIENT_DATA: There was not enough data to create the desired key. Note that in this case, no output is written to the output buffer. The operation’s capacity is set to 0, thus subsequent calls to this function will not succeed, even with a smaller output buffer.
PSA_ERROR_NOT_SUPPORTED: The key type or key size is not supported, either by the implementation in general or in this particular location.
PSA_ERROR_BAD_STATE
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_INSUFFICIENT_STORAGE
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED
PSA_ERROR_BAD_STATE: The library has not been previously initialized by psa_crypto_init(). It is implementation-dependent whether a failure to initialize results in this error code.

Description:

Derive a key from an ongoing key derivation operation.

This function calculates output bytes from a key derivation algorithm and uses those bytes to generate a key deterministically. If you view the key derivation’s output as a stream of bytes, this function destructively reads as many bytes as required from the stream. The operation’s capacity decreases by the number of bytes read.

How much output is produced and consumed from the operation, and how the key is derived, depends on the key type:

For key types for which the key is an arbitrary sequence of bytes of a given size, this function is functionally equivalent to calling psa_key_derivation_output_bytes and passing the resulting output to psa_import_key. However, this function has a security benefit: if the implementation provides an isolation boundary then the key material is not exposed outside the isolation boundary. As a consequence, for these key types, this function always consumes exactly (bits / 8) bytes from the operation. The following key types defined in this specification follow this scheme:
For ECC keys on a Montgomery elliptic curve (PSA_KEY_TYPE_ECC_KEY_PAIR(curve) where curve designates a Montgomery curve), this function always draws a byte string whose length is determined by the curve, and sets the mandatory bits accordingly. That is:
- PSA_ECC_CURVE_CURVE25519: draw a 32-byte string and process it as specified in RFC 7748 §5.
- PSA_ECC_CURVE_CURVE448: draw a 56-byte string and process it as specified in RFC 7748 §5.
For key types for which the key is represented by a single sequence of bits bits with constraints as to which bit sequences are acceptable, this function draws a byte string of length (bits / 8) bytes rounded up to the nearest whole number of bytes. If the resulting byte string is acceptable, it becomes the key, otherwise the drawn bytes are discarded. This process is repeated until an acceptable byte string is drawn. The byte string drawn from the operation is interpreted as specified for the output produced by psa_export_key(). The following key types defined in this specification follow this scheme:
- PSA_KEY_TYPE_DES. Force-set the parity bits, but discard forbidden weak keys. For 2-key and 3-key triple-DES, the three keys are generated successively (for example, for 3-key triple-DES, if the first 8 bytes specify a weak key and the next 8 bytes do not, discard the first 8 bytes, use the next 8 bytes as the first key, and continue reading output from the operation to derive the other two keys).
- Finite-field Diffie-Hellman keys (PSA_KEY_TYPE_DH_KEY_PAIR(group) where group designates any Diffie-Hellman group) and ECC keys on a Weierstrass elliptic curve (PSA_KEY_TYPE_ECC_KEY_PAIR(curve) where curve designates a Weierstrass curve). For these key types, interpret the byte string as integer in big-endian order. Discard it if it is not in the range [0, N - 2] where N is the boundary of the private key domain (the prime p for Diffie-Hellman, the subprime q for DSA, or the order of the curve’s base point for ECC). Add 1 to the resulting integer and use this as the private key x. This method allows compliance to NIST standards, specifically the methods titled “key-pair generation by testing candidates” in NIST SP 800-56A §5.6.1.1.4 for Diffie-Hellman, in FIPS 186-4 §B.1.2 for DSA, and in NIST SP 800-56A §5.6.1.2.2 or FIPS 186-4 §B.4.2 for elliptic curve keys.
For other key types, including PSA_KEY_TYPE_RSA_KEY_PAIR, the way in which the operation output is consumed is implementation-defined.

In all cases, the data that is read is discarded from the operation. The operation’s capacity is decreased by the number of bytes read.

`psa_key_derivation_abort` (function)

psa_status_t psa_key_derivation_abort(psa_key_derivation_operation_t * operation);

Parameters:

operation: The operation to abort.

Returns: psa_status_t

PSA_SUCCESS
PSA_ERROR_BAD_STATE
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Abort a key derivation operation.

Once a key derivation operation has been aborted, its capacity is zero. Aborting an operation frees all associated resources except for the operation structure itself.

This function may be called at any time as long as the operation object has been initialized to PSA_KEY_DERIVATION_OPERATION_INIT, to psa_key_derivation_operation_init() or a zero value. In particular, it is valid to call psa_key_derivation_abort() twice, or to call psa_key_derivation_abort() on an operation that has not been set up.

Once aborted, the key derivation operation object may be called.

`psa_raw_key_agreement` (function)

psa_status_t psa_raw_key_agreement(psa_algorithm_t alg,
                                   psa_key_handle_t private_key,
                                   const uint8_t * peer_key,
                                   size_t peer_key_length,
                                   uint8_t * output,
                                   size_t output_size,
                                   size_t * output_length);

Parameters:

alg: The key agreement algorithm to compute (PSA_ALG_XXX value such that PSA_ALG_IS_RAW_KEY_AGREEMENT(alg) is true).
private_key: Handle to the private key to use.
peer_key: Public key of the peer. It must be in the same format that psa_import_key() accepts. The standard formats for public keys are documented in the documentation of psa_export_public_key().
peer_key_length: Size of peer_key in bytes.
output: Buffer where the decrypted message is to be written.
output_size: Size of the output buffer in bytes.
output_length: On success, the number of bytes that make up the returned output.

Returns: psa_status_t

PSA_SUCCESS: Success.
PSA_ERROR_INVALID_HANDLE
PSA_ERROR_NOT_PERMITTED
PSA_ERROR_INVALID_ARGUMENT: alg is not a key agreement algorithm
PSA_ERROR_INVALID_ARGUMENT: private_key is not compatible with alg, or peer_key is not valid for alg or not compatible with private_key.
PSA_ERROR_NOT_SUPPORTED: alg is not a supported key agreement algorithm.
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED

Description:

Perform a key agreement and return the raw shared secret.

Warning

The raw result of a key agreement algorithm such as finite-field Diffie-Hellman or elliptic curve Diffie-Hellman has biases and should not be used directly as key material. It should instead be passed as input to a key derivation algorithm. To chain a key agreement with a key derivation, use psa_key_derivation_key_agreement() and other functions from the key derivation interface.

Random generation

`psa_generate_random` (function)

psa_status_t psa_generate_random(uint8_t * output,
                                 size_t output_size);

Parameters:

output: Output buffer for the generated data.
output_size: Number of bytes to generate and output.

Returns: psa_status_t

PSA_SUCCESS
PSA_ERROR_NOT_SUPPORTED
PSA_ERROR_INSUFFICIENT_ENTROPY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED
PSA_ERROR_BAD_STATE: The library has not been previously initialized by psa_crypto_init(). It is implementation-dependent whether a failure to initialize results in this error code.

Description:

Generate random bytes.

Warning

This function can fail! Callers MUST check the return status and MUST NOT use the content of the output buffer if the return status is not PSA_SUCCESS.

Note

To generate a key, use psa_generate_key() instead.

`psa_generate_key` (function)

psa_status_t psa_generate_key(const psa_key_attributes_t * attributes,
                              psa_key_handle_t * handle);

Parameters:

attributes: The attributes for the new key.
handle: On success, a handle to the newly created key. 0 on failure.

Returns: psa_status_t

PSA_SUCCESS: Success. If the key is persistent, the key material and the key’s metadata have been saved to persistent storage.
PSA_ERROR_ALREADY_EXISTS: This is an attempt to create a persistent key, and there is already a persistent key with the given identifier.
PSA_ERROR_NOT_SUPPORTED
PSA_ERROR_INVALID_ARGUMENT
PSA_ERROR_INSUFFICIENT_MEMORY
PSA_ERROR_INSUFFICIENT_ENTROPY
PSA_ERROR_COMMUNICATION_FAILURE
PSA_ERROR_HARDWARE_FAILURE
PSA_ERROR_CORRUPTION_DETECTED
PSA_ERROR_BAD_STATE: The library has not been previously initialized by psa_crypto_init(). It is implementation-dependent whether a failure to initialize results in this error code.

Description:

Generate a key or key pair.

The key is generated randomly. Its location, policy, type and size are taken from attributes.

The following type-specific considerations apply:

For RSA keys (PSA_KEY_TYPE_RSA_KEY_PAIR), the public exponent is 65537. The modulus is a product of two probabilistic primes between 2^{n-1} and 2^n where n is the bit size specified in the attributes.

Error codes

`psa_status_t` (type)

typedef int32_t psa_status_t;

Function return status.

This is either PSA_SUCCESS (which is zero), indicating success, or a small negative value indicating that an error occurred. Errors are encoded as one of the PSA_ERROR_xxx values defined here.

`PSA_SUCCESS` (macro)

#define PSA_SUCCESS  ((psa_status_t)0)

The action was completed successfully.

`PSA_ERROR_GENERIC_ERROR` (macro)

#define PSA_ERROR_GENERIC_ERROR  ((psa_status_t)-132)

An error occurred that does not correspond to any defined failure cause.

Implementations may use this error code if none of the other standard error codes are applicable.

`PSA_ERROR_NOT_SUPPORTED` (macro)

#define PSA_ERROR_NOT_SUPPORTED  ((psa_status_t)-134)

The requested operation or a parameter is not supported by this implementation.

Implementations should return this error code when an enumeration parameter such as a key type, algorithm, etc. is not recognized. If a combination of parameters is recognized and identified as not valid, return PSA_ERROR_INVALID_ARGUMENT instead.

`PSA_ERROR_NOT_PERMITTED` (macro)

#define PSA_ERROR_NOT_PERMITTED  ((psa_status_t)-133)

The requested action is denied by a policy.

Implementations should return this error code when the parameters are recognized as valid and supported, and a policy explicitly denies the requested operation.

If a subset of the parameters of a function call identify a forbidden operation, and another subset of the parameters are not valid or not supported, it is unspecified whether the function returns PSA_ERROR_NOT_PERMITTED, PSA_ERROR_NOT_SUPPORTED or PSA_ERROR_INVALID_ARGUMENT.

`PSA_ERROR_BUFFER_TOO_SMALL` (macro)

#define PSA_ERROR_BUFFER_TOO_SMALL  ((psa_status_t)-138)

An output buffer is too small.

Applications can call the PSA_xxx_SIZE macro listed in the function description to determine a sufficient buffer size.

Implementations should preferably return this error code only in cases when performing the operation with a larger output buffer would succeed. However implementations may return this error if a function has invalid or unsupported parameters in addition to the parameters that determine the necessary output buffer size.

`PSA_ERROR_ALREADY_EXISTS` (macro)

#define PSA_ERROR_ALREADY_EXISTS  ((psa_status_t)-139)

Asking for an item that already exists.

Implementations should return this error, when attempting to write an item (like a key) that already exists.

`PSA_ERROR_DOES_NOT_EXIST` (macro)

#define PSA_ERROR_DOES_NOT_EXIST  ((psa_status_t)-140)

Asking for an item that doesn’t exist.

Implementations should return this error, if a requested item (like a key) does not exist.

`PSA_ERROR_BAD_STATE` (macro)

#define PSA_ERROR_BAD_STATE  ((psa_status_t)-137)

The requested action cannot be performed in the current state.

Multipart operations return this error when one of the functions is called out of sequence. Refer to the function descriptions for permitted sequencing of functions.

Implementations shall not return this error code to indicate that a key either exists or not, but shall instead return PSA_ERROR_ALREADY_EXISTS or PSA_ERROR_DOES_NOT_EXIST as applicable.

Implementations shall not return this error code to indicate that a key handle is invalid, but shall return PSA_ERROR_INVALID_HANDLE instead.

`PSA_ERROR_INVALID_ARGUMENT` (macro)

#define PSA_ERROR_INVALID_ARGUMENT  ((psa_status_t)-135)

The parameters passed to the function are invalid.

Implementations may return this error any time a parameter or combination of parameters are recognized as invalid.

Implementations shall not return this error code to indicate that a key handle is invalid, but shall return PSA_ERROR_INVALID_HANDLE instead.

`PSA_ERROR_INSUFFICIENT_MEMORY` (macro)

#define PSA_ERROR_INSUFFICIENT_MEMORY  ((psa_status_t)-141)

There is not enough runtime memory.

If the action is carried out across multiple security realms, this error can refer to available memory in any of the security realms.

`PSA_ERROR_INSUFFICIENT_STORAGE` (macro)

#define PSA_ERROR_INSUFFICIENT_STORAGE  ((psa_status_t)-142)

There is not enough persistent storage.

Functions that modify the key storage return this error code if there is insufficient storage space on the host media. In addition, many functions that do not otherwise access storage may return this error code if the implementation requires a mandatory log entry for the requested action and the log storage space is full.

`PSA_ERROR_COMMUNICATION_FAILURE` (macro)

#define PSA_ERROR_COMMUNICATION_FAILURE  ((psa_status_t)-145)

There was a communication failure inside the implementation.

This can indicate a communication failure between the application and an external cryptoprocessor or between the cryptoprocessor and an external volatile or persistent memory. A communication failure may be transient or permanent depending on the cause.

Warning

If a function returns this error, it is undetermined whether the requested action has completed or not. Implementations should return PSA_SUCCESS on successful completion whenver possible, however functions may return PSA_ERROR_COMMUNICATION_FAILURE if the requested action was completed successfully in an external cryptoprocessor but there was a breakdown of communication before the cryptoprocessor could report the status to the application.

`PSA_ERROR_STORAGE_FAILURE` (macro)

#define PSA_ERROR_STORAGE_FAILURE  ((psa_status_t)-146)

There was a storage failure that may have led to data loss.

This error indicates that some persistent storage is corrupted. It should not be used for a corruption of volatile memory (use PSA_ERROR_CORRUPTION_DETECTED), for a communication error between the cryptoprocessor and its external storage (use PSA_ERROR_COMMUNICATION_FAILURE), or when the storage is in a valid state but is full (use PSA_ERROR_INSUFFICIENT_STORAGE).

Note that a storage failure does not indicate that any data that was previously read is invalid. However this previously read data may no longer be readable from storage.

When a storage failure occurs, it is no longer possible to ensure the global integrity of the keystore. Depending on the global integrity guarantees offered by the implementation, access to other data may or may not fail even if the data is still readable but its integrity cannot be guaranteed.

Implementations should only use this error code to report a permanent storage corruption. However application writers should keep in mind that transient errors while reading the storage may be reported using this error code.

`PSA_ERROR_HARDWARE_FAILURE` (macro)

#define PSA_ERROR_HARDWARE_FAILURE  ((psa_status_t)-147)

A hardware failure was detected.

A hardware failure may be transient or permanent depending on the cause.

`PSA_ERROR_CORRUPTION_DETECTED` (macro)

#define PSA_ERROR_CORRUPTION_DETECTED  ((psa_status_t)-151)

A tampering attempt was detected.

If an application receives this error code, there is no guarantee that previously accessed or computed data was correct and remains confidential. Applications should not perform any security function and should enter a safe failure state.

Implementations may return this error code if they detect an invalid state that cannot happen during normal operation and that indicates that the implementation’s security guarantees no longer hold. Depending on the implementation architecture and on its security and safety goals, the implementation may forcibly terminate the application.

This error code is intended as a last resort when a security breach is detected and it is unsure whether the keystore data is still protected. Implementations shall only return this error code to report an alarm from a tampering detector, to indicate that the confidentiality of stored data can no longer be guaranteed, or to indicate that the integrity of previously returned data is now considered compromised. Implementations shall not use this error code to indicate a hardware failure that merely makes it impossible to perform the requested operation (use PSA_ERROR_COMMUNICATION_FAILURE, PSA_ERROR_STORAGE_FAILURE, PSA_ERROR_HARDWARE_FAILURE, PSA_ERROR_INSUFFICIENT_ENTROPY or other applicable error code instead).

This error indicates an attack against the application. Implementations shall not return this error code as a consequence of the behavior of the application itself.

`PSA_ERROR_INSUFFICIENT_ENTROPY` (macro)

#define PSA_ERROR_INSUFFICIENT_ENTROPY  ((psa_status_t)-148)

There is not enough entropy to generate random data needed for the requested action.

This error indicates a failure of a hardware random generator. Application writers should note that this error can be returned not only by functions whose purpose is to generate random data, such as key, IV or nonce generation, but also by functions that execute an algorithm with a randomized result, as well as functions that use randomization of intermediate computations as a countermeasure to certain attacks.

Implementations should avoid returning this error after psa_crypto_init() has succeeded. Implementations should generate sufficient entropy during initialization and subsequently use a cryptographically secure pseudorandom generator (PRNG). However implementations may return this error at any time if a policy requires the PRNG to be reseeded during normal operation.

`PSA_ERROR_INVALID_SIGNATURE` (macro)

#define PSA_ERROR_INVALID_SIGNATURE  ((psa_status_t)-149)

The signature, MAC or hash is incorrect.

Verification functions return this error if the verification calculations completed successfully, and the value to be verified was determined to be incorrect.

If the value to verify has an invalid size, implementations may return either PSA_ERROR_INVALID_ARGUMENT or PSA_ERROR_INVALID_SIGNATURE.

`PSA_ERROR_INVALID_PADDING` (macro)

#define PSA_ERROR_INVALID_PADDING  ((psa_status_t)-150)

The decrypted padding is incorrect.

Warning

In some protocols, when decrypting data, it is essential that the behavior of the application does not depend on whether the padding is correct, down to precise timing. Applications should prefer protocols that use authenticated encryption rather than plain encryption. If the application must perform a decryption of unauthenticated data, the application writer should take care not to reveal whether the padding is invalid.

Implementations should strive to make valid and invalid padding as close as possible to indistinguishable to an external observer. In particular, the timing of a decryption operation should not depend on the validity of the padding.

`PSA_ERROR_INSUFFICIENT_DATA` (macro)

#define PSA_ERROR_INSUFFICIENT_DATA  ((psa_status_t)-143)

Return this error when there’s insufficient data when attempting to read from a resource.

`PSA_ERROR_INVALID_HANDLE` (macro)

#define PSA_ERROR_INVALID_HANDLE  ((psa_status_t)-136)

The key handle is not valid.

Key and algorithm types

`psa_key_type_t` (type)

typedef uint32_t psa_key_type_t;

Encoding of a key type.

`psa_ecc_curve_t` (type)

typedef uint16_t psa_ecc_curve_t;

The type of PSA elliptic curve identifiers.

`psa_dh_group_t` (type)

typedef uint16_t psa_dh_group_t;

The type of PSA Diffie-Hellman group identifiers.

`psa_algorithm_t` (type)

typedef uint32_t psa_algorithm_t;

Encoding of a cryptographic algorithm.

For algorithms that can be applied to multiple key types, this type does not encode the key type. For example, for symmetric ciphers based on a block cipher, psa_algorithm_t encodes the block cipher mode and the padding mode while the block cipher itself is encoded via psa_key_type_t.

`PSA_KEY_TYPE_NONE` (macro)

#define PSA_KEY_TYPE_NONE  ((psa_key_type_t)0x00000000)

An invalid key type value.

Zero is not the encoding of any key type.

`PSA_KEY_TYPE_VENDOR_FLAG` (macro)

#define PSA_KEY_TYPE_VENDOR_FLAG  ((psa_key_type_t)0x80000000)

Vendor-defined flag.

Key types defined by this standard will never have the PSA_KEY_TYPE_VENDOR_FLAG bit set. Vendors who define additional key types must use an encoding with the PSA_KEY_TYPE_VENDOR_FLAG bit set and should respect the bitwise structure used by standard encodings whenever practical.

`PSA_KEY_TYPE_CATEGORY_MASK` (macro)

#define PSA_KEY_TYPE_CATEGORY_MASK  ((psa_key_type_t)0x70000000)

`PSA_KEY_TYPE_CATEGORY_SYMMETRIC` (macro)

#define PSA_KEY_TYPE_CATEGORY_SYMMETRIC  ((psa_key_type_t)0x40000000)

`PSA_KEY_TYPE_CATEGORY_RAW` (macro)

#define PSA_KEY_TYPE_CATEGORY_RAW  ((psa_key_type_t)0x50000000)

`PSA_KEY_TYPE_CATEGORY_PUBLIC_KEY` (macro)

#define PSA_KEY_TYPE_CATEGORY_PUBLIC_KEY  ((psa_key_type_t)0x60000000)

`PSA_KEY_TYPE_CATEGORY_KEY_PAIR` (macro)

#define PSA_KEY_TYPE_CATEGORY_KEY_PAIR  ((psa_key_type_t)0x70000000)

`PSA_KEY_TYPE_CATEGORY_FLAG_PAIR` (macro)

#define PSA_KEY_TYPE_CATEGORY_FLAG_PAIR  ((psa_key_type_t)0x10000000)

`PSA_KEY_TYPE_IS_VENDOR_DEFINED` (macro)

#define PSA_KEY_TYPE_IS_VENDOR_DEFINED(type) \
    (((type) & PSA_KEY_TYPE_VENDOR_FLAG) != 0)

Parameters:

type

Description:

Whether a key type is vendor-defined.

`PSA_KEY_TYPE_IS_UNSTRUCTURED` (macro)

#define PSA_KEY_TYPE_IS_UNSTRUCTURED(type) \
    (((type) & PSA_KEY_TYPE_CATEGORY_MASK & ~(psa_key_type_t)0x10000000) == PSA_KEY_TYPE_CATEGORY_SYMMETRIC)

Parameters:

type

Description:

Whether a key type is an unstructured array of bytes.

This encompasses both symmetric keys and non-key data.

`PSA_KEY_TYPE_IS_ASYMMETRIC` (macro)

#define PSA_KEY_TYPE_IS_ASYMMETRIC(type) \
    (((type) & PSA_KEY_TYPE_CATEGORY_MASK & ~PSA_KEY_TYPE_CATEGORY_FLAG_PAIR) == PSA_KEY_TYPE_CATEGORY_PUBLIC_KEY)

Parameters:

type

Description:

Whether a key type is asymmetric: either a key pair or a public key.

`PSA_KEY_TYPE_IS_PUBLIC_KEY` (macro)

#define PSA_KEY_TYPE_IS_PUBLIC_KEY(type) \
    (((type) & PSA_KEY_TYPE_CATEGORY_MASK) == PSA_KEY_TYPE_CATEGORY_PUBLIC_KEY)

Parameters:

type

Description:

Whether a key type is the public part of a key pair.

`PSA_KEY_TYPE_IS_KEY_PAIR` (macro)

#define PSA_KEY_TYPE_IS_KEY_PAIR(type) \
    (((type) & PSA_KEY_TYPE_CATEGORY_MASK) == PSA_KEY_TYPE_CATEGORY_KEY_PAIR)

Parameters:

type

Description:

Whether a key type is a key pair containing a private part and a public part.

`PSA_KEY_TYPE_KEY_PAIR_OF_PUBLIC_KEY` (macro)

#define PSA_KEY_TYPE_KEY_PAIR_OF_PUBLIC_KEY(type) \
    ((type) | PSA_KEY_TYPE_CATEGORY_FLAG_PAIR)

Parameters:

type: A public key type or key pair type.

Returns:

The corresponding key pair type. If type is not a public key or a key pair, the return value is undefined.

Description:

The key pair type corresponding to a public key type.

You may also pass a key pair type as type, it will be left unchanged.

`PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR` (macro)

#define PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(type) \
    ((type) & ~PSA_KEY_TYPE_CATEGORY_FLAG_PAIR)

Parameters:

type: A public key type or key pair type.

Returns:

The corresponding public key type. If type is not a public key or a key pair, the return value is undefined.

Description:

The public key type corresponding to a key pair type.

You may also pass a key pair type as type, it will be left unchanged.

`PSA_KEY_TYPE_RAW_DATA` (macro)

#define PSA_KEY_TYPE_RAW_DATA  ((psa_key_type_t)0x50000001)

Raw data.

A “key” of this type cannot be used for any cryptographic operation. Applications may use this type to store arbitrary data in the keystore.

`PSA_KEY_TYPE_HMAC` (macro)

#define PSA_KEY_TYPE_HMAC  ((psa_key_type_t)0x51000000)

HMAC key.

The key policy determines which underlying hash algorithm the key can be used for.

HMAC keys should generally have the same size as the underlying hash. This size can be calculated with PSA_HASH_SIZE(alg) where alg is the HMAC algorithm or the underlying hash algorithm.

`PSA_KEY_TYPE_DERIVE` (macro)

#define PSA_KEY_TYPE_DERIVE  ((psa_key_type_t)0x52000000)

A secret for key derivation.

The key policy determines which key derivation algorithm the key can be used for.

`PSA_KEY_TYPE_AES` (macro)

#define PSA_KEY_TYPE_AES  ((psa_key_type_t)0x40000001)

Key for a cipher, AEAD or MAC algorithm based on the AES block cipher.

The size of the key can be 16 bytes (AES-128), 24 bytes (AES-192) or 32 bytes (AES-256).

`PSA_KEY_TYPE_DES` (macro)

#define PSA_KEY_TYPE_DES  ((psa_key_type_t)0x40000002)

Key for a cipher or MAC algorithm based on DES or 3DES (Triple-DES).

The size of the key can be 8 bytes (single DES), 16 bytes (2-key 3DES) or 24 bytes (3-key 3DES).

Note that single DES and 2-key 3DES are weak and strongly deprecated and should only be used to decrypt legacy data. 3-key 3DES is weak and deprecated and should only be used in legacy protocols.

`PSA_KEY_TYPE_CAMELLIA` (macro)

#define PSA_KEY_TYPE_CAMELLIA  ((psa_key_type_t)0x40000003)

Key for a cipher, AEAD or MAC algorithm based on the Camellia block cipher.

`PSA_KEY_TYPE_ARC4` (macro)

#define PSA_KEY_TYPE_ARC4  ((psa_key_type_t)0x40000004)

Key for the RC4 stream cipher.

Note that RC4 is weak and deprecated and should only be used in legacy protocols.

`PSA_KEY_TYPE_CHACHA20` (macro)

#define PSA_KEY_TYPE_CHACHA20  ((psa_key_type_t)0x40000005)

Key for the ChaCha20 stream cipher or the Chacha20-Poly1305 AEAD algorithm.

ChaCha20 and the ChaCha20_Poly1305 construction are defined in RFC 7539.

Implementations must support 12-byte nonces, may support 8-byte nonces, and should reject other sizes.

`PSA_KEY_TYPE_RSA_PUBLIC_KEY` (macro)

#define PSA_KEY_TYPE_RSA_PUBLIC_KEY  ((psa_key_type_t)0x60010000)

RSA public key.

`PSA_KEY_TYPE_RSA_KEY_PAIR` (macro)

#define PSA_KEY_TYPE_RSA_KEY_PAIR  ((psa_key_type_t)0x70010000)

RSA key pair (private and public key).

`PSA_KEY_TYPE_IS_RSA` (macro)

#define PSA_KEY_TYPE_IS_RSA(type) \
    (PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(type) == PSA_KEY_TYPE_RSA_PUBLIC_KEY)

Parameters:

type

Description:

Whether a key type is an RSA key (pair or public-only).

`PSA_KEY_TYPE_ECC_PUBLIC_KEY_BASE` (macro)

#define PSA_KEY_TYPE_ECC_PUBLIC_KEY_BASE  ((psa_key_type_t)0x60030000)

`PSA_KEY_TYPE_ECC_KEY_PAIR_BASE` (macro)

#define PSA_KEY_TYPE_ECC_KEY_PAIR_BASE  ((psa_key_type_t)0x70030000)

`PSA_KEY_TYPE_ECC_CURVE_MASK` (macro)

#define PSA_KEY_TYPE_ECC_CURVE_MASK  ((psa_key_type_t)0x0000ffff)

`PSA_KEY_TYPE_ECC_KEY_PAIR` (macro)

#define PSA_KEY_TYPE_ECC_KEY_PAIR(curve) \
    (PSA_KEY_TYPE_ECC_KEY_PAIR_BASE | (curve))

Parameters:

curve

Description:

Elliptic curve key pair.

`PSA_KEY_TYPE_ECC_PUBLIC_KEY` (macro)

#define PSA_KEY_TYPE_ECC_PUBLIC_KEY(curve) \
    (PSA_KEY_TYPE_ECC_PUBLIC_KEY_BASE | (curve))

Parameters:

curve

Description:

Elliptic curve public key.

`PSA_KEY_TYPE_IS_ECC` (macro)

#define PSA_KEY_TYPE_IS_ECC(type) \
    ((PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(type) & ~PSA_KEY_TYPE_ECC_CURVE_MASK) == PSA_KEY_TYPE_ECC_PUBLIC_KEY_BASE)

Parameters:

type

Description:

Whether a key type is an elliptic curve key (pair or public-only).

`PSA_KEY_TYPE_IS_ECC_KEY_PAIR` (macro)

#define PSA_KEY_TYPE_IS_ECC_KEY_PAIR(type) \
    (((type) & ~PSA_KEY_TYPE_ECC_CURVE_MASK) == PSA_KEY_TYPE_ECC_KEY_PAIR_BASE)

Parameters:

type

Description:

Whether a key type is an elliptic curve key pair.

`PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY` (macro)

#define PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY(type) \
    (((type) & ~PSA_KEY_TYPE_ECC_CURVE_MASK) == PSA_KEY_TYPE_ECC_PUBLIC_KEY_BASE)

Parameters:

type

Description:

Whether a key type is an elliptic curve public key.

`PSA_KEY_TYPE_GET_CURVE` (macro)

#define PSA_KEY_TYPE_GET_CURVE(type) \
    ((psa_ecc_curve_t) (PSA_KEY_TYPE_IS_ECC(type) ? ((type) & PSA_KEY_TYPE_ECC_CURVE_MASK) : 0))

Parameters:

type

Description:

Extract the curve from an elliptic curve key type.

`PSA_ECC_CURVE_SECT163K1` (macro)

#define PSA_ECC_CURVE_SECT163K1  ((psa_ecc_curve_t) 0x0001)

`PSA_ECC_CURVE_SECT163R1` (macro)

#define PSA_ECC_CURVE_SECT163R1  ((psa_ecc_curve_t) 0x0002)

`PSA_ECC_CURVE_SECT163R2` (macro)

#define PSA_ECC_CURVE_SECT163R2  ((psa_ecc_curve_t) 0x0003)

`PSA_ECC_CURVE_SECT193R1` (macro)

#define PSA_ECC_CURVE_SECT193R1  ((psa_ecc_curve_t) 0x0004)

`PSA_ECC_CURVE_SECT193R2` (macro)

#define PSA_ECC_CURVE_SECT193R2  ((psa_ecc_curve_t) 0x0005)

`PSA_ECC_CURVE_SECT233K1` (macro)

#define PSA_ECC_CURVE_SECT233K1  ((psa_ecc_curve_t) 0x0006)

`PSA_ECC_CURVE_SECT233R1` (macro)

#define PSA_ECC_CURVE_SECT233R1  ((psa_ecc_curve_t) 0x0007)

`PSA_ECC_CURVE_SECT239K1` (macro)

#define PSA_ECC_CURVE_SECT239K1  ((psa_ecc_curve_t) 0x0008)

`PSA_ECC_CURVE_SECT283K1` (macro)

#define PSA_ECC_CURVE_SECT283K1  ((psa_ecc_curve_t) 0x0009)

`PSA_ECC_CURVE_SECT283R1` (macro)

#define PSA_ECC_CURVE_SECT283R1  ((psa_ecc_curve_t) 0x000a)

`PSA_ECC_CURVE_SECT409K1` (macro)

#define PSA_ECC_CURVE_SECT409K1  ((psa_ecc_curve_t) 0x000b)

`PSA_ECC_CURVE_SECT409R1` (macro)

#define PSA_ECC_CURVE_SECT409R1  ((psa_ecc_curve_t) 0x000c)

`PSA_ECC_CURVE_SECT571K1` (macro)

#define PSA_ECC_CURVE_SECT571K1  ((psa_ecc_curve_t) 0x000d)

`PSA_ECC_CURVE_SECT571R1` (macro)

#define PSA_ECC_CURVE_SECT571R1  ((psa_ecc_curve_t) 0x000e)

`PSA_ECC_CURVE_SECP160K1` (macro)

#define PSA_ECC_CURVE_SECP160K1  ((psa_ecc_curve_t) 0x000f)

`PSA_ECC_CURVE_SECP160R1` (macro)

#define PSA_ECC_CURVE_SECP160R1  ((psa_ecc_curve_t) 0x0010)

`PSA_ECC_CURVE_SECP160R2` (macro)

#define PSA_ECC_CURVE_SECP160R2  ((psa_ecc_curve_t) 0x0011)

`PSA_ECC_CURVE_SECP192K1` (macro)

#define PSA_ECC_CURVE_SECP192K1  ((psa_ecc_curve_t) 0x0012)

`PSA_ECC_CURVE_SECP192R1` (macro)

#define PSA_ECC_CURVE_SECP192R1  ((psa_ecc_curve_t) 0x0013)

`PSA_ECC_CURVE_SECP224K1` (macro)

#define PSA_ECC_CURVE_SECP224K1  ((psa_ecc_curve_t) 0x0014)

`PSA_ECC_CURVE_SECP224R1` (macro)

#define PSA_ECC_CURVE_SECP224R1  ((psa_ecc_curve_t) 0x0015)

`PSA_ECC_CURVE_SECP256K1` (macro)

#define PSA_ECC_CURVE_SECP256K1  ((psa_ecc_curve_t) 0x0016)

`PSA_ECC_CURVE_SECP256R1` (macro)

#define PSA_ECC_CURVE_SECP256R1  ((psa_ecc_curve_t) 0x0017)

`PSA_ECC_CURVE_SECP384R1` (macro)

#define PSA_ECC_CURVE_SECP384R1  ((psa_ecc_curve_t) 0x0018)

`PSA_ECC_CURVE_SECP521R1` (macro)

#define PSA_ECC_CURVE_SECP521R1  ((psa_ecc_curve_t) 0x0019)

`PSA_ECC_CURVE_BRAINPOOL_P256R1` (macro)

#define PSA_ECC_CURVE_BRAINPOOL_P256R1  ((psa_ecc_curve_t) 0x001a)

`PSA_ECC_CURVE_BRAINPOOL_P384R1` (macro)

#define PSA_ECC_CURVE_BRAINPOOL_P384R1  ((psa_ecc_curve_t) 0x001b)

`PSA_ECC_CURVE_BRAINPOOL_P512R1` (macro)

#define PSA_ECC_CURVE_BRAINPOOL_P512R1  ((psa_ecc_curve_t) 0x001c)

`PSA_ECC_CURVE_CURVE25519` (macro)

#define PSA_ECC_CURVE_CURVE25519  ((psa_ecc_curve_t) 0x001d)

Curve25519.

This is the curve defined in Bernstein et al., Curve25519: new Diffie-Hellman speed records, LNCS 3958, 2006. The algorithm PSA_ALG_ECDH performs X25519 when used with this curve.

`PSA_ECC_CURVE_CURVE448` (macro)

#define PSA_ECC_CURVE_CURVE448  ((psa_ecc_curve_t) 0x001e)

Curve448.

This is the curve defined in Hamburg, Ed448-Goldilocks, a new elliptic curve, NIST ECC Workshop, 2015. The algorithm PSA_ALG_ECDH performs X448 when used with this curve.

`PSA_KEY_TYPE_DH_PUBLIC_KEY_BASE` (macro)

#define PSA_KEY_TYPE_DH_PUBLIC_KEY_BASE  ((psa_key_type_t)0x60040000)

`PSA_KEY_TYPE_DH_KEY_PAIR_BASE` (macro)

#define PSA_KEY_TYPE_DH_KEY_PAIR_BASE  ((psa_key_type_t)0x70040000)

`PSA_KEY_TYPE_DH_GROUP_MASK` (macro)

#define PSA_KEY_TYPE_DH_GROUP_MASK  ((psa_key_type_t)0x0000ffff)

`PSA_KEY_TYPE_DH_KEY_PAIR` (macro)

#define PSA_KEY_TYPE_DH_KEY_PAIR(group) \
    (PSA_KEY_TYPE_DH_KEY_PAIR_BASE | (group))

Parameters:

group

Description:

Diffie-Hellman key pair.

`PSA_KEY_TYPE_DH_PUBLIC_KEY` (macro)

#define PSA_KEY_TYPE_DH_PUBLIC_KEY(group) \
    (PSA_KEY_TYPE_DH_PUBLIC_KEY_BASE | (group))

Parameters:

group

Description:

Diffie-Hellman public key.

`PSA_KEY_TYPE_IS_DH` (macro)

#define PSA_KEY_TYPE_IS_DH(type) \
    ((PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(type) & ~PSA_KEY_TYPE_DH_GROUP_MASK) == PSA_KEY_TYPE_DH_PUBLIC_KEY_BASE)

Parameters:

type

Description:

Whether a key type is a Diffie-Hellman key (pair or public-only).

`PSA_KEY_TYPE_IS_DH_KEY_PAIR` (macro)

#define PSA_KEY_TYPE_IS_DH_KEY_PAIR(type) \
    (((type) & ~PSA_KEY_TYPE_DH_GROUP_MASK) == PSA_KEY_TYPE_DH_KEY_PAIR_BASE)

Parameters:

type

Description:

Whether a key type is a Diffie-Hellman key pair.

`PSA_KEY_TYPE_IS_DH_PUBLIC_KEY` (macro)

#define PSA_KEY_TYPE_IS_DH_PUBLIC_KEY(type) \
    (((type) & ~PSA_KEY_TYPE_DH_GROUP_MASK) == PSA_KEY_TYPE_DH_PUBLIC_KEY_BASE)

Parameters:

type

Description:

Whether a key type is a Diffie-Hellman public key.

`PSA_KEY_TYPE_GET_GROUP` (macro)

#define PSA_KEY_TYPE_GET_GROUP(type) \
    ((psa_dh_group_t) (PSA_KEY_TYPE_IS_DH(type) ? ((type) & PSA_KEY_TYPE_DH_GROUP_MASK) : 0))

Parameters:

type

Description:

Extract the group from a Diffie-Hellman key type.

`PSA_DH_GROUP_FFDHE2048` (macro)

#define PSA_DH_GROUP_FFDHE2048  ((psa_dh_group_t) 0x0100)

`PSA_DH_GROUP_FFDHE3072` (macro)

#define PSA_DH_GROUP_FFDHE3072  ((psa_dh_group_t) 0x0101)

`PSA_DH_GROUP_FFDHE4096` (macro)

#define PSA_DH_GROUP_FFDHE4096  ((psa_dh_group_t) 0x0102)

`PSA_DH_GROUP_FFDHE6144` (macro)

#define PSA_DH_GROUP_FFDHE6144  ((psa_dh_group_t) 0x0103)

`PSA_DH_GROUP_FFDHE8192` (macro)

#define PSA_DH_GROUP_FFDHE8192  ((psa_dh_group_t) 0x0104)

`PSA_BLOCK_CIPHER_BLOCK_SIZE` (macro)

#define PSA_BLOCK_CIPHER_BLOCK_SIZE(type) \
    ( (type) == PSA_KEY_TYPE_AES ? 16 : (type) == PSA_KEY_TYPE_DES ? 8 : (type) == PSA_KEY_TYPE_CAMELLIA ? 16 : (type) == PSA_KEY_TYPE_ARC4 ? 1 : 0)

Parameters:

type: A cipher key type (value of type psa_key_type_t).

Returns:

The block size for a block cipher, or 1 for a stream cipher. The return value is undefined if type is not a supported cipher key type.

Description:

The block size of a block cipher.

Note

It is possible to build stream cipher algorithms on top of a block cipher, for example CTR mode (PSA_ALG_CTR). This macro only takes the key type into account, so it cannot be used to determine the size of the data that psa_cipher_update() might buffer for future processing in general.

Note

This macro returns a compile-time constant if its argument is one.

Warning

This macro may evaluate its argument multiple times.

`PSA_ALG_VENDOR_FLAG` (macro)

#define PSA_ALG_VENDOR_FLAG  ((psa_algorithm_t)0x80000000)

`PSA_ALG_CATEGORY_MASK` (macro)

#define PSA_ALG_CATEGORY_MASK  ((psa_algorithm_t)0x7f000000)

`PSA_ALG_CATEGORY_HASH` (macro)

#define PSA_ALG_CATEGORY_HASH  ((psa_algorithm_t)0x01000000)

`PSA_ALG_CATEGORY_MAC` (macro)

#define PSA_ALG_CATEGORY_MAC  ((psa_algorithm_t)0x02000000)

`PSA_ALG_CATEGORY_CIPHER` (macro)

#define PSA_ALG_CATEGORY_CIPHER  ((psa_algorithm_t)0x04000000)

`PSA_ALG_CATEGORY_AEAD` (macro)

#define PSA_ALG_CATEGORY_AEAD  ((psa_algorithm_t)0x06000000)

`PSA_ALG_CATEGORY_SIGN` (macro)

#define PSA_ALG_CATEGORY_SIGN  ((psa_algorithm_t)0x10000000)

`PSA_ALG_CATEGORY_ASYMMETRIC_ENCRYPTION` (macro)

#define PSA_ALG_CATEGORY_ASYMMETRIC_ENCRYPTION  ((psa_algorithm_t)0x12000000)

`PSA_ALG_CATEGORY_KEY_DERIVATION` (macro)

#define PSA_ALG_CATEGORY_KEY_DERIVATION  ((psa_algorithm_t)0x20000000)

`PSA_ALG_CATEGORY_KEY_AGREEMENT` (macro)

#define PSA_ALG_CATEGORY_KEY_AGREEMENT  ((psa_algorithm_t)0x30000000)

`PSA_ALG_IS_VENDOR_DEFINED` (macro)

#define PSA_ALG_IS_VENDOR_DEFINED(alg)  (((alg) & PSA_ALG_VENDOR_FLAG) != 0)

Parameters:

alg

Description:

`PSA_ALG_IS_HASH` (macro)

#define PSA_ALG_IS_HASH(alg) \
    (((alg) & PSA_ALG_CATEGORY_MASK) == PSA_ALG_CATEGORY_HASH)

Parameters:

alg: An algorithm identifier (value of type psa_algorithm_t).

Returns:

1 if alg is a hash algorithm, 0 otherwise. This macro may return either 0 or 1 if alg is not a supported algorithm identifier.

Description:

Whether the specified algorithm is a hash algorithm.

`PSA_ALG_IS_MAC` (macro)

#define PSA_ALG_IS_MAC(alg) \
    (((alg) & PSA_ALG_CATEGORY_MASK) == PSA_ALG_CATEGORY_MAC)

Parameters:

alg: An algorithm identifier (value of type psa_algorithm_t).

Returns:

1 if alg is a MAC algorithm, 0 otherwise. This macro may return either 0 or 1 if alg is not a supported algorithm identifier.

Description:

Whether the specified algorithm is a MAC algorithm.

`PSA_ALG_IS_CIPHER` (macro)

#define PSA_ALG_IS_CIPHER(alg) \
    (((alg) & PSA_ALG_CATEGORY_MASK) == PSA_ALG_CATEGORY_CIPHER)

Parameters:

alg: An algorithm identifier (value of type psa_algorithm_t).

Returns:

1 if alg is a symmetric cipher algorithm, 0 otherwise. This macro may return either 0 or 1 if alg is not a supported algorithm identifier.

Description:

Whether the specified algorithm is a symmetric cipher algorithm.

`PSA_ALG_IS_AEAD` (macro)

#define PSA_ALG_IS_AEAD(alg) \
    (((alg) & PSA_ALG_CATEGORY_MASK) == PSA_ALG_CATEGORY_AEAD)

Parameters:

alg: An algorithm identifier (value of type psa_algorithm_t).

Returns:

1 if alg is an AEAD algorithm, 0 otherwise. This macro may return either 0 or 1 if alg is not a supported algorithm identifier.

Description:

Whether the specified algorithm is an authenticated encryption with associated data (AEAD) algorithm.

`PSA_ALG_IS_SIGN` (macro)

#define PSA_ALG_IS_SIGN(alg) \
    (((alg) & PSA_ALG_CATEGORY_MASK) == PSA_ALG_CATEGORY_SIGN)

Parameters:

alg: An algorithm identifier (value of type psa_algorithm_t).

Returns:

1 if alg is a public-key signature algorithm, 0 otherwise. This macro may return either 0 or 1 if alg is not a supported algorithm identifier.

Description:

Whether the specified algorithm is a public-key signature algorithm.

`PSA_ALG_IS_ASYMMETRIC_ENCRYPTION` (macro)

#define PSA_ALG_IS_ASYMMETRIC_ENCRYPTION(alg) \
    (((alg) & PSA_ALG_CATEGORY_MASK) == PSA_ALG_CATEGORY_ASYMMETRIC_ENCRYPTION)

Parameters:

alg: An algorithm identifier (value of type psa_algorithm_t).

Returns:

1 if alg is a public-key encryption algorithm, 0 otherwise. This macro may return either 0 or 1 if alg is not a supported algorithm identifier.

Description:

Whether the specified algorithm is a public-key encryption algorithm.

`PSA_ALG_IS_KEY_AGREEMENT` (macro)

#define PSA_ALG_IS_KEY_AGREEMENT(alg) \
    (((alg) & PSA_ALG_CATEGORY_MASK) == PSA_ALG_CATEGORY_KEY_AGREEMENT)

Parameters:

alg: An algorithm identifier (value of type psa_algorithm_t).

Returns:

1 if alg is a key agreement algorithm, 0 otherwise. This macro may return either 0 or 1 if alg is not a supported algorithm identifier.

Description:

Whether the specified algorithm is a key agreement algorithm.

`PSA_ALG_IS_KEY_DERIVATION` (macro)

#define PSA_ALG_IS_KEY_DERIVATION(alg) \
    (((alg) & PSA_ALG_CATEGORY_MASK) == PSA_ALG_CATEGORY_KEY_DERIVATION)

Parameters:

alg: An algorithm identifier (value of type psa_algorithm_t).

Returns:

1 if alg is a key derivation algorithm, 0 otherwise. This macro may return either 0 or 1 if alg is not a supported algorithm identifier.

Description:

Whether the specified algorithm is a key derivation algorithm.

`PSA_ALG_HASH_MASK` (macro)

#define PSA_ALG_HASH_MASK  ((psa_algorithm_t)0x000000ff)

`PSA_ALG_MD2` (macro)

#define PSA_ALG_MD2  ((psa_algorithm_t)0x01000001)

`PSA_ALG_MD4` (macro)

#define PSA_ALG_MD4  ((psa_algorithm_t)0x01000002)

`PSA_ALG_MD5` (macro)

#define PSA_ALG_MD5  ((psa_algorithm_t)0x01000003)

`PSA_ALG_RIPEMD160` (macro)

#define PSA_ALG_RIPEMD160  ((psa_algorithm_t)0x01000004)

`PSA_ALG_SHA_1` (macro)

#define PSA_ALG_SHA_1  ((psa_algorithm_t)0x01000005)

`PSA_ALG_SHA_224` (macro)

#define PSA_ALG_SHA_224  ((psa_algorithm_t)0x01000008)

SHA2-224.

`PSA_ALG_SHA_256` (macro)

#define PSA_ALG_SHA_256  ((psa_algorithm_t)0x01000009)

SHA2-256.

`PSA_ALG_SHA_384` (macro)

#define PSA_ALG_SHA_384  ((psa_algorithm_t)0x0100000a)

SHA2-384.

`PSA_ALG_SHA_512` (macro)

#define PSA_ALG_SHA_512  ((psa_algorithm_t)0x0100000b)

SHA2-512.

`PSA_ALG_SHA_512_224` (macro)

#define PSA_ALG_SHA_512_224  ((psa_algorithm_t)0x0100000c)

SHA2-512/224.

`PSA_ALG_SHA_512_256` (macro)

#define PSA_ALG_SHA_512_256  ((psa_algorithm_t)0x0100000d)

SHA2-512/256.

`PSA_ALG_SHA3_224` (macro)

#define PSA_ALG_SHA3_224  ((psa_algorithm_t)0x01000010)

SHA3-224.

`PSA_ALG_SHA3_256` (macro)

#define PSA_ALG_SHA3_256  ((psa_algorithm_t)0x01000011)

SHA3-256.

`PSA_ALG_SHA3_384` (macro)

#define PSA_ALG_SHA3_384  ((psa_algorithm_t)0x01000012)

SHA3-384.

`PSA_ALG_SHA3_512` (macro)

#define PSA_ALG_SHA3_512  ((psa_algorithm_t)0x01000013)

SHA3-512.

`PSA_ALG_ANY_HASH` (macro)

#define PSA_ALG_ANY_HASH  ((psa_algorithm_t)0x010000ff)

In a hash-and-sign algorithm policy, allow any hash algorithm.

This value may be used to form the algorithm usage field of a policy for a signature algorithm that is parametrized by a hash. The key may then be used to perform operations using the same signature algorithm parametrized with any supported hash.

That is, suppose that PSA_xxx_SIGNATURE is one of the following macros:

PSA_ALG_RSA_PKCS1V15_SIGN, PSA_ALG_RSA_PSS,
PSA_ALG_ECDSA, PSA_ALG_DETERMINISTIC_ECDSA. Then you may create and use a key as follows:

Set the key usage field using PSA_ALG_ANY_HASH, for example:

psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN); // or VERIFY
psa_set_key_algorithm(&attributes, PSA_xxx_SIGNATURE(PSA_ALG_ANY_HASH));

Import or generate key material.

Call psa_asymmetric_sign() or psa_asymmetric_verify(), passing an algorithm built from PSA_xxx_SIGNATURE and a specific hash. Each call to sign or verify a message may use a different hash.

psa_asymmetric_sign(handle, PSA_xxx_SIGNATURE(PSA_ALG_SHA_256), ...);
psa_asymmetric_sign(handle, PSA_xxx_SIGNATURE(PSA_ALG_SHA_512), ...);
psa_asymmetric_sign(handle, PSA_xxx_SIGNATURE(PSA_ALG_SHA3_256), ...);

This value may not be used to build other algorithms that are parametrized over a hash. For any valid use of this macro to build an algorithm alg, PSA_ALG_IS_HASH_AND_SIGN(alg) is true.

This value may not be used to build an algorithm specification to perform an operation. It is only valid to build policies.

`PSA_ALG_MAC_SUBCATEGORY_MASK` (macro)

#define PSA_ALG_MAC_SUBCATEGORY_MASK  ((psa_algorithm_t)0x00c00000)

`PSA_ALG_HMAC_BASE` (macro)

#define PSA_ALG_HMAC_BASE  ((psa_algorithm_t)0x02800000)

`PSA_ALG_HMAC` (macro)

#define PSA_ALG_HMAC(hash_alg) \
    (PSA_ALG_HMAC_BASE | ((hash_alg) & PSA_ALG_HASH_MASK))

Parameters:

hash_alg: A hash algorithm (PSA_ALG_XXX value such that PSA_ALG_IS_HASH(hash_alg) is true).

Returns:

The corresponding HMAC algorithm.

Unspecified if hash_alg is not a supported hash algorithm.

Description:

Macro to build an HMAC algorithm.

For example, PSA_ALG_HMAC(PSA_ALG_SHA_256) is HMAC-SHA-256.

`PSA_ALG_HMAC_GET_HASH` (macro)

#define PSA_ALG_HMAC_GET_HASH(hmac_alg) \
    (PSA_ALG_CATEGORY_HASH | ((hmac_alg) & PSA_ALG_HASH_MASK))

Parameters:

hmac_alg

Description:

`PSA_ALG_IS_HMAC` (macro)

#define PSA_ALG_IS_HMAC(alg) \
    (((alg) & (PSA_ALG_CATEGORY_MASK | PSA_ALG_MAC_SUBCATEGORY_MASK)) == PSA_ALG_HMAC_BASE)

Parameters:

alg: An algorithm identifier (value of type psa_algorithm_t).

Returns:

1 if alg is an HMAC algorithm, 0 otherwise. This macro may return either 0 or 1 if alg is not a supported algorithm identifier.

Description:

Whether the specified algorithm is an HMAC algorithm.

HMAC is a family of MAC algorithms that are based on a hash function.

`PSA_ALG_MAC_TRUNCATION_MASK` (macro)

#define PSA_ALG_MAC_TRUNCATION_MASK  ((psa_algorithm_t)0x00003f00)

`PSA_MAC_TRUNCATION_OFFSET` (macro)

#define PSA_MAC_TRUNCATION_OFFSET  8

`PSA_ALG_TRUNCATED_MAC` (macro)

#define PSA_ALG_TRUNCATED_MAC(mac_alg, mac_length) \
    (((mac_alg) & ~PSA_ALG_MAC_TRUNCATION_MASK) | ((mac_length) << PSA_MAC_TRUNCATION_OFFSET & PSA_ALG_MAC_TRUNCATION_MASK))

Parameters:

mac_alg: A MAC algorithm identifier (value of type psa_algorithm_t such that PSA_ALG_IS_MAC(alg) is true). This may be a truncated or untruncated MAC algorithm.
mac_length: Desired length of the truncated MAC in bytes. This must be at most the full length of the MAC and must be at least an implementation-specified minimum. The implementation-specified minimum shall not be zero.

Returns:

The corresponding MAC algorithm with the specified length.

Unspecified if alg is not a supported MAC algorithm or if mac_length is too small or too large for the specified MAC algorithm.

Description:

Macro to build a truncated MAC algorithm.

A truncated MAC algorithm is identical to the corresponding MAC algorithm except that the MAC value for the truncated algorithm consists of only the first mac_length bytes of the MAC value for the untruncated algorithm.

Note

This macro may allow constructing algorithm identifiers that are not valid, either because the specified length is larger than the untruncated MAC or because the specified length is smaller than permitted by the implementation.

Note

It is implementation-defined whether a truncated MAC that is truncated to the same length as the MAC of the untruncated algorithm is considered identical to the untruncated algorithm for policy comparison purposes.

`PSA_ALG_FULL_LENGTH_MAC` (macro)

#define PSA_ALG_FULL_LENGTH_MAC(mac_alg) \
    ((mac_alg) & ~PSA_ALG_MAC_TRUNCATION_MASK)

Parameters:

mac_alg: A MAC algorithm identifier (value of type psa_algorithm_t such that PSA_ALG_IS_MAC(alg) is true). This may be a truncated or untruncated MAC algorithm.

Returns:

The corresponding base MAC algorithm.

Unspecified if alg is not a supported MAC algorithm.

Description:

Macro to build the base MAC algorithm corresponding to a truncated MAC algorithm.

`PSA_MAC_TRUNCATED_LENGTH` (macro)

#define PSA_MAC_TRUNCATED_LENGTH(mac_alg) \
    (((mac_alg) & PSA_ALG_MAC_TRUNCATION_MASK) >> PSA_MAC_TRUNCATION_OFFSET)

Parameters:

mac_alg: A MAC algorithm identifier (value of type psa_algorithm_t such that PSA_ALG_IS_MAC(alg) is true).

Returns:

Length of the truncated MAC in bytes.

0 if alg is a non-truncated MAC algorithm.

Unspecified if alg is not a supported MAC algorithm.

Description:

Length to which a MAC algorithm is truncated.

`PSA_ALG_CIPHER_MAC_BASE` (macro)

#define PSA_ALG_CIPHER_MAC_BASE  ((psa_algorithm_t)0x02c00000)

`PSA_ALG_CBC_MAC` (macro)

#define PSA_ALG_CBC_MAC  ((psa_algorithm_t)0x02c00001)

`PSA_ALG_CMAC` (macro)

#define PSA_ALG_CMAC  ((psa_algorithm_t)0x02c00002)

`PSA_ALG_GMAC` (macro)

#define PSA_ALG_GMAC  ((psa_algorithm_t)0x02c00003)

`PSA_ALG_IS_BLOCK_CIPHER_MAC` (macro)

#define PSA_ALG_IS_BLOCK_CIPHER_MAC(alg) \
    (((alg) & (PSA_ALG_CATEGORY_MASK | PSA_ALG_MAC_SUBCATEGORY_MASK)) == PSA_ALG_CIPHER_MAC_BASE)

Parameters:

alg: An algorithm identifier (value of type psa_algorithm_t).

Returns:

1 if alg is a MAC algorithm based on a block cipher, 0 otherwise. This macro may return either 0 or 1 if alg is not a supported algorithm identifier.

Description:

Whether the specified algorithm is a MAC algorithm based on a block cipher.

`PSA_ALG_CIPHER_STREAM_FLAG` (macro)

#define PSA_ALG_CIPHER_STREAM_FLAG  ((psa_algorithm_t)0x00800000)

`PSA_ALG_CIPHER_FROM_BLOCK_FLAG` (macro)

#define PSA_ALG_CIPHER_FROM_BLOCK_FLAG  ((psa_algorithm_t)0x00400000)

`PSA_ALG_IS_STREAM_CIPHER` (macro)

#define PSA_ALG_IS_STREAM_CIPHER(alg) \
    (((alg) & (PSA_ALG_CATEGORY_MASK | PSA_ALG_CIPHER_STREAM_FLAG)) == (PSA_ALG_CATEGORY_CIPHER | PSA_ALG_CIPHER_STREAM_FLAG))

Parameters:

alg: An algorithm identifier (value of type psa_algorithm_t).

Returns:

1 if alg is a stream cipher algorithm, 0 otherwise. This macro may return either 0 or 1 if alg is not a supported algorithm identifier or if it is not a symmetric cipher algorithm.

Description:

Whether the specified algorithm is a stream cipher.

A stream cipher is a symmetric cipher that encrypts or decrypts messages by applying a bitwise-xor with a stream of bytes that is generated from a key.

`PSA_ALG_ARC4` (macro)

#define PSA_ALG_ARC4  ((psa_algorithm_t)0x04800001)

The ARC4 stream cipher algorithm.

`PSA_ALG_CHACHA20` (macro)

#define PSA_ALG_CHACHA20  ((psa_algorithm_t)0x04800005)

The ChaCha20 stream cipher.

ChaCha20 is defined in RFC 7539.

The nonce size for psa_cipher_set_iv() or psa_cipher_generate_iv() must be 12.

The initial block counter is always 0.

`PSA_ALG_CTR` (macro)

#define PSA_ALG_CTR  ((psa_algorithm_t)0x04c00001)

The CTR stream cipher mode.

CTR is a stream cipher which is built from a block cipher. The underlying block cipher is determined by the key type. For example, to use AES-128-CTR, use this algorithm with a key of type PSA_KEY_TYPE_AES and a length of 128 bits (16 bytes).

`PSA_ALG_CFB` (macro)

#define PSA_ALG_CFB  ((psa_algorithm_t)0x04c00002)

`PSA_ALG_OFB` (macro)

#define PSA_ALG_OFB  ((psa_algorithm_t)0x04c00003)

`PSA_ALG_XTS` (macro)

#define PSA_ALG_XTS  ((psa_algorithm_t)0x044000ff)

The XTS cipher mode.

XTS is a cipher mode which is built from a block cipher. It requires at least one full block of input, but beyond this minimum the input does not need to be a whole number of blocks.

`PSA_ALG_CBC_NO_PADDING` (macro)

#define PSA_ALG_CBC_NO_PADDING  ((psa_algorithm_t)0x04600100)

The CBC block cipher chaining mode, with no padding.

The underlying block cipher is determined by the key type.

This symmetric cipher mode can only be used with messages whose lengths are whole number of blocks for the chosen block cipher.

`PSA_ALG_CBC_PKCS7` (macro)

#define PSA_ALG_CBC_PKCS7  ((psa_algorithm_t)0x04600101)

The CBC block cipher chaining mode with PKCS#7 padding.

The underlying block cipher is determined by the key type.

This is the padding method defined by PKCS#7 (RFC 2315) §10.3.

`PSA_ALG_AEAD_FROM_BLOCK_FLAG` (macro)

#define PSA_ALG_AEAD_FROM_BLOCK_FLAG  ((psa_algorithm_t)0x00400000)

`PSA_ALG_IS_AEAD_ON_BLOCK_CIPHER` (macro)

#define PSA_ALG_IS_AEAD_ON_BLOCK_CIPHER(alg) \
    (((alg) & (PSA_ALG_CATEGORY_MASK | PSA_ALG_AEAD_FROM_BLOCK_FLAG)) == (PSA_ALG_CATEGORY_AEAD | PSA_ALG_AEAD_FROM_BLOCK_FLAG))

Parameters:

alg: An algorithm identifier (value of type psa_algorithm_t).

Returns:

1 if alg is an AEAD algorithm which is an AEAD mode based on a block cipher, 0 otherwise. This macro may return either 0 or 1 if alg is not a supported algorithm identifier.

Description:

Whether the specified algorithm is an AEAD mode on a block cipher.

`PSA_ALG_CCM` (macro)

#define PSA_ALG_CCM  ((psa_algorithm_t)0x06401001)

The CCM authenticated encryption algorithm.

`PSA_ALG_GCM` (macro)

#define PSA_ALG_GCM  ((psa_algorithm_t)0x06401002)

The GCM authenticated encryption algorithm.

`PSA_ALG_CHACHA20_POLY1305` (macro)

#define PSA_ALG_CHACHA20_POLY1305  ((psa_algorithm_t)0x06001005)

The Chacha20-Poly1305 AEAD algorithm.

The ChaCha20_Poly1305 construction is defined in RFC 7539.

Implementations must support 12-byte nonces, may support 8-byte nonces, and should reject other sizes.

Implementations must support 16-byte tags and should reject other sizes.

`PSA_ALG_AEAD_TAG_LENGTH_MASK` (macro)

#define PSA_ALG_AEAD_TAG_LENGTH_MASK  ((psa_algorithm_t)0x00003f00)

`PSA_AEAD_TAG_LENGTH_OFFSET` (macro)

#define PSA_AEAD_TAG_LENGTH_OFFSET  8

`PSA_ALG_AEAD_WITH_TAG_LENGTH` (macro)

#define PSA_ALG_AEAD_WITH_TAG_LENGTH(aead_alg, tag_length) \
    (((aead_alg) & ~PSA_ALG_AEAD_TAG_LENGTH_MASK) | ((tag_length) << PSA_AEAD_TAG_LENGTH_OFFSET & PSA_ALG_AEAD_TAG_LENGTH_MASK))

Parameters:

aead_alg: An AEAD algorithm identifier (value of type psa_algorithm_t such that PSA_ALG_IS_AEAD(alg) is true).
tag_length: Desired length of the authentication tag in bytes.

Returns:

The corresponding AEAD algorithm with the specified length.

Unspecified if alg is not a supported AEAD algorithm or if tag_length is not valid for the specified AEAD algorithm.

Description:

Macro to build a shortened AEAD algorithm.

A shortened AEAD algorithm is similar to the corresponding AEAD algorithm, but has an authentication tag that consists of fewer bytes. Depending on the algorithm, the tag length may affect the calculation of the ciphertext.

`PSA_ALG_AEAD_WITH_DEFAULT_TAG_LENGTH` (macro)

#define PSA_ALG_AEAD_WITH_DEFAULT_TAG_LENGTH(aead_alg) \
    ( PSA__ALG_AEAD_WITH_DEFAULT_TAG_LENGTH__CASE(aead_alg, PSA_ALG_CCM) PSA__ALG_AEAD_WITH_DEFAULT_TAG_LENGTH__CASE(aead_alg, PSA_ALG_GCM) PSA__ALG_AEAD_WITH_DEFAULT_TAG_LENGTH__CASE(aead_alg, PSA_ALG_CHACHA20_POLY1305) 0)

Parameters:

aead_alg: An AEAD algorithm (PSA_ALG_XXX value such that PSA_ALG_IS_AEAD(alg) is true).

Returns:

The corresponding AEAD algorithm with the default tag length for that algorithm.

Description:

Calculate the corresponding AEAD algorithm with the default tag length.

`PSA__ALG_AEAD_WITH_DEFAULT_TAG_LENGTH__CASE` (macro)

#define PSA__ALG_AEAD_WITH_DEFAULT_TAG_LENGTH__CASE(aead_alg, ref) \
    PSA_ALG_AEAD_WITH_TAG_LENGTH(aead_alg, 0) == PSA_ALG_AEAD_WITH_TAG_LENGTH(ref, 0) ? ref :

Parameters:

aead_alg
ref

Description:

`PSA_ALG_RSA_PKCS1V15_SIGN_BASE` (macro)

#define PSA_ALG_RSA_PKCS1V15_SIGN_BASE  ((psa_algorithm_t)0x10020000)

`PSA_ALG_RSA_PKCS1V15_SIGN` (macro)

#define PSA_ALG_RSA_PKCS1V15_SIGN(hash_alg) \
    (PSA_ALG_RSA_PKCS1V15_SIGN_BASE | ((hash_alg) & PSA_ALG_HASH_MASK))

Parameters:

hash_alg: A hash algorithm (PSA_ALG_XXX value such that PSA_ALG_IS_HASH(hash_alg) is true). This includes PSA_ALG_ANY_HASH when specifying the algorithm in a usage policy.

Returns:

The corresponding RSA PKCS#1 v1.5 signature algorithm.

Unspecified if hash_alg is not a supported hash algorithm.

Description:

RSA PKCS#1 v1.5 signature with hashing.

This is the signature scheme defined by RFC 8017 (PKCS#1: RSA Cryptography Specifications) under the name RSASSA-PKCS1-v1_5.

`PSA_ALG_RSA_PKCS1V15_SIGN_RAW` (macro)

#define PSA_ALG_RSA_PKCS1V15_SIGN_RAW  PSA_ALG_RSA_PKCS1V15_SIGN_BASE

Raw PKCS#1 v1.5 signature.

The input to this algorithm is the DigestInfo structure used by RFC 8017 (PKCS#1: RSA Cryptography Specifications), §9.2 steps 3–6.

`PSA_ALG_IS_RSA_PKCS1V15_SIGN` (macro)

#define PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) \
    (((alg) & ~PSA_ALG_HASH_MASK) == PSA_ALG_RSA_PKCS1V15_SIGN_BASE)

Parameters:

alg

Description:

`PSA_ALG_RSA_PSS_BASE` (macro)

#define PSA_ALG_RSA_PSS_BASE  ((psa_algorithm_t)0x10030000)

`PSA_ALG_RSA_PSS` (macro)

#define PSA_ALG_RSA_PSS(hash_alg) \
    (PSA_ALG_RSA_PSS_BASE | ((hash_alg) & PSA_ALG_HASH_MASK))

Parameters:

hash_alg: A hash algorithm (PSA_ALG_XXX value such that PSA_ALG_IS_HASH(hash_alg) is true). This includes PSA_ALG_ANY_HASH when specifying the algorithm in a usage policy.

Returns:

The corresponding RSA PSS signature algorithm.

Unspecified if hash_alg is not a supported hash algorithm.

Description:

RSA PSS signature with hashing.

This is the signature scheme defined by RFC 8017 (PKCS#1: RSA Cryptography Specifications) under the name RSASSA-PSS, with the message generation function MGF1, and with a salt length equal to the length of the hash. The specified hash algorithm is used to hash the input message, to create the salted hash, and for the mask generation.

`PSA_ALG_IS_RSA_PSS` (macro)

#define PSA_ALG_IS_RSA_PSS(alg) \
    (((alg) & ~PSA_ALG_HASH_MASK) == PSA_ALG_RSA_PSS_BASE)

Parameters:

alg

Description:

`PSA_ALG_ECDSA_BASE` (macro)

#define PSA_ALG_ECDSA_BASE  ((psa_algorithm_t)0x10060000)

`PSA_ALG_ECDSA` (macro)

#define PSA_ALG_ECDSA(hash_alg) \
    (PSA_ALG_ECDSA_BASE | ((hash_alg) & PSA_ALG_HASH_MASK))

Parameters:

hash_alg: A hash algorithm (PSA_ALG_XXX value such that PSA_ALG_IS_HASH(hash_alg) is true). This includes PSA_ALG_ANY_HASH when specifying the algorithm in a usage policy.

Returns:

The corresponding ECDSA signature algorithm.

Unspecified if hash_alg is not a supported hash algorithm.

Description:

ECDSA signature with hashing.

This is the ECDSA signature scheme defined by ANSI X9.62, with a random per-message secret number (k).

The representation of the signature as a byte string consists of the concatentation of the signature values r and s. Each of r and s is encoded as an N-octet string, where N is the length of the base point of the curve in octets. Each value is represented in big-endian order (most significant octet first).

`PSA_ALG_ECDSA_ANY` (macro)

#define PSA_ALG_ECDSA_ANY  PSA_ALG_ECDSA_BASE

ECDSA signature without hashing.

This is the same signature scheme as PSA_ALG_ECDSA(), but without specifying a hash algorithm. This algorithm may only be used to sign or verify a sequence of bytes that should be an already-calculated hash. Note that the input is padded with zeros on the left or truncated on the left as required to fit the curve size.

`PSA_ALG_DETERMINISTIC_ECDSA_BASE` (macro)

#define PSA_ALG_DETERMINISTIC_ECDSA_BASE  ((psa_algorithm_t)0x10070000)

`PSA_ALG_DETERMINISTIC_ECDSA` (macro)

#define PSA_ALG_DETERMINISTIC_ECDSA(hash_alg) \
    (PSA_ALG_DETERMINISTIC_ECDSA_BASE | ((hash_alg) & PSA_ALG_HASH_MASK))

Parameters:

hash_alg: A hash algorithm (PSA_ALG_XXX value such that PSA_ALG_IS_HASH(hash_alg) is true). This includes PSA_ALG_ANY_HASH when specifying the algorithm in a usage policy.

Returns:

The corresponding deterministic ECDSA signature algorithm.

Unspecified if hash_alg is not a supported hash algorithm.

Description:

Deterministic ECDSA signature with hashing.

This is the deterministic ECDSA signature scheme defined by RFC 6979.

The representation of a signature is the same as with PSA_ALG_ECDSA().

Note that when this algorithm is used for verification, signatures made with randomized ECDSA (PSA_ALG_ECDSA(hash_alg)) with the same private key are accepted. In other words, PSA_ALG_DETERMINISTIC_ECDSA(hash_alg) differs from PSA_ALG_ECDSA(hash_alg) only for signature, not for verification.

`PSA_ALG_IS_ECDSA` (macro)

#define PSA_ALG_IS_ECDSA(alg) \
    (((alg) & ~PSA_ALG_HASH_MASK & ~PSA_ALG_DSA_DETERMINISTIC_FLAG) == PSA_ALG_ECDSA_BASE)

Parameters:

alg

Description:

`PSA_ALG_ECDSA_IS_DETERMINISTIC` (macro)

#define PSA_ALG_ECDSA_IS_DETERMINISTIC(alg) \
    (((alg) & PSA_ALG_DSA_DETERMINISTIC_FLAG) != 0)

Parameters:

alg

Description:

`PSA_ALG_IS_DETERMINISTIC_ECDSA` (macro)

#define PSA_ALG_IS_DETERMINISTIC_ECDSA(alg) \
    (PSA_ALG_IS_ECDSA(alg) && PSA_ALG_ECDSA_IS_DETERMINISTIC(alg))

Parameters:

alg

Description:

`PSA_ALG_IS_RANDOMIZED_ECDSA` (macro)

#define PSA_ALG_IS_RANDOMIZED_ECDSA(alg) \
    (PSA_ALG_IS_ECDSA(alg) && !PSA_ALG_ECDSA_IS_DETERMINISTIC(alg))

Parameters:

alg

Description:

`PSA_ALG_IS_HASH_AND_SIGN` (macro)

#define PSA_ALG_IS_HASH_AND_SIGN(alg) \
    (PSA_ALG_IS_RSA_PSS(alg) || PSA_ALG_IS_RSA_PKCS1V15_SIGN(alg) || PSA_ALG_IS_ECDSA(alg))

Parameters:

alg: An algorithm identifier (value of type psa_algorithm_t).

Returns:

1 if alg is a hash-and-sign algorithm, 0 otherwise. This macro may return either 0 or 1 if alg is not a supported algorithm identifier.

Description:

Whether the specified algorithm is a hash-and-sign algorithm.

Hash-and-sign algorithms are public-key signature algorithms structured in two parts: first the calculation of a hash in a way that does not depend on the key, then the calculation of a signature from the hash value and the key.

`PSA_ALG_SIGN_GET_HASH` (macro)

#define PSA_ALG_SIGN_GET_HASH(alg) \
    (PSA_ALG_IS_HASH_AND_SIGN(alg) ? ((alg) & PSA_ALG_HASH_MASK) == 0 ? /*"raw" algorithm*/ 0 : ((alg) & PSA_ALG_HASH_MASK) | PSA_ALG_CATEGORY_HASH : 0)

Parameters:

alg: A signature algorithm (PSA_ALG_XXX value such that PSA_ALG_IS_SIGN(alg) is true).

Returns:

The underlying hash algorithm if alg is a hash-and-sign algorithm.

0 if alg is a signature algorithm that does not follow the hash-and-sign structure.

Unspecified if alg is not a signature algorithm or if it is not supported by the implementation.

Description:

Get the hash used by a hash-and-sign signature algorithm.

A hash-and-sign algorithm is a signature algorithm which is composed of two phases: first a hashing phase which does not use the key and produces a hash of the input message, then a signing phase which only uses the hash and the key and not the message itself.

`PSA_ALG_RSA_PKCS1V15_CRYPT` (macro)

#define PSA_ALG_RSA_PKCS1V15_CRYPT  ((psa_algorithm_t)0x12020000)

RSA PKCS#1 v1.5 encryption.

`PSA_ALG_RSA_OAEP_BASE` (macro)

#define PSA_ALG_RSA_OAEP_BASE  ((psa_algorithm_t)0x12030000)

`PSA_ALG_RSA_OAEP` (macro)

#define PSA_ALG_RSA_OAEP(hash_alg) \
    (PSA_ALG_RSA_OAEP_BASE | ((hash_alg) & PSA_ALG_HASH_MASK))

Parameters:

hash_alg: The hash algorithm (PSA_ALG_XXX value such that PSA_ALG_IS_HASH(hash_alg) is true) to use for MGF1.

Returns:

The corresponding RSA OAEP signature algorithm.

Unspecified if hash_alg is not a supported hash algorithm.

Description:

RSA OAEP encryption.

This is the encryption scheme defined by RFC 8017 (PKCS#1: RSA Cryptography Specifications) under the name RSAES-OAEP, with the message generation function MGF1.

`PSA_ALG_IS_RSA_OAEP` (macro)

#define PSA_ALG_IS_RSA_OAEP(alg) \
    (((alg) & ~PSA_ALG_HASH_MASK) == PSA_ALG_RSA_OAEP_BASE)

Parameters:

alg

Description:

`PSA_ALG_RSA_OAEP_GET_HASH` (macro)

#define PSA_ALG_RSA_OAEP_GET_HASH(alg) \
    (PSA_ALG_IS_RSA_OAEP(alg) ? ((alg) & PSA_ALG_HASH_MASK) | PSA_ALG_CATEGORY_HASH : 0)

Parameters:

alg

Description:

`PSA_ALG_HKDF_BASE` (macro)

#define PSA_ALG_HKDF_BASE  ((psa_algorithm_t)0x20000100)

`PSA_ALG_HKDF` (macro)

#define PSA_ALG_HKDF(hash_alg) \
    (PSA_ALG_HKDF_BASE | ((hash_alg) & PSA_ALG_HASH_MASK))

Parameters:

hash_alg: A hash algorithm (PSA_ALG_XXX value such that PSA_ALG_IS_HASH(hash_alg) is true).

Returns:

The corresponding HKDF algorithm.

Unspecified if hash_alg is not a supported hash algorithm.

Description:

Macro to build an HKDF algorithm.

For example, PSA_ALG_HKDF(PSA_ALG_SHA256) is HKDF using HMAC-SHA-256.

This key derivation algorithm uses the following inputs:

PSA_KEY_DERIVATION_INPUT_SALT is the salt used in the “extract” step. It is optional; if omitted, the derivation uses an empty salt.
PSA_KEY_DERIVATION_INPUT_SECRET is the secret key used in the “extract” step.
PSA_KEY_DERIVATION_INPUT_INFO is the info string used in the “expand” step. You must pass PSA_KEY_DERIVATION_INPUT_SALT before PSA_KEY_DERIVATION_INPUT_SECRET. You may pass PSA_KEY_DERIVATION_INPUT_INFO at any time after steup and before starting to generate output.

`PSA_ALG_IS_HKDF` (macro)

#define PSA_ALG_IS_HKDF(alg) \
    (((alg) & ~PSA_ALG_HASH_MASK) == PSA_ALG_HKDF_BASE)

Parameters:

alg: An algorithm identifier (value of type psa_algorithm_t).

Returns:

1 if alg is an HKDF algorithm, 0 otherwise. This macro may return either 0 or 1 if alg is not a supported key derivation algorithm identifier.

Description:

Whether the specified algorithm is an HKDF algorithm.

HKDF is a family of key derivation algorithms that are based on a hash function and the HMAC construction.

`PSA_ALG_HKDF_GET_HASH` (macro)

#define PSA_ALG_HKDF_GET_HASH(hkdf_alg) \
    (PSA_ALG_CATEGORY_HASH | ((hkdf_alg) & PSA_ALG_HASH_MASK))

Parameters:

hkdf_alg

Description:

`PSA_ALG_TLS12_PRF_BASE` (macro)

#define PSA_ALG_TLS12_PRF_BASE  ((psa_algorithm_t)0x20000200)

`PSA_ALG_TLS12_PRF` (macro)

#define PSA_ALG_TLS12_PRF(hash_alg) \
    (PSA_ALG_TLS12_PRF_BASE | ((hash_alg) & PSA_ALG_HASH_MASK))

Parameters:

hash_alg: A hash algorithm (PSA_ALG_XXX value such that PSA_ALG_IS_HASH(hash_alg) is true).

Returns:

The corresponding TLS-1.2 PRF algorithm.

Unspecified if hash_alg is not a supported hash algorithm.

Description:

Macro to build a TLS-1.2 PRF algorithm.

TLS 1.2 uses a custom pseudorandom function (PRF) for key schedule, specified in Section 5 of RFC 5246. It is based on HMAC and can be used with either SHA-256 or SHA-384.

This key derivation algorithm uses the following inputs:

PSA_KEY_DERIVATION_INPUT_SECRET is the secret key.
PSA_KEY_DERIVATION_INPUT_LABEL is the label.
PSA_KEY_DERIVATION_INPUT_SEED is the seed.

For the application to TLS-1.2 key expansion, the seed is the concatenation of ServerHello.Random + ClientHello.Random, and the label is “key expansion”.

For example, PSA_ALG_TLS12_PRF(PSA_ALG_SHA256) represents the TLS 1.2 PRF using HMAC-SHA-256.

`PSA_ALG_IS_TLS12_PRF` (macro)

#define PSA_ALG_IS_TLS12_PRF(alg) \
    (((alg) & ~PSA_ALG_HASH_MASK) == PSA_ALG_TLS12_PRF_BASE)

Parameters:

alg: An algorithm identifier (value of type psa_algorithm_t).

Returns:

1 if alg is a TLS-1.2 PRF algorithm, 0 otherwise. This macro may return either 0 or 1 if alg is not a supported key derivation algorithm identifier.

Description:

Whether the specified algorithm is a TLS-1.2 PRF algorithm.

`PSA_ALG_TLS12_PRF_GET_HASH` (macro)

#define PSA_ALG_TLS12_PRF_GET_HASH(hkdf_alg) \
    (PSA_ALG_CATEGORY_HASH | ((hkdf_alg) & PSA_ALG_HASH_MASK))

Parameters:

hkdf_alg

Description:

`PSA_ALG_TLS12_PSK_TO_MS_BASE` (macro)

#define PSA_ALG_TLS12_PSK_TO_MS_BASE  ((psa_algorithm_t)0x20000300)

`PSA_ALG_TLS12_PSK_TO_MS` (macro)

#define PSA_ALG_TLS12_PSK_TO_MS(hash_alg) \
    (PSA_ALG_TLS12_PSK_TO_MS_BASE | ((hash_alg) & PSA_ALG_HASH_MASK))

Parameters:

hash_alg: A hash algorithm (PSA_ALG_XXX value such that PSA_ALG_IS_HASH(hash_alg) is true).

Returns:

The corresponding TLS-1.2 PSK to MS algorithm.

Unspecified if hash_alg is not a supported hash algorithm.

Description:

Macro to build a TLS-1.2 PSK-to-MasterSecret algorithm.

In a pure-PSK handshake in TLS 1.2, the master secret is derived from the PreSharedKey (PSK) through the application of padding (RFC 4279, Section 2) and the TLS-1.2 PRF (RFC 5246, Section 5). The latter is based on HMAC and can be used with either SHA-256 or SHA-384.

This key derivation algorithm uses the following inputs:

PSA_KEY_DERIVATION_INPUT_SECRET is the secret key.
PSA_KEY_DERIVATION_INPUT_LABEL is the label.
PSA_KEY_DERIVATION_INPUT_SEED is the seed.

For the application to TLS-1.2, the seed (which is forwarded to the TLS-1.2 PRF) is the concatenation of the ClientHello.Random + ServerHello.Random, and the label is “master secret” or “extended master secret”.

For example, PSA_ALG_TLS12_PSK_TO_MS(PSA_ALG_SHA256) represents the TLS-1.2 PSK to MasterSecret derivation PRF using HMAC-SHA-256.

`PSA_ALG_IS_TLS12_PSK_TO_MS` (macro)

#define PSA_ALG_IS_TLS12_PSK_TO_MS(alg) \
    (((alg) & ~PSA_ALG_HASH_MASK) == PSA_ALG_TLS12_PSK_TO_MS_BASE)

Parameters:

alg: An algorithm identifier (value of type psa_algorithm_t).

Returns:

1 if alg is a TLS-1.2 PSK to MS algorithm, 0 otherwise. This macro may return either 0 or 1 if alg is not a supported key derivation algorithm identifier.

Description:

Whether the specified algorithm is a TLS-1.2 PSK to MS algorithm.

`PSA_ALG_TLS12_PSK_TO_MS_GET_HASH` (macro)

#define PSA_ALG_TLS12_PSK_TO_MS_GET_HASH(hkdf_alg) \
    (PSA_ALG_CATEGORY_HASH | ((hkdf_alg) & PSA_ALG_HASH_MASK))

Parameters:

hkdf_alg

Description:

`PSA_ALG_KEY_DERIVATION_MASK` (macro)

#define PSA_ALG_KEY_DERIVATION_MASK  ((psa_algorithm_t)0x0803ffff)

`PSA_ALG_KEY_AGREEMENT_MASK` (macro)

#define PSA_ALG_KEY_AGREEMENT_MASK  ((psa_algorithm_t)0x10fc0000)

`PSA_ALG_KEY_AGREEMENT` (macro)

#define PSA_ALG_KEY_AGREEMENT(ka_alg, kdf_alg)  ((ka_alg) | (kdf_alg))

Parameters:

ka_alg: A key agreement algorithm (PSA_ALG_XXX value such that PSA_ALG_IS_KEY_AGREEMENT(ka_alg) is true).
kdf_alg: A key derivation algorithm (PSA_ALG_XXX value such that PSA_ALG_IS_KEY_DERIVATION(kdf_alg) is true).

Returns:

The corresponding key agreement and derivation algorithm.

Unspecified if ka_alg is not a supported key agreement algorithm or kdf_alg is not a supported key derivation algorithm.

Description:

Macro to build a combined algorithm that chains a key agreement with a key derivation.

`PSA_ALG_KEY_AGREEMENT_GET_KDF` (macro)

#define PSA_ALG_KEY_AGREEMENT_GET_KDF(alg) \
    (((alg) & PSA_ALG_KEY_DERIVATION_MASK) | PSA_ALG_CATEGORY_KEY_DERIVATION)

Parameters:

alg

Description:

`PSA_ALG_KEY_AGREEMENT_GET_BASE` (macro)

#define PSA_ALG_KEY_AGREEMENT_GET_BASE(alg) \
    (((alg) & PSA_ALG_KEY_AGREEMENT_MASK) | PSA_ALG_CATEGORY_KEY_AGREEMENT)

Parameters:

alg

Description:

`PSA_ALG_IS_RAW_KEY_AGREEMENT` (macro)

#define PSA_ALG_IS_RAW_KEY_AGREEMENT(alg) \
    (PSA_ALG_IS_KEY_AGREEMENT(alg) && PSA_ALG_KEY_AGREEMENT_GET_KDF(alg) == PSA_ALG_CATEGORY_KEY_DERIVATION)

Parameters:

alg: An algorithm identifier (value of type psa_algorithm_t).

Returns:

1 if alg is a raw key agreement algorithm, 0 otherwise. This macro may return either 0 or 1 if alg is not a supported algorithm identifier.

Description:

Whether the specified algorithm is a raw key agreement algorithm.

A raw key agreement algorithm is one that does not specify a key derivation function. Usually, raw key agreement algorithms are constructed directly with a PSA_ALG_xxx macro while non-raw key agreement algorithms are constructed with PSA_ALG_KEY_AGREEMENT().

`PSA_ALG_IS_KEY_DERIVATION_OR_AGREEMENT` (macro)

#define PSA_ALG_IS_KEY_DERIVATION_OR_AGREEMENT(alg) \
    ((PSA_ALG_IS_KEY_DERIVATION(alg) || PSA_ALG_IS_KEY_AGREEMENT(alg)))

Parameters:

alg

Description:

`PSA_ALG_FFDH` (macro)

#define PSA_ALG_FFDH  ((psa_algorithm_t)0x30100000)

The finite-field Diffie-Hellman (DH) key agreement algorithm.

The shared secret produced by key agreement is g^{ab} in big-endian format. It is ceiling(m / 8) bytes long where m is the size of the prime p in bits.

`PSA_ALG_IS_FFDH` (macro)

#define PSA_ALG_IS_FFDH(alg) \
    (PSA_ALG_KEY_AGREEMENT_GET_BASE(alg) == PSA_ALG_FFDH)

Parameters:

alg: An algorithm identifier (value of type psa_algorithm_t).

Returns:

1 if alg is a finite field Diffie-Hellman algorithm, 0 otherwise. This macro may return either 0 or 1 if alg is not a supported key agreement algorithm identifier.

Description:

Whether the specified algorithm is a finite field Diffie-Hellman algorithm.

This includes the raw finite field Diffie-Hellman algorithm as well as finite-field Diffie-Hellman followed by any supporter key derivation algorithm.

`PSA_ALG_ECDH` (macro)

#define PSA_ALG_ECDH  ((psa_algorithm_t)0x30200000)

The elliptic curve Diffie-Hellman (ECDH) key agreement algorithm.

The shared secret produced by key agreement is the x-coordinate of the shared secret point. It is always ceiling(m / 8) bytes long where m is the bit size associated with the curve, i.e. the bit size of the order of the curve’s coordinate field. When m is not a multiple of 8, the byte containing the most significant bit of the shared secret is padded with zero bits. The byte order is either little-endian or big-endian depending on the curve type.

For Montgomery curves (curve types PSA_ECC_CURVE_CURVEXXX), the shared secret is the x-coordinate of d_A Q_B = d_B Q_A in little-endian byte order. The bit size is 448 for Curve448 and 255 for Curve25519.
For Weierstrass curves over prime fields (curve types PSA_ECC_CURVE_SECPXXX and PSA_ECC_CURVE_BRAINPOOL_PXXX), the shared secret is the x-coordinate of d_A Q_B = d_B Q_A in big-endian byte order. The bit size is m = ceiling(log_2(p)) for the field F_p.
For Weierstrass curves over binary fields (curve types PSA_ECC_CURVE_SECTXXX), the shared secret is the x-coordinate of d_A Q_B = d_B Q_A in big-endian byte order. The bit size is m for the field F_{2^m}.

`PSA_ALG_IS_ECDH` (macro)

#define PSA_ALG_IS_ECDH(alg) \
    (PSA_ALG_KEY_AGREEMENT_GET_BASE(alg) == PSA_ALG_ECDH)

Parameters:

alg: An algorithm identifier (value of type psa_algorithm_t).

Returns:

1 if alg is an elliptic curve Diffie-Hellman algorithm, 0 otherwise. This macro may return either 0 or 1 if alg is not a supported key agreement algorithm identifier.

Description:

Whether the specified algorithm is an elliptic curve Diffie-Hellman algorithm.

This includes the raw elliptic curve Diffie-Hellman algorithm as well as elliptic curve Diffie-Hellman followed by any supporter key derivation algorithm.

`PSA_ALG_IS_WILDCARD` (macro)

#define PSA_ALG_IS_WILDCARD(alg) \
    (PSA_ALG_IS_HASH_AND_SIGN(alg) ? PSA_ALG_SIGN_GET_HASH(alg) == PSA_ALG_ANY_HASH : (alg) == PSA_ALG_ANY_HASH)

Parameters:

alg: An algorithm identifier (value of type psa_algorithm_t).

Returns:

1 if alg is a wildcard algorithm encoding.

0 if alg is a non-wildcard algorithm encoding (suitable for an operation).

This macro may return either 0 or 1 if alg is not a supported algorithm identifier.

Description:

Whether the specified algorithm encoding is a wildcard.

Wildcard values may only be used to set the usage algorithm field in a policy, not to perform an operation.

Key lifetimes

`psa_key_lifetime_t` (type)

typedef uint32_t psa_key_lifetime_t;

Encoding of key lifetimes.

The lifetime of a key indicates where it is stored and what system actions may create and destroy it.

Keys with the lifetime PSA_KEY_LIFETIME_VOLATILE are automatically destroyed when the application terminates or on a power reset.

Keys with a lifetime other than PSA_KEY_LIFETIME_VOLATILE are said to be persistent. Persistent keys are preserved if the application or the system restarts. Persistent keys have a key identifier of type psa_key_id_t. The application can call psa_open_key() to open a persistent key that it created previously.

`psa_key_id_t` (type)

typedef uint32_t psa_key_id_t;

Encoding of identifiers of persistent keys.

Applications may freely choose key identifiers in the range PSA_KEY_ID_USER_MIN to PSA_KEY_ID_USER_MAX.
Implementations may define additional key identifiers in the range PSA_KEY_ID_VENDOR_MIN to PSA_KEY_ID_VENDOR_MAX.
0 is reserved as an invalid key identifier.
Key identifiers outside these ranges are reserved for future use.

`PSA_KEY_LIFETIME_VOLATILE` (macro)

#define PSA_KEY_LIFETIME_VOLATILE  ((psa_key_lifetime_t)0x00000000)

A volatile key only exists as long as the handle to it is not closed.

The key material is guaranteed to be erased on a power reset.

`PSA_KEY_LIFETIME_PERSISTENT` (macro)

#define PSA_KEY_LIFETIME_PERSISTENT  ((psa_key_lifetime_t)0x00000001)

The default storage area for persistent keys.

A persistent key remains in storage until it is explicitly destroyed or until the corresponding storage area is wiped. This specification does not define any mechanism to wipe a storage area, but implementations may provide their own mechanism (for example to perform a factory reset, to prepare for device refurbishment, or to uninstall an application).

This lifetime value is the default storage area for the calling application. Implementations may offer other storage areas designated by other lifetime values as implementation-specific extensions.

`PSA_KEY_ID_USER_MIN` (macro)

#define PSA_KEY_ID_USER_MIN  ((psa_key_id_t)0x00000001)

The minimum value for a key identifier chosen by the application.

`PSA_KEY_ID_USER_MAX` (macro)

#define PSA_KEY_ID_USER_MAX  ((psa_key_id_t)0x3fffffff)

The maximum value for a key identifier chosen by the application.

`PSA_KEY_ID_VENDOR_MIN` (macro)

#define PSA_KEY_ID_VENDOR_MIN  ((psa_key_id_t)0x40000000)

The minimum value for a key identifier chosen by the implementation.

`PSA_KEY_ID_VENDOR_MAX` (macro)

#define PSA_KEY_ID_VENDOR_MAX  ((psa_key_id_t)0x7fffffff)

The maximum value for a key identifier chosen by the implementation.

Key policies

`psa_key_usage_t` (type)

typedef uint32_t psa_key_usage_t;

Encoding of permitted usage on a key.

`PSA_KEY_USAGE_EXPORT` (macro)

#define PSA_KEY_USAGE_EXPORT  ((psa_key_usage_t)0x00000001)

Whether the key may be exported.

A public key or the public part of a key pair may always be exported regardless of the value of this permission flag.

If a key does not have export permission, implementations shall not allow the key to be exported in plain form from the cryptoprocessor, whether through psa_export_key() or through a proprietary interface. The key may however be exportable in a wrapped form, i.e. in a form where it is encrypted by another key.

`PSA_KEY_USAGE_COPY` (macro)

#define PSA_KEY_USAGE_COPY  ((psa_key_usage_t)0x00000002)

Whether the key may be copied.

This flag allows the use of psa_copy_key() to make a copy of the key with the same policy or a more restrictive policy.

For lifetimes for which the key is located in a secure element which enforce the non-exportability of keys, copying a key outside the secure element also requires the usage flag PSA_KEY_USAGE_EXPORT. Copying the key inside the secure element is permitted with just PSA_KEY_USAGE_COPY if the secure element supports it. For keys with the lifetime PSA_KEY_LIFETIME_VOLATILE or PSA_KEY_LIFETIME_PERSISTENT, the usage flag PSA_KEY_USAGE_COPY is sufficient to permit the copy.

`PSA_KEY_USAGE_ENCRYPT` (macro)

#define PSA_KEY_USAGE_ENCRYPT  ((psa_key_usage_t)0x00000100)

Whether the key may be used to encrypt a message.

This flag allows the key to be used for a symmetric encryption operation, for an AEAD encryption-and-authentication operation, or for an asymmetric encryption operation, if otherwise permitted by the key’s type and policy.

For a key pair, this concerns the public key.

`PSA_KEY_USAGE_DECRYPT` (macro)

#define PSA_KEY_USAGE_DECRYPT  ((psa_key_usage_t)0x00000200)

Whether the key may be used to decrypt a message.

This flag allows the key to be used for a symmetric decryption operation, for an AEAD decryption-and-verification operation, or for an asymmetric decryption operation, if otherwise permitted by the key’s type and policy.

For a key pair, this concerns the private key.

`PSA_KEY_USAGE_SIGN` (macro)

#define PSA_KEY_USAGE_SIGN  ((psa_key_usage_t)0x00000400)

Whether the key may be used to sign a message.

This flag allows the key to be used for a MAC calculation operation or for an asymmetric signature operation, if otherwise permitted by the key’s type and policy.

For a key pair, this concerns the private key.

`PSA_KEY_USAGE_VERIFY` (macro)

#define PSA_KEY_USAGE_VERIFY  ((psa_key_usage_t)0x00000800)

Whether the key may be used to verify a message signature.

This flag allows the key to be used for a MAC verification operation or for an asymmetric signature verification operation, if otherwise permitted by by the key’s type and policy.

For a key pair, this concerns the public key.

`PSA_KEY_USAGE_DERIVE` (macro)

#define PSA_KEY_USAGE_DERIVE  ((psa_key_usage_t)0x00001000)

Whether the key may be used to derive other keys.

Key derivation

`psa_key_derivation_step_t` (type)

typedef uint16_t psa_key_derivation_step_t;

Encoding of the step of a key derivation.

`PSA_KEY_DERIVATION_INPUT_SECRET` (macro)

#define PSA_KEY_DERIVATION_INPUT_SECRET  ((psa_key_derivation_step_t)0x0101)

A secret input for key derivation.

This must be a key of type PSA_KEY_TYPE_DERIVE.

`PSA_KEY_DERIVATION_INPUT_LABEL` (macro)

#define PSA_KEY_DERIVATION_INPUT_LABEL  ((psa_key_derivation_step_t)0x0201)

A label for key derivation.

This must be a direct input.

`PSA_KEY_DERIVATION_INPUT_SALT` (macro)

#define PSA_KEY_DERIVATION_INPUT_SALT  ((psa_key_derivation_step_t)0x0202)

A salt for key derivation.

This must be a direct input.

`PSA_KEY_DERIVATION_INPUT_INFO` (macro)

#define PSA_KEY_DERIVATION_INPUT_INFO  ((psa_key_derivation_step_t)0x0203)

An information string for key derivation.

This must be a direct input.

`PSA_KEY_DERIVATION_INPUT_SEED` (macro)

#define PSA_KEY_DERIVATION_INPUT_SEED  ((psa_key_derivation_step_t)0x0204)

A seed for key derivation.

This must be a direct input.

Other definitions

`PSA_BITS_TO_BYTES` (macro)

#define PSA_BITS_TO_BYTES(bits)  (((bits) + 7) / 8)

Parameters:

bits

Description:

`PSA_BYTES_TO_BITS` (macro)

#define PSA_BYTES_TO_BITS(bytes)  ((bytes) * 8)

Parameters:

bytes

Description:

`PSA_ROUND_UP_TO_MULTIPLE` (macro)

#define PSA_ROUND_UP_TO_MULTIPLE(block_size, length) \
    (((length) + (block_size) - 1) / (block_size) * (block_size))

Parameters:

block_size
length

Description:

`PSA_HASH_SIZE` (macro)

#define PSA_HASH_SIZE(alg) \
    ( PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_MD2 ? 16 : PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_MD4 ? 16 : PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_MD5 ? 16 : PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_RIPEMD160 ? 20 : PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA_1 ? 20 : PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA_224 ? 28 : PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA_256 ? 32 : PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA_384 ? 48 : PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA_512 ? 64 : PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA_512_224 ? 28 : PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA_512_256 ? 32 : PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA3_224 ? 28 : PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA3_256 ? 32 : PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA3_384 ? 48 : PSA_ALG_HMAC_GET_HASH(alg) == PSA_ALG_SHA3_512 ? 64 : 0)

Parameters:

alg: A hash algorithm (PSA_ALG_XXX value such that PSA_ALG_IS_HASH(alg) is true), or an HMAC algorithm (PSA_ALG_HMAC(hash_alg) where hash_alg is a hash algorithm).

Returns:

The hash size for the specified hash algorithm. If the hash algorithm is not recognized, return 0. An implementation may return either 0 or the correct size for a hash algorithm that it recognizes, but does not support.

Description:

The size of the output of psa_hash_finish(), in bytes.

This is also the hash size that psa_hash_verify() expects.

`PSA_HASH_MAX_SIZE` (macro)

#define PSA_HASH_MAX_SIZE  64

Maximum size of a hash.

This macro must expand to a compile-time constant integer. This value should be the maximum size of a hash supported by the implementation, in bytes, and must be no smaller than this maximum.

`PSA_HMAC_MAX_HASH_BLOCK_SIZE` (macro)

#define PSA_HMAC_MAX_HASH_BLOCK_SIZE  128

`PSA_MAC_MAX_SIZE` (macro)

#define PSA_MAC_MAX_SIZE  PSA_HASH_MAX_SIZE

Maximum size of a MAC.

This macro must expand to a compile-time constant integer. This value should be the maximum size of a MAC supported by the implementation, in bytes, and must be no smaller than this maximum.

`PSA_AEAD_TAG_LENGTH` (macro)

#define PSA_AEAD_TAG_LENGTH(alg) \
    (PSA_ALG_IS_AEAD(alg) ? (((alg) & PSA_ALG_AEAD_TAG_LENGTH_MASK) >> PSA_AEAD_TAG_LENGTH_OFFSET) : 0)

Parameters:

alg: An AEAD algorithm (PSA_ALG_XXX value such that PSA_ALG_IS_AEAD(alg) is true).

Returns:

The tag size for the specified algorithm. If the AEAD algorithm does not have an identified tag that can be distinguished from the rest of the ciphertext, return 0. If the AEAD algorithm is not recognized, return 0. An implementation may return either 0 or a correct size for an AEAD algorithm that it recognizes, but does not support.

Description:

The tag size for an AEAD algorithm, in bytes.

`PSA_VENDOR_RSA_MAX_KEY_BITS` (macro)

#define PSA_VENDOR_RSA_MAX_KEY_BITS  4096

`PSA_VENDOR_ECC_MAX_CURVE_BITS` (macro)

#define PSA_VENDOR_ECC_MAX_CURVE_BITS  521

`PSA_ECC_CURVE_BITS` (macro)

#define PSA_ECC_CURVE_BITS(curve)  /*...*/

Parameters:

curve: An elliptic curve (value of type psa_ecc_curve_t).

Returns:

The size associated with curve, in bits. This may be 0 if the implementation does not support the specified curve.

Description:

Bit size associated with an elliptic curve.

`PSA_ALG_TLS12_PSK_TO_MS_MAX_PSK_LEN` (macro)

#define PSA_ALG_TLS12_PSK_TO_MS_MAX_PSK_LEN  128

This macro returns the maximum length of the PSK supported by the TLS-1.2 PSK-to-MS key derivation.

Quoting RFC 4279, Sect 5.3: TLS implementations supporting these ciphersuites MUST support arbitrary PSK identities up to 128 octets in length, and arbitrary PSKs up to 64 octets in length. Supporting longer identities and keys is RECOMMENDED.

Therefore, no implementation should define a value smaller than 64 for PSA_ALG_TLS12_PSK_TO_MS_MAX_PSK_LEN.

`PSA_ASYMMETRIC_SIGNATURE_MAX_SIZE` (macro)

#define PSA_ASYMMETRIC_SIGNATURE_MAX_SIZE \
    PSA_BITS_TO_BYTES( PSA_VENDOR_RSA_MAX_KEY_BITS > PSA_VENDOR_ECC_MAX_CURVE_BITS ? PSA_VENDOR_RSA_MAX_KEY_BITS : PSA_VENDOR_ECC_MAX_CURVE_BITS )

Maximum size of an asymmetric signature.

This macro must expand to a compile-time constant integer. This value should be the maximum size of a MAC supported by the implementation, in bytes, and must be no smaller than this maximum.

`PSA_MAX_BLOCK_CIPHER_BLOCK_SIZE` (macro)

#define PSA_MAX_BLOCK_CIPHER_BLOCK_SIZE  16

The maximum size of a block cipher supported by the implementation.

`PSA_MAC_FINAL_SIZE` (macro)

#define PSA_MAC_FINAL_SIZE(key_type, key_bits, alg) \
    ((alg) & PSA_ALG_MAC_TRUNCATION_MASK ? PSA_MAC_TRUNCATED_LENGTH(alg) : PSA_ALG_IS_HMAC(alg) ? PSA_HASH_SIZE(PSA_ALG_HMAC_GET_HASH(alg)) : PSA_ALG_IS_BLOCK_CIPHER_MAC(alg) ? PSA_BLOCK_CIPHER_BLOCK_SIZE(key_type) : ((void)(key_type), (void)(key_bits), 0))

Parameters:

key_type: The type of the MAC key.
key_bits: The size of the MAC key in bits.
alg: A MAC algorithm (PSA_ALG_XXX value such that PSA_ALG_IS_MAC(alg) is true).

Returns:

The MAC size for the specified algorithm with the specified key parameters.

0 if the MAC algorithm is not recognized.

Either 0 or the correct size for a MAC algorithm that the implementation recognizes, but does not support.

Unspecified if the key parameters are not consistent with the algorithm.

Description:

The size of the output of psa_mac_sign_finish(), in bytes.

This is also the MAC size that psa_mac_verify_finish() expects.

`PSA_AEAD_ENCRYPT_OUTPUT_SIZE` (macro)

#define PSA_AEAD_ENCRYPT_OUTPUT_SIZE(alg, plaintext_length) \
    (PSA_AEAD_TAG_LENGTH(alg) != 0 ? (plaintext_length) + PSA_AEAD_TAG_LENGTH(alg) : 0)

Parameters:

alg: An AEAD algorithm (PSA_ALG_XXX value such that PSA_ALG_IS_AEAD(alg) is true).
plaintext_length: Size of the plaintext in bytes.

Returns:

The AEAD ciphertext size for the specified algorithm. If the AEAD algorithm is not recognized, return 0. An implementation may return either 0 or a correct size for an AEAD algorithm that it recognizes, but does not support.

Description:

The maximum size of the output of psa_aead_encrypt(), in bytes.

If the size of the ciphertext buffer is at least this large, it is guaranteed that psa_aead_encrypt() will not fail due to an insufficient buffer size. Depending on the algorithm, the actual size of the ciphertext may be smaller.

`PSA_AEAD_DECRYPT_OUTPUT_SIZE` (macro)

#define PSA_AEAD_DECRYPT_OUTPUT_SIZE(alg, ciphertext_length) \
    (PSA_AEAD_TAG_LENGTH(alg) != 0 ? (ciphertext_length) - PSA_AEAD_TAG_LENGTH(alg) : 0)

Parameters:

alg: An AEAD algorithm (PSA_ALG_XXX value such that PSA_ALG_IS_AEAD(alg) is true).
ciphertext_length: Size of the plaintext in bytes.

Returns:

The AEAD ciphertext size for the specified algorithm. If the AEAD algorithm is not recognized, return 0. An implementation may return either 0 or a correct size for an AEAD algorithm that it recognizes, but does not support.

Description:

The maximum size of the output of psa_aead_decrypt(), in bytes.

If the size of the plaintext buffer is at least this large, it is guaranteed that psa_aead_decrypt() will not fail due to an insufficient buffer size. Depending on the algorithm, the actual size of the plaintext may be smaller.

`PSA_AEAD_UPDATE_OUTPUT_SIZE` (macro)

#define PSA_AEAD_UPDATE_OUTPUT_SIZE(alg, input_length) \
    (PSA_ALG_IS_AEAD_ON_BLOCK_CIPHER(alg) ? PSA_ROUND_UP_TO_MULTIPLE(PSA_MAX_BLOCK_CIPHER_BLOCK_SIZE, (input_length)) : (input_length))

Parameters:

alg: An AEAD algorithm (PSA_ALG_XXX value such that PSA_ALG_IS_AEAD(alg) is true).
input_length: Size of the input in bytes.

Returns:

A sufficient output buffer size for the specified algorithm. If the AEAD algorithm is not recognized, return 0. An implementation may return either 0 or a correct size for an AEAD algorithm that it recognizes, but does not support.

Description:

A sufficient output buffer size for psa_aead_update().

If the size of the output buffer is at least this large, it is guaranteed that psa_aead_update() will not fail due to an insufficient buffer size. The actual size of the output may be smaller in any given call.

`PSA_AEAD_FINISH_OUTPUT_SIZE` (macro)

#define PSA_AEAD_FINISH_OUTPUT_SIZE(alg) \
    (PSA_ALG_IS_AEAD_ON_BLOCK_CIPHER(alg) ? PSA_MAX_BLOCK_CIPHER_BLOCK_SIZE : 0)

Parameters:

alg: An AEAD algorithm (PSA_ALG_XXX value such that PSA_ALG_IS_AEAD(alg) is true).

Returns:

A sufficient ciphertext buffer size for the specified algorithm. If the AEAD algorithm is not recognized, return 0. An implementation may return either 0 or a correct size for an AEAD algorithm that it recognizes, but does not support.

Description:

A sufficient ciphertext buffer size for psa_aead_finish().

If the size of the ciphertext buffer is at least this large, it is guaranteed that psa_aead_finish() will not fail due to an insufficient ciphertext buffer size. The actual size of the output may be smaller in any given call.

`PSA_AEAD_VERIFY_OUTPUT_SIZE` (macro)

#define PSA_AEAD_VERIFY_OUTPUT_SIZE(alg) \
    (PSA_ALG_IS_AEAD_ON_BLOCK_CIPHER(alg) ? PSA_MAX_BLOCK_CIPHER_BLOCK_SIZE : 0)

Parameters:

alg: An AEAD algorithm (PSA_ALG_XXX value such that PSA_ALG_IS_AEAD(alg) is true).

Returns:

A sufficient plaintext buffer size for the specified algorithm. If the AEAD algorithm is not recognized, return 0. An implementation may return either 0 or a correct size for an AEAD algorithm that it recognizes, but does not support.

Description:

A sufficient plaintext buffer size for psa_aead_verify().

If the size of the plaintext buffer is at least this large, it is guaranteed that psa_aead_verify() will not fail due to an insufficient plaintext buffer size. The actual size of the output may be smaller in any given call.

`PSA_RSA_MINIMUM_PADDING_SIZE` (macro)

#define PSA_RSA_MINIMUM_PADDING_SIZE(alg) \
    (PSA_ALG_IS_RSA_OAEP(alg) ? 2 * PSA_HASH_SIZE(PSA_ALG_RSA_OAEP_GET_HASH(alg)) + 1 : 11 /*PKCS#1v1.5*/)

Parameters:

alg

Description:

`PSA_ECDSA_SIGNATURE_SIZE` (macro)

#define PSA_ECDSA_SIGNATURE_SIZE(curve_bits) \
    (PSA_BITS_TO_BYTES(curve_bits) * 2)

Parameters:

curve_bits: Curve size in bits.

Returns:

Signature size in bytes.

Description:

ECDSA signature size for a given curve bit size.

Note

This macro returns a compile-time constant if its argument is one.

`PSA_ASYMMETRIC_SIGN_OUTPUT_SIZE` (macro)

#define PSA_ASYMMETRIC_SIGN_OUTPUT_SIZE(key_type, key_bits, alg) \
    (PSA_KEY_TYPE_IS_RSA(key_type) ? ((void)alg, PSA_BITS_TO_BYTES(key_bits)) : PSA_KEY_TYPE_IS_ECC(key_type) ? PSA_ECDSA_SIGNATURE_SIZE(key_bits) : ((void)alg, 0))

Parameters:

key_type: An asymmetric key type (this may indifferently be a key pair type or a public key type).
key_bits: The size of the key in bits.
alg: The signature algorithm.

Returns:

If the parameters are valid and supported, return a buffer size in bytes that guarantees that psa_asymmetric_sign() will not fail with PSA_ERROR_BUFFER_TOO_SMALL. If the parameters are a valid combination that is not supported by the implementation, this macro shall return either a sensible size or 0. If the parameters are not valid, the return value is unspecified.

Description:

Sufficient signature buffer size for psa_asymmetric_sign().

This macro returns a sufficient buffer size for a signature using a key of the specified type and size, with the specified algorithm. Note that the actual size of the signature may be smaller (some algorithms produce a variable-size signature).

Warning

This function may call its arguments multiple times or zero times, so you should not pass arguments that contain side effects.

`PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE` (macro)

#define PSA_ASYMMETRIC_ENCRYPT_OUTPUT_SIZE(key_type, key_bits, alg) \
    (PSA_KEY_TYPE_IS_RSA(key_type) ? ((void)alg, PSA_BITS_TO_BYTES(key_bits)) : 0)

Parameters:

key_type: An asymmetric key type (this may indifferently be a key pair type or a public key type).
key_bits: The size of the key in bits.
alg: The signature algorithm.

Returns:

If the parameters are valid and supported, return a buffer size in bytes that guarantees that psa_asymmetric_encrypt() will not fail with PSA_ERROR_BUFFER_TOO_SMALL. If the parameters are a valid combination that is not supported by the implementation, this macro shall return either a sensible size or 0. If the parameters are not valid, the return value is unspecified.

Description:

Sufficient output buffer size for psa_asymmetric_encrypt().

This macro returns a sufficient buffer size for a ciphertext produced using a key of the specified type and size, with the specified algorithm. Note that the actual size of the ciphertext may be smaller, depending on the algorithm.

Warning

This function may call its arguments multiple times or zero times, so you should not pass arguments that contain side effects.

`PSA_ASYMMETRIC_DECRYPT_OUTPUT_SIZE` (macro)

#define PSA_ASYMMETRIC_DECRYPT_OUTPUT_SIZE(key_type, key_bits, alg) \
    (PSA_KEY_TYPE_IS_RSA(key_type) ? PSA_BITS_TO_BYTES(key_bits) - PSA_RSA_MINIMUM_PADDING_SIZE(alg) : 0)

Parameters:

key_type: An asymmetric key type (this may indifferently be a key pair type or a public key type).
key_bits: The size of the key in bits.
alg: The signature algorithm.

Returns:

If the parameters are valid and supported, return a buffer size in bytes that guarantees that psa_asymmetric_decrypt() will not fail with PSA_ERROR_BUFFER_TOO_SMALL. If the parameters are a valid combination that is not supported by the implementation, this macro shall return either a sensible size or 0. If the parameters are not valid, the return value is unspecified.

Description:

Sufficient output buffer size for psa_asymmetric_decrypt().

This macro returns a sufficient buffer size for a ciphertext produced using a key of the specified type and size, with the specified algorithm. Note that the actual size of the ciphertext may be smaller, depending on the algorithm.

Warning

This function may call its arguments multiple times or zero times, so you should not pass arguments that contain side effects.

`PSA_KEY_EXPORT_ASN1_INTEGER_MAX_SIZE` (macro)

#define PSA_KEY_EXPORT_ASN1_INTEGER_MAX_SIZE(bits)  ((bits) / 8 + 5)

Parameters:

bits

Description:

`PSA_KEY_EXPORT_RSA_PUBLIC_KEY_MAX_SIZE` (macro)

#define PSA_KEY_EXPORT_RSA_PUBLIC_KEY_MAX_SIZE(key_bits) \
    (PSA_KEY_EXPORT_ASN1_INTEGER_MAX_SIZE(key_bits) + 11)

Parameters:

key_bits

Description:

`PSA_KEY_EXPORT_RSA_KEY_PAIR_MAX_SIZE` (macro)

#define PSA_KEY_EXPORT_RSA_KEY_PAIR_MAX_SIZE(key_bits) \
    (9 * PSA_KEY_EXPORT_ASN1_INTEGER_MAX_SIZE((key_bits) / 2 + 1) + 14)

Parameters:

key_bits

Description:

`PSA_KEY_EXPORT_DSA_PUBLIC_KEY_MAX_SIZE` (macro)

#define PSA_KEY_EXPORT_DSA_PUBLIC_KEY_MAX_SIZE(key_bits) \
    (PSA_KEY_EXPORT_ASN1_INTEGER_MAX_SIZE(key_bits) * 3 + 59)

Parameters:

key_bits

Description:

`PSA_KEY_EXPORT_DSA_KEY_PAIR_MAX_SIZE` (macro)

#define PSA_KEY_EXPORT_DSA_KEY_PAIR_MAX_SIZE(key_bits) \
    (PSA_KEY_EXPORT_ASN1_INTEGER_MAX_SIZE(key_bits) * 3 + 75)

Parameters:

key_bits

Description:

`PSA_KEY_EXPORT_ECC_PUBLIC_KEY_MAX_SIZE` (macro)

#define PSA_KEY_EXPORT_ECC_PUBLIC_KEY_MAX_SIZE(key_bits) \
    (2 * PSA_BITS_TO_BYTES(key_bits) + 1)

Parameters:

key_bits

Description:

`PSA_KEY_EXPORT_ECC_KEY_PAIR_MAX_SIZE` (macro)

#define PSA_KEY_EXPORT_ECC_KEY_PAIR_MAX_SIZE(key_bits) \
    (PSA_BITS_TO_BYTES(key_bits))

Parameters:

key_bits

Description:

`PSA_KEY_EXPORT_MAX_SIZE` (macro)

#define PSA_KEY_EXPORT_MAX_SIZE(key_type, key_bits) \
    (PSA_KEY_TYPE_IS_UNSTRUCTURED(key_type) ? PSA_BITS_TO_BYTES(key_bits) : (key_type) == PSA_KEY_TYPE_RSA_KEY_PAIR ? PSA_KEY_EXPORT_RSA_KEY_PAIR_MAX_SIZE(key_bits) : (key_type) == PSA_KEY_TYPE_RSA_PUBLIC_KEY ? PSA_KEY_EXPORT_RSA_PUBLIC_KEY_MAX_SIZE(key_bits) : (key_type) == PSA_KEY_TYPE_DSA_KEY_PAIR ? PSA_KEY_EXPORT_DSA_KEY_PAIR_MAX_SIZE(key_bits) : (key_type) == PSA_KEY_TYPE_DSA_PUBLIC_KEY ? PSA_KEY_EXPORT_DSA_PUBLIC_KEY_MAX_SIZE(key_bits) : PSA_KEY_TYPE_IS_ECC_KEY_PAIR(key_type) ? PSA_KEY_EXPORT_ECC_KEY_PAIR_MAX_SIZE(key_bits) : PSA_KEY_TYPE_IS_ECC_PUBLIC_KEY(key_type) ? PSA_KEY_EXPORT_ECC_PUBLIC_KEY_MAX_SIZE(key_bits) : 0)

Parameters:

key_type: A supported key type.
key_bits: The size of the key in bits.

Returns:

If the parameters are valid and supported, return a buffer size in bytes that guarantees that psa_asymmetric_sign() will not fail with PSA_ERROR_BUFFER_TOO_SMALL. If the parameters are a valid combination that is not supported by the implementation, this macro shall return either a sensible size or 0. If the parameters are not valid, the return value is unspecified.

Description:

Sufficient output buffer size for psa_export_key() or psa_export_public_key().

This macro returns a compile-time constant if its arguments are compile-time constants.

Warning

This function may call its arguments multiple times or zero times, so you should not pass arguments that contain side effects.

The following code illustrates how to allocate enough memory to export a key by querying the key type and size at runtime.

psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
psa_status_t status;
status = psa_get_key_attributes(key, &attributes);
if (status != PSA_SUCCESS) handle_error(...);
psa_key_type_t key_type = psa_get_key_type(&attributes);
size_t key_bits = psa_get_key_bits(&attributes);
size_t buffer_size = PSA_KEY_EXPORT_MAX_SIZE(key_type, key_bits);
psa_reset_key_attributes(&attributes);
unsigned char *buffer = malloc(buffer_size);
if (buffer == NULL) handle_error(...);
size_t buffer_length;
status = psa_export_key(key, buffer, buffer_size, &buffer_length);
if (status != PSA_SUCCESS) handle_error(...);

For psa_export_public_key(), calculate the buffer size from the public key type. You can use the macro PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR to convert a key pair type to the corresponding public key type.

psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
psa_status_t status;
status = psa_get_key_attributes(key, &attributes);
if (status != PSA_SUCCESS) handle_error(...);
psa_key_type_t key_type = psa_get_key_type(&attributes);
psa_key_type_t public_key_type = PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(key_type);
size_t key_bits = psa_get_key_bits(&attributes);
size_t buffer_size = PSA_KEY_EXPORT_MAX_SIZE(public_key_type, key_bits);
psa_reset_key_attributes(&attributes);
unsigned char *buffer = malloc(buffer_size);
if (buffer == NULL) handle_error(...);
size_t buffer_length;
status = psa_export_public_key(key, buffer, buffer_size, &buffer_length);
if (status != PSA_SUCCESS) handle_error(...);

Implementation-specific definitions

psa_key_handle_t (type)

Library initialization

psa_crypto_init (function)

Key attributes

psa_key_attributes_t (type)

PSA_KEY_ATTRIBUTES_INIT (macro)

psa_key_attributes_init (function)

psa_set_key_id (function)

psa_set_key_lifetime (function)

psa_get_key_id (function)

psa_get_key_lifetime (function)

psa_set_key_usage_flags (function)

psa_get_key_usage_flags (function)

psa_set_key_algorithm (function)

psa_get_key_algorithm (function)

psa_set_key_type (function)

psa_set_key_bits (function)

psa_get_key_type (function)

psa_get_key_bits (function)

psa_get_key_attributes (function)

psa_reset_key_attributes (function)

Key management

psa_open_key (function)

psa_close_key (function)

Key import and export

psa_import_key (function)

psa_destroy_key (function)

psa_export_key (function)

psa_export_public_key (function)

psa_copy_key (function)

Message digests

psa_hash_operation_t (type)

PSA_HASH_OPERATION_INIT (macro)

psa_hash_compute (function)

psa_hash_compare (function)

psa_hash_operation_init (function)

psa_hash_setup (function)

psa_hash_update (function)

psa_hash_finish (function)

psa_hash_verify (function)

psa_hash_abort (function)

psa_hash_clone (function)

Message authentication codes

psa_mac_operation_t (type)

PSA_MAC_OPERATION_INIT (macro)

psa_mac_compute (function)

psa_mac_verify (function)

psa_mac_operation_init (function)

psa_mac_sign_setup (function)

psa_mac_verify_setup (function)

psa_mac_update (function)

psa_mac_sign_finish (function)

psa_mac_verify_finish (function)

psa_mac_abort (function)

Symmetric ciphers

psa_cipher_operation_t (type)

PSA_CIPHER_OPERATION_INIT (macro)

psa_cipher_encrypt (function)

psa_cipher_decrypt (function)

psa_cipher_operation_init (function)

psa_cipher_encrypt_setup (function)

psa_cipher_decrypt_setup (function)

psa_cipher_generate_iv (function)

psa_cipher_set_iv (function)

psa_cipher_update (function)

psa_cipher_finish (function)

psa_cipher_abort (function)

Authenticated encryption with associated data (AEAD)

psa_aead_operation_t (type)

PSA_AEAD_OPERATION_INIT (macro)

psa_aead_encrypt (function)

psa_aead_decrypt (function)

psa_aead_operation_init (function)

psa_aead_encrypt_setup (function)

psa_aead_decrypt_setup (function)

psa_aead_generate_nonce (function)

psa_aead_set_nonce (function)

psa_aead_set_lengths (function)

psa_aead_update_ad (function)

`psa_key_handle_t` (type)

`psa_crypto_init` (function)

`psa_key_attributes_t` (type)

`PSA_KEY_ATTRIBUTES_INIT` (macro)

`psa_key_attributes_init` (function)

`psa_set_key_id` (function)

`psa_set_key_lifetime` (function)

`psa_get_key_id` (function)

`psa_get_key_lifetime` (function)

`psa_set_key_usage_flags` (function)

`psa_get_key_usage_flags` (function)

`psa_set_key_algorithm` (function)

`psa_get_key_algorithm` (function)

`psa_set_key_type` (function)

`psa_set_key_bits` (function)

`psa_get_key_type` (function)

`psa_get_key_bits` (function)

`psa_get_key_attributes` (function)

`psa_reset_key_attributes` (function)

`psa_open_key` (function)

`psa_close_key` (function)

`psa_import_key` (function)

`psa_destroy_key` (function)

`psa_export_key` (function)

`psa_export_public_key` (function)

`psa_copy_key` (function)

`psa_hash_operation_t` (type)

`PSA_HASH_OPERATION_INIT` (macro)

`psa_hash_compute` (function)

`psa_hash_compare` (function)

`psa_hash_operation_init` (function)

`psa_hash_setup` (function)

`psa_hash_update` (function)

`psa_hash_finish` (function)

`psa_hash_verify` (function)

`psa_hash_abort` (function)

`psa_hash_clone` (function)

`psa_mac_operation_t` (type)

`PSA_MAC_OPERATION_INIT` (macro)

`psa_mac_compute` (function)

`psa_mac_verify` (function)

`psa_mac_operation_init` (function)

`psa_mac_sign_setup` (function)

`psa_mac_verify_setup` (function)

`psa_mac_update` (function)

`psa_mac_sign_finish` (function)

`psa_mac_verify_finish` (function)

`psa_mac_abort` (function)

`psa_cipher_operation_t` (type)

`PSA_CIPHER_OPERATION_INIT` (macro)

`psa_cipher_encrypt` (function)

`psa_cipher_decrypt` (function)

`psa_cipher_operation_init` (function)

`psa_cipher_encrypt_setup` (function)

`psa_cipher_decrypt_setup` (function)

`psa_cipher_generate_iv` (function)

`psa_cipher_set_iv` (function)

`psa_cipher_update` (function)

`psa_cipher_finish` (function)

`psa_cipher_abort` (function)

`psa_aead_operation_t` (type)

`PSA_AEAD_OPERATION_INIT` (macro)

`psa_aead_encrypt` (function)

`psa_aead_decrypt` (function)

`psa_aead_operation_init` (function)

`psa_aead_encrypt_setup` (function)

`psa_aead_decrypt_setup` (function)

`psa_aead_generate_nonce` (function)

`psa_aead_set_nonce` (function)

`psa_aead_set_lengths` (function)

`psa_aead_update_ad` (function)

`psa_aead_update` (function)

`psa_aead_finish` (function)

`psa_aead_verify` (function)

`psa_aead_abort` (function)

`psa_asymmetric_sign` (function)

`psa_asymmetric_verify` (function)

`psa_asymmetric_encrypt` (function)

`psa_asymmetric_decrypt` (function)

`psa_key_derivation_operation_t` (type)