psa_destroy_key: return SUCCESS on an empty slot
Do wipe the slot even if it doesn't contain a key, to erase any metadata.
diff --git a/library/psa_crypto.c b/library/psa_crypto.c
index b66862c..deeffa3 100644
--- a/library/psa_crypto.c
+++ b/library/psa_crypto.c
@@ -373,9 +373,11 @@
return( PSA_ERROR_INVALID_ARGUMENT );
slot = &global_data.key_slots[key];
if( slot->type == PSA_KEY_TYPE_NONE )
- return( PSA_ERROR_EMPTY_SLOT );
-
- if( PSA_KEY_TYPE_IS_RAW_BYTES( slot->type ) )
+ {
+ /* No key material to clean, but do zeroize the slot below to wipe
+ * metadata such as policies. */
+ }
+ else if( PSA_KEY_TYPE_IS_RAW_BYTES( slot->type ) )
{
mbedtls_free( slot->data.raw.data );
}