Split persistence and key id validation
With key usage based on key identifiers and not
key handles (openless APIs), volatile keys will
also have a key identifier. Thus, isolate key
identifier validation from key persistence
validation to clarify that key identifiers
are not specific to persistent keys.
Signed-off-by: Ronald Cron <ronald.cron@arm.com>
diff --git a/library/psa_crypto_slot_management.c b/library/psa_crypto_slot_management.c
index 5140772..4f651d9 100644
--- a/library/psa_crypto_slot_management.c
+++ b/library/psa_crypto_slot_management.c
@@ -51,6 +51,22 @@
static psa_global_data_t global_data;
+psa_status_t psa_validate_key_id( mbedtls_svc_key_id_t key, int vendor_ok )
+{
+ psa_key_id_t key_id = MBEDTLS_SVC_KEY_ID_GET_KEY_ID( key );
+
+ if( ( PSA_KEY_ID_USER_MIN <= key_id ) &&
+ ( key_id <= PSA_KEY_ID_USER_MAX ) )
+ return( PSA_SUCCESS );
+
+ if( vendor_ok &&
+ ( PSA_KEY_ID_VENDOR_MIN <= key_id ) &&
+ ( key_id <= PSA_KEY_ID_VENDOR_MAX ) )
+ return( PSA_SUCCESS );
+
+ return( PSA_ERROR_INVALID_ARGUMENT );
+}
+
/* Access a key slot at the given handle. The handle of a key slot is
* the index of the slot in the global slot array, plus one so that handles
* start at 1 and not 0. */
@@ -150,31 +166,6 @@
psa_free_persistent_key_data( key_data, key_data_length );
return( status );
}
-
-/** Check whether a key identifier is acceptable.
- *
- * For backward compatibility, key identifiers that were valid in a
- * past released version must remain valid, unless a migration path
- * is provided.
- *
- * \param key The key identifier to check.
- * \param vendor_ok Nonzero to allow key ids in the vendor range.
- * 0 to allow only key ids in the application range.
- *
- * \return 1 if \p key is acceptable, otherwise 0.
- */
-static int psa_is_key_id_valid( mbedtls_svc_key_id_t key, int vendor_ok )
-{
- psa_key_id_t key_id = MBEDTLS_SVC_KEY_ID_GET_KEY_ID( key );
- if( PSA_KEY_ID_USER_MIN <= key_id && key_id <= PSA_KEY_ID_USER_MAX )
- return( 1 );
- else if( vendor_ok &&
- PSA_KEY_ID_VENDOR_MIN <= key_id &&
- key_id <= PSA_KEY_ID_VENDOR_MAX )
- return( 1 );
- else
- return( 0 );
-}
#endif /* defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) */
psa_status_t psa_validate_key_location( psa_key_lifetime_t lifetime,
@@ -202,8 +193,7 @@
return( PSA_SUCCESS );
}
-psa_status_t psa_validate_key_persistence( psa_key_lifetime_t lifetime,
- mbedtls_svc_key_id_t key )
+psa_status_t psa_validate_key_persistence( psa_key_lifetime_t lifetime )
{
if ( PSA_KEY_LIFETIME_IS_VOLATILE( lifetime ) )
{
@@ -214,13 +204,8 @@
{
/* Persistent keys require storage support */
#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
- if( psa_is_key_id_valid( key,
- psa_key_lifetime_is_external( lifetime ) ) )
- return( PSA_SUCCESS );
- else
- return( PSA_ERROR_INVALID_ARGUMENT );
+ return( PSA_SUCCESS );
#else /* MBEDTLS_PSA_CRYPTO_STORAGE_C */
- (void) key;
return( PSA_ERROR_NOT_SUPPORTED );
#endif /* !MBEDTLS_PSA_CRYPTO_STORAGE_C */
}
@@ -234,8 +219,9 @@
*handle = 0;
- if( ! psa_is_key_id_valid( key, 1 ) )
- return( PSA_ERROR_INVALID_ARGUMENT );
+ status = psa_validate_key_id( key, 1 );
+ if( status != PSA_SUCCESS )
+ return( status );
status = psa_get_empty_key_slot( handle, &slot );
if( status != PSA_SUCCESS )