-
Notifications
You must be signed in to change notification settings - Fork 2.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Implement the openless crypto API #3265
Labels
Milestone
Comments
gilles-peskine-arm
added
component-crypto
Crypto primitives and low-level interfaces
enhancement
mbed TLS team
labels
Apr 27, 2020
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Mbed Crypto currently implements version 1.0 beta 3 of the PSA Crypto API. In the final version of the API, there has been one major change to key management. Now, instead of calling
psa_open_key
on a persistent key identifier to obtain a transient handle to the key, the application directly uses the identifier as a handle. This is not yet possible in Mbed Crypto.The goal of this task is to implement the openless API:
psa_key_id_t
wherever the API currently haspsa_key_handle_t
.psa_key_id_t
is not restricted to a small range, there needs to be more indirection in the equivalent function topsa_get_key_slot
for key ids. Possible methods include:global_data.key_slots
.global_data.key_slots
.psa_purge_key
.The behavior if a key is purged while a multipart operation is in progress is out of scope of this task and tracked separately at https://github.com/ARMmbed/mbed-crypto/issues/86. However, there are commonalities in the design, so a prerequisite of this task is to come up with a design that's compatible with both problems.
For backward compatibility, keep the following declared in
include/psa/crypto_compat.h
:psa_open_key
either as a function that only checks whether the key exists, or essentially as today (loading the key into memory).psa_close_key
at least callspsa_purge_key
.psa_key_handle_t
is an alias ofpsa_key_id_t
.The text was updated successfully, but these errors were encountered: