Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement the openless crypto API #3265

Closed
gilles-peskine-arm opened this issue Mar 9, 2020 · 1 comment · Fixed by #3527 or #3547
Closed

Implement the openless crypto API #3265

gilles-peskine-arm opened this issue Mar 9, 2020 · 1 comment · Fixed by #3527 or #3547
Assignees
Labels
component-crypto Crypto primitives and low-level interfaces enhancement

Comments

@gilles-peskine-arm
Copy link
Contributor

gilles-peskine-arm commented Mar 9, 2020

Mbed Crypto currently implements version 1.0 beta 3 of the PSA Crypto API. In the final version of the API, there has been one major change to key management. Now, instead of calling psa_open_key on a persistent key identifier to obtain a transient handle to the key, the application directly uses the identifier as a handle. This is not yet possible in Mbed Crypto.

The goal of this task is to implement the openless API:

  • Use psa_key_id_t wherever the API currently has psa_key_handle_t.
  • Since psa_key_id_t is not restricted to a small range, there needs to be more indirection in the equivalent function to psa_get_key_slot for key ids. Possible methods include:
    • A linear search in the existing table global_data.key_slots.
    • Another table mapping key ids to indices in global_data.key_slots.
  • Implement the new function psa_purge_key.
  • Add tests that exercise the new behavior. It's ok to keep calls to the old functions in most existing tests.

The behavior if a key is purged while a multipart operation is in progress is out of scope of this task and tracked separately at https://github.com/ARMmbed/mbed-crypto/issues/86. However, there are commonalities in the design, so a prerequisite of this task is to come up with a design that's compatible with both problems.

For backward compatibility, keep the following declared in include/psa/crypto_compat.h:

  • psa_open_key either as a function that only checks whether the key exists, or essentially as today (loading the key into memory).
  • psa_close_key at least calls psa_purge_key.
  • psa_key_handle_t is an alias of psa_key_id_t.
@gilles-peskine-arm gilles-peskine-arm transferred this issue from ARMmbed/mbed-crypto Apr 27, 2020
@gilles-peskine-arm gilles-peskine-arm added component-crypto Crypto primitives and low-level interfaces enhancement mbed TLS team labels Apr 27, 2020
@danh-arm danh-arm added this to the June 2020 Sprint milestone May 14, 2020
@ronald-cron-arm ronald-cron-arm linked a pull request Jul 29, 2020 that will close this issue
@ronald-cron-arm ronald-cron-arm linked a pull request Aug 7, 2020 that will close this issue
@ronald-cron-arm
Copy link
Contributor

ronald-cron-arm commented Sep 15, 2020

#3527 merged but not #3547 thus reopening this issue that has been closed automatically due to the merge of #3527.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
component-crypto Crypto primitives and low-level interfaces enhancement
Projects
None yet
5 participants