commit 920c063bad6ca3bc27cdef40ba3d3ddd647cde74
author Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com> Wed Oct 31 10:57:29 2018 +0100
committer Manuel Pégourié-Gonnard <manuel.pegourie-gonnard@arm.com> Thu Nov 22 09:59:34 2018 +0100
tree 96f94ce92e6790f16efa7617b7ae2134fde8f23c
parent 0184b3c69b8bd1891ff6b2cf711b5ddf63254eef

Implement can_do for opaque ECC keypairs

Unfortunately the can_do wrapper does not receive the key context as an
argument, so it cannot check psa_get_key_information(). Later we might want to
change our internal structures to fix this, but for now we'll just restrict
opaque PSA keys to be ECDSA keypairs, as this is the only thing we need for
now. It also simplifies testing a bit (no need to test each key type).

library/pk.c

diff --git a/library/pk.c b/library/pk.c
index 331ed6c..f65b2ee 100644
--- a/library/pk.c
+++ b/library/pk.c
@@ -147,10 +147,18 @@
 {
     const mbedtls_pk_info_t * const info = &mbedtls_pk_opaque_psa_info;
     psa_key_slot_t *pk_ctx;
+    psa_key_type_t type;
 
     if( ctx == NULL || ctx->pk_info != NULL )
         return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
 
+    if( PSA_SUCCESS != psa_get_key_information( key, &type, NULL ) )
+        return( MBEDTLS_ERR_PK_BAD_INPUT_DATA );
+
+    /* Current implementation of can_do() relies on this. */
+    if( ! PSA_KEY_TYPE_IS_ECC_KEYPAIR( type ) )
+        return( MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE) ;
+
     if( ( ctx->pk_ctx = info->ctx_alloc_func() ) == NULL )
         return( MBEDTLS_ERR_PK_ALLOC_FAILED );