commit 8135b84ed2f5a2c2ab032098b0816f1bf1e4f405
author Anton Matkin <anton.matkin@arm.com> Thu Apr 03 16:36:24 2025 +0200
committer Anton Matkin <anton.matkin@arm.com> Fri Aug 29 16:09:09 2025 +0200
tree 04df606a22e80c960835f4cd33abbd4b606f5994
parent 5663c2379997cc4bc72d291d955af54951b12093

Fixed incorrect usage of key derivation procedures

Signed-off-by: Anton Matkin <anton.matkin@arm.com>

library/ssl_tls.c

diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index b75c6d4..12af239 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -6390,7 +6390,7 @@
             psa_key_attributes_t shared_key_attributes = PSA_KEY_ATTRIBUTES_INIT;
             psa_set_key_usage_flags(&shared_key_attributes, PSA_KEY_USAGE_DERIVE);
             psa_set_key_algorithm(&shared_key_attributes, alg);
-            psa_set_key_type(&shared_key_attributes, PSA_KEY_TYPE_PASSWORD);
+            psa_set_key_type(&shared_key_attributes, PSA_KEY_TYPE_DERIVE);
 
             status = psa_pake_get_shared_key(&handshake->psa_pake_ctx, &shared_key_attributes, &shared_key_id);
 
@@ -6401,13 +6401,13 @@
 
             status = psa_key_derivation_input_key(&derivation, PSA_KEY_DERIVATION_INPUT_SECRET, shared_key_id);
 
+            psa_destroy_key(shared_key_id);
+
             if (status != PSA_SUCCESS) {
                 psa_key_derivation_abort(&derivation);
                 return MBEDTLS_ERR_SSL_HW_ACCEL_FAILED;
             }
 
-            psa_destroy_key(shared_key_id);
-
             status = psa_key_derivation_output_bytes(&derivation,
                                                      handshake->premaster,
                                                      handshake->pmslen);