Do not persist transactions on volatile external keys
Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
diff --git a/library/psa_crypto.c b/library/psa_crypto.c
index 1c348e8..a0851c7 100644
--- a/library/psa_crypto.c
+++ b/library/psa_crypto.c
@@ -1593,11 +1593,14 @@
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
/* For a key in a secure element, we need to do three things
- * when creating or registering a key:
+ * when creating or registering a persistent key:
* create the key file in internal storage, create the
* key inside the secure element, and update the driver's
- * persistent data. Start a transaction that will encompass these
- * three actions. */
+ * persistent data. This is done by starting a transaction that will
+ * encompass these three actions.
+ * For registering a volatile key, we just need to find an appropriate
+ * slot number inside the SE. Since the key is designated volatile, creating
+ * a transaction is not required. */
/* The first thing to do is to find a slot number for the new key.
* We save the slot number in persistent storage as part of the
* transaction data. It will be needed to recover if the power
@@ -1612,15 +1615,19 @@
&slot->data.se.slot_number );
if( status != PSA_SUCCESS )
return( status );
- psa_crypto_prepare_transaction( PSA_CRYPTO_TRANSACTION_CREATE_KEY );
- psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
- psa_crypto_transaction.key.slot = slot->data.se.slot_number;
- psa_crypto_transaction.key.id = slot->attr.id;
- status = psa_crypto_save_transaction( );
- if( status != PSA_SUCCESS )
+
+ if( ! PSA_KEY_LIFETIME_IS_VOLATILE( attributes->core.lifetime ) )
{
- (void) psa_crypto_stop_transaction( );
- return( status );
+ psa_crypto_prepare_transaction( PSA_CRYPTO_TRANSACTION_CREATE_KEY );
+ psa_crypto_transaction.key.lifetime = slot->attr.lifetime;
+ psa_crypto_transaction.key.slot = slot->data.se.slot_number;
+ psa_crypto_transaction.key.id = slot->attr.id;
+ status = psa_crypto_save_transaction( );
+ if( status != PSA_SUCCESS )
+ {
+ (void) psa_crypto_stop_transaction( );
+ return( status );
+ }
}
}
@@ -1708,8 +1715,8 @@
/* Finish the transaction for a key creation. This does not
* happen when registering an existing key. Detect this case
* by checking whether a transaction is in progress (actual
- * creation of a key in a secure element requires a transaction,
- * but registration doesn't use one). */
+ * creation of a persistent key in a secure element requires a transaction,
+ * but registration or volatile key creation doesn't use one). */
if( driver != NULL &&
psa_crypto_transaction.unknown.type == PSA_CRYPTO_TRANSACTION_CREATE_KEY )
{