commit fc9c5561273c1b18431612f7aaaa2f77999c42c4
author Ronald Cron <ronald.cron@arm.com> Thu Oct 15 19:24:49 2020 +0200
committer Ronald Cron <ronald.cron@arm.com> Tue Nov 10 16:18:07 2020 +0100
tree 574dfd4daeaa41aa55055528f44c741cd54fbbce
parent f67aefed3f3057aafa597dc7d3fdd1b3c22fd309

Forbid volatile key identifiers for non volatile keys

Volatile key identifiers in the vendor range are
reserved to volatile keys thus don't allow them
for persistent keys when creating a key.

Signed-off-by: Ronald Cron <ronald.cron@arm.com>

library/psa_crypto_slot_management.c

diff --git a/library/psa_crypto_slot_management.c b/library/psa_crypto_slot_management.c
index 6471591..1e521d1 100644
--- a/library/psa_crypto_slot_management.c
+++ b/library/psa_crypto_slot_management.c
@@ -51,7 +51,8 @@
 
 static psa_global_data_t global_data;
 
-psa_status_t psa_validate_key_id( mbedtls_svc_key_id_t key, int vendor_ok )
+psa_status_t psa_validate_key_id(
+    mbedtls_svc_key_id_t key, int vendor_ok, int volatile_ok )
 {
     psa_key_id_t key_id = MBEDTLS_SVC_KEY_ID_GET_KEY_ID( key );
 
@@ -61,7 +62,12 @@
 
     if( vendor_ok &&
         ( PSA_KEY_ID_VENDOR_MIN <= key_id ) &&
-        ( key_id <= PSA_KEY_ID_VENDOR_MAX ) )
+        ( key_id < PSA_KEY_ID_VOLATILE_MIN ) )
+        return( PSA_SUCCESS );
+
+    if( volatile_ok &&
+        ( PSA_KEY_ID_VOLATILE_MIN <= key_id ) &&
+        ( key_id <= PSA_KEY_ID_VOLATILE_MAX ) )
         return( PSA_SUCCESS );
 
     return( PSA_ERROR_INVALID_HANDLE );
@@ -191,7 +197,7 @@
     if( ! global_data.key_slots_initialized )
         return( PSA_ERROR_BAD_STATE );
 
-    status = psa_validate_key_id( key, 1 );
+    status = psa_validate_key_id( key, 1, 1 );
     if( status != PSA_SUCCESS )
         return( status );