commit 5b98ac9c64316e07befb197b923c1ac7f8c04255
author Ronald Cron <ronald.cron@arm.com> Tue Mar 15 10:19:18 2022 +0100
committer Ronald Cron <ronald.cron@arm.com> Tue Mar 29 14:42:17 2022 +0200
tree 40e2769a02983f5309d7a176c73e2483c3804686
parent 8540cf66acad6283f97a0f35426488741d8b85aa

TLS 1.3: Move PSA ECDH private key destroy to dedicated function

Signed-off-by: Ronald Cron <ronald.cron@arm.com>

library/ssl_tls13_client.c

diff --git a/library/ssl_tls13_client.c b/library/ssl_tls13_client.c
index 5c07bc0..7d1c826 100644
--- a/library/ssl_tls13_client.c
+++ b/library/ssl_tls13_client.c
@@ -231,13 +231,26 @@
 static int ssl_tls13_reset_key_share( mbedtls_ssl_context *ssl )
 {
     uint16_t group_id = ssl->handshake->offered_group_id;
+
     if( group_id == 0 )
         return( MBEDTLS_ERR_SSL_INTERNAL_ERROR );
 
 #if defined(MBEDTLS_ECDH_C)
     if( mbedtls_ssl_tls13_named_group_is_ecdhe( group_id ) )
     {
-        mbedtls_ecdh_free( &ssl->handshake->ecdh_ctx );
+        int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
+        psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
+
+        /* Destroy generated private key. */
+        status = psa_destroy_key( ssl->handshake->ecdh_psa_privkey );
+        if( status != PSA_SUCCESS )
+        {
+            ret = psa_ssl_status_to_mbedtls( status );
+            MBEDTLS_SSL_DEBUG_RET( 1, "psa_destroy_key", ret );
+            return( ret );
+        }
+
+        ssl->handshake->ecdh_psa_privkey = MBEDTLS_SVC_KEY_ID_INIT;
         return( 0 );
     }
     else