Gilles Peskine | 961849f | 2018-11-30 18:54:54 +0100 | [diff] [blame] | 1 | /* |
| 2 | * PSA crypto layer on top of Mbed TLS crypto |
| 3 | */ |
Bence Szépkúti | 8697465 | 2020-06-15 11:59:37 +0200 | [diff] [blame] | 4 | /* |
Bence Szépkúti | 1e14827 | 2020-08-07 13:07:28 +0200 | [diff] [blame] | 5 | * Copyright The Mbed TLS Contributors |
Dave Rodgman | 16799db | 2023-11-02 19:47:20 +0000 | [diff] [blame] | 6 | * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later |
Gilles Peskine | 961849f | 2018-11-30 18:54:54 +0100 | [diff] [blame] | 7 | */ |
| 8 | |
| 9 | #ifndef PSA_CRYPTO_SLOT_MANAGEMENT_H |
| 10 | #define PSA_CRYPTO_SLOT_MANAGEMENT_H |
| 11 | |
Gilles Peskine | 011e428 | 2019-06-26 18:34:38 +0200 | [diff] [blame] | 12 | #include "psa/crypto.h" |
Ronald Cron | c4d1b51 | 2020-07-31 11:26:37 +0200 | [diff] [blame] | 13 | #include "psa_crypto_core.h" |
Gilles Peskine | 011e428 | 2019-06-26 18:34:38 +0200 | [diff] [blame] | 14 | #include "psa_crypto_se.h" |
| 15 | |
Ronald Cron | 2a99315 | 2020-07-17 14:13:26 +0200 | [diff] [blame] | 16 | /** Range of volatile key identifiers. |
| 17 | * |
Steven Cooreman | 863470a | 2021-02-15 14:03:19 +0100 | [diff] [blame] | 18 | * The last #MBEDTLS_PSA_KEY_SLOT_COUNT identifiers of the implementation |
| 19 | * range of key identifiers are reserved for volatile key identifiers. |
Ronald Cron | 9678355 | 2020-10-19 12:06:30 +0200 | [diff] [blame] | 20 | * A volatile key identifier is equal to #PSA_KEY_ID_VOLATILE_MIN plus the |
Ronald Cron | 2a99315 | 2020-07-17 14:13:26 +0200 | [diff] [blame] | 21 | * index of the key slot containing the volatile key definition. |
| 22 | */ |
| 23 | |
| 24 | /** The minimum value for a volatile key identifier. |
| 25 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 26 | #define PSA_KEY_ID_VOLATILE_MIN (PSA_KEY_ID_VENDOR_MAX - \ |
| 27 | MBEDTLS_PSA_KEY_SLOT_COUNT + 1) |
Ronald Cron | 2a99315 | 2020-07-17 14:13:26 +0200 | [diff] [blame] | 28 | |
| 29 | /** The maximum value for a volatile key identifier. |
| 30 | */ |
| 31 | #define PSA_KEY_ID_VOLATILE_MAX PSA_KEY_ID_VENDOR_MAX |
| 32 | |
Ronald Cron | 97c8ad5 | 2020-10-15 11:17:11 +0200 | [diff] [blame] | 33 | /** Test whether a key identifier is a volatile key identifier. |
| 34 | * |
| 35 | * \param key_id Key identifier to test. |
| 36 | * |
| 37 | * \retval 1 |
| 38 | * The key identifier is a volatile key identifier. |
| 39 | * \retval 0 |
| 40 | * The key identifier is not a volatile key identifier. |
| 41 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 42 | static inline int psa_key_id_is_volatile(psa_key_id_t key_id) |
Ronald Cron | 97c8ad5 | 2020-10-15 11:17:11 +0200 | [diff] [blame] | 43 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 44 | return (key_id >= PSA_KEY_ID_VOLATILE_MIN) && |
| 45 | (key_id <= PSA_KEY_ID_VOLATILE_MAX); |
Ronald Cron | 97c8ad5 | 2020-10-15 11:17:11 +0200 | [diff] [blame] | 46 | } |
| 47 | |
Ronald Cron | 5c52292 | 2020-11-14 16:35:34 +0100 | [diff] [blame] | 48 | /** Get the description of a key given its identifier and lock it. |
Gilles Peskine | 0982903 | 2018-12-10 17:00:38 +0100 | [diff] [blame] | 49 | * |
Ronald Cron | 5c52292 | 2020-11-14 16:35:34 +0100 | [diff] [blame] | 50 | * The descriptions of volatile keys and loaded persistent keys are stored in |
| 51 | * key slots. This function returns a pointer to the key slot containing the |
| 52 | * description of a key given its identifier. |
Ronald Cron | c4d1b51 | 2020-07-31 11:26:37 +0200 | [diff] [blame] | 53 | * |
Ronald Cron | 5c52292 | 2020-11-14 16:35:34 +0100 | [diff] [blame] | 54 | * In case of a persistent key, the function loads the description of the key |
| 55 | * into a key slot if not already done. |
Ronald Cron | c4d1b51 | 2020-07-31 11:26:37 +0200 | [diff] [blame] | 56 | * |
Ryan Everett | 098c665 | 2024-01-03 13:03:36 +0000 | [diff] [blame] | 57 | * On success, the returned key slot has been registered for reading. |
| 58 | * It is the responsibility of the caller to call psa_unregister_read(slot) |
| 59 | * when they have finished reading the contents of the slot. |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 60 | * |
Ryan Everett | 231f15b | 2024-04-29 18:26:19 +0100 | [diff] [blame^] | 61 | * On failure, `*p_slot` is set to NULL. This ensures that it is always valid |
| 62 | * to call psa_unregister_read on the returned slot. |
| 63 | * |
Ronald Cron | c4d1b51 | 2020-07-31 11:26:37 +0200 | [diff] [blame] | 64 | * \param key Key identifier to query. |
Gilles Peskine | 0982903 | 2018-12-10 17:00:38 +0100 | [diff] [blame] | 65 | * \param[out] p_slot On success, `*p_slot` contains a pointer to the |
Ronald Cron | c4d1b51 | 2020-07-31 11:26:37 +0200 | [diff] [blame] | 66 | * key slot containing the description of the key |
| 67 | * identified by \p key. |
Gilles Peskine | 0982903 | 2018-12-10 17:00:38 +0100 | [diff] [blame] | 68 | * |
Ronald Cron | c4d1b51 | 2020-07-31 11:26:37 +0200 | [diff] [blame] | 69 | * \retval #PSA_SUCCESS |
Ronald Cron | 1d12d87 | 2020-11-18 17:21:22 +0100 | [diff] [blame] | 70 | * \p *p_slot contains a pointer to the key slot containing the |
| 71 | * description of the key identified by \p key. |
| 72 | * The key slot counter has been incremented. |
Ronald Cron | c4d1b51 | 2020-07-31 11:26:37 +0200 | [diff] [blame] | 73 | * \retval #PSA_ERROR_BAD_STATE |
Ryan Everett | dfe8bf8 | 2024-01-12 17:45:05 +0000 | [diff] [blame] | 74 | * The library has not been initialized. |
Ronald Cron | c4d1b51 | 2020-07-31 11:26:37 +0200 | [diff] [blame] | 75 | * \retval #PSA_ERROR_INVALID_HANDLE |
| 76 | * \p key is not a valid key identifier. |
| 77 | * \retval #PSA_ERROR_INSUFFICIENT_MEMORY |
| 78 | * \p key is a persistent key identifier. The implementation does not |
| 79 | * have sufficient resources to load the persistent key. This can be |
| 80 | * due to a lack of empty key slot, or available memory. |
| 81 | * \retval #PSA_ERROR_DOES_NOT_EXIST |
| 82 | * There is no key with key identifier \p key. |
Gilles Peskine | ed73355 | 2023-02-14 19:21:09 +0100 | [diff] [blame] | 83 | * \retval #PSA_ERROR_CORRUPTION_DETECTED \emptydescription |
| 84 | * \retval #PSA_ERROR_STORAGE_FAILURE \emptydescription |
| 85 | * \retval #PSA_ERROR_DATA_CORRUPT \emptydescription |
Gilles Peskine | 0982903 | 2018-12-10 17:00:38 +0100 | [diff] [blame] | 86 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 87 | psa_status_t psa_get_and_lock_key_slot(mbedtls_svc_key_id_t key, |
| 88 | psa_key_slot_t **p_slot); |
Gilles Peskine | 66fb126 | 2018-12-10 16:29:04 +0100 | [diff] [blame] | 89 | |
Gilles Peskine | 0982903 | 2018-12-10 17:00:38 +0100 | [diff] [blame] | 90 | /** Initialize the key slot structures. |
| 91 | * |
Ronald Cron | 9678355 | 2020-10-19 12:06:30 +0200 | [diff] [blame] | 92 | * \retval #PSA_SUCCESS |
Gilles Peskine | 0982903 | 2018-12-10 17:00:38 +0100 | [diff] [blame] | 93 | * Currently this function always succeeds. |
| 94 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 95 | psa_status_t psa_initialize_key_slots(void); |
Gilles Peskine | 66fb126 | 2018-12-10 16:29:04 +0100 | [diff] [blame] | 96 | |
Gilles Peskine | 0982903 | 2018-12-10 17:00:38 +0100 | [diff] [blame] | 97 | /** Delete all data from key slots in memory. |
Ryan Everett | 16abd59 | 2024-01-24 17:37:46 +0000 | [diff] [blame] | 98 | * This function is not thread safe, it wipes every key slot regardless of |
| 99 | * state and reader count. It should only be called when no slot is in use. |
Gilles Peskine | 0982903 | 2018-12-10 17:00:38 +0100 | [diff] [blame] | 100 | * |
| 101 | * This does not affect persistent storage. */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 102 | void psa_wipe_all_key_slots(void); |
Gilles Peskine | 66fb126 | 2018-12-10 16:29:04 +0100 | [diff] [blame] | 103 | |
Ryan Everett | 2afb516 | 2023-12-22 15:59:45 +0000 | [diff] [blame] | 104 | /** Find a free key slot and reserve it to be filled with a key. |
Gilles Peskine | 41e50d2 | 2019-07-31 15:01:55 +0200 | [diff] [blame] | 105 | * |
Ryan Everett | 2afb516 | 2023-12-22 15:59:45 +0000 | [diff] [blame] | 106 | * This function finds a key slot that is free, |
| 107 | * sets its state to PSA_SLOT_FILLING and then returns the slot. |
| 108 | * |
| 109 | * On success, the key slot's state is PSA_SLOT_FILLING. |
| 110 | * It is the responsibility of the caller to change the slot's state to |
| 111 | * PSA_SLOT_EMPTY/FULL once key creation has finished. |
Gilles Peskine | f46f81c | 2019-05-27 14:53:10 +0200 | [diff] [blame] | 112 | * |
Ryan Everett | 3d8118d | 2024-01-30 16:58:47 +0000 | [diff] [blame] | 113 | * If multi-threading is enabled, the caller must hold the |
| 114 | * global key slot mutex. |
| 115 | * |
Ronald Cron | 2a99315 | 2020-07-17 14:13:26 +0200 | [diff] [blame] | 116 | * \param[out] volatile_key_id On success, volatile key identifier |
| 117 | * associated to the returned slot. |
| 118 | * \param[out] p_slot On success, a pointer to the slot. |
Gilles Peskine | f46f81c | 2019-05-27 14:53:10 +0200 | [diff] [blame] | 119 | * |
Gilles Peskine | ed73355 | 2023-02-14 19:21:09 +0100 | [diff] [blame] | 120 | * \retval #PSA_SUCCESS \emptydescription |
Ryan Everett | 2afb516 | 2023-12-22 15:59:45 +0000 | [diff] [blame] | 121 | * \retval #PSA_ERROR_INSUFFICIENT_MEMORY |
| 122 | * There were no free key slots. |
Ryan Everett | dfe8bf8 | 2024-01-12 17:45:05 +0000 | [diff] [blame] | 123 | * \retval #PSA_ERROR_BAD_STATE \emptydescription |
| 124 | * \retval #PSA_ERROR_CORRUPTION_DETECTED |
Ryan Everett | 2afb516 | 2023-12-22 15:59:45 +0000 | [diff] [blame] | 125 | * This function attempted to operate on a key slot which was in an |
| 126 | * unexpected state. |
Gilles Peskine | f46f81c | 2019-05-27 14:53:10 +0200 | [diff] [blame] | 127 | */ |
Ryan Everett | 2afb516 | 2023-12-22 15:59:45 +0000 | [diff] [blame] | 128 | psa_status_t psa_reserve_free_key_slot(psa_key_id_t *volatile_key_id, |
| 129 | psa_key_slot_t **p_slot); |
| 130 | |
Ryan Everett | 4a78277 | 2024-01-04 10:53:26 +0000 | [diff] [blame] | 131 | /** Change the state of a key slot. |
| 132 | * |
| 133 | * This function changes the state of the key slot from expected_state to |
| 134 | * new state. If the state of the slot was not expected_state, the state is |
| 135 | * unchanged. |
| 136 | * |
Ryan Everett | fb02d57 | 2024-01-08 11:13:03 +0000 | [diff] [blame] | 137 | * If multi-threading is enabled, the caller must hold the |
| 138 | * global key slot mutex. |
| 139 | * |
Ryan Everett | 4a78277 | 2024-01-04 10:53:26 +0000 | [diff] [blame] | 140 | * \param[in] slot The key slot. |
| 141 | * \param[in] expected_state The current state of the slot. |
| 142 | * \param[in] new_state The new state of the slot. |
| 143 | * |
| 144 | * \retval #PSA_SUCCESS |
| 145 | The key slot's state variable is new_state. |
Ryan Everett | dfe8bf8 | 2024-01-12 17:45:05 +0000 | [diff] [blame] | 146 | * \retval #PSA_ERROR_CORRUPTION_DETECTED |
Ryan Everett | 4a78277 | 2024-01-04 10:53:26 +0000 | [diff] [blame] | 147 | * The slot's state was not expected_state. |
| 148 | */ |
| 149 | static inline psa_status_t psa_key_slot_state_transition( |
| 150 | psa_key_slot_t *slot, psa_key_slot_state_t expected_state, |
| 151 | psa_key_slot_state_t new_state) |
| 152 | { |
| 153 | if (slot->state != expected_state) { |
Ryan Everett | dfe8bf8 | 2024-01-12 17:45:05 +0000 | [diff] [blame] | 154 | return PSA_ERROR_CORRUPTION_DETECTED; |
Ryan Everett | 4a78277 | 2024-01-04 10:53:26 +0000 | [diff] [blame] | 155 | } |
| 156 | slot->state = new_state; |
| 157 | return PSA_SUCCESS; |
| 158 | } |
Gilles Peskine | f46f81c | 2019-05-27 14:53:10 +0200 | [diff] [blame] | 159 | |
Ryan Everett | 39cc9d7 | 2023-12-21 17:57:14 +0000 | [diff] [blame] | 160 | /** Register as a reader of a key slot. |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 161 | * |
Ryan Everett | 39cc9d7 | 2023-12-21 17:57:14 +0000 | [diff] [blame] | 162 | * This function increments the key slot registered reader counter by one. |
Ryan Everett | fb02d57 | 2024-01-08 11:13:03 +0000 | [diff] [blame] | 163 | * If multi-threading is enabled, the caller must hold the |
| 164 | * global key slot mutex. |
Ryan Everett | 7aeacc1 | 2024-01-19 13:02:58 +0000 | [diff] [blame] | 165 | * |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 166 | * \param[in] slot The key slot. |
Ronald Cron | cbf6a1d | 2020-11-13 15:59:59 +0100 | [diff] [blame] | 167 | * |
| 168 | * \retval #PSA_SUCCESS |
Ryan Everett | 39cc9d7 | 2023-12-21 17:57:14 +0000 | [diff] [blame] | 169 | The key slot registered reader counter was incremented. |
Ronald Cron | cbf6a1d | 2020-11-13 15:59:59 +0100 | [diff] [blame] | 170 | * \retval #PSA_ERROR_CORRUPTION_DETECTED |
Ryan Everett | 39cc9d7 | 2023-12-21 17:57:14 +0000 | [diff] [blame] | 171 | * The reader counter already reached its maximum value and was not |
Ryan Everett | dfe8bf8 | 2024-01-12 17:45:05 +0000 | [diff] [blame] | 172 | * increased, or the slot's state was not PSA_SLOT_FULL. |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 173 | */ |
Ryan Everett | 39cc9d7 | 2023-12-21 17:57:14 +0000 | [diff] [blame] | 174 | static inline psa_status_t psa_register_read(psa_key_slot_t *slot) |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 175 | { |
Ryan Everett | dfe8bf8 | 2024-01-12 17:45:05 +0000 | [diff] [blame] | 176 | if ((slot->state != PSA_SLOT_FULL) || |
| 177 | (slot->registered_readers >= SIZE_MAX)) { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 178 | return PSA_ERROR_CORRUPTION_DETECTED; |
| 179 | } |
Ryan Everett | 39cc9d7 | 2023-12-21 17:57:14 +0000 | [diff] [blame] | 180 | slot->registered_readers++; |
Ronald Cron | cbf6a1d | 2020-11-13 15:59:59 +0100 | [diff] [blame] | 181 | |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 182 | return PSA_SUCCESS; |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 183 | } |
| 184 | |
Ryan Everett | 39cc9d7 | 2023-12-21 17:57:14 +0000 | [diff] [blame] | 185 | /** Unregister from reading a key slot. |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 186 | * |
Ryan Everett | 39cc9d7 | 2023-12-21 17:57:14 +0000 | [diff] [blame] | 187 | * This function decrements the key slot registered reader counter by one. |
| 188 | * If the state of the slot is PSA_SLOT_PENDING_DELETION, |
| 189 | * and there is only one registered reader (the caller), |
Ryan Everett | 558da2f | 2024-01-19 12:59:28 +0000 | [diff] [blame] | 190 | * this function will call psa_wipe_key_slot(). |
Ryan Everett | fb02d57 | 2024-01-08 11:13:03 +0000 | [diff] [blame] | 191 | * If multi-threading is enabled, the caller must hold the |
| 192 | * global key slot mutex. |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 193 | * |
| 194 | * \note To ease the handling of errors in retrieving a key slot |
| 195 | * a NULL input pointer is valid, and the function returns |
| 196 | * successfully without doing anything in that case. |
| 197 | * |
| 198 | * \param[in] slot The key slot. |
| 199 | * \retval #PSA_SUCCESS |
Ryan Everett | 39cc9d7 | 2023-12-21 17:57:14 +0000 | [diff] [blame] | 200 | * \p slot is NULL or the key slot reader counter has been |
| 201 | * decremented (and potentially wiped) successfully. |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 202 | * \retval #PSA_ERROR_CORRUPTION_DETECTED |
Ryan Everett | 39cc9d7 | 2023-12-21 17:57:14 +0000 | [diff] [blame] | 203 | * The slot's state was neither PSA_SLOT_FULL nor |
Ryan Everett | dfe8bf8 | 2024-01-12 17:45:05 +0000 | [diff] [blame] | 204 | * PSA_SLOT_PENDING_DELETION. |
| 205 | * Or a wipe was attempted and the slot's state was not |
| 206 | * PSA_SLOT_PENDING_DELETION. |
| 207 | * Or registered_readers was equal to 0. |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 208 | */ |
Ryan Everett | 39cc9d7 | 2023-12-21 17:57:14 +0000 | [diff] [blame] | 209 | psa_status_t psa_unregister_read(psa_key_slot_t *slot); |
Ronald Cron | f95a2b1 | 2020-10-22 15:24:49 +0200 | [diff] [blame] | 210 | |
Ryan Everett | eb1722a | 2024-01-31 13:36:39 +0000 | [diff] [blame] | 211 | /** Wrap a call to psa_unregister_read in the global key slot mutex. |
| 212 | * |
| 213 | * If threading is disabled, this simply calls psa_unregister_read. |
| 214 | * |
| 215 | * \note To ease the handling of errors in retrieving a key slot |
| 216 | * a NULL input pointer is valid, and the function returns |
| 217 | * successfully without doing anything in that case. |
| 218 | * |
| 219 | * \param[in] slot The key slot. |
| 220 | * \retval #PSA_SUCCESS |
| 221 | * \p slot is NULL or the key slot reader counter has been |
| 222 | * decremented (and potentially wiped) successfully. |
| 223 | * \retval #PSA_ERROR_CORRUPTION_DETECTED |
| 224 | * The slot's state was neither PSA_SLOT_FULL nor |
| 225 | * PSA_SLOT_PENDING_DELETION. |
| 226 | * Or a wipe was attempted and the slot's state was not |
| 227 | * PSA_SLOT_PENDING_DELETION. |
| 228 | * Or registered_readers was equal to 0. |
| 229 | */ |
| 230 | psa_status_t psa_unregister_read_under_mutex(psa_key_slot_t *slot); |
| 231 | |
Gilles Peskine | 011e428 | 2019-06-26 18:34:38 +0200 | [diff] [blame] | 232 | /** Test whether a lifetime designates a key in an external cryptoprocessor. |
| 233 | * |
| 234 | * \param lifetime The lifetime to test. |
| 235 | * |
| 236 | * \retval 1 |
| 237 | * The lifetime designates an external key. There should be a |
| 238 | * registered driver for this lifetime, otherwise the key cannot |
| 239 | * be created or manipulated. |
| 240 | * \retval 0 |
| 241 | * The lifetime designates a key that is volatile or in internal |
| 242 | * storage. |
| 243 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 244 | static inline int psa_key_lifetime_is_external(psa_key_lifetime_t lifetime) |
Gilles Peskine | 011e428 | 2019-06-26 18:34:38 +0200 | [diff] [blame] | 245 | { |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 246 | return PSA_KEY_LIFETIME_GET_LOCATION(lifetime) |
| 247 | != PSA_KEY_LOCATION_LOCAL_STORAGE; |
Gilles Peskine | 011e428 | 2019-06-26 18:34:38 +0200 | [diff] [blame] | 248 | } |
| 249 | |
Steven Cooreman | 8c1e759 | 2020-06-17 14:52:05 +0200 | [diff] [blame] | 250 | /** Validate a key's location. |
Gilles Peskine | d167b94 | 2019-04-19 18:19:40 +0200 | [diff] [blame] | 251 | * |
Steven Cooreman | 81fe7c3 | 2020-06-08 18:37:19 +0200 | [diff] [blame] | 252 | * This function checks whether the key's attributes point to a location that |
| 253 | * is known to the PSA Core, and returns the driver function table if the key |
| 254 | * is to be found in an external location. |
Gilles Peskine | d167b94 | 2019-04-19 18:19:40 +0200 | [diff] [blame] | 255 | * |
Steven Cooreman | 8c1e759 | 2020-06-17 14:52:05 +0200 | [diff] [blame] | 256 | * \param[in] lifetime The key lifetime attribute. |
Steven Cooreman | 81fe7c3 | 2020-06-08 18:37:19 +0200 | [diff] [blame] | 257 | * \param[out] p_drv On success, when a key is located in external |
| 258 | * storage, returns a pointer to the driver table |
| 259 | * associated with the key's storage location. |
Gilles Peskine | 011e428 | 2019-06-26 18:34:38 +0200 | [diff] [blame] | 260 | * |
Gilles Peskine | ed73355 | 2023-02-14 19:21:09 +0100 | [diff] [blame] | 261 | * \retval #PSA_SUCCESS \emptydescription |
| 262 | * \retval #PSA_ERROR_INVALID_ARGUMENT \emptydescription |
Gilles Peskine | d167b94 | 2019-04-19 18:19:40 +0200 | [diff] [blame] | 263 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 264 | psa_status_t psa_validate_key_location(psa_key_lifetime_t lifetime, |
| 265 | psa_se_drv_table_entry_t **p_drv); |
Steven Cooreman | 81fe7c3 | 2020-06-08 18:37:19 +0200 | [diff] [blame] | 266 | |
Ronald Cron | d2ed481 | 2020-07-17 16:11:30 +0200 | [diff] [blame] | 267 | /** Validate the persistence of a key. |
Steven Cooreman | 81fe7c3 | 2020-06-08 18:37:19 +0200 | [diff] [blame] | 268 | * |
Ronald Cron | 27238fc | 2020-07-23 12:30:41 +0200 | [diff] [blame] | 269 | * \param[in] lifetime The key lifetime attribute. |
Steven Cooreman | 81fe7c3 | 2020-06-08 18:37:19 +0200 | [diff] [blame] | 270 | * |
Gilles Peskine | ed73355 | 2023-02-14 19:21:09 +0100 | [diff] [blame] | 271 | * \retval #PSA_SUCCESS \emptydescription |
Ronald Cron | de825e6 | 2021-04-01 13:59:10 +0200 | [diff] [blame] | 272 | * \retval #PSA_ERROR_NOT_SUPPORTED The key is persistent but persistent keys |
| 273 | * are not supported. |
Steven Cooreman | 81fe7c3 | 2020-06-08 18:37:19 +0200 | [diff] [blame] | 274 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 275 | psa_status_t psa_validate_key_persistence(psa_key_lifetime_t lifetime); |
Ronald Cron | d2ed481 | 2020-07-17 16:11:30 +0200 | [diff] [blame] | 276 | |
| 277 | /** Validate a key identifier. |
| 278 | * |
Ronald Cron | fc9c556 | 2020-10-15 19:24:49 +0200 | [diff] [blame] | 279 | * \param[in] key The key identifier. |
| 280 | * \param[in] vendor_ok Non-zero to indicate that key identifiers in the |
| 281 | * vendor range are allowed, volatile key identifiers |
| 282 | * excepted \c 0 otherwise. |
Ronald Cron | d2ed481 | 2020-07-17 16:11:30 +0200 | [diff] [blame] | 283 | * |
Ronald Cron | 77e412c | 2021-03-31 17:36:31 +0200 | [diff] [blame] | 284 | * \retval <> 0 if the key identifier is valid, 0 otherwise. |
Ronald Cron | d2ed481 | 2020-07-17 16:11:30 +0200 | [diff] [blame] | 285 | */ |
Gilles Peskine | 449bd83 | 2023-01-11 14:50:10 +0100 | [diff] [blame] | 286 | int psa_is_valid_key_id(mbedtls_svc_key_id_t key, int vendor_ok); |
Gilles Peskine | d167b94 | 2019-04-19 18:19:40 +0200 | [diff] [blame] | 287 | |
Gilles Peskine | 961849f | 2018-11-30 18:54:54 +0100 | [diff] [blame] | 288 | #endif /* PSA_CRYPTO_SLOT_MANAGEMENT_H */ |