diff --git a/include/psa/crypto.h b/include/psa/crypto.h index 51a2b0e52..e87892b63 100644 --- a/include/psa/crypto.h +++ b/include/psa/crypto.h @@ -852,12 +852,13 @@ psa_status_t psa_export_public_key(psa_key_handle_t handle, * * The policy on the source key must have the usage flag * #PSA_KEY_USAGE_COPY set. - * In addition, some lifetimes also require the source key to have the - * usage flag #PSA_KEY_USAGE_EXPORT, because otherwise the source key - * is locked inside a secure processing environment and cannot be - * extracted. For keys with the lifetime #PSA_KEY_LIFETIME_VOLATILE or - * #PSA_KEY_LIFETIME_PERSISTENT, the usage flag #PSA_KEY_USAGE_COPY - * is sufficient to permit the copy. + * This flag is sufficient to permit the copy if the key has the lifetime + * #PSA_KEY_LIFETIME_VOLATILE or #PSA_KEY_LIFETIME_PERSISTENT. + * Some secure elements do not provide a way to copy a key without + * making it extractable from the secure element. If a key is located + * in such a secure element, then the key must have both usage flags + * #PSA_KEY_USAGE_COPY and #PSA_KEY_USAGE_EXPORT in order to make + * a copy of the key outside the secure element. * * The resulting key may only be used in a way that conforms to * both the policy of the original key and the policy specified in diff --git a/include/psa/crypto_values.h b/include/psa/crypto_values.h index 766e396d4..fa0d14d4f 100644 --- a/include/psa/crypto_values.h +++ b/include/psa/crypto_values.h @@ -1461,13 +1461,15 @@ /** Whether the key may be copied. * - * This flag allows the use of psa_crypto_copy() to make a copy of the key + * This flag allows the use of psa_copy_key() to make a copy of the key * with the same policy or a more restrictive policy. * - * For some lifetimes, copying a key also requires the usage flag - * #PSA_KEY_USAGE_EXPORT, because otherwise the source key - * is locked inside a secure processing environment and cannot be - * extracted. For keys with the lifetime #PSA_KEY_LIFETIME_VOLATILE or + * For lifetimes for which the key is located in a secure element which + * enforce the non-exportability of keys, copying a key outside the secure + * element also requires the usage flag #PSA_KEY_USAGE_EXPORT. + * Copying the key inside the secure element is permitted with just + * #PSA_KEY_USAGE_COPY if the secure element supports it. + * For keys with the lifetime #PSA_KEY_LIFETIME_VOLATILE or * #PSA_KEY_LIFETIME_PERSISTENT, the usage flag #PSA_KEY_USAGE_COPY * is sufficient to permit the copy. */