eden-emu/mbedtls
15
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Keys may allow a second algorithm

Browse source 
Add a second permitted algorithm to key policies.

This commit includes smoke tests that do not cover psa_copy_key.
This commit is contained in:
Gilles Peskine 2019-05-10 19:33:38 +02:00
parent 8bf196b303
commit d6f371b1ba
5 changed files with 124 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

39
include/psa/crypto_extra.h
View file

@ -62,6 +62,45 @@ extern "C" {
MBEDTLS_DEPRECATED_NUMERIC_CONSTANT( PSA_ERROR_INSUFFICIENT_DATA )
#endif
/** \addtogroup policy
* @{
*/
/** \brief Set the enrollment algorithm in a key policy.
*
* An operation on a key may indifferently use the algorithm set with
* psa_key_policy_set_usage() or with this function.
*
* \param[in,out] policy The key policy to modify. It must have been
* initialized as per the documentation for
* #psa_key_policy_t.
* \param alg2 A second algorithm that the key may be used for,
* in addition to the algorithm set with
* psa_key_policy_set_usage().
*
* \warning Setting an enrollment algorithm is not recommended, because
* using the same key with different algorithms can allow some
* attacks based on arithmetic relations between different
* computations made with the same key, or can escalate harmless
* side channels into exploitable ones. Use this function only
* if it is necessary to support a protocol for which is has been
* verified that the usage of the key with multiple algorithms
* is safe.
*/
void psa_key_policy_set_enrollment_algorithm(psa_key_policy_t *policy,
psa_algorithm_t alg2);
/** \brief Retrieve the enrollment algorithm field of a policy structure.
*
* \param[in] policy The policy object to query.
*
* \return The enrollment algorithm for a key with this policy.
*/
psa_algorithm_t psa_key_policy_get_enrollment_algorithm(
const psa_key_policy_t *policy);
/**@}*/
/**
* \brief Library deinitialization.
*

3
include/psa/crypto_struct.h
View file

@ -228,9 +228,10 @@ struct psa_key_policy_s
{
psa_key_usage_t usage;
psa_algorithm_t alg;
psa_algorithm_t alg2;
};
#define PSA_KEY_POLICY_INIT {0, 0}
#define PSA_KEY_POLICY_INIT {0, 0, 0}
static inline struct psa_key_policy_s psa_key_policy_init( void )
{
const struct psa_key_policy_s v = PSA_KEY_POLICY_INIT;