Part of moving Parsec to use psa-crypto

psa-crypto-sys/src/c/shim.h

@@ -83,6 +83,7 @@ psa_algorithm_t shim_get_key_algorithm(const psa_key_attributes_t *attributes);
 psa_key_usage_t
 shim_get_key_usage_flags(const psa_key_attributes_t *attributes);
 psa_key_attributes_t shim_key_attributes_init(void);
+psa_status_t shim_get_key_attributes(psa_key_handle_t key_handle, psa_key_attributes_t *attributes);
 
 void shim_set_key_algorithm(psa_key_attributes_t *attributes,
                             psa_algorithm_t alg);

psa-crypto-sys/src/constants.rs

@@ -25,6 +25,9 @@ pub const PSA_ERROR_HARDWARE_FAILURE: psa_status_t = -147;
 pub const PSA_ERROR_INSUFFICIENT_ENTROPY: psa_status_t = -148;
 pub const PSA_ERROR_INVALID_SIGNATURE: psa_status_t = -149;
 pub const PSA_ERROR_INVALID_PADDING: psa_status_t = -150;
+pub const PSA_ERROR_CORRUPTION_DETECTED: psa_status_t = -151;
+pub const PSA_ERROR_DATA_CORRUPT: psa_status_t = -152;
+pub const PSA_ERROR_DATA_INVALID: psa_status_t = -153;
 pub const PSA_ERROR_INSUFFICIENT_DATA: psa_status_t = -143;
 pub const PSA_ERROR_INVALID_HANDLE: psa_status_t = -136;
 
@@ -87,6 +90,8 @@ pub const PSA_KEY_USAGE_DECRYPT: psa_key_usage_t = 512;
 pub const PSA_KEY_USAGE_SIGN: psa_key_usage_t = 1024;
 pub const PSA_KEY_USAGE_VERIFY: psa_key_usage_t = 2048;
 pub const PSA_KEY_USAGE_DERIVE: psa_key_usage_t = 4096;
+pub const PSA_KEY_SLOT_COUNT: isize = 32;
+pub const PSA_MAX_PERSISTENT_KEY_IDENTIFIER: psa_key_id_t = 0x3fff_ffff;
 
 #[cfg(feature = "implementation-defined")]
 pub const PSA_DRV_SE_HAL_VERSION: u32 = 5;

psa-crypto-sys/src/lib.rs

@@ -39,9 +39,9 @@ pub use types::*;
 
 #[cfg(feature = "implementation-defined")]
 pub use psa_crypto_binding::{
-    psa_close_key, psa_crypto_init, psa_destroy_key, psa_export_public_key, psa_generate_key,
-    psa_import_key, psa_key_attributes_t, psa_open_key, psa_reset_key_attributes, psa_sign_hash,
-    psa_verify_hash,
+    mbedtls_psa_crypto_free, psa_close_key, psa_crypto_init, psa_destroy_key,
+    psa_export_public_key, psa_generate_key, psa_get_key_attributes, psa_import_key,
+    psa_key_attributes_t, psa_open_key, psa_reset_key_attributes, psa_sign_hash, psa_verify_hash,
 };
 
 // Secure Element Driver definitions

psa-crypto/src/lib.rs

@@ -72,7 +72,7 @@ static INITIALISED: AtomicBool = AtomicBool::new(false);
 /// ```
 #[cfg(feature = "with-mbed-crypto")]
 pub fn init() -> Result<()> {
-    // It it not a problem to call psa_crypto_init more than once.
+    // It is not a problem to call psa_crypto_init more than once.
     Status::from(unsafe { psa_crypto_sys::psa_crypto_init() }).to_result()?;
     let _ = INITIALISED.compare_and_swap(false, true, Ordering::Relaxed);
 
@@ -96,3 +96,20 @@ pub fn initialized() -> Result<()> {
         Err(Error::BadState)
     }
 }
+
+/// Closes mbedtls, releasing resources
+///
+/// Example
+///
+/// ```
+/// use psa_crypto::{init, drop};
+/// init().unwrap();
+/// // ...
+/// drop();
+/// ```
+#[cfg(feature = "with-mbed-crypto")]
+pub fn drop() {
+    unsafe {
+        psa_crypto_sys::mbedtls_psa_crypto_free();
+    }
+}

psa-crypto/src/operations/asym_signature.rs

@@ -64,7 +64,7 @@ pub fn sign_hash(
     let mut signature_length = 0;
     let handle = key.handle()?;
 
-    Status::from(unsafe {
+    let sign_res = Status::from(unsafe {
         psa_crypto_sys::psa_sign_hash(
             handle,
             alg.into(),
@@ -75,10 +75,9 @@ pub fn sign_hash(
             &mut signature_length,
         )
     })
-    .to_result()?;
-
+    .to_result();
     key.close_handle(handle)?;
-
+    sign_res?;
     Ok(signature_length)
 }
 
@@ -130,7 +129,7 @@ pub fn verify_hash(key: Id, alg: AsymmetricSignature, hash: &[u8], signature: &[
 
     let handle = key.handle()?;
 
-    Status::from(unsafe {
+    let verify_res = Status::from(unsafe {
         psa_crypto_sys::psa_verify_hash(
             handle,
             alg.into(),
@@ -140,7 +139,7 @@ pub fn verify_hash(key: Id, alg: AsymmetricSignature, hash: &[u8], signature: &[
             signature.len(),
         )
     })
-    .to_result()?;
-
-    key.close_handle(handle)
+    .to_result();
+    key.close_handle(handle)?;
+    verify_res
 }

psa-crypto/src/operations/key_management.rs

@@ -4,9 +4,10 @@
 //! # Key Management operations
 
 use crate::initialized;
-use crate::types::key::{Attributes, Id};
+use crate::types::key::{Attributes, Id, Lifetime};
 use crate::types::status::{Result, Status};
 use core::convert::TryFrom;
+use psa_crypto_sys::{psa_key_handle_t, psa_key_id_t};
 
 /// Generate a key or a key pair
 ///
@@ -47,25 +48,20 @@ use core::convert::TryFrom;
 /// ```
 pub fn generate(attributes: Attributes, id: Option<u32>) -> Result<Id> {
     initialized()?;
-
-    let mut attributes = psa_crypto_sys::psa_key_attributes_t::try_from(attributes)?;
+    let mut key_attributes = psa_crypto_sys::psa_key_attributes_t::try_from(attributes)?;
     let id = if let Some(id) = id {
-        unsafe { psa_crypto_sys::psa_set_key_id(&mut attributes, id) };
+        unsafe { psa_crypto_sys::psa_set_key_id(&mut key_attributes, id) };
         id
     } else {
         0
     };
     let mut handle = 0;
+    let gen_res =
+        Status::from(unsafe { psa_crypto_sys::psa_generate_key(&key_attributes, &mut handle) })
+            .to_result();
+    Attributes::reset(&mut key_attributes);
 
-    Status::from(unsafe { psa_crypto_sys::psa_generate_key(&attributes, &mut handle) })
-        .to_result()?;
-
-    Attributes::reset(&mut attributes);
-
-    Ok(Id {
-        id,
-        handle: Some(handle),
-    })
+    complete_new_key_operation(attributes.lifetime, id, handle, gen_res)
 }
 
 /// Destroy a key
@@ -113,8 +109,7 @@ pub fn generate(attributes: Attributes, id: Option<u32>) -> Result<Id> {
 pub unsafe fn destroy(key: Id) -> Result<()> {
     initialized()?;
     let handle = key.handle()?;
-    Status::from(psa_crypto_sys::psa_destroy_key(handle)).to_result()?;
-    key.close_handle(handle)
+    Status::from(psa_crypto_sys::psa_destroy_key(handle)).to_result()
 }
 
 /// Import a key in binary format
@@ -166,26 +161,23 @@ pub unsafe fn destroy(key: Id) -> Result<()> {
 pub fn import(attributes: Attributes, id: Option<u32>, data: &[u8]) -> Result<Id> {
     initialized()?;
 
-    let mut attributes = psa_crypto_sys::psa_key_attributes_t::try_from(attributes)?;
+    let mut key_attributes = psa_crypto_sys::psa_key_attributes_t::try_from(attributes)?;
     let id = if let Some(id) = id {
-        unsafe { psa_crypto_sys::psa_set_key_id(&mut attributes, id) };
+        unsafe { psa_crypto_sys::psa_set_key_id(&mut key_attributes, id) };
         id
     } else {
         0
     };
     let mut handle = 0;
 
-    Status::from(unsafe {
-        psa_crypto_sys::psa_import_key(&attributes, data.as_ptr(), data.len(), &mut handle)
+    let gen_res = Status::from(unsafe {
+        psa_crypto_sys::psa_import_key(&key_attributes, data.as_ptr(), data.len(), &mut handle)
     })
-    .to_result()?;
+    .to_result();
 
-    Attributes::reset(&mut attributes);
+    Attributes::reset(&mut key_attributes);
 
-    Ok(Id {
-        id,
-        handle: Some(handle),
-    })
+    complete_new_key_operation(attributes.lifetime, id, handle, gen_res)
 }
 
 /// Export a public key or the public part of a key pair in binary format
@@ -227,17 +219,87 @@ pub fn export_public(key: Id, data: &mut [u8]) -> Result<usize> {
     let handle = key.handle()?;
     let mut data_length = 0;
 
-    Status::from(unsafe {
+    let export_res = Status::from(unsafe {
         psa_crypto_sys::psa_export_public_key(
             handle,
             data.as_mut_ptr(),
             data.len(),
             &mut data_length,
         )
     })
-    .to_result()?;
+    .to_result();
+    key.close_handle(handle)?;
+    export_res?;
+    Ok(data_length)
+}
 
+/// Gets the attributes for a given key ID
+///
+/// The `Id` structure can be created with the `from_persistent_key_id` constructor on `Id`.
+///
+/// # Example
+///
+/// ```
+/// # use psa_crypto::operations::key_management;
+/// # use psa_crypto::types::key::{Attributes, Type, Lifetime, Policy, UsageFlags};
+/// # use psa_crypto::types::algorithm::{AsymmetricSignature, Hash};
+/// # let mut attributes = Attributes {
+/// #     key_type: Type::RsaKeyPair,
+/// #     bits: 1024,
+/// #     lifetime: Lifetime::Volatile,
+/// #     policy: Policy {
+/// #         usage_flags: UsageFlags {
+/// #             sign_hash: true,
+/// #             sign_message: true,
+/// #             verify_hash: true,
+/// #             verify_message: true,
+/// #             ..Default::default()
+/// #         },
+/// #         permitted_algorithms: AsymmetricSignature::RsaPkcs1v15Sign {
+/// #             hash_alg: Hash::Sha256.into(),
+/// #         }.into(),
+/// #     },
+/// # };
+/// psa_crypto::init().unwrap();
+/// let my_key = key_management::generate(attributes, None).unwrap();
+/// //...
+/// let key_attributes = key_management::get_key_attributes(my_key);
+/// ```
+
+pub fn get_key_attributes(key: Id) -> Result<Attributes> {
+    initialized()?;
+    let mut key_attributes = unsafe { psa_crypto_sys::psa_key_attributes_init() };
+    let handle = key.handle()?;
+    let attributes_res = Status::from(unsafe {
+        psa_crypto_sys::psa_get_key_attributes(handle, &mut key_attributes)
+    })
+    .to_result();
     key.close_handle(handle)?;
+    attributes_res?;
+    Ok(Attributes::try_from(key_attributes)?)
+}
 
-    Ok(data_length)
+/// Completes a new key operation (either generate or import)
+///
+/// If key is not `Volatile` (`Persistent` or `Custom(u32)`), handle is closed.
+///
+/// If a key is `Volatile`, `Id` returned contains the key `handle`. Otherwise, it does not.
+fn complete_new_key_operation(
+    key_lifetime: Lifetime,
+    id: psa_key_id_t,
+    handle: psa_key_handle_t,
+    operation_result: Result<()>,
+) -> Result<Id> {
+    if key_lifetime != Lifetime::Volatile {
+        Status::from(unsafe { psa_crypto_sys::psa_close_key(handle) }).to_result()?;
+    }
+    operation_result?;
+    Ok(Id {
+        id,
+        handle: if key_lifetime == Lifetime::Volatile {
+            Some(handle)
+        } else {
+            None
+        },
+    })
 }

psa-crypto/src/types/key.rs

@@ -12,6 +12,9 @@ use crate::types::status::{Error, Result};
 #[cfg(feature = "with-mbed-crypto")]
 use core::convert::{TryFrom, TryInto};
 use log::error;
+pub use psa_crypto_sys::{
+    psa_key_id_t as key_id_type, PSA_KEY_SLOT_COUNT, PSA_MAX_PERSISTENT_KEY_IDENTIFIER,
+};
 use serde::{Deserialize, Serialize};
 
 /// Native definition of the attributes needed to fully describe
@@ -473,7 +476,7 @@ pub struct UsageFlags {
 #[cfg(feature = "with-mbed-crypto")]
 #[derive(Copy, Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub struct Id {
-    pub(crate) id: psa_crypto_sys::psa_key_id_t,
+    pub(crate) id: key_id_type,
     pub(crate) handle: Option<psa_crypto_sys::psa_key_handle_t>,
 }
 

psa-crypto/src/types/status.rs

@@ -186,6 +186,9 @@ impl From<psa_crypto_sys::psa_status_t> for Status {
             psa_crypto_sys::PSA_ERROR_INVALID_PADDING => Error::InvalidPadding.into(),
             psa_crypto_sys::PSA_ERROR_INSUFFICIENT_DATA => Error::InsufficientData.into(),
             psa_crypto_sys::PSA_ERROR_INVALID_HANDLE => Error::InvalidHandle.into(),
+            psa_crypto_sys::PSA_ERROR_CORRUPTION_DETECTED => Error::CorruptionDetected.into(),
+            psa_crypto_sys::PSA_ERROR_DATA_CORRUPT => Error::DataCorrupt.into(),
+            psa_crypto_sys::PSA_ERROR_DATA_INVALID => Error::DataInvalid.into(),
             s => {
                 error!("{} not recognised as a valid PSA status.", s);
                 Status::Error(Error::GenericError)
@@ -218,19 +221,20 @@ impl From<Error> for psa_crypto_sys::psa_status_t {
             Error::InsufficientStorage => psa_crypto_sys::PSA_ERROR_INSUFFICIENT_STORAGE,
             Error::CommunicationFailure => psa_crypto_sys::PSA_ERROR_COMMUNICATION_FAILURE,
             Error::StorageFailure => psa_crypto_sys::PSA_ERROR_STORAGE_FAILURE,
-            //Error::DataCorrupt => psa_crypto_sys::PSA_ERROR_DATA_CORRUPT,
-            //Error::DataInvalid => psa_crypto_sys::PSA_ERROR_DATA_INVALID,
+            Error::DataCorrupt => psa_crypto_sys::PSA_ERROR_DATA_CORRUPT,
+            Error::DataInvalid => psa_crypto_sys::PSA_ERROR_DATA_INVALID,
             Error::HardwareFailure => psa_crypto_sys::PSA_ERROR_HARDWARE_FAILURE,
-            //Error::CorruptionDetected => psa_crypto_sys::PSA_ERROR_CORRUPTION_DETECTED,
+            Error::CorruptionDetected => psa_crypto_sys::PSA_ERROR_CORRUPTION_DETECTED,
             Error::InsufficientEntropy => psa_crypto_sys::PSA_ERROR_INSUFFICIENT_ENTROPY,
             Error::InvalidSignature => psa_crypto_sys::PSA_ERROR_INVALID_SIGNATURE,
             Error::InvalidPadding => psa_crypto_sys::PSA_ERROR_INVALID_PADDING,
             Error::InsufficientData => psa_crypto_sys::PSA_ERROR_INSUFFICIENT_DATA,
             Error::InvalidHandle => psa_crypto_sys::PSA_ERROR_INVALID_HANDLE,
-            e => {
+            // Commented out as all errors are currently matched against and this causes compilation error
+            /*e => {
                 error!("No equivalent of {:?} to a psa_status_t.", e);
                 psa_crypto_sys::PSA_ERROR_GENERIC_ERROR
-            }
+            }*/
         }
     }
 }