Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-09-22 13:01:16 +03:00
Code Issues Packages Projects Releases Wiki Activity

feat(mbedtls/esp_rsa_ds): Introduce ESP-RSA DS opaque key context

Browse Source
This commit is contained in:
harshal.patil
2026-02-19 14:06:03 +05:30
parent d13bbd4b2b
commit 96f5317806
8 changed files with 100 additions and 81 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
components/esp-tls/esp_tls_mbedtls.c
View File

@@ -1420,6 +1420,10 @@ static esp_err_t esp_mbedtls_init_pk_ctx_for_ds(const void *pki)
psa_key_id_t ds_key_id = 0;
psa_status_t status = PSA_ERROR_GENERIC_ERROR;
esp_rsa_ds_opaque_key_t rsa_ds_opaque_key = {0};
rsa_ds_opaque_key.ds_data_ctx = ds_data;
psa_key_attributes_t ds_key_attributes = PSA_KEY_ATTRIBUTES_INIT;
psa_algorithm_t alg = PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_ANY_HASH);
#ifdef CONFIG_MBEDTLS_SSL_PROTO_TLS1_3
@@ -1427,14 +1431,14 @@ static esp_err_t esp_mbedtls_init_pk_ctx_for_ds(const void *pki)
#endif /* CONFIG_MBEDTLS_SSL_PROTO_TLS1_3 */
psa_set_key_type(&ds_key_attributes, PSA_KEY_TYPE_RSA_KEY_PAIR);
psa_set_key_bits(&ds_key_attributes, ds_data->rsa_length_bits);
psa_set_key_bits(&ds_key_attributes, rsa_ds_opaque_key.ds_data_ctx->rsa_length_bits);
psa_set_key_usage_flags(&ds_key_attributes, PSA_KEY_USAGE_SIGN_HASH);
psa_set_key_algorithm(&ds_key_attributes, alg);
psa_set_key_lifetime(&ds_key_attributes, PSA_KEY_LIFETIME_ESP_RSA_DS);
status = psa_import_key(&ds_key_attributes,
(const uint8_t *)ds_data,
sizeof(esp_ds_data_ctx_t),
&ds_key_id);
(const uint8_t *)&rsa_ds_opaque_key,
sizeof(rsa_ds_opaque_key),
&ds_key_id);
psa_reset_key_attributes(&ds_key_attributes);
if (status != PSA_SUCCESS) {
ESP_LOGE(TAG, "Failed to import DS key to PSA, status = %d", status);

2
components/mbedtls/esp_tee/esp_tee_mbedtls.cmake
View File

@@ -59,11 +59,11 @@ foreach(target ${mbedtls_targets})
elseif(CONFIG_MBEDTLS_COMPILER_OPTIMIZATION_PERF)
target_compile_options(${target} PRIVATE "-O2")
endif()
target_link_libraries(${target} PUBLIC idf::esp_hal_security)
endforeach()
target_link_libraries(${COMPONENT_LIB} INTERFACE ${mbedtls_targets})
target_link_libraries(tfpsacrypto PUBLIC idf::esp_hal_security)
target_link_libraries(tfpsacrypto PRIVATE idf::esp_security)
target_include_directories(tfpsacrypto PRIVATE ${crypto_port_inc_dirs})

4
components/mbedtls/port/psa_driver/esp_ecdsa/psa_crypto_driver_esp_ecdsa.c
View File

@@ -512,7 +512,7 @@ psa_status_t esp_ecdsa_opaque_sign_hash_start(
return PSA_ERROR_INVALID_ARGUMENT;
}
esp_ecdsa_opaque_key_t *opaque_key = (esp_ecdsa_opaque_key_t *) key_buffer;
const esp_ecdsa_opaque_key_t *opaque_key = (const esp_ecdsa_opaque_key_t *) key_buffer;
psa_status_t status = validate_ecdsa_opaque_key_attributes(attributes, opaque_key);
if (status != PSA_SUCCESS) {
return status;
@@ -579,7 +579,7 @@ psa_status_t esp_ecdsa_opaque_sign_hash_complete(
}
#if CONFIG_MBEDTLS_TEE_SEC_STG_ECDSA_SIGN
esp_ecdsa_opaque_key_t *opaque_key = operation->opaque_key;
const esp_ecdsa_opaque_key_t *opaque_key = operation->opaque_key;
if (opaque_key->tee_key_id) {
esp_tee_sec_storage_type_t tee_sec_storage_type = esp_ecdsa_curve_to_tee_sec_storage_type(opaque_key->curve);
if (tee_sec_storage_type == (esp_tee_sec_storage_type_t) -1) {

59
components/mbedtls/port/psa_driver/esp_rsa_ds/psa_crypto_driver_esp_rsa_ds.c
View File

@@ -65,33 +65,38 @@ void esp_rsa_ds_release_ds_lock(void)
}
}
static int esp_rsa_ds_validate_opaque_key(const esp_ds_data_ctx_t *opaque_key)
static int esp_rsa_ds_validate_opaque_key(const esp_rsa_ds_opaque_key_t *opaque_key)
{
if (opaque_key == NULL) {
return PSA_ERROR_INVALID_ARGUMENT;
}
if (opaque_key->esp_ds_data == NULL) {
if (opaque_key->ds_data_ctx == NULL) {
return PSA_ERROR_INVALID_ARGUMENT;
}
if (EFUSE_BLK_KEY0 + opaque_key->efuse_key_id >= EFUSE_BLK_KEY_MAX) {
if (opaque_key->ds_data_ctx->esp_ds_data == NULL) {
return PSA_ERROR_INVALID_ARGUMENT;
}
if (opaque_key->rsa_length_bits % 32 != 0) {
if ((opaque_key->ds_data_ctx->efuse_key_id + EFUSE_BLK_KEY0) >= EFUSE_BLK_KEY_MAX) {
return PSA_ERROR_INVALID_ARGUMENT;
}
if (opaque_key->rsa_length_bits < 1024 || opaque_key->rsa_length_bits > SOC_DS_SIGNATURE_MAX_BIT_LEN) {
if (opaque_key->ds_data_ctx->rsa_length_bits % 32 != 0) {
return PSA_ERROR_INVALID_ARGUMENT;
}
if (opaque_key->ds_data_ctx->rsa_length_bits < 1024 || opaque_key->ds_data_ctx->rsa_length_bits > SOC_DS_SIGNATURE_MAX_BIT_LEN) {
return PSA_ERROR_INVALID_ARGUMENT;
}
/* DS data rsa_length must match rsa_length_bits so we can use the key's data directly in sign operations */
if (opaque_key->esp_ds_data->rsa_length != (opaque_key->rsa_length_bits / 32) - 1) {
if (opaque_key->ds_data_ctx->esp_ds_data->rsa_length != (opaque_key->ds_data_ctx->rsa_length_bits / 32) - 1) {
return PSA_ERROR_INVALID_ARGUMENT;
}
esp_efuse_purpose_t purpose = esp_efuse_get_key_purpose(EFUSE_BLK_KEY0 + opaque_key->efuse_key_id);
esp_efuse_purpose_t purpose = esp_efuse_get_key_purpose(EFUSE_BLK_KEY0 + opaque_key->ds_data_ctx->efuse_key_id);
if (purpose != ESP_EFUSE_KEY_PURPOSE_HMAC_DOWN_DIGITAL_SIGNATURE) {
return PSA_ERROR_NOT_PERMITTED;
}
@@ -111,7 +116,7 @@ psa_status_t esp_rsa_ds_opaque_sign_hash_start(
return PSA_ERROR_INVALID_ARGUMENT;
}
if (key_buffer_size < sizeof(esp_ds_data_ctx_t)) {
if (key_buffer_size < sizeof(esp_rsa_ds_opaque_key_t)) {
return PSA_ERROR_INVALID_ARGUMENT;
}
@@ -121,7 +126,7 @@ psa_status_t esp_rsa_ds_opaque_sign_hash_start(
operation->alg = alg;
const esp_ds_data_ctx_t *opaque_key = (const esp_ds_data_ctx_t *)key_buffer;
const esp_rsa_ds_opaque_key_t *opaque_key = (const esp_rsa_ds_opaque_key_t *)key_buffer;
operation->esp_rsa_ds_opaque_key = opaque_key;
if (esp_rsa_ds_validate_opaque_key(opaque_key) != PSA_SUCCESS) {
@@ -141,7 +146,7 @@ psa_status_t esp_rsa_ds_opaque_sign_hash_start(
psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH(operation->alg);
const size_t words_len = (opaque_key->rsa_length_bits / 32);
const size_t words_len = (opaque_key->ds_data_ctx->rsa_length_bits / 32);
const size_t rsa_len_bytes = words_len * 4;
operation->sig_buffer_size = rsa_len_bytes;
operation->sig_buffer = NULL;
@@ -171,9 +176,9 @@ psa_status_t esp_rsa_ds_opaque_sign_hash_start(
}
esp_err_t err = esp_ds_start_sign((const void *)operation->sig_buffer,
opaque_key->esp_ds_data,
(hmac_key_id_t) opaque_key->efuse_key_id,
&operation->esp_rsa_ds_ctx);
opaque_key->ds_data_ctx->esp_ds_data,
opaque_key->ds_data_ctx->efuse_key_id,
&operation->esp_rsa_ds_ctx);
if (err != ESP_OK) {
status = PSA_ERROR_GENERIC_ERROR;
goto error;
@@ -207,7 +212,7 @@ psa_status_t esp_rsa_ds_opaque_sign_hash_complete(
return PSA_ERROR_BAD_STATE;
}
int expected_signature_size = operation->esp_rsa_ds_opaque_key->rsa_length_bits / 8;
int expected_signature_size = operation->esp_rsa_ds_opaque_key->ds_data_ctx->rsa_length_bits / 8;
if (signature_size < expected_signature_size) {
return PSA_ERROR_BUFFER_TOO_SMALL;
}
@@ -309,22 +314,22 @@ psa_status_t esp_rsa_ds_opaque_import_key(
return PSA_ERROR_INVALID_ARGUMENT;
}
if (key_buffer_size < sizeof(esp_ds_data_ctx_t)) {
if (key_buffer_size < sizeof(esp_rsa_ds_opaque_key_t)) {
return PSA_ERROR_BUFFER_TOO_SMALL;
}
const esp_ds_data_ctx_t *opaque_key = (const esp_ds_data_ctx_t *)data;
const esp_rsa_ds_opaque_key_t *opaque_key = (const esp_rsa_ds_opaque_key_t *)data;
int ret = esp_rsa_ds_validate_opaque_key(opaque_key);
if (ret != PSA_SUCCESS) {
return ret;
}
/* Shallow copy: key buffer holds the context; esp_ds_data points to the caller's data.
* The key material (esp_ds_data_ctx_t and the esp_ds_data_t it points to) must remain
* The key material (esp_rsa_ds_opaque_key_t and the esp_ds_data_t it points to) must remain
* valid until psa_destroy_key() is called on this key. */
memcpy(key_buffer, opaque_key, sizeof(esp_ds_data_ctx_t));
*key_buffer_length = sizeof(esp_ds_data_ctx_t);
*bits = opaque_key->rsa_length_bits;
memcpy(key_buffer, opaque_key, sizeof(esp_rsa_ds_opaque_key_t));
*key_buffer_length = sizeof(esp_rsa_ds_opaque_key_t);
*bits = opaque_key->ds_data_ctx->rsa_length_bits;
return PSA_SUCCESS;
}
@@ -335,7 +340,7 @@ size_t esp_rsa_ds_opaque_size_function(
(void)key_type;
(void)key_bits;
return sizeof(esp_ds_data_ctx_t);
return sizeof(esp_rsa_ds_opaque_key_t);
}
void esp_rsa_ds_opaque_set_session_timeout(int timeout_ms)
@@ -360,7 +365,7 @@ psa_status_t esp_rsa_ds_opaque_asymmetric_decrypt(
{
(void)salt;
(void)salt_length;
if (!attributes || !key || key_length < sizeof(esp_ds_data_ctx_t) ||
if (!attributes || !key || key_length < sizeof(esp_rsa_ds_opaque_key_t) ||
!input || input_length < 1 || !output || !output_length) {
return PSA_ERROR_INVALID_ARGUMENT;
}
@@ -369,13 +374,13 @@ psa_status_t esp_rsa_ds_opaque_asymmetric_decrypt(
return PSA_ERROR_NOT_SUPPORTED;
}
const esp_ds_data_ctx_t *opaque_key = (const esp_ds_data_ctx_t *)key;
const esp_rsa_ds_opaque_key_t *opaque_key = (const esp_rsa_ds_opaque_key_t *)key;
if (esp_rsa_ds_validate_opaque_key(opaque_key) != PSA_SUCCESS) {
return PSA_ERROR_INVALID_ARGUMENT;
}
size_t key_bits = opaque_key->rsa_length_bits;
size_t key_bits = opaque_key->ds_data_ctx->rsa_length_bits;
if (input_length != (key_bits / 8)) {
return PSA_ERROR_INVALID_ARGUMENT;
}
@@ -409,9 +414,9 @@ psa_status_t esp_rsa_ds_opaque_asymmetric_decrypt(
operation.sig_buffer = em_words;
esp_err_t err = esp_ds_start_sign((const void *)em_words,
opaque_key->esp_ds_data,
(hmac_key_id_t) opaque_key->efuse_key_id,
&operation.esp_rsa_ds_ctx);
opaque_key->ds_data_ctx->esp_ds_data,
opaque_key->ds_data_ctx->efuse_key_id,
&operation.esp_rsa_ds_ctx);
if (err != ESP_OK) {
heap_caps_free(em_words);
esp_rsa_ds_release_ds_lock();

2
components/mbedtls/port/psa_driver/include/psa_crypto_driver_esp_ecdsa_contexts.h
View File

@@ -66,7 +66,7 @@ typedef struct {
/* The buffers are stored in the little-endian format */
typedef struct {
psa_algorithm_t alg;
esp_ecdsa_opaque_key_t *opaque_key;
const esp_ecdsa_opaque_key_t *opaque_key;
uint8_t r[MAX_ECDSA_COMPONENT_LEN];
uint8_t s[MAX_ECDSA_COMPONENT_LEN];
uint8_t sha[MAX_ECDSA_SHA_LEN];

2
components/mbedtls/port/psa_driver/include/psa_crypto_driver_esp_rsa_ds.h
View File

@@ -110,7 +110,7 @@ psa_status_t esp_rsa_ds_opaque_signature_sign_hash(
/**
* @brief Import the RSA DS opaque key
* The data should be of type esp_ds_data_ctx_t and should be
* The data should be of type esp_rsa_ds_opaque_key_t and should be
* already initialised with DS data and efuse key id.
*
* @param attributes Key attributes

9
components/mbedtls/port/psa_driver/include/psa_crypto_driver_esp_rsa_ds_contexts.h
View File

@@ -10,6 +10,7 @@
#if defined(ESP_RSA_DS_DRIVER_ENABLED)
#include "psa/crypto_driver_common.h"
#include "esp_ds.h"
#include "hal/hmac_types.h"
#ifdef __cplusplus
extern "C" {
@@ -35,14 +36,18 @@ typedef enum {
*/
typedef struct {
esp_ds_data_t *esp_ds_data; /**< Pointer to the esp ds data */
uint8_t efuse_key_id; /**< efuse block id in which DS_KEY is stored e.g. 0,1*/
hmac_key_id_t efuse_key_id; /**< efuse block id in which the HMAC key for the DS peripheral is stored e.g. 0,1*/
uint16_t rsa_length_bits; /**< length of RSA private key in bits e.g. 2048 */
} esp_ds_data_ctx_t;
typedef struct {
esp_ds_data_ctx_t *ds_data_ctx;
} esp_rsa_ds_opaque_key_t;
#if !(__DOXYGEN__) // No need to document these structures, these are internal to the driver
/* The buffers are stored in the little-endian format */
typedef struct {
const esp_ds_data_ctx_t *esp_rsa_ds_opaque_key; /**< Pointer to the esp ds opaque key */
const esp_rsa_ds_opaque_key_t *esp_rsa_ds_opaque_key; /**< Pointer to the esp ds opaque key */
psa_algorithm_t alg; /**< Algorithm used in the sign operation */
uint32_t *sig_buffer; /**< Buffer to hold the signature */
size_t sig_buffer_size; /**< Size of the signature buffer */

91
components/mbedtls/test_apps/main/test_ds_sign_and_decrypt.c
View File

@@ -57,43 +57,44 @@ TEST_CASE("ds sign test pkcs1_v15 PSA validation", "[ds_rsa_psa]")
psa_status_t status;
psa_algorithm_t alg = PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_SHA_256);
esp_ds_data_ctx_t *ds_key = esp_secure_cert_get_ds_ctx();
TEST_ASSERT_NOT_NULL(ds_key);
esp_rsa_ds_opaque_key_t rsa_ds_opaque_key = {0};
rsa_ds_opaque_key.ds_data_ctx = esp_secure_cert_get_ds_ctx();
TEST_ASSERT_NOT_NULL(rsa_ds_opaque_key.ds_data_ctx);
ds_key->efuse_key_id = EFUSE_BLK_MAX; // Invalid efuse key id to trigger validation failure
rsa_ds_opaque_key.ds_data_ctx->efuse_key_id = EFUSE_BLK_KEY_MAX; // Invalid efuse block to trigger validation failure
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
psa_set_key_type(&attributes, PSA_KEY_TYPE_RSA_KEY_PAIR);
psa_set_key_bits(&attributes, ds_key->rsa_length_bits);
psa_set_key_bits(&attributes, rsa_ds_opaque_key.ds_data_ctx->rsa_length_bits);
psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_HASH);
psa_set_key_algorithm(&attributes, alg);
psa_set_key_lifetime(&attributes, PSA_KEY_LIFETIME_ESP_RSA_DS);
status = psa_import_key(&attributes,
(const uint8_t *)ds_key,
sizeof(*ds_key),
(const uint8_t *)&rsa_ds_opaque_key,
sizeof(rsa_ds_opaque_key),
&keyt_id);
TEST_ASSERT_EQUAL(PSA_ERROR_INVALID_ARGUMENT, status);
ds_key->efuse_key_id = EFUSE_BLK0 + 0; // Reset to valid efuse key id
ds_key->rsa_length_bits = 1000; // Invalid RSA length to trigger validation failure
rsa_ds_opaque_key.ds_data_ctx->efuse_key_id = EFUSE_BLK_KEY0; // Reset to valid efuse block
rsa_ds_opaque_key.ds_data_ctx->rsa_length_bits = 1000; // Invalid RSA length to trigger validation failure
status = psa_import_key(&attributes,
(const uint8_t *)ds_key,
sizeof(*ds_key),
(const uint8_t *)&rsa_ds_opaque_key,
sizeof(rsa_ds_opaque_key),
&keyt_id);
TEST_ASSERT_EQUAL(PSA_ERROR_INVALID_ARGUMENT, status);
ds_key->rsa_length_bits = 2048; // Reset to valid RSA length
esp_ds_data_t *ds_data_backup = ds_key->esp_ds_data;
ds_key->esp_ds_data = NULL; // NULL esp_ds_data to trigger validation failure
rsa_ds_opaque_key.ds_data_ctx->rsa_length_bits = 2048; // Reset to valid RSA length
esp_ds_data_t *ds_data_backup = rsa_ds_opaque_key.ds_data_ctx->esp_ds_data;
rsa_ds_opaque_key.ds_data_ctx->esp_ds_data = NULL; // NULL esp_ds_data to trigger validation failure
status = psa_import_key(&attributes,
(const uint8_t *)ds_key,
sizeof(*ds_key),
(const uint8_t *)&rsa_ds_opaque_key,
sizeof(rsa_ds_opaque_key),
&keyt_id);
TEST_ASSERT_EQUAL(PSA_ERROR_INVALID_ARGUMENT, status);
ds_key->esp_ds_data = ds_data_backup; // Restore esp_ds_data
rsa_ds_opaque_key.ds_data_ctx->esp_ds_data = ds_data_backup; // Restore esp_ds_data
esp_secure_cert_free_ds_ctx(ds_key);
esp_secure_cert_free_ds_ctx(rsa_ds_opaque_key.ds_data_ctx);
}
TEST_CASE("ds sign test pkcs1_v15 PSA", "[ds_rsa_psa]")
@@ -102,18 +103,19 @@ TEST_CASE("ds sign test pkcs1_v15 PSA", "[ds_rsa_psa]")
psa_status_t status;
psa_algorithm_t alg = PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_SHA_256);
esp_ds_data_ctx_t *ds_key = esp_secure_cert_get_ds_ctx();
TEST_ASSERT_NOT_NULL(ds_key);
esp_rsa_ds_opaque_key_t rsa_ds_opaque_key = {0};
rsa_ds_opaque_key.ds_data_ctx = esp_secure_cert_get_ds_ctx();
TEST_ASSERT_NOT_NULL(rsa_ds_opaque_key.ds_data_ctx);
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
psa_set_key_type(&attributes, PSA_KEY_TYPE_RSA_KEY_PAIR);
psa_set_key_bits(&attributes, ds_key->rsa_length_bits);
psa_set_key_bits(&attributes, rsa_ds_opaque_key.ds_data_ctx->rsa_length_bits);
psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_HASH);
psa_set_key_algorithm(&attributes, alg);
psa_set_key_lifetime(&attributes, PSA_KEY_LIFETIME_ESP_RSA_DS);
status = psa_import_key(&attributes,
(const uint8_t *)ds_key,
sizeof(*ds_key),
(const uint8_t *)&rsa_ds_opaque_key,
sizeof(rsa_ds_opaque_key),
&keyt_id);
TEST_ASSERT_EQUAL(PSA_SUCCESS, status);
@@ -136,7 +138,7 @@ TEST_CASE("ds sign test pkcs1_v15 PSA", "[ds_rsa_psa]")
psa_reset_key_attributes(&attributes);
// Free the DS context to prevent memory leak
esp_secure_cert_free_ds_ctx(ds_key);
esp_secure_cert_free_ds_ctx(rsa_ds_opaque_key.ds_data_ctx);
// Because we have wrapped around the ds_start_sign and ds_finish_sign functions,
// we are not actually performing the real signing operation. That test is done in the
@@ -169,18 +171,19 @@ TEST_CASE("ds sign test pkcs1_v21 PSA", "[ds_rsa_psa]")
psa_key_id_t keyt_id;
psa_status_t status;
psa_algorithm_t alg = PSA_ALG_RSA_PSS(PSA_ALG_SHA_256);
esp_ds_data_ctx_t *ds_key = esp_secure_cert_get_ds_ctx();
TEST_ASSERT_NOT_NULL(ds_key);
esp_rsa_ds_opaque_key_t rsa_ds_opaque_key = {0};
rsa_ds_opaque_key.ds_data_ctx = esp_secure_cert_get_ds_ctx();
TEST_ASSERT_NOT_NULL(rsa_ds_opaque_key.ds_data_ctx);
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
psa_set_key_type(&attributes, PSA_KEY_TYPE_RSA_KEY_PAIR);
psa_set_key_bits(&attributes, ds_key->rsa_length_bits);
psa_set_key_bits(&attributes, rsa_ds_opaque_key.ds_data_ctx->rsa_length_bits);
psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_HASH);
psa_set_key_algorithm(&attributes, alg);
psa_set_key_lifetime(&attributes, PSA_KEY_LIFETIME_ESP_RSA_DS);
status = psa_import_key(&attributes,
(const uint8_t *)ds_key,
sizeof(*ds_key),
(const uint8_t *)&rsa_ds_opaque_key,
sizeof(rsa_ds_opaque_key),
&keyt_id);
TEST_ASSERT_EQUAL(PSA_SUCCESS, status);
@@ -203,7 +206,7 @@ TEST_CASE("ds sign test pkcs1_v21 PSA", "[ds_rsa_psa]")
psa_reset_key_attributes(&attributes);
// Free the DS context to prevent memory leak
esp_secure_cert_free_ds_ctx(ds_key);
esp_secure_cert_free_ds_ctx(rsa_ds_opaque_key.ds_data_ctx);
}
/* Generated external data for OAEP padding */
@@ -232,20 +235,21 @@ TEST_CASE("ds decrypt test pkcs1_v21 PSA", "[ds_rsa]")
psa_status_t status;
psa_algorithm_t alg = PSA_ALG_RSA_OAEP(PSA_ALG_SHA_256);
esp_ds_data_ctx_t *ds_key = esp_secure_cert_get_ds_ctx();
TEST_ASSERT_NOT_NULL(ds_key);
esp_rsa_ds_opaque_key_t rsa_ds_opaque_key = {0};
rsa_ds_opaque_key.ds_data_ctx = esp_secure_cert_get_ds_ctx();
TEST_ASSERT_NOT_NULL(rsa_ds_opaque_key.ds_data_ctx);
printf("DS Key RSA Length Bits: %d\n", ds_key->rsa_length_bits);
printf("DS Key RSA Length Bits: %d\n", rsa_ds_opaque_key.ds_data_ctx->rsa_length_bits);
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
psa_set_key_type(&attributes, PSA_KEY_TYPE_RSA_KEY_PAIR);
psa_set_key_bits(&attributes, ds_key->rsa_length_bits);
psa_set_key_bits(&attributes, rsa_ds_opaque_key.ds_data_ctx->rsa_length_bits);
psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_DECRYPT);
psa_set_key_algorithm(&attributes, alg);
psa_set_key_lifetime(&attributes, PSA_KEY_LIFETIME_ESP_RSA_DS);
status = psa_import_key(&attributes,
(const uint8_t *)ds_key,
sizeof(*ds_key),
(const uint8_t *)&rsa_ds_opaque_key,
sizeof(rsa_ds_opaque_key),
&keyt_id);
TEST_ASSERT_EQUAL(PSA_SUCCESS, status);
@@ -265,7 +269,7 @@ TEST_CASE("ds decrypt test pkcs1_v21 PSA", "[ds_rsa]")
psa_reset_key_attributes(&attributes);
// Free the DS context to prevent memory leak
esp_secure_cert_free_ds_ctx(ds_key);
esp_secure_cert_free_ds_ctx(rsa_ds_opaque_key.ds_data_ctx);
}
#endif /* CONFIG_MBEDTLS_SSL_PROTO_TLS1_3 */
@@ -294,20 +298,21 @@ TEST_CASE("ds decrypt test pkcs1_v15 PSA", "[ds_rsa]")
psa_status_t status;
psa_algorithm_t alg = PSA_ALG_RSA_PKCS1V15_CRYPT;
esp_ds_data_ctx_t *ds_key = esp_secure_cert_get_ds_ctx();
TEST_ASSERT_NOT_NULL(ds_key);
esp_rsa_ds_opaque_key_t rsa_ds_opaque_key = {0};
rsa_ds_opaque_key.ds_data_ctx = esp_secure_cert_get_ds_ctx();
TEST_ASSERT_NOT_NULL(rsa_ds_opaque_key.ds_data_ctx);
printf("DS Key RSA Length Bits: %d\n", ds_key->rsa_length_bits);
printf("DS Key RSA Length Bits: %d\n", rsa_ds_opaque_key.ds_data_ctx->rsa_length_bits);
psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
psa_set_key_type(&attributes, PSA_KEY_TYPE_RSA_KEY_PAIR);
psa_set_key_bits(&attributes, ds_key->rsa_length_bits);
psa_set_key_bits(&attributes, rsa_ds_opaque_key.ds_data_ctx->rsa_length_bits);
psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_DECRYPT);
psa_set_key_algorithm(&attributes, alg);
psa_set_key_lifetime(&attributes, PSA_KEY_LIFETIME_ESP_RSA_DS);
status = psa_import_key(&attributes,
(const uint8_t *)ds_key,
sizeof(*ds_key),
(const uint8_t *)&rsa_ds_opaque_key,
sizeof(rsa_ds_opaque_key),
&keyt_id);
TEST_ASSERT_EQUAL(PSA_SUCCESS, status);
@@ -327,7 +332,7 @@ TEST_CASE("ds decrypt test pkcs1_v15 PSA", "[ds_rsa]")
psa_reset_key_attributes(&attributes);
// Free the DS context to prevent memory leak
esp_secure_cert_free_ds_ctx(ds_key);
esp_secure_cert_free_ds_ctx(rsa_ds_opaque_key.ds_data_ctx);
}
int __wrap_esp_ds_start_sign(const void *message, const esp_ds_data_t *data, hmac_key_id_t key_id, esp_ds_context_t **esp_ds_ctx)