From 96f5317806164984fece3bc2d3de6f9eb157ca6a Mon Sep 17 00:00:00 2001 From: "harshal.patil" Date: Thu, 19 Feb 2026 14:06:03 +0530 Subject: [PATCH] feat(mbedtls/esp_rsa_ds): Introduce ESP-RSA DS opaque key context --- components/esp-tls/esp_tls_mbedtls.c | 12 ++- .../mbedtls/esp_tee/esp_tee_mbedtls.cmake | 2 +- .../esp_ecdsa/psa_crypto_driver_esp_ecdsa.c | 4 +- .../esp_rsa_ds/psa_crypto_driver_esp_rsa_ds.c | 59 ++++++------ .../psa_crypto_driver_esp_ecdsa_contexts.h | 2 +- .../include/psa_crypto_driver_esp_rsa_ds.h | 2 +- .../psa_crypto_driver_esp_rsa_ds_contexts.h | 9 +- .../test_apps/main/test_ds_sign_and_decrypt.c | 91 ++++++++++--------- 8 files changed, 100 insertions(+), 81 deletions(-) diff --git a/components/esp-tls/esp_tls_mbedtls.c b/components/esp-tls/esp_tls_mbedtls.c index 46aab343699..8040a7b8c60 100644 --- a/components/esp-tls/esp_tls_mbedtls.c +++ b/components/esp-tls/esp_tls_mbedtls.c @@ -1420,6 +1420,10 @@ static esp_err_t esp_mbedtls_init_pk_ctx_for_ds(const void *pki) psa_key_id_t ds_key_id = 0; psa_status_t status = PSA_ERROR_GENERIC_ERROR; + + esp_rsa_ds_opaque_key_t rsa_ds_opaque_key = {0}; + rsa_ds_opaque_key.ds_data_ctx = ds_data; + psa_key_attributes_t ds_key_attributes = PSA_KEY_ATTRIBUTES_INIT; psa_algorithm_t alg = PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_ANY_HASH); #ifdef CONFIG_MBEDTLS_SSL_PROTO_TLS1_3 @@ -1427,14 +1431,14 @@ static esp_err_t esp_mbedtls_init_pk_ctx_for_ds(const void *pki) #endif /* CONFIG_MBEDTLS_SSL_PROTO_TLS1_3 */ psa_set_key_type(&ds_key_attributes, PSA_KEY_TYPE_RSA_KEY_PAIR); - psa_set_key_bits(&ds_key_attributes, ds_data->rsa_length_bits); + psa_set_key_bits(&ds_key_attributes, rsa_ds_opaque_key.ds_data_ctx->rsa_length_bits); psa_set_key_usage_flags(&ds_key_attributes, PSA_KEY_USAGE_SIGN_HASH); psa_set_key_algorithm(&ds_key_attributes, alg); psa_set_key_lifetime(&ds_key_attributes, PSA_KEY_LIFETIME_ESP_RSA_DS); status = psa_import_key(&ds_key_attributes, - (const uint8_t *)ds_data, - sizeof(esp_ds_data_ctx_t), - &ds_key_id); + (const uint8_t *)&rsa_ds_opaque_key, + sizeof(rsa_ds_opaque_key), + &ds_key_id); psa_reset_key_attributes(&ds_key_attributes); if (status != PSA_SUCCESS) { ESP_LOGE(TAG, "Failed to import DS key to PSA, status = %d", status); diff --git a/components/mbedtls/esp_tee/esp_tee_mbedtls.cmake b/components/mbedtls/esp_tee/esp_tee_mbedtls.cmake index 9bf64d29ade..710f06e7c92 100644 --- a/components/mbedtls/esp_tee/esp_tee_mbedtls.cmake +++ b/components/mbedtls/esp_tee/esp_tee_mbedtls.cmake @@ -59,11 +59,11 @@ foreach(target ${mbedtls_targets}) elseif(CONFIG_MBEDTLS_COMPILER_OPTIMIZATION_PERF) target_compile_options(${target} PRIVATE "-O2") endif() + target_link_libraries(${target} PUBLIC idf::esp_hal_security) endforeach() target_link_libraries(${COMPONENT_LIB} INTERFACE ${mbedtls_targets}) -target_link_libraries(tfpsacrypto PUBLIC idf::esp_hal_security) target_link_libraries(tfpsacrypto PRIVATE idf::esp_security) target_include_directories(tfpsacrypto PRIVATE ${crypto_port_inc_dirs}) diff --git a/components/mbedtls/port/psa_driver/esp_ecdsa/psa_crypto_driver_esp_ecdsa.c b/components/mbedtls/port/psa_driver/esp_ecdsa/psa_crypto_driver_esp_ecdsa.c index c966e0fd9c1..ed9be47abe2 100644 --- a/components/mbedtls/port/psa_driver/esp_ecdsa/psa_crypto_driver_esp_ecdsa.c +++ b/components/mbedtls/port/psa_driver/esp_ecdsa/psa_crypto_driver_esp_ecdsa.c @@ -512,7 +512,7 @@ psa_status_t esp_ecdsa_opaque_sign_hash_start( return PSA_ERROR_INVALID_ARGUMENT; } - esp_ecdsa_opaque_key_t *opaque_key = (esp_ecdsa_opaque_key_t *) key_buffer; + const esp_ecdsa_opaque_key_t *opaque_key = (const esp_ecdsa_opaque_key_t *) key_buffer; psa_status_t status = validate_ecdsa_opaque_key_attributes(attributes, opaque_key); if (status != PSA_SUCCESS) { return status; @@ -579,7 +579,7 @@ psa_status_t esp_ecdsa_opaque_sign_hash_complete( } #if CONFIG_MBEDTLS_TEE_SEC_STG_ECDSA_SIGN - esp_ecdsa_opaque_key_t *opaque_key = operation->opaque_key; + const esp_ecdsa_opaque_key_t *opaque_key = operation->opaque_key; if (opaque_key->tee_key_id) { esp_tee_sec_storage_type_t tee_sec_storage_type = esp_ecdsa_curve_to_tee_sec_storage_type(opaque_key->curve); if (tee_sec_storage_type == (esp_tee_sec_storage_type_t) -1) { diff --git a/components/mbedtls/port/psa_driver/esp_rsa_ds/psa_crypto_driver_esp_rsa_ds.c b/components/mbedtls/port/psa_driver/esp_rsa_ds/psa_crypto_driver_esp_rsa_ds.c index 6f1b24223e3..1855be1d39b 100644 --- a/components/mbedtls/port/psa_driver/esp_rsa_ds/psa_crypto_driver_esp_rsa_ds.c +++ b/components/mbedtls/port/psa_driver/esp_rsa_ds/psa_crypto_driver_esp_rsa_ds.c @@ -65,33 +65,38 @@ void esp_rsa_ds_release_ds_lock(void) } } -static int esp_rsa_ds_validate_opaque_key(const esp_ds_data_ctx_t *opaque_key) +static int esp_rsa_ds_validate_opaque_key(const esp_rsa_ds_opaque_key_t *opaque_key) { if (opaque_key == NULL) { return PSA_ERROR_INVALID_ARGUMENT; } - if (opaque_key->esp_ds_data == NULL) { + + if (opaque_key->ds_data_ctx == NULL) { return PSA_ERROR_INVALID_ARGUMENT; } - if (EFUSE_BLK_KEY0 + opaque_key->efuse_key_id >= EFUSE_BLK_KEY_MAX) { + if (opaque_key->ds_data_ctx->esp_ds_data == NULL) { return PSA_ERROR_INVALID_ARGUMENT; } - if (opaque_key->rsa_length_bits % 32 != 0) { + if ((opaque_key->ds_data_ctx->efuse_key_id + EFUSE_BLK_KEY0) >= EFUSE_BLK_KEY_MAX) { return PSA_ERROR_INVALID_ARGUMENT; } - if (opaque_key->rsa_length_bits < 1024 || opaque_key->rsa_length_bits > SOC_DS_SIGNATURE_MAX_BIT_LEN) { + if (opaque_key->ds_data_ctx->rsa_length_bits % 32 != 0) { + return PSA_ERROR_INVALID_ARGUMENT; + } + + if (opaque_key->ds_data_ctx->rsa_length_bits < 1024 || opaque_key->ds_data_ctx->rsa_length_bits > SOC_DS_SIGNATURE_MAX_BIT_LEN) { return PSA_ERROR_INVALID_ARGUMENT; } /* DS data rsa_length must match rsa_length_bits so we can use the key's data directly in sign operations */ - if (opaque_key->esp_ds_data->rsa_length != (opaque_key->rsa_length_bits / 32) - 1) { + if (opaque_key->ds_data_ctx->esp_ds_data->rsa_length != (opaque_key->ds_data_ctx->rsa_length_bits / 32) - 1) { return PSA_ERROR_INVALID_ARGUMENT; } - esp_efuse_purpose_t purpose = esp_efuse_get_key_purpose(EFUSE_BLK_KEY0 + opaque_key->efuse_key_id); + esp_efuse_purpose_t purpose = esp_efuse_get_key_purpose(EFUSE_BLK_KEY0 + opaque_key->ds_data_ctx->efuse_key_id); if (purpose != ESP_EFUSE_KEY_PURPOSE_HMAC_DOWN_DIGITAL_SIGNATURE) { return PSA_ERROR_NOT_PERMITTED; } @@ -111,7 +116,7 @@ psa_status_t esp_rsa_ds_opaque_sign_hash_start( return PSA_ERROR_INVALID_ARGUMENT; } - if (key_buffer_size < sizeof(esp_ds_data_ctx_t)) { + if (key_buffer_size < sizeof(esp_rsa_ds_opaque_key_t)) { return PSA_ERROR_INVALID_ARGUMENT; } @@ -121,7 +126,7 @@ psa_status_t esp_rsa_ds_opaque_sign_hash_start( operation->alg = alg; - const esp_ds_data_ctx_t *opaque_key = (const esp_ds_data_ctx_t *)key_buffer; + const esp_rsa_ds_opaque_key_t *opaque_key = (const esp_rsa_ds_opaque_key_t *)key_buffer; operation->esp_rsa_ds_opaque_key = opaque_key; if (esp_rsa_ds_validate_opaque_key(opaque_key) != PSA_SUCCESS) { @@ -141,7 +146,7 @@ psa_status_t esp_rsa_ds_opaque_sign_hash_start( psa_algorithm_t hash_alg = PSA_ALG_SIGN_GET_HASH(operation->alg); - const size_t words_len = (opaque_key->rsa_length_bits / 32); + const size_t words_len = (opaque_key->ds_data_ctx->rsa_length_bits / 32); const size_t rsa_len_bytes = words_len * 4; operation->sig_buffer_size = rsa_len_bytes; operation->sig_buffer = NULL; @@ -171,9 +176,9 @@ psa_status_t esp_rsa_ds_opaque_sign_hash_start( } esp_err_t err = esp_ds_start_sign((const void *)operation->sig_buffer, - opaque_key->esp_ds_data, - (hmac_key_id_t) opaque_key->efuse_key_id, - &operation->esp_rsa_ds_ctx); + opaque_key->ds_data_ctx->esp_ds_data, + opaque_key->ds_data_ctx->efuse_key_id, + &operation->esp_rsa_ds_ctx); if (err != ESP_OK) { status = PSA_ERROR_GENERIC_ERROR; goto error; @@ -207,7 +212,7 @@ psa_status_t esp_rsa_ds_opaque_sign_hash_complete( return PSA_ERROR_BAD_STATE; } - int expected_signature_size = operation->esp_rsa_ds_opaque_key->rsa_length_bits / 8; + int expected_signature_size = operation->esp_rsa_ds_opaque_key->ds_data_ctx->rsa_length_bits / 8; if (signature_size < expected_signature_size) { return PSA_ERROR_BUFFER_TOO_SMALL; } @@ -309,22 +314,22 @@ psa_status_t esp_rsa_ds_opaque_import_key( return PSA_ERROR_INVALID_ARGUMENT; } - if (key_buffer_size < sizeof(esp_ds_data_ctx_t)) { + if (key_buffer_size < sizeof(esp_rsa_ds_opaque_key_t)) { return PSA_ERROR_BUFFER_TOO_SMALL; } - const esp_ds_data_ctx_t *opaque_key = (const esp_ds_data_ctx_t *)data; + const esp_rsa_ds_opaque_key_t *opaque_key = (const esp_rsa_ds_opaque_key_t *)data; int ret = esp_rsa_ds_validate_opaque_key(opaque_key); if (ret != PSA_SUCCESS) { return ret; } /* Shallow copy: key buffer holds the context; esp_ds_data points to the caller's data. - * The key material (esp_ds_data_ctx_t and the esp_ds_data_t it points to) must remain + * The key material (esp_rsa_ds_opaque_key_t and the esp_ds_data_t it points to) must remain * valid until psa_destroy_key() is called on this key. */ - memcpy(key_buffer, opaque_key, sizeof(esp_ds_data_ctx_t)); - *key_buffer_length = sizeof(esp_ds_data_ctx_t); - *bits = opaque_key->rsa_length_bits; + memcpy(key_buffer, opaque_key, sizeof(esp_rsa_ds_opaque_key_t)); + *key_buffer_length = sizeof(esp_rsa_ds_opaque_key_t); + *bits = opaque_key->ds_data_ctx->rsa_length_bits; return PSA_SUCCESS; } @@ -335,7 +340,7 @@ size_t esp_rsa_ds_opaque_size_function( (void)key_type; (void)key_bits; - return sizeof(esp_ds_data_ctx_t); + return sizeof(esp_rsa_ds_opaque_key_t); } void esp_rsa_ds_opaque_set_session_timeout(int timeout_ms) @@ -360,7 +365,7 @@ psa_status_t esp_rsa_ds_opaque_asymmetric_decrypt( { (void)salt; (void)salt_length; - if (!attributes || !key || key_length < sizeof(esp_ds_data_ctx_t) || + if (!attributes || !key || key_length < sizeof(esp_rsa_ds_opaque_key_t) || !input || input_length < 1 || !output || !output_length) { return PSA_ERROR_INVALID_ARGUMENT; } @@ -369,13 +374,13 @@ psa_status_t esp_rsa_ds_opaque_asymmetric_decrypt( return PSA_ERROR_NOT_SUPPORTED; } - const esp_ds_data_ctx_t *opaque_key = (const esp_ds_data_ctx_t *)key; + const esp_rsa_ds_opaque_key_t *opaque_key = (const esp_rsa_ds_opaque_key_t *)key; if (esp_rsa_ds_validate_opaque_key(opaque_key) != PSA_SUCCESS) { return PSA_ERROR_INVALID_ARGUMENT; } - size_t key_bits = opaque_key->rsa_length_bits; + size_t key_bits = opaque_key->ds_data_ctx->rsa_length_bits; if (input_length != (key_bits / 8)) { return PSA_ERROR_INVALID_ARGUMENT; } @@ -409,9 +414,9 @@ psa_status_t esp_rsa_ds_opaque_asymmetric_decrypt( operation.sig_buffer = em_words; esp_err_t err = esp_ds_start_sign((const void *)em_words, - opaque_key->esp_ds_data, - (hmac_key_id_t) opaque_key->efuse_key_id, - &operation.esp_rsa_ds_ctx); + opaque_key->ds_data_ctx->esp_ds_data, + opaque_key->ds_data_ctx->efuse_key_id, + &operation.esp_rsa_ds_ctx); if (err != ESP_OK) { heap_caps_free(em_words); esp_rsa_ds_release_ds_lock(); diff --git a/components/mbedtls/port/psa_driver/include/psa_crypto_driver_esp_ecdsa_contexts.h b/components/mbedtls/port/psa_driver/include/psa_crypto_driver_esp_ecdsa_contexts.h index 2a4d28b5ddb..00c141aa994 100644 --- a/components/mbedtls/port/psa_driver/include/psa_crypto_driver_esp_ecdsa_contexts.h +++ b/components/mbedtls/port/psa_driver/include/psa_crypto_driver_esp_ecdsa_contexts.h @@ -66,7 +66,7 @@ typedef struct { /* The buffers are stored in the little-endian format */ typedef struct { psa_algorithm_t alg; - esp_ecdsa_opaque_key_t *opaque_key; + const esp_ecdsa_opaque_key_t *opaque_key; uint8_t r[MAX_ECDSA_COMPONENT_LEN]; uint8_t s[MAX_ECDSA_COMPONENT_LEN]; uint8_t sha[MAX_ECDSA_SHA_LEN]; diff --git a/components/mbedtls/port/psa_driver/include/psa_crypto_driver_esp_rsa_ds.h b/components/mbedtls/port/psa_driver/include/psa_crypto_driver_esp_rsa_ds.h index 862282dc42c..b237d267c8f 100644 --- a/components/mbedtls/port/psa_driver/include/psa_crypto_driver_esp_rsa_ds.h +++ b/components/mbedtls/port/psa_driver/include/psa_crypto_driver_esp_rsa_ds.h @@ -110,7 +110,7 @@ psa_status_t esp_rsa_ds_opaque_signature_sign_hash( /** * @brief Import the RSA DS opaque key - * The data should be of type esp_ds_data_ctx_t and should be + * The data should be of type esp_rsa_ds_opaque_key_t and should be * already initialised with DS data and efuse key id. * * @param attributes Key attributes diff --git a/components/mbedtls/port/psa_driver/include/psa_crypto_driver_esp_rsa_ds_contexts.h b/components/mbedtls/port/psa_driver/include/psa_crypto_driver_esp_rsa_ds_contexts.h index 70cec0e0555..72184f71b35 100644 --- a/components/mbedtls/port/psa_driver/include/psa_crypto_driver_esp_rsa_ds_contexts.h +++ b/components/mbedtls/port/psa_driver/include/psa_crypto_driver_esp_rsa_ds_contexts.h @@ -10,6 +10,7 @@ #if defined(ESP_RSA_DS_DRIVER_ENABLED) #include "psa/crypto_driver_common.h" #include "esp_ds.h" +#include "hal/hmac_types.h" #ifdef __cplusplus extern "C" { @@ -35,14 +36,18 @@ typedef enum { */ typedef struct { esp_ds_data_t *esp_ds_data; /**< Pointer to the esp ds data */ - uint8_t efuse_key_id; /**< efuse block id in which DS_KEY is stored e.g. 0,1*/ + hmac_key_id_t efuse_key_id; /**< efuse block id in which the HMAC key for the DS peripheral is stored e.g. 0,1*/ uint16_t rsa_length_bits; /**< length of RSA private key in bits e.g. 2048 */ } esp_ds_data_ctx_t; +typedef struct { + esp_ds_data_ctx_t *ds_data_ctx; +} esp_rsa_ds_opaque_key_t; + #if !(__DOXYGEN__) // No need to document these structures, these are internal to the driver /* The buffers are stored in the little-endian format */ typedef struct { - const esp_ds_data_ctx_t *esp_rsa_ds_opaque_key; /**< Pointer to the esp ds opaque key */ + const esp_rsa_ds_opaque_key_t *esp_rsa_ds_opaque_key; /**< Pointer to the esp ds opaque key */ psa_algorithm_t alg; /**< Algorithm used in the sign operation */ uint32_t *sig_buffer; /**< Buffer to hold the signature */ size_t sig_buffer_size; /**< Size of the signature buffer */ diff --git a/components/mbedtls/test_apps/main/test_ds_sign_and_decrypt.c b/components/mbedtls/test_apps/main/test_ds_sign_and_decrypt.c index d9eff1bb603..d583773e2da 100644 --- a/components/mbedtls/test_apps/main/test_ds_sign_and_decrypt.c +++ b/components/mbedtls/test_apps/main/test_ds_sign_and_decrypt.c @@ -57,43 +57,44 @@ TEST_CASE("ds sign test pkcs1_v15 PSA validation", "[ds_rsa_psa]") psa_status_t status; psa_algorithm_t alg = PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_SHA_256); - esp_ds_data_ctx_t *ds_key = esp_secure_cert_get_ds_ctx(); - TEST_ASSERT_NOT_NULL(ds_key); + esp_rsa_ds_opaque_key_t rsa_ds_opaque_key = {0}; + rsa_ds_opaque_key.ds_data_ctx = esp_secure_cert_get_ds_ctx(); + TEST_ASSERT_NOT_NULL(rsa_ds_opaque_key.ds_data_ctx); - ds_key->efuse_key_id = EFUSE_BLK_MAX; // Invalid efuse key id to trigger validation failure + rsa_ds_opaque_key.ds_data_ctx->efuse_key_id = EFUSE_BLK_KEY_MAX; // Invalid efuse block to trigger validation failure psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; psa_set_key_type(&attributes, PSA_KEY_TYPE_RSA_KEY_PAIR); - psa_set_key_bits(&attributes, ds_key->rsa_length_bits); + psa_set_key_bits(&attributes, rsa_ds_opaque_key.ds_data_ctx->rsa_length_bits); psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_HASH); psa_set_key_algorithm(&attributes, alg); psa_set_key_lifetime(&attributes, PSA_KEY_LIFETIME_ESP_RSA_DS); status = psa_import_key(&attributes, - (const uint8_t *)ds_key, - sizeof(*ds_key), + (const uint8_t *)&rsa_ds_opaque_key, + sizeof(rsa_ds_opaque_key), &keyt_id); TEST_ASSERT_EQUAL(PSA_ERROR_INVALID_ARGUMENT, status); - ds_key->efuse_key_id = EFUSE_BLK0 + 0; // Reset to valid efuse key id - ds_key->rsa_length_bits = 1000; // Invalid RSA length to trigger validation failure + rsa_ds_opaque_key.ds_data_ctx->efuse_key_id = EFUSE_BLK_KEY0; // Reset to valid efuse block + rsa_ds_opaque_key.ds_data_ctx->rsa_length_bits = 1000; // Invalid RSA length to trigger validation failure status = psa_import_key(&attributes, - (const uint8_t *)ds_key, - sizeof(*ds_key), + (const uint8_t *)&rsa_ds_opaque_key, + sizeof(rsa_ds_opaque_key), &keyt_id); TEST_ASSERT_EQUAL(PSA_ERROR_INVALID_ARGUMENT, status); - ds_key->rsa_length_bits = 2048; // Reset to valid RSA length - esp_ds_data_t *ds_data_backup = ds_key->esp_ds_data; - ds_key->esp_ds_data = NULL; // NULL esp_ds_data to trigger validation failure + rsa_ds_opaque_key.ds_data_ctx->rsa_length_bits = 2048; // Reset to valid RSA length + esp_ds_data_t *ds_data_backup = rsa_ds_opaque_key.ds_data_ctx->esp_ds_data; + rsa_ds_opaque_key.ds_data_ctx->esp_ds_data = NULL; // NULL esp_ds_data to trigger validation failure status = psa_import_key(&attributes, - (const uint8_t *)ds_key, - sizeof(*ds_key), + (const uint8_t *)&rsa_ds_opaque_key, + sizeof(rsa_ds_opaque_key), &keyt_id); TEST_ASSERT_EQUAL(PSA_ERROR_INVALID_ARGUMENT, status); - ds_key->esp_ds_data = ds_data_backup; // Restore esp_ds_data + rsa_ds_opaque_key.ds_data_ctx->esp_ds_data = ds_data_backup; // Restore esp_ds_data - esp_secure_cert_free_ds_ctx(ds_key); + esp_secure_cert_free_ds_ctx(rsa_ds_opaque_key.ds_data_ctx); } TEST_CASE("ds sign test pkcs1_v15 PSA", "[ds_rsa_psa]") @@ -102,18 +103,19 @@ TEST_CASE("ds sign test pkcs1_v15 PSA", "[ds_rsa_psa]") psa_status_t status; psa_algorithm_t alg = PSA_ALG_RSA_PKCS1V15_SIGN(PSA_ALG_SHA_256); - esp_ds_data_ctx_t *ds_key = esp_secure_cert_get_ds_ctx(); - TEST_ASSERT_NOT_NULL(ds_key); + esp_rsa_ds_opaque_key_t rsa_ds_opaque_key = {0}; + rsa_ds_opaque_key.ds_data_ctx = esp_secure_cert_get_ds_ctx(); + TEST_ASSERT_NOT_NULL(rsa_ds_opaque_key.ds_data_ctx); psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; psa_set_key_type(&attributes, PSA_KEY_TYPE_RSA_KEY_PAIR); - psa_set_key_bits(&attributes, ds_key->rsa_length_bits); + psa_set_key_bits(&attributes, rsa_ds_opaque_key.ds_data_ctx->rsa_length_bits); psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_HASH); psa_set_key_algorithm(&attributes, alg); psa_set_key_lifetime(&attributes, PSA_KEY_LIFETIME_ESP_RSA_DS); status = psa_import_key(&attributes, - (const uint8_t *)ds_key, - sizeof(*ds_key), + (const uint8_t *)&rsa_ds_opaque_key, + sizeof(rsa_ds_opaque_key), &keyt_id); TEST_ASSERT_EQUAL(PSA_SUCCESS, status); @@ -136,7 +138,7 @@ TEST_CASE("ds sign test pkcs1_v15 PSA", "[ds_rsa_psa]") psa_reset_key_attributes(&attributes); // Free the DS context to prevent memory leak - esp_secure_cert_free_ds_ctx(ds_key); + esp_secure_cert_free_ds_ctx(rsa_ds_opaque_key.ds_data_ctx); // Because we have wrapped around the ds_start_sign and ds_finish_sign functions, // we are not actually performing the real signing operation. That test is done in the @@ -169,18 +171,19 @@ TEST_CASE("ds sign test pkcs1_v21 PSA", "[ds_rsa_psa]") psa_key_id_t keyt_id; psa_status_t status; psa_algorithm_t alg = PSA_ALG_RSA_PSS(PSA_ALG_SHA_256); - esp_ds_data_ctx_t *ds_key = esp_secure_cert_get_ds_ctx(); - TEST_ASSERT_NOT_NULL(ds_key); + esp_rsa_ds_opaque_key_t rsa_ds_opaque_key = {0}; + rsa_ds_opaque_key.ds_data_ctx = esp_secure_cert_get_ds_ctx(); + TEST_ASSERT_NOT_NULL(rsa_ds_opaque_key.ds_data_ctx); psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; psa_set_key_type(&attributes, PSA_KEY_TYPE_RSA_KEY_PAIR); - psa_set_key_bits(&attributes, ds_key->rsa_length_bits); + psa_set_key_bits(&attributes, rsa_ds_opaque_key.ds_data_ctx->rsa_length_bits); psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_SIGN_HASH); psa_set_key_algorithm(&attributes, alg); psa_set_key_lifetime(&attributes, PSA_KEY_LIFETIME_ESP_RSA_DS); status = psa_import_key(&attributes, - (const uint8_t *)ds_key, - sizeof(*ds_key), + (const uint8_t *)&rsa_ds_opaque_key, + sizeof(rsa_ds_opaque_key), &keyt_id); TEST_ASSERT_EQUAL(PSA_SUCCESS, status); @@ -203,7 +206,7 @@ TEST_CASE("ds sign test pkcs1_v21 PSA", "[ds_rsa_psa]") psa_reset_key_attributes(&attributes); // Free the DS context to prevent memory leak - esp_secure_cert_free_ds_ctx(ds_key); + esp_secure_cert_free_ds_ctx(rsa_ds_opaque_key.ds_data_ctx); } /* Generated external data for OAEP padding */ @@ -232,20 +235,21 @@ TEST_CASE("ds decrypt test pkcs1_v21 PSA", "[ds_rsa]") psa_status_t status; psa_algorithm_t alg = PSA_ALG_RSA_OAEP(PSA_ALG_SHA_256); - esp_ds_data_ctx_t *ds_key = esp_secure_cert_get_ds_ctx(); - TEST_ASSERT_NOT_NULL(ds_key); + esp_rsa_ds_opaque_key_t rsa_ds_opaque_key = {0}; + rsa_ds_opaque_key.ds_data_ctx = esp_secure_cert_get_ds_ctx(); + TEST_ASSERT_NOT_NULL(rsa_ds_opaque_key.ds_data_ctx); - printf("DS Key RSA Length Bits: %d\n", ds_key->rsa_length_bits); + printf("DS Key RSA Length Bits: %d\n", rsa_ds_opaque_key.ds_data_ctx->rsa_length_bits); psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; psa_set_key_type(&attributes, PSA_KEY_TYPE_RSA_KEY_PAIR); - psa_set_key_bits(&attributes, ds_key->rsa_length_bits); + psa_set_key_bits(&attributes, rsa_ds_opaque_key.ds_data_ctx->rsa_length_bits); psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_DECRYPT); psa_set_key_algorithm(&attributes, alg); psa_set_key_lifetime(&attributes, PSA_KEY_LIFETIME_ESP_RSA_DS); status = psa_import_key(&attributes, - (const uint8_t *)ds_key, - sizeof(*ds_key), + (const uint8_t *)&rsa_ds_opaque_key, + sizeof(rsa_ds_opaque_key), &keyt_id); TEST_ASSERT_EQUAL(PSA_SUCCESS, status); @@ -265,7 +269,7 @@ TEST_CASE("ds decrypt test pkcs1_v21 PSA", "[ds_rsa]") psa_reset_key_attributes(&attributes); // Free the DS context to prevent memory leak - esp_secure_cert_free_ds_ctx(ds_key); + esp_secure_cert_free_ds_ctx(rsa_ds_opaque_key.ds_data_ctx); } #endif /* CONFIG_MBEDTLS_SSL_PROTO_TLS1_3 */ @@ -294,20 +298,21 @@ TEST_CASE("ds decrypt test pkcs1_v15 PSA", "[ds_rsa]") psa_status_t status; psa_algorithm_t alg = PSA_ALG_RSA_PKCS1V15_CRYPT; - esp_ds_data_ctx_t *ds_key = esp_secure_cert_get_ds_ctx(); - TEST_ASSERT_NOT_NULL(ds_key); + esp_rsa_ds_opaque_key_t rsa_ds_opaque_key = {0}; + rsa_ds_opaque_key.ds_data_ctx = esp_secure_cert_get_ds_ctx(); + TEST_ASSERT_NOT_NULL(rsa_ds_opaque_key.ds_data_ctx); - printf("DS Key RSA Length Bits: %d\n", ds_key->rsa_length_bits); + printf("DS Key RSA Length Bits: %d\n", rsa_ds_opaque_key.ds_data_ctx->rsa_length_bits); psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT; psa_set_key_type(&attributes, PSA_KEY_TYPE_RSA_KEY_PAIR); - psa_set_key_bits(&attributes, ds_key->rsa_length_bits); + psa_set_key_bits(&attributes, rsa_ds_opaque_key.ds_data_ctx->rsa_length_bits); psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_DECRYPT); psa_set_key_algorithm(&attributes, alg); psa_set_key_lifetime(&attributes, PSA_KEY_LIFETIME_ESP_RSA_DS); status = psa_import_key(&attributes, - (const uint8_t *)ds_key, - sizeof(*ds_key), + (const uint8_t *)&rsa_ds_opaque_key, + sizeof(rsa_ds_opaque_key), &keyt_id); TEST_ASSERT_EQUAL(PSA_SUCCESS, status); @@ -327,7 +332,7 @@ TEST_CASE("ds decrypt test pkcs1_v15 PSA", "[ds_rsa]") psa_reset_key_attributes(&attributes); // Free the DS context to prevent memory leak - esp_secure_cert_free_ds_ctx(ds_key); + esp_secure_cert_free_ds_ctx(rsa_ds_opaque_key.ds_data_ctx); } int __wrap_esp_ds_start_sign(const void *message, const esp_ds_data_t *data, hmac_key_id_t key_id, esp_ds_context_t **esp_ds_ctx)