Add policy usage flag to copy a key #108

2019-05-14T07:33:52-05:00

gilles-peskine-arm commented

2019-05-14 07:33:52 -05:00

(Migrated from github.com)

Require PSA_KEY_USAGE_COPY in psa_copy_key.

Require `PSA_KEY_USAGE_COPY` in `psa_copy_key`.

athoelke (Migrated from github.com) reviewed

2019-05-14 08:23:07 -05:00

include/psa/crypto.h

					
				@ -844,6 +850,16 @@ psa_status_t psa_export_public_key(psa_key_handle_t handle,

				 * this function may be used to share a key with a different party,

The wording isn't completely clear, for example:

who is doing the "locking inside"? - presume this is the SE designer, but better to avoid unnamed actors in the documentation.
Is the use case here one where a key is being copied out of the SE into a volatile key (for example), and the SE design defaults to denying this operation unless the key is extractable? - presumably a copy within the SE would only require COPY policy in this set up?

The wording isn't completely clear, for example: * who is doing the "locking inside"? - presume this is the SE designer, but better to avoid unnamed actors in the documentation. * Is the use case here one where a key is being copied out of the SE into a volatile key (for example), and the SE design defaults to denying this operation unless the key is extractable? - presumably a copy within the SE would only require COPY policy in this set up?

include/psa/crypto_values.h

					
				@ -1459,6 +1459,22 @@

				 */

psa_copy_key()

Clarify use case? - as above

gilles-peskine-arm (Migrated from github.com) reviewed

2019-05-14 09:26:50 -05:00

include/psa/crypto.h

					
				@ -844,6 +850,16 @@ psa_status_t psa_export_public_key(psa_key_handle_t handle,

				 * this function may be used to share a key with a different party,

I updated the documentation.

yanesca (Migrated from github.com) approved these changes

2019-05-16 05:16:17 -05:00

yanesca (Migrated from github.com) left a comment

@athoelke 's comments have been addressed, looks good to me.

Patater commented

2019-05-16 06:08:06 -05:00

(Migrated from github.com)

CI failure is ABI job (known to fail until https://github.com/ARMmbed/mbedtls/pull/2636 lands in the development branch) and USE_PSA_CRYPTO, which doesn't work on the API branch.

CI failure is ABI job (known to fail until https://github.com/ARMmbed/mbedtls/pull/2636 lands in the development branch) and `USE_PSA_CRYPTO`, which doesn't work on the API branch.

Sign in to join this conversation.

No reviewers

yanesca