Update interruptible signature functions to the PSA standard #861

New issue

Open

opened 2026-07-30 11:57:12 -05:00 by gilles-peskine-arm · 0 comments

gilles-peskine-arm commented

2026-07-30 11:57:12 -05:00

(Migrated from github.com)

The structure of the functions has changed: the step that is psa_sign_hash_start() in our implementation is now split in three: psa_sign_iop_setup(), psa_sign_iop_setup_complete(), psa_sign_iop_hash(). The function psa_sign_hash_complete() has been renamed to psa_sign_iop_complete(). Split psa_sign_hash_start() into three pieces, and provide the old function as a wrapper with a deprecation annotation. Rename psa_sign_hash_complete() and provide the old name as a deprecated static inline wrapper.

Do the same for verification.

Also rename psa_sign_interruptible_get_num_ops() and psa_verify_interruptible_get_num_ops() to psa_sign_iop_get_num_ops() and psa_verify_iop_get_num_ops(). Provide the old names as deprecated static inline wrappers for backward compatibility.

This issue applies to development only. No change in LTS branches.

TODO: This issue should probably be two size-s tasks. Define an intermediate step for splitting sign/verify-hash-start.

Related: https://github.com/Mbed-TLS/TF-PSA-Crypto/issues/860 — rename num-ops functions.

We implemented a draft of the PSA specification for interruptible operations. Since this draft, there have been some changes to the specification. This issue covers the restructuring of interruptible sign/verify functions. The structure of the functions has changed: the step that is `psa_sign_hash_start()` in our implementation is now split in three: `psa_sign_iop_setup()`, `psa_sign_iop_setup_complete()`, `psa_sign_iop_hash()`. The function `psa_sign_hash_complete()` has been renamed to `psa_sign_iop_complete()`. Split `psa_sign_hash_start()` into three pieces, and provide the old function as a wrapper with a deprecation annotation. Rename `psa_sign_hash_complete()` and provide the old name as a deprecated `static inline` wrapper. Do the same for verification. Also rename `psa_sign_interruptible_get_num_ops()` and `psa_verify_interruptible_get_num_ops()` to `psa_sign_iop_get_num_ops()` and `psa_verify_iop_get_num_ops()`. Provide the old names as deprecated `static inline` wrappers for backward compatibility. This issue applies to development only. No change in LTS branches. TODO: This issue should probably be two size-s tasks. Define an intermediate step for splitting sign/verify-hash-start. Related: https://github.com/Mbed-TLS/TF-PSA-Crypto/issues/860 — rename num-ops functions.

No milestone

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

gh-Mbed-TLS/TF-PSA-Crypto#861

No description provided.

Rows
Columns