Combine psa_pake_set_password_key() with psa_pake_setup() #215

2025-03-19T10:23:49-05:00

amtkarm1 commented

2025-03-19 10:23:49 -05:00

(Migrated from github.com)

Description

Fixed Mbed-TLS/mbedtls#9320

Gatekeeper note: interdependent with Mbed-TLS/mbedtls#10077 - handle with care!

PR checklist

changelog provided
framework PR not required
mbedtls development PR provided Mbed-TLS/mbedtls#10077
mbedtls 3.6 PR not required because: no backport required
mbedtls 2.28 PR not required because: no backport required
tests provided: changed the previous tests

## Description Fixed Mbed-TLS/mbedtls#9320 Gatekeeper note: interdependent with Mbed-TLS/mbedtls#10077 - handle with care! ## PR checklist - [X] **changelog** provided - [X] **framework PR** not required - [X] **mbedtls development PR** provided Mbed-TLS/mbedtls#10077 - [X] **mbedtls 3.6 PR** not required because: no backport required - [X] **mbedtls 2.28 PR** not required because: no backport required - **tests** provided: changed the previous tests

gabor-mezei-arm (Migrated from github.com) requested changes

2025-04-07 08:06:55 -05:00

ChangeLog.d/9320.txt

					
				@ -0,0 +1,7 @@

				Removals

   * Removed the `psa_pake_set_password_key()` function to comply
     with the PSA API 1.2 PAKE extension.

```suggestion * Removed the `psa_pake_set_password_key()` function to comply with the PSA API 1.2 PAKE extension. ```

   * Now the functionality of `psa_pake_set_password_key()` is implemented in
     `psa_pake_setup()` function, as per the PSA API 1.2 PAKE extension.

```suggestion * Now the functionality of `psa_pake_set_password_key()` is implemented in `psa_pake_setup()` function, as per the PSA API 1.2 PAKE extension. ```

include/psa/crypto_extra.h

 *         \p password_key is not a valid key identifier.

```suggestion * \p password_key is not a valid key identifier. ```

 *                              #psa_pake_operation_t and not yet in use.

```suggestion * #psa_pake_operation_t and not yet in use. ```

 *                              The key must permit the usage #PSA_KEY_USAGE_DERIVE.

```suggestion * The key must permit the usage #PSA_KEY_USAGE_DERIVE. ```

 *         - The library requires initializing by a call to #psa_crypto_init().

```suggestion * - The library requires initializing by a call to #psa_crypto_init(). ```

 *         \p password_key does not have the #PSA_KEY_USAGE_DERIVE flag, or it does
 *         not permit the algorithm in \p cipher_suite.

```suggestion * \p password_key does not have the #PSA_KEY_USAGE_DERIVE flag, or it does * not permit the algorithm in \p cipher_suite. ```

 *         - The algorithm in \p cipher_suite is not a PAKE algorithm, or encodes an

```suggestion * - The algorithm in \p cipher_suite is not a PAKE algorithm, or encodes an ```

 *         - The PAKE primitive in \p cipher_suite is not compatible with the PAKE

```suggestion * - The PAKE primitive in \p cipher_suite is not compatible with the PAKE ```

 *         - The key confirmation value in \p cipher_suite is not compatible with the

```suggestion * - The key confirmation value in \p cipher_suite is not compatible with the ```

 *         - The key type or key size of \p password_key is not compatible with
 *           \p cipher_suite.

```suggestion * - The key type or key size of \p password_key is not compatible with * \p cipher_suite. ```

 *         - The algorithm in \p cipher_suite is not a supported PAKE algorithm, or

```suggestion * - The algorithm in \p cipher_suite is not a supported PAKE algorithm, or ```

 *         - The PAKE primitive in \p cipher_suite is not supported or not compatible

```suggestion * - The PAKE primitive in \p cipher_suite is not supported or not compatible ```

 *         - The key confirmation value in \p cipher_suite is not supported, or not

```suggestion * - The key confirmation value in \p cipher_suite is not supported, or not ```

 *         - The key type or key size of \p password_key is not supported with
 *           \p cipher_suite.

```suggestion * - The key type or key size of \p password_key is not supported with * \p cipher_suite. ```

 *                              of \p password_key.

```suggestion * of \p password_key. ```

amtkarm1 (Migrated from github.com) reviewed

2025-04-07 09:37:47 -05:00

include/psa/crypto_extra.h

Updated in a new commit

amtkarm1 (Migrated from github.com) reviewed

2025-04-07 09:37:50 -05:00

include/psa/crypto_extra.h

Updated in a new commit

amtkarm1 (Migrated from github.com) reviewed

2025-04-07 09:37:54 -05:00

include/psa/crypto_extra.h

Updated in a new commit

amtkarm1 (Migrated from github.com) reviewed

2025-04-07 09:37:56 -05:00

include/psa/crypto_extra.h

Updated in a new commit

amtkarm1 (Migrated from github.com) reviewed

2025-04-07 09:37:58 -05:00

include/psa/crypto_extra.h

Updated in a new commit

amtkarm1 (Migrated from github.com) reviewed

2025-04-07 09:38:00 -05:00

include/psa/crypto_extra.h

Updated in a new commit

amtkarm1 (Migrated from github.com) reviewed

2025-04-07 09:38:02 -05:00

include/psa/crypto_extra.h

Updated in a new commit

amtkarm1 (Migrated from github.com) reviewed

2025-04-07 09:38:05 -05:00

include/psa/crypto_extra.h

Updated in a new commit

amtkarm1 (Migrated from github.com) reviewed

2025-04-07 09:38:07 -05:00

include/psa/crypto_extra.h

Updated in a new commit

amtkarm1 (Migrated from github.com) reviewed

2025-04-07 09:38:10 -05:00

include/psa/crypto_extra.h

Updated in a new commit

amtkarm1 (Migrated from github.com) reviewed

2025-04-07 09:38:17 -05:00

include/psa/crypto_extra.h

Updated in a new commit

amtkarm1 (Migrated from github.com) reviewed

2025-04-07 09:38:20 -05:00

include/psa/crypto_extra.h

Updated in a new commit

amtkarm1 (Migrated from github.com) reviewed

2025-04-07 09:38:23 -05:00

include/psa/crypto_extra.h

Updated in a new commit

amtkarm1 (Migrated from github.com) reviewed

2025-04-07 09:38:25 -05:00

include/psa/crypto_extra.h

Updated in a new commit

amtkarm1 (Migrated from github.com) reviewed

2025-04-07 09:38:28 -05:00

ChangeLog.d/9320.txt

					
				@ -0,0 +1,7 @@

				Removals

Updated in a new commit

amtkarm1 (Migrated from github.com) reviewed

2025-04-07 09:38:30 -05:00

ChangeLog.d/9320.txt

					
				@ -0,0 +1,7 @@

				Removals

Updated in a new commit

gabor-mezei-arm (Migrated from github.com) reviewed

2025-04-08 05:43:56 -05:00

gabor-mezei-arm (Migrated from github.com) left a comment

No description provided.

LGTM

bjwtaylor (Migrated from github.com) reviewed

2025-04-15 02:10:22 -05:00

tests/src/psa_test_wrappers.c

Should be initialised?

amtkarm1 (Migrated from github.com) reviewed

2025-04-17 11:44:28 -05:00

tests/src/psa_test_wrappers.c

Could you elaborate, please?

bjwtaylor (Migrated from github.com) reviewed

2025-04-24 08:40:22 -05:00

tests/src/psa_test_wrappers.c

Actually ignore it, I missed the function def in the git view.

bjwtaylor (Migrated from github.com) reviewed

2025-04-24 08:40:54 -05:00

gilles-peskine-arm commented

2025-04-24 12:52:26 -05:00

(Migrated from github.com)

The CI is unhappy.

mpg commented

2025-05-07 05:22:19 -05:00

(Migrated from github.com)

The CI is unhappy.

Isn't that mostly because this PR and the associated Mbed TLS PR are inter-dependent, though? The associated Mbed TLS PR seems to have a green CI.

Counter-point: one of the failures here is code style, which seems real.

> The CI is unhappy. Isn't that mostly because this PR and the associated Mbed TLS PR are inter-dependent, though? The associated Mbed TLS PR seems to have a green CI. Counter-point: one of the failures here is code style, which seems real.

gabor-mezei-arm commented

2025-05-20 05:35:34 -05:00

(Migrated from github.com)

There are code style issues which need to be fixed.

--- core/psa_crypto.c	2025-05-12 13:31:18.865257612 +0000
+++ core/psa_crypto.c.uncrustify	2025-05-12 13:32:06.609583357 +0000
@@ -8760,7 +8760,7 @@
         type != PSA_KEY_TYPE_PASSWORD_HASH) {
         status = PSA_ERROR_INVALID_ARGUMENT;
         goto exit;
-        }
+    }
     operation->data.inputs.password = mbedtls_calloc(1, slot->key.bytes);
     if (operation->data.inputs.password == NULL) {
@@ -8772,10 +8772,10 @@
     operation->data.inputs.password_len = slot->key.bytes;
     operation->data.inputs.attributes = slot->attr;
 
-    exit:
-        if (status != PSA_SUCCESS) {
-            psa_pake_abort(operation);
-        }
+exit:
+    if (status != PSA_SUCCESS) {
+        psa_pake_abort(operation);
+    }
     unlock_status = psa_unregister_read_under_mutex(slot);
     return (status == PSA_SUCCESS) ? unlock_status : status;
 }

There are code style issues which need to be fixed. ``` diff --- core/psa_crypto.c 2025-05-12 13:31:18.865257612 +0000 +++ core/psa_crypto.c.uncrustify 2025-05-12 13:32:06.609583357 +0000 @@ -8760,7 +8760,7 @@ type != PSA_KEY_TYPE_PASSWORD_HASH) { status = PSA_ERROR_INVALID_ARGUMENT; goto exit; - } + } operation->data.inputs.password = mbedtls_calloc(1, slot->key.bytes); if (operation->data.inputs.password == NULL) { @@ -8772,10 +8772,10 @@ operation->data.inputs.password_len = slot->key.bytes; operation->data.inputs.attributes = slot->attr; - exit: - if (status != PSA_SUCCESS) { - psa_pake_abort(operation); - } +exit: + if (status != PSA_SUCCESS) { + psa_pake_abort(operation); + } unlock_status = psa_unregister_read_under_mutex(slot); return (status == PSA_SUCCESS) ? unlock_status : status; } ```

mpg commented

2025-05-28 04:37:40 -05:00

(Migrated from github.com)

Note: framework/scripts/code_style.py --fix <affected_files> can be used to fix the code style automatically.

Note: `framework/scripts/code_style.py --fix <affected_files>` can be used to fix the code style automatically.

bjwtaylor (Migrated from github.com) approved these changes

2025-06-12 04:40:35 -05:00

bjwtaylor (Migrated from github.com) left a comment

Approved, subject to CI issues being fixed.

mpg (Migrated from github.com) approved these changes

2025-07-30 03:03:47 -05:00

mpg (Migrated from github.com) left a comment

Looks good to me, thanks!

Can you rebase on latest development? That should give us a green CI.

Looks good to me, thanks! Can you rebase on latest development? That should give us a green CI.

mpg commented

2025-07-31 03:53:12 -05:00

(Migrated from github.com)

Note: the reason the CI is not green is that it needs the changes in the companion TLS PR https://github.com/Mbed-TLS/mbedtls/pull/10077 - that one has a green CI with its crypto pointer pointing to the tip of this branch, so it counts as a green CI for this PR as well.

Sign in to join this conversation.

No reviewers

gabor-mezei-arm

bjwtaylor

mpg

No milestone

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

gh-Mbed-TLS/TF-PSA-Crypto!215

				`@ -0,0 +1,7 @@`
				`Removals`

				`@ -0,0 +1,7 @@`
				`Removals`

				`@ -0,0 +1,7 @@`
				`Removals`

Rows
Columns