gh-Mbed-TLS/TF-PSA-Crypto

Watch

Fork 0

Remove encrypt/decrypt from PK #297

Merged

mpg merged 6 commits from rm-pk-crypt into development

2025-05-22 05:23:48 -05:00

mpg commented

2025-05-20 03:02:58 -05:00

(Migrated from github.com)

Description

Remove encryption/decryption features from PK, in order to avoid having to spend time on it in #298.

Depends on: https://github.com/Mbed-TLS/mbedtls/pull/10186 for a clean CI. (merged)

PR checklist

changelog provided
framework PR not required
mbedtls development PR provided Mbed-TLS/mbedtls#10186
mbedtls 3.6 PR not required because: 4.0-only removal
tests not required because: feature removal

## Description Remove encryption/decryption features from PK, in order to avoid having to spend time on it in #298. ~**Depends on:** https://github.com/Mbed-TLS/mbedtls/pull/10186 for a clean CI.~ (merged) ## PR checklist - [x] **changelog** provided - [x] **framework PR** not required - [x] **mbedtls development PR** provided Mbed-TLS/mbedtls#10186 - [x] **mbedtls 3.6 PR** not required because: 4.0-only removal - **tests** not required because: feature removal

felixc-arm (Migrated from github.com) approved these changes

2025-05-20 08:06:23 -05:00

felixc-arm (Migrated from github.com) left a comment

LGTM 👍

LGTM :+1:

valeriosetti (Migrated from github.com) approved these changes

2025-05-21 07:47:27 -05:00

valeriosetti (Migrated from github.com) left a comment

LGTM so approving. I know it depends on https://github.com/Mbed-TLS/mbedtls/pull/10186 so I count on need-preceding-pr (and failing CI) to block this one from being merged.
I will re-check and re-approve once the dependency will be merged ;)

LGTM so approving. I know it depends on https://github.com/Mbed-TLS/mbedtls/pull/10186 so I count on `need-preceding-pr` (and failing CI) to block this one from being merged. I will re-check and re-approve once the dependency will be merged ;)

mpg commented

2025-05-22 02:03:21 -05:00

(Migrated from github.com)

Made a zero-diff force-push (just added an blank line to the last commit's message). With the new github rules, it doesn't invalidate reviews. So this should be good to go as soon as the CI is happy.

👍 2

valeriosetti commented

2025-05-27 11:01:50 -05:00

(Migrated from github.com)

While working on https://github.com/Mbed-TLS/TF-PSA-Crypto/issues/298 I found that in pk.c there are still functions like psa_algorithm_for_rsa() which can potentially return an encryption/decryption algorithm to be associated to a PK wrapped RSA key before importing it into PSA. Since this PR is about removing support for encryption/decryption using PK, should we keep that function as-is, or should it be updated accordingly?

While working on https://github.com/Mbed-TLS/TF-PSA-Crypto/issues/298 I found that in `pk.c` there are still functions like `psa_algorithm_for_rsa()` which can potentially return an encryption/decryption algorithm to be associated to a PK wrapped RSA key before importing it into PSA. Since this PR is about removing support for encryption/decryption using PK, should we keep that function as-is, or should it be updated accordingly?

gilles-peskine-arm commented

2025-05-27 11:13:38 -05:00

(Migrated from github.com)

psa_algorithm_for_rsa is used by mbedtls_pk_get_psa_attributes and there's no plan to change that. We're removing encryption from PK, and mbedtls_pk_get_psa_attributes together with mbedtls_pk_import_into_psa is how you do encryption in PSA with a key that you constructed via PK. So it's even more useful now.

`psa_algorithm_for_rsa` is used by `mbedtls_pk_get_psa_attributes` and there's no plan to change that. We're removing encryption from PK, and `mbedtls_pk_get_psa_attributes` together with `mbedtls_pk_import_into_psa` is how you do encryption in PSA with a key that you constructed via PK. So it's even more useful now.

valeriosetti commented

2025-05-28 01:52:35 -05:00

(Migrated from github.com)

Oh right, I think I missed a detail yesterday while working on my previous comment. My reasoning was like: "if I cannot do encryption/decryption with PK, then I should not try to setup a PK context for that kind of operation in the first place, right?". What I missed is that one of the main benefits in having PK nowadays is that it provides ways to parse keys that are not available yet in PSA. Therefore on the practical side I can parse a key with PK, import it into PSA and then do encryption/decryption with PSA API.
Sorry for the noise @gilles-peskine-arm

Oh right, I think I missed a detail yesterday while working on my [previous comment](https://github.com/Mbed-TLS/TF-PSA-Crypto/pull/297#issuecomment-2913137150). My reasoning was like: "if I cannot do encryption/decryption with PK, then I should not try to setup a PK context for that kind of operation in the first place, right?". What I missed is that one of the main benefits in having PK nowadays is that it provides ways to parse keys that are not available yet in PSA. Therefore on the practical side I can parse a key with PK, import it into PSA and then do encryption/decryption with PSA API. Sorry for the noise @gilles-peskine-arm

No reviewers

felixc-arm

valeriosetti

No milestone

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

gh-Mbed-TLS/TF-PSA-Crypto!297

No description provided.

Rows
Columns