Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make mbedtls_psa_register_se_key usable with volatile keys #9254

Open
gilles-peskine-arm opened this issue Jun 13, 2024 · 0 comments
Open

Make mbedtls_psa_register_se_key usable with volatile keys #9254

gilles-peskine-arm opened this issue Jun 13, 2024 · 0 comments
Labels
api-break This issue/PR breaks the API and must wait for a new major version bug component-psa PSA keystore/dispatch layer (storage, drivers, …) size-xs Estimated task size: extra small (a few hours at most)

Comments

@gilles-peskine-arm
Copy link
Contributor

The function mbedtls_psa_register_se_key creates a PSA key object that is backed by a secure element. If you give it a volatile lifetime, the core chooses a volatile key identifier, which is needed to use the key subsequently. However, the API does not output that key identifier, so the created volatile key just leaks memory.

My original thinking was that you would call this function once to register a key during a provisioning phase. However, there are devices with no local storage of keys, not even key metadata, but that have a secure element, and this function is useful on such devices as well. The application would register the key each time it uses it.

In the next major version of Mbed TLS, change the function to have an extra argument to output the key identifier, like the other key creation functions (psa_generate_key, etc.).

@gilles-peskine-arm gilles-peskine-arm added bug component-psa PSA keystore/dispatch layer (storage, drivers, …) api-break This issue/PR breaks the API and must wait for a new major version size-xs Estimated task size: extra small (a few hours at most) labels Jun 13, 2024
@gilles-peskine-arm gilles-peskine-arm moved this to Implementation needed in Mbed TLS 4.0 planning Jun 13, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
api-break This issue/PR breaks the API and must wait for a new major version bug component-psa PSA keystore/dispatch layer (storage, drivers, …) size-xs Estimated task size: extra small (a few hours at most)
Projects
Status: Implementation needed
Development

No branches or pull requests

1 participant