Mbed-TLS/mbedtls-framework
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls-framework.git synced 2026-08-14 07:07:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

PSA_KEY_USAGE_DERIVE_PUBLIC is not valid in key policies

Browse Source 
We have a new usage flag `PSA_KEY_USAGE_DERIVE_PUBLIC` which is (so far)
only meant for checking a key's capabilities, and not valid in key policies.
Exclude this flag from systematic checking of usage flags.

Signed-off-by: Gilles Peskine <[email protected]>
This commit is contained in:
Gilles Peskine
2025-09-25 11:44:27 +02:00
parent 59d77ef052
commit 0920bdab56
1 changed files with 21 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/generate_psa_tests.py
+21 -6
View File
@@ -561,19 +561,34 @@ class StorageFormat:
key1.description += short
return key1
USAGE_FLAGS_NOT_VALID_IN_POLICIES = frozenset([
# Only for psa_check_key_usage() (upcoming) and
# mbedtls_pk_can_do_psa() (since TF-PSA-Crypto 1.0),
# not allowed in key policies as of TF-PSA-Crypto 1.0.
# Note that this may become dependent on the TF-PSA-Crypto version
# in the future; if so this code will require some refactoring.
'PSA_KEY_USAGE_DERIVE_PUBLIC',
])
def all_policy_flags(self) -> List[str]:
"""Return the list of all usage flags that are valid in key policies."""
known_flags = frozenset(self.constructors.key_usage_flags)
policy_flags = known_flags - self.USAGE_FLAGS_NOT_VALID_IN_POLICIES
return sorted(policy_flags)
def generate_keys_for_usage_flags(self, **kwargs) -> Iterator[StorageTestData]:
"""Generate test keys covering usage flags."""
known_flags = sorted(self.constructors.key_usage_flags)
policy_flags = self.all_policy_flags()
yield self.key_for_usage_flags(['0'], **kwargs)
for usage_flag in known_flags:
for usage_flag in policy_flags:
yield self.key_for_usage_flags([usage_flag], **kwargs)
for flag1, flag2 in zip(known_flags,
known_flags[1:] + [known_flags[0]]):
for flag1, flag2 in zip(policy_flags,
policy_flags[1:] + [policy_flags[0]]):
yield self.key_for_usage_flags([flag1, flag2], **kwargs)
def generate_key_for_all_usage_flags(self) -> Iterator[StorageTestData]:
known_flags = sorted(self.constructors.key_usage_flags)
yield self.key_for_usage_flags(known_flags, short='all known')
policy_flags = self.all_policy_flags()
yield self.key_for_usage_flags(policy_flags, short='all valid')
def all_keys_for_usage_flags(self) -> Iterator[StorageTestData]:
yield from self.generate_keys_for_usage_flags()