From 0920bdab56d90903ca0f4a09d8c8aa001a199935 Mon Sep 17 00:00:00 2001 From: Gilles Peskine Date: Thu, 25 Sep 2025 11:38:59 +0200 Subject: [PATCH] PSA_KEY_USAGE_DERIVE_PUBLIC is not valid in key policies We have a new usage flag `PSA_KEY_USAGE_DERIVE_PUBLIC` which is (so far) only meant for checking a key's capabilities, and not valid in key policies. Exclude this flag from systematic checking of usage flags. Signed-off-by: Gilles Peskine --- scripts/generate_psa_tests.py | 27 +++++++++++++++++++++------ 1 file changed, 21 insertions(+), 6 deletions(-) diff --git a/scripts/generate_psa_tests.py b/scripts/generate_psa_tests.py index 9e628abc6..3651951d8 100755 --- a/scripts/generate_psa_tests.py +++ b/scripts/generate_psa_tests.py @@ -561,19 +561,34 @@ class StorageFormat: key1.description += short return key1 + USAGE_FLAGS_NOT_VALID_IN_POLICIES = frozenset([ + # Only for psa_check_key_usage() (upcoming) and + # mbedtls_pk_can_do_psa() (since TF-PSA-Crypto 1.0), + # not allowed in key policies as of TF-PSA-Crypto 1.0. + # Note that this may become dependent on the TF-PSA-Crypto version + # in the future; if so this code will require some refactoring. + 'PSA_KEY_USAGE_DERIVE_PUBLIC', + ]) + + def all_policy_flags(self) -> List[str]: + """Return the list of all usage flags that are valid in key policies.""" + known_flags = frozenset(self.constructors.key_usage_flags) + policy_flags = known_flags - self.USAGE_FLAGS_NOT_VALID_IN_POLICIES + return sorted(policy_flags) + def generate_keys_for_usage_flags(self, **kwargs) -> Iterator[StorageTestData]: """Generate test keys covering usage flags.""" - known_flags = sorted(self.constructors.key_usage_flags) + policy_flags = self.all_policy_flags() yield self.key_for_usage_flags(['0'], **kwargs) - for usage_flag in known_flags: + for usage_flag in policy_flags: yield self.key_for_usage_flags([usage_flag], **kwargs) - for flag1, flag2 in zip(known_flags, - known_flags[1:] + [known_flags[0]]): + for flag1, flag2 in zip(policy_flags, + policy_flags[1:] + [policy_flags[0]]): yield self.key_for_usage_flags([flag1, flag2], **kwargs) def generate_key_for_all_usage_flags(self) -> Iterator[StorageTestData]: - known_flags = sorted(self.constructors.key_usage_flags) - yield self.key_for_usage_flags(known_flags, short='all known') + policy_flags = self.all_policy_flags() + yield self.key_for_usage_flags(policy_flags, short='all valid') def all_keys_for_usage_flags(self) -> Iterator[StorageTestData]: yield from self.generate_keys_for_usage_flags()