From adac57a6e82ab7a9d043ee96302eea3ab73e73f6 Mon Sep 17 00:00:00 2001
From: xusiyu <xusiyu@espressif.com>
Date: Sat, 4 Jul 2026 04:33:54 +0800
Subject: [PATCH] [crypto] align LinkRaw MAC key exportability with KeyManager
 (#13277)

This change completes a previously unfinished part of the "MAC keys
must be exportable" fix. `KeyManager` already applies an explicit
exportable policy (`kExportableMacKeys`) when updating MAC keys, but
`LinkRaw::SetMacKey()` still relied on `SetFrom(...,
aIsExportable=false)` by default, which made key import permissions
inconsistent across code paths.

On RCP paths with `OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE`,
MAC key bytes from host spinel are re-imported on RCP as key
references before being passed to the platform radio. If those key
references are not created with export permission as required by
`OPENTHREAD_CONFIG_PLATFORM_MAC_KEYS_EXPORTABLE_ENABLE`, the platform
can fail to retrieve key material when setting MAC keys, which can
break subsequent 802.15.4 security processing.

This patch introduces a shared `Mac::kDefaultMacKeysExportable` policy
(derived from `OPENTHREAD_CONFIG_PLATFORM_MAC_KEYS_EXPORTABLE_ENABLE`)
and uses it in both `KeyManager` and `LinkRaw`, so MAC key import
behavior stays consistent whenever
`OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE` is enabled.
---
 src/core/mac/link_raw.cpp       | 6 +++---
 src/core/mac/mac_types.hpp      | 2 ++
 src/core/thread/key_manager.cpp | 6 +++---
 src/core/thread/key_manager.hpp | 1 -
 4 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/src/core/mac/link_raw.cpp b/src/core/mac/link_raw.cpp
index db5d5c866..119f21760 100644
--- a/src/core/mac/link_raw.cpp
+++ b/src/core/mac/link_raw.cpp
@@ -253,9 +253,9 @@ Error LinkRaw::SetMacKey(uint8_t    aKeyIdMode,
 
     VerifyOrExit(IsEnabled(), error = kErrorInvalidState);
 
-    prevKey.SetFrom(aPrevKey);
-    currKey.SetFrom(aCurrKey);
-    nextKey.SetFrom(aNextKey);
+    prevKey.SetFrom(aPrevKey, kDefaultMacKeysExportable);
+    currKey.SetFrom(aCurrKey, kDefaultMacKeysExportable);
+    nextKey.SetFrom(aNextKey, kDefaultMacKeysExportable);
 
     mSubMac.SetMacKey(aKeyIdMode, aKeyId, prevKey, currKey, nextKey);
 
diff --git a/src/core/mac/mac_types.hpp b/src/core/mac/mac_types.hpp
index fbfc591c9..f49c9b550 100644
--- a/src/core/mac/mac_types.hpp
+++ b/src/core/mac/mac_types.hpp
@@ -80,6 +80,8 @@ typedef otShortAddress ShortAddress;
 
 constexpr ShortAddress kShortAddrBroadcast = OT_RADIO_BROADCAST_SHORT_ADDR; ///< Broadcast Short Address.
 constexpr ShortAddress kShortAddrInvalid   = OT_RADIO_INVALID_SHORT_ADDR;   ///< Invalid Short Address.
+constexpr bool         kDefaultMacKeysExportable =
+    OPENTHREAD_CONFIG_PLATFORM_MAC_KEYS_EXPORTABLE_ENABLE; ///< Default exportability policy for MAC key refs.
 
 /**
  * Represents the wake-up identifier.
diff --git a/src/core/thread/key_manager.cpp b/src/core/thread/key_manager.cpp
index d5e995309..f0e6a5122 100644
--- a/src/core/thread/key_manager.cpp
+++ b/src/core/thread/key_manager.cpp
@@ -344,13 +344,13 @@ void KeyManager::UpdateKeyMaterial(void)
         Mac::KeyMaterial prevKey;
         Mac::KeyMaterial nextKey;
 
-        curKey.SetFrom(hashKeys.GetMacKey(), kExportableMacKeys);
+        curKey.SetFrom(hashKeys.GetMacKey(), Mac::kDefaultMacKeysExportable);
 
         ComputeKeys(mKeySequence - 1, hashKeys);
-        prevKey.SetFrom(hashKeys.GetMacKey(), kExportableMacKeys);
+        prevKey.SetFrom(hashKeys.GetMacKey(), Mac::kDefaultMacKeysExportable);
 
         ComputeKeys(mKeySequence + 1, hashKeys);
-        nextKey.SetFrom(hashKeys.GetMacKey(), kExportableMacKeys);
+        nextKey.SetFrom(hashKeys.GetMacKey(), Mac::kDefaultMacKeysExportable);
 
         Get<Mac::SubMac>().SetMacKey(Mac::Frame::kKeyIdMode1, (mKeySequence & 0x7f) + 1, prevKey, curKey, nextKey);
     }
diff --git a/src/core/thread/key_manager.hpp b/src/core/thread/key_manager.hpp
index 763d77109..1a3368868 100644
--- a/src/core/thread/key_manager.hpp
+++ b/src/core/thread/key_manager.hpp
@@ -571,7 +571,6 @@ public:
 private:
     static constexpr uint16_t kDefaultKeySwitchGuardTime    = 624; // ~ 93% of 672 (default key rotation time)
     static constexpr uint32_t kKeySwitchGuardTimePercentage = 93;  // Percentage of key rotation time.
-    static constexpr bool     kExportableMacKeys            = OPENTHREAD_CONFIG_PLATFORM_MAC_KEYS_EXPORTABLE_ENABLE;
 
     static_assert(kDefaultKeySwitchGuardTime ==
                       SecurityPolicy::kDefaultKeyRotationTime * kKeySwitchGuardTimePercentage / 100,