SE driver: make persistent data work #285
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
When registering a key in a secure element, go through the transaction mechanism. This makes the code simpler, at the expense of a few extra storage operations. Given that registering a key is typically very rare over the lifetime of a device, this is an acceptable loss. Drivers must now have a p_validate_slot_number method, otherwise registering a key is not possible. This reduces the risk that due to a mistake during the integration of a device, an application might claim a slot in a way that is not supported by the driver.
Add a parameter to the p_validate_slot_number method to allow the driver to modify the persistent data. With the current structure of the core, the persistent data is already updated. All it took was adding a way to modify it.
gilles-peskine-arm
added
enhancement
Patater
reviewed
Oct 1, 2019
Patater
previously approved these changes
Oct 1, 2019
The persistent data was not loaded correctly (the code was loading 0 bytes instead of the correct size).
Add invasive checks that peek at the stored persistent data after some successful import, generation or destruction operations and after reinitialization to ensure that the persistent data in storage has the expected content.
gilles-peskine-arm
changed the title
dgreen-arm
approved these changes
Oct 3, 2019
|
CI passed on -head. The failures on -merge are due to a recent CI instability. The PR is from a recent branch and we'd have been happy to merge with a CI job that had run on exactly the same content as the -head job. So CI is ok to merge. |
gilles-peskine-arm
removed
the
needs: review
gilles-peskine-arm
added a commit
to gilles-peskine-arm/mbed-crypto
that referenced
this pull request
Nov 15, 2019
* ARMmbed#272: Insert doxygen comments on old algorithms so they appear in PSA documentation * ARMmbed#285: SE driver: make persistent data work * ARMmbed#279: Include IANA reference in the definition of ECC curves and DH groups * ARMmbed#287: DRBG documentation improvements * ARMmbed#297: Fix int overflow in mbedtls_asn1_get_int (Credit to OSS-Fuzz)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Secure element interface changes:
p_validate_slot_numbermethod no longer allows registering an existing key withmbedtls_psa_register_se_key.p_validate_slot_numbermethod now takes an extra read-write parameterpersistent_data, likep_allocate.New features and bug fixes:
p_initdriver method duringpsa_crypto_init.