psa_crypto_helpers.h (22735B)
1 /* 2 * Helper functions for tests that use the PSA Crypto API. 3 */ 4 /* 5 * Copyright The Mbed TLS Contributors 6 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later 7 */ 8 9 #ifndef PSA_CRYPTO_HELPERS_H 10 #define PSA_CRYPTO_HELPERS_H 11 12 #include "test/helpers.h" 13 14 #if (MBEDTLS_VERSION_MAJOR < 4 && defined(MBEDTLS_PSA_CRYPTO_C)) || \ 15 (MBEDTLS_VERSION_MAJOR >= 4 && defined(MBEDTLS_PSA_CRYPTO_CLIENT)) 16 #include "test/psa_helpers.h" 17 #endif 18 19 #include <psa/crypto.h> 20 #include <mbedtls/ctr_drbg.h> 21 22 #if defined(MBEDTLS_PSA_CRYPTO_C) 23 /** Initialize the PSA Crypto subsystem. */ 24 #define PSA_INIT() PSA_ASSERT(psa_crypto_init()) 25 26 /** Shut down the PSA Crypto subsystem and destroy persistent keys. 27 * Expect a clean shutdown, with no slots in use. 28 * 29 * If some key slots are still in use, record the test case as failed, 30 * but continue executing. This macro is suitable (and primarily intended) 31 * for use in the cleanup section of test functions. 32 * 33 * \note Persistent keys must be recorded with #TEST_USES_KEY_ID before 34 * creating them. 35 */ 36 #define PSA_DONE() \ 37 do \ 38 { \ 39 mbedtls_test_fail_if_psa_leaking(__LINE__, __FILE__); \ 40 mbedtls_test_psa_purge_key_storage(); \ 41 mbedtls_psa_crypto_free(); \ 42 } \ 43 while (0) 44 #elif MBEDTLS_VERSION_MAJOR >= 4 && defined(MBEDTLS_PSA_CRYPTO_CLIENT) 45 #define PSA_INIT() PSA_ASSERT(psa_crypto_init()) 46 #define PSA_DONE() mbedtls_psa_crypto_free(); 47 #else /* MBEDTLS_PSA_CRYPTO_CLIENT && !MBEDTLS_PSA_CRYPTO_C */ 48 #define PSA_INIT() ((void) 0) 49 #define PSA_DONE() ((void) 0) 50 #endif /* MBEDTLS_PSA_CRYPTO_C */ 51 52 #if (MBEDTLS_VERSION_MAJOR < 4 && defined(MBEDTLS_PSA_CRYPTO_C)) || \ 53 (MBEDTLS_VERSION_MAJOR >= 4 && defined(MBEDTLS_PSA_CRYPTO_CLIENT)) 54 55 #if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) 56 57 /* Internal function for #TEST_USES_KEY_ID. Return 1 on success, 0 on failure. */ 58 int mbedtls_test_uses_key_id(mbedtls_svc_key_id_t key_id); 59 60 /** Destroy persistent keys recorded with #TEST_USES_KEY_ID. 61 */ 62 void mbedtls_test_psa_purge_key_storage(void); 63 64 /** Purge the in-memory cache of persistent keys recorded with 65 * #TEST_USES_KEY_ID. 66 * 67 * Call this function before calling PSA_DONE() if it's ok for 68 * persistent keys to still exist at this point. 69 */ 70 void mbedtls_test_psa_purge_key_cache(void); 71 72 /** \def TEST_USES_KEY_ID 73 * 74 * Call this macro in a test function before potentially creating a 75 * persistent key. Test functions that use this mechanism must call 76 * mbedtls_test_psa_purge_key_storage() in their cleanup code. 77 * 78 * This macro records a persistent key identifier as potentially used in the 79 * current test case. Recorded key identifiers will be cleaned up at the end 80 * of the test case, even on failure. 81 * 82 * This macro has no effect on volatile keys. Therefore, it is safe to call 83 * this macro in a test function that creates either volatile or persistent 84 * keys depending on the test data. 85 * 86 * This macro currently has no effect on special identifiers 87 * used to store implementation-specific files. 88 * 89 * Calling this macro multiple times on the same key identifier in the same 90 * test case has no effect. 91 * 92 * This macro can fail the test case if there isn't enough memory to 93 * record the key id. 94 * 95 * \param key_id The PSA key identifier to record. 96 */ 97 #define TEST_USES_KEY_ID(key_id) \ 98 TEST_ASSERT(mbedtls_test_uses_key_id(key_id)) 99 100 #else /* MBEDTLS_PSA_CRYPTO_STORAGE_C */ 101 102 #define TEST_USES_KEY_ID(key_id) ((void) (key_id)) 103 #define mbedtls_test_psa_purge_key_storage() ((void) 0) 104 #define mbedtls_test_psa_purge_key_cache() ((void) 0) 105 106 #endif /* MBEDTLS_PSA_CRYPTO_STORAGE_C */ 107 108 /** Check for things that have not been cleaned up properly in the 109 * PSA subsystem. 110 * 111 * \return NULL if nothing has leaked. 112 * \return A string literal explaining what has not been cleaned up 113 * if applicable. 114 */ 115 const char *mbedtls_test_helper_is_psa_leaking(void); 116 117 /** Check that no PSA Crypto key slots are in use. 118 * 119 * If any slots are in use, mark the current test as failed and jump to 120 * the exit label. This is equivalent to 121 * `TEST_ASSERT( ! mbedtls_test_helper_is_psa_leaking( ) )` 122 * but with a more informative message. 123 */ 124 #define ASSERT_PSA_PRISTINE() \ 125 do \ 126 { \ 127 if (mbedtls_test_fail_if_psa_leaking(__LINE__, __FILE__)) \ 128 goto exit; \ 129 } \ 130 while (0) 131 132 /** Shut down the PSA Crypto subsystem, allowing persistent keys to survive. 133 * Expect a clean shutdown, with no slots in use. 134 * 135 * If some key slots are still in use, record the test case as failed and 136 * jump to the `exit` label. 137 */ 138 #define PSA_SESSION_DONE() \ 139 do \ 140 { \ 141 mbedtls_test_psa_purge_key_cache(); \ 142 ASSERT_PSA_PRISTINE(); \ 143 mbedtls_psa_crypto_free(); \ 144 } \ 145 while (0) 146 147 148 /** Initializer that doesn't set the embedded union to zero. 149 * 150 * Use this to validate that our code correctly handles platforms where 151 * `{0}` does not initialize a union to all-bits-zero, only the first member. 152 * Such behavior is uncommon, but compliant (see discussion in 153 * https://github.com/Mbed-TLS/mbedtls/issues/9814). 154 * You can portably simulate that behavior by using the `xxx_init_short()` 155 * initializer function instead of `{0}` or an official initializer 156 * `xxx_init()` or `XXX_INIT`. 157 */ 158 psa_hash_operation_t psa_hash_operation_init_short(void); 159 psa_mac_operation_t psa_mac_operation_init_short(void); 160 psa_cipher_operation_t psa_cipher_operation_init_short(void); 161 psa_aead_operation_t psa_aead_operation_init_short(void); 162 psa_key_derivation_operation_t psa_key_derivation_operation_init_short(void); 163 psa_pake_operation_t psa_pake_operation_init_short(void); 164 psa_sign_hash_interruptible_operation_t psa_sign_hash_interruptible_operation_init_short(void); 165 psa_verify_hash_interruptible_operation_t psa_verify_hash_interruptible_operation_init_short(void); 166 #if defined(PSA_KEY_AGREEMENT_IOP_INIT) 167 psa_key_agreement_iop_t psa_key_agreement_iop_init_short(void); 168 #endif 169 #if defined(PSA_GENERATE_KEY_IOP_INIT) 170 psa_generate_key_iop_t psa_generate_key_iop_init_short(void); 171 #endif 172 #if defined(PSA_EXPORT_PUBLIC_KEY_IOP_INIT) 173 psa_export_public_key_iop_t psa_export_public_key_iop_init_short(void); 174 #endif 175 176 177 178 #if defined(RECORD_PSA_STATUS_COVERAGE_LOG) 179 psa_status_t mbedtls_test_record_status(psa_status_t status, 180 const char *func, 181 const char *file, int line, 182 const char *expr); 183 184 /** Return value logging wrapper macro. 185 * 186 * Evaluate \p expr. Write a line recording its value to the log file 187 * #STATUS_LOG_FILE_NAME and return the value. The line is a colon-separated 188 * list of fields: 189 * ``` 190 * value of expr:string:__FILE__:__LINE__:expr 191 * ``` 192 * 193 * The test code does not call this macro explicitly because that would 194 * be very invasive. Instead, we instrument the source code by defining 195 * a bunch of wrapper macros like 196 * ``` 197 * #define psa_crypto_init() RECORD_STATUS("psa_crypto_init", psa_crypto_init()) 198 * ``` 199 * These macro definitions must be present in `instrument_record_status.h` 200 * when building the test suites. 201 * 202 * \param string A string, normally a function name. 203 * \param expr An expression to evaluate, normally a call of the function 204 * whose name is in \p string. This expression must return 205 * a value of type #psa_status_t. 206 * \return The value of \p expr. 207 */ 208 #define RECORD_STATUS(string, expr) \ 209 mbedtls_test_record_status((expr), string, __FILE__, __LINE__, #expr) 210 211 #include "instrument_record_status.h" 212 213 #endif /* defined(RECORD_PSA_STATUS_COVERAGE_LOG) */ 214 215 /** Return extended key usage policies. 216 * 217 * Do a key policy permission extension on key usage policies always involves 218 * permissions of other usage policies 219 * (like PSA_KEY_USAGE_SIGN_HASH involves PSA_KEY_USAGE_SIGN_MESSAGE). 220 */ 221 psa_key_usage_t mbedtls_test_update_key_usage_flags(psa_key_usage_t usage_flags); 222 223 /** Check that no PSA Crypto key slots are in use. 224 * 225 * If any slots are in use, mark the current test as failed. 226 * 227 * \return 0 if the key store is empty, 1 otherwise. 228 */ 229 int mbedtls_test_fail_if_psa_leaking(int line_no, const char *filename); 230 231 232 233 #if defined(MBEDTLS_PSA_INJECT_ENTROPY) 234 /* The #MBEDTLS_PSA_INJECT_ENTROPY feature requires two extra platform 235 * functions, which must be configured as #MBEDTLS_PLATFORM_NV_SEED_READ_MACRO 236 * and #MBEDTLS_PLATFORM_NV_SEED_WRITE_MACRO. The job of these functions 237 * is to read and write from the entropy seed file, which is located 238 * in the PSA ITS file whose uid is #PSA_CRYPTO_ITS_RANDOM_SEED_UID. 239 * (These could have been provided as library functions, but for historical 240 * reasons, they weren't, and so each integrator has to provide a copy 241 * of these functions.) 242 * 243 * Provide implementations of these functions for testing. */ 244 int mbedtls_test_inject_entropy_seed_read(unsigned char *buf, size_t len); 245 int mbedtls_test_inject_entropy_seed_write(unsigned char *buf, size_t len); 246 247 248 /** Make sure that the injected entropy is present. 249 * 250 * When MBEDTLS_PSA_INJECT_ENTROPY is enabled, psa_crypto_init() 251 * will fail if the PSA entropy seed is not present. 252 * This function must be called at least once in a test suite or other 253 * program before any call to psa_crypto_init(). 254 * It does not need to be called in each test case. 255 * 256 * The test framework calls this function before running any test case. 257 * 258 * The few tests that might remove the entropy file must call this function 259 * in their cleanup. 260 */ 261 int mbedtls_test_inject_entropy_restore(void); 262 #endif /* MBEDTLS_PSA_INJECT_ENTROPY */ 263 264 /** Parse binary string and convert it to a long integer 265 */ 266 uint64_t mbedtls_test_parse_binary_string(data_t *bin_string); 267 268 /** Skip a test case if the given key is a 192 bits AES key and the AES 269 * implementation is at least partially provided by an accelerator or 270 * alternative implementation. 271 * 272 * Call this macro in a test case when a cryptographic operation that may 273 * involve an AES operation returns a #PSA_ERROR_NOT_SUPPORTED error code. 274 * The macro call will skip and not fail the test case in case the operation 275 * involves a 192 bits AES key and the AES implementation is at least 276 * partially provided by an accelerator or alternative implementation. 277 * 278 * Hardware AES implementations not supporting 192 bits keys commonly exist. 279 * Consequently, PSA test cases aim at not failing when an AES operation with 280 * a 192 bits key performed by an alternative AES implementation returns 281 * with the #PSA_ERROR_NOT_SUPPORTED error code. The purpose of this macro 282 * is to facilitate this and make the test case code more readable. 283 * 284 * \param key_type Key type 285 * \param key_bits Key length in number of bits. 286 */ 287 #if defined(MBEDTLS_AES_ALT) || \ 288 defined(MBEDTLS_AES_SETKEY_ENC_ALT) || \ 289 defined(MBEDTLS_PSA_ACCEL_KEY_TYPE_AES) 290 #define MBEDTLS_TEST_HAVE_ACCEL_AES 1 291 #else 292 #define MBEDTLS_TEST_HAVE_ACCEL_AES 0 293 #endif 294 295 #define MBEDTLS_TEST_PSA_SKIP_IF_ALT_AES_192(key_type, key_bits) \ 296 do \ 297 { \ 298 if ((MBEDTLS_TEST_HAVE_ACCEL_AES) && \ 299 ((key_type) == PSA_KEY_TYPE_AES) && \ 300 (key_bits == 192)) \ 301 { \ 302 mbedtls_test_skip("AES-192 not supported", __LINE__, __FILE__); \ 303 goto exit; \ 304 } \ 305 } \ 306 while (0) 307 308 /** Skip a test case if a GCM operation with a nonce length different from 309 * 12 bytes fails and was performed by an accelerator or alternative 310 * implementation. 311 * 312 * Call this macro in a test case when an AEAD cryptography operation that 313 * may involve the GCM mode returns with a #PSA_ERROR_NOT_SUPPORTED error 314 * code. The macro call will skip and not fail the test case in case the 315 * operation involves the GCM mode, a nonce with a length different from 316 * 12 bytes and the GCM mode implementation is an alternative one. 317 * 318 * Hardware GCM implementations not supporting nonce lengths different from 319 * 12 bytes commonly exist, as supporting a non-12-byte nonce requires 320 * additional computations involving the GHASH function. 321 * Consequently, PSA test cases aim at not failing when an AEAD operation in 322 * GCM mode with a nonce length different from 12 bytes is performed by an 323 * alternative GCM implementation and returns with a #PSA_ERROR_NOT_SUPPORTED 324 * error code. The purpose of this macro is to facilitate this check and make 325 * the test case code more readable. 326 * 327 * \param alg The AEAD algorithm. 328 * \param nonce_length The nonce length in number of bytes. 329 */ 330 331 #if defined(MBEDTLS_GCM_ALT) || \ 332 defined(MBEDTLS_PSA_ACCEL_ALG_GCM) 333 #define MBEDTLS_TEST_HAVE_ACCEL_GCM 1 334 #else 335 #define MBEDTLS_TEST_HAVE_ACCEL_GCM 0 336 #endif 337 338 #define MBEDTLS_TEST_PSA_SKIP_IF_ALT_GCM_NOT_12BYTES_NONCE(alg, \ 339 nonce_length) \ 340 do \ 341 { \ 342 if ((MBEDTLS_TEST_HAVE_ACCEL_GCM) && \ 343 (PSA_ALG_AEAD_WITH_SHORTENED_TAG((alg), 0) == \ 344 PSA_ALG_AEAD_WITH_SHORTENED_TAG(PSA_ALG_GCM, 0)) && \ 345 ((nonce_length) != 12)) \ 346 { \ 347 mbedtls_test_skip("GCM with non-12-byte IV is not supported", __LINE__, __FILE__); \ 348 goto exit; \ 349 } \ 350 } \ 351 while (0) 352 353 #endif /* MBEDTLS_PSA_CRYPTO_CLIENT || MBEDTLS_PSA_CRYPTO_C */ 354 355 #if MBEDTLS_VERSION_MAJOR >= 4 356 /* Legacy PSA_INIT() / PSA_DONE() variants from 3.6 */ 357 #define USE_PSA_INIT() PSA_INIT() 358 #define USE_PSA_DONE() PSA_DONE() 359 #define MD_PSA_INIT() PSA_INIT() 360 #define MD_PSA_DONE() PSA_DONE() 361 #define BLOCK_CIPHER_PSA_INIT() PSA_INIT() 362 #define BLOCK_CIPHER_PSA_DONE() PSA_DONE() 363 #define MD_OR_USE_PSA_INIT() PSA_INIT() 364 #define MD_OR_USE_PSA_DONE() PSA_DONE() 365 #define AES_PSA_INIT() PSA_INIT() 366 #define AES_PSA_DONE() PSA_DONE() 367 368 #else /* MBEDTLS_VERSION_MAJOR < 4 */ 369 370 /** \def USE_PSA_INIT 371 * 372 * Call this macro to initialize the PSA subsystem if #MBEDTLS_USE_PSA_CRYPTO 373 * or #MBEDTLS_SSL_PROTO_TLS1_3 (In contrast to TLS 1.2 implementation, the 374 * TLS 1.3 one uses PSA independently of the definition of 375 * #MBEDTLS_USE_PSA_CRYPTO) is enabled and do nothing otherwise. 376 * 377 * If the initialization fails, mark the test case as failed and jump to the 378 * \p exit label. 379 */ 380 /** \def USE_PSA_DONE 381 * 382 * Call this macro at the end of a test case if you called #USE_PSA_INIT. 383 * 384 * This is like #PSA_DONE except it does nothing under the same conditions as 385 * #USE_PSA_INIT. 386 */ 387 #if defined(MBEDTLS_USE_PSA_CRYPTO) 388 #define USE_PSA_INIT() PSA_INIT() 389 #define USE_PSA_DONE() PSA_DONE() 390 #elif defined(MBEDTLS_SSL_PROTO_TLS1_3) 391 /* TLS 1.3 must work without having called psa_crypto_init(), for backward 392 * compatibility with Mbed TLS <= 3.5 when connecting with a peer that 393 * supports both TLS 1.2 and TLS 1.3. See mbedtls_ssl_tls13_crypto_init() 394 * and https://github.com/Mbed-TLS/mbedtls/issues/9072 . */ 395 #define USE_PSA_INIT() ((void) 0) 396 /* TLS 1.3 may have initialized the PSA subsystem. Shut it down cleanly, 397 * otherwise Asan and Valgrind would notice a resource leak. */ 398 #define USE_PSA_DONE() PSA_DONE() 399 #else /* MBEDTLS_USE_PSA_CRYPTO || MBEDTLS_SSL_PROTO_TLS1_3 */ 400 /* Define empty macros so that we can use them in the preamble and teardown 401 * of every test function that uses PSA conditionally based on 402 * MBEDTLS_USE_PSA_CRYPTO. */ 403 #define USE_PSA_INIT() ((void) 0) 404 #define USE_PSA_DONE() ((void) 0) 405 #endif /* !MBEDTLS_USE_PSA_CRYPTO && !MBEDTLS_SSL_PROTO_TLS1_3 */ 406 407 /** \def MD_PSA_INIT 408 * 409 * Call this macro to initialize the PSA subsystem if MD uses a driver, 410 * and do nothing otherwise. 411 * 412 * If the initialization fails, mark the test case as failed and jump to the 413 * \p exit label. 414 */ 415 /** \def MD_PSA_DONE 416 * 417 * Call this macro at the end of a test case if you called #MD_PSA_INIT. 418 * 419 * This is like #PSA_DONE except it does nothing under the same conditions as 420 * #MD_PSA_INIT. 421 */ 422 #if defined(MBEDTLS_MD_SOME_PSA) 423 #define MD_PSA_INIT() PSA_INIT() 424 #define MD_PSA_DONE() PSA_DONE() 425 #else /* MBEDTLS_MD_SOME_PSA */ 426 #define MD_PSA_INIT() ((void) 0) 427 #define MD_PSA_DONE() ((void) 0) 428 #endif /* MBEDTLS_MD_SOME_PSA */ 429 430 /** \def BLOCK_CIPHER_PSA_INIT 431 * 432 * Call this macro to initialize the PSA subsystem if BLOCK_CIPHER uses a driver, 433 * and do nothing otherwise. 434 * 435 * If the initialization fails, mark the test case as failed and jump to the 436 * \p exit label. 437 */ 438 /** \def BLOCK_CIPHER_PSA_DONE 439 * 440 * Call this macro at the end of a test case if you called #BLOCK_CIPHER_PSA_INIT. 441 * 442 * This is like #PSA_DONE except it does nothing under the same conditions as 443 * #BLOCK_CIPHER_PSA_INIT. 444 */ 445 #if defined(MBEDTLS_BLOCK_CIPHER_SOME_PSA) 446 #define BLOCK_CIPHER_PSA_INIT() PSA_INIT() 447 #define BLOCK_CIPHER_PSA_DONE() PSA_DONE() 448 #else /* MBEDTLS_MD_SOME_PSA */ 449 #define BLOCK_CIPHER_PSA_INIT() ((void) 0) 450 #define BLOCK_CIPHER_PSA_DONE() ((void) 0) 451 #endif /* MBEDTLS_MD_SOME_PSA */ 452 453 454 /** \def MD_OR_USE_PSA_INIT 455 * 456 * Call this macro to initialize the PSA subsystem if MD uses a driver, 457 * or if #MBEDTLS_USE_PSA_CRYPTO or #MBEDTLS_SSL_PROTO_TLS1_3 is enabled, 458 * and do nothing otherwise. 459 * 460 * If the initialization fails, mark the test case as failed and jump to the 461 * \p exit label. 462 */ 463 /** \def MD_OR_USE_PSA_DONE 464 * 465 * Call this macro at the end of a test case if you called #MD_OR_USE_PSA_INIT. 466 * 467 * This is like #PSA_DONE except it does nothing under the same conditions as 468 * #MD_OR_USE_PSA_INIT. 469 */ 470 #if defined(MBEDTLS_MD_SOME_PSA) 471 #define MD_OR_USE_PSA_INIT() PSA_INIT() 472 #define MD_OR_USE_PSA_DONE() PSA_DONE() 473 #else 474 #define MD_OR_USE_PSA_INIT() USE_PSA_INIT() 475 #define MD_OR_USE_PSA_DONE() USE_PSA_DONE() 476 #endif 477 478 /** \def AES_PSA_INIT 479 * 480 * Call this macro to initialize the PSA subsystem if AES_C is not defined, 481 * so that CTR_DRBG uses PSA implementation to get AES-ECB. 482 * 483 * If the initialization fails, mark the test case as failed and jump to the 484 * \p exit label. 485 */ 486 /** \def AES_PSA_DONE 487 * 488 * Call this macro at the end of a test case if you called #AES_PSA_INIT. 489 * 490 * This is like #PSA_DONE except it does nothing under the same conditions as 491 * #AES_PSA_INIT. 492 */ 493 #if defined(MBEDTLS_CTR_DRBG_USE_PSA_CRYPTO) 494 #define AES_PSA_INIT() PSA_INIT() 495 #define AES_PSA_DONE() PSA_DONE() 496 #else /* MBEDTLS_CTR_DRBG_USE_PSA_CRYPTO */ 497 #define AES_PSA_INIT() ((void) 0) 498 #define AES_PSA_DONE() ((void) 0) 499 #endif /* MBEDTLS_CTR_DRBG_USE_PSA_CRYPTO */ 500 501 #endif /* MBEDTLS_VERSION_MAJOR >= 4 */ 502 503 #if !defined(MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG) && \ 504 defined(MBEDTLS_CTR_DRBG_C) && \ 505 defined(MBEDTLS_CTR_DRBG_USE_PSA_CRYPTO) 506 /* When AES_C is not defined and PSA does not have an external RNG, 507 * then CTR_DRBG uses PSA to perform AES-ECB. In this scenario 1 key 508 * slot is used internally from PSA to hold the AES key and it should 509 * not be taken into account when evaluating remaining open slots. */ 510 #define MBEDTLS_TEST_PSA_INTERNAL_KEYS_FOR_DRBG 1 511 #else 512 #define MBEDTLS_TEST_PSA_INTERNAL_KEYS_FOR_DRBG 0 513 #endif 514 515 /** The number of volatile keys that PSA crypto uses internally. 516 * 517 * We expect that many volatile keys to be in use after a successful 518 * psa_crypto_init(). 519 */ 520 #define MBEDTLS_TEST_PSA_INTERNAL_KEYS \ 521 MBEDTLS_TEST_PSA_INTERNAL_KEYS_FOR_DRBG 522 523 /* A couple of helper macros to verify if MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE is 524 * large enough to contain an RSA key pair of the given size. This is meant to be 525 * used in test cases where MBEDTLS_PSA_STATIC_KEY_SLOTS is enabled. */ 526 #if defined(MBEDTLS_PSA_CRYPTO_CLIENT) 527 528 #if (MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE >= PSA_KEY_EXPORT_RSA_KEY_PAIR_MAX_SIZE(4096)) 529 #define MBEDTLS_TEST_STATIC_KEY_SLOTS_SUPPORT_RSA_4096 530 #endif 531 532 #if (MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE >= PSA_KEY_EXPORT_RSA_KEY_PAIR_MAX_SIZE(2048)) 533 #define MBEDTLS_TEST_STATIC_KEY_SLOTS_SUPPORT_RSA_2048 534 #endif 535 536 #endif /* MBEDTLS_PSA_CRYPTO_CLIENT */ 537 538 /* Helper macro to get the size of the each key slot buffer. */ 539 #if defined(MBEDTLS_PSA_STATIC_KEY_SLOTS) 540 #define MBEDTLS_PSA_KEY_BUFFER_MAX_SIZE MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE 541 #else 542 #define MBEDTLS_PSA_KEY_BUFFER_MAX_SIZE SIZE_MAX 543 #endif 544 545 /* Helper macro for the PK module to check whether MBEDTLS_PSA_STATIC_KEY_SLOT_BUFFER_SIZE 546 * is large enough to contain 4096-bit RSA key pairs. Of course this check is only 547 * necessary if PK relies on PSA (i.e. MBEDTLS_USE_PSA_CRYPTO) to store and manage 548 * the key. */ 549 #if defined(MBEDTLS_USE_PSA_CRYPTO) 550 551 #if !defined(MBEDTLS_PSA_STATIC_KEY_SLOTS) || \ 552 defined(MBEDTLS_TEST_STATIC_KEY_SLOTS_SUPPORT_RSA_4096) 553 #define MBEDTLS_TEST_PK_ALLOW_RSA_KEY_PAIR_4096 554 #endif 555 556 #else /* MBEDTLS_USE_PSA_CRYPTO */ 557 558 #define MBEDTLS_TEST_PK_ALLOW_RSA_KEY_PAIR_4096 559 560 #endif /* MBEDTLS_USE_PSA_CRYPTO */ 561 562 #endif /* PSA_CRYPTO_HELPERS_H */