lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-08-01 10:06:53 +03:00
Code Activity

Refuse to destroy read-only keys

Browse Source 
Signed-off-by: Gilles Peskine <Gilles.Peskine@arm.com>
This commit is contained in:
Gilles Peskine
2021-04-21 22:32:05 +02:00
parent 576464873a
commit 6687cd07f3
2 changed files with 17 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
library/psa_crypto.c
View File

@ -1052,6 +1052,18 @@ psa_status_t psa_destroy_key( mbedtls_svc_key_id_t key )
return( PSA_ERROR_GENERIC_ERROR );
}
if( PSA_KEY_LIFETIME_IS_READ_ONLY( slot->attr.lifetime ) )
{
/* Refuse the destruction of a read-only key (which may or may not work
* if we attempt it, depending on whether the key is merely read-only
* by policy or actually physically read-only).
* Just do the best we can, which is to wipe the copy in memory. */
status = psa_wipe_key_slot( slot );
if( status != PSA_SUCCESS )
return( status );
return( PSA_ERROR_NOT_PERMITTED );
}
#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
driver = psa_get_se_driver_entry( slot->attr.lifetime );
if( driver != NULL )