Update to Mbed Crypto v2.0.0

parallaxsecond / parsec

Platform AbstRaction for SECurity service

https://parsec.community/

Apache License 2.0

468 stars 67 forks source link

Update to Mbed Crypto v2.0.0 #38

Closed ionut-arm closed 4 years ago

ionut-arm commented 4 years ago

We're currently using Mbed Crypto 1.1.0 which exposed an old version of PSA Crypto API.

After the interface work is done, we should update the version of mbed we pull to 2.0.0 and modify the way we create and handle keys (where necessary).

Changes that will probably be needed:

Updating the way Mbed Provider handles key creation (as per the new PSA spec)
Updating the way we deal with key lifetimes (deciding how this will be handled is WIP)
Adding permit_copy as a flag for key attributes

If providers will be forced to only support one key lifetime, a new issue shall be raised.

ionut-arm commented 4 years ago

This will also open up the possibility of changing the storage path of keys by defining PSA_ITS_STORAGE_PREFIX at compile time: https://github.com/ARMmbed/mbed-crypto/blob/development/library/psa_its_file.c#L48

ionut-arm commented 4 years ago

Based on the work done in #52, there is no intention to make the current mbed provider work with volatile keys.

A new/joint provider that will only work with such keys will be created at some point, but we'll have a new issue for that.

ionut-arm commented 4 years ago

We're going to find a workaround for a shortcoming in bindgen: https://github.com/rust-lang/rust-bindgen/issues/1344

Most of the functions for populating key attributes structures are defined as static inline. So we either have to populate things by hand or write our own FFI wrappers.