File pk.h

Public Key abstraction layer.

Defines

MBEDTLS_PK_HAVE_PRIVATE_HEADER
MBEDTLS_ERR_PK_TYPE_MISMATCH

Type mismatch, eg attempt to do ECDSA with an RSA key

MBEDTLS_ERR_PK_FILE_IO_ERROR

Read/write of file failed.

MBEDTLS_ERR_PK_KEY_INVALID_VERSION

Unsupported key version

MBEDTLS_ERR_PK_KEY_INVALID_FORMAT

Invalid key tag or value.

MBEDTLS_ERR_PK_UNKNOWN_PK_ALG

Key algorithm is unsupported (only RSA and EC are supported).

MBEDTLS_ERR_PK_PASSWORD_REQUIRED

Private key password can’t be empty.

MBEDTLS_ERR_PK_PASSWORD_MISMATCH

Given private key password does not allow for correct decryption.

MBEDTLS_ERR_PK_INVALID_PUBKEY

The pubkey tag or value is invalid (only RSA and EC are supported).

MBEDTLS_ERR_PK_INVALID_ALG

The algorithm tag or value is invalid.

MBEDTLS_ERR_PK_UNKNOWN_NAMED_CURVE

Elliptic curve is unsupported (only NIST curves are supported).

MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE

Unavailable feature, e.g. RSA disabled for RSA key.

MBEDTLS_PK_SIGNATURE_MAX_SIZE

Maximum size of a signature made by mbedtls_pk_sign() and other signature functions.

MBEDTLS_PK_SIGNATURE_MAX_SIZE

Maximum size of a signature made by mbedtls_pk_sign() and other signature functions.

MBEDTLS_PK_USE_PSA_EC_DATA
MBEDTLS_PK_USE_PSA_RSA_DATA
MBEDTLS_PK_MAX_EC_PUBKEY_RAW_LEN
MBEDTLS_PK_MAX_RSA_PUBKEY_RAW_LEN
MBEDTLS_PK_MAX_PUBKEY_RAW_LEN
MBEDTLS_PK_ALG_ECDSA(hash_alg)

This helper exposes which ECDSA variant the PK module uses by default: this is deterministic ECDSA if available, or randomized otherwise.

Warning

This default algorithm selection might change in the future.

Typedefs

typedef struct mbedtls_pk_info_t mbedtls_pk_info_t
typedef struct mbedtls_pk_context mbedtls_pk_context

Public key container.

Enums

enum mbedtls_pk_sigalg_t

Values:

enumerator MBEDTLS_PK_SIGALG_NONE
enumerator MBEDTLS_PK_SIGALG_RSA_PKCS1V15
enumerator MBEDTLS_PK_SIGALG_RSA_PSS
enumerator MBEDTLS_PK_SIGALG_ECDSA

Functions

void mbedtls_pk_init(mbedtls_pk_context *ctx)

Initialize a mbedtls_pk_context (as empty). 

            After this, you want to populate the context using one of the
            following functions:
            - \c mbedtls_pk_wrap_psa()
            - \c mbedtls_pk_copy_from_psa()
            - \c mbedtls_pk_copy_public_from_psa()
            - \c mbedtls_pk_parse_key()
            - \c mbedtls_pk_parse_public_key()
            - \c mbedtls_pk_parse_keyfile()
            - \c mbedtls_pk_parse_public_keyfile()
Parameters:

ctx – The context to initialize. This must not be NULL.

void mbedtls_pk_free(mbedtls_pk_context *ctx)

Empty a mbedtls_pk_context. After this, the context can be re-used as if it had been freshly initialized.

Note

For contexts that have been populated with mbedtls_pk_wrap_psa(), this does not free the underlying PSA key and you still need to call psa_destroy_key() independently if you want to destroy that key.

Parameters:

ctx – The context to clear. It must have been initialized. If this is NULL, this function does nothing.

void mbedtls_pk_restart_init(mbedtls_pk_restart_ctx *ctx)

Initialize a restart context.

Parameters:

ctx – The context to initialize. This must not be NULL.

void mbedtls_pk_restart_free(mbedtls_pk_restart_ctx *ctx)

Free the components of a restart context.

Parameters:

ctx – The context to clear. It must have been initialized. If this is NULL, this function does nothing.

int mbedtls_pk_wrap_psa(mbedtls_pk_context *ctx, const mbedtls_svc_key_id_t key)

Populate a PK context by wrapping a PSA key pair.

The PSA key must be an EC or RSA key pair (FFDH is not suported in PK).

The resulting context can only perform operations that are allowed by the key’s policy. Additionally, it currently has the following limitations:

  • restartable operations can’t be used;

  • for RSA keys, signature verification is not supported.

Warning

The PSA wrapped key must remain valid as long as the wrapping PK context is in use, that is at least between the point this function is called and the point mbedtls_pk_free() is called on this context.

Parameters:

  • ctx – The context to populate. It must be empty.

  • key – The PSA key to wrap, which must hold an ECC or RSA key pair.

Returns:

0 on success.

Returns:

PSA_ERROR_INVALID_ARGUMENT on invalid input (context already used, invalid key identifier).

Returns:

MBEDTLS_ERR_PK_FEATURE_UNAVAILABLE if the key is not an ECC or RSA key pair.

Returns:

PSA_ERROR_INSUFFICIENT_MEMORY on allocation failure.

size_t mbedtls_pk_get_bitlen(const mbedtls_pk_context *ctx)

Get the size in bits of the underlying key.

Parameters:

ctx – The context to query. It must have been populated.

Returns:

Key size in bits, or 0 on error

int mbedtls_pk_can_do_psa(const mbedtls_pk_context *pk, psa_algorithm_t alg, psa_key_usage_t usage)

Tell if the key wrapped in the PK context is able to perform the usage operation using the alg algorithm.

The operation may be a PK function, a PSA operation on the underlying PSA key if the PK object wraps a PSA key, or a PSA operation on a key obtained with mbedtls_pk_import_into_psa().

Note

As of TF-PSA-Crypto 1.0.0, this function returns 0 if the key type and policy are suitable for the requested algorithm and usage, even if the key would not work for some other reason, for example an RSA key that is too small for OAEP with the specified hash. This behavior may change without notice in future versions of the library.

Parameters:
Returns:

1 if the key can do operation on the given type.

Returns:

0 if the key cannot do the operations, or the context has not been populated.

int mbedtls_pk_get_psa_attributes(const mbedtls_pk_context *pk, psa_key_usage_t usage, psa_key_attributes_t *attributes)

Determine valid PSA attributes that can be used to import a key into PSA.

The attributes determined by this function are suitable for calling mbedtls_pk_import_into_psa() to create a PSA key with the same key material.

The typical flow of operations involving this function is 

psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
int ret = mbedtls_pk_get_psa_attributes(pk, &attributes);
if (ret != 0) ...; // error handling omitted
// Tweak attributes if desired
psa_key_id_t key_id = 0;
ret = mbedtls_pk_import_into_psa(pk, &attributes, &key_id);
if (ret != 0) ...; // error handling omitted

Parameters:

  • pk – [in] The PK context to use. It must have been populated. It can either contain a key pair or just a public key.

  • usage – A single PSA_KEY_USAGE_xxx flag among the following:

  • attributes – [out] On success, valid attributes to import the key into PSA.

    • The lifetime and key identifier are unchanged. If the attribute structure was initialized or reset before calling this function, this will result in a volatile key. Call psa_set_key_identifier() before or after this function if you wish to create a persistent key. Call psa_set_key_lifetime() before or after this function if you wish to import the key in a secure element.

    • The key type and bit-size are determined by the contents of the PK context. If the PK context contains a key pair, the key type can be either a key pair type or the corresponding public key type, depending on usage. If the PK context contains a public key, the key type is a public key type.

    • The key’s policy is determined by the key type and the usage parameter. The usage always allows usage, exporting and copying the key, and possibly other permissions as documented for the usage parameter. The enrolment algorithm (if available in this build) is left unchanged. For keys created with mbedtls_pk_wrap_psa(), the primary algorithm is the same as the original PSA key. Otherwise, it is determined as follows:

Returns:

0 on success. MBEDTLS_ERR_PK_TYPE_MISMATCH if pk does not contain a key compatible with the desired usage. Another error code on other failures.

psa_key_type_t mbedtls_pk_get_key_type(const mbedtls_pk_context *pk)

Get the PSA key type corresponding to the key represented by the given PK context.

Parameters:

pk – The context to query. It must already be initialized.

Returns:

A PSA key type. Specifically, one of:

Returns:

PSA_KEY_TYPE_NONE, if the context has not been populated.

int mbedtls_pk_import_into_psa(const mbedtls_pk_context *pk, const psa_key_attributes_t *attributes, mbedtls_svc_key_id_t *key_id)

Import a key into the PSA key store.

This function is equivalent to calling psa_import_key() with the key material from pk.

The typical way to use this function is:

  1. Call mbedtls_pk_get_psa_attributes() to obtain attributes for the given key.

  2. If desired, modify the attributes, for example:

    • To create a persistent key, call psa_set_key_identifier() and optionally psa_set_key_lifetime().

    • To import only the public part of a key pair: 

      psa_set_key_type(&attributes,
                 PSA_KEY_TYPE_PUBLIC_KEY_OF_KEY_PAIR(
                     psa_get_key_type(&attributes)));

    • Restrict the key usage if desired.

  3. Call mbedtls_pk_import_into_psa().

Parameters:

  • pk – [in] The PK context to use. It must have been populated. It can either contain a key pair or just a public key.

  • attributes – [in] The attributes to use for the new key. They must be compatible with pk. In particular, the key type must match the content of pk. If pk contains a key pair, the key type in attributes can be either the key pair type or the corresponding public key type (to import only the public part).

  • key_id – [out] On success, the identifier of the newly created key. On error, this is MBEDTLS_SVC_KEY_ID_INIT.

Returns:

0 on success. MBEDTLS_ERR_PK_TYPE_MISMATCH if pk does not contain a key of the type identified in attributes. Another error code on other failures.

int mbedtls_pk_copy_from_psa(mbedtls_svc_key_id_t key_id, mbedtls_pk_context *pk)

Populate a PK context with the key material from a PSA key. 

            This key:
            - must be exportable and
            - must be an RSA or EC key pair or public key
              (FFDH is not supported in PK).

            Once this function returns the PK object will be completely
            independent from the original PSA key that it was generated
            from.

If you want to retain the PSA policy, see mbedtls_pk_wrap_psa() - but then the PSA key needs to live at least as long as the PK context.

Note

This function only copies the key material but discards policy information entirely. See mbedtls_pk_get_psa_attributes() for details on which algorithm is going to be used by PK for contexts populated with this function.

Parameters:

  • key_id – The key identifier of the key stored in PSA.

  • pk – The PK context to populate. It must be empty.

Returns:

0 on success.

Returns:

PSA_ERROR_INVALID_ARGUMENT in case the provided input parameters are not correct.

int mbedtls_pk_copy_public_from_psa(mbedtls_svc_key_id_t key_id, mbedtls_pk_context *pk)

Populate a PK context with the public key material of a PSA key.

The key must be an RSA or ECC key. It can be either a public key or a key pair, and only the public key is copied.

Once this function returns the PK object will be completely independent from the original PSA key that it was generated from.

If you want to retain the PSA policy, see mbedtls_pk_wrap_psa() - but then the PSA key needs to live at least as long as the PK context.

Note

This function only copies the key material but discards policy information entirely. See mbedtls_pk_get_psa_attributes() for details on which algorithm is going to be used by PK for contexts populated with this function.

Parameters:

  • key_id – The key identifier of the key stored in PSA.

  • pk – The PK context to populate. It must be empty.

Returns:

0 on success.

Returns:

PSA_ERROR_INVALID_ARGUMENT in case the provided input parameters are not correct.

int mbedtls_pk_verify(mbedtls_pk_context *ctx, mbedtls_md_type_t md_alg, const unsigned char *hash, size_t hash_len, const unsigned char *sig, size_t sig_len)

Verify signature.

Note

The signature algorithm used will be the one that would be selected by mbedtls_pk_get_psa_attributes() called with a usage of PSA_KEY_USAGE_VERIFY_HASH - see that function’s documentation for details. If you want to select a specific signature algorithm, see mbedtls_pk_verify_ext().

Note

This function currently does not work on RSA keys created with mbedtls_pk_wrap_psa().

Parameters:

  • ctx – The PK context to use. It must have been populated.

  • md_alg – Hash algorithm used.

  • hash – Hash of the message to sign

  • hash_len – Hash length

  • sig – Signature to verify

  • sig_len – Signature length

Returns:

0 on success (signature is valid), PSA_ERROR_INVALID_SIGNATURE if the signature is invalid, or another specific error code.

int mbedtls_pk_verify_restartable(mbedtls_pk_context *ctx, mbedtls_md_type_t md_alg, const unsigned char *hash, size_t hash_len, const unsigned char *sig, size_t sig_len, mbedtls_pk_restart_ctx *rs_ctx)

Restartable version of mbedtls_pk_verify().

Note

Performs the same job as mbedtls_pk_verify(), but can return early and restart according to the limit set with psa_interruptible_set_max_ops() to reduce blocking for ECC operations. For RSA, same as mbedtls_pk_verify().

Parameters:

  • ctx – The PK context to use. It must have been populated.

  • md_alg – Hash algorithm used

  • hash – Hash of the message to sign

  • hash_len – Hash length

  • sig – Signature to verify

  • sig_len – Signature length

  • rs_ctx – Restart context (NULL to disable restart)

Returns:

See mbedtls_pk_verify(), or

Returns:

PSA_OPERATION_INCOMPLETE if maximum number of operations was reached: see psa_interruptible_set_max_ops().

int mbedtls_pk_verify_ext(mbedtls_pk_sigalg_t type, mbedtls_pk_context *ctx, mbedtls_md_type_t md_alg, const unsigned char *hash, size_t hash_len, const unsigned char *sig, size_t sig_len)

Verify signature, selecting a specific algorithm.

Note

If type is MBEDTLS_PK_SIGALG_RSA_PSS, then any salt length is accepted: PSA_ALG_RSA_PSS_ANY_SALT is used.

Parameters:

  • type – Signature type to verify

  • ctx – The PK context to use. It must have been populated.

  • md_alg – Hash algorithm used.

  • hash – Hash of the message to sign

  • hash_len – Hash length

  • sig – Signature to verify

  • sig_len – Signature length

Returns:

0 on success (signature is valid), MBEDTLS_ERR_PK_TYPE_MISMATCH if the PK context can’t be used for this type of signature, PSA_ERROR_INVALID_SIGNATURE if the signature is invalid, or a specific error code.

int mbedtls_pk_sign(mbedtls_pk_context *ctx, mbedtls_md_type_t md_alg, const unsigned char *hash, size_t hash_len, unsigned char *sig, size_t sig_size, size_t *sig_len)

Make signature.

Note

The signature algorithm used will be the one that would be selected by mbedtls_pk_get_psa_attributes() called with a usage of PSA_KEY_USAGE_SIGN_HASH - see that function’s documentation for details. If you want to select a specific signature algorithm, see mbedtls_pk_sign_ext().

Parameters:

  • ctx – The PK context to use. It must have been populated with a private key.

  • md_alg – Hash algorithm used

  • hash – Hash of the message to sign

  • hash_len – Hash length

  • sig – Place to write the signature. It must have enough room for the signature. MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. You may use a smaller buffer if it is large enough given the key type.

  • sig_size – The size of the sig buffer in bytes.

  • sig_len – On successful return, the number of bytes written to sig.

Returns:

0 on success, or a specific error code.

int mbedtls_pk_sign_restartable(mbedtls_pk_context *ctx, mbedtls_md_type_t md_alg, const unsigned char *hash, size_t hash_len, unsigned char *sig, size_t sig_size, size_t *sig_len, mbedtls_pk_restart_ctx *rs_ctx)

Restartable version of mbedtls_pk_sign().

Note

Performs the same job as mbedtls_pk_sign(), but can return early and restart according to the limit set with psa_interruptible_set_max_ops() to reduce blocking for ECC operations. For RSA, same as mbedtls_pk_sign().

Note

For ECC keys, always uses MBEDTLS_PK_ALG_ECDSA(hash), where hash is the PSA alg identifier corresponding to hash.

Note

This function currently does not work on ECC keys created with mbedtls_pk_wrap_psa().

Parameters:

  • ctx – The PK context to use. It must have been populated with a private key.

  • md_alg – Hash algorithm used.

  • hash – Hash of the message to sign

  • hash_len – Hash length

  • sig – Place to write the signature. It must have enough room for the signature. MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. You may use a smaller buffer if it is large enough given the key type.

  • sig_size – The size of the sig buffer in bytes.

  • sig_len – On successful return, the number of bytes written to sig.

  • rs_ctx – Restart context (NULL to disable restart)

Returns:

See mbedtls_pk_sign().

Returns:

PSA_OPERATION_INCOMPLETE if the maximum number of operations was reached: see psa_interruptible_set_max_ops().

int mbedtls_pk_sign_ext(mbedtls_pk_sigalg_t sig_type, mbedtls_pk_context *ctx, mbedtls_md_type_t md_alg, const unsigned char *hash, size_t hash_len, unsigned char *sig, size_t sig_size, size_t *sig_len)

Generate a signature, selecting a specific algorithm.

Parameters:

  • sig_type – Signature type to generate.

  • ctx – The PK context to use. It must have been populated with a private key.

  • md_alg – Hash algorithm used

  • hash – Hash of the message to sign

  • hash_len – Hash length

  • sig – Place to write the signature. It must have enough room for the signature. MBEDTLS_PK_SIGNATURE_MAX_SIZE is always enough. You may use a smaller buffer if it is large enough given the key type.

  • sig_size – The size of the sig buffer in bytes.

  • sig_len – On successful return, the number of bytes written to sig.

Returns:

0 on success, MBEDTLS_ERR_PK_TYPE_MISMATCH if the PK context can’t be used for this type of signature, or a specific error code.

int mbedtls_pk_check_pair(const mbedtls_pk_context *pub, const mbedtls_pk_context *prv)

Check if a public-private pair of keys matches.

Parameters:

  • pub – Context holding a public key.

  • prv – Context holding a private (and public) key.

Returns:

0 on success (keys were checked and match each other).

Returns:

PSA_ERROR_INVALID_ARGUMENT if a context is invalid.

Returns:

Another non-zero value if the keys do not match.

int mbedtls_pk_parse_key(mbedtls_pk_context *ctx, const unsigned char *key, size_t keylen, const unsigned char *pwd, size_t pwdlen)

Parse a private key in PEM or DER format.

Note

If you need a specific key type, check the result with mbedtls_pk_can_do_psa().

Note

The key is also checked for correctness.

Parameters:

  • ctx – The PK context to populate. It must be empty.

  • key – Input buffer to parse. The buffer must contain the input exactly, with no extra trailing material. For PEM, the buffer must contain a null-terminated string.

  • keylen – Size of key in bytes. For PEM data, this includes the terminating null byte, so keylen must be equal to strlen(key) + 1.

  • pwd – Optional password for decryption. Pass NULL if expecting a non-encrypted key. Pass a string of pwdlen bytes if expecting an encrypted key; a non-encrypted key will also be accepted. The empty password is not supported.

  • pwdlen – Size of the password in bytes. Ignored if pwd is NULL.

Returns:

0 if successful, or a specific PK or PEM error code

int mbedtls_pk_parse_public_key(mbedtls_pk_context *ctx, const unsigned char *key, size_t keylen)

Parse a public key in PEM or DER format.

Note

If you need a specific key type, check the result with mbedtls_pk_can_do_psa().

Note

The key is also checked for correctness.

Parameters:

  • ctx – The PK context to populate. It must be empty.

  • key – Input buffer to parse. The buffer must contain the input exactly, with no extra trailing material. For PEM, the buffer must contain a null-terminated string.

  • keylen – Size of key in bytes. For PEM data, this includes the terminating null byte, so keylen must be equal to strlen(key) + 1.

Returns:

0 if successful, or a specific PK or PEM error code

int mbedtls_pk_parse_keyfile(mbedtls_pk_context *ctx, const char *path, const char *password)

Load and parse a private key.

Note

If you need a specific key type, check the result with mbedtls_pk_can_do_psa().

Note

The key is also checked for correctness.

Parameters:

  • ctx – The PK context to populate. It must be empty.

  • path – filename to read the private key from

  • password – Optional password to decrypt the file. Pass NULL if expecting a non-encrypted key. Pass a null-terminated string if expecting an encrypted key; a non-encrypted key will also be accepted. The empty password is not supported.

Returns:

0 if successful, or a specific PK or PEM error code

int mbedtls_pk_parse_public_keyfile(mbedtls_pk_context *ctx, const char *path)

Load and parse a public key.

Note

If you need a specific key type, check the result with mbedtls_pk_can_do_psa().

Note

The key is also checked for correctness.

Parameters:

  • ctx – The PK context to populate. It must be empty.

  • path – filename to read the public key from

Returns:

0 if successful, or a specific PK or PEM error code

int mbedtls_pk_write_key_der(const mbedtls_pk_context *ctx, unsigned char *buf, size_t size)

Write a private key to a PKCS#1 or SEC1 DER structure Note: data is written at the end of the buffer! Use the return value to determine where you should start using the buffer.

Parameters:

  • ctx – PK context which must contain a valid private key.

  • buf – buffer to write to

  • size – size of the buffer

Returns:

length of data written if successful, or a specific error code

int mbedtls_pk_write_pubkey_der(const mbedtls_pk_context *ctx, unsigned char *buf, size_t size)

Write a public key to a SubjectPublicKeyInfo DER structure Note: data is written at the end of the buffer! Use the return value to determine where you should start using the buffer.

Parameters:

  • ctx – PK context which must contain a valid public or private key.

  • buf – buffer to write to

  • size – size of the buffer

Returns:

length of data written if successful, or a specific error code

int mbedtls_pk_write_pubkey_pem(const mbedtls_pk_context *ctx, unsigned char *buf, size_t size)

Write a public key to a PEM string.

Parameters:

  • ctx – PK context which must contain a valid public or private key.

  • buf – Buffer to write to. The output includes a terminating null byte.

  • size – Size of the buffer in bytes.

Returns:

0 if successful, or a specific error code

int mbedtls_pk_write_key_pem(const mbedtls_pk_context *ctx, unsigned char *buf, size_t size)

Write a private key to a PKCS#1 or SEC1 PEM string.

Parameters:

  • ctx – PK context which must contain a valid private key.

  • buf – Buffer to write to. The output includes a terminating null byte.

  • size – Size of the buffer in bytes.

Returns:

0 if successful, or a specific error code

int mbedtls_pk_write_pubkey_psa(const mbedtls_pk_context *ctx, unsigned char *buf, size_t buf_size, size_t *buf_len)

Write the public key of the provided PK context in “PSA friendly” format.

Note

“PSA friendly” format means that the obtained output buffer can be directly imported into PSA using psa_import_key() without any modification.

Parameters:

  • ctx – PK context from which the public key is extracted. It must have been populated.

  • buf – Output buffer where the public key is written. It must not be NULL.

  • buf_size – Size of buf buffer in bytes. PSA_EXPORT_PUBLIC_KEY_MAX_SIZE can be used as safe value that fit all the key types enabled in the build of the PSA Crypto Core. Otherwise the following more accurate values can be used:

  • buf_len – Amount of bytes written into buf if the exporting operation is successful. In case of failure the value is 0. It must not be NULL.

Returns:

0 if successful.

Returns:

MBEDTLS_ERR_PK_BAD_INPUT_DATA if ctx has not been populated.

Returns:

MBEDTLS_ERR_PK_BUFFER_TOO_SMALL if the provided output buffer is too small to contain the public key.

struct mbedtls_pk_context
#include <pk.h>

Public key container.

Public Members

const mbedtls_pk_info_t *private_pk_info
psa_key_type_t private_psa_type
mbedtls_svc_key_id_t private_priv_id
uint8_t private_pub_raw[MBEDTLS_PK_MAX_PUBKEY_RAW_LEN]
size_t private_pub_raw_len
size_t private_bits
psa_ecc_family_t private_ec_family
struct mbedtls_pk_restart_ctx
#include <pk.h>

Context for resuming operations.

Public Members

const mbedtls_pk_info_t *private_pk_info
void *private_rs_ctx