parsec_interface/operations/
psa_raw_key_agreement.rs

1// Copyright 2020 Contributors to the Parsec project.
2// SPDX-License-Identifier: Apache-2.0
3//! # PsaRawKeyAgreement operation
4//!
5//! Perform a raw key agreement.
6
7use super::psa_key_attributes::Attributes;
8use crate::operations::psa_algorithm::{KeyAgreement, RawKeyAgreement};
9use derivative::Derivative;
10
11/// Native object for raw key agreement operation.
12#[derive(Derivative)]
13#[derivative(Debug)]
14pub struct Operation {
15    /// `alg` specifies the raw key agreement algorithm to use. It must allow the `derive` usage flag.
16    pub alg: RawKeyAgreement,
17    /// `private_key_name` specifies a name of the private key to use in the key agreement operation.
18    pub private_key_name: String,
19    /// `peer_key` contains the bytes of a peers public key, to be used in the key agreement operation.
20    /// This must be in the format that `PsaImportKey` accepts.
21    #[derivative(Debug = "ignore")]
22    pub peer_key: zeroize::Zeroizing<Vec<u8>>,
23}
24
25/// Native object for result for raw key agreement operation.
26#[derive(Derivative)]
27#[derivative(Debug)]
28pub struct Result {
29    /// `data` holds the bytes defining the key, formatted as specified
30    /// by the provider for which the request was made.
31    #[derivative(Debug = "ignore")]
32    pub shared_secret: crate::secrecy::Secret<Vec<u8>>,
33}
34
35impl Operation {
36    /// Validate the contents of the operation against the attributes of the key it targets
37    ///
38    /// This method checks that:
39    /// * the key policy allows derivation
40    /// * the key policy allows the key agreement algorithm requested in the operation
41    /// * the key type is compatible with the requested algorithm
42    pub fn validate(&self, key_attributes: Attributes) -> crate::requests::Result<()> {
43        key_attributes.can_derive_from()?;
44        key_attributes.permits_alg(KeyAgreement::Raw(self.alg).into())?;
45        key_attributes.compatible_with_alg(KeyAgreement::Raw(self.alg).into())?;
46
47        Ok(())
48    }
49}
50
51#[cfg(test)]
52mod tests {
53    use super::*;
54    use crate::operations::psa_algorithm::{KeyAgreement, RawKeyAgreement};
55    use crate::operations::psa_key_attributes::{EccFamily, Lifetime, Policy, Type, UsageFlags};
56    use crate::requests::ResponseStatus;
57
58    fn get_attrs() -> Attributes {
59        let mut usage_flags = UsageFlags::default();
60        let _ = usage_flags.set_derive();
61        Attributes {
62            lifetime: Lifetime::Persistent,
63            key_type: Type::EccKeyPair {
64                curve_family: EccFamily::SecpR1,
65            },
66            bits: 256,
67            policy: Policy {
68                usage_flags,
69                permitted_algorithms: KeyAgreement::Raw(RawKeyAgreement::Ecdh).into(),
70            },
71        }
72    }
73
74    #[test]
75    fn validate_success() {
76        (Operation {
77            private_key_name: String::from("some key"),
78            alg: RawKeyAgreement::Ecdh,
79            peer_key: vec![0xff, 32].into(),
80        })
81        .validate(get_attrs())
82        .unwrap();
83    }
84
85    #[test]
86    fn cannot_derive() {
87        let mut attrs = get_attrs();
88        attrs.policy.usage_flags = UsageFlags::default();
89        assert_eq!(
90            (Operation {
91                private_key_name: String::from("some key"),
92                alg: RawKeyAgreement::Ecdh,
93                peer_key: vec![0xff, 32].into(),
94            })
95            .validate(attrs)
96            .unwrap_err(),
97            ResponseStatus::PsaErrorNotPermitted
98        );
99    }
100
101    #[test]
102    fn wrong_algorithm() {
103        assert_eq!(
104            (Operation {
105                private_key_name: String::from("some key"),
106                alg: RawKeyAgreement::Ffdh,
107                peer_key: vec![0xff, 32].into(),
108            })
109            .validate(get_attrs())
110            .unwrap_err(),
111            ResponseStatus::PsaErrorNotPermitted
112        );
113    }
114}
parsec_interface/operations/psa_raw_key_agreement.rs

parsec_interface/operations/
psa_raw_key_agreement.rs
