@@ -1382,10 +1382,17 @@ int xOtaProvisionCodeSigningKey( psa_key_handle_t * pxKeyHandle,
13821382 size_t xPubKeyDerLength = DER_FORMAT_BUFFER_LENGTH ;
13831383 size_t xPubKeyPemLength = strlen ( ( const char * ) pxProvisioningParamsBundle -> codeSigningPublicKey );
13841384 int result = 0 ;
1385+ psa_status_t status = PSA_SUCCESS ;
13851386 psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT ;
1386- mbedtls_pk_context xMbedPkContext = { 0 };
13871387
1388- mbedtls_pk_init ( & xMbedPkContext );
1388+ #ifdef AWS_OTA_SIGN_RSA
1389+ mbedtls_pk_context xMbedPkContext = { 0 };
1390+ #elif AWS_OTA_SIGN_ECDSA
1391+ uint8_t * pucPubKeyDerFormatBufferEcdsaAligned = pucPubKeyDerFormatBuffer + AWS_OTA_ECDSA_HEADER_SIZE ;
1392+ size_t xPubKeyDerLengthEcdsaAligned ;
1393+ #else /* ifdef AWS_OTA_SIGN_RSA */
1394+ #error "Unknown crypto algorithm, supportted algorithms are EC and RSA!"
1395+ #endif
13891396
13901397 result = convert_pem_to_der ( ( const unsigned char * ) pxProvisioningParamsBundle -> codeSigningPublicKey ,
13911398 xPubKeyPemLength ,
@@ -1394,59 +1401,73 @@ int xOtaProvisionCodeSigningKey( psa_key_handle_t * pxKeyHandle,
13941401
13951402 if ( result != 0 )
13961403 {
1397- goto exit ;
1404+ return result ;
13981405 }
13991406
1400- /*
1401- * From mbedtls 3.6.0 release note:
1402- *
1403- * Default behavior changes
1404- * psa_import_key() now only accepts RSA keys in the PSA standard formats.
1405- * The undocumented ability to import other formats (PKCS#8, SubjectPublicKey,
1406- * PEM) accepted by the pkparse module has been removed. Applications that
1407- * need these formats can call mbedtls_pk_parse_{public,}key() followed by
1408- * mbedtls_pk_import_into_psa().
1409- */
1410-
1411- result = mbedtls_pk_parse_public_key ( & xMbedPkContext ,
1412- ( const unsigned char * ) pucPubKeyDerFormatBuffer ,
1413- xPubKeyDerLength );
1414-
1415- if ( result != 0 )
1416- {
1417- goto exit ;
1418- }
1419-
1420- result = mbedtls_pk_get_psa_attributes ( & xMbedPkContext ,
1421- PSA_KEY_USAGE_VERIFY_HASH ,
1422- & attributes );
1423-
1424- if ( result != 0 )
1425- {
1426- goto exit ;
1427- }
1428-
1429- #ifdef PSA_CRYPTO_IMPLEMENTATION_MBEDTLS
1430- psa_set_key_lifetime ( & attributes , PSA_KEY_LIFETIME_VOLATILE );
1431- #endif
1407+ #ifdef AWS_OTA_SIGN_RSA
1408+ mbedtls_pk_init ( & xMbedPkContext );
1409+
1410+ /*
1411+ * From mbedtls 3.6.0 release note:
1412+ *
1413+ * Default behavior changes
1414+ * psa_import_key() now only accepts RSA keys in the PSA standard formats.
1415+ * The undocumented ability to import other formats (PKCS#8, SubjectPublicKey,
1416+ * PEM) accepted by the pkparse module has been removed. Applications that
1417+ * need these formats can call mbedtls_pk_parse_{public,}key() followed by
1418+ * mbedtls_pk_import_into_psa().
1419+ */
1420+ result = mbedtls_pk_parse_public_key ( & xMbedPkContext ,
1421+ ( const unsigned char * ) pucPubKeyDerFormatBuffer ,
1422+ xPubKeyDerLength );
1423+
1424+ if ( result != 0 )
1425+ {
1426+ mbedtls_pk_free ( & xMbedPkContext );
1427+ return result ;
1428+ }
14321429
1433- psa_set_key_algorithm ( & attributes , PSA_ALG_RSA_PSS_ANY_SALT ( PSA_ALG_SHA_256 ) );
1434- psa_set_key_bits ( & attributes , keyBits );
1430+ result = mbedtls_pk_get_psa_attributes ( & xMbedPkContext ,
1431+ PSA_KEY_USAGE_VERIFY_HASH ,
1432+ & attributes );
14351433
1436- result = mbedtls_pk_import_into_psa ( & xMbedPkContext ,
1437- & attributes ,
1438- pxKeyHandle );
1434+ if ( result != 0 )
1435+ {
1436+ mbedtls_pk_free ( & xMbedPkContext );
1437+ return result ;
1438+ }
14391439
1440- if ( result != 0 )
1441- {
1440+ #ifdef PSA_CRYPTO_IMPLEMENTATION_MBEDTLS
1441+ psa_set_key_lifetime ( & attributes , PSA_KEY_LIFETIME_VOLATILE );
1442+ #endif
1443+
1444+ psa_set_key_bits ( & attributes , keyBits );
1445+ psa_set_key_algorithm ( & attributes , PSA_ALG_RSA_PSS_ANY_SALT ( PSA_ALG_SHA_256 ) );
1446+ status = mbedtls_pk_import_into_psa ( & xMbedPkContext ,
1447+ & attributes ,
1448+ pxKeyHandle );
1449+ #elif AWS_OTA_SIGN_ECDSA
1450+ xPubKeyDerLengthEcdsaAligned = xPubKeyDerLength - AWS_OTA_ECDSA_HEADER_SIZE ;
1451+ #ifdef PSA_CRYPTO_IMPLEMENTATION_MBEDTLS
1452+ psa_set_key_lifetime ( & attributes , PSA_KEY_LIFETIME_VOLATILE );
1453+ #endif
1454+ psa_set_key_bits ( & attributes , keyBits );
1455+ psa_set_key_usage_flags ( & attributes , PSA_KEY_USAGE_VERIFY_HASH );
1456+ psa_set_key_algorithm ( & attributes , PSA_ALG_ECDSA ( PSA_ALG_SHA_256 ) );
1457+ psa_set_key_type ( & attributes , PSA_KEY_TYPE_ECC_PUBLIC_KEY ( PSA_ECC_FAMILY_SECP_R1 ) );
1458+ status = psa_import_key ( & attributes , ( const uint8_t * ) pucPubKeyDerFormatBufferEcdsaAligned ,
1459+ xPubKeyDerLengthEcdsaAligned , pxKeyHandle );
1460+ #endif /* ifdef AWS_OTA_SIGN_RSA */
1461+
1462+ if ( status != PSA_SUCCESS )
1463+ {
1464+ #ifdef AWS_OTA_SIGN_RSA
1465+ mbedtls_pk_free ( & xMbedPkContext );
1466+ #endif
14421467 * pxKeyHandle = NULL ;
1443- goto exit ;
14441468 }
14451469
1446- exit :
1447- mbedtls_pk_free ( & xMbedPkContext );
1448-
1449- return result ;
1470+ return status ;
14501471}
14511472
14521473UBaseType_t uxIsDeviceProvisioned ( void )
0 commit comments