Skip to content

Fixing PSA key slot exhaustion problem#411

Open
ElsaLopez133 wants to merge 3 commits intolake-rs:mainfrom
ElsaLopez133:pr-psa-memory-error
Open

Fixing PSA key slot exhaustion problem#411
ElsaLopez133 wants to merge 3 commits intolake-rs:mainfrom
ElsaLopez133:pr-psa-memory-error

Conversation

@ElsaLopez133
Copy link
Collaborator

Each p256_ecdh call imports a key into a PSA key slot, and if those slots aren't being freed after use, it runs out and PSA returns InsufficientMemory.

@ElsaLopez133 ElsaLopez133 marked this pull request as ready for review March 4, 2026 17:25
@chrysn
Copy link
Member

chrysn commented Mar 5, 2026

We're .unwrap()'ing the PSA results in other places as well. I don't think this should be an exception:

  • Either something goes wrong in terms of "the item you want to delete does not exist": then ignoring the error means we're ignoring an error in how we use PSA.
  • Or something goes wrong in terms of "oups your PSA coprocessor got unplugged": then this might just as well happen in the line above, and I'd prefer consistency.

key_agreement::raw_key_agreement(alg, my_key, &peer_public_key, &mut output_buffer)
.unwrap();

unsafe { key_management::destroy(my_key).unwrap() };
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
unsafe { key_management::destroy(my_key).unwrap() };
// SAFETY: The function demands that the Id is not used while destroyed.
// We did not hand out the Id `my_key` in the last few lines, so we can destroy it.
unsafe { key_management::destroy(my_key).unwrap() };

(Also, I feel reaffirmed in doing embedded-cal rather than fixing psa_crypto…)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants