yuzu-emu/mbedtls
1
0
Fork 0
mirror of https://github.com/yuzu-emu/mbedtls.git synced 2024-11-27 07:54:18 +01:00
Code Issues Packages Projects Releases Wiki Activity

Clarify some policy-handling code comments

Browse Source 
Signed-off-by: Steven Cooreman <steven.cooreman@silabs.com>
This commit is contained in:
Steven Cooreman 2021-03-03 20:47:40 +01:00
parent f9f7fdfe49
commit 31a876da09
1 changed files with 18 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
library/psa_crypto.c
View File

@ -756,9 +756,11 @@ static psa_algorithm_t psa_key_policy_algorithm_intersection(
if( PSA_SUCCESS != psa_mac_key_can_do( alg1, key_type ) ) if( PSA_SUCCESS != psa_mac_key_can_do( alg1, key_type ) )
return( 0 ); return( 0 );
/* Get the output length for the algorithm and key combination. None of /* Get the (exact or at-least) output lengths for both sides of the
* the currently supported algorithms have an output length dependent on * requested intersection. None of the currently supported algorithms
* actual key size, so setting it to a bogus value is currently OK. * have an output length dependent on the actual key size, so setting it
* to a bogus value of 0 is currently OK.
*
* Note that for at-least-this-length wildcard algorithms, the output * Note that for at-least-this-length wildcard algorithms, the output
* length is set to the shortest allowed length, which allows us to * length is set to the shortest allowed length, which allows us to
* calculate the most restrictive tag length for the intersection. */ * calculate the most restrictive tag length for the intersection. */
@ -772,7 +774,10 @@ static psa_algorithm_t psa_key_policy_algorithm_intersection(
{ {
return( PSA_ALG_AT_LEAST_THIS_LENGTH_MAC( alg1, max_len ) ); return( PSA_ALG_AT_LEAST_THIS_LENGTH_MAC( alg1, max_len ) );
} }
/* If only one is a wildcard, return specific algorithm if compatible. */
/* If only one is an at-least-this-length policy, the intersection would
* be the other (fixed-length) policy as long as said fixed length is
* equal to or larger than the shortest allowed length. */
if( ( alg1 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG ) != 0 ) if( ( alg1 & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG ) != 0 )
{ {
if( alg1_len <= alg2_len ) if( alg1_len <= alg2_len )
@ -787,6 +792,7 @@ static psa_algorithm_t psa_key_policy_algorithm_intersection(
else else
return( 0 ); return( 0 );
} }
/* If none of them are wildcards, check whether this is a case of one /* If none of them are wildcards, check whether this is a case of one
* specifying the default length and the other a specific length. If the * specifying the default length and the other a specific length. If the
* specific length equals the default length for this key type, the * specific length equals the default length for this key type, the
@ -836,10 +842,11 @@ static int psa_key_algorithm_permits( psa_key_type_t key_type,
if( PSA_SUCCESS != psa_mac_key_can_do( policy_alg, key_type ) ) if( PSA_SUCCESS != psa_mac_key_can_do( policy_alg, key_type ) )
return( 0 ); return( 0 );
/* Get both the requested and the default output length for this /* Get both the requested output length for the algorithm which is to be
* algorithm and key combination. None of the currently supported * verified, and the default output length for the base algorithm.
* algorithms have an output length dependent on actual key size, so * Note that none of the currently supported algorithms have an output
* setting it to a bogus value is currently OK. */ * length dependent on actual key size, so setting it to a bogus value
* of 0 is currently OK. */
size_t requested_output_length = PSA_MAC_LENGTH( size_t requested_output_length = PSA_MAC_LENGTH(
key_type, 0, requested_alg ); key_type, 0, requested_alg );
size_t default_output_length = PSA_MAC_LENGTH( size_t default_output_length = PSA_MAC_LENGTH(
@ -859,9 +866,9 @@ static int psa_key_algorithm_permits( psa_key_type_t key_type,
return( 1 ); return( 1 );
} }
/* If policy_alg is a wildcard MAC algorithm of the same base as /* If policy_alg is an at-least-this-length wildcard MAC algorithm of
* the requested algorithm, check the requested tag length to be * the same base as the requested algorithm, check for the requested MAC
* equal-length or longer than the wildcard-specified length. */ * length to be equal to or longer than the minimum allowed length. */
if( ( policy_alg & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG ) != 0 ) if( ( policy_alg & PSA_ALG_MAC_AT_LEAST_THIS_LENGTH_FLAG ) != 0 )
{ {
return( PSA_MAC_TRUNCATED_LENGTH( policy_alg ) <= return( PSA_MAC_TRUNCATED_LENGTH( policy_alg ) <=