SharkSslPSAConsumerKeyWrap.h File Reference

#include "SharkSSL.h"

Go to the source code of this file.

Functions
SHARKSSL_API int	SharkSslPSAKeyWrap_wrap (psa_key_id_t kek, psa_algorithm_t algorithm, psa_key_id_t key, U8 *wrapped, U16 wrappedSize, U16 *wrappedLen)
	Wrap an exportable PSA key under a caller-owned AES key-encryption key. More...
SHARKSSL_API int	SharkSslPSAKeyWrap_unwrap (psa_key_id_t kek, psa_algorithm_t algorithm, const U8 *wrapped, U16 wrappedLen, const psa_key_attributes_t *attributes, psa_key_id_t *key)
	Unwrap to a new PSA key using caller-provided attributes. More...

Detailed Description

See Choose a SharkSSL API for build scope and the owning API layer.

Function Documentation

SharkSslPSAKeyWrap_unwrap()

int SharkSslPSAKeyWrap_unwrap	(	psa_key_id_t	kek,
		psa_algorithm_t	algorithm,
		const U8 *	wrapped,
		U16	wrappedLen,
		const psa_key_attributes_t *	attributes,
		psa_key_id_t *	key
	)

Unwrap to a new PSA key using caller-provided attributes.

The KEK must permit UNWRAP. The caller owns the returned key and must destroy it. Sets *key to PSA_KEY_ID_NULL on error.

Parameters

kek	psa_key_id_t; borrowed non-null AES key-encryption-key handle with unwrapping permission.
algorithm	psa_algorithm_t; PSA_ALG_KW or PSA_ALG_KWP matching the wrapped data and provider.
wrapped	const U8 *; required wrapped key bytes.
wrappedLen	U16; nonzero wrapped length in bytes.
attributes	const psa_key_attributes_t *; required requested attributes and policy for the new key, borrowed for this call.
key	psa_key_id_t *; required result handle; set to PSA_KEY_ID_NULL on failure. On success the caller owns the new key and must manage its lifetime.

Returns

int: 0 on success; -1 for invalid arguments, unsupported algorithms/policies, or provider failure.

SharkSslPSAKeyWrap_wrap()

int SharkSslPSAKeyWrap_wrap	(	psa_key_id_t	kek,
		psa_algorithm_t	algorithm,
		psa_key_id_t	key,
		U8 *	wrapped,
		U16	wrappedSize,
		U16 *	wrappedLen
	)

Wrap an exportable PSA key under a caller-owned AES key-encryption key.

The source and wrapping key remain owned by the caller.

The KEK must permit WRAP for algorithm PSA_ALG_KW or PSA_ALG_KWP; the input key must permit EXPORT. Clears wrapped and sets wrappedLen to zero on error.

With valid output arguments, wrapping failure clears the output buffer.

Parameters

kek	psa_key_id_t; borrowed non-null AES key-encryption-key handle with wrapping permission.
algorithm	psa_algorithm_t; PSA_ALG_KW or PSA_ALG_KWP, if declared and supported by the selected provider.
key	psa_key_id_t; borrowed handle of the key to wrap; its policy must permit wrapping.
wrapped	U8 *; required output buffer.
wrappedSize	U16; output capacity in bytes, including wrapping overhead.
wrappedLen	U16 *; required wrapped byte count; set to zero on failure.

Returns

int: 0 on success; -1 for invalid arguments, unsupported algorithms/policies, or provider failure.