psa_generate_key should return INVALID_ARGUMENT for a public key type

[hug-dev]

In the PSA Crypto documentation it is written for psa_generate_key returned errors:

PSA_ERROR_INVALID_ARGUMENT
The key type is an asymmetric public key type.

However the following snippet:

psa_status_t status;
psa_key_handle_t public_key_handle;

status = psa_crypto_init();
if (status != PSA_SUCCESS) {
        printf("Init failed (status = %d)\n", status);
        return 1;
}

psa_key_attributes_t key_pair_attributes = PSA_KEY_ATTRIBUTES_INIT;
psa_set_key_id(&key_pair_attributes, 1);
psa_set_key_lifetime(&key_pair_attributes, PSA_KEY_LIFETIME_PERSISTENT);
psa_set_key_usage_flags(&key_pair_attributes, PSA_KEY_USAGE_VERIFY_HASH);
psa_set_key_algorithm(&key_pair_attributes, PSA_ALG_ECDSA(PSA_ALG_SHA_256));
psa_set_key_type(&key_pair_attributes, PSA_KEY_TYPE_ECC_PUBLIC_KEY(PSA_ECC_CURVE_SECP_R1));
psa_set_key_bits(&key_pair_attributes, 256U);

status = psa_generate_key(&key_pair_attributes, &key_pair_handle);
if (status != PSA_SUCCESS) {
        printf("Key generation failed (status = %d)\n", status);
        return 1;
}

prints

Key generation failed (status = -134)

which is PSA_ERROR_NOT_SUPPORTED (instead of -135).

Maybe I am wrong an PSA_ERROR_NOT_SUPPORTED is also a valid return value here!

This was tested with mbedtls-2.25.0.

[gilles-peskine-arm]

PSA_ERROR_NOT_SUPPORTED is a valid return value for psa_generate_key, but it's meant for cases like requesting an RSA private key when the implementation is built without RSA support. If you attempt to generate a public key, PSA_ERROR_INVALID_ARGUMENT makes more sense.

[mprse]

@gilles-peskine-arm I reproduced this locally. Can I investigate this one?

[gilles-peskine-arm]

@mprse Yes, please!