Add Application Secrets TEE client library

[tusal-vaisala]

Related optee_os PR: OP-TEE/optee_os#7769

Addresses issue: OP-TEE/optee_os#7768

[jforissier]

Hi @tusal-vaisala,

Thanks for the PR. This looks like a useful feature and easy to use. Please see my comments below.

[jforissier]

Style: !plain_len

To implement the contract in the proposed API documentation update above, we would need to add:

if (!sealed && *sealed_len)
	return TEEC_ERROR_BAD_PARAMETERS;

[jforissier]

Assuming the proposed API update and for consistency with asteec_seal():

Suggested change

	if (!sealed || !plain_len)
	return TEEC_ERROR_BAD_PARAMETERS;
	if (!sealed || !sealed_len || !plain_len)
	return TEEC_ERROR_BAD_PARAMETERS;
	if (!plain && *plain_len)
	return TEEC_ERROR_BAD_PARAMETERS;

[jforissier]

I suggest making the build of this library optional like for libteecacl:

option(WITH_ASTEEC "Build libasteec" TRUE)

[jforissier]

I recommend being explicit bout output size querying:

Suggested change

	* @param sealed Pointer to buffer to receive sealed secret datablob
	* @param sealed_len Byte length of buffer @sealed, updated with actual size
	* @param sealed Pointer to buffer to receive sealed secret datablob.
	* May be NULL when *sealed_len is 0 to query the
	* required output size.
	* @param sealed_len On input, byte length of buffer @sealed. On output,
	* updated with the actual size on success or the required
	* size when TEEC_ERROR_SHORT_BUFFER is returned.

I have not checked if this would require changes in the TA implementation though

[tusal-vaisala]

Thanks for the review! Added a fixup with all proposed changes. The TA already supports querying the output buffer size, so no changes needed there regarding this.

[jforissier]

And here:

Suggested change

	* @param plain Pointer to buffer to receive plain secret
	* @param plain_len Byte length of buffer @plain, updated with actual size
	* @param plain Pointer to buffer to receive plain secret.
	* May be NULL when *plain_len is 0 to query the
	* required output size.
	* @param plain_len On input, byte length of buffer @plain. On output,
	* updated with the actual size on success or the required
	* size when TEEC_ERROR_SHORT_BUFFER is returned.

[jforissier]

Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>

[github-actions]

This pull request has been marked as a stale pull request because it has been open (more than) 30 days with no activity. Remove the stale label or add a comment, otherwise this pull request will automatically be closed in 5 days. Note, that you can always re-open a closed issue at any time.

[tusal-vaisala]

keep-alive