psa_asymmetric_encrypt() doesn't work with opaque driver

[michael2012z]

Summary

I am creating an opaque driver which talks to a secure element (in our case it's TF-M). The driver supports entries asymmetric_encrypt and asymmetric_decrypt.

In the application, we generated a key at first with the driver successfully, then we tried to call psa_asymmetric_encrypt() with the key. But the check failed here https://github.com/Mbed-TLS/mbedtls/blob/91aaba0172dfa1c740bc67a12bc201bad4cd509c/library/psa_crypto.c#L1146C4-L1146C4 in psa_get_and_lock_transparent_key_slot_with_policy().

Seemingly the psa_asymmetric_encrypt() assumes that key must be a transparent one and can not be external. The limitation doesn't work with an opaque driver.

System information

Mbed TLS version: v3.4.0
Operating system and version: Linux Ubuntu 22.04
Configuration (if not default, please attach mbedtls_config.h):
Compiler and options (if you used a pre-built binary, please indicate how you obtained it):
Additional environment information:

Expected behavior

In psa_asymmetric_encrypt(), the checks before invoking psa_driver_wrapper_asymmetric_encrypt() should pass.

Additional information

Same problem is also seen in psa_asymmetric_decrypt()

[gilles-peskine-arm]

We intended for this to work, but evidently missed a part of the implementation and aren't testing this adequately.

[adeaarm]

@david-hazi-arm FYI