Added PsaExportKey

Signed-off-by: Samuel Bailey <samuel.bailey@arm.com>

Author: sbailey-arm

Cargo.toml

@@ -13,7 +13,7 @@ edition = "2018"
 documentation = "https://docs.rs/crate/parsec-client"
 
 [dependencies]
-parsec-interface = "0.18.0"
+parsec-interface = { path = "../parsec-interface-rs" }
 num = "0.2.1"
 rand = "0.7.3"
 log = "0.4.8"

src/core/basic_client.rs

@@ -11,6 +11,7 @@ use parsec_interface::operations::psa_algorithm::{AsymmetricEncryption, Asymmetr
 use parsec_interface::operations::psa_asymmetric_decrypt::Operation as PsaAsymDecrypt;
 use parsec_interface::operations::psa_asymmetric_encrypt::Operation as PsaAsymEncrypt;
 use parsec_interface::operations::psa_destroy_key::Operation as PsaDestroyKey;
+use parsec_interface::operations::psa_export_key::Operation as PsaExportKey;
 use parsec_interface::operations::psa_export_public_key::Operation as PsaExportPublicKey;
 use parsec_interface::operations::psa_generate_key::Operation as PsaGenerateKey;
 use parsec_interface::operations::psa_import_key::Operation as PsaImportKey;
@@ -19,7 +20,7 @@ use parsec_interface::operations::psa_sign_hash::Operation as PsaSignHash;
 use parsec_interface::operations::psa_verify_hash::Operation as PsaVerifyHash;
 use parsec_interface::operations::{NativeOperation, NativeResult};
 use parsec_interface::requests::{Opcode, ProviderID};
-use parsec_interface::secrecy::Secret;
+use parsec_interface::secrecy::{ExposeSecret, Secret};
 use std::collections::HashSet;
 use zeroize::Zeroizing;
 
@@ -422,6 +423,43 @@ impl BasicClient {
         }
     }
 
+    /// **[Cryptographic Operation]** Export a key.
+    ///
+    /// The returned key material will follow the appropriate binary format expressed
+    /// [here](https://parallaxsecond.github.io/parsec-book/parsec_client/operations/psa_export_key.html).
+    /// Several crates (e.g. [`picky-asn1`](https://crates.io/crates/picky-asn1))
+    /// can greatly help in dealing with binary encodings.
+    ///
+    /// # Errors
+    ///
+    /// If the implicit client provider is `ProviderID::Core`, a client error
+    /// of `InvalidProvider` type is returned.
+    ///
+    /// If the implicit client provider has not been set, a client error of
+    /// `NoProvider` type is returned.
+    ///
+    /// See the operation-specific response codes returned by the service
+    /// [here](https://parallaxsecond.github.io/parsec-book/parsec_client/operations/psa_export_key.html#specific-response-status-codes).
+    pub fn psa_export_key(&self, key_name: String) -> Result<Vec<u8>> {
+        let crypto_provider = self.can_provide_crypto()?;
+
+        let op = PsaExportKey { key_name };
+
+        let res = self.op_client.process_operation(
+            NativeOperation::PsaExportKey(op),
+            crypto_provider,
+            &self.auth_data,
+        )?;
+
+        if let NativeResult::PsaExportKey(res) = res {
+            Ok(res.data.expose_secret().to_vec())
+        } else {
+            // Should really not be reached given the checks we do, but it's not impossible if some
+            // changes happen in the interface
+            Err(Error::Client(ClientErrorKind::InvalidServiceResponseType))
+        }
+    }
+
     /// **[Cryptographic Operation]** Create an asymmetric signature on a pre-computed message digest.
     ///
     /// The key intended for signing **must** have its `sign_hash` flag set

src/core/testing/core_tests.rs

@@ -286,6 +286,34 @@ fn psa_export_public_key_test() {
     }
 }
 
+#[test]
+fn psa_export_key_test() {
+    let mut client: TestBasicClient = Default::default();
+    let key_data = vec![0xa5; 128];
+    client.set_mock_read(&get_response_bytes_from_result(NativeResult::PsaExportKey(
+        operations::psa_export_key::Result {
+            data: Secret::new(key_data.clone()),
+        },
+    )));
+
+    let key_name = String::from("key-name");
+    // Check response:
+    assert_eq!(
+        client
+            .psa_export_key(key_name.clone())
+            .expect("Failed to export key"),
+        key_data
+    );
+
+    // Check request:
+    let op = get_operation_from_req_bytes(client.get_mock_write());
+    if let NativeOperation::PsaExportKey(op) = op {
+        assert_eq!(op.key_name, key_name);
+    } else {
+        panic!("Got wrong operation type: {:?}", op);
+    }
+}
+
 #[test]
 fn psa_sign_hash_test() {
     let mut client: TestBasicClient = Default::default();