Test gap: mbedtls_pk_check_pair with MBEDTLS_PK_OPAQUE about mbedtls

[valeriosetti]

Checking test_suite_pk.function it seems to me that actually performs mbedtls_pk_check_pair() with one opaque PK context and one non-opaque one. So if I'm not wrong the thing we're missing is a test in which both keys are opaque.

PS = Also the last line of the description doesn't hold any more, right?

[valeriosetti]

Edit to the previous comment. mbedtls_pk_check_pair is meant to check a private/public pair as the name suggests, but as far as I know opaque keys can only wrap key-pairs not public keys only. In other words it's OK to run check_pair between an opaque and a non-opaque context (as mbedtls_pk_check_pair in test_suite_pk.function is doing), but it's not possible to run check_pair between 2 opaque contexts. Am I wrong?

[mpg]

PS = Also the last line of the description doesn't hold any more, right?

Agreed, edited the description accordingly.

but it's not possible to run check_pair between 2 opaque contexts.

Agreed too.

Checking test_suite_pk.function it seems to me that actually performs mbedtls_pk_check_pair() with one opaque PK context and one non-opaque one.

Looking at the code, that's supposed to work for ECC keys but not for RSA keys. So perhaps all that's left to do is:

• document that opaque RSA keys can't be used with check_pair() - probably an addition to #8937?
• perhaps also add a test that calling check_pair() on a opaque RSA keys indeed fails with an appropriate error (as opposed to crashing or doing something silly)?