From 01a8c33506b30def65ab417c5fca06a60daa7783 Mon Sep 17 00:00:00 2001 From: Chaitanya Tata Date: Mon, 13 Jul 2026 01:59:08 +0530 Subject: [PATCH 1/2] Fix incorrect identifiers in the WPA3-SAE example code The WPA3-SAE operation example referenced a PAKE step macro that is not defined, and extracted the shared key from the wrong operation object (a copy-paste from the SPAKE2+ example). * The send-confirm counter input step used the undefined PSA_PAKE_STEP_SEND_CONFIRM; the defined step is PSA_PAKE_STEP_CONFIRM_COUNT. * psa_pake_get_shared_key() operated on &spake2p_p instead of the example's &wpa3_sae operation. Signed-off-by: Chaitanya Tata --- doc/crypto/api/ops/pake.rst | 4 ++-- doc/crypto/appendix/history.rst | 5 +++++ 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/doc/crypto/api/ops/pake.rst b/doc/crypto/api/ops/pake.rst index 044f7caa..9475ed79 100644 --- a/doc/crypto/api/ops/pake.rst +++ b/doc/crypto/api/ops/pake.rst @@ -2354,7 +2354,7 @@ Confirm .. code-block:: xref // Set send-confirm counter - psa_pake_input(&wpa3_sae, PSA_PAKE_STEP_SEND_CONFIRM, ...); + psa_pake_input(&wpa3_sae, PSA_PAKE_STEP_CONFIRM_COUNT, ...); // Get combined send-confirm || confirm value psa_pake_output(&wpa3_sae, PSA_PAKE_STEP_CONFIRM, ...); @@ -2392,7 +2392,7 @@ Extract shared secret // Get K_shared psa_key_id_t shared_key; - psa_pake_get_shared_key(&spake2p_p, &att, &shared_key); + psa_pake_get_shared_key(&wpa3_sae, &att, &shared_key); The shared secret that is produced by WPA3-SAE is pseudorandom. Although it can be used directly as an encryption key, it is recommended to use the shared secret as an input to a key-derivation operation to produce additional cryptographic keys. diff --git a/doc/crypto/appendix/history.rst b/doc/crypto/appendix/history.rst index 4dce0754..240d0cbc 100644 --- a/doc/crypto/appendix/history.rst +++ b/doc/crypto/appendix/history.rst @@ -14,6 +14,11 @@ This section provides the detailed changes made between published version of the Changes in the draft GlobalPlatform publication revision ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +Clarifications and fixes +~~~~~~~~~~~~~~~~~~~~~~~~ + +* Corrected the WPA3-SAE operation example code: the send-confirm counter input step is `PSA_PAKE_STEP_CONFIRM_COUNT`, and the shared key is extracted from the ``wpa3_sae`` operation. + Other changes ~~~~~~~~~~~~~ From 5afaea83b2a90252ccbc3c2545f36bddd770593b Mon Sep 17 00:00:00 2001 From: Chaitanya Tata Date: Mon, 13 Jul 2026 01:59:08 +0530 Subject: [PATCH 2/2] Fix incorrect identifier in the SPAKE2+ example code The SPAKE2+ operation example referenced a PAKE step macro that is not defined: the Prover input step for the Verifier confirmation value used the undefined PSA_PAKE_STEP_KEY_CONFIRM; the defined step is PSA_PAKE_STEP_CONFIRM. Signed-off-by: Chaitanya Tata --- doc/crypto/api/ops/pake.rst | 2 +- doc/crypto/appendix/history.rst | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/doc/crypto/api/ops/pake.rst b/doc/crypto/api/ops/pake.rst index 9475ed79..a1d18766 100644 --- a/doc/crypto/api/ops/pake.rst +++ b/doc/crypto/api/ops/pake.rst @@ -1852,7 +1852,7 @@ After setup, the key exchange and confirmation flow for SPAKE2+ is as follows. // Set shareV psa_pake_input(&spake2p_p, PSA_PAKE_STEP_KEY_SHARE, ...); // Set confirmV - psa_pake_input(&spake2p_p, PSA_PAKE_STEP_KEY_CONFIRM, ...); + psa_pake_input(&spake2p_p, PSA_PAKE_STEP_CONFIRM, ...); **Prover** To get the Prover key confirmation value to send to the Verifier, call: diff --git a/doc/crypto/appendix/history.rst b/doc/crypto/appendix/history.rst index 240d0cbc..652c8bda 100644 --- a/doc/crypto/appendix/history.rst +++ b/doc/crypto/appendix/history.rst @@ -18,6 +18,7 @@ Clarifications and fixes ~~~~~~~~~~~~~~~~~~~~~~~~ * Corrected the WPA3-SAE operation example code: the send-confirm counter input step is `PSA_PAKE_STEP_CONFIRM_COUNT`, and the shared key is extracted from the ``wpa3_sae`` operation. +* Corrected the SPAKE2+ operation example code: the Prover input step for the Verifier confirmation value is `PSA_PAKE_STEP_CONFIRM`. Other changes ~~~~~~~~~~~~~