Hi,

I see that keys can only be accessed/modified by their owning secure partition. 

File ID used by ITS is 12-bytes.  Assuming the Application imports a persistent key and then opens the key, the File ID would be:

|       32 –bits           |  32 -bits |            32 –bits                         |

==========================================

PSA Crypto SP ID  |   Key ID  |  DEFAULT_NS_CLIENT_ID (-1)

Then the key handle returned from the psa_open_key() is used for any cryptographic operations.  This makes perfect sense to me for PSA API v1.0 beta 3.  

However, for PSA API v1.0 release where open/close key was removed and only the Key ID will be used, I’m confused on how the key access and File ID would work.

Initially, when the app imports the key, the key file would have the same 12-byte file ID as the case above.   However, when the application calls a cryptographic function, it now provides the

32-bit key ID instead of the handle.  The persistent key is not cached and must be read from the ITS.  I had assumed the crypto driver would call psa_export_key() to retrieve the key for use, however, the File ID in this case would be:

|       32 –bits           |  32 -bits |            32 –bits                         |

==========================================

PSA Crypto SP ID  |   Key ID  |  Secure Partition ID of Crypto Driver

The file ID would not match what the App imported and the key would not be found.

Am I misunderstanding how the key should be accessed for use after it has been imported or how the File ID is generated?

Another explanation of the scenario if the above was not clear:

1) NS application calls psa_import_key() to store a key with an ID.  Key is stored by ITS with client ID of -1 (DEFAULT_NS_CLIENT_ID).

2) NS application calls an AES crypto function and provides the key ID.

3) AES driver crypto function calls psa_export_key() to retrieve the key from ITS for use.  Client ID = AES secure partition.

RoT Partition 1:

- PSA Crypto (with keystore)

RoT Partition 2:
       -       AES driver  (placed its own partition so other crypto ops in PSA Crypto partition can run in parallel…multiple HW accelerators)

RoT Partition 3:

- ITS

Regards,

Brian Quach

SimpleLink MCU

Texas Instruments Inc.

12500 TI Blvd, MS F-4000

Dallas, TX 75243

214-479-4076