psa-crypto

psa-crypto@lists.trustedfirmware.org

86 discussions

Re: [psa-crypto] PEM exports of public/private keys?

by Gilles Peskine

Hi Kevin, The separation between the secure and non-secure world is designed to keep the code in the secure world as small as possible. I don't think there'll ever be enough justification to include base64 encoding in the secure world. The current PSA crypto API was designed to be mostly simple wrappers around calls to the secure world. We (Arm) are considering extending it with some higher-level functions designed to remain in the normal world. This would include key formats such as SubjectPublicKeyInfo, and PEM encoding. I can't make any promises as to when or even if this will happen. At the moment, all we have to offer is the existing mbedtls functions. -- Gilles Peskine Mbed TLS developer and PSA crypto API designer P.S. When I'm working on Mbed TLS and using a shell prompt to calculate or verify values (usually with openssl or python/cryptodome), I usually use hex/binary conversion, and DER to encode asymmetric keys. On 14/05/2020 13:56, Kevin Townsend via psa-crypto wrote: > Hi, > > Working on some cryptography demos for Zephyr, now that TF-M support > was fully merged in for the upcoming 2.3 release, I've put some test > code together that: > > - Generates a permanent persistent key (prime256v1) > - Displays the public key based on the private key above (in hex format) > - Calculates the SHA256 hash of a payload > - Signs the hash with the persistent key > - Verifies the signature using the public key > - Destroys the key > > https://gist.github.com/microbuilder/a326cc6b935f87f413d89e44f9d3de05 > > An important part of the hash/sign/verify workflow is of course > verifying the signature on the receiving end, which requires access to > the public key generated on the device (perhaps a new key was randomly > generated when the device first boots, etc.). > > We can currently derive the public key in DER format with the existing > API, but it seems like a helper function to convert to PEM would make > this export process easier, since you could then just copy and paste > the text output directly for provisioning or debug purposes. > mbedcrypto 3.1.0 already has a library/pem.c utility function for this > that could be exposed: mbedtls_pem_write_buffer > > In general, I think enabling the import and export of PEM data, not > just DER, would make the process of dealing with keys during > provisioning easier. > > I didn't find any references to PEM in the PSA Cryptography API, but > perhaps I'm missing some obvious already existing means to convert to > PEM, or is this something other people see any value in having? > > Being able to copy and paste PEM data (versus DER which can't be > copy/pasted), then save it as a file, for example, would make working > with openssl easier, such as the commands described here where we > could use the extracted PEM data to verify the signed data from the > command line: > https://gist.github.com/microbuilder/a326cc6b935f87f413d89e44f9d3de05#file-… > > Any thoughts on the idea, or perhaps it's already been added and I'm > simply missing it? > > It's easy to add this at the NS application level as well, of course, > but it does seem like a useful enough operation that it should be > available in S world when requesting key data. > > Best regards, > Kevin Townsend >

5 years, 5 months

PEM exports of public/private keys?

by Kevin Townsend

Hi, Working on some cryptography demos for Zephyr, now that TF-M support was fully merged in for the upcoming 2.3 release, I've put some test code together that: - Generates a permanent persistent key (prime256v1) - Displays the public key based on the private key above (in hex format) - Calculates the SHA256 hash of a payload - Signs the hash with the persistent key - Verifies the signature using the public key - Destroys the key https://gist.github.com/microbuilder/a326cc6b935f87f413d89e44f9d3de05 An important part of the hash/sign/verify workflow is of course verifying the signature on the receiving end, which requires access to the public key generated on the device (perhaps a new key was randomly generated when the device first boots, etc.). We can currently derive the public key in DER format with the existing API, but it seems like a helper function to convert to PEM would make this export process easier, since you could then just copy and paste the text output directly for provisioning or debug purposes. mbedcrypto 3.1.0 already has a library/pem.c utility function for this that could be exposed: mbedtls_pem_write_buffer In general, I think enabling the import and export of PEM data, not just DER, would make the process of dealing with keys during provisioning easier. I didn't find any references to PEM in the PSA Cryptography API, but perhaps I'm missing some obvious already existing means to convert to PEM, or is this something other people see any value in having? Being able to copy and paste PEM data (versus DER which can't be copy/pasted), then save it as a file, for example, would make working with openssl easier, such as the commands described here where we could use the extracted PEM data to verify the signed data from the command line: https://gist.github.com/microbuilder/a326cc6b935f87f413d89e44f9d3de05#file-… Any thoughts on the idea, or perhaps it's already been added and I'm simply missing it? It's easy to add this at the NS application level as well, of course, but it does seem like a useful enough operation that it should be available in S world when requesting key data. Best regards, Kevin Townsend

5 years, 5 months

Re: [psa-crypto] [TF-M] Will TFM crypto service suppot national encryption algorithm in the future?

by Shebu Varghese Kuriakose

Hi Matt, TF-M plans to continue using Mbedcrypto in the crypto service. Mbed Crypto implements the PSA Crypto APIs and is also now part of trustedfirmware.org community project alongside TF-M. However, it is possible with some effort for a platform using TF-M to use another crypto library in the TF-M crypto service. Of course the library will need to support PSA Crypto APIs to be PSA compliant. There is support for ARIA, Camellia in Mbed TLS. There has already been a PR for SM4 support sometime back - https://github.com/ARMmbed/mbedtls/pull/1165. SM2/SM3 algorithm support can be contributed to MbedTLS project (Mbed Crypto is now merged to Mbed TLS project). The maintainers will have to review and integrate the contribution as their bandwidth permits while finding time to review several contributions that the project is receiving. I am adding psa-crypto mailing list which is used for Mbedcrypto/PSA Crypto discussions. Regards, Shebu From: TF-M <tf-m-bounces(a)lists.trustedfirmware.org> On Behalf Of Matt via TF-M Sent: Thursday, April 16, 2020 8:24 AM To: tf-m(a)lists.trustedfirmware.org Subject: [TF-M] Will TFM crypto service suppot national encryption algorithm in the future? Hi All TFM experts, TFM crypto service is based on mbedcrypto and there is no national encryption algorithm support in current mbedcrypto implementation. The Chinese market has a strong demand for national encryption algorithms, such as SM2/SM3/SM4, will TFM crypto service change to other crypto implementation to support the national encryption algorithm in the future? Thanks, -Matt

5 years, 6 months

Mbed TLS/PSA Crypto Roadmap

by Shebu Varghese Kuriakose

Hi All, Here is the link to the roadmap for Mbed TLS and PSA Crypto in the coming quarters. https://developer.trustedfirmware.org/w/mbed-tls/roadmap/ If you are interested in collaborating on any of the roadmap features or other features in the project, please let your interest known via. the mailing lists. Note that the expected quarter when a feature will be completed is based on very rough estimates of the effort involved and therefore might change. Roadmap will be reviewed and updated at the start of every quarter depending on progress made in previous quarter. Thanks, Shebu (Mbed TLS, PSA Crypto Technology Manager, Arm)

5 years, 6 months

Welcome to PSA Crypto @ TrustedFirmware.org

by Dan Handley

5 years, 7 months

Welcome to PSA Crypto @ TrustedFirmware.org

by Dan Handley

Welcome to the PSA Crypto list @ TrustedFirmware.org! This mailing list is the primary channel for public discussion, questions and announcements about the PSA Crypto implementation at TrustedFirmware.org, which is currently part of the Mbed TLS project. Please use this where possible in preference to the GitHub issue tracker or private support channels. The GitHub issue tracker should still be used for raising bugs and enhancement requests (after first checking the issue doesn't already exist). For more general Mbed TLS project discussion, including about the non-PSA crypto functionality within Mbed TLS, please use mbed-tls(a)lists.trustedfirmware.org<mailto:mbed-tls@lists.trustedfirmware.org>. Thanks and regards Dan. IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

5 years, 7 months

2025

2024

2023

2022

2021

2020

psa-crypto