Hi Andrej,
The PSA Storage spec (available here https://developer.arm.com/architectures/security-architectures/platform-secu...) states that the Protected Storage service should be implemented inside the Application Root of Trust.
The principle is that the PSA Root of Trust should be kept as small as possible, to reduce the attack surface of the most privileged part of the system. As Protected Storage neither needs the privileges of the PSA Root of Trust nor is used by any PSA Root of Trust service, it should be implemented inside the Application Root of Trust.
Kind regards, Jamie
From: TF-M tf-m-bounces@lists.trustedfirmware.org On Behalf Of Andrej Butok via TF-M Sent: 18 June 2020 09:16 To: tf-m@lists.trustedfirmware.org Subject: [TF-M] PS => AP ROT
Hello,
I have just notices that the TFM Protected Storage service partition has been changed from PSA ROT to APP ROT. Just curious, what is a reason? May it stay PSA ROT?
Thank you in advance, Andrej Butok