Hi George,

Protected Storage  == Encrypted ITS.

Right? It is not needed to create a different ITS.

The problem is that ITS is mandatory for TFM, but PS is optional.

It creates problem for flash-less MCUs, using external Flash only. This is main limitation to use TFM on our RT platform.

The proposal is to have possibility to choose what Secure Storage to use: PS, or ITS, or both.

Thanks,

Andrej

From: TF-M <tf-m-bounces@lists.trustedfirmware.org> On Behalf Of Vasilakis, Georgios via TF-M
Sent: Thursday, September 23, 2021 3:28 PM
To: tf-m@lists.trustedfirmware.org
Subject: [TF-M] Supporting encryption with ITS

Hey all,

Lately the requirement for an encrypted ITS solution is being asked from our customers and I would like to have a discussion here on how we can design this in a reasonable way. The first thought that came to my mind was to add the functionality to the ITS flash-fs layer. This layer contains file metadata in the its_file_meta_t structure and it should be possible to expand this to include additional crypto metadata (conditionally). This seems to be the less invasive change to me, even though it will introduce some increased memory usage since supporting encryption will mean that we cannot read the data in chunks anymore, we will have to use static buffers.

At the same time, I looked at the PS partition since I knew that it has support for encryption. I believe that some core concepts of both solutions have similarities even though the code is quite different. For example, a file in ITS is similar to an object in PS and the (linear) list of file metadata in ITS is similar to the concept of the object table in PS. So, I think that it should be possible to design some generic-enough APIs that we can use for both the ITS and PS. Even though this will require some major refactoring in both partitions, it will decrease the code of these services which will probably decrease maintenance later.

What are your thoughts on this?

Regards,

George