CC2745R10-Q1: Cryptographic operations using PSA KeyStore

Hello,

Kaichi Miyatake said:

No.1
I am stating this because it was stated that AES-CBC does not support operations using PSA's API.
If SimpleLink and PSA APIs should not be confused, does this mean that it is not possible to store the keys for AES-CBC operations in the PSA KeyStore?

What SDK version are you using? Support was added later, so it may be that those release notes/documentation might be old.

Kaichi Miyatake said:

No.2
I thought I was calling the PSA API for everything, but is there any place in this source code where I am calling the KeyStore API directly?

Yes, at line 50 of the code provided you are calling a KeyStore API.

I have written the following code that does an AES-CBC operation using PSA. Before running it, some changes are required to the sysconfig file of the project:

All that needs to be changed is the number of Volatile AES Keys. Note that I changes AES-128 Plaintext Keys to 1. I see that you're using persistent storage, and sysconfig will be updated so that it states Volatile/Non-Volatile. 

/* For usleep() */
#include <unistd.h>
#include <stdint.h>
#include <stddef.h>

/* Driver Header files */
#include <ti/drivers/GPIO.h>
#include <third_party/psa_crypto/include/psa/crypto.h>
#include <ti/drivers/cryptoutils/hsm/HSMLPF3.h>

/* Driver configuration */
#include "ti_drivers_config.h"

#define KEY_LIFETIME PSA_KEY_LIFETIME_FROM_PERSISTENCE_AND_LOCATION(PSA_KEY_PERSISTENCE_DEFAULT, PSA_KEY_LOCATION_LOCAL_STORAGE)

uint8_t keyingMaterial[16] = { 0x1f, 0x8e, 0x49, 0x73, 0x95, 0x3f, 0x3f, 0xb0,
                               0xbd, 0x6b, 0x16, 0x66, 0x2e, 0x9a, 0x3c, 0x17
                             };
uint8_t iv[16] =                {0x2f, 0xe2, 0xb3, 0x33, 0xce, 0xda, 0x8f, 0x98,
                                 0xf4, 0xa9, 0x9b, 0x40, 0xd2, 0xcd, 0x34, 0xa8};

uint8_t plaintext[16] =         {0x45, 0xcf, 0x12, 0x96, 0x4f, 0xc8, 0x24, 0xab,
                                 0x76, 0x61, 0x6a, 0xe2, 0xf4, 0xbf, 0x08, 0x22};

uint8_t ciphertext[sizeof(plaintext)];

/*
 *  ======== mainThread ========
 */
void *mainThread(void *arg0)
{
    psa_status_t status;
    psa_key_id_t key_id;
    int_fast16_t ret;

    status = psa_crypto_init();
    if (status != PSA_SUCCESS)
    {
        while(1);
    }

    ret = HSMLPF3_provisionHUK();
    if (ret != HSMLPF3_STATUS_SUCCESS)
    {
        while(1);
    }


    psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;

    psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_ENCRYPT);
    psa_set_key_algorithm(&attributes, PSA_ALG_CBC_NO_PADDING);
    psa_set_key_type(&attributes, PSA_KEY_TYPE_AES);

    psa_set_key_lifetime(&attributes, KEY_LIFETIME);
    psa_set_key_bits(&attributes, 128);

    key_id = PSA_KEY_ID_USER_MIN;
    psa_set_key_id(&attributes, key_id);

    status = psa_import_key(&attributes, keyingMaterial, sizeof(keyingMaterial), &key_id);
    if (status != PSA_SUCCESS)
    {
        while(1);
    }

    psa_cipher_operation_t op = PSA_CIPHER_OPERATION_INIT;
    status = psa_cipher_encrypt_setup(&op, key_id, PSA_ALG_CBC_NO_PADDING);
    if (status != PSA_SUCCESS)
    {
        while(1);
    }

    status = psa_cipher_set_iv(&op, iv, sizeof(iv));
    if (status != PSA_SUCCESS)
    {
        while(1);
    }

    size_t cipher_length = 0;

    status = psa_cipher_update(&op,
                               plaintext,
                               sizeof(plaintext),
                               ciphertext,
                               sizeof(plaintext),
                               &cipher_length);

    if (status != PSA_SUCCESS)
    {
        while(1);
    }

    status = psa_cipher_finish(&op,
                               ciphertext,
                               sizeof(plaintext),
                               &cipher_length);
    if (status != PSA_SUCCESS)
    {
        while(1);
    }

    while(1);
}

If you try the code above do you still see the hardware failure? 

Best,

Nima Behmanesh