• State Resolved
  • Locked Locked
  • Replies 1 reply
  • Subscribers 51 subscribers
  • Views 253 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

CC2745R10-Q1:Lifetime settings

youkyou ryu
Prodigy 80 points

Part Number: CC2745R10-Q1

Tool/software:

When storing keys in an HSM, what is the difference between the following expiration settings?

・PSA_KEY_LOCATION_HSM_ASSET_STORE + PSA_KEY_PERSISTENCE_DEFAULT
・PSA_KEY_LOCATION_HSM_ASSET_STORE + PSA_KEY_PERSISTENCE_HSM_ASSET_STORE

https://dev.ti.com/tirex/content/simplelink_lowpower_f3_sdk_8_40_00_61/docs/ble5stack/ble_user_guide/html/cc23xx/keystore-cc23xx.html?highlight=key%20store#null

After reading the above, I don't really understand the difference. Could you please tell me the purpose of each?


When saving a key in PSA, can the key be referenced directly from RAM with the following Lifetime settings?
Also, is the RAM encrypted?
・PSA_KEY_LOCATION_LOCAL_STORAGE + PSA_KEY_PERSISTENCE_VOLATILE

  • +1
    TI__Intellectual 1950 points

    Hello Youkyou,

    The difference between the two expiration settings is where the key material will be stored. PSA_KEY_LOCATION_HSM_ASSET_STORE makes it so that the HSM only uses the key during crypto operations. However, the HSM store has limited space, so you might defer storage to KeyStore depending on storage utilization preference. 

    PSA_KEY_LOCATION_HSM_ASSET_STORE + PSA_KEY_PERSISTENCE_DEFAULT: stores the key in KeyStore using wrapping and encryption. This still provides the maximum security but comes with more overhead than the other option since HSM module has to refer to the KeyStore to access the key and convert to plain text.

    PSA_KEY_LOCATION_HSM_ASSET_STORE + PSA_KEY_PERSISTENCE_HSM_ASSET_STORE: stores the key directly in the HSM asset store in plain text. This key is exclusive to the asset store and has less overhead as a result. Since HSM has limited storage, this kind of key should have the highest priority or used most frequently.

    - When saving a key in PSA, can the key be referenced directly from RAM with the following Lifetime settings?

    Yes, I believe this lifetime setting (PSA_KEY_LOCATION_LOCAL_STORAGE + PSA_KEY_PERSISTENCE_VOLATILE) generates a key that can be referenced directly from KeyStore RAM as it is created using the default KeyStore storage parameters. The RAM is not encrypted since it stores the plaintext keys that are used to reference the actual encrypted key material used during secure operations.

    Eshaan