Skip to content

Commit 50ac62f

Browse files
Vge0rgeVge0rge
committed
nrf_security: Refactor Cracen IKG keys
This refactors how we handle the IKG key IDs for Cracen. Before this change we used the internal Cracen IKG key identifiers inside the builtin key driver. This had an issue because both the KMU keys and the IKG internal key IDs share the IDs 0-2. To avoid this collision the IKG handling is refactored to use the reserved Cracen PSA key identifiers in the driver level and only use the internal key intentifiers deeper in the implementation in order to avoid the conflicts. This also removes unused structs related to the IKG keys and unused code as well. Signed-off-by: Georgios Vasilakis <georgios.vasilakis@nordicsemi.no>
1 parent 4dfdc18 commit 50ac62f

File tree

5 files changed

+189
-70
lines changed

5 files changed

+189
-70
lines changed

‎subsys/nrf_security/src/drivers/cracen/cracenpsa/include/cracen_psa_key_ids.h

-4
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,6 @@
1313

1414
#define CRACEN_PROTECTED_RAM_AES_KEY0_ID ((uint32_t)0x7fffc004)
1515

16-
#define CRACEN_IDENTITY_KEY_SLOT_NUMBER 0
17-
#define CRACEN_MKEK_SLOT_NUMBER 1
18-
#define CRACEN_MEXT_SLOT_NUMBER 2
19-
2016
#define PSA_KEY_LOCATION_CRACEN ((psa_key_location_t)(0x800000 | ('N' << 8)))
2117

2218
/*

‎subsys/nrf_security/src/drivers/cracen/cracenpsa/src/common.c

+92-40
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,9 @@
3030
#include <psa/nrf_platform_key_ids.h>
3131

3232
LOG_MODULE_DECLARE(cracen, CONFIG_CRACEN_LOG_LEVEL);
33+
#if CONFIG_PSA_NEED_CRACEN_PLATFORM_KEYS
34+
#include "platform_keys/platform_keys.h"
35+
#endif
3336

3437
#define NOT_ENABLED_CURVE (0)
3538
#define NOT_ENABLED_HASH_ALG (0)
@@ -727,6 +730,58 @@ static int cracen_clean_ik_key(const uint8_t *user_data)
727730
return SX_OK;
728731
}
729732

733+
static bool cracen_is_ikg_key(const psa_key_attributes_t *attributes)
734+
{
735+
#if CONFIG_PSA_NEED_CRACEN_PLATFORM_KEYS
736+
return cracen_platform_keys_is_ikg_key(attributes);
737+
#else
738+
switch (MBEDTLS_SVC_KEY_ID_GET_KEY_ID(psa_get_key_id(attributes))) {
739+
case CRACEN_BUILTIN_IDENTITY_KEY_ID:
740+
case CRACEN_BUILTIN_MKEK_ID:
741+
case CRACEN_BUILTIN_MEXT_ID:
742+
return true;
743+
default:
744+
return false;
745+
}
746+
#endif
747+
};
748+
749+
static psa_status_t cracen_load_ikg_keyref(const psa_key_attributes_t *attributes,
750+
const uint8_t *key_buffer, size_t key_buffer_size,
751+
struct sxkeyref *k)
752+
{
753+
k->prepare_key = cracen_prepare_ik_key;
754+
k->clean_key = cracen_clean_ik_key;
755+
756+
#if CONFIG_PSA_NEED_CRACEN_PLATFORM_KEYS
757+
if (key_buffer_size != sizeof(ikg_opaque_key)) {
758+
return PSA_ERROR_INVALID_ARGUMENT;
759+
}
760+
761+
k->cfg = ((ikg_opaque_key *)key_buffer)->slot_number;
762+
k->owner_id = ((ikg_opaque_key *)key_buffer)->owner_id;
763+
#else
764+
/* IKG keys are identified from the ID */
765+
(void)key_buffer;
766+
(void)key_buffer_size;
767+
768+
switch (MBEDTLS_SVC_KEY_ID_GET_KEY_ID(psa_get_key_id(attributes))) {
769+
case CRACEN_BUILTIN_MKEK_ID:
770+
k->cfg = CRACEN_INTERNAL_HW_KEY1_ID;
771+
break;
772+
case CRACEN_BUILTIN_MEXT_ID:
773+
k->cfg = CRACEN_INTERNAL_HW_KEY2_ID;
774+
break;
775+
default:
776+
return PSA_ERROR_INVALID_ARGUMENT;
777+
};
778+
779+
k->owner_id = MBEDTLS_SVC_KEY_ID_GET_OWNER_ID(psa_get_key_id(attributes));
780+
#endif
781+
k->user_data = (uint8_t *)&k->owner_id;
782+
return PSA_SUCCESS;
783+
}
784+
730785
psa_status_t cracen_load_keyref(const psa_key_attributes_t *attributes, const uint8_t *key_buffer,
731786
size_t key_buffer_size, struct sxkeyref *k)
732787
{
@@ -763,39 +818,28 @@ psa_status_t cracen_load_keyref(const psa_key_attributes_t *attributes, const ui
763818
if (PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)) ==
764819
PSA_KEY_LOCATION_CRACEN) {
765820

766-
k->prepare_key = cracen_prepare_ik_key;
767-
k->clean_key = cracen_clean_ik_key;
821+
if (cracen_is_ikg_key(attributes)) {
822+
return cracen_load_ikg_keyref(attributes, key_buffer, key_buffer_size, k);
823+
}
824+
768825
k->owner_id = MBEDTLS_SVC_KEY_ID_GET_OWNER_ID(psa_get_key_id(attributes));
769826
k->user_data = (uint8_t *)&k->owner_id;
827+
k->prepare_key = NULL;
828+
k->clean_key = NULL;
770829

771830
switch (MBEDTLS_SVC_KEY_ID_GET_KEY_ID(psa_get_key_id(attributes))) {
772-
case CRACEN_BUILTIN_MKEK_ID:
773-
k->cfg = CRACEN_INTERNAL_HW_KEY1_ID;
774-
break;
775-
case CRACEN_BUILTIN_MEXT_ID:
776-
k->cfg = CRACEN_INTERNAL_HW_KEY2_ID;
777-
break;
778831
case CRACEN_PROTECTED_RAM_AES_KEY0_ID:
779832
k->sz = 32;
780833
k->key = (uint8_t *)CRACEN_PROTECTED_RAM_AES_KEY0;
781-
k->prepare_key = NULL;
782-
k->clean_key = NULL;
783834
break;
784835
default:
785836
if (key_buffer_size == 0) {
786837
return PSA_ERROR_CORRUPTION_DETECTED;
787838
}
788839

789-
if (key_buffer_size == sizeof(ikg_opaque_key)) {
790-
k->cfg = ((ikg_opaque_key *)key_buffer)->slot_number;
791-
k->owner_id = ((ikg_opaque_key *)key_buffer)->owner_id;
792-
} else {
793-
/* Normal transparent key. */
794-
k->prepare_key = NULL;
795-
k->clean_key = NULL;
796-
k->key = key_buffer;
797-
k->sz = key_buffer_size;
798-
}
840+
/* Normal transparent key. */
841+
k->key = key_buffer;
842+
k->sz = key_buffer_size;
799843
}
800844
} else {
801845
k->key = key_buffer;
@@ -805,30 +849,38 @@ psa_status_t cracen_load_keyref(const psa_key_attributes_t *attributes, const ui
805849
return PSA_SUCCESS;
806850
}
807851

852+
static psa_status_t cracen_get_ikg_opaque_key_size(const psa_key_attributes_t *attributes,
853+
size_t *key_size)
854+
{
855+
#ifdef CONFIG_PSA_NEED_CRACEN_PLATFORM_KEYS
856+
return cracen_platform_keys_get_size(attributes, key_size);
857+
#else
858+
switch (MBEDTLS_SVC_KEY_ID_GET_KEY_ID(psa_get_key_id(attributes))) {
859+
case CRACEN_BUILTIN_IDENTITY_KEY_ID:
860+
if (psa_get_key_type(attributes) ==
861+
PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1)) {
862+
*key_size = sizeof(ikg_opaque_key);
863+
return PSA_SUCCESS;
864+
}
865+
break;
866+
case CRACEN_BUILTIN_MEXT_ID:
867+
case CRACEN_BUILTIN_MKEK_ID:
868+
if (psa_get_key_type(attributes) == PSA_KEY_TYPE_AES) {
869+
*key_size = sizeof(ikg_opaque_key);
870+
return PSA_SUCCESS;
871+
}
872+
break;
873+
}
874+
875+
return PSA_ERROR_INVALID_ARGUMENT;
876+
#endif /* CONFIG_PSA_NEED_CRACEN_PLATFORM_KEYS */
877+
}
878+
808879
psa_status_t cracen_get_opaque_size(const psa_key_attributes_t *attributes, size_t *key_size)
809880
{
810881
if (PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)) ==
811882
PSA_KEY_LOCATION_CRACEN) {
812-
switch (MBEDTLS_SVC_KEY_ID_GET_KEY_ID(psa_get_key_id(attributes))) {
813-
case CRACEN_BUILTIN_IDENTITY_KEY_ID:
814-
if (psa_get_key_type(attributes) ==
815-
PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1)) {
816-
*key_size = sizeof(ikg_opaque_key);
817-
return PSA_SUCCESS;
818-
}
819-
break;
820-
case CRACEN_BUILTIN_MEXT_ID:
821-
case CRACEN_BUILTIN_MKEK_ID:
822-
if (psa_get_key_type(attributes) == PSA_KEY_TYPE_AES) {
823-
*key_size = sizeof(ikg_opaque_key);
824-
return PSA_SUCCESS;
825-
}
826-
break;
827-
#ifdef CONFIG_PSA_NEED_CRACEN_PLATFORM_KEYS
828-
default:
829-
return cracen_platform_keys_get_size(attributes, key_size);
830-
#endif
831-
}
883+
return cracen_get_ikg_opaque_key_size(attributes, key_size);
832884
}
833885

834886
if (PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)) ==

‎subsys/nrf_security/src/drivers/cracen/cracenpsa/src/key_management.c

+44-16
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
#include <stddef.h>
2525
#include <string.h>
2626
#include <sxsymcrypt/trng.h>
27+
#include <sxsymcrypt/keyref.h>
2728
#include <zephyr/sys/__assert.h>
2829
#include <zephyr/sys/byteorder.h>
2930

@@ -1174,6 +1175,29 @@ psa_status_t cracen_generate_key(const psa_key_attributes_t *attributes, uint8_t
11741175
return PSA_ERROR_NOT_SUPPORTED;
11751176
}
11761177

1178+
static void cracen_set_ikg_key_buffer(psa_key_attributes_t *attributes,
1179+
psa_drv_slot_number_t slot_number, uint8_t *key_buffer)
1180+
{
1181+
ikg_opaque_key *ikg_key = (ikg_opaque_key *)key_buffer;
1182+
1183+
switch (slot_number) {
1184+
case CRACEN_BUILTIN_IDENTITY_KEY_ID:
1185+
/* The slot_number is not used with the identity key */
1186+
break;
1187+
case CRACEN_BUILTIN_MKEK_ID:
1188+
ikg_key->slot_number = CRACEN_INTERNAL_HW_KEY1_ID;
1189+
break;
1190+
case CRACEN_BUILTIN_MEXT_ID:
1191+
ikg_key->slot_number = CRACEN_INTERNAL_HW_KEY2_ID;
1192+
break;
1193+
}
1194+
1195+
#ifdef CONFIG_PSA_NEED_CRACEN_PLATFORM_KEYS
1196+
ikg_key->owner_id = cracen_platform_keys_get_owner(attributes);
1197+
#else
1198+
ikg_key->owner_id = MBEDTLS_SVC_KEY_ID_GET_OWNER_ID(psa_get_key_id(attributes));
1199+
#endif
1200+
}
11771201

11781202
psa_status_t cracen_get_builtin_key(psa_drv_slot_number_t slot_number,
11791203
psa_key_attributes_t *attributes, uint8_t *key_buffer,
@@ -1187,7 +1211,7 @@ psa_status_t cracen_get_builtin_key(psa_drv_slot_number_t slot_number,
11871211
* attributes, and update the `lifetime` field to be more specific.
11881212
*/
11891213
switch (slot_number) {
1190-
case CRACEN_IDENTITY_KEY_SLOT_NUMBER:
1214+
case CRACEN_BUILTIN_IDENTITY_KEY_ID:
11911215
psa_set_key_lifetime(attributes, PSA_KEY_LIFETIME_FROM_PERSISTENCE_AND_LOCATION(
11921216
PSA_KEY_PERSISTENCE_READ_ONLY,
11931217
PSA_KEY_LOCATION_CRACEN));
@@ -1210,18 +1234,15 @@ psa_status_t cracen_get_builtin_key(psa_drv_slot_number_t slot_number,
12101234
*/
12111235
if (key_buffer_size >= opaque_key_size) {
12121236
*key_buffer_length = opaque_key_size;
1213-
*((ikg_opaque_key *)key_buffer) =
1214-
(ikg_opaque_key){.slot_number = slot_number,
1215-
.owner_id = MBEDTLS_SVC_KEY_ID_GET_OWNER_ID(
1216-
psa_get_key_id(attributes))};
1237+
cracen_set_ikg_key_buffer(attributes, slot_number, key_buffer);
12171238
return PSA_SUCCESS;
12181239
} else {
12191240
return PSA_ERROR_BUFFER_TOO_SMALL;
12201241
}
12211242
break;
12221243

1223-
case CRACEN_MKEK_SLOT_NUMBER:
1224-
case CRACEN_MEXT_SLOT_NUMBER:
1244+
case CRACEN_BUILTIN_MKEK_ID:
1245+
case CRACEN_BUILTIN_MEXT_ID:
12251246
psa_set_key_lifetime(attributes, PSA_KEY_LIFETIME_FROM_PERSISTENCE_AND_LOCATION(
12261247
PSA_KEY_PERSISTENCE_READ_ONLY,
12271248
PSA_KEY_LOCATION_CRACEN));
@@ -1240,10 +1261,7 @@ psa_status_t cracen_get_builtin_key(psa_drv_slot_number_t slot_number,
12401261
*/
12411262
if (key_buffer_size >= opaque_key_size) {
12421263
*key_buffer_length = opaque_key_size;
1243-
*((ikg_opaque_key *)key_buffer) =
1244-
(ikg_opaque_key){.slot_number = slot_number,
1245-
.owner_id = MBEDTLS_SVC_KEY_ID_GET_OWNER_ID(
1246-
psa_get_key_id(attributes))};
1264+
cracen_set_ikg_key_buffer(attributes, slot_number, key_buffer);
12471265
return PSA_SUCCESS;
12481266
} else {
12491267
return PSA_ERROR_BUFFER_TOO_SMALL;
@@ -1266,21 +1284,30 @@ psa_status_t mbedtls_psa_platform_get_builtin_key(mbedtls_svc_key_id_t key_id,
12661284
psa_key_lifetime_t *lifetime,
12671285
psa_drv_slot_number_t *slot_number)
12681286
{
1287+
/* For nRF54H20 devices all the builtin keys are considered platform keys,
1288+
* these include the IKG keys. The IKG keys in these devices don't directly
1289+
* use the CRACEN_BUILTIN_ ids, they use the IDs defined in the file
1290+
* nrf_platform_key_ids.h.
1291+
* The function cracen_platform_get_key_slot will do the matching between the
1292+
* platform key ids and the Cracen bulitin ids.
1293+
*/
1294+
#if CONFIG_PSA_NEED_CRACEN_PLATFORM_KEYS
1295+
return cracen_platform_get_key_slot(key_id, lifetime, slot_number);
1296+
#else
1297+
12691298
switch (MBEDTLS_SVC_KEY_ID_GET_KEY_ID(key_id)) {
12701299
case CRACEN_BUILTIN_IDENTITY_KEY_ID:
1271-
*slot_number = CRACEN_IDENTITY_KEY_SLOT_NUMBER;
1300+
*slot_number = CRACEN_BUILTIN_IDENTITY_KEY_ID;
12721301
break;
12731302
case CRACEN_BUILTIN_MKEK_ID:
1274-
*slot_number = CRACEN_MKEK_SLOT_NUMBER;
1303+
*slot_number = CRACEN_BUILTIN_MKEK_ID;
12751304
break;
12761305
case CRACEN_BUILTIN_MEXT_ID:
1277-
*slot_number = CRACEN_MEXT_SLOT_NUMBER;
1306+
*slot_number = CRACEN_BUILTIN_MEXT_ID;
12781307
break;
12791308
default:
12801309
#if CONFIG_PSA_NEED_CRACEN_KMU_DRIVER
12811310
return cracen_kmu_get_key_slot(key_id, lifetime, slot_number);
1282-
#elif CONFIG_PSA_NEED_CRACEN_PLATFORM_KEYS
1283-
return cracen_platform_get_key_slot(key_id, lifetime, slot_number);
12841311
#else
12851312
return PSA_ERROR_DOES_NOT_EXIST;
12861313
#endif
@@ -1290,6 +1317,7 @@ psa_status_t mbedtls_psa_platform_get_builtin_key(mbedtls_svc_key_id_t key_id,
12901317
PSA_KEY_LOCATION_CRACEN);
12911318

12921319
return PSA_SUCCESS;
1320+
#endif /* CONFIG_PSA_NEED_CRACEN_PLATFORM_KEYS */
12931321
}
12941322

12951323
psa_status_t cracen_export_key(const psa_key_attributes_t *attributes, const uint8_t *key_buffer,

0 commit comments

Comments
 (0)