Skip to content

Commit a8918df

Browse files
Vge0rgenordicjm
Vge0rge
authored and
nordicjm
committed
nrf_security: Refactor Cracen IKG keys
This refactors how we handle the IKG key IDs for Cracen. Before this change we used the internal Cracen IKG key identifiers inside the builtin key driver. This had an issue because both the KMU keys and the IKG internal key IDs share the IDs 0-2. To avoid this collision the IKG handling is refactored to use the reserved Cracen PSA key identifiers in the driver level and only use the internal key intentifiers deeper in the implementation in order to avoid the conflicts. Signed-off-by: Georgios Vasilakis <[email protected]>
1 parent c9f575f commit a8918df

File tree

5 files changed

+185
-70
lines changed

5 files changed

+185
-70
lines changed

‎subsys/nrf_security/src/drivers/cracen/cracenpsa/include/cracen_psa_key_ids.h‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,6 @@
1313

1414
#define CRACEN_PROTECTED_RAM_AES_KEY0_ID ((uint32_t)0x7fffc004)
1515

16-
#define CRACEN_IDENTITY_KEY_SLOT_NUMBER 0
17-
#define CRACEN_MKEK_SLOT_NUMBER 1
18-
#define CRACEN_MEXT_SLOT_NUMBER 2
19-
2016
#define PSA_KEY_LOCATION_CRACEN ((psa_key_location_t)(0x800000 | ('N' << 8)))
2117

2218
/*

‎subsys/nrf_security/src/drivers/cracen/cracenpsa/src/common.c‎

Lines changed: 92 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,9 @@
2828
#include <psa/nrf_platform_key_ids.h>
2929

3030
LOG_MODULE_DECLARE(cracen, CONFIG_CRACEN_LOG_LEVEL);
31+
#if CONFIG_PSA_NEED_CRACEN_PLATFORM_KEYS
32+
#include "platform_keys/platform_keys.h"
33+
#endif
3134

3235
#define NOT_ENABLED_CURVE (0)
3336
#define NOT_ENABLED_HASH_ALG (0)
@@ -725,6 +728,58 @@ static int cracen_clean_ik_key(const uint8_t *user_data)
725728
return SX_OK;
726729
}
727730

731+
static bool cracen_is_ikg_key(const psa_key_attributes_t *attributes)
732+
{
733+
#if CONFIG_PSA_NEED_CRACEN_PLATFORM_KEYS
734+
return cracen_platform_keys_is_ikg_key(attributes);
735+
#else
736+
switch (MBEDTLS_SVC_KEY_ID_GET_KEY_ID(psa_get_key_id(attributes))) {
737+
case CRACEN_BUILTIN_IDENTITY_KEY_ID:
738+
case CRACEN_BUILTIN_MKEK_ID:
739+
case CRACEN_BUILTIN_MEXT_ID:
740+
return true;
741+
default:
742+
return false;
743+
}
744+
#endif
745+
};
746+
747+
static psa_status_t cracen_load_ikg_keyref(const psa_key_attributes_t *attributes,
748+
const uint8_t *key_buffer, size_t key_buffer_size,
749+
struct sxkeyref *k)
750+
{
751+
k->prepare_key = cracen_prepare_ik_key;
752+
k->clean_key = cracen_clean_ik_key;
753+
754+
#if CONFIG_PSA_NEED_CRACEN_PLATFORM_KEYS
755+
if (key_buffer_size != sizeof(ikg_opaque_key)) {
756+
return PSA_ERROR_INVALID_ARGUMENT;
757+
}
758+
759+
k->cfg = ((ikg_opaque_key *)key_buffer)->slot_number;
760+
k->owner_id = ((ikg_opaque_key *)key_buffer)->owner_id;
761+
#else
762+
/* IKG keys are identified from the ID */
763+
(void)key_buffer;
764+
(void)key_buffer_size;
765+
766+
switch (MBEDTLS_SVC_KEY_ID_GET_KEY_ID(psa_get_key_id(attributes))) {
767+
case CRACEN_BUILTIN_MKEK_ID:
768+
k->cfg = CRACEN_INTERNAL_HW_KEY1_ID;
769+
break;
770+
case CRACEN_BUILTIN_MEXT_ID:
771+
k->cfg = CRACEN_INTERNAL_HW_KEY2_ID;
772+
break;
773+
default:
774+
return PSA_ERROR_INVALID_ARGUMENT;
775+
};
776+
777+
k->owner_id = MBEDTLS_SVC_KEY_ID_GET_OWNER_ID(psa_get_key_id(attributes));
778+
#endif
779+
k->user_data = (uint8_t *)&k->owner_id;
780+
return PSA_SUCCESS;
781+
}
782+
728783
psa_status_t cracen_load_keyref(const psa_key_attributes_t *attributes, const uint8_t *key_buffer,
729784
size_t key_buffer_size, struct sxkeyref *k)
730785
{
@@ -761,39 +816,28 @@ psa_status_t cracen_load_keyref(const psa_key_attributes_t *attributes, const ui
761816
if (PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)) ==
762817
PSA_KEY_LOCATION_CRACEN) {
763818

764-
k->prepare_key = cracen_prepare_ik_key;
765-
k->clean_key = cracen_clean_ik_key;
819+
if (cracen_is_ikg_key(attributes)) {
820+
return cracen_load_ikg_keyref(attributes, key_buffer, key_buffer_size, k);
821+
}
822+
766823
k->owner_id = MBEDTLS_SVC_KEY_ID_GET_OWNER_ID(psa_get_key_id(attributes));
767824
k->user_data = (uint8_t *)&k->owner_id;
825+
k->prepare_key = NULL;
826+
k->clean_key = NULL;
768827

769828
switch (MBEDTLS_SVC_KEY_ID_GET_KEY_ID(psa_get_key_id(attributes))) {
770-
case CRACEN_BUILTIN_MKEK_ID:
771-
k->cfg = CRACEN_INTERNAL_HW_KEY1_ID;
772-
break;
773-
case CRACEN_BUILTIN_MEXT_ID:
774-
k->cfg = CRACEN_INTERNAL_HW_KEY2_ID;
775-
break;
776829
case CRACEN_PROTECTED_RAM_AES_KEY0_ID:
777830
k->sz = 32;
778831
k->key = (uint8_t *)CRACEN_PROTECTED_RAM_AES_KEY0;
779-
k->prepare_key = NULL;
780-
k->clean_key = NULL;
781832
break;
782833
default:
783834
if (key_buffer_size == 0) {
784835
return PSA_ERROR_CORRUPTION_DETECTED;
785836
}
786837

787-
if (key_buffer_size == sizeof(ikg_opaque_key)) {
788-
k->cfg = ((ikg_opaque_key *)key_buffer)->slot_number;
789-
k->owner_id = ((ikg_opaque_key *)key_buffer)->owner_id;
790-
} else {
791-
/* Normal transparent key. */
792-
k->prepare_key = NULL;
793-
k->clean_key = NULL;
794-
k->key = key_buffer;
795-
k->sz = key_buffer_size;
796-
}
838+
/* Normal transparent key. */
839+
k->key = key_buffer;
840+
k->sz = key_buffer_size;
797841
}
798842
} else {
799843
k->key = key_buffer;
@@ -803,30 +847,38 @@ psa_status_t cracen_load_keyref(const psa_key_attributes_t *attributes, const ui
803847
return PSA_SUCCESS;
804848
}
805849

850+
static psa_status_t cracen_get_ikg_opaque_key_size(const psa_key_attributes_t *attributes,
851+
size_t *key_size)
852+
{
853+
#ifdef CONFIG_PSA_NEED_CRACEN_PLATFORM_KEYS
854+
return cracen_platform_keys_get_size(attributes, key_size);
855+
#else
856+
switch (MBEDTLS_SVC_KEY_ID_GET_KEY_ID(psa_get_key_id(attributes))) {
857+
case CRACEN_BUILTIN_IDENTITY_KEY_ID:
858+
if (psa_get_key_type(attributes) ==
859+
PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1)) {
860+
*key_size = sizeof(ikg_opaque_key);
861+
return PSA_SUCCESS;
862+
}
863+
break;
864+
case CRACEN_BUILTIN_MEXT_ID:
865+
case CRACEN_BUILTIN_MKEK_ID:
866+
if (psa_get_key_type(attributes) == PSA_KEY_TYPE_AES) {
867+
*key_size = sizeof(ikg_opaque_key);
868+
return PSA_SUCCESS;
869+
}
870+
break;
871+
}
872+
873+
return PSA_ERROR_INVALID_ARGUMENT;
874+
#endif /* CONFIG_PSA_NEED_CRACEN_PLATFORM_KEYS */
875+
}
876+
806877
psa_status_t cracen_get_opaque_size(const psa_key_attributes_t *attributes, size_t *key_size)
807878
{
808879
if (PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)) ==
809880
PSA_KEY_LOCATION_CRACEN) {
810-
switch (MBEDTLS_SVC_KEY_ID_GET_KEY_ID(psa_get_key_id(attributes))) {
811-
case CRACEN_BUILTIN_IDENTITY_KEY_ID:
812-
if (psa_get_key_type(attributes) ==
813-
PSA_KEY_TYPE_ECC_KEY_PAIR(PSA_ECC_FAMILY_SECP_R1)) {
814-
*key_size = sizeof(ikg_opaque_key);
815-
return PSA_SUCCESS;
816-
}
817-
break;
818-
case CRACEN_BUILTIN_MEXT_ID:
819-
case CRACEN_BUILTIN_MKEK_ID:
820-
if (psa_get_key_type(attributes) == PSA_KEY_TYPE_AES) {
821-
*key_size = sizeof(ikg_opaque_key);
822-
return PSA_SUCCESS;
823-
}
824-
break;
825-
#ifdef CONFIG_PSA_NEED_CRACEN_PLATFORM_KEYS
826-
default:
827-
return cracen_platform_keys_get_size(attributes, key_size);
828-
#endif
829-
}
881+
return cracen_get_ikg_opaque_key_size(attributes, key_size);
830882
}
831883

832884
if (PSA_KEY_LIFETIME_GET_LOCATION(psa_get_key_lifetime(attributes)) ==

‎subsys/nrf_security/src/drivers/cracen/cracenpsa/src/key_management.c‎

Lines changed: 40 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
#include <stddef.h>
2525
#include <string.h>
2626
#include <sxsymcrypt/trng.h>
27+
#include <sxsymcrypt/keyref.h>
2728
#include <zephyr/sys/__assert.h>
2829
#include <zephyr/sys/byteorder.h>
2930

@@ -1147,6 +1148,25 @@ psa_status_t cracen_generate_key(const psa_key_attributes_t *attributes, uint8_t
11471148
return PSA_ERROR_NOT_SUPPORTED;
11481149
}
11491150

1151+
static void cracen_set_ikg_key_buffer(psa_key_attributes_t *attributes,
1152+
psa_drv_slot_number_t slot_number, uint8_t *key_buffer)
1153+
{
1154+
ikg_opaque_key *ikg_key = (ikg_opaque_key *)key_buffer;
1155+
1156+
switch (slot_number) {
1157+
case CRACEN_BUILTIN_IDENTITY_KEY_ID:
1158+
/* The slot_number is not used with the identity key */
1159+
break;
1160+
case CRACEN_BUILTIN_MKEK_ID:
1161+
ikg_key->slot_number = CRACEN_INTERNAL_HW_KEY1_ID;
1162+
break;
1163+
case CRACEN_BUILTIN_MEXT_ID:
1164+
ikg_key->slot_number = CRACEN_INTERNAL_HW_KEY2_ID;
1165+
break;
1166+
}
1167+
1168+
ikg_key->owner_id = MBEDTLS_SVC_KEY_ID_GET_OWNER_ID(psa_get_key_id(attributes));
1169+
}
11501170

11511171
psa_status_t cracen_get_builtin_key(psa_drv_slot_number_t slot_number,
11521172
psa_key_attributes_t *attributes, uint8_t *key_buffer,
@@ -1160,7 +1180,7 @@ psa_status_t cracen_get_builtin_key(psa_drv_slot_number_t slot_number,
11601180
* attributes, and update the `lifetime` field to be more specific.
11611181
*/
11621182
switch (slot_number) {
1163-
case CRACEN_IDENTITY_KEY_SLOT_NUMBER:
1183+
case CRACEN_BUILTIN_IDENTITY_KEY_ID:
11641184
psa_set_key_lifetime(attributes, PSA_KEY_LIFETIME_FROM_PERSISTENCE_AND_LOCATION(
11651185
CRACEN_KEY_PERSISTENCE_READ_ONLY,
11661186
PSA_KEY_LOCATION_CRACEN));
@@ -1183,18 +1203,15 @@ psa_status_t cracen_get_builtin_key(psa_drv_slot_number_t slot_number,
11831203
*/
11841204
if (key_buffer_size >= opaque_key_size) {
11851205
*key_buffer_length = opaque_key_size;
1186-
*((ikg_opaque_key *)key_buffer) =
1187-
(ikg_opaque_key){.slot_number = slot_number,
1188-
.owner_id = MBEDTLS_SVC_KEY_ID_GET_OWNER_ID(
1189-
psa_get_key_id(attributes))};
1206+
cracen_set_ikg_key_buffer(attributes, slot_number, key_buffer);
11901207
return PSA_SUCCESS;
11911208
} else {
11921209
return PSA_ERROR_BUFFER_TOO_SMALL;
11931210
}
11941211
break;
11951212

1196-
case CRACEN_MKEK_SLOT_NUMBER:
1197-
case CRACEN_MEXT_SLOT_NUMBER:
1213+
case CRACEN_BUILTIN_MKEK_ID:
1214+
case CRACEN_BUILTIN_MEXT_ID:
11981215
psa_set_key_lifetime(attributes, PSA_KEY_LIFETIME_FROM_PERSISTENCE_AND_LOCATION(
11991216
CRACEN_KEY_PERSISTENCE_READ_ONLY,
12001217
PSA_KEY_LOCATION_CRACEN));
@@ -1213,10 +1230,7 @@ psa_status_t cracen_get_builtin_key(psa_drv_slot_number_t slot_number,
12131230
*/
12141231
if (key_buffer_size >= opaque_key_size) {
12151232
*key_buffer_length = opaque_key_size;
1216-
*((ikg_opaque_key *)key_buffer) =
1217-
(ikg_opaque_key){.slot_number = slot_number,
1218-
.owner_id = MBEDTLS_SVC_KEY_ID_GET_OWNER_ID(
1219-
psa_get_key_id(attributes))};
1233+
cracen_set_ikg_key_buffer(attributes, slot_number, key_buffer);
12201234
return PSA_SUCCESS;
12211235
} else {
12221236
return PSA_ERROR_BUFFER_TOO_SMALL;
@@ -1239,21 +1253,30 @@ psa_status_t mbedtls_psa_platform_get_builtin_key(mbedtls_svc_key_id_t key_id,
12391253
psa_key_lifetime_t *lifetime,
12401254
psa_drv_slot_number_t *slot_number)
12411255
{
1256+
/* For nRF54H20 devices all the builtin keys are considered platform keys,
1257+
* these include the IKG keys. The IKG keys in these devices don't directly
1258+
* use the CRACEN_BUILTIN_ ids, they use the IDs defined in the file
1259+
* nrf_platform_key_ids.h.
1260+
* The function cracen_platform_get_key_slot will do the matching between the
1261+
* platform key ids and the Cracen bulitin ids.
1262+
*/
1263+
#if CONFIG_PSA_NEED_CRACEN_PLATFORM_KEYS
1264+
return cracen_platform_get_key_slot(key_id, lifetime, slot_number);
1265+
#else
1266+
12421267
switch (MBEDTLS_SVC_KEY_ID_GET_KEY_ID(key_id)) {
12431268
case CRACEN_BUILTIN_IDENTITY_KEY_ID:
1244-
*slot_number = CRACEN_IDENTITY_KEY_SLOT_NUMBER;
1269+
*slot_number = CRACEN_BUILTIN_IDENTITY_KEY_ID;
12451270
break;
12461271
case CRACEN_BUILTIN_MKEK_ID:
1247-
*slot_number = CRACEN_MKEK_SLOT_NUMBER;
1272+
*slot_number = CRACEN_BUILTIN_MKEK_ID;
12481273
break;
12491274
case CRACEN_BUILTIN_MEXT_ID:
1250-
*slot_number = CRACEN_MEXT_SLOT_NUMBER;
1275+
*slot_number = CRACEN_BUILTIN_MEXT_ID;
12511276
break;
12521277
default:
12531278
#if CONFIG_PSA_NEED_CRACEN_KMU_DRIVER
12541279
return cracen_kmu_get_key_slot(key_id, lifetime, slot_number);
1255-
#elif CONFIG_PSA_NEED_CRACEN_PLATFORM_KEYS
1256-
return cracen_platform_get_key_slot(key_id, lifetime, slot_number);
12571280
#else
12581281
return PSA_ERROR_DOES_NOT_EXIST;
12591282
#endif
@@ -1263,6 +1286,7 @@ psa_status_t mbedtls_psa_platform_get_builtin_key(mbedtls_svc_key_id_t key_id,
12631286
PSA_KEY_LOCATION_CRACEN);
12641287

12651288
return PSA_SUCCESS;
1289+
#endif /* CONFIG_PSA_NEED_CRACEN_PLATFORM_KEYS */
12661290
}
12671291

12681292
psa_status_t cracen_export_key(const psa_key_attributes_t *attributes, const uint8_t *key_buffer,

0 commit comments

Comments
 (0)