Secure Element Key Derivation and Agreement

Key derivation is the process of generating new key material using an existing key and additional parameters, iterating through a basic cryptographic function, such as a hash. More...

Detailed Description

Key derivation is the process of generating new key material using an existing key and additional parameters, iterating through a basic cryptographic function, such as a hash.

Key agreement is a part of cryptographic protocols that allows two parties to agree on the same key value, but starting from different original key material. The flows are similar, and the PSA Crypto Driver Model uses the same functions for both of the flows.

There are two different final functions for the flows, `psa_drv_se_key_derivation_derive` and `psa_drv_se_key_derivation_export`. `psa_drv_se_key_derivation_derive` is used when the key material should be placed in a slot on the hardware and not exposed to the caller. `psa_drv_se_key_derivation_export` is used when the key material should be returned to the PSA Cryptographic API implementation.

Different key derivation algorithms require a different number of inputs. Instead of having an API that takes as input variable length arrays, which can be problemmatic to manage on embedded platforms, the inputs are passed to the driver via a function, `psa_drv_se_key_derivation_collateral`, that is called multiple times with different `collateral_id`s. Thus, for a key derivation algorithm that required 3 paramter inputs, the flow would look something like: ~~~~~~~~~~~~~{.c} psa_drv_se_key_derivation_setup(kdf_algorithm, source_key, dest_key_size_bytes); psa_drv_se_key_derivation_collateral(kdf_algorithm_collateral_id_0, p_collateral_0, collateral_0_size); psa_drv_se_key_derivation_collateral(kdf_algorithm_collateral_id_1, p_collateral_1, collateral_1_size); psa_drv_se_key_derivation_collateral(kdf_algorithm_collateral_id_2, p_collateral_2, collateral_2_size); psa_drv_se_key_derivation_derive(); ~~~~~~~~~~~~~

key agreement example: ~~~~~~~~~~~~~{.c} psa_drv_se_key_derivation_setup(alg, source_key. dest_key_size_bytes); psa_drv_se_key_derivation_collateral(DHE_PUBKEY, p_pubkey, pubkey_size); psa_drv_se_key_derivation_export(p_session_key, session_key_size, &session_key_length); ~~~~~~~~~~~~~

Typedef Documentation