bootutil: crypto: Add PSA crypto implementation for AES-KW - #2791
Conversation
Add a PSA crypto implementation for AES-KW. This implementation uses the PSA Crypto API to perform AES key unwrapping operations. Support for key wrapping was added in version 1.4 of the PSA Crypto API specification. Signed-off-by: Tim Pambor <tim.pambor@codewrights.de>
| psa_set_key_algorithm(&attributes, PSA_ALG_CTR); | ||
| psa_set_key_bits(&attributes, key_len * 8); | ||
|
|
||
| status = psa_unwrap_key(&attributes, ctx->key_id, PSA_ALG_ECB_NO_PADDING, |
There was a problem hiding this comment.
As far as I can tell psa_unwrap_key is only implemented in the thin_psa_crypto_core.c you mentioned and that's only built when MCUboot is built as part of the TF-M build. TBH I don't know how common it is to encrypt images in devices which are not also using TF-M, but if that's possible shouldn't we add some guard to ensure that this block is not compiled when MCUboot is built without TF-M? Wdyt?
There was a problem hiding this comment.
No strong opinion here, but I don't think it is necessary as one can select PSA or another crypto implementation and whether to use KW or ECIES, etc. tf-psa-crypto currently does not implement it, but there are other PSA implementations like Oberon PSA that also have support for AES-KW (https://github.com/nrfconnect/sdk-oberon-psa-crypto/blob/87917371cc6f3883dbdf0c7751c48a358ab8920a/core/psa_crypto.c#L6041)
2 participants
Add a PSA crypto implementation for AES-KW. This implementation uses the PSA Crypto API to perform AES key unwrapping operations.
Support for key wrapping was added in version 1.4 of the PSA Crypto API specification.
This implementation has been tested with TF-M, which also provides a implementation in its thin_psa_crypto_core layer.