[参考译文] CC2745R10-Q1：关于 PSA 密钥库导入和导出

https://e2e.ti.com/support/wireless-connectivity/bluetooth-group/bluetooth/f/bluetooth-forum/1502248/cc2745r10-q1-about-psa-keystore-import-and-export

工具/软件：

相关问题

CC2745R10-Q1：使用 PSA 密钥库进行加密操作- Bluetooth 论坛- Bluetooth︎- TI E2E 支持论坛

你好。

此问题与 Kaichi 提出的查询有关。

我修改了 NIMA 提供的源代码如下。

导入的密钥随后导出时、导出的密钥exported_key()和导入的密钥()keyingMaterial是相同的。

/* For usleep() */
#include <unistd.h>
#include <stdint.h>
#include <stddef.h>

/* Driver Header files */
#include <ti/drivers/GPIO.h>
#include <third_party/psa_crypto/include/psa/crypto.h>
#include <ti/drivers/cryptoutils/hsm/HSMLPF3.h>

/* Driver configuration */
#include "ti_drivers_config.h"

#define KEY_LIFETIME PSA_KEY_LIFETIME_FROM_PERSISTENCE_AND_LOCATION(PSA_KEY_PERSISTENCE_DEFAULT, PSA_KEY_LOCATION_LOCAL_STORAGE)

uint8_t keyingMaterial[16] = { 0x06, 0xa9, 0x21, 0x40, 0x36, 0xb8, 0xa1, 0x5b, 0x51, 0x2e, 0x03, 0xd5, 0x34, 0x12, 0x00, 0x06 };
uint8_t iv[16] = { 0x3d, 0xaf, 0xba, 0x42, 0x9d, 0x9e, 0xb4, 0x30, 0xb4, 0x22, 0xda, 0x80, 0x2c, 0x9f, 0xac, 0x41 };
uint8_t plaintext[16] = { 0x53, 0x69, 0x6e, 0x67, 0x6c, 0x65, 0x20, 0x62, 0x6c, 0x6f, 0x63, 0x6b, 0x20, 0x6d, 0x73, 0x67 };
uint8_t ciphertext[16];
uint8_t exported_key[sizeof(keyingMaterial)];

//ciphertest { 0xe3, 0x53, 0x77, 0x9c, 0x10, 0x79, 0xae, 0xb8, 0x27, 0x08, 0x94, 0x2d, 0xbe, 0x77, 0x18, 0x1a };


/*
 *  ======== mainThread ========
 */
void *mainThread(void *arg0)
{
    psa_status_t status;
    psa_key_id_t key_id;
    size_t exported_key_length;
    psa_cipher_operation_t op = PSA_CIPHER_OPERATION_INIT;
    psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
    size_t cipher_length = 0;
    int_fast16_t ret;

    status = psa_crypto_init();
    if (status != PSA_SUCCESS)
    {
        while(1);
    }

    ret = HSMLPF3_provisionHUK();
    if (ret != HSMLPF3_STATUS_SUCCESS)
    {
        while(1);
    }


    /* Import Key*/
    psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_EXPORT|PSA_KEY_USAGE_ENCRYPT|PSA_KEY_USAGE_DECRYPT);
    psa_set_key_algorithm(&attributes, PSA_ALG_CBC_NO_PADDING);
    psa_set_key_type(&attributes, PSA_KEY_TYPE_AES);
    psa_set_key_lifetime(&attributes, KEY_LIFETIME);
    psa_set_key_bits(&attributes, 128);

    key_id = PSA_KEY_ID_USER_MIN;
    psa_set_key_id(&attributes, key_id);

    status = psa_import_key(&attributes, keyingMaterial, sizeof(keyingMaterial), &key_id);
    if (status != PSA_SUCCESS)
    {
        while(1);
    }

    /* AES-CBC　Encrypt */
    status = psa_cipher_encrypt_setup(&op, key_id, PSA_ALG_CBC_NO_PADDING);
    if (status != PSA_SUCCESS)
    {
        while(1);
    }

    status = psa_cipher_set_iv(&op, iv, sizeof(iv));
    if (status != PSA_SUCCESS)
    {
        while(1);
    }

    status = psa_cipher_update(&op,
                               plaintext,
                               sizeof(plaintext),
                               ciphertext,
                               sizeof(plaintext),
                               &cipher_length);

    if (status != PSA_SUCCESS)
    {
        while(1);
    }

    status = psa_cipher_finish(&op,
                               ciphertext,
                               sizeof(plaintext),
                               &cipher_length);
    if (status != PSA_SUCCESS)
    {
        while(1);
    }


    /*　Export Key*/
    status = psa_export_key(key_id, exported_key, sizeof(exported_key), &exported_key_length);

    if (status != PSA_SUCCESS)
    {
         while(1);
    }


    while(1);
}

由于可存储的密钥数量有限、我考虑暂时导出密钥进行保存、并在需要时重新导入。

因此、出于安全考虑、最好对导出的密钥进行加密。

是否可以导出加密密钥？