TrustedFirmware Git Browser
Code Review Sign In
review.trustedfirmware.org / mirror / mbed-crypto / 6c723a2f46051a3543bb7856b41761e84f5a8a15 / . / docs / html / overview / sample-arch.html
blob: 855382df8c584d531fc50c025ef1dfea17aed0ea [file] [log] [blame]
Gilles Peskine6c723a22020-04-17 16:57:52 +0200[diff] [blame^]1
2<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
3 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
4
5<html xmlns="http://www.w3.org/1999/xhtml">
6 <head>
7 <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
8 <title>Sample architectures &#8212; PSA Crypto API 1.0.0 documentation</title>
9 <link rel="stylesheet" href="../_static/alabaster.css" type="text/css" />
10 <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />
11 <script type="text/javascript">
12 var DOCUMENTATION_OPTIONS = {
13 URL_ROOT: '../',
14 VERSION: '1.0.0',
15 COLLAPSE_INDEX: false,
16 FILE_SUFFIX: '.html',
17 HAS_SOURCE: true,
18 SOURCELINK_SUFFIX: '.txt'
19 };
20 </script>
21 <script type="text/javascript" src="../_static/jquery.js"></script>
22 <script type="text/javascript" src="../_static/underscore.js"></script>
23 <script type="text/javascript" src="../_static/doctools.js"></script>
24 <link rel="index" title="Index" href="../genindex.html" />
25 <link rel="search" title="Search" href="../search.html" />
26 <link rel="next" title="Library conventions" href="conventions.html" />
27 <link rel="prev" title="Functionality overview" href="functionality.html" />
28
29 <link rel="stylesheet" href="../_static/custom.css" type="text/css" />
30
31 <meta name="viewport" content="width=device-width, initial-scale=0.9, maximum-scale=0.9" />
32
33 </head>
34 <body>
35
36
37 <div class="document">
38 <div class="documentwrapper">
39 <div class="bodywrapper">
40 <div class="body" role="main">
41
42 <div class="section" id="sample-architectures">
43<span id="architectures"></span><h1>Sample architectures</h1>
44<p>This section describes some example architectures that can be used for
45implementations of the interface described in this specification. This list is
46not exhaustive and the section is entirely non-normative.</p>
47<div class="section" id="single-partition-architecture">
48<h2>Single-partition architecture</h2>
49<p>In the single-partition architecture, there is no security boundary inside the system. The
50application code can access all the system memory, including the memory used by
51the cryptographic services described in this specification. Thus, the
52architecture provides <a class="reference internal" href="goals.html#isolation"><span class="std std-ref">no isolation</span></a>.</p>
53<p>This architecture does not conform to the Arm <em>Platform Security Architecture
54Security Model</em>. However, it is useful for providing cryptographic services
55that use the same interface, even on devices that cannot support any security
56boundary. So, while this architecture is not the primary design goal of the API
57defined in the present specification, it is supported.</p>
58<p>The functions in this specification simply execute the underlying algorithmic
59code. Security checks can be kept to a minimum, since the cryptoprocessor cannot
60defend against a malicious application. Key import and export copy data inside
61the same memory space.</p>
62<p>This architecture also describes a subset of some larger systems, where the
63cryptographic services are implemented inside a high-security partition,
64separate from the code of the main application, though it shares this
65high-security partition with other platform security services.</p>
66</div>
67<div class="section" id="cryptographic-token-and-single-application-processor">
68<span id="isolated-cryptoprocessor"></span><h2>Cryptographic token and single-application processor</h2>
69<p>This system is composed of two partitions: one is a cryptoprocessor and the
70other partition runs an application. There is a security boundary between the
71two partitions, so that the application cannot access the cryptoprocessor,
72except through its public interface. Thus, the architecture provides
73<a class="reference internal" href="goals.html#isolation"><span class="std std-ref">cryptoprocessor isolation</span></a>. The cryptoprocessor has
74some non-volatile storage, a TRNG, and possibly, some cryptographic accelerators.</p>
75<p>There are a number of potential physical realizations: the cryptoprocessor might
76be a separate chip, a separate processor on the same chip, or a logical
77partition using a combination of hardware and software to provide the isolation.
78These realizations are functionally equivalent in terms of the offered software
79interface, but they would typically offer different levels of security
80guarantees.</p>
81<p>The PSA crypto API in the application processor consists of a thin layer of code
82that translates function calls to remote procedure calls in the cryptoprocessor.
83All cryptographic computations are, therefore, performed inside the
84cryptoprocessor. Non-volatile keys are stored inside the cryptoprocessor.</p>
85</div>
86<div class="section" id="cryptoprocessor-with-no-key-storage">
87<h2>Cryptoprocessor with no key storage</h2>
88<p>As in the <em><a class="reference internal" href="#isolated-cryptoprocessor"><span class="std std-ref">Cryptographic token and single-application processor</span></a></em> architecture, this system
89is also composed of two partitions separated by a security boundary and also
90provides <a class="reference internal" href="goals.html#isolation"><span class="std std-ref">cryptoprocessor isolation</span></a>.
91However, unlike the previous architecture, in this system, the cryptoprocessor
92does not have any secure, persistent storage that could be used to store
93application keys.</p>
94<p>If the cryptoprocessor is not capable of storing cryptographic material, then
95there is little use for a separate cryptoprocessor, since all data would have to
96be imported by the application.</p>
97<p>The cryptoprocessor can provide useful services if it is able to store at least
98one key. This might be a hardware unique key that is burnt to one-time
99programmable memory during the manufacturing of the device. This key can be used
100for one or more purposes:</p>
101<ul class="simple">
102<li>Encrypt and authenticate data stored in the application processor.</li>
103<li>Communicate with a paired device.</li>
104<li>Allow the application to perform operations with keys that are derived from
105the hardware unique key.</li>
106</ul>
107</div>
108<div class="section" id="multi-client-cryptoprocessor">
109<h2>Multi-client cryptoprocessor</h2>
110<p>This is an expanded variant of the <a class="reference internal" href="#isolated-cryptoprocessor"><span class="std std-ref">cryptographic token plus application
111architecture</span></a>. In this
112variant, the cryptoprocessor serves multiple applications that are mutually
113untrustworthy. This architecture provides <a class="reference internal" href="goals.html#isolation"><span class="std std-ref">caller
114isolation</span></a>.</p>
115<p>In this architecture, API calls are translated to remote procedure calls, which
116encode the identity of the client application. The cryptoprocessor carefully
117segments its internal storage to ensure that a client’s data is never leaked to
118another client.</p>
119</div>
120<div class="section" id="multi-cryptoprocessor-architecture">
121<h2>Multi-cryptoprocessor architecture</h2>
122<p>This system includes multiple cryptoprocessors. There are several reasons to
123have multiple cryptoprocessors:</p>
124<ul class="simple">
125<li>Different compromises between security and performance for different keys.
126Typically, this means a cryptoprocessor that runs on the same hardware as the
127main application and processes short-term secrets, a secure element or a
128similar separate chip that retains long-term secrets.</li>
129<li>Independent provisioning of certain secrets.</li>
130<li>A combination of a non-removable cryptoprocessor and removable ones, for
131example, a smartcard or HSM.</li>
132<li>Cryptoprocessors managed by different stakeholders who do not trust each
133other.</li>
134</ul>
135<p>The keystore implementation needs to dispatch each request to the correct
136processor. For example:</p>
137<ul class="simple">
138<li>All requests involving a non-extractable key must be processed in the
139cryptoprocessor that holds that key.</li>
140<li>Requests involving a persistent key must be processed in the cryptoprocessor
141that corresponds to the key’s lifetime value.</li>
142<li>Requests involving a volatile key might target a cryptoprocessor based on
143parameters supplied by the application, or based on considerations such as
144performance inside the implementation.</li>
145</ul>
146</div>
147</div>
148
149
150 </div>
151 </div>
152 </div>
153 <div class="sphinxsidebar" role="navigation" aria-label="main navigation">
154 <div class="sphinxsidebarwrapper">
155 <h3><a href="../index.html">Table Of Contents</a></h3>
156 <ul>
157<li><a class="reference internal" href="#">Sample architectures</a><ul>
158<li><a class="reference internal" href="#single-partition-architecture">Single-partition architecture</a></li>
159<li><a class="reference internal" href="#cryptographic-token-and-single-application-processor">Cryptographic token and single-application processor</a></li>
160<li><a class="reference internal" href="#cryptoprocessor-with-no-key-storage">Cryptoprocessor with no key storage</a></li>
161<li><a class="reference internal" href="#multi-client-cryptoprocessor">Multi-client cryptoprocessor</a></li>
162<li><a class="reference internal" href="#multi-cryptoprocessor-architecture">Multi-cryptoprocessor architecture</a></li>
163</ul>
164</li>
165</ul>
166<div class="relations">
167<h3>Related Topics</h3>
168<ul>
169 <li><a href="../index.html">Documentation overview</a><ul>
170 <li>Previous: <a href="functionality.html" title="previous chapter">Functionality overview</a></li>
171 <li>Next: <a href="conventions.html" title="next chapter">Library conventions</a></li>
172 </ul></li>
173</ul>
174</div>
175 <div role="note" aria-label="source link">
176 <h3>This Page</h3>
177 <ul class="this-page-menu">
178 <li><a href="../_sources/overview/sample-arch.rst.txt"
179 rel="nofollow">Show Source</a></li>
180 </ul>
181 </div>
182<div id="searchbox" style="display: none" role="search">
183 <h3>Quick search</h3>
184 <form class="search" action="../search.html" method="get">
185 <div><input type="text" name="q" /></div>
186 <div><input type="submit" value="Go" /></div>
187 <input type="hidden" name="check_keywords" value="yes" />
188 <input type="hidden" name="area" value="default" />
189 </form>
190</div>
191<script type="text/javascript">$('#searchbox').show(0);</script>
192 </div>
193 </div>
194 <div class="clearer"></div>
195 </div>
196 <div class="footer">
197 &copy; 2019-2020, Arm Limited or its affiliates. All rights reserved.
198
199 |
200 Powered by <a href="http://sphinx-doc.org/">Sphinx 1.6.7</a>
201 &amp; <a href="https://github.com/bitprophet/alabaster">Alabaster 0.7.8</a>
202
203 |
204 <a href="../_sources/overview/sample-arch.rst.txt"
205 rel="nofollow">Page source</a>
206 </div>
207
208
209
210
211 </body>
212</html>