TrustedFirmware Git Browser
Code Review Sign In
review.trustedfirmware.org / mirror / mbed-crypto / 882f7c72267ee598fd4f7c0d34b2c70760c76d8c / . / docs / 1.1.0 / html / overview / sample-arch.html
blob: 68b49711d02cf3e1a56d575c903b9d7f0a991c40 [file] [log] [blame]
Gilles Peskine882f7c72022-04-07 13:44:55 +0200[diff] [blame^]1
2<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
3 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
4
5<html xmlns="http://www.w3.org/1999/xhtml">
6 <head>
7 <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
8 <title>4. Sample architectures &#8212; PSA Crypto API 1.1.0 documentation</title>
9 <link rel="stylesheet" href="../_static/alabaster.css" type="text/css" />
10 <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />
11 <script type="text/javascript">
12 var DOCUMENTATION_OPTIONS = {
13 URL_ROOT: '../',
14 VERSION: '1.1.0',
15 COLLAPSE_INDEX: false,
16 FILE_SUFFIX: '.html',
17 HAS_SOURCE: false,
18 SOURCELINK_SUFFIX: '.txt'
19 };
20 </script>
21 <script type="text/javascript" src="../_static/jquery.js"></script>
22 <script type="text/javascript" src="../_static/underscore.js"></script>
23 <script type="text/javascript" src="../_static/doctools.js"></script>
24 <link rel="author" title="About these documents" href="../about.html" />
25 <link rel="index" title="Index" href="../genindex.html" />
26 <link rel="search" title="Search" href="../search.html" />
27 <link rel="next" title="5. Library conventions" href="conventions.html" />
28 <link rel="prev" title="3. Functionality overview" href="functionality.html" />
29
30 <link rel="stylesheet" href="../_static/custom.css" type="text/css" />
31
32 <meta name="viewport" content="width=device-width, initial-scale=0.9, maximum-scale=0.9" />
33
34 </head>
35 <body>
36
37
38 <div class="document">
39 <div class="documentwrapper">
40 <div class="bodywrapper">
41 <div class="body" role="main">
42
43 <div class="section" id="sample-architectures">
44<span id="architectures"></span><h1>4. Sample architectures</h1>
45<p>This section describes some example architectures that can be used for
46implementations of the interface described in this specification. This list is
47not exhaustive and the section is entirely non-normative.</p>
48<div class="section" id="single-partition-architecture">
49<h2>4.1. Single-partition architecture</h2>
50<p>In the single-partition architecture, there is no security boundary inside the system. The
51application code can access all the system memory, including the memory used by
52the cryptographic services described in this specification. Thus, the
53architecture provides <a class="reference internal" href="../about.html#term-no-isolation"><span class="term">no isolation</span></a>.</p>
54<p>This architecture does not conform to the Arm <em>Platform Security Architecture
55Security Model</em>. However, it is useful for providing cryptographic services
56that use the same interface, even on devices that cannot support any security
57boundary. So, while this architecture is not the primary design goal of the API
58defined in the present specification, it is supported.</p>
59<p>The functions in this specification simply execute the underlying algorithmic
60code. Security checks can be kept to a minimum, since the cryptoprocessor cannot
61defend against a malicious application. Key import and export copy data inside
62the same memory space.</p>
63<p>This architecture also describes a subset of some larger systems, where the
64cryptographic services are implemented inside a high-security partition,
65separate from the code of the main application, though it shares this
66high-security partition with other platform security services.</p>
67</div>
68<div class="section" id="cryptographic-token-and-single-application-processor">
69<span id="isolated-cryptoprocessor"></span><h2>4.2. Cryptographic token and single-application processor</h2>
70<p>This system is composed of two partitions: one is a cryptoprocessor and the
71other partition runs an application. There is a security boundary between the
72two partitions, so that the application cannot access the cryptoprocessor,
73except through its public interface. Thus, the architecture provides
74<a class="reference internal" href="../about.html#term-cryptoprocessor-isolation"><span class="term">cryptoprocessor isolation</span></a>. The cryptoprocessor has
75some non-volatile storage, a TRNG, and possibly, some cryptographic accelerators.</p>
76<p>There are a number of potential physical realizations: the cryptoprocessor might
77be a separate chip, a separate processor on the same chip, or a logical
78partition using a combination of hardware and software to provide the isolation.
79These realizations are functionally equivalent in terms of the offered software
80interface, but they would typically offer different levels of security
81guarantees.</p>
82<p>The PSA crypto API in the application processor consists of a thin layer of code
83that translates function calls to remote procedure calls in the cryptoprocessor.
84All cryptographic computations are, therefore, performed inside the
85cryptoprocessor. Non-volatile keys are stored inside the cryptoprocessor.</p>
86</div>
87<div class="section" id="cryptoprocessor-with-no-key-storage">
88<h2>4.3. Cryptoprocessor with no key storage</h2>
89<p>As in the <a class="reference internal" href="#isolated-cryptoprocessor"><span class="secref">Cryptographic token and single-application processor</span></a> architecture, this system
90is also composed of two partitions separated by a security boundary and also
91provides <a class="reference internal" href="../about.html#term-cryptoprocessor-isolation"><span class="term">cryptoprocessor isolation</span></a>.
92However, unlike the previous architecture, in this system, the cryptoprocessor
93does not have any secure, persistent storage that could be used to store
94application keys.</p>
95<p>If the cryptoprocessor is not capable of storing cryptographic material, then
96there is little use for a separate cryptoprocessor, since all data would have to
97be imported by the application.</p>
98<p>The cryptoprocessor can provide useful services if it is able to store at least
99one key. This might be a hardware unique key that is burnt to one-time
100programmable memory during the manufacturing of the device. This key can be used
101for one or more purposes:</p>
102<ul class="simple">
103<li>Encrypt and authenticate data stored in the application processor.</li>
104<li>Communicate with a paired device.</li>
105<li>Allow the application to perform operations with keys that are derived from
106the hardware unique key.</li>
107</ul>
108</div>
109<div class="section" id="multi-client-cryptoprocessor">
110<h2>4.4. Multi-client cryptoprocessor</h2>
111<p>This is an expanded variant of
112<a class="reference internal" href="#isolated-cryptoprocessor"><span class="secref">Cryptographic token and single-application processor</span></a>. In this
113variant, the cryptoprocessor serves multiple applications that are mutually
114untrustworthy. This architecture provides <a class="reference internal" href="../about.html#term-caller-isolation"><span class="term">caller isolation</span></a>.</p>
115<p>In this architecture, API calls are translated to remote procedure calls, which
116encode the identity of the client application. The cryptoprocessor carefully
117segments its internal storage to ensure that a client’s data is never leaked to
118another client.</p>
119</div>
120<div class="section" id="multi-cryptoprocessor-architecture">
121<h2>4.5. Multi-cryptoprocessor architecture</h2>
122<p>This system includes multiple cryptoprocessors. There are several reasons to
123have multiple cryptoprocessors:</p>
124<ul class="simple">
125<li>Different compromises between security and performance for different keys.
126Typically, this means a cryptoprocessor that runs on the same hardware as the
127main application and processes short-term secrets, a secure element or a
128similar separate chip that retains long-term secrets.</li>
129<li>Independent provisioning of certain secrets.</li>
130<li>A combination of a non-removable cryptoprocessor and removable ones, for
131example, a smartcard or HSM.</li>
132<li>Cryptoprocessors managed by different stakeholders who do not trust each
133other.</li>
134</ul>
135<p>The keystore implementation needs to dispatch each request to the correct
136processor. For example:</p>
137<ul class="simple">
138<li>All requests involving a non-extractable key must be processed in the
139cryptoprocessor that holds that key.</li>
140<li>Requests involving a persistent key must be processed in the cryptoprocessor
141that corresponds to the key’s lifetime value.</li>
142<li>Requests involving a volatile key might target a cryptoprocessor based on
143parameters supplied by the application, or based on considerations such as
144performance inside the implementation.</li>
145</ul>
146</div>
147</div>
148
149
150 </div>
151 </div>
152 </div>
153 <div class="sphinxsidebar" role="navigation" aria-label="main navigation">
154 <div class="sphinxsidebarwrapper"><h3><a href="../index.html"><b>PSA Crypto API</b></a></h3>
155IHI 0086<br/>
156Non-confidential<br/>
157Version 1.1.0
158<span style="color: red; font-weight: bold;"></span>
159<ul>
160<li class="toctree-l1"><a class="reference internal" href="../about.html">About this document</a></li>
161</ul>
162<ul class="current">
163<li class="toctree-l1"><a class="reference internal" href="intro.html">1. Introduction</a></li>
164<li class="toctree-l1"><a class="reference internal" href="goals.html">2. Design goals</a></li>
165<li class="toctree-l1"><a class="reference internal" href="functionality.html">3. Functionality overview</a></li>
166<li class="toctree-l1 current"><a class="current reference internal" href="#">4. Sample architectures</a><ul>
167<li class="toctree-l2"><a class="reference internal" href="#single-partition-architecture">4.1. Single-partition architecture</a></li>
168<li class="toctree-l2"><a class="reference internal" href="#cryptographic-token-and-single-application-processor">4.2. Cryptographic token and single-application processor</a></li>
169<li class="toctree-l2"><a class="reference internal" href="#cryptoprocessor-with-no-key-storage">4.3. Cryptoprocessor with no key storage</a></li>
170<li class="toctree-l2"><a class="reference internal" href="#multi-client-cryptoprocessor">4.4. Multi-client cryptoprocessor</a></li>
171<li class="toctree-l2"><a class="reference internal" href="#multi-cryptoprocessor-architecture">4.5. Multi-cryptoprocessor architecture</a></li>
172</ul>
173</li>
174<li class="toctree-l1"><a class="reference internal" href="conventions.html">5. Library conventions</a></li>
175<li class="toctree-l1"><a class="reference internal" href="implementation.html">6. Implementation considerations</a></li>
176<li class="toctree-l1"><a class="reference internal" href="usage.html">7. Usage considerations</a></li>
177<li class="toctree-l1"><a class="reference internal" href="../api/library/index.html">8. Library management reference</a></li>
178<li class="toctree-l1"><a class="reference internal" href="../api/keys/index.html">9. Key management reference</a></li>
179<li class="toctree-l1"><a class="reference internal" href="../api/ops/index.html">10. Cryptographic operation reference</a></li>
180</ul>
181<ul>
182<li class="toctree-l1"><a class="reference internal" href="../appendix/example_header.html">Example header file</a></li>
183<li class="toctree-l1"><a class="reference internal" href="../appendix/encodings.html">Algorithm and key type encoding</a></li>
184<li class="toctree-l1"><a class="reference internal" href="../appendix/specdef_values.html">Example macro implementations</a></li>
185<li class="toctree-l1"><a class="reference internal" href="../appendix/sra.html">Security Risk Assessment</a></li>
186<li class="toctree-l1"><a class="reference internal" href="../appendix/history.html">Changes to the API</a></li>
187</ul>
188<ul>
189<li class="toctree-l1"><a class="reference internal" href="../psa_c-identifiers.html">Index of API elements</a></li>
190</ul>
191<div id="searchbox" style="display: none" role="search">
192 <h3>Quick search</h3>
193 <form class="search" action="../search.html" method="get">
194 <div><input type="text" name="q" /></div>
195 <div><input type="submit" value="Go" /></div>
196 <input type="hidden" name="check_keywords" value="yes" />
197 <input type="hidden" name="area" value="default" />
198 </form>
199</div>
200<script type="text/javascript">$('#searchbox').show(0);</script>
201 </div>
202 </div>
203 <div class="clearer"></div>
204 </div>
205 <div class="footer">
206 &copy; 2018-2022, Arm Limited or its affiliates. All rights reserved.
207
208 |
209 Powered by <a href="http://sphinx-doc.org/">Sphinx 1.6.7</a>
210 &amp; <a href="https://github.com/bitprophet/alabaster">Alabaster 0.7.8</a>
211
212 </div>
213
214
215
216
217 </body>
218</html>