TrustedFirmware Git Browser
Code Review Sign In
review.trustedfirmware.org / mirror / mbed-crypto / c2db5f0e443752021c73fb4440a339e2cbc10fb7 / . / docs / html / overview / sample-arch.html
blob: 679aec709c45b51fed7be8e13d3155ef48468bfd [file] [log] [blame]
Gilles Peskine6c723a22020-04-17 16:57:52 +0200[diff] [blame]1
2<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
3 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
4
5<html xmlns="http://www.w3.org/1999/xhtml">
6 <head>
7 <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
Gilles Peskinec2db5f02021-01-18 20:36:53 +0100[diff] [blame^]8 <title>4. Sample architectures &#8212; PSA Crypto API 1.0.1 documentation</title>
Gilles Peskine6c723a22020-04-17 16:57:52 +0200[diff] [blame]9 <link rel="stylesheet" href="../_static/alabaster.css" type="text/css" />
10 <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />
11 <script type="text/javascript">
12 var DOCUMENTATION_OPTIONS = {
13 URL_ROOT: '../',
Gilles Peskinec2db5f02021-01-18 20:36:53 +0100[diff] [blame^]14 VERSION: '1.0.1',
Gilles Peskine6c723a22020-04-17 16:57:52 +0200[diff] [blame]15 COLLAPSE_INDEX: false,
16 FILE_SUFFIX: '.html',
Gilles Peskinec2db5f02021-01-18 20:36:53 +0100[diff] [blame^]17 HAS_SOURCE: false,
Gilles Peskine6c723a22020-04-17 16:57:52 +0200[diff] [blame]18 SOURCELINK_SUFFIX: '.txt'
19 };
20 </script>
21 <script type="text/javascript" src="../_static/jquery.js"></script>
22 <script type="text/javascript" src="../_static/underscore.js"></script>
23 <script type="text/javascript" src="../_static/doctools.js"></script>
Gilles Peskinec2db5f02021-01-18 20:36:53 +0100[diff] [blame^]24 <link rel="author" title="About these documents" href="../about.html" />
Gilles Peskine6c723a22020-04-17 16:57:52 +0200[diff] [blame]25 <link rel="index" title="Index" href="../genindex.html" />
26 <link rel="search" title="Search" href="../search.html" />
Gilles Peskinec2db5f02021-01-18 20:36:53 +0100[diff] [blame^]27 <link rel="next" title="5. Library conventions" href="conventions.html" />
28 <link rel="prev" title="3. Functionality overview" href="functionality.html" />
Gilles Peskine6c723a22020-04-17 16:57:52 +0200[diff] [blame]29
30 <link rel="stylesheet" href="../_static/custom.css" type="text/css" />
31
32 <meta name="viewport" content="width=device-width, initial-scale=0.9, maximum-scale=0.9" />
33
34 </head>
35 <body>
36
37
38 <div class="document">
39 <div class="documentwrapper">
40 <div class="bodywrapper">
41 <div class="body" role="main">
42
43 <div class="section" id="sample-architectures">
Gilles Peskinec2db5f02021-01-18 20:36:53 +0100[diff] [blame^]44<span id="architectures"></span><h1>4. Sample architectures</h1>
Gilles Peskine6c723a22020-04-17 16:57:52 +0200[diff] [blame]45<p>This section describes some example architectures that can be used for
46implementations of the interface described in this specification. This list is
47not exhaustive and the section is entirely non-normative.</p>
48<div class="section" id="single-partition-architecture">
Gilles Peskinec2db5f02021-01-18 20:36:53 +0100[diff] [blame^]49<h2>4.1. Single-partition architecture</h2>
Gilles Peskine6c723a22020-04-17 16:57:52 +0200[diff] [blame]50<p>In the single-partition architecture, there is no security boundary inside the system. The
51application code can access all the system memory, including the memory used by
52the cryptographic services described in this specification. Thus, the
53architecture provides <a class="reference internal" href="goals.html#isolation"><span class="std std-ref">no isolation</span></a>.</p>
54<p>This architecture does not conform to the Arm <em>Platform Security Architecture
55Security Model</em>. However, it is useful for providing cryptographic services
56that use the same interface, even on devices that cannot support any security
57boundary. So, while this architecture is not the primary design goal of the API
58defined in the present specification, it is supported.</p>
59<p>The functions in this specification simply execute the underlying algorithmic
60code. Security checks can be kept to a minimum, since the cryptoprocessor cannot
61defend against a malicious application. Key import and export copy data inside
62the same memory space.</p>
63<p>This architecture also describes a subset of some larger systems, where the
64cryptographic services are implemented inside a high-security partition,
65separate from the code of the main application, though it shares this
66high-security partition with other platform security services.</p>
67</div>
68<div class="section" id="cryptographic-token-and-single-application-processor">
Gilles Peskinec2db5f02021-01-18 20:36:53 +0100[diff] [blame^]69<span id="isolated-cryptoprocessor"></span><h2>4.2. Cryptographic token and single-application processor</h2>
Gilles Peskine6c723a22020-04-17 16:57:52 +0200[diff] [blame]70<p>This system is composed of two partitions: one is a cryptoprocessor and the
71other partition runs an application. There is a security boundary between the
72two partitions, so that the application cannot access the cryptoprocessor,
73except through its public interface. Thus, the architecture provides
74<a class="reference internal" href="goals.html#isolation"><span class="std std-ref">cryptoprocessor isolation</span></a>. The cryptoprocessor has
75some non-volatile storage, a TRNG, and possibly, some cryptographic accelerators.</p>
76<p>There are a number of potential physical realizations: the cryptoprocessor might
77be a separate chip, a separate processor on the same chip, or a logical
78partition using a combination of hardware and software to provide the isolation.
79These realizations are functionally equivalent in terms of the offered software
80interface, but they would typically offer different levels of security
81guarantees.</p>
82<p>The PSA crypto API in the application processor consists of a thin layer of code
83that translates function calls to remote procedure calls in the cryptoprocessor.
84All cryptographic computations are, therefore, performed inside the
85cryptoprocessor. Non-volatile keys are stored inside the cryptoprocessor.</p>
86</div>
87<div class="section" id="cryptoprocessor-with-no-key-storage">
Gilles Peskinec2db5f02021-01-18 20:36:53 +0100[diff] [blame^]88<h2>4.3. Cryptoprocessor with no key storage</h2>
89<p>As in the <a class="reference internal" href="#isolated-cryptoprocessor"><span class="secref">Cryptographic token and single-application processor</span></a> architecture, this system
Gilles Peskine6c723a22020-04-17 16:57:52 +0200[diff] [blame]90is also composed of two partitions separated by a security boundary and also
91provides <a class="reference internal" href="goals.html#isolation"><span class="std std-ref">cryptoprocessor isolation</span></a>.
92However, unlike the previous architecture, in this system, the cryptoprocessor
93does not have any secure, persistent storage that could be used to store
94application keys.</p>
95<p>If the cryptoprocessor is not capable of storing cryptographic material, then
96there is little use for a separate cryptoprocessor, since all data would have to
97be imported by the application.</p>
98<p>The cryptoprocessor can provide useful services if it is able to store at least
99one key. This might be a hardware unique key that is burnt to one-time
100programmable memory during the manufacturing of the device. This key can be used
101for one or more purposes:</p>
102<ul class="simple">
103<li>Encrypt and authenticate data stored in the application processor.</li>
104<li>Communicate with a paired device.</li>
105<li>Allow the application to perform operations with keys that are derived from
106the hardware unique key.</li>
107</ul>
108</div>
109<div class="section" id="multi-client-cryptoprocessor">
Gilles Peskinec2db5f02021-01-18 20:36:53 +0100[diff] [blame^]110<h2>4.4. Multi-client cryptoprocessor</h2>
Gilles Peskine6c723a22020-04-17 16:57:52 +0200[diff] [blame]111<p>This is an expanded variant of the <a class="reference internal" href="#isolated-cryptoprocessor"><span class="std std-ref">cryptographic token plus application
112architecture</span></a>. In this
113variant, the cryptoprocessor serves multiple applications that are mutually
114untrustworthy. This architecture provides <a class="reference internal" href="goals.html#isolation"><span class="std std-ref">caller
115isolation</span></a>.</p>
116<p>In this architecture, API calls are translated to remote procedure calls, which
117encode the identity of the client application. The cryptoprocessor carefully
118segments its internal storage to ensure that a client’s data is never leaked to
119another client.</p>
120</div>
121<div class="section" id="multi-cryptoprocessor-architecture">
Gilles Peskinec2db5f02021-01-18 20:36:53 +0100[diff] [blame^]122<h2>4.5. Multi-cryptoprocessor architecture</h2>
Gilles Peskine6c723a22020-04-17 16:57:52 +0200[diff] [blame]123<p>This system includes multiple cryptoprocessors. There are several reasons to
124have multiple cryptoprocessors:</p>
125<ul class="simple">
126<li>Different compromises between security and performance for different keys.
127Typically, this means a cryptoprocessor that runs on the same hardware as the
128main application and processes short-term secrets, a secure element or a
129similar separate chip that retains long-term secrets.</li>
130<li>Independent provisioning of certain secrets.</li>
131<li>A combination of a non-removable cryptoprocessor and removable ones, for
132example, a smartcard or HSM.</li>
133<li>Cryptoprocessors managed by different stakeholders who do not trust each
134other.</li>
135</ul>
136<p>The keystore implementation needs to dispatch each request to the correct
137processor. For example:</p>
138<ul class="simple">
139<li>All requests involving a non-extractable key must be processed in the
140cryptoprocessor that holds that key.</li>
141<li>Requests involving a persistent key must be processed in the cryptoprocessor
142that corresponds to the key’s lifetime value.</li>
143<li>Requests involving a volatile key might target a cryptoprocessor based on
144parameters supplied by the application, or based on considerations such as
145performance inside the implementation.</li>
146</ul>
147</div>
148</div>
149
150
151 </div>
152 </div>
153 </div>
154 <div class="sphinxsidebar" role="navigation" aria-label="main navigation">
Gilles Peskinec2db5f02021-01-18 20:36:53 +0100[diff] [blame^]155 <div class="sphinxsidebarwrapper"><h3><a href="../index.html"><b>PSA Crypto API</b></a></h3>
156IHI 0086<br/>
157Non-confidential<br/>
158Version 1.0.1
159<span style="color: red; font-weight: bold;"></span>
160<ul>
161<li class="toctree-l1"><a class="reference internal" href="../about.html">About this document</a></li>
162</ul>
163<ul class="current">
164<li class="toctree-l1"><a class="reference internal" href="intro.html">1. Introduction</a></li>
165<li class="toctree-l1"><a class="reference internal" href="goals.html">2. Design goals</a></li>
166<li class="toctree-l1"><a class="reference internal" href="functionality.html">3. Functionality overview</a></li>
167<li class="toctree-l1 current"><a class="current reference internal" href="#">4. Sample architectures</a><ul>
168<li class="toctree-l2"><a class="reference internal" href="#single-partition-architecture">4.1. Single-partition architecture</a></li>
169<li class="toctree-l2"><a class="reference internal" href="#cryptographic-token-and-single-application-processor">4.2. Cryptographic token and single-application processor</a></li>
170<li class="toctree-l2"><a class="reference internal" href="#cryptoprocessor-with-no-key-storage">4.3. Cryptoprocessor with no key storage</a></li>
171<li class="toctree-l2"><a class="reference internal" href="#multi-client-cryptoprocessor">4.4. Multi-client cryptoprocessor</a></li>
172<li class="toctree-l2"><a class="reference internal" href="#multi-cryptoprocessor-architecture">4.5. Multi-cryptoprocessor architecture</a></li>
Gilles Peskine6c723a22020-04-17 16:57:52 +0200[diff] [blame]173</ul>
174</li>
Gilles Peskinec2db5f02021-01-18 20:36:53 +0100[diff] [blame^]175<li class="toctree-l1"><a class="reference internal" href="conventions.html">5. Library conventions</a></li>
176<li class="toctree-l1"><a class="reference internal" href="implementation.html">6. Implementation considerations</a></li>
177<li class="toctree-l1"><a class="reference internal" href="usage.html">7. Usage considerations</a></li>
178<li class="toctree-l1"><a class="reference internal" href="../api/library/index.html">8. Library management reference</a></li>
179<li class="toctree-l1"><a class="reference internal" href="../api/keys/index.html">9. Key management reference</a></li>
180<li class="toctree-l1"><a class="reference internal" href="../api/ops/index.html">10. Cryptographic operation reference</a></li>
Gilles Peskine6c723a22020-04-17 16:57:52 +0200[diff] [blame]181</ul>
Gilles Peskine6c723a22020-04-17 16:57:52 +0200[diff] [blame]182<ul>
Gilles Peskinec2db5f02021-01-18 20:36:53 +0100[diff] [blame^]183<li class="toctree-l1"><a class="reference internal" href="../appendix/example_header.html">Example header file</a></li>
184<li class="toctree-l1"><a class="reference internal" href="../appendix/specdef_values.html">Example macro implementations</a></li>
185<li class="toctree-l1"><a class="reference internal" href="../appendix/history.html">Changes to the API</a></li>
Gilles Peskine6c723a22020-04-17 16:57:52 +0200[diff] [blame]186</ul>
Gilles Peskinec2db5f02021-01-18 20:36:53 +0100[diff] [blame^]187<ul>
188<li class="toctree-l1"><a class="reference internal" href="../psa_c-identifiers.html">Index of API elements</a></li>
189</ul>
Gilles Peskine6c723a22020-04-17 16:57:52 +0200[diff] [blame]190<div id="searchbox" style="display: none" role="search">
191 <h3>Quick search</h3>
192 <form class="search" action="../search.html" method="get">
193 <div><input type="text" name="q" /></div>
194 <div><input type="submit" value="Go" /></div>
195 <input type="hidden" name="check_keywords" value="yes" />
196 <input type="hidden" name="area" value="default" />
197 </form>
198</div>
199<script type="text/javascript">$('#searchbox').show(0);</script>
200 </div>
201 </div>
202 <div class="clearer"></div>
203 </div>
204 <div class="footer">
Gilles Peskinec2db5f02021-01-18 20:36:53 +0100[diff] [blame^]205 &copy; 2018-2020, Arm Limited or its affiliates. All rights reserved.
Gilles Peskine6c723a22020-04-17 16:57:52 +0200[diff] [blame]206
207 |
208 Powered by <a href="http://sphinx-doc.org/">Sphinx 1.6.7</a>
209 &amp; <a href="https://github.com/bitprophet/alabaster">Alabaster 0.7.8</a>
210
Gilles Peskine6c723a22020-04-17 16:57:52 +0200[diff] [blame]211 </div>
212
213
214
215
216 </body>
217</html>