persistent keys on psa/crypto.h with TFM

RE: persistent keys on psa/crypto.h with TFM

Einar Thorsrud — Mon, 03 Jan 2022 08:44:09 GMT

Hi,

I am sorry for the delay.

The problem with this is that ITS is not configured to store such large keys. The persistent keys are stored in the ITS storage and the largest possible asset stored is dependent on the configuration here: ITS_MAX_ASSET_SIZE. Even though this value seems big enough for the requested RSA key it is not. There is storage overhead added by the PSA APIs which increase the size of the key substantially. Increasing this configuration though will eventually result to the success of of the operation.

RE: persistent keys on psa/crypto.h with TFM

Einar Thorsrud — Wed, 15 Dec 2021 14:01:22 GMT

Hi,

I see the same as you, but I did not get to the bottom of this today. I will continue to look into it, though.

(Note that TF-M is still experimental, and there are some issues with it. At the same time, the SPM does not provide this features (it provides virtually no crypto related features at all, except RNG), so TF-M is never-the-less the way to go.)

RE: persistent keys on psa/crypto.h with TFM

hk1234 — Tue, 14 Dec 2021 13:00:51 GMT

v1.7.1

RE: persistent keys on psa/crypto.h with TFM

Einar Thorsrud — Tue, 14 Dec 2021 12:58:19 GMT

Hi,

Any key type can be stored with PSA ITS, and that should be the case also when using TF-M (see Crypto: Persistent key storage sample). Which nRF Connect SDK version are you using?