SE RT Services Utilities library

| SE RT Services Utilities library

Macros | Typedefs | Functions
Key policies
IFX SE PSA crypto API » Key attributes operations

## General Description

Key policies operations definitions.

## Macros
#define | IFX_SE_KEY_POLICY_INIT { 0, 0, 0 }
| The initial value of the key policy.
#define | IFX_SE_KEY_USAGE_EXPORT ((ifx_se_key_usage_t)0x00000001)
| Whether the key may be exported. More...
#define | IFX_SE_KEY_USAGE_COPY ((ifx_se_key_usage_t)0x00000002)
| Whether the key may be copied. More...
#define | IFX_SE_KEY_USAGE_ENCRYPT ((ifx_se_key_usage_t)0x00000100)
| Whether the key may be used to encrypt a message. More...
#define | IFX_SE_KEY_USAGE_DECRYPT ((ifx_se_key_usage_t)0x00000200)
| Whether the key may be used to decrypt a message. More...
#define | IFX_SE_KEY_USAGE_SIGN_MESSAGE ((ifx_se_key_usage_t)0x00000400)
| Whether the key may be used to sign a message. More...
#define | IFX_SE_KEY_USAGE_VERIFY_MESSAGE ((ifx_se_key_usage_t)0x00000800)
| Whether the key may be used to verify a message. More...
#define | IFX_SE_KEY_USAGE_SIGN_HASH ((ifx_se_key_usage_t)0x00001000)
| Whether the key may be used to sign a message. More...
#define | IFX_SE_KEY_USAGE_VERIFY_HASH ((ifx_se_key_usage_t)0x00002000)
| Whether the key may be used to verify a message signature. More...
#define | IFX_SE_KEY_USAGE_DERIVE ((ifx_se_key_usage_t)0x00004000)
| Whether the key may be used to derive other keys or produce a password hash. More...
#define | IFX_SE_KEY_USAGE_VERIFY_DERIVATION ((ifx_se_key_usage_t)0x00008000)
| Whether the key may be used to verify the result of a key derivation, including password hashing. More...

## Typedefs
typedef struct ifx_se_key_policy_s | ifx_se_key_policy_t
| Holds key usage allowance and specific algorithms. More...
typedef uint32_t | ifx_se_key_usage_t
| Encoding of permitted usage on a key.

## Functions
static struct ifx_se_key_policy_s | ifx_se_key_policy_init (void)
| Sets key policy structure with initial value. More...
static void | ifx_se_set_key_usage_flags (ifx_se_key_attributes_t *attributes, ifx_se_key_usage_t usage_flags)
| Sets key usage flags in key attributes structure. More...
static ifx_se_key_usage_t | ifx_se_get_key_usage_flags (const ifx_se_key_attributes_t *attributes)
| Gets key usage flags from key attributes structure. More...

## Macro Definition Documentation

## ◆ IFX_SE_KEY_USAGE_EXPORT

#define IFX_SE_KEY_USAGE_EXPORT ((ifx_se_key_usage_t)0x00000001)

Whether the key may be exported.

A public key or the public part of a key pair may always be exported regardless of the value of this permission flag.

If a key does not have export permission, implementations shall not allow the key to be exported in plain form from the cryptoprocessor, whether through ifx_se_export_key() or through a proprietary interface. The key may however be exportable in a wrapped form, i.e. in a form where it is encrypted by another key.

## ◆ IFX_SE_KEY_USAGE_COPY

#define IFX_SE_KEY_USAGE_COPY ((ifx_se_key_usage_t)0x00000002)

Whether the key may be copied.

This flag allows the use of ifx_se_copy_key() to make a copy of the key with the same policy or a more restrictive policy.

For lifetimes for which the key is located in a secure element which enforce the non-exportability of keys, copying a key outside the secure element also requires the usage flag IFX_SE_KEY_USAGE_EXPORT. Copying the key inside the secure element is permitted with just IFX_SE_KEY_USAGE_COPY if the secure element supports it. For keys with the lifetime IFX_SE_KEY_LIFETIME_VOLATILE or IFX_SE_KEY_LIFETIME_PERSISTENT, the usage flag IFX_SE_KEY_USAGE_COPY is sufficient to permit the copy.

## ◆ IFX_SE_KEY_USAGE_ENCRYPT

#define IFX_SE_KEY_USAGE_ENCRYPT ((ifx_se_key_usage_t)0x00000100)

Whether the key may be used to encrypt a message.

This flag allows the key to be used for a symmetric encryption operation, for an AEAD encryption-and-authentication operation, or for an asymmetric encryption operation, if otherwise permitted by the key's type and policy.

For a key pair, this concerns the public key.

## ◆ IFX_SE_KEY_USAGE_DECRYPT

#define IFX_SE_KEY_USAGE_DECRYPT ((ifx_se_key_usage_t)0x00000200)

Whether the key may be used to decrypt a message.

This flag allows the key to be used for a symmetric decryption operation, for an AEAD decryption-and-verification operation, or for an asymmetric decryption operation, if otherwise permitted by the key's type and policy.

For a key pair, this concerns the private key.

## ◆ IFX_SE_KEY_USAGE_SIGN_MESSAGE

#define IFX_SE_KEY_USAGE_SIGN_MESSAGE ((ifx_se_key_usage_t)0x00000400)

Whether the key may be used to sign a message.

This flag allows the key to be used for a MAC calculation operation or for an asymmetric message signature operation, if otherwise permitted by the key's type and policy.

For a key pair, this concerns the private key.

## ◆ IFX_SE_KEY_USAGE_VERIFY_MESSAGE

#define IFX_SE_KEY_USAGE_VERIFY_MESSAGE ((ifx_se_key_usage_t)0x00000800)

Whether the key may be used to verify a message.

This flag allows the key to be used for a MAC verification operation or for an asymmetric message signature verification operation, if otherwise permitted by the key's type and policy.

For a key pair, this concerns the public key.

## ◆ IFX_SE_KEY_USAGE_SIGN_HASH

#define IFX_SE_KEY_USAGE_SIGN_HASH ((ifx_se_key_usage_t)0x00001000)

Whether the key may be used to sign a message.

This flag allows the key to be used for a MAC calculation operation or for an asymmetric signature operation, if otherwise permitted by the key's type and policy.

For a key pair, this concerns the private key.

## ◆ IFX_SE_KEY_USAGE_VERIFY_HASH

#define IFX_SE_KEY_USAGE_VERIFY_HASH ((ifx_se_key_usage_t)0x00002000)

Whether the key may be used to verify a message signature.

This flag allows the key to be used for a MAC verification operation or for an asymmetric signature verification operation, if otherwise permitted by by the key's type and policy.

For a key pair, this concerns the public key.

## ◆ IFX_SE_KEY_USAGE_DERIVE

#define IFX_SE_KEY_USAGE_DERIVE ((ifx_se_key_usage_t)0x00004000)

Whether the key may be used to derive other keys or produce a password hash.

This flag allows the key to be used for a key derivation operation or for a key agreement operation, if otherwise permitted by by the key's type and policy.

If this flag is present on all keys used in calls to ifx_se_key_derivation_input_key() for a key derivation operation, then it permits calling ifx_se_key_derivation_output_bytes() or ifx_se_key_derivation_output_key() at the end of the operation.

## ◆ IFX_SE_KEY_USAGE_VERIFY_DERIVATION

#define IFX_SE_KEY_USAGE_VERIFY_DERIVATION ((ifx_se_key_usage_t)0x00008000)

Whether the key may be used to verify the result of a key derivation, including password hashing.

This flag allows the key to be used:

This flag allows the key to be used in a key derivation operation, if otherwise permitted by by the key's type and policy.

If this flag is present on all keys used in calls to ifx_se_key_derivation_input_key() for a key derivation operation, then it permits calling ifx_se_key_derivation_verify_bytes() or ifx_se_key_derivation_verify_key() at the end of the operation.

## Typedef Documentation

## ◆ ifx_se_key_policy_t

typedef struct ifx_se_key_policy_s ifx_se_key_policy_t

Holds key usage allowance and specific algorithms.

Members:

- ifx_se_key_usage_t usage - Encoded permitted usage of a key
- ifx_se_algorithm_t alg - Allowed main algorithm
- ifx_se_algorithm_t alg2 - Allowed secondary algorithm

## Function Documentation

## ◆ ifx_se_key_policy_init()

static struct ifx_se_key_policy_s ifx_se_key_policy_init | ( | void |  | ) |
| inlinestatic

Sets key policy structure with initial value.

Returns
  ifx_se_key_policy_s structure

## ◆ ifx_se_set_key_usage_flags()

static void ifx_se_set_key_usage_flags | ( | ifx_se_key_attributes_t * | attributes,
|  | ifx_se_key_usage_t | usage_flags
| ) |  |
| inlinestatic

Sets key usage flags in key attributes structure.

Parameters

  [in] | attributes | Key attributes structure
  [in] | usage_flags | Key usage flags

## ◆ ifx_se_get_key_usage_flags()

static ifx_se_key_usage_t ifx_se_get_key_usage_flags | ( | const ifx_se_key_attributes_t * | attributes | ) |
| inlinestatic

Gets key usage flags from key attributes structure.

Parameters

  [in] | attributes | Key attributes structure

Returns
  Key usage flags