SE RT Services Utilities library

| SE RT Services Utilities library

Macros
Built-In keys
IFX SE PSA crypto API » Key attributes operations

## General Description

Built-In keys definitions.

SE RT Services provides the next built-in keys in two groups:

- main built-in keys (from IFX_SE_KEY_ID_BUILTIN_HUK to IFX_SE_KEY_ID_BUILTIN_ATTEST_PUB)
- test built-in keys (from IFX_SE_KEY_ID_BUILTIN_TEST_AES128 to IFX_SE_KEY_ID_BUILTIN_TEST_ECC_PUB).

Main built-in keys used during boot and in the normal operating flow.

Test built-in keys used for test purpose (for application self-test as example).

All built-in keys have key location set to IFX_SE_KEY_LOCATION_SE.

Keys group | Key ID | Key type | Key algorithm | Key policy
--- | --- | --- | --- | ---
Main keys | IFX_SE_KEY_ID_BUILTIN_HUK | AES-256 | CMAC-KDF | IFX_SE_KEY_USAGE_DERIVE
IFX_SE_KEY_ID_BUILTIN_OEM_ROT | ECC Public key | ECDSA-256R1 (SHA_256) | IFX_SE_KEY_USAGE_VERIFY_HASH IFX_SE_KEY_USAGE_VERIFY_MESSAGE IFX_SE_KEY_USAGE_EXPORT
IFX_SE_KEY_ID_BUILTIN_UPD | ECC Public key | ECDSA-256R1 (SHA_256) | IFX_SE_KEY_USAGE_VERIFY_HASH IFX_SE_KEY_USAGE_VERIFY_MESSAGE IFX_SE_KEY_USAGE_EXPORT
IFX_SE_KEY_ID_BUILTIN_IFX_ROT | ECC Public key | ECDSA-256R1 (SHA_256) | IFX_SE_KEY_USAGE_VERIFY_HASH IFX_SE_KEY_USAGE_VERIFY_MESSAGE IFX_SE_KEY_USAGE_EXPORT
IFX_SE_KEY_ID_BUILTIN_DEVICE * | ECC Private key | ECDSA-256R1 (SHA_256) | IFX_SE_KEY_USAGE_SIGN_HASH IFX_SE_KEY_USAGE_SIGN_MESSAGE IFX_SE_KEY_USAGE_VERIFY_HASH IFX_SE_KEY_USAGE_VERIFY_MESSAGE
IFX_SE_KEY_ID_BUILTIN_ATTEST ** | ECC Private key | ECDSA-256R1 (SHA_256) | IFX_SE_KEY_USAGE_SIGN_HASH IFX_SE_KEY_USAGE_SIGN_MESSAGE IFX_SE_KEY_USAGE_VERIFY_HASH IFX_SE_KEY_USAGE_VERIFY_MESSAGE
IFX_SE_KEY_ID_BUILTIN_ATTEST_PUB | ECC Public key | ECDSA-256R1 (SHA_256) | IFX_SE_KEY_USAGE_VERIFY_HASH IFX_SE_KEY_USAGE_VERIFY_MESSAGE IFX_SE_KEY_USAGE_EXPORT
Test keys | IFX_SE_KEY_ID_BUILTIN_TEST_AES128 | AES-128 | AES CBC NO_PADDING | IFX_SE_KEY_USAGE_DECRYPT IFX_SE_KEY_USAGE_ENCRYPT IFX_SE_KEY_USAGE_EXPORT
IFX_SE_KEY_ID_BUILTIN_TEST_ECC256_PRIV | ECC Private key | ECDSA-256R1 (SHA_256) | IFX_SE_KEY_USAGE_SIGN_HASH IFX_SE_KEY_USAGE_SIGN_MESSAGE IFX_SE_KEY_USAGE_VERIFY_HASH IFX_SE_KEY_USAGE_VERIFY_MESSAGE IFX_SE_KEY_USAGE_EXPORT
IFX_SE_KEY_ID_BUILTIN_TEST_CMAC128 | AES-128 | CMAC | IFX_SE_KEY_USAGE_SIGN_MESSAGE IFX_SE_KEY_USAGE_VERIFY_MESSAGE IFX_SE_KEY_USAGE_EXPORT
IFX_SE_KEY_ID_BUILTIN_TEST_CMAC256 | AES-256 | CMAC | IFX_SE_KEY_USAGE_SIGN_MESSAGE IFX_SE_KEY_USAGE_VERIFY_MESSAGE IFX_SE_KEY_USAGE_EXPORT
IFX_SE_KEY_ID_BUILTIN_TEST_ECC384 | ECC Public key | ECDSA-384R1 (SHA_256) | IFX_SE_KEY_USAGE_VERIFY_HASH IFX_SE_KEY_USAGE_VERIFY_MESSAGE IFX_SE_KEY_USAGE_EXPORT
IFX_SE_KEY_ID_BUILTIN_TEST_CMACKDF | AES-256 | CMAC-KDF | IFX_SE_KEY_USAGE_DERIVE
IFX_SE_KEY_ID_BUILTIN_TEST_ECC_PUB | ECC Public key | ECDSA-256R1 (SHA_256) | IFX_SE_KEY_USAGE_VERIFY_HASH IFX_SE_KEY_USAGE_VERIFY_MESSAGE IFX_SE_KEY_USAGE_EXPORT

Note
  * IFX_SE_KEY_ID_BUILTIN_DEVICE used only in provisioning stage to generate device certificates and not available for user SIGN operations.
  ** IFX_SE_KEY_ID_BUILTIN_ATTEST used only to sign Attestation Token in SE RT Services and not available for user SIGN operations.

## Macros
#define | IFX_SE_KEY_ID_BUILTIN_HUK (IFX_SE_KEY_ID_BUILTIN_MIN)
| Hardware Unique Key ID.
#define | IFX_SE_KEY_ID_BUILTIN_OEM_ROT (IFX_SE_KEY_ID_BUILTIN_MIN + 1u)
| OEM RoT Public Key ID.
#define | IFX_SE_KEY_ID_BUILTIN_UPD (IFX_SE_KEY_ID_BUILTIN_MIN + 2u)
| IFX SE RT Services Public Key ID.
#define | IFX_SE_KEY_ID_BUILTIN_IFX_ROT (IFX_SE_KEY_ID_BUILTIN_MIN + 3u)
| IFX RoT Public Key ID.
#define | IFX_SE_KEY_ID_BUILTIN_DEVICE (IFX_SE_KEY_ID_BUILTIN_MIN + 4u)
| Device Key ID (DICE_DeviceID)
#define | IFX_SE_KEY_ID_BUILTIN_ATTEST (IFX_SE_KEY_ID_BUILTIN_MIN + 5u)
| Attestation key Private key ID. More...
#define | IFX_SE_KEY_ID_BUILTIN_ATTEST_PUB (IFX_SE_KEY_ID_BUILTIN_MIN + 6u)
| Attestation key Public key (Alias)
#define | IFX_SE_KEY_ID_BUILTIN_TEST_AES128 (IFX_SE_KEY_ID_BUILTIN_MIN + 32u)
| AES-128 key for encryption / decryption tests. More...
#define | IFX_SE_KEY_ID_BUILTIN_TEST_ECC256_PRIV (IFX_SE_KEY_ID_BUILTIN_MIN + 33u)
| ECC P256 private key for sign / verify NIST tests. More...
#define | IFX_SE_KEY_ID_BUILTIN_TEST_CMAC128 (IFX_SE_KEY_ID_BUILTIN_MIN + 34u)
| AES-128 key for CMAC operation tests. More...
#define | IFX_SE_KEY_ID_BUILTIN_TEST_CMAC256 (IFX_SE_KEY_ID_BUILTIN_MIN + 35u)
| AES-256 key for CMAC operation tests. More...
#define | IFX_SE_KEY_ID_BUILTIN_TEST_ECC384 (IFX_SE_KEY_ID_BUILTIN_MIN + 36u)
| ECC P384 public key for signature verify NIST test. More...
#define | IFX_SE_KEY_ID_BUILTIN_TEST_CMACKDF (IFX_SE_KEY_ID_BUILTIN_MIN + 37u)
| AES-256 key for CMAC-KDF key derivation tests. More...
#define | IFX_SE_KEY_ID_BUILTIN_TEST_ECC_PUB (IFX_SE_KEY_ID_BUILTIN_MIN + 38u)
| Built-in public ECC (P-256) key to use in verify. More...

## Macro Definition Documentation

## ◆ IFX_SE_KEY_ID_BUILTIN_ATTEST

#define IFX_SE_KEY_ID_BUILTIN_ATTEST (IFX_SE_KEY_ID_BUILTIN_MIN + 5u)

Attestation key Private key ID.

Note
  IFX_SE_KEY_ID_BUILTIN_ATTEST used only to sign Attestation Token in SE RT Services and not available for user SIGN operations.

## ◆ IFX_SE_KEY_ID_BUILTIN_TEST_AES128

#define IFX_SE_KEY_ID_BUILTIN_TEST_AES128 (IFX_SE_KEY_ID_BUILTIN_MIN + 32u)

AES-128 key for encryption / decryption tests.

    *
    * Zero key for test vectors from
    * csrc.nist.gov/CSRC/media/Projects/Cryptographic-Algorithm-Validation-Program/documents/aes/AESAVS.pdf
    * csrc.nist.gov/CSRC/media/Projects/Cryptographic-Algorithm-Validation-Program/documents/aes/KAT_AES.zip
    *

## ◆ IFX_SE_KEY_ID_BUILTIN_TEST_ECC256_PRIV

#define IFX_SE_KEY_ID_BUILTIN_TEST_ECC256_PRIV (IFX_SE_KEY_ID_BUILTIN_MIN + 33u)

ECC P256 private key for sign / verify NIST tests.

    *
    * csrc.nist.gov/CSRC/media/Projects/Cryptographic-Algorithm-Validation-Program/documents/dss/186-4ecdsatestvectors.zip
    *
    * SigVer.rsp [P-256, SHA-256]
    *     Msg = 5905238877c77421f73e43ee3da6f2d9e2ccad5fc942dcec0cbd25482935faaf416983fe165b1a045ee2bcd2e6dca3bdf46c4310a7461f9a37960ca672d3feb5473e253605fb1ddfd28065b53cb5858a8ad28175bf9bd386a5e471ea7a65c17cc934a9d791e91491eb3754d03799790fe2d308d16146d5c9b0d0debd97d79ce8
    *     d = 519b423d715f8b581f4fa8ee59f4771a5b44c8130b4e3eacca54a56dda72b464
    *     Qx = 1ccbe91c075fc7f4f033bfa248db8fccd3565de94bbfb12f3c59ff46c271bf83
    *     Qy = ce4014c68811f9a21a1fdb2c0e6113e06db7ca93b7404e78dc7ccd5ca89a4ca9
    *     k = 94a1bbb14b906a61a280f245f9e93c7f3b4a6247824f5d33b9670787642a68de
    *     R = f3ac8061b514795b8843e3d6629527ed2afd6b1f6a555a7acabb5e6f79c8c2ac
    *     S = 8bf77819ca05a6b2786c76262bf7371cef97b218e96f175a3ccdda2acc058903
    *

## ◆ IFX_SE_KEY_ID_BUILTIN_TEST_CMAC128

#define IFX_SE_KEY_ID_BUILTIN_TEST_CMAC128 (IFX_SE_KEY_ID_BUILTIN_MIN + 34u)

AES-128 key for CMAC operation tests.

    *
    * Test vector from datatracker.ietf.org/doc/rfc4493, Example 2
    *

## ◆ IFX_SE_KEY_ID_BUILTIN_TEST_CMAC256

#define IFX_SE_KEY_ID_BUILTIN_TEST_CMAC256 (IFX_SE_KEY_ID_BUILTIN_MIN + 35u)

AES-256 key for CMAC operation tests.

    *
    * Test vector csrc.nist.gov/CSRC/media/Projects/Cryptographic-Standards-and-Guidelines/documents/examples/AES_CMAC.pdf, Example #2
    *

## ◆ IFX_SE_KEY_ID_BUILTIN_TEST_ECC384

#define IFX_SE_KEY_ID_BUILTIN_TEST_ECC384 (IFX_SE_KEY_ID_BUILTIN_MIN + 36u)

ECC P384 public key for signature verify NIST test.

    *
    *  csrc.nist.gov/CSRC/media/Projects/Cryptographic-Algorithm-Validation-Program/documents/dss/186-4ecdsatestvectors.zip
    *
    *  SigVer.rsp [P-384, SHA-256]
    *     Qx = 86ac12dd0a7fe5b81fdae86b12435d316ef9392a3f50b307ab65d9c6079dd0d2d819dc09e22861459c2ed99fbab66fae
    *     Qy = ac8444077aaed6d6ccacbe67a4caacee0b5a094a3575ca12ea4b4774c030fe1c870c9249023f5dc4d9ad6e333668cc38
    *

## ◆ IFX_SE_KEY_ID_BUILTIN_TEST_CMACKDF

#define IFX_SE_KEY_ID_BUILTIN_TEST_CMACKDF (IFX_SE_KEY_ID_BUILTIN_MIN + 37u)

AES-256 key for CMAC-KDF key derivation tests.

    *
    * Test vector csrc.nist.gov/CSRC/media/Projects/Cryptographic-Standards-and-Guidelines/documents/examples/AES_CMAC.pdf, Example #2
    *

## ◆ IFX_SE_KEY_ID_BUILTIN_TEST_ECC_PUB

#define IFX_SE_KEY_ID_BUILTIN_TEST_ECC_PUB (IFX_SE_KEY_ID_BUILTIN_MIN + 38u)

Built-in public ECC (P-256) key to use in verify.

    *
    * csrc.nist.gov/CSRC/media/Projects/Cryptographic-Algorithm-Validation-Program/documents/dss/186-4ecdsatestvectors.zip
    *
    * SigVer.rsp [P-256, SHA-256]
    *     Msg = 5905238877c77421f73e43ee3da6f2d9e2ccad5fc942dcec0cbd25482935faaf416983fe165b1a045ee2bcd2e6dca3bdf46c4310a7461f9a37960ca672d3feb5473e253605fb1ddfd28065b53cb5858a8ad28175bf9bd386a5e471ea7a65c17cc934a9d791e91491eb3754d03799790fe2d308d16146d5c9b0d0debd97d79ce8
    *     d = 519b423d715f8b581f4fa8ee59f4771a5b44c8130b4e3eacca54a56dda72b464
    *     Qx = 1ccbe91c075fc7f4f033bfa248db8fccd3565de94bbfb12f3c59ff46c271bf83
    *     Qy = ce4014c68811f9a21a1fdb2c0e6113e06db7ca93b7404e78dc7ccd5ca89a4ca9
    *     k = 94a1bbb14b906a61a280f245f9e93c7f3b4a6247824f5d33b9670787642a68de
    *     R = f3ac8061b514795b8843e3d6629527ed2afd6b1f6a555a7acabb5e6f79c8c2ac
    *     S = 8bf77819ca05a6b2786c76262bf7371cef97b218e96f175a3ccdda2acc058903
    *