This example uses the PSA Crypto API to perform ECDSA digital signature on the supported device.
In this example, the PSA Crypto API is used to generate a private-public key pair using a given Elliptic Curve Cryptography (ECC) curve. The private key is first used to sign the hash of a message buffer. The signature is then verified using the public key.
The build-in asymmetric keys can be selected for ECDSA operations if these keys are available on the supported device. The private sign key and private command keys are stored in device memory to sign the hash. The device’s public sign key and public command key in the SE OTP must match with the public keys of the private sign key and private command key to verify the signature.
The default private sign key (rootsign-unsafe-privkey.pem
) and private command key (cmd-unsafe-privkey.pem
) can be found in the Windows folder below.
C:\SiliconLabs\SimplicityStudio\v5\developer\adapter_packs\secmgr\scripts\offline
The public key of rootsign-unsafe-privkey.pem
is:
X - C4AF4AC69AAB9512DB50F7A26AE5B4801183D85417E729A56DA974F4E08A562C
Y - DE6019DEA9411332DC1A743372D170B436238A34597C410EA177024DE20FC819
The public key of cmd-unsafe-privkey.pem
is:
X - B1BC6F6FA56640ED522B2EE0F5B3CF7E5D48F60BE8148F0DC08440F0A4E1DCA4
Y - 7C04119ED6A1BE31B7707E5F9D001A659A051003E95E1B936F05C37EA793AD63
If the public sign key or public command key has not been provisioned on the device, the program will skip the signature verification of this public key.
The example redirects standard I/O to the virtual serial port (VCOM) of the kit. By default, the serial port setting is 115200 bps and 8-N-1 configuration.
Except for the Series 1 Cortex-M0+ device, the example has been instrumented with code to count the number of clock cycles spent in different operations. The results are printed on the VCOM serial port console. This feature can be disabled by defining PSA_CRYPTO_PRINT=0
(default is 1) in the IDE setting (Preprocessor->Defined symbols
).
The following key storages are supported in this example:
The following elliptic curve keys are supported in this example:
PSA_ECC_FAMILY_SECP_R1
:The following asymmetric signature algorithms are supported in this example:
PSA_ALG_ECDSA(hash_alg)
PSA_ALG_ECDSA_ANY
The following hash algorithms are supported in this example:
PSA_ALG_SHA_1
PSA_ALG_SHA_224
PSA_ALG_SHA_256
PSA_ALG_SHA_384
PSA_ALG_SHA_512
The following built-in keys are supported in this example:
The following PSA Crypto APIs are used in this example:
psa_crypto_init
psa_key_attributes_init
psa_set_key_type
psa_set_key_bits
psa_set_key_usage_flags
psa_set_key_algorithm
psa_set_key_id
psa_set_key_lifetime
psa_generate_key
psa_import_key
psa_reset_key_attributes
psa_export_public_key
psa_sign_hash
psa_verify_hash
psa_open_key
psa_close_key
psa_destroy_key
mbedtls_psa_crypto_free
Adapter Firmware
under General Device Information in Simplicity Studio 5 Users Guide).Secure Firmware
under General Device Information in Simplicity Studio 5 Users Guide).Device Console
in Simplicity Studio 5, Line terminator:
must be set to None
).Platform()
checkbox to browse the platform examples).4096
) in sl_memory_config.h
can be reset to the default value (2048
) if the software fallback feature in Mbed TLS is disabled.PERSISTENT_KEY_ID
value in app_process.h
if this key ID had already existed in NVM3.psa_sign_message
and psa_verify_message
) are not supported yet.Optimize for debugging (-Og)
on Simplicity IDE and None
on IAR Embedded Workbench.AN1222: Production Programming of Series 2 Devices
AN1268: Authenticating Silicon Labs Devices Using Device Certificates