PSA Crypto Cipher

This example uses the PSA Crypto API to perform unauthenticated ciphers’ operations on the supported device.

The build-in AES-128 key can be selected for AES cipher operations if this key is available on the supported device. The default AES-128 key (encrypt-unsafe-key.prv) can be found in the Windows folder below.

C:\SiliconLabs\SimplicityStudio\v5\developer\adapter_packs\secmgr\scripts\offline

The AES-128 key (encrypt-unsafe-key.prv) is:

81a5e21fa15286f1df445c2cc120fa3f

If the AES-128 key has not been provisioned on the device, the program will skip the cipher operation of this key.

The example redirects standard I/O to the virtual serial port (VCOM) of the kit. By default, the serial port setting is 115200 bps and 8-N-1 configuration.

Except for the Series 1 Cortex-M0+ device, the example has been instrumented with code to count the number of clock cycles spent in different operations. The results are printed on the VCOM serial port console. This feature can be disabled by defining PSA_CRYPTO_PRINT=0 (default is 1) in the IDE setting (Preprocessor->Defined symbols).

Key Storage

The following key storages are supported in this example:

Key Size

The following key sizes are supported in this example:

Payload Size

The following payload sizes are supported in this example:

The default PLAIN_MSG_SIZE is 4096, it is defined in app_psa_crypto_cipher.h.

Unauthenticated Cipher Algorithm

The following unauthenticated cipher algorithms are supported in this example:

The PSA_ALG_CHACHA20 can only use a 256-bit key.

Built-in Key

The following built-in key is supported in this example:

The default cipher algorithm of the AES-128 key is PSA_ALG_CTR, it is defined in sli_se_opaque_types.h.

PSA Crypto API

The following PSA Crypto APIs are used in this example:

Getting Started

  1. Upgrade the kit’s firmware to the latest version (see Adapter Firmware under General Device Information in Simplicity Studio 5 Users Guide).
  2. Upgrade the device’s SE firmware to the latest version when Series 2 device is used (see Secure Firmware under General Device Information in Simplicity Studio 5 Users Guide).
  3. Open any terminal program and connect to the kit’s VCOM port (if using Device Console in Simplicity Studio 5, Line terminator: must be set to None).
  4. Create this platform example project in the Simplicity IDE (see Examples in Simplicity Studio 5 Users Guide, check Platform() checkbox to browse the platform examples).
  5. Build the example and download it to the kit (see Simple Build and Flash Programmer in Simplicity Studio 5 Users Guide).
  6. Run the example and follow the instructions shown on the console.

Additional Information

  1. The example uses the CTR-DRBG, a pseudo-random number generator (PRNG) included in Mbed TLS to generate the random number. If the example is running on a device including a TRNG (True Random Number Generator) hardware module, the TRNG will be used as an entropy source to seed the CTR-DRBG. If the device does not incorporate a TRNG, the example will use RAIL or ADC as the entropy source.
  2. If an algorithm is not supported in the hardware accelerator of the selected device, the PSA Crypto will use the software fallback feature (if enable) in Mbed TLS.
  3. Change the PERSISTENT_KEY_ID value in app_process.h if this key ID had already existed in NVM3.
  4. The Series 1 devices do not support 192-bit key on unauthenticated ciphers.
  5. The single-part cipher functions (psa_cipher_encrypt and psa_cipher_decrypt) are not supported yet.
  6. The PSA_ALG_CHACHA20 on the wrapped key is not supported yet.
  7. The default optimization level is Optimize for debugging (-Og) on Simplicity IDE and None on IAR Embedded Workbench.

Resources

AN1222: Production Programming of Series 2 Devices

AN1311: Mbed TLS to PSA Crypto Porting Guide