This example uses the PSA Crypto API to perform ECDSA digital signature on the supported device.
In this example, the PSA Crypto API is used to generate a private-public key pair using a given Elliptic Curve Cryptography (ECC) curve. The private key is first used to sign the hash of a message buffer. The signature is then verified using the public key.
The build-in asymmetric keys can be selected for ECDSA operations if these keys are available on the supported device. The private sign key and private command keys are stored in device memory to sign the hash. The device’s public sign key and public command key in the SE OTP must match with the public keys of the private sign key and private command key to verify the signature.
The default private sign key (rootsign-unsafe-privkey.pem) and private command key (cmd-unsafe-privkey.pem) can be found in the Windows folder below.
C:\SiliconLabs\SimplicityStudio\v5\developer\adapter_packs\secmgr\scripts\offline
The public key of rootsign-unsafe-privkey.pem is:
X - C4AF4AC69AAB9512DB50F7A26AE5B4801183D85417E729A56DA974F4E08A562C
Y - DE6019DEA9411332DC1A743372D170B436238A34597C410EA177024DE20FC819
The public key of cmd-unsafe-privkey.pem is:
X - B1BC6F6FA56640ED522B2EE0F5B3CF7E5D48F60BE8148F0DC08440F0A4E1DCA4
Y - 7C04119ED6A1BE31B7707E5F9D001A659A051003E95E1B936F05C37EA793AD63
If the public sign key or public command key has not been provisioned on the device, the program will skip the signature verification of this public key.
The example redirects standard I/O to the virtual serial port (VCOM) of the kit. By default, the serial port setting is 115200 bps and 8-N-1 configuration.
Except for the Series 1 Cortex-M0+ device, the example has been instrumented with code to count the number of clock cycles spent in different operations. The results are printed on the VCOM serial port console. This feature can be disabled by defining PSA_CRYPTO_PRINT=0 (default is 1) in the IDE setting (Preprocessor->Defined symbols).
The following key storages are supported in this example:
The following elliptic curve keys are supported in this example:
PSA_ECC_FAMILY_SECP_R1 :The following asymmetric signature algorithms are supported in this example:
PSA_ALG_ECDSA(hash_alg)PSA_ALG_ECDSA_ANYThe following hash algorithms are supported in this example:
PSA_ALG_SHA_1PSA_ALG_SHA_224PSA_ALG_SHA_256PSA_ALG_SHA_384PSA_ALG_SHA_512The following built-in keys are supported in this example:
The following PSA Crypto APIs are used in this example:
psa_crypto_initpsa_key_attributes_initpsa_set_key_typepsa_set_key_bitspsa_set_key_usage_flagspsa_set_key_algorithmpsa_set_key_idpsa_set_key_lifetimepsa_generate_keypsa_import_keypsa_reset_key_attributespsa_export_public_keypsa_sign_hashpsa_verify_hashpsa_open_keypsa_close_keypsa_destroy_keymbedtls_psa_crypto_freeAdapter Firmware under General Device Information in Simplicity Studio 5 Users Guide).Secure Firmware under General Device Information in Simplicity Studio 5 Users Guide).Device Console in Simplicity Studio 5, Line terminator: must be set to None).Platform() checkbox to browse the platform examples).4096) in sl_memory_config.h can be reset to the default value (2048) if the software fallback feature in Mbed TLS is disabled.PERSISTENT_KEY_ID value in app_process.h if this key ID had already existed in NVM3.psa_sign_message and psa_verify_message) are not supported yet.Optimize for debugging (-Og) on Simplicity IDE and None on IAR Embedded Workbench.AN1222: Production Programming of Series 2 Devices
AN1268: Authenticating Silicon Labs Devices Using Device Certificates