STM32 Key Management Services Key Management Services (KMS) provides cryptographic services through the standard <br/> PKCS#11 APIs (developed by OASIS) allowing to abstract the key value to the caller <br/> (using object ID and not directly the key value). KMS can be executed inside a <br/> protected/isolated environment in order to ensure that key value can’t be accessed by <br/> an unauthorized code running outside the protected/isolated environment. <br/> KMS manages 3 types of keys: <br/> - Static Embedded keys : <br/> - Predefined keys embedded within the code that can’t be modified <br/> - Updatable keys with Static ID : <br/> - Keys IDs are predefined in the system <br/> - Key(s) can be injected or updated in a NVM storage via a secure <br/> procedure using. Static Embedded Keys(authenticity check, data <br/> integrity check and data decryption) <br/> - Key can’t be deleted <br/> - Updatable keys with dynamic ID : <br/> - Keys IDs are defined when keys are created using KMS services <br/> - Key value can be updated using KMS services <br/> - Key can be deleted <br/> KMS only supports a subset of PKCS#11 APIs: <br/> - Object management functions: creation / update / deletion <br/> - AES Encrypt & Decrypt functions <br/> - SHA Digest functions <br/> - RSA and ECDSA Sign / Verify functions <br/> STM32 Key Management Services Key Management Services (KMS) provides cryptographic services through the standard <br/> PKCS#11 APIs (developed by OASIS) allowing to abstract the key value to the caller <br/> (using object ID and not directly the key value). KMS can be executed inside a <br/> protected/isolated environment in order to ensure that key value can’t be accessed by <br/> an unauthorized code running outside the protected/isolated environment. <br/> KMS manages 3 types of keys: <br/> - Static Embedded keys : <br/> - Predefined keys embedded within the code that can’t be modified <br/> - Updatable keys with Static ID : <br/> - Keys IDs are predefined in the system <br/> - Key(s) can be injected or updated in a NVM storage via a secure <br/> procedure using. Static Embedded Keys(authenticity check, data <br/> integrity check and data decryption) <br/> - Key can’t be deleted <br/> - Updatable keys with dynamic ID : <br/> - Keys IDs are defined when keys are created using KMS services <br/> - Key value can be updated using KMS services <br/> - Key can be deleted <br/> KMS only supports a subset of PKCS#11 APIs: <br/> - Object management functions: creation / update / deletion <br/> - AES Encrypt & Decrypt functions <br/> - SHA Digest functions <br/> - RSA Sign / Verify functions <br/> - ECDSA Sign functions <br/>