Key Management Services (KMS) provides cryptographic services through the standard PKCS#11 APIs (developed by OASIS) allowing to abstract the key value to the caller (using object ID and not directly the key value). KMS can be executed inside a protected/isolated environment in order to ensure that key value can’t be accessed by an unauthorized code running outside the protected/isolated environment. KMS_EXT_TOKEN_ENABLED : to support External Token KMS_NVM_ENABLED : to support Non Volatile Memory storage Mandatory to handle runtime objects addition through blob import or creation through specific KMS services Requires @ref KMS_NVM_SLOT_NUMBERS to be defined KMS_NVM_DYNAMIC_ENABLED : to support Non Volatile Memory storage Mandatory to handle runtime objects creation through specific KMS services Requires "support Non Volatile Memory storage" (KMS_NVM_ENABLED) to be defined KMS_NVM_SLOT_NUMBERS : Specify here the number of slots to use in the Non Volatile Memory storage NVM slots correspond to storage slots, it should be at least equal to the number of keys you'll store into NVM. But if you intend to manipulate objects (create, destroy, derivate...) better use a greater number to avoid too much erase of the flash sectors containing the NVM storage. Memory impact is a 4 bytes per slot to store slot address in NVM. Mandatory to set if "support Non Volatile Memory storage" (KMS_NVM_ENABLED) is defined KMS_NB_SESSIONS_MAX : Defines the number of sessions KMS will be able to handle in parallel This value has an impact on memory footprint KMS_ENCRYPT : to support encryption services Requires a supported encryption algorithm to be enabled too: - KMS_AES_CBC - KMS_AES_CCM - KMS_AES_ECB - KMS_AES_GCM KMS_DECRYPT : to support decryption services Requires a supported decryption algorithm to be enabled too: - KMS_AES_CBC - KMS_AES_CCM - KMS_AES_ECB - KMS_AES_GCM KMS_DIGEST : to support digest services Requires a supported digest algorithm to be enabled too: - KMS_SHA1 - KMS_SHA256 KMS_SIGN : to support signature services Requires a supported signature algorithm to be enabled too: - KMS_RSA1 - KMS_AES_CMAC KMS_VERIFY : to support verification services Requires a supported verification algorithm to be enabled too: - KMS_RSA1 - KMS_ECDSA - KMS_AES_CMAC KMS_DERIVE_KEY : to support key derivation services Requires a supported derivation algorithm to be enabled too: - KMS_AES_ECB Requires KMS_NVM_DYNAMIC_ENABLED to be enabled to store derived key into NVM KMS_SEARCH : to support key search or mechanism search services KMS_GENERATE_KEYS : to support key generation services Requires a supported key generation algorithm to be enabled too: - KMS_ECDSA Requires KMS_NVM_DYNAMIC_ENABLED to be enabled to store generated key into NVM KMS_ATTRIBUTES : to support attributes manipulation services Requires KMS_NVM_DYNAMIC_ENABLED to be enabled in order to modify attributes KMS_OBJECTS : to support objects manipulation services Requires KMS_NVM_DYNAMIC_ENABLED to be enabled to create or delete objects into NVM KMS_PKCS11_GET_FUNCTION_LIST_SUPPORT : to support C_GetFunctionList API Disabling this feature allows to save some code footprint KMS_PKCS11_COMPLIANCE : to support PKCS11 APIs and implementation that are required to be compliant with PKCS11 standard Disabling this feature allows to save some code footprint KMS_NIKMS_ROUTER_BYPASS : to bypass KMS router and perform direct KMS API calls Only applicable when using 'niKMS' access Enabling this feature allows to save some code footprint, but forbid any use of the external token services KMS_IMPORT_BLOB : to use vendor defined blob import features Requires KMS_NVM_ENABLED to store imported keys Requires the following services and algorithm to Authenticate, Verify and decrypt the imported blobs: - KMS_DECRYPT - KMS_AES_CBC - KMS_DIGEST - KMS_SHA256 - KMS_VERIFY - KMS_ECDSA - KMS_EC_SECP256 KMS_IMPORT_BLOB_CHUNK_SIZE : Configure the blob importation chunk size - This size must be a multiple of 4 - This size must be greater to at least the blob import header size (@ref KMS_BlobRawHeaderTypeDef) Requires KMS_IMPORT_BLOB to be enabled KMS_MEM_USE_HEAP_ALLOCATOR : to perform dynamic allocation in HEAP - KMS will use standard malloc and free APIs - Requires a dynamic allocator provided by the toolchain like dlmalloc KMS_MEM_USE_POOL_ALLOCATOR : to perform dynamic allocation using internal pool allocator - Requires a pool definition in a file called kms_mem_pool_def.h (see kms_mem_pool_def_template.h for example) KMS_MEM_USE_CUSTOM_ALLOCATOR : to perform dynamic allocation using a custom allocator To use this custom allocator, implement the kms_mem_low_level.c - void KMS_MemInit(void) - CK_VOID_PTR KMS_Alloc(CK_SESSION_HANDLE session, size_t size) - void KMS_Free(CK_SESSION_HANDLE session, CK_VOID_PTR ptr) KMS_MEM_USE_HEAP_ALLOCATOR : to perform dynamic allocation in HEAP - KMS will use standard malloc and free APIs - Requires a dynamic allocator provided by the toolchain like dlmalloc KMS_MEM_USE_HEAP_ALLOCATOR, KMS_MEM_USE_POOL_ALLOCATOR and KMS_MEM_USE_CUSTOM_ALLOCATOR are mutually exclusive KMS_MEM_USE_POOL_ALLOCATOR : to perform dynamic allocation using internal pool allocator - Requires a pool definition in a file called kms_mem_pool_def.h (see kms_mem_pool_def_template.h for example) KMS_MEM_USE_HEAP_ALLOCATOR, KMS_MEM_USE_POOL_ALLOCATOR and KMS_MEM_USE_CUSTOM_ALLOCATOR are mutually exclusive KMS_MEM_USE_CUSTOM_ALLOCATOR : to perform dynamic allocation using a custom allocator To use this custom allocator, implement the kms_mem_low_level.c - void KMS_MemInit(void) - CK_VOID_PTR KMS_Alloc(CK_SESSION_HANDLE session, size_t size) - void KMS_Free(CK_SESSION_HANDLE session, CK_VOID_PTR ptr) KMS_MEM_USE_HEAP_ALLOCATOR, KMS_MEM_USE_POOL_ALLOCATOR and KMS_MEM_USE_CUSTOM_ALLOCATOR are mutually exclusive KMS_MEM_DEBUGGING : to keep memory profiling information Not usable with KMS_MEM_USE_CUSTOM_ALLOCATOR KMS_MEM_CLEANING : to clean dynamically freed memory The freed memory will be reset to 0 If using KMS_MEM_USE_HEAP_ALLOCATOR, KMS_MEM_DEBUGGING required Not usable with KMS_MEM_USE_CUSTOM_ALLOCATOR KMS_MEM_LOGGING : to log memory allocation information Information about allocations will be transmitted to KMS_LL_ReportMemAlloc and KMS_LL_ReportMemFree Not usable with KMS_MEM_USE_CUSTOM_ALLOCATOR KMS_SE_CHECK_PARAMS : to check input & output parameters location vs secure enclave Secure enforcement only applicable when using iKMS and secure enclave KMS_SE_CHECK_PARAMS : to use key locking services Secure enforcement only applicable when using iKMS and secure enclave KMS_SE_LOCK_KEYS_MAX : the number of keys that can be locked Mandatory to set if KMS_SE_LOCK_KEYS is defined KMS_SE_LOCK_SERVICES : to use services locking services Secure enforcement only applicable when using iKMS and secure enclave KMS_SE_LOCK_SERVICES_MAX : the number of services that can be locked Mandatory to set if KMS_SE_LOCK_SERVICES is defined KMS_AES_CBC : to support AES CBC algorithm This defines is a bit mask that include information on the algorithm purpose: - KMS_FCT_ENCRYPT This algorithm can be used to perform encryption - KMS_FCT_DECRYPT This algorithm can be used to perform decryption Requires at least one of the following PKCS#11 services to be enabled: - KMS_ENCRYPT - KMS_DECRYPT KMS_AES_CCM : to support AES CCM algorithm This defines is a bit mask that include information on the algorithm purpose: - KMS_FCT_ENCRYPT This algorithm can be used to perform encryption - KMS_FCT_DECRYPT This algorithm can be used to perform decryption Requires at least one of the following PKCS#11 services to be enabled: - KMS_ENCRYPT - KMS_DECRYPT KMS_AES_ECB : to support AES ECB algorithm This defines is a bit mask that include information on the algorithm purpose: - KMS_FCT_ENCRYPT This algorithm can be used to perform encryption - KMS_FCT_DECRYPT This algorithm can be used to perform decryption - KMS_FCT_DERIVE_KEY This algorithm can be used to perform key derivation Requires at least one of the following PKCS#11 services to be enabled: - KMS_ENCRYPT - KMS_DECRYPT - KMS_DERIVE_KEY KMS_AES_GCM : to support AES GCM algorithm This defines is a bit mask that include information on the algorithm purpose: - KMS_FCT_ENCRYPT This algorithm can be used to perform encryption - KMS_FCT_DECRYPT This algorithm can be used to perform decryption Requires at least one of the following PKCS#11 services to be enabled: - KMS_ENCRYPT - KMS_DECRYPT KMS_AES_CMAC : to support AES CMAC algorithm This defines is a bit mask that include information on the algorithm purpose: - KMS_FCT_SIGN This algorithm can be used to perform signature - KMS_FCT_VERIFY This algorithm can be used to perform verification Requires at least one of the following PKCS#11 services to be enabled: - KMS_SIGN - KMS_VERIFY KMS_RSA : to support RSA algorithm This defines is a bit mask that include information on the algorithm purpose: - KMS_FCT_SIGN This algorithm can be used to perform signature - KMS_FCT_VERIFY This algorithm can be used to perform verification Requires at least one of the following PKCS#11 services to be enabled: - KMS_SIGN - KMS_VERIFY Requires at least one of the following RSA modulus length to be enabled: - KMS_RSA_1024 - KMS_RSA_2048 KMS_RSA_1024 : to support RSA 1024 bits modulus length Requires KMS_RSA to be defined KMS_RSA_2048 : to support RSA 2048 bits modulus length Requires KMS_RSA to be defined KMS_ECDSA Uncomment the below line to support ECDSA algorithm This defines is a bit mask that include information on the algorithm purpose: - KMS_FCT_VERIFY This algorithm can be used to perform verification Requires at least one of the following PKCS#11 services to be enabled: - KMS_VERIFY Requires at least one of the following elliptic curve to be enabled: - KMS_EC_SECP192 - KMS_EC_SECP256 - KMS_EC_SECP384 KMS_EC_SECP192 : to support elliptic curve SECP-192 Requires KMS_ECDSA to be defined KMS_EC_SECP256 : to support elliptic curve SECP-256 Requires KMS_ECDSA to be defined KMS_EC_SECP384 : to support elliptic curve SECP-384 Requires KMS_ECDSA to be defined KMS_SHA1 : to support SHA1 algorithm This defines is a bit mask that include information on the algorithm purpose: - KMS_FCT_DIGEST This algorithm can be used to perform digesting Requires at least one of the following PKCS#11 services to be enabled: - KMS_DIGEST KMS_SHA256 : to support SHA256 algorithm This defines is a bit mask that include information on the algorithm purpose: - KMS_FCT_DIGEST This algorithm can be used to perform digesting Requires at least one of the following PKCS#11 services to be enabled: - KMS_DIGEST KMS_Init //#define KMS_ENCRYPT #define KMS_ENCRYPT //#define KMS_DECRYPT #define KMS_DECRYPT //#define KMS_DIGEST #define KMS_DIGEST //#define KMS_SIGN #define KMS_SIGN //#define KMS_VERIFY #define KMS_VERIFY //#define KMS_DERIVE_KEY #define KMS_DERIVE_KEY //#define KMS_SEARCH #define KMS_SEARCH //#define KMS_GENERATE_KEYS //#define KMS_ATTRIBUTES #define KMS_ATTRIBUTES //#define KMS_OBJECTS #define KMS_OBJECTS //#define KMS_PKCS11_GET_FUNCTION_LIST_SUPPORT #define KMS_PKCS11_GET_FUNCTION_LIST_SUPPORT //#define KMS_PKCS11_COMPLIANCE #define KMS_PKCS11_COMPLIANCE //#define KMS_NIKMS_ROUTER_BYPASS #define KMS_NIKMS_ROUTER_BYPASS //#define KMS_IMPORT_BLOB #define KMS_IMPORT_BLOB KMS_FCT_ENCRYPT KMS_FCT_DECRYPT KMS_FCT_ENCRYPT|KMS_FCT_DECRYPT KMS_FCT_ENCRYPT KMS_FCT_DECRYPT KMS_FCT_ENCRYPT|KMS_FCT_DECRYPT KMS_FCT_ENCRYPT KMS_FCT_DECRYPT KMS_FCT_DERIVE_KEY KMS_FCT_ENCRYPT|KMS_FCT_DECRYPT KMS_FCT_ENCRYPT|KMS_FCT_DERIVE_KEY KMS_FCT_DECRYPT|KMS_FCT_DERIVE_KEY KMS_FCT_ENCRYPT|KMS_FCT_DECRYPT|KMS_FCT_DERIVE_KEY KMS_FCT_ENCRYPT KMS_FCT_DECRYPT KMS_FCT_ENCRYPT|KMS_FCT_DECRYPT KMS_FCT_SIGN KMS_FCT_VERIFY KMS_FCT_SIGN|KMS_FCT_VERIFY KMS_FCT_SIGN KMS_FCT_VERIFY KMS_FCT_SIGN|KMS_FCT_VERIFY //#define KMS_RSA_1024 #define KMS_RSA_1024 //#define KMS_RSA_2048 #define KMS_RSA_2048 KMS_FCT_VERIFY //#define KMS_EC_SECP192 #define KMS_EC_SECP192 //#define KMS_EC_SECP256 #define KMS_EC_SECP256 //#define KMS_EC_SECP384 #define KMS_EC_SECP384 KMS_FCT_DIGEST KMS_FCT_DIGEST S_KMS S_KMS$noContext