Silicon Labs Cryptography Hardware Acceleration Drivers for PSA Crypto#

end group sl_crypto

Overview of drivers for hardware accelerated cryptography through the PSA Crypto APIs

Introduction#

The Silicon Labs distribution of mbed TLS includes device-specific drivers for selected PSA Crypto library functions. The drivers use the CRYPTO-, CRYPTOACC- or SE hardware peripherals to accelerate cryptographic primitives and algorithms according to the PSA Crypto driver model. Available acceleration hardware depends on the target device.

Note

• The PSA Crypto driver interface is prone to change across releases. These interfaces are therefore prefixed with sli_* to denote their potential instability. Users are strongly discouraged from depending directly on the driver interface, and should rather use the top-level PSA Crypto APIs.

For more information on the PSA Crypto accelerator driver interface, and its specification, see docs/proposed/psa-driver-interface.md.

CRYPTO peripheral drivers for PSA Crypto#

The Series-1 devices incorporate the CRYPTO peripheral for cryptographic hardware acceleration.

The drivers using the CRYPTO peripheral are located in sl_psa_driver/src/sli_crypto_*. These implementations are plugged in through the PSA Crypto driver interface, and rely on crypto_management.c to provide multi-threaded access to the driver.

Note

• Although the hardware acceleration drivers have been made thread-safe, the PSA Crypto core implemented in mbed TLS does not fully implement thread safety. See sl_psa_thread_safety for more information.

Driver files for supporting acceleration through PSA Crypto APIs using the CRYPTO peripheral:

• sli_crypto_transparent_driver_aead.c: AES-CCM and AES-GCM acceleration support for use through the PSA Crypto API.

• sli_crypto_transparent_driver_cipher.c: AES (ECB, CTR, CFB, OFB, CBC) acceleration support for use through the PSA Crypto API.

• sli_crypto_transparent_driver_hash.c: SHA-1 and SHA-256 acceleration for use through the PSA Crypto API.

• sli_crypto_transparent_driver_mac.c: AES-CMAC acceleration support for use through the PSA Crypto API.

Secure Engine peripheral drivers for PSA Crypto#

The EFR32xG21, EFR32xG23 & EFR32xG24 devices incorporate the SE peripheral for cryptographic hardware acceleration.

The drivers using the SE peripheral are located in sl_psa_driver/src/sli_se_* . These plugins also depend on Silicon Labs' SE Manager.

On Vault High devices, the plugins for the SE peripheral in opaque mode provide support for using wrapped keys through the PSA API.

Note

• The Secure Engine drivers are multi-thread capable, but do not support preemption. This means the application developer is responsible for not calling a driver-accelerated PSA API under conditions which would cause preemption of an already-running operation. For baremetal applications, this usually means not calling cryptographic operations from ISR. For RTOS-based applications, this boils down to not calling these SE-accelerated functions from either ISR or inside critical/atomic sections, since the underlying mutex acquisition would fail. Also note that the PSA Crypto core implemented in mbed TLS does not fully implement thread safety. See sl_psa_thread_safety for more information.

Base driver files supporting acceleration through PSA Crypto APIs (all depend on sli_se_driver_key_management.c):

• sli_se_driver_aead.c: Supporting symmetric-key AEAD algorithms for both transparent and opaque SE drivers.

• sli_se_driver_cipher.c: Supporting symmetric-key cipher algorithms for both transparent and opaque SE drivers.

• sli_se_driver_key_derivation.c: Supporting key agreement for both transparent and opaque SE drivers.

• sli_se_driver_key_management.c: Supporting key management for both transparent and opaque SE drivers.

• sli_se_driver_mac.c: Supporting symmetric-key MAC functions for both transparent and opaque SE drivers.

• sli_se_driver_signature.c: Supporting elliptic-curve signature functions for both transparent and opaque SE drivers.

• sli_se_transparent_driver_hash.c: Accelerated hashing functions (SHA-1 and SHA-2 families) for use with PSA Crypto according to the PSA Crypto accelerator driver model.

Driver files supporting acceleration with plaintext keys through PSA Crypto APIs (all depend on sli_se_driver_key_management.c):

• sli_se_transparent_driver_aead.c: Symmetric-key AEAD algorithm acceleration using plaintext keys (depends on sli_se_driver_aead.c).

• sli_se_transparent_driver_cipher.c: Symmetric-key block cipher algorithm acceleration using plaintext keys (depends on sli_se_driver_cipher.c).

• sli_se_transparent_driver_hash.c: Accelerated hashing functions (SHA-1 and SHA-2 families) for use with PSA Crypto according to the PSA Crypto accelerator driver model.

• sli_se_transparent_driver_mac.c: Symmetric-key MAC algorithm acceleration using plaintext keys (depends on sli_se_driver_mac.c).

• sli_se_transparent_key_derivation.c: Key agreement acceleration using plaintext keys (depends on sli_se_driver_key_derivation.c).

Driver files supporting acceleration with wrapped keys through PSA Crypto APIs (all depend on sli_se_driver_key_management.c):

• sli_se_opaque_driver_aead.c: Symmetric-key AEAD algorithm acceleration using wrapped keys (depends on sli_se_driver_aead.c).

• sli_se_opaque_driver_cipher.c: Symmetric-key block cipher algorithm acceleration using wrapped keys (depends on sli_se_driver_cipher.c).

• sli_se_opaque_driver_mac.c: Symmetric-key MAC algorithm acceleration using wrapped keys (depends on sli_se_driver_mac.c).

• sli_se_opaque_key_derivation.c: Key agreement acceleration using wrapped keys (depends on sli_se_driver_key_derivation.c).

CRYPTOACC peripheral drivers for PSA Crypto#

The EFR32xG22 devices incorporate the CRYPTOACC peripheral for cryptographic hardware acceleration.

The drivers using the CRYPTOACC peripheral are located in sl_psa_driver/src/sli_cryptoacc_*. These implementations are plugged in through the PSA Crypto driver interface, and rely on cryptoacc_management.c to provide multi-threaded access to the driver.

Note

• Although the hardware acceleration drivers have been made thread-safe, the PSA Crypto core implemented in mbed TLS does not fully implement thread safety. See sl_psa_thread_safety for more information.

Driver files supporting acceleration with plaintext keys through PSA Crypto APIs:

• sli_cryptoacc_transparent_driver_aead.c: Symmetric-key AEAD algorithm acceleration using CRYPTOACC.

• sli_cryptoacc_transparent_driver_cipher.c: Symmetric-key block cipher algorithm acceleration using CRYPTOACC.

• sli_cryptoacc_transparent_driver_hash.c: Accelerated hashing functions (SHA-1 and SHA-2 families) using CRYPTOACC.

• sli_cryptoacc_transparent_driver_mac.c: Symmetric-key MAC algorithm acceleration using CRYPTOACC.

• sli_cryptoacc_transparent_driver_key_derivation.c: Key agreement acceleration using CRYPTOACC.

• sli_cryptoacc_transparent_driver_signature.c: Elliptic-curve signature functions acceleration using CRYPTOACC.

Missing Features#

Missing features and known limitations for the PSA crypto drivers are listed below.

AEAD multipart:

• Missing support for non-12-byte IV for GCM multipart.

• Passing of AAD in multiple parts is only supported on Series-1 devices.

Modules#

Values for devices with a Hardware Secure Engine

Values for devices with a Virtual Secure Engine

((psa_key_location_t)0x000001UL)

((psa_key_location_t)0x000001UL)