PSA Internal Trusted Storage (ITS)#
PSA ITS (Internal Trusted Storage) is a set of storage abstraction APIs for use in conjunction with the rest of the PSA Crypto API's. It defines a way to interact with a trusted storage backend, by storing data in internal flash. Files are accessed with a unique value through psa_storage_uid_t.
The PSA storage subsystem in Mbed TLS maps the psa_storage_uid_t parameter in the PSA API directly to the key_id (of type mbedtls_svc_key_id_t ). this is returned by psa_import_key and subsequently used when referencing most PSA Crypto APIs.
Use of ITS for Key Storage#
The Mbed TLS PSA Crypto implementation interacts with ITS to store its key database, key metadata and (if applicable) key material. It is based on a set of different files:
One file for the key database (the list of psa_key_id's present on a system)
One file per psa_key_id present on the system, containing key metadata (for all keys across all lifetimes except volatile) with potentially plain-text key material (for keys generated with the default persistent lifetime)
One transaction file that logs ongoing key creation/modification/deletion operations in case an unexpected system restart happens and the transaction needs to be fulfilled across reset.
PSA ITS on Silicon Labs Parts#
The Simplicity SDK includes a PSA ITS driver which is implemented as a wrapper around NVM3. See NVM3 NVM Data Manager for further details. In NVM3, there is a range of NVM3 IDs allocated to PSA ITS, and each file stored through ITS requires such an ID. Files are stored sequentially, and created in the first free NVM3 ID which can be found in its range. Retrieval of a PSA ITS file by its PSA ID requires finding the NVM3 ID which contains the file for the requested PSA ID.
Constraints of this implementation#
Looking up a key by PSA ITS ID requires that all keys need to be partially read (through retrieval of the file header) to look for a match, since the PSA ITS ID range is 64 bits and the NVM3 range allocated for PSA ITS is set to 16 bits.
The PSA ITS file maximum size is dictated by the default NVM3 instance's maximum object size.
The maximum amount of PSA ITS files in a system becomes a function of:
The maximum NVM3 object size
The available free space in the NVM3 default instance
The amount of keys available in the
NVM3_PSA_ITS_RANGE
Currently, the NVM3 range available to PSA is set to 1024 files.
Version 3 of the PSA ITS driver#
A new version (v3) of the ITS driver was added in the Gecko SDK 4.2.0. Selecting the version of the ITS driver can be done in the PSA Crypto Configuration file.
Version 3 is enabled by default when adding PSA Persistant Storage Support (ITS) to a new project. For applications that have used the old ITS driver prior to v4.2.0, enabling support for the V3 ITS Driver will provide an upgrade path from V1/V2. For devices that are not able to upgrade to TS driver V3, disable V3 support in the configuration, and use the previous version of the ITS driver.
Note: Upgrading to V3 can take some time (more than 1 min for 1000 files). There is no available downgrade path to earlier versions after upgrading to V3.
With the ITS driver upgrade to version 3, ITS uses simple PRNG with UID as a seed to create a hash-map-like structure. The NVM3 ID range has been changed from a region starting at 0x83100 to region ending with 0x870ff. Note that with ITS Driver V3, maximum used peristent key count (SL_PSA_ITS_USER_MAX_FILES)can no longer be changed.