Crypto - Platform#

otCryptoKeyType#

otCryptoKeyType

Defines the key types.

otCryptoKeyAlgorithm#

otCryptoKeyAlgorithm

Defines the key algorithms.

@11#

@11

Defines the key usage flags.

otCryptoKeyStorage#

otCryptoKeyStorage

Defines the key storage types.

otCryptoKeyRef#

typedef uint32_t otCryptoKeyRef

This datatype represents the key reference.

otCryptoKey#

typedef struct otCryptoKey otCryptoKey

otCryptoContext#

typedef struct otCryptoContext otCryptoContext

otPlatCryptoSha256Hash#

typedef struct otPlatCryptoSha256Hash otPlatCryptoSha256Hash

Represents a SHA-256 hash.

otPlatCryptoEcdsaKeyPair#

typedef struct otPlatCryptoEcdsaKeyPair otPlatCryptoEcdsaKeyPair

otPlatCryptoEcdsaPublicKey#

typedef struct otPlatCryptoEcdsaPublicKey otPlatCryptoEcdsaPublicKey

otPlatCryptoEcdsaSignature#

typedef struct otPlatCryptoEcdsaSignature otPlatCryptoEcdsaSignature

OT_TOOL_PACKED_END#

OT_TOOL_PACKED_BEGIN struct otPlatCryptoEcdsaSignature OT_TOOL_PACKED_END

otPlatCryptoInit#

void otPlatCryptoInit (void)

Initialize the Crypto module.

otPlatCryptoImportKey#

otError otPlatCryptoImportKey (otCryptoKeyRef *aKeyRef, otCryptoKeyType aKeyType, otCryptoKeyAlgorithm aKeyAlgorithm, int aKeyUsage, otCryptoKeyStorage aKeyPersistence, const uint8_t *aKey, size_t aKeyLen)

Import a key into PSA ITS.

Note

• If OT_CRYPTO_KEY_STORAGE_PERSISTENT is passed for aKeyPersistence then aKeyRef is input and platform should use the given aKeyRef and MUST not change it.

If OT_CRYPTO_KEY_STORAGE_VOLATILE is passed for aKeyPersistence then aKeyRef is output, the initial value does not matter and platform API MUST update it to return the new key ref.

This API is only used by OT core when OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE is enabled.

otPlatCryptoExportKey#

otError otPlatCryptoExportKey (otCryptoKeyRef aKeyRef, uint8_t *aBuffer, size_t aBufferLen, size_t *aKeyLen)

Export a key stored in PSA ITS.

Note

• This API is only used by OT core when OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE is enabled.

otPlatCryptoDestroyKey#

otError otPlatCryptoDestroyKey (otCryptoKeyRef aKeyRef)

Destroy a key stored in PSA ITS.

Note

• This API is only used by OT core when OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE is enabled.

otPlatCryptoHasKey#

bool otPlatCryptoHasKey (otCryptoKeyRef aKeyRef)

Check if the key ref passed has an associated key in PSA ITS.

Note

• This API is only used by OT core when OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE is enabled.

otPlatCryptoHmacSha256Init#

otError otPlatCryptoHmacSha256Init (otCryptoContext *aContext)

Initialize the HMAC operation.

Note

• The platform driver shall point the context to the correct object such as psa_mac_operation_t or mbedtls_md_context_t.

otPlatCryptoHmacSha256Deinit#

otError otPlatCryptoHmacSha256Deinit (otCryptoContext *aContext)

Uninitialize the HMAC operation.

otPlatCryptoHmacSha256Start#

otError otPlatCryptoHmacSha256Start (otCryptoContext *aContext, const otCryptoKey *aKey)

Start HMAC operation.

otPlatCryptoHmacSha256Update#

otError otPlatCryptoHmacSha256Update (otCryptoContext *aContext, const void *aBuf, uint16_t aBufLength)

Update the HMAC operation with new input.

otPlatCryptoHmacSha256Finish#

otError otPlatCryptoHmacSha256Finish (otCryptoContext *aContext, uint8_t *aBuf, size_t aBufLength)

Complete the HMAC operation.

otPlatCryptoAesInit#

otError otPlatCryptoAesInit (otCryptoContext *aContext)

Initialise the AES operation.

Note

• The platform driver shall point the context to the correct object such as psa_key_id or mbedtls_aes_context_t.

otPlatCryptoAesSetKey#

otError otPlatCryptoAesSetKey (otCryptoContext *aContext, const otCryptoKey *aKey)

Set the key for AES operation.

otPlatCryptoAesEncrypt#

otError otPlatCryptoAesEncrypt (otCryptoContext *aContext, const uint8_t *aInput, uint8_t *aOutput)

Encrypt the given data.

otPlatCryptoAesFree#

otError otPlatCryptoAesFree (otCryptoContext *aContext)

Free the AES context.

otPlatCryptoHkdfInit#

otError otPlatCryptoHkdfInit (otCryptoContext *aContext)

Initialise the HKDF context.

Note

• The platform driver shall point the context to the correct object such as psa_key_derivation_operation_t or HmacSha256::Hash

otPlatCryptoHkdfExpand#

otError otPlatCryptoHkdfExpand (otCryptoContext *aContext, const uint8_t *aInfo, uint16_t aInfoLength, uint8_t *aOutputKey, uint16_t aOutputKeyLength)

Perform HKDF Expand step.

otPlatCryptoHkdfExtract#

otError otPlatCryptoHkdfExtract (otCryptoContext *aContext, const uint8_t *aSalt, uint16_t aSaltLength, const otCryptoKey *aInputKey)

Perform HKDF Extract step.

otPlatCryptoHkdfDeinit#

otError otPlatCryptoHkdfDeinit (otCryptoContext *aContext)

Uninitialize the HKDF context.

otPlatCryptoSha256Init#

otError otPlatCryptoSha256Init (otCryptoContext *aContext)

Initialise the SHA-256 operation.

Note

• The platform driver shall point the context to the correct object such as psa_hash_operation_t or mbedtls_sha256_context.

otPlatCryptoSha256Deinit#

otError otPlatCryptoSha256Deinit (otCryptoContext *aContext)

Uninitialize the SHA-256 operation.

otPlatCryptoSha256Start#

otError otPlatCryptoSha256Start (otCryptoContext *aContext)

Start SHA-256 operation.

otPlatCryptoSha256Update#

otError otPlatCryptoSha256Update (otCryptoContext *aContext, const void *aBuf, uint16_t aBufLength)

Update SHA-256 operation with new input.

otPlatCryptoSha256Finish#

otError otPlatCryptoSha256Finish (otCryptoContext *aContext, uint8_t *aHash, uint16_t aHashSize)

Finish SHA-256 operation.

otPlatCryptoRandomInit#

void otPlatCryptoRandomInit (void)

Initialize cryptographically-secure pseudorandom number generator (CSPRNG).

otPlatCryptoRandomDeinit#

void otPlatCryptoRandomDeinit (void)

Deinitialize cryptographically-secure pseudorandom number generator (CSPRNG).

otPlatCryptoRandomGet#

otError otPlatCryptoRandomGet (uint8_t *aBuffer, uint16_t aSize)

Fills a given buffer with cryptographically secure random bytes.

otPlatCryptoEcdsaGenerateKey#

otError otPlatCryptoEcdsaGenerateKey (otPlatCryptoEcdsaKeyPair *aKeyPair)

Generate and populate the output buffer with a new ECDSA key-pair.

otPlatCryptoEcdsaGetPublicKey#

otError otPlatCryptoEcdsaGetPublicKey (const otPlatCryptoEcdsaKeyPair *aKeyPair, otPlatCryptoEcdsaPublicKey *aPublicKey)

Get the associated public key from the input context.

otPlatCryptoEcdsaSign#

otError otPlatCryptoEcdsaSign (const otPlatCryptoEcdsaKeyPair *aKeyPair, const otPlatCryptoSha256Hash *aHash, otPlatCryptoEcdsaSignature *aSignature)

Calculate the ECDSA signature for a hashed message using the private key from the input context.

Uses the deterministic digital signature generation procedure from RFC 6979.

otPlatCryptoEcdsaVerify#

otError otPlatCryptoEcdsaVerify (const otPlatCryptoEcdsaPublicKey *aPublicKey, const otPlatCryptoSha256Hash *aHash, const otPlatCryptoEcdsaSignature *aSignature)

Use the key from the input context to verify the ECDSA signature of a hashed message.

otPlatCryptoEcdsaSignUsingKeyRef#

otError otPlatCryptoEcdsaSignUsingKeyRef (otCryptoKeyRef aKeyRef, const otPlatCryptoSha256Hash *aHash, otPlatCryptoEcdsaSignature *aSignature)

Calculate the ECDSA signature for a hashed message using the Key reference passed.

Uses the deterministic digital signature generation procedure from RFC 6979.

Note

• This API is only used by OT core when OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE is enabled.

otPlatCryptoEcdsaExportPublicKey#

otError otPlatCryptoEcdsaExportPublicKey (otCryptoKeyRef aKeyRef, otPlatCryptoEcdsaPublicKey *aPublicKey)

Get the associated public key from the key reference passed.

The public key is stored differently depending on the crypto backend library being used (OPENTHREAD_CONFIG_CRYPTO_LIB).

This API must make sure to return the public key as a byte sequence representation of an uncompressed curve point (RFC 6605 - sec 4)

Note

• This API is only used by OT core when OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE is enabled.

otPlatCryptoEcdsaGenerateAndImportKey#

otError otPlatCryptoEcdsaGenerateAndImportKey (otCryptoKeyRef aKeyRef)

Generate and import a new ECDSA key-pair at reference passed.

Note

• This API is only used by OT core when OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE is enabled.

otPlatCryptoEcdsaVerifyUsingKeyRef#

otError otPlatCryptoEcdsaVerifyUsingKeyRef (otCryptoKeyRef aKeyRef, const otPlatCryptoSha256Hash *aHash, const otPlatCryptoEcdsaSignature *aSignature)

Use the keyref to verify the ECDSA signature of a hashed message.

Note

• This API is only used by OT core when OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE is enabled.

otPlatCryptoPbkdf2GenerateKey#

void otPlatCryptoPbkdf2GenerateKey (const uint8_t *aPassword, uint16_t aPasswordLen, const uint8_t *aSalt, uint16_t aSaltLen, uint32_t aIterationCounter, uint16_t aKeyLen, uint8_t *aKey)

Perform PKCS#5 PBKDF2 using CMAC (AES-CMAC-PRF-128).

OT_CRYPTO_SHA256_HASH_SIZE#

#define OT_CRYPTO_SHA256_HASH_SIZE

32

Length of SHA256 hash (in bytes).

OT_CRYPTO_ECDSA_MAX_DER_SIZE#

#define OT_CRYPTO_ECDSA_MAX_DER_SIZE

125

Max buffer size (in bytes) for representing the EDCSA key-pair in DER format.

OT_CRYPTO_ECDSA_PUBLIC_KEY_SIZE#

#define OT_CRYPTO_ECDSA_PUBLIC_KEY_SIZE

64

Buffer size (in bytes) for representing the EDCSA public key.

OT_CRYPTO_ECDSA_SIGNATURE_SIZE#

#define OT_CRYPTO_ECDSA_SIGNATURE_SIZE

64

Buffer size (in bytes) for representing the EDCSA signature.

OT_CRYPTO_PBDKF2_MAX_SALT_SIZE#

#define OT_CRYPTO_PBDKF2_MAX_SALT_SIZE

30

Max PBKDF2 SALT length: salt prefix (6) + extended panid (8) + network name (16)