topic Re: S32K3 certificate storage in S32K

S32K3 certificate storage

JiayuZhou — Mon, 19 Aug 2024 01:31:15 GMT

For S32K3，I find certificates can't store in HSM, only can store the key in HSM, the certificate still store in user core.

So, I have two questions:

1. Whether is HSM not support to certificate storage, update and verify?

2. Whether is MCAL not support to certificate parsing?

Re: S32K3 certificate storage

VaneB — Tue, 20 Aug 2024 16:30:28 GMT

Hi @JiayuZhou

The CertificateParse and CertificateVerify functionalities are not implemented, as Certificate handling via HSE-B is not done directly. It can fill-in a certificate signing request (CSR) that is pre-formatted by the host. By this the host just needs to provide the pointers to the key values that must be located within the CSR.

To provide a certificate as shown in the image you share, HSE supports the option to "import standard key certificates", in this case the key container of the Key to be imported is formatted according to a standard certificate format. To properly import the key the host just needs to provide the pointers to the key values and container within the certificate.

To keep a certificate valid, most of them will have an expiration date and that means that the certification must be updated in order to keep being valid or to provide a more secure way of authenticating the identity of the organization/user. This depends on the certificate itself and the company that validates the corresponding certificate.

BR, VaneB

Re: S32K3 certificate storage

JiayuZhou — Wed, 21 Aug 2024 01:26:02 GMT

thanks for your reply. Besides, I want to know whether HSE can parse certificates. And I understand that only the key of certificate and the pointer of certificate stored in HSE, the whole of certificate is not stored in HSE, right? Whether HSE can verify the validity of the certificate?

Re: S32K3 certificate storage

VaneB — Wed, 21 Aug 2024 20:06:30 GMT

Hi @JiayuZhou

CertificateParse and CertificateVerify functionalities are not currently implemented, so there is no support. Unfortunately, there is no timeline or plan to include direct support.

The whole of certificate is not stored in HSE, right? Yes, only the keys are stored.