topic Re: S32K3 HSE: Export EDDSA Public Key in S32K

S32K3 HSE: Export EDDSA Public Key

MHan — Mon, 20 Oct 2025 22:28:51 GMT

I am able to generate an ED25519 key pair with the Key Generation Service, and I would like to be able to export the public key later with the Key Export Service. However, the HSE returns a HSE_SRV_RSP_NOT_ALLOWED when I attempt to export the public key.

When I generate the key I use the following parameters:
Service ID: HSE_SRV_ID_KEY_GENERATE

targetKeyHandle = key_handle;

keyInfo:
keyFlags = HSE_KF_USAGE_SIGN | HSE_KF_USAGE_VERIFY | HSE_KF_ACCESS_EXPORTABLE
keyBitLen = HSE_KEY256_BITS
keyCounter = 0
smrFlags = 0
keyType = HSE_KEY_TYPE_ECC_PAIR
specific.eccCurveId = HSE_EC_25519_ED25519

keyGenScheme = HSE_KEY_GEN_ECC_KEY_PAIR

sch.eccKey.pPubKey = (HOST_ADDR)pub_key_output_ptr;

And when I export the key:

Service ID: HSE_SRV_ID_EXPORT_KEY

targetKeyHandle = key_handle; // Same Key Handle

keyInfo:
keyFlags = HSE_KF_USAGE_VERIFY | HSE_KF_ACCESS_EXPORTABLE
keyBitLen = HSE_KEY256_BITS
keyCounter = 0
smrFlags = 0
keyType = HSE_KEY_TYPE_ECC_PAIR
specific.eccCurveId = HSE_EC_25519_ED25519

pKey[0] = (HOST_ADDR)pub_key_output_ptr;
pKeyLen[0] = (HOST_ADDR)&g_identity_key_len;

Are there any parameter's that are missing or configured incorrectly?

Re: S32K3 HSE: Export EDDSA Public Key

lukaszadrapa — Tue, 21 Oct 2025 10:56:35 GMT

Hi @MHan

I can see nothing wrong in those parameters. Because the public ECC key is exported in plain and not authenticated, did you configured cipherKeyHandle and authKeyHandle as HSE_INVALID_KEY_HANDLE (0xFFFFFFFF)? Setting of HSE_INVALID_KEY_HANDLE to these key handles ensures that authentication and encryption parameters are ignored.
Also try to disable data cache to confirm it is not cache issue.

Regards,
Lukas

Re: S32K3 HSE: Export EDDSA Public Key

MHan — Thu, 23 Oct 2025 23:25:46 GMT

Thank you Lukas, I was missing setting the HSE_INVALID_KEY_HANDLE's.

I see now in the header files: Must be set to #HSE_INVALID_KEY_HANDLE if not used.