topic Re: OpenSSL 3 and black key? in i.MX Processors

OpenSSL 3 and black key?

Christian-R — Fri, 24 Oct 2025 07:41:46 GMT

Hi,

We are interested in being able to use CAAM to support OpenSSL with black keys for signing operations.

OpenSSL 3 recommends using a new interface called "Provider".

It appears there's no ready CAAM "Provider" implementation without using something like OP-TEE. Could someone confirm or deny this?

If there's no ready implementation, any suggestions, is there any official support integrating black key sign/verify operations to mbedTLS, OpenSSH, OpenGPG, etc..?

Thanks,
Christian

Re: OpenSSL 3 and black key?

Harvey021 — Mon, 27 Oct 2025 07:58:20 GMT

Hi,

Hope that the section <10.4.8 OpenSSL TLS offload to OP-TEE PKCS#11 via pkcs11-provider> of UG10163.pdf be helpful.

Regards

Harvey

Re: OpenSSL 3 and black key?

Christian-R — Mon, 27 Oct 2025 22:00:05 GMT

If possible we'd like to _not_ have to use OPTEE.
Do you know if that's possible?

Regard,
Christian

Re: OpenSSL 3 and black key?

Harvey021 — Thu, 30 Oct 2025 02:55:47 GMT

Have also checked with internal security team, no positive answer without OPTEE.

Regards

Harvey