topic Re: POLICY_OBJ_ALLOW_DELETE and Reset in Secure Authentication

POLICY_OBJ_ALLOW_DELETE and Reset

psvz — Wed, 28 Dec 2022 16:08:06 GMT

If I attached POLICY_OBJ_ALLOW_DELETE = False to a key object - would it help to preserve it over ssscli se05x reset?

Re: POLICY_OBJ_ALLOW_DELETE and Reset

Kan_Li — Thu, 29 Dec 2022 02:04:36 GMT

Hi @psvz ,

Yes, you can do that, and usually we set up POLICY_OBJ_ALLOW_DELETE = True for some Auth ID to a key object so that you may still perform the deletion in some cases.

Hope that makes sense,

Have a great day,
Kan

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------

Re: POLICY_OBJ_ALLOW_DELETE and Reset

psvz — Thu, 29 Dec 2022 15:14:37 GMT

Hi Kan

I am trying to achieve the opposite effect. I want a key that I have provisioned to stay in secure element forever and couldn't be deleted - same way as NXP keys and certificates. Is it possible?

Re: POLICY_OBJ_ALLOW_DELETE and Reset

Kan_Li — Tue, 03 Jan 2023 07:12:18 GMT

Hi @psvz ,

No , I don't think it is possible, you know, the DeleteAll command may delete all secure objects which are not trust provisioned by NXP.

Have a great day,
Kan

Re: POLICY_OBJ_ALLOW_DELETE and Reset

psvz — Wed, 04 Jan 2023 18:57:23 GMT

Se05x_API_DeleteAll() fails if I open session with kSSS_AuthType_None. Do you know if session with kSSS_AuthType_SCP03 would work? any working demo using Se05x_API_DeleteAll()?

Re: POLICY_OBJ_ALLOW_DELETE and Reset

Kan_Li — Thu, 05 Jan 2023 02:01:03 GMT

Hi @psvz ,

Actually this command can only be used in the session authenticated using the
credential with index RESERVED_ID_FACTORY_RESET, and this Auth ID might be not available in your device, but you may provision it with the help of ssscli tool.

Please kindly refer to https://www.nxp.com/webapp/Download?colCode=AN12543 for more details.

Have a great day,
Kan