How to use SecureElement SE05x: Using SE050 via OpenSSL (Japanese blog) In the previous article, we described the procedure for setting up the "Plug and Trust Middleware" library for SE05x (Secure Element) on a Raspberry Pi and FRDM-IMX93 (development board for i.MX 93) .
How to use Secure Element SE05x: Setting up Plug and Trust Middleware on Raspberry Pi (Japanese blog)
How to use Secure Element SE05x: Setting up Plug and Trust Middleware on the FRDM-IMX93 development board (Japanese blog)
By using Secure Element and "*Plug and Trust Middleware," you can apply protection features to all applications that perform authentication using OpenSSL (e.g., Eclipse Mosquitto ™ , etc.) without modifying the application itself .
This article explains practical ways to use SE05x in conjunction with OpenSSL.
(Estimated time: 10 minutes *Assuming Plug and Trust Middleware is already set up)
*Plug and Trust Middleware also includes integration with OpenSSL, which is widely used on Linux.
Hardware, software, and versions used in writing this article
Hardware:
Raspberry Pi 3 Model B+
EdgeLock ® SE050 Development Kit ( OM-SE050ARD-E )
Five jumper wires (male-to-female or female-to-female) or an Arduino to Raspberry Pi adapter board ( OM-SE050RPI )
software:
Raspberry Pi OS 12 64-bit
SE-PLUG-TRUST-MW_04.07.01 *After unzipping, you can access the documentation from simw-top/doc/index.html (hereafter, "documentation" refers to this HTML file).
The OpenSSL provider within the middleware is also available on GitHub, where you can find command examples and other information. https://github.com/NXPPlugNTrust/se05x-openssl-provider
Summary of this article
OpenSSL has an interface called `provider` (or `engine` in earlier versions) since version 3.0, which allows you to replace parts of OpenSSL's operation with customized code.
Plug and Trust Middleware provides a provider/engine to replace the cryptographic processing performed by OpenSSL with cryptographic processing using SE05x.
The corresponding process is described in section "8.2" of the documentation. Please refer to "Introduction on OpenSSL provider".
If a provider is not used (see the diagram on the left below) , the key, including the private key, is placed on the file system, and OpenSSL reads it and performs the processing.
(*Since the key is stored on the file system, there is a high risk of key leakage.)
When using a Provider (see the diagram on the right below) , it will look like this:
OpenSSL instructs the Plug and Trust Middleware Provider to perform cryptographic processing.
The Provider reads the Key file, and upon recognizing that it is in the format of a reference key, it retrieves the Key ID from the reference key and instructs the SE05x to perform encryption using the Key with that ID.
(If a regular key file that is not a reference key is recognized, the process returns to the left.)
In this article,
Creating a reference key to use the key pair pre-installed on the SE05x at the time of shipment.
Enabling the OpenSSL Provider
Example of the steps for signing and verifying using these methods.
I will explain this.
Retrieving the object list within SE05x
Similar to the Plug and Trust Middleware setup, we will enable venv and perform operations in an independent Python environment (virtual environment).
Enable venv from the Plug and Trust Middleware deployment directory using the following command.
cd simw-top/pycli/
source venv/bin/activate
The following command will display a list of objects within SE05x.
ssscli connect se05x t1oi2c none
ssscli se05x readidlist
ssscli disconnect
The execution result will be as follows:
(venv) shinji@raspberrypi:~/SE-PLUG-TRUST-MW_04.07.01/simw-top/pycli $ ssscli connect se05x t1oi2c none
(venv) shinji@raspberrypi:~/SE-PLUG-TRUST-MW_04.07.01/simw-top/pycli $ ssscli se05x readidlist
sss :INFO :atr (Len=35)
01 A0 00 00 03 96 04 03 E8 00 FE 02 0B 03 E8 00
01 00 00 00 00 64 13 88 0A 00 65 53 45 30 35 31
00 00 00
sss :WARN :Communication channel is Plain.
sss :WARN :!!!Not recommended for production use.!!!
Key-Id: 0X7fff0201 NIST-P (Key Pair) Size(Bits): 256
Key-Id: 0X7fff0202 NIST-P (Key Pair) Size(Bits): 256
Key-Id: 0X7fff0204 NIST-P (Public Key) Size(Bits): 256
Key-Id: 0X7fff0206 BINARY Size(Bits): 144
Key-Id: 0x7fff020b HMAC Size(Bits): No Info available
Key-Id: 0Xf0000000 NIST-P (Key Pair) Size(Bits): 256
Key-Id: 0Xf0000001 BINARY Size(Bits): 3760
Key-Id: 0Xf0000002 NIST-P (Key Pair) Size(Bits): 256
Key-Id: 0Xf0000003 BINARY Size(Bits): 3760
Key-Id: 0Xf0000012 NIST-P (Key Pair) Size(Bits): 256
Key-Id: 0Xf0000013 BINARY Size(Bits): 3736
Key-Id: 0Xf0000020 NIST-P (Public Key) Size(Bits): 256
Key-Id: 0Xf0000100 NIST-P (Key Pair) Size(Bits): 256
Key-Id: 0Xf0000101 BINARY Size(Bits): 4392
Key-Id: 0Xf0000102 NIST-P (Key Pair) Size(Bits): 256
Key-Id: 0Xf0000103 BINARY Size(Bits): 4392
Key-Id: 0Xf0003394 AES Size(Bits): 256
(venv) shinji@raspberrypi:~/SE-PLUG-TRUST-MW_04.07.01/simw-top/pycli $ ssscli disconnect
SE05x factory-programmed user identification information (keypair, certificate)
Details of the displayed list of objects can be found in AN12436: SE050 configurations .
The following are key pairs and their certificates that do not have a designated purpose and can be used freely by users.
Key-Id: 0Xf0000100 NIST-P (Key Pair) Size(Bits): 256
Key-Id: 0Xf0000101 BINARY Size(Bits): 4392
Key-Id: 0Xf0000102 NIST-P (Key Pair) Size(Bits): 256
Key-Id: 0Xf0000103 BINARY Size(Bits): 4392
0Xf0000101 and 0Xf0000103 are certificates corresponding to the key pairs 0Xf0000100 and 0Xf0000102, respectively.
Let's try using the key pair 0Xf0000100.
OpenSSL treats key pairs as files, but there's no point in protecting the private key with SE050 if you're going to extract and use the private key.
Therefore, it is obtained in a format that does not include the private key, called a reference key, which will be described later.
The following commands will create a directory for storing keys and retrieve the keys.
mkdir se050_keys
cd se050_keys/
ssscli connect se05x t1oi2c none
ssscli refpem ecc pair 0xf0000100 reference_key_0xf0000100.pem
ssscli get ecc pub 0xf0000100 public_key_0xf0000100.pem
ssscli disconnect
For comparison purposes, we will also generate a key pair and public key without using the SE050 as described below.
Please execute the following command.
openssl ecparam -genkey -name prime256v1 -out keypair.pem
openssl ec -in keypair.pem -outform PEM -pubout -out public_key.pem
About the Reference Key
Let's display the contents of the reference key and public key obtained using the following command.
openssl ec -text -noout -in reference_key_0xf0000100.pem
openssl ec -text -noout -pubin -in public_key_0xf0000100.pem
The execution result will be as follows:
(venv) shinji@raspberrypi:~/SE-PLUG-TRUST-MW_04.07.01/simw-top/pycli/se050_keys $ openssl ec -text -noout -in reference_key_0xf0000100.pem
read EC key
Private-Key: (256 bit)
priv:
10:00:00:00:00:00:00:00:00:00:00:00:00:00:00:
00:00:00:f0:00:01:00:a5:a6:b5:b6:a5:a6:b5:b6:
10:00
pub:
04:e7:e0:f5:77:d7:b7:6f:0c:e6:93:7c:61:bf:85:
5e:80:37:76:9a:01:e3:e4:18:60:67:7a:3f:ab:bd:
9b:b6:53:64:4d:40:9b:07:c6:18:c9:5a:74:b9:c7:
c8:d4:ae:2e:49:ae:68:63:de:64:77:6d:1e:1c:94:
4b:bb:70:10:0b
ASN1 OID: prime256v1
NIST CURVE: P-256
(venv) shinji@raspberrypi:~/SE-PLUG-TRUST-MW_04.07.01/simw-top/pycli/se050_keys $ openssl ec -text -noout -pubin -in public_key_0xf0000100.pem
read EC key
Public-Key: (256 bit)
pub:
04:e7:e0:f5:77:d7:b7:6f:0c:e6:93:7c:61:bf:85:
5e:80:37:76:9a:01:e3:e4:18:60:67:7a:3f:ab:bd:
9b:b6:53:64:4d:40:9b:07:c6:18:c9:5a:74:b9:c7:
c8:d4:ae:2e:49:ae:68:63:de:64:77:6d:1e:1c:94:
4b:bb:70:10:0b
ASN1 OID: prime256v1
NIST CURVE: P-256
As can be seen above, the `pub` field of the reference key contains the same public key as the public key file, but the private key portion starting with `priv` contains a series of zeros, indicating that it does not actually contain the private key.
The `priv` field in the Reference key does not contain the private key itself, but rather indicates where the private key is stored within SE050. In this case, it indicates that it is stored at 0xf0000100.
For formatting information, see document "8.1.2.2". It is described in "EC Reference key format".
Enabling the OpenSSL Provider
There are several ways to use the OpenSSL Provider, but here we will enable it by reading a config file.
The config file is located in simw-top/demos/linux/common/ and there are several versions of it.
openssl11_sss_se050.cnf ----- OpenSSL 1.1.1 and SE050
openssl_sss_se050.cnf ----- OpenSSL 1.0.0 and SE050
openssl30_sss_se050.cnf ----- OpenSSL 3.x and SE050
You can check the OpenSSL version with the following command.
openssl version
If you're using a Raspberry Pi, it should be version 3.0.
Apply the configuration using the following command. Replace with the middleware deployment location.
export OPENSSL_CONF= /simw-top/demos/linux/common/openssl30_sss_se050.cnf
Signature generation and verification using SE050 + OpenSSL provider
Use the following command:
Use the reference key to generate a signature using the private key with ID:0xf0000100 within SE05x.
Signature verification using the reference key and the public key with ID:0xf0000100 within SE05x.
Signature verification using a client key
We will do this.
openssl pkeyutl -sign -inkey reference_key_0xf0000100.pem -rawin -in public_key_0xf0000100.pem -out signature_with_provider.txt -digest sha256
openssl pkeyutl -verify -inkey reference_key_0xf0000100.pem -rawin -in public_key_0xf0000100.pem -sigfile signature_with_provider.txt -digest sha256
openssl pkeyutl -verify -pubin -inkey public_key_0xf0000100.pem -rawin -in public_key_0xf0000100.pem -sigfile signature_with_provider.txt -digest sha256
The execution result will be as follows:
(venv) shinji@raspberrypi:~/SE-PLUG-TRUST-MW_04.07.01/simw-top/pycli/se050_keys $ openssl pkeyutl -sign -inkey reference_key_0xf0000100.pem -rawin -in public_key_0xf0000100.pem -out signature_with_provider.txt -digest sha256
App :INFO :If you want to over-ride the selection, use ENV=EX_SSS_BOOT_SSS_PORT or pass in command line arguments.
sss :INFO :atr (Len=35)
01 A0 00 00 03 96 04 03 E8 00 FE 02 0B 03 E8 00
01 00 00 00 00 64 13 88 0A 00 65 53 45 30 35 31
00 00 00
sss :WARN :Communication channel is Plain.
sss :WARN :!!!Not recommended for production use.!!!
sssprov-flw: Performing ECDSA sign using SE05x
(venv) shinji@raspberrypi:~/SE-PLUG-TRUST-MW_04.07.01/simw-top/pycli/se050_keys $ openssl pkeyutl -verify -inkey reference_key_0xf0000100.pem -rawin -in public_key_0xf0000100.pem -sigfile signature_with_provider.txt -digest sha256
App :INFO :If you want to over-ride the selection, use ENV=EX_SSS_BOOT_SSS_PORT or pass in command line arguments.
sss :INFO :atr (Len=35)
01 A0 00 00 03 96 04 03 E8 00 FE 02 0B 03 E8 00
01 00 00 00 00 64 13 88 0A 00 65 53 45 30 35 31
00 00 00
sss :WARN :Communication channel is Plain.
sss :WARN :!!!Not recommended for production use.!!!
sssprov-flw: Performing ECDSA verify using SE05x
Signature Verified Successfully
(venv) shinji@raspberrypi:~/SE-PLUG-TRUST-MW_04.07.01/simw-top/pycli/se050_keys $ openssl pkeyutl -verify -pubin -inkey public_key_0xf0000100.pem -rawin -in public_key_0xf0000100.pem -sigfile signature_with_provider.txt -digest sha256
App :INFO :If you want to over-ride the selection, use ENV=EX_SSS_BOOT_SSS_PORT or pass in command line arguments.
sss :INFO :atr (Len=35)
01 A0 00 00 03 96 04 03 E8 00 FE 02 0B 03 E8 00
01 00 00 00 00 64 13 88 0A 00 65 53 45 30 35 31
00 00 00
sss :WARN :Communication channel is Plain.
sss :WARN :!!!Not recommended for production use.!!!
sssprov-flw: Not a key in secure element. Performing ECDSA verify operation using host software
Signature Verified Successfully
Since the OpenSSL provider is enabled, messages related to the OpenSSL provider will be displayed.
The following display shows that SE05x is actually using the object specified by the reference key to generate and verify the signature. If it is not displayed, please check the OPENSSL_CONF settings.
sssprov-flw: Performing ECDSA sign using SE05x
sssprov-flw: Performing ECDSA verify using SE05x
When verifying a signature using a file containing only the public key, the following message is displayed, indicating that SE050 is not being used.
sssprov-flw: Not a key in secure element. Performing ECDSA verify operation using host software
For comparison, we will perform the same operation using a key pair and public key generated outside of the SE050.
openssl pkeyutl -sign -inkey keypair.pem -rawin -in public_key.pem -out signature.txt -digest sha256
openssl pkeyutl -verify -inkey keypair.pem -rawin -in public_key.pem -sigfile signature.txt -digest sha256
openssl pkeyutl -verify -pubin -inkey public_key.pem -rawin -in public_key.pem -sigfile signature.txt -digest sha256
The execution result will be as follows:
(venv) shinji@raspberrypi:~/SE-PLUG-TRUST-MW_04.07.01/simw-top/pycli/se050_keys $ openssl pkeyutl -sign -inkey keypair.pem -rawin -in public_key.pem -out signature.txt -digest sha256
App :INFO :If you want to over-ride the selection, use ENV=EX_SSS_BOOT_SSS_PORT or pass in command line arguments.
sss :INFO :atr (Len=35)
01 A0 00 00 03 96 04 03 E8 00 FE 02 0B 03 E8 00
01 00 00 00 00 64 13 88 0A 00 65 53 45 30 35 31
00 00 00
sss :WARN :Communication channel is Plain.
sss :WARN :!!!Not recommended for production use.!!!
sssprov-flw: Not a ref key
sssprov-flw: Not a key in secure element. Performing ECDSA sign operation using host software
sssprov-flw: Get random data from SE05x
(venv) shinji@raspberrypi:~/SE-PLUG-TRUST-MW_04.07.01/simw-top/pycli/se050_keys $ openssl pkeyutl -verify -inkey keypair.pem -rawin -in public_key.pem -sigfile signature.txt -digest sha256
App :INFO :If you want to over-ride the selection, use ENV=EX_SSS_BOOT_SSS_PORT or pass in command line arguments.
sss :INFO :atr (Len=35)
01 A0 00 00 03 96 04 03 E8 00 FE 02 0B 03 E8 00
01 00 00 00 00 64 13 88 0A 00 65 53 45 30 35 31
00 00 00
sss :WARN :Communication channel is Plain.
sss :WARN :!!!Not recommended for production use.!!!
sssprov-flw: Not a ref key
sssprov-flw: Not a key in secure element. Performing ECDSA verify operation using host software
Signature Verified Successfully
(venv) shinji@raspberrypi:~/SE-PLUG-TRUST-MW_04.07.01/simw-top/pycli/se050_keys $ openssl pkeyutl -verify -pubin -inkey public_key.pem -rawin -in public_key.pem -sigfile signature.txt -digest sha256
App :INFO :If you want to over-ride the selection, use ENV=EX_SSS_BOOT_SSS_PORT or pass in command line arguments.
sss :INFO :atr (Len=35)
01 A0 00 00 03 96 04 03 E8 00 FE 02 0B 03 E8 00
01 00 00 00 00 64 13 88 0A 00 65 53 45 30 35 31
00 00 00
sss :WARN :Communication channel is Plain.
sss :WARN :!!!Not recommended for production use.!!!
sssprov-flw: Not a key in secure element. Performing ECDSA verify operation using host software
Signature Verified Successfully
When a key pair is specified, the following is displayed, indicating that signature generation is performed using the private key in the key pair file, not SE050.
sssprov-flw: Not a ref key
However, since the OpenSSL Provider provides a random number generation function, the following is displayed during signature generation, and random numbers are generated using SE050.
sssprov-flw: Get random data from SE05x
For comparison, the following is the result of using a reference key with the OpenSSL provider disabled.
(venv) shinji@raspberrypi:~/SE-PLUG-TRUST-MW_04.07.01/simw-top/pycli/se050_keys $ export OPENSSL_CONF=
(venv) shinji@raspberrypi:~/SE-PLUG-TRUST-MW_04.07.01/simw-top/pycli/se050_keys $ openssl pkeyutl -sign -inkey reference_key_0xf0000100.pem -rawin -in public_key_0xf0000100.pem -out signature_without_provider.txt -digest sha256
(venv) shinji@raspberrypi:~/SE-PLUG-TRUST-MW_04.07.01/simw-top/pycli/se050_keys $ openssl pkeyutl -verify -inkey reference_key_0xf0000100.pem -rawin -in public_key_0xf0000100.pem -sigfile signature_without_provider.txt -digest sha256
Signature Verification Failure
The priv portion of the reference key is interpreted as the private key, and the signature is generated accordingly.
The signature generation is successful, but the signature verification will naturally fail because the private key being used does not correspond to the public key.
In this case, we applied SE050 protection to a process that uses OpenSSL commands.
An example of applying SE050 protection to an application using the OpenSSL library is described in the following article.
Connecting to Azure IoT Hub using the Eclipse Mosquitto client
=========================
We are currently unable to respond to comments left in the " Comment " section of this post . We apologize for the inconvenience, but please refer to " Technical Questions to NXP - How to Contact Us( Japanese Blog) " when making inquiries.(If you are already an NXP distributor or have a relationship with NXP, you may ask your representative directly.) In the previous article, we described the procedure for setting up the "Plug and Trust Middleware" library for SE05x (Secure Element) on a Raspberry Pi and FRDM-IMX93 (development board for i.MX 93) .
How to use Secure Element SE05x: Setting up Plug and Trust Middleware on Raspberry Pi (Japanese blog)
How to use Secure Element SE05x: Setting up Plug and Trust Middleware on the FRDM-IMX93 development board (Japanese blog)
By using Secure Element and "*Plug and Trust Middleware," you can apply protection features to all applications that perform authentication using OpenSSL (e.g., Eclipse Mosquitto ™ , etc.) without modifying the application itself .
This article explains practical ways to use SE05x in conjunction with OpenSSL.
(Estimated time: 10 minutes *Assuming Plug and Trust Middleware is already set up)
*Plug and Trust Middleware also includes integration with OpenSSL, which is widely used on Linux. Security Technology Focus Japanese Blog
View full article
