Thank you for the response.
I’ve reviewed Chapter 26 of the BSP43 UM, and I understand that OP-TEE TAs can communicate with HSE directly using supported APIs.
To clarify my current use case:
I need to generate and store keys inside the HSE key catalog.
From within an OP-TEE Trusted Application, I need to reference those keys using HSE key handles.
Then, I need to perform encryption/decryption operations using those key handles via the HSE Crypto Engine.
Given that, I’d like to clarify the following:
Do the standard OP-TEE crypto APIs (e.g., TEE_AEEncryptFinal, TEE_AllocateTransientObject, etc.) automatically route cryptographic operations to the HSE engine?
If not, is it required to manually construct HSE service descriptors (e.g., HSE_SRV_ID_IMPORT_KEY, HSE_SRV_ID_SYM_CIPHER) and invoke the corresponding APIs from inside the TA?
Is there a reference or documented method in BSP43 that shows how a TA can build and submit HSE service descriptors?
Specifically, how can a TA access and use key handles for encryption/decryption via HSE? Are there APIs or interface layers exposed for this purpose?
Are there particular headers or secure-side libraries I should include in the TA to enable direct use of HSE service APIs?
Any guidance or examples related to this HSE + OP-TEE integration, especially involving key handle usage inside the TEE, would be greatly appreciated.
Best regards,
Yashas
