Key Management Example

[kerti1]

Hi,

I am using the HSE for s32K and able to perform AES-128 encryption and SHA hashing successfully. Currently, I am storing the keys in RAM, which is only for testing purposes. I would now like to implement proper key management. Specifically, I want to know whether the HSE can automatically generate keys, or if we are required to hard-code them as global variables—similar to how we use RAM keys  and call the M1, M2, and M3 for storing in ECU.I have searched for examples using the HSE_IP layer (Non-AUTOSAR), but could not find any clear examples or documentation related to key management. Could you please provide a clear and understandable example for key management using the HSE_IP layer? That would be very helpful.

---

Thank you

[ASN7]

Can the NVM Key update (2) demo, be used to store custom keys (not generated) so that it can be accessed after writing only once to a particular key slot ? 

Because right now, I import the keys to NVM and calculate CMAC and it works fine. And then I comment out the import function in the same project and select the key handle and ask HSE to calculate CMAC and it throws me an error saying key slot is empty. 

[Julián_AragónM · Accepted solution]

Hi @kerti1,

From the S32K3 product page, you can download the HSE Demo Examples, which contains various projects. 

Inside the SW package, you can find the Key Management demos, which include Session Keys (1) and NVM Key update (2). 

I can share the main objective from each example:

(1) The main purpose of this example is to show the steps required to properly configure the HSE to show the functionality of the session key services. It formats the keys and then generates the ECC key pair. Then import the ECC keys, compute the DH Shared Secret and derive key using SP800_108 KDF. Finally, it extracts from the derived key material 2 keys, a 192-bits AES and a 256-bit AES, and then encrypts and decrypt using AES GCM using both keys.

(2) The main purpose of this example is to an import symmetric key and AES GMAC generate keys.

Best regards,
Julián