RAM catalogs issues

[kerti1]

Hi,

I am working on the implementation of ECDH. I took the DemoExamples which includes Demoapp_SessionKeys as reference. The example include RAM Key catalog as shown below.

const hseKeyGroupCfgEntry_t RAM_Catalog [] =
{
/* keyType numOfKeySlots maxKeyBitLen*/ \
/* Symetric key */ \
{HSE_ALL_MU_MASK, HSE_KEY_OWNER_ANY, HSE_KEY_TYPE_SHE, 1U, HSE_KEY128_BITS}, /* KEY_RAM */ \
{HSE_ALL_MU_MASK, HSE_KEY_OWNER_ANY, HSE_KEY_TYPE_AES, 10U, HSE_KEY128_BITS}, \
{HSE_MU0_MASK, HSE_KEY_OWNER_ANY, HSE_KEY_TYPE_AES, 10U, HSE_KEY256_BITS}, /* HMAC key */ \
{HSE_ALL_MU_MASK, HSE_KEY_OWNER_ANY, HSE_KEY_TYPE_HMAC, 6U, HSE_KEY1024_BITS}, /* RSA key */ \
{HSE_ALL_MU_MASK, HSE_KEY_OWNER_ANY, HSE_KEY_TYPE_RSA_PUB, 2U, HSE_KEY2048_BITS}, \
{HSE_ALL_MU_MASK, HSE_KEY_OWNER_ANY, HSE_KEY_TYPE_RSA_PUB_EXT, 1U, HSE_KEY1024_BITS}, \
{HSE_ALL_MU_MASK, HSE_KEY_OWNER_ANY, WRP_KEY_TYPE_ECC_PAIR, 2U, WRP_ECC_KEY_SIZE}, \
{HSE_ALL_MU_MASK, HSE_KEY_OWNER_ANY, WRP_KEY_TYPE_ECC_PUB, 5U, WRP_ECC_KEY_SIZE}, \
{HSE_ALL_MU_MASK, HSE_KEY_OWNER_ANY, HSE_KEY_TYPE_SHARED_SECRET, 2U, HSE_KEY638_BITS}, \
{HSE_ALL_MU_MASK, HSE_KEY_OWNER_ANY, HSE_KEY_TYPE_SHARED_SECRET, 1U, HSE_KEY2048_BITS}, \
{ \
0U, 0U, 0U, 0U, 0U \
}
};

I'm using operations like AES, HMAC, and ECC, but not all key types. So I removed RSA, HMAC, and KEY_TYPE_SHE entries from the key catalog, thinking they were unnecessary. After that, I was still able to generate ECC key pairs (ECC_PAIR) without any problem. However, when I tried to import an ECC public key (ECC_PUB), I got an INVALID_PARAMS error. But when I used the original full key catalog (including all entries like RSA, HMAC, etc.), it worked fine.

This made me confused about what the key catalog really does. I don’t fully understand why removing unused entries causes errors. I always get INVALID_PARAMS errors when modifying the catalog, and I would like to understand why this happens and what the key catalog is actually for.

[lukaszadrapa · Accepted solution]

Hi @kerti1 

This is thoroughly explained in HSE-B Firmware Reference Manual v2.4. Take a look at following sections:

6.1.5 Key catalog

6.1.6 Key handle

In short - if you want to work with keys (import, export, use them...) the key catalogs must be formatted. This tells to HSE how many keys will be used, which size, which types...

And now the key point - you can select a key for an operation by "key handle". This is 32bit word which specifies catalog, group and key:

lukaszadrapa_0-1747834282316.png

So, the key handle points to exact single key in a catalog.

If you deleted some groups, the key handle for ECC_PUB key must be changed accordingly. For example, in the original catalog you shared, the key group index of ECC_PUB is 7. If you deleted two groups above ECC_PUB, the index is changed to 5 -> you need to update this in your code.

Regards,

Lukas

[kerti1]

Thanks for the response. I understood that group index needs to be changed according to the definition of RAM catalogs. But why in the example of Diffie Helman they are using Derive Key, But before that there are trying to import using key container. May i Know why these key containers are needed.