diff --git a/configs/config-psa-crypto.h b/configs/config-psa-crypto.h
index 27e9ef1d6..c9a8ebd62 100644
--- a/configs/config-psa-crypto.h
+++ b/configs/config-psa-crypto.h
@@ -710,6 +710,16 @@
*/
//#define MBEDTLS_PSA_CRYPTO_SPM
+/**
+ * \def MBEDTLS_PSA_HAS_ITS_IO
+ *
+ * Enable the non-volatile secure storage usage.
+ *
+ * This is crucial on systems that do not have a HW TRNG support.
+ *
+ */
+//#define MBEDTLS_PSA_HAS_ITS_IO
+
/**
* \def MBEDTLS_RSA_NO_CRT
*
@@ -1529,7 +1539,9 @@
*
* Module: library/psa_crypto_storage.c
*
- * Requires: MBEDTLS_PSA_CRYPTO_C, MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C
+ * Requires: MBEDTLS_PSA_CRYPTO_C and one of either
+ * MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C or MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C
+ * (but not both)
*
*/
#define MBEDTLS_PSA_CRYPTO_STORAGE_C
@@ -1547,6 +1559,19 @@
*/
#define MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C
+/**
+ * \def MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C
+ *
+ * Enable persistent key storage over PSA ITS for the
+ * Platform Security Architecture cryptography API.
+ *
+ * Module: library/psa_crypto_storage_its.c
+ *
+ * Requires: MBEDTLS_PSA_CRYPTO_C, MBEDTLS_PSA_HAS_ITS_IO
+ *
+ */
+//#define MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C
+
/**
* \def MBEDTLS_RIPEMD160_C
*
diff --git a/include/mbedtls/check_config.h b/include/mbedtls/check_config.h
index f78e61bf1..21bede707 100644
--- a/include/mbedtls/check_config.h
+++ b/include/mbedtls/check_config.h
@@ -506,9 +506,14 @@
#error "MBEDTLS_PSA_CRYPTO_SPM defined, but not all prerequisites"
#endif
+#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C) && defined(MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C)
+#error "Only one of MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C or MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C can be defined"
+#endif
+
#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_C) && \
- !( defined(MBEDTLS_PSA_CRYPTO_C) && \
- defined(MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C) )
+ !( defined(MBEDTLS_PSA_CRYPTO_C) && \
+ ( defined(MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C) || \
+ defined(MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C) ) )
#error "MBEDTLS_PSA_CRYPTO_STORAGE_C defined, but not all prerequisites"
#endif
@@ -518,6 +523,11 @@
#error "MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C defined, but not all prerequisites"
#endif
+#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C) && \
+ ! defined(MBEDTLS_PSA_CRYPTO_STORAGE_C)
+#error "MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C defined, but not all prerequisites"
+#endif
+
#if defined(MBEDTLS_RSA_C) && ( !defined(MBEDTLS_BIGNUM_C) || \
!defined(MBEDTLS_OID_C) )
#error "MBEDTLS_RSA_C defined, but not all prerequisites"
diff --git a/include/mbedtls/config.h b/include/mbedtls/config.h
index 2190ac519..c47c4714a 100644
--- a/include/mbedtls/config.h
+++ b/include/mbedtls/config.h
@@ -1173,6 +1173,16 @@
*/
//#define MBEDTLS_PSA_CRYPTO_SPM
+/**
+ * \def MBEDTLS_PSA_HAS_ITS_IO
+ *
+ * Enable the non-volatile secure storage usage.
+ *
+ * This is crucial on systems that do not have a HW TRNG support.
+ *
+ */
+//#define MBEDTLS_PSA_HAS_ITS_IO
+
/**
* \def MBEDTLS_RSA_NO_CRT
*
@@ -2623,7 +2633,9 @@
*
* Module: library/psa_crypto_storage.c
*
- * Requires: MBEDTLS_PSA_CRYPTO_C, MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C
+ * Requires: MBEDTLS_PSA_CRYPTO_C and one of either
+ * MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C or MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C
+ * (but not both)
*
*/
#define MBEDTLS_PSA_CRYPTO_STORAGE_C
@@ -2641,6 +2653,19 @@
*/
#define MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C
+/**
+ * \def MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C
+ *
+ * Enable persistent key storage over PSA ITS for the
+ * Platform Security Architecture cryptography API.
+ *
+ * Module: library/psa_crypto_storage_its.c
+ *
+ * Requires: MBEDTLS_PSA_CRYPTO_C, MBEDTLS_PSA_HAS_ITS_IO
+ *
+ */
+//#define MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C
+
/**
* \def MBEDTLS_RIPEMD160_C
*
diff --git a/library/CMakeLists.txt b/library/CMakeLists.txt
index 433fab11c..c8070bb27 100644
--- a/library/CMakeLists.txt
+++ b/library/CMakeLists.txt
@@ -56,6 +56,7 @@ set(src_crypto
psa_crypto.c
psa_crypto_storage.c
psa_crypto_storage_file.c
+ psa_crypto_storage_its.c
ripemd160.c
rsa.c
rsa_internal.c
diff --git a/library/Makefile b/library/Makefile
index 5814ae8a1..95faaaef3 100644
--- a/library/Makefile
+++ b/library/Makefile
@@ -85,6 +85,7 @@ OBJS_CRYPTO= aes.o aesni.o arc4.o \
psa_crypto.o \
psa_crypto_storage.o \
psa_crypto_storage_file.o \
+ psa_crypto_storage_its.o \
ripemd160.o rsa_internal.o rsa.o \
sha1.o sha256.o sha512.o \
threading.o timing.o version.o \
diff --git a/library/psa_crypto_storage_its.c b/library/psa_crypto_storage_its.c
new file mode 100644
index 000000000..29394b5d8
--- /dev/null
+++ b/library/psa_crypto_storage_its.c
@@ -0,0 +1,184 @@
+/*
+ * PSA storage backend for persistent keys using psa_its APIs.
+ */
+/* Copyright (C) 2018, ARM Limited, All Rights Reserved
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License"); you may
+ * not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+ * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * This file is part of mbed TLS (https://tls.mbed.org)
+ */
+
+#if defined(MBEDTLS_CONFIG_FILE)
+#include MBEDTLS_CONFIG_FILE
+#else
+#include "mbedtls/config.h"
+#endif
+
+#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C)
+
+#include "psa/crypto.h"
+#include "psa_crypto_storage_backend.h"
+#include "psa_prot_internal_storage.h"
+
+#if defined(MBEDTLS_PLATFORM_C)
+#include "mbedtls/platform.h"
+#endif
+
+static psa_status_t its_to_psa_error( psa_its_status_t ret )
+{
+ switch( ret )
+ {
+ case PSA_ITS_SUCCESS:
+ return( PSA_SUCCESS );
+
+ case PSA_ITS_ERROR_KEY_NOT_FOUND:
+ return( PSA_ERROR_EMPTY_SLOT );
+
+ case PSA_ITS_ERROR_STORAGE_FAILURE:
+ return( PSA_ERROR_STORAGE_FAILURE );
+
+ case PSA_ITS_ERROR_INSUFFICIENT_SPACE:
+ return( PSA_ERROR_INSUFFICIENT_STORAGE );
+
+ case PSA_ITS_ERROR_INVALID_KEY:
+ case PSA_PS_ERROR_OFFSET_INVALID:
+ case PSA_ITS_ERROR_INCORRECT_SIZE:
+ case PSA_ITS_ERROR_BAD_POINTER:
+ return( PSA_ERROR_INVALID_ARGUMENT );
+
+ case PSA_ITS_ERROR_FLAGS_NOT_SUPPORTED:
+ return( PSA_ERROR_NOT_SUPPORTED );
+
+ case PSA_ITS_ERROR_WRITE_ONCE:
+ return( PSA_ERROR_OCCUPIED_SLOT );
+
+ default:
+ return( PSA_ERROR_UNKNOWN_ERROR );
+ }
+}
+
+static uint32_t psa_its_identifier_of_slot( psa_key_slot_t key )
+{
+ return( key );
+}
+
+psa_status_t psa_crypto_storage_load( const psa_key_slot_t key, uint8_t *data,
+ size_t data_size )
+{
+ psa_its_status_t ret;
+ psa_status_t status;
+ uint32_t data_identifier = psa_its_identifier_of_slot( key );
+ struct psa_its_info_t data_identifier_info;
+
+ ret = psa_its_get_info( data_identifier, &data_identifier_info );
+ status = its_to_psa_error( ret );
+ if( status != PSA_SUCCESS )
+ return( status );
+
+ ret = psa_its_get( data_identifier, 0, data_size, data );
+ status = its_to_psa_error( ret );
+
+ return( status );
+}
+
+int psa_is_key_present_in_storage( const psa_key_slot_t key )
+{
+ psa_its_status_t ret;
+ uint32_t data_identifier = psa_its_identifier_of_slot( key );
+ struct psa_its_info_t data_identifier_info;
+
+ ret = psa_its_get_info( data_identifier, &data_identifier_info );
+
+ if( ret == PSA_ITS_ERROR_KEY_NOT_FOUND )
+ return( 0 );
+ return( 1 );
+}
+
+psa_status_t psa_crypto_storage_store( const psa_key_slot_t key,
+ const uint8_t *data,
+ size_t data_length )
+{
+ psa_its_status_t ret;
+ psa_status_t status;
+ uint32_t data_identifier = psa_its_identifier_of_slot( key );
+ struct psa_its_info_t data_identifier_info;
+
+ if( psa_is_key_present_in_storage( key ) == 1 )
+ return( PSA_ERROR_OCCUPIED_SLOT );
+
+ ret = psa_its_set( data_identifier, data_length, data, 0 );
+ status = its_to_psa_error( ret );
+ if( status != PSA_SUCCESS )
+ {
+ return( PSA_ERROR_STORAGE_FAILURE );
+ }
+
+ ret = psa_its_get_info( data_identifier, &data_identifier_info );
+ status = its_to_psa_error( ret );
+ if( status != PSA_SUCCESS )
+ {
+ goto exit;
+ }
+
+ if( data_identifier_info.size != data_length )
+ {
+ status = PSA_ERROR_STORAGE_FAILURE;
+ goto exit;
+ }
+
+exit:
+ if( status != PSA_SUCCESS )
+ psa_its_remove( data_identifier );
+ return( status );
+}
+
+psa_status_t psa_destroy_persistent_key( const psa_key_slot_t key )
+{
+ psa_its_status_t ret;
+ uint32_t data_identifier = psa_its_identifier_of_slot( key );
+ struct psa_its_info_t data_identifier_info;
+
+ ret = psa_its_get_info( data_identifier, &data_identifier_info );
+ if( ret == PSA_ITS_ERROR_KEY_NOT_FOUND )
+ return( PSA_SUCCESS );
+
+ if( psa_its_remove( data_identifier ) != PSA_ITS_SUCCESS )
+ return( PSA_ERROR_STORAGE_FAILURE );
+
+ ret = psa_its_get_info( data_identifier, &data_identifier_info );
+ if( ret != PSA_ITS_ERROR_KEY_NOT_FOUND )
+ return( PSA_ERROR_STORAGE_FAILURE );
+
+ return( PSA_SUCCESS );
+}
+
+psa_status_t psa_crypto_storage_get_data_length( const psa_key_slot_t key,
+ size_t *data_length )
+{
+ psa_its_status_t ret;
+ psa_status_t status;
+ uint32_t data_identifier = psa_its_identifier_of_slot( key );
+ struct psa_its_info_t data_identifier_info;
+
+ ret = psa_its_get_info( data_identifier, &data_identifier_info );
+ status = its_to_psa_error( ret );
+ if( status != PSA_SUCCESS )
+ return( status );
+
+ *data_length = (size_t) data_identifier_info.size;
+
+ return( PSA_SUCCESS );
+}
+
+#endif /* MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C */
diff --git a/library/version_features.c b/library/version_features.c
index 7ef899717..af8149052 100644
--- a/library/version_features.c
+++ b/library/version_features.c
@@ -420,6 +420,9 @@ static const char *features[] = {
#if defined(MBEDTLS_PSA_CRYPTO_SPM)
"MBEDTLS_PSA_CRYPTO_SPM",
#endif /* MBEDTLS_PSA_CRYPTO_SPM */
+#if defined(MBEDTLS_PSA_HAS_ITS_IO)
+ "MBEDTLS_PSA_HAS_ITS_IO",
+#endif /* MBEDTLS_PSA_HAS_ITS_IO */
#if defined(MBEDTLS_RSA_NO_CRT)
"MBEDTLS_RSA_NO_CRT",
#endif /* MBEDTLS_RSA_NO_CRT */
@@ -693,6 +696,9 @@ static const char *features[] = {
#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C)
"MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C",
#endif /* MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C */
+#if defined(MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C)
+ "MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C",
+#endif /* MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C */
#if defined(MBEDTLS_RIPEMD160_C)
"MBEDTLS_RIPEMD160_C",
#endif /* MBEDTLS_RIPEMD160_C */
diff --git a/scripts/config.pl b/scripts/config.pl
index 69c6d5fce..6d02ec05c 100755
--- a/scripts/config.pl
+++ b/scripts/config.pl
@@ -97,6 +97,8 @@ MBEDTLS_PKCS11_C
MBEDTLS_NO_UDBL_DIVISION
MBEDTLS_NO_64BIT_MULTIPLICATION
MBEDTLS_PSA_CRYPTO_SPM
+MBEDTLS_PSA_HAS_ITS_IO
+MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C
_ALT\s*$
);
@@ -118,6 +120,8 @@ MBEDTLS_PLATFORM_TIME_ALT
MBEDTLS_PLATFORM_FPRINTF_ALT
MBEDTLS_PSA_CRYPTO_STORAGE_C
MBEDTLS_PSA_CRYPTO_STORAGE_FILE_C
+MBEDTLS_PSA_CRYPTO_STORAGE_ITS_C
+MBEDTLS_PSA_HAS_ITS_IO
);
# Things that should be enabled in "full" even if they match @excluded
diff --git a/visualc/VS2010/mbedTLS.vcxproj b/visualc/VS2010/mbedTLS.vcxproj
index 91cf2f0fc..5d57a7504 100644
--- a/visualc/VS2010/mbedTLS.vcxproj
+++ b/visualc/VS2010/mbedTLS.vcxproj
@@ -291,6 +291,7 @@
+