Skip to content

NVStore: already deprecated implementation removed #12017

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Dec 5, 2019
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 1 addition & 2 deletions TESTS/configs/baremetal.json
Original file line number Diff line number Diff line change
Expand Up @@ -32,8 +32,7 @@
"events",
"kv-global-api",
"sd",
"qspif",
"nvstore"
"qspif"
],
"target_overrides": {
"*": {
Expand Down
4 changes: 2 additions & 2 deletions TESTS/host_tests/trng_reset.py
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@
This script is the host script for trng test sequence, it send the
step signaling sequence and receive and transmit data to the device after
reset if necesarry (default loading and storing mechanism while reseting the device
is NVstore, in case NVstore isn't enabled we'll use current infrastructure,
is KVStore, in case KVStore isn't enabled we'll use current infrastructure,
for more details see main.cpp file)
"""

Expand Down Expand Up @@ -142,4 +142,4 @@ def test_steps(self):
self.send_kv(MSG_KEY_EXIT, MSG_VALUE_DUMMY)

# The sequence is correct -- test passed.
yield
yield
3 changes: 1 addition & 2 deletions TESTS/integration/COMMON/sample.txt
Original file line number Diff line number Diff line change
Expand Up @@ -267,7 +267,6 @@ The [storage APIs](storage.html) include file system APIs, for file system opera
<td><a href="littlefilesystem.html">LittleFileSystem</a></td>
<td><a href="chainingblockdevice.html">ChainingBlockDevice</a></td>
<td><a href="../apis/dataflashblockdevice.html">DataFlashBlockDevice</a></td>
<td><a href="nvstore.html">NVStore</a></td>
</tr>
<tr>
<td><a href="static-global-api.html">Static Global API</a></td>
Expand Down Expand Up @@ -3115,4 +3114,4 @@ An application can extend capabilities of `SimpleMessageParser` by adding new re

- [MessageParser](messageparser.html) API reference.
- [MessageBuilder](messagebuilder.html) API reference.
- [NFC architecture](../reference/nfc-technology.html).
- [NFC architecture](../reference/nfc-technology.html).
1 change: 0 additions & 1 deletion UNITTESTS/empty_baseline/unittest.cmake
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,6 @@ set(unittest-sources
../features/storage/kvstore/conf/kv_config.cpp
../features/storage/kvstore/filesystemstore/FileSystemStore.cpp
../features/storage/system_storage/SystemStorage.cpp
../features/storage/nvstore/source/nvstore.cpp
../features/storage/blockdevice/ChainingBlockDevice.cpp
../features/storage/blockdevice/ReadOnlyBlockDevice.cpp
../features/storage/blockdevice/SlicingBlockDevice.cpp
Expand Down
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "tfm-s",
"macros": ["MBED_FAULT_HANDLER_DISABLED", "BYPASS_NVSTORE_CHECK=1"],
"macros": ["MBED_FAULT_HANDLER_DISABLED"],
"config": {
"max_ns_thread_count": {
"help": "maximum allowed number of non-secure threads",
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -20,8 +20,6 @@ Below there is a list of some examples to explain the motivation and the need fo
examples:
- TDBStore needs to know if there are flash characteristics for the block device and if there aren�t it should use
FlashSimBlockDevice to simulate a flash BlockDevice.
- TDBStore should not co-exists with NVStore, but this is true only if TDBStore is running on internal memory. Therefore if TDBStore running on
internal memory and NVStore is also there an error should be raised.
- When creating a file system you would prefer working with FAT on top of SD while LITTLEFS on top of any flash block device.
Those preference in favor of better performance.

Expand Down
12 changes: 6 additions & 6 deletions features/device_key/README.md
Original file line number Diff line number Diff line change
@@ -1,31 +1,31 @@
## DeviceKey

DeviceKey is a mechanism that implements key derivation from a root of trust key. The DeviceKey mechanism generates symmetric keys that security features need. You can use these keys for encryption, authentication and more. The DeviceKey API allows key derivation without exposing the actual root of trust, to reduce the possibility of accidental exposure of the root of trust outside the device.
DeviceKey is a mechanism that implements key derivation from a Root of Trust(RoT) key. The DeviceKey mechanism generates symmetric keys that security features need. You can use these keys for encryption, authentication and more. The DeviceKey API allows key derivation without exposing the actual RoT, to reduce the possibility of accidental exposure of the RoT outside the device.

We have implemented DeviceKey according to NIST SP 800-108, section "KDF in Counter Mode", with AES-CMAC as the pseudorandom function.

### Root of Trust

The root of trust key, which DeviceKey uses to derive additional keys, is generated using the hardware random generator if it exists, or using a key injected to the device in the production process.
The RoT key, which DeviceKey uses to derive additional keys, is generated using the hardware random generator if it exists, or using a key injected to the device in the production process.

The characteristics required by this root of trust are:
The characteristics required by this RoT are:

- It must be unique per device.
- It must be difficult to guess.
- It must be at least 128 bits.
- It must be kept secret.

The DeviceKey feature keeps the root of trust key in internal storage, using the NVStore component. Internal storage provides protection from external physical attacks to the device.
The DeviceKey feature keeps the RoT key in internal storage, using the KVStore component. Internal storage provides protection from external physical attacks to the device.

The root of trust is generated at the first use of DeviceKey if the true random number generator is available in the device. If no true random number generator is available, you must pass the injected root of trust key to the DeviceKey before you call the key derivation API.
The RoT is generated at the first use of DeviceKey if the True Random Number Generator(TRNG) is available in the device. If no TRNG is available, you must pass the injected RoT key to the DeviceKey before you call the key derivation API.

### Key derivation API

`generate_derived_key`: This API generates a new key based on a string (salt) the caller provides. The same key is generated for the same salt. Generated keys can be 128 or 256 bits in length.

#### Root of Trust Injection API

`device_inject_root_of_trust`: You must call this API once in the lifecycle of the device, before any call to key derivation, if the device does not support True Random Number Generator (`DEVICE_TRNG` is not defined).
`device_inject_root_of_trust`: You must call this API once in the lifecycle of the device, before any call to key derivation, if the device does not support TRNG (`DEVICE_TRNG` is not defined).

#### Using DeviceKey

Expand Down
16 changes: 0 additions & 16 deletions features/storage/kvstore/tdbstore/TDBStore.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -24,10 +24,6 @@
#include "mbed_error.h"
#include "mbed_wait_api.h"
#include "MbedCRC.h"
//Bypass the check of NVStore co existance if compiled for TARGET_TFM
#if !(BYPASS_NVSTORE_CHECK)
#include "features/storage/system_storage/SystemStorage.h"
#endif

using namespace mbed;

Expand Down Expand Up @@ -1016,18 +1012,6 @@ int TDBStore::init()
goto end;
}

//Bypass the check of NVStore co existance if compiled for TARGET_TFM
#if !(BYPASS_NVSTORE_CHECK)

//Check if we are on internal memory && try to set the internal memory for TDBStore use.
if (strcmp(_bd->get_type(), "FLASHIAP") == 0 &&
avoid_conflict_nvstore_tdbstore(TDBSTORE) == MBED_ERROR_ALREADY_INITIALIZED) {

MBED_ERROR(MBED_ERROR_ALREADY_INITIALIZED, "TDBStore in internal memory can not be initialize when NVStore is in use");
}

#endif

_max_keys = initial_max_keys;

ram_table = new ram_table_entry_t[_max_keys];
Expand Down
60 changes: 0 additions & 60 deletions features/storage/nvstore/README.md

This file was deleted.

Loading